diff --git a/.claude/commands/triage.md b/.claude/commands/triage.md
index 188a69fb49de9..5b50228e254a2 100644
--- a/.claude/commands/triage.md
+++ b/.claude/commands/triage.md
@@ -1 +1,12 @@
-Analyze this CI failure and find a root cause and permanent solution:
+Investigate this StackRox CI failure by launching the `stackrox-ci-failure-investigator`
+subagent (via the Agent tool). Pass it the input below — a Prow build ID or URL, a failing
+job name, a ROX-XXXXX ticket, or pasted logs — and have it download and read the CI
+artifacts (Prow step logs plus the collected k8s service logs, pod descriptions, events, and
+node capacity) before forming a hypothesis.
+
+Do not guess at a cause or attribute the failure to flakiness or a version being behind until
+the artifacts rule everything else out. Follow the causal chain to its origin — a failed
+check is usually a downstream symptom. Do not write code until the root cause is confirmed
+with the user.
+
+$ARGUMENTS
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 3c1d2f7d70746..d318cf685d35c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -71,7 +71,6 @@ tests/roxctl/bats-tests/local/central-migrate-to-operator.bats   @stackrox/insta
 # Scanner team's responsibilities include anything related to the scanner itself and scanning utilities
 # such as vulnerability uploading and image integrations.
 /.github/workflows/scanner*                               @stackrox/scanner
-/.github/workflows/update_scanner_periodic.yaml           @stackrox/scanner
 /central/image/service/                                   @stackrox/scanner
 /central/imageintegration/service/                        @stackrox/scanner
 /central/imageintegration/store/defaults.go               @stackrox/scanner
diff --git a/.github/actions/cache-go-dependencies/action.yaml b/.github/actions/cache-go-dependencies/action.yaml
index 0d70c4ee4ee3e..b4696c0ecd0b4 100644
--- a/.github/actions/cache-go-dependencies/action.yaml
+++ b/.github/actions/cache-go-dependencies/action.yaml
@@ -15,8 +15,25 @@ runs:
     - name: Determine Go cache paths
       id: cache-paths
       run: |
-        echo "GOCACHE=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
-        echo "GOARCH=$(go env GOARCH)" >> "$GITHUB_OUTPUT"
+        # Keep assignments separate from echo so Go failures are not masked.
+        if ! gocache=$(go env GOCACHE); then
+          echo "::error::Failed to determine GOCACHE: go env GOCACHE failed. See the Go error above."
+          exit 1
+        fi
+        if [[ -z "$gocache" ]]; then
+          echo "::error::go env GOCACHE returned an empty value. Cannot configure the Go build cache."
+          exit 1
+        fi
+        if ! goarch=$(go env GOARCH); then
+          echo "::error::Failed to determine GOARCH: go env GOARCH failed. See the Go error above."
+          exit 1
+        fi
+        if [[ -z "$goarch" ]]; then
+          echo "::error::go env GOARCH returned an empty value. Cannot configure the Go build cache."
+          exit 1
+        fi
+        echo "GOCACHE=$gocache" >> "$GITHUB_OUTPUT"
+        echo "GOARCH=$goarch" >> "$GITHUB_OUTPUT"
         echo "TAG=${{ github.sha }}" >> "$GITHUB_OUTPUT"
         # Hash go.mod once for use in cache keys. When dependencies change,
         # the GOCACHE must be invalidated because Go's module index caches
@@ -67,7 +84,7 @@ runs:
     # Registered AFTER cache steps so the post-step runs BEFORE cache save
     # (GHA runs post-steps in reverse registration order).
     - name: Trim stale GOCACHE entries (post-step)
-      uses: gacts/run-and-post-run@598d7a875d5620e0457490555b5e18e46082aa47 # v1.4.0
+      uses: gacts/run-and-post-run@fc6503862aba998e2f2123225ad63c09a92ed46e # v1.4.0
       with:
         post: >
           set +e;
diff --git a/.github/actions/job-preamble/action.yaml b/.github/actions/job-preamble/action.yaml
index 9080746c11019..8bb2eb47b1154 100644
--- a/.github/actions/job-preamble/action.yaml
+++ b/.github/actions/job-preamble/action.yaml
@@ -157,7 +157,7 @@ runs:
         echo "container_runtime=$([[ -f /.dockerenv ]] && echo container || echo None)" >> "$GITHUB_OUTPUT"
 
     - name: Record job info
-      uses: gacts/run-and-post-run@598d7a875d5620e0457490555b5e18e46082aa47 # v1.4.0
+      uses: gacts/run-and-post-run@fc6503862aba998e2f2123225ad63c09a92ed46e # v1.4.0
       id: record_job_info
       env:
         GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ inputs.gcp-account }}
diff --git a/.github/actions/notify-slack-on-failure/action.yaml b/.github/actions/notify-slack-on-failure/action.yaml
new file mode 100644
index 0000000000000..e5c014585b920
--- /dev/null
+++ b/.github/actions/notify-slack-on-failure/action.yaml
@@ -0,0 +1,61 @@
+name: Notify Slack on failure
+description: >
+  Posts a Slack failure notification for the current workflow run. By
+  default, collects ::error:: annotations and per-job status via the GitHub
+  API and builds a message from that data; pass `message` to post a fixed, pre-built
+  message instead (no GitHub API calls). Requires `permissions: {checks:
+  read, actions: read}` on the calling job unless `message` is set.
+inputs:
+  slack-webhook:
+    description: "Slack incoming webhook URL to post to."
+    required: true
+  github-token:
+    description: "Token used to query the Actions/Checks API. Not needed when `message` is set."
+    required: false
+    default: ${{ github.token }}
+  mention:
+    description: "Optional Slack mention/subteam tag prepended to the message (e.g. '<!subteam^SXXXX|team-name>')."
+    required: false
+    default: ""
+  context:
+    description: "Optional extra line of context inserted near the top of the message (e.g. 'Source: alpine'). Ignored when `message` is set."
+    required: false
+    default: ""
+  job-name-filter:
+    description: >
+      Optional substring used to narrow annotation/job-status collection to
+      jobs whose name contains it. Use this when the calling job is one of
+      several matrix legs sharing the same workflow run, so the message only
+      covers this leg. Ignored when `message` is set.
+    required: false
+    default: ""
+  include-successful-jobs:
+    description: >
+      If "true", also inspect jobs that did not fail: any job with real
+      ::error:: annotations is included even if it concluded successfully.
+      Jobs with no annotations are omitted either way. Use this when the
+      caller wants to alert on a job that intentionally does not fail
+      despite reporting real errors. Ignored when `message` is set.
+    required: false
+    default: ""
+  message:
+    description: "If set, this literal text is posted instead of collecting annotations/job status."
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+  - shell: bash
+    run: "${{ github.action_path }}/notify-slack-on-failure.sh"
+    env:
+      SLACK_WEBHOOK: ${{ inputs.slack-webhook }}
+      GH_TOKEN: ${{ inputs.github-token }}
+      MENTION: ${{ inputs.mention }}
+      CONTEXT: ${{ inputs.context }}
+      JOB_NAME_FILTER: ${{ inputs.job-name-filter }}
+      INCLUDE_SUCCESSFUL_JOBS: ${{ inputs.include-successful-jobs }}
+      MESSAGE: ${{ inputs.message }}
+      REPO: ${{ github.repository }}
+      RUN_ID: ${{ github.run_id }}
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      WORKFLOW: ${{ github.workflow }}
diff --git a/.github/actions/notify-slack-on-failure/notify-slack-on-failure.sh b/.github/actions/notify-slack-on-failure/notify-slack-on-failure.sh
new file mode 100755
index 0000000000000..27ed01e711099
--- /dev/null
+++ b/.github/actions/notify-slack-on-failure/notify-slack-on-failure.sh
@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# Posts a Slack failure notification to $SLACK_WEBHOOK.
+#
+# Two modes:
+#   - $MESSAGE is set: post that text verbatim (prefixed by $MENTION), no
+#     GitHub API calls are made. Use this when the caller already has a
+#     specific, curated message (e.g. a list of failed sources).
+#   - $MESSAGE is unset: collect ::error:: annotations and per-job status for
+#     the current workflow run via the GitHub API (optionally narrowed to
+#     jobs whose name contains $JOB_NAME_FILTER, useful when this script runs
+#     once per matrix leg of a reusable workflow), and build a message from that data.
+#     If collection itself fails, a degraded but still-informative message is
+#     sent instead of nothing at all.
+#
+# Required env vars: SLACK_WEBHOOK, RUN_URL, WORKFLOW, REPO
+# Used only when $MESSAGE is unset: GH_TOKEN, RUN_ID
+# Optional: MENTION, CONTEXT, MESSAGE, JOB_NAME_FILTER, INCLUDE_SUCCESSFUL_JOBS
+
+set -euo pipefail
+
+: "${SLACK_WEBHOOK:?SLACK_WEBHOOK is required}"
+: "${RUN_URL:?RUN_URL is required}"
+: "${WORKFLOW:?WORKFLOW is required}"
+: "${REPO:?REPO is required}"
+
+MENTION="${MENTION:-}"
+CONTEXT="${CONTEXT:-}"
+MESSAGE="${MESSAGE:-}"
+JOB_NAME_FILTER="${JOB_NAME_FILTER:-}"
+INCLUDE_SUCCESSFUL_JOBS="${INCLUDE_SUCCESSFUL_JOBS:-}"
+
+max_messages_per_job=10
+
+# collect_annotations sets the global SUMMARY and JOB_STATUS variables from
+# the current workflow run's jobs/annotations, optionally narrowed to job
+# names containing $JOB_NAME_FILTER. Returns non-zero on any GitHub API
+# failure.
+collect_annotations() {
+    : "${GH_TOKEN:?GH_TOKEN is required to collect annotations}"
+    : "${RUN_ID:?RUN_ID is required to collect annotations}"
+
+    # --paginate output is multiple JSON docs back-to-back; jq below handles
+    # that as a stream, no --slurp needed.
+    local jobs_json
+    if ! jobs_json=$(gh api "repos/${REPO}/actions/runs/${RUN_ID}/jobs" --paginate); then
+        return 1
+    fi
+
+    if [ -n "$JOB_NAME_FILTER" ]; then
+        jobs_json=$(printf '%s' "$jobs_json" \
+            | jq --arg filter "$JOB_NAME_FILTER" '{ jobs: [.jobs[] | select(.name | contains($filter))] }')
+    fi
+
+    # Jobs to inspect for annotations: only failure-like ones by default; every
+    # job (success included) when INCLUDE_SUCCESSFUL_JOBS is set. Either way,
+    # a successful job only ends up in SUMMARY below if it actually has real
+    # annotations (see the skip check in the loop).
+    local jobs_filter='.jobs[]'
+    if [ "$INCLUDE_SUCCESSFUL_JOBS" != "true" ]; then
+        jobs_filter='.jobs[] | select(.conclusion | IN("failure","timed_out","action_required","neutral","stale","startup_failure"))'
+    fi
+
+    # Plain text: rendered inside a Slack code block, not mrkdwn.
+    SUMMARY=""
+    while IFS=$'\t' read -r job_id job_name job_conclusion failed_step; do
+        # Exclude GitHub's generic "Process completed..." annotation (noise).
+        # --paginate: a job can have >30 annotations (API's page size).
+        local messages
+        if ! messages=$(gh api "repos/${REPO}/check-runs/${job_id}/annotations" --paginate \
+            --jq '.[] | select(.annotation_level == "failure") | select(.message | test("^Process completed with exit code") | not) | .message'); then
+            # Distinct fallback so an API failure isn't confused with "no annotations".
+            messages="(failed to fetch annotations for this job via the GitHub API; see the workflow run directly for details)"
+        fi
+
+        local is_failure_like=false
+        case "$job_conclusion" in
+            failure | timed_out | action_required | neutral | stale | startup_failure) is_failure_like=true ;;
+        esac
+
+        # A successful job with nothing to report contributes nothing (only
+        # relevant when INCLUDE_SUCCESSFUL_JOBS pulled it in above). A job
+        # that actually failed always shows up, even with no annotations.
+        if [ -z "$messages" ] && [ "$is_failure_like" = false ]; then
+            continue
+        fi
+
+        # Blank line between job blocks, but not before the first one.
+        if [ -n "$SUMMARY" ]; then
+            SUMMARY+=$'\n\n'
+        fi
+        SUMMARY+="${job_name}: ${failed_step}"$'\n'
+        if [ -n "$messages" ]; then
+            local total
+            total=$(printf '%s\n' "$messages" | grep -c . || true)
+            SUMMARY+="$(printf '%s\n' "$messages" | sed -n "1,${max_messages_per_job}s/^/  - /p")"
+            if [ "$total" -gt "$max_messages_per_job" ]; then
+                SUMMARY+=$'\n'"  - ... and $((total - max_messages_per_job)) more (see the workflow run for full details)"
+            fi
+        else
+            SUMMARY+="  - (no detailed error annotations found; see the workflow run for details)"
+        fi
+    done < <(printf '%s' "$jobs_json" | jq -r "$jobs_filter"' | [.id, .name, (.conclusion // "in_progress"), ([.steps[]? | select(.conclusion | IN("failure","timed_out","action_required","neutral","stale","startup_failure")) | .name][0] // "unknown step")] | @tsv')
+
+    if [ -z "$SUMMARY" ]; then
+        SUMMARY="(no failed jobs found; see the workflow run for details)"
+    fi
+
+    # Safety-net truncation, on top of the per-job cap above.
+    SUMMARY="${SUMMARY:0:3000}"
+
+    # Status of every (filtered) job, icons matching GitHub's own.
+    JOB_STATUS=""
+    while IFS=$'\t' read -r job_name job_conclusion; do
+        local icon
+        case "$job_conclusion" in
+            success) icon="✅" ;;
+            skipped) icon="⏭️" ;;
+            cancelled) icon="🚫" ;;
+            in_progress) icon="🟡" ;;
+            failure | timed_out | action_required | neutral | stale | startup_failure) icon="❌" ;;
+            *) icon="❔" ;; # genuinely unrecognized future conclusion value
+        esac
+        JOB_STATUS+="${icon} ${job_name}"$'\n'
+    done < <(printf '%s' "$jobs_json" | jq -r '.jobs[] | [.name, (.conclusion // "in_progress")] | @tsv')
+
+    JOB_STATUS="${JOB_STATUS:0:3000}"
+}
+
+context_line=""
+if [ -n "$CONTEXT" ]; then
+    context_line="*Context:* ${CONTEXT}"$'\n'
+fi
+
+if [ -n "$MESSAGE" ]; then
+    text="$MESSAGE"
+elif collect_annotations; then
+    # shellcheck disable=SC2016 # backticks below are a Slack code-block
+    # delimiter, not shell command substitution.
+    text=$(printf '*Failed Workflow:* <%s|%s>\n*Repository:* %s\n%s*Job Status:*\n```\n%s```\n*Failed steps:*\n```\n%s\n```' \
+        "$RUN_URL" "$WORKFLOW" "$REPO" "$context_line" "$JOB_STATUS" "$SUMMARY")
+else
+    # Runs even if annotation collection failed, so a degraded message still
+    # reaches on-call instead of nothing at all.
+    text=$(printf ':warning: *Failed Workflow:* <%s|%s>\n*Repository:* %s\n%sCould not collect failure annotations for this run (the collection step itself failed) -- please check the workflow run directly for details.' \
+        "$RUN_URL" "$WORKFLOW" "$REPO" "$context_line")
+fi
+
+if [ -n "$MENTION" ]; then
+    text="${MENTION} ${text}"
+fi
+
+# --retry-all-errors means a slow-but-eventually-successful post could be
+# retried and sent twice; unlikely in practice, but possible.
+jq -n --arg text "$text" '{text: $text}' \
+    | curl --fail --silent --show-error \
+        --retry 3 --retry-all-errors --retry-delay 5 \
+        --connect-timeout 10 --max-time 300 \
+        -X POST -H 'Content-type: application/json' --data @- "$SLACK_WEBHOOK"
diff --git a/.github/docker/images.hcl b/.github/docker/images.hcl
index 4e9de4284681e..b4b6d47ac7760 100644
--- a/.github/docker/images.hcl
+++ b/.github/docker/images.hcl
@@ -28,7 +28,7 @@ group "databases" {
   targets = ["central-db", "scanner-v4-db"]
 }
 
-# Central database (PostgreSQL 15)
+# Central database (PostgreSQL 16)
 target "central-db" {
   context = "image/postgres"
   dockerfile = "Dockerfile"
diff --git a/.github/labeler.yml b/.github/labeler.yml
index 73a8695553f5c..7a345d52c9ba6 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -60,7 +60,7 @@ ci-all-qa-tests:
 - changed-files:
   - any-glob-to-any-file:
     - COLLECTOR_VERSION
-    - SCANNER_VERSION
+    - FACT_VERSION
 
 backport:
 - base-branch: 'release-*'
diff --git a/.github/test-images/postgres.dockerfile b/.github/test-images/postgres.dockerfile
index a1556f5177f31..bb498f0494622 100644
--- a/.github/test-images/postgres.dockerfile
+++ b/.github/test-images/postgres.dockerfile
@@ -1,3 +1,3 @@
-# Postgres 15 image for unit test CI. Referenced by unit-tests.yaml.
+# Postgres 16 image for unit test CI. Referenced by unit-tests.yaml.
 # Dependabot auto-bumps this digest via the docker ecosystem config.
-FROM quay.io/sclorg/postgresql-15-c9s@sha256:77c1e962234c598f3ed2b5e581f0845fca333bd262e9b0ee542bf8fa96fbc03d
+FROM quay.io/sclorg/postgresql-16-c9s@sha256:d33717fd33c1a4b11afef94568d0c20812a19d62fb8c633fadee1e491e2edd4a
diff --git a/.github/workflows/add-new-pr-to-oss-triaging.yml b/.github/workflows/add-new-pr-to-oss-triaging.yml
index dfb5b52a95100..9d7a10996440f 100644
--- a/.github/workflows/add-new-pr-to-oss-triaging.yml
+++ b/.github/workflows/add-new-pr-to-oss-triaging.yml
@@ -9,7 +9,7 @@ env:
 jobs:
   check-pr-if-external:
     name: Add external label to pull request if outside StackRox
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       GH_TOKEN: ${{ github.token }}
       BASE_REPO: ${{ github.repository }}
diff --git a/.github/workflows/add-vms-to-cluster.yml b/.github/workflows/add-vms-to-cluster.yml
index 58eb968bd3a87..0ace3f5f384e7 100644
--- a/.github/workflows/add-vms-to-cluster.yml
+++ b/.github/workflows/add-vms-to-cluster.yml
@@ -1,5 +1,5 @@
-name: "Add VMs to Cluster"
-run-name: "Add ${{ inputs.num-vms }} ${{ inputs.vm-os }} VMs to ${{ inputs.cluster-name }}"
+name: "Ensure VMs on Cluster"
+run-name: "Ensure ${{ inputs.num-vms }} ${{ inputs.vm-os }} VMs on ${{ inputs.cluster-name }}"
 
 on:
   workflow_dispatch:
@@ -9,7 +9,7 @@ on:
         required: true
         type: string
       num-vms:
-        description: "Number of VMs to deploy"
+        description: "Desired count of {os}-1..N, not how many to add. Existing VMs are reused; 2 is a no-op if rhel9-1 and rhel9-2 already exist."
         required: false
         default: 1
         type: number
@@ -19,6 +19,7 @@ on:
         default: "rhel9"
         type: choice
         options:
+          - rhel8
           - rhel9
           - rhel10
       ssh-public-key:
@@ -29,7 +30,7 @@ on:
 
 jobs:
   add-vms:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
       INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
diff --git a/.github/workflows/audit-backport-prs.yml b/.github/workflows/audit-backport-prs.yml
index 08ceefc68c375..b220cb7c4e725 100644
--- a/.github/workflows/audit-backport-prs.yml
+++ b/.github/workflows/audit-backport-prs.yml
@@ -29,7 +29,7 @@ env:
 jobs:
   properties:
     name: Read repository properties
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.properties.outputs.slack-channel, steps.properties.outputs.dry-slack-channel))[(github.event_name == 'workflow_dispatch' && inputs.dry_run) || github.event_name == 'pull_request'] }}
     steps:
@@ -40,7 +40,7 @@ jobs:
         run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT"
 
   audit:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [properties]
     permissions:
       contents: read
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 5ae4329f1151d..1a18592aebca3 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   auto-merge:
     name: Enable auto-merge for eligible PRs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.repository_owner == 'stackrox'
 
     steps:
diff --git a/.github/workflows/backport-pr.yaml b/.github/workflows/backport-pr.yaml
index f30c5dd830a9a..dc54e31818fce 100644
--- a/.github/workflows/backport-pr.yaml
+++ b/.github/workflows/backport-pr.yaml
@@ -1,14 +1,22 @@
 name: Backport PR to release branch
 on:
-  pull_request_target:
+  # From security considerations, it will not be possible for PRs from forks to be backported with this workflow.
+  pull_request:
     types:
       - closed
       - labeled
 
+# Disables permissions of the default GITHUB_TOKEN, it's not used anyway.
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   backport:
     name: Backport
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Only react to merged PRs for security reasons.
     # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
     if: >
@@ -17,11 +25,40 @@ jobs:
         github.event.action == 'closed'
         || (
           github.event.action == 'labeled'
-          && contains(github.event.label.name, 'backport')
+          && startsWith(github.event.label.name, 'backport release-')
         )
       )
     steps:
       - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # ratchet:tibdex/backport@v2.0.4
+        id: backport
         with:
           github_token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
-          title_template: "<%= title %>"
+          title_template: "<%= title %> (<%= base %>)"
+          label_pattern: '^backport (?<base>(release-[0-9]+\.[0-9]+))$'
+          labels_template: '["backport"]'
+
+      - name: Assign backport PRs to original author
+        if: steps.backport.outcome == 'success' && steps.backport.outputs.created_pull_requests != '{}'
+        env:
+          GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
+          CREATED_PRS: ${{ steps.backport.outputs.created_pull_requests }}
+          ORIGINAL_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          set -u
+          echo "Created PRs: ${CREATED_PRS}"
+          echo "Original author: ${ORIGINAL_AUTHOR}"
+
+          # Check if the original author can be assigned
+          if gh api --silent "repos/${{ github.repository }}/assignees/${ORIGINAL_AUTHOR}" 2>/dev/null; then
+            echo "Author ${ORIGINAL_AUTHOR} is eligible for assignment"
+
+            # Parse the JSON object and extract PR numbers
+            for pr_number in $(echo "${CREATED_PRS}" | jq -r '.[]'); do
+              echo "Assigning PR #${pr_number} to ${ORIGINAL_AUTHOR}"
+              if ! gh pr edit "${pr_number}" --add-assignee "${ORIGINAL_AUTHOR}" --repo "${{ github.repository }}"; then
+                >&2 echo "Warning: Failed to assign PR #${pr_number} to ${ORIGINAL_AUTHOR}"
+              fi
+            done
+          else
+            >&2 echo "Warning: Author ${ORIGINAL_AUTHOR} cannot be assigned to PRs in this repository"
+          fi
diff --git a/.github/workflows/batch-load-test-metrics.yml b/.github/workflows/batch-load-test-metrics.yml
index 8168c7cfd63fd..f798db49af93d 100644
--- a/.github/workflows/batch-load-test-metrics.yml
+++ b/.github/workflows/batch-load-test-metrics.yml
@@ -10,7 +10,7 @@ concurrency: Batch load test metrics
 jobs:
   batch-load-test-metrics:
     if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11@sha256:df3459cf038e73775314b3a5d36d14dda41e6df438a0273c9efa8d23e0f2358a # ratchet:quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11
     steps:
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6776ef11d814c..607c34fe7803f 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -164,7 +164,7 @@ jobs:
       ROX_PRODUCT_BRANDING: ${{ matrix.branding }}
       # For consistency with `image/rhel/konflux.Dockerfile`, see comment there.
       UI_PKG_INSTALL_EXTRA_ARGS: --ignore-scripts
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -205,7 +205,7 @@ jobs:
 
   pre-build-cli:
     needs: define-job-matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}
       SHORTCOMMIT: ${{ needs.define-job-matrix.outputs.short-commit }}
@@ -283,7 +283,7 @@ jobs:
       # race-condition-debug - built with -race
       matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).pre_build_go_binaries }}
     needs: define-job-matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}
       SHORTCOMMIT: ${{ needs.define-job-matrix.outputs.short-commit }}
@@ -363,7 +363,7 @@ jobs:
           compression-level: 1
 
   pre-build-docs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -394,7 +394,7 @@ jobs:
             image/rhel/docs
 
   pre-build-oss-notice:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -435,7 +435,7 @@ jobs:
         path: image/rhel/THIRD_PARTY_NOTICES
 
   build-and-push-db:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - define-job-matrix
     if: ${{ !cancelled() }}
@@ -498,7 +498,7 @@ jobs:
       - name: Build and push DB images in parallel with bake
         if: |
           github.event_name == 'push' || !github.event.pull_request.head.repo.fork
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # ratchet:docker/bake-action@v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # ratchet:docker/bake-action@v7.4.0
         with:
           source: .
           files: .github/docker/images.hcl
@@ -541,7 +541,7 @@ jobs:
             "docker://quay.io/rhacs-eng/scanner-v4-db:${{ env.BUILD_TAG }}"
 
   build-operator-bundle:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       QUAY_ORG: rhacs-eng
       QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}
@@ -579,7 +579,7 @@ jobs:
 
   build-and-push-main:
     # Use native arm64 runner to avoid QEMU emulation overhead (~2x slower).
-    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-24.04' }}
     needs:
       - define-job-matrix
       - pre-build-cli
@@ -755,7 +755,7 @@ jobs:
             push_main_image_set "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "${{ matrix.arch }}"
 
   push-matching-collector-scanner:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - define-job-matrix
     if: ${{ !cancelled() }}
@@ -788,7 +788,7 @@ jobs:
           push_matching_collector_scanner_images "${{ env.ROX_PRODUCT_BRANDING }}"
 
   push-main-manifests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
     - define-job-matrix
     - build-and-push-main
@@ -911,7 +911,7 @@ jobs:
         message-path: build-comment.md
 
   build-and-push-operator:
-    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-24.04' }}
     needs:
       - define-job-matrix
       - pre-build-go-binaries
@@ -1027,7 +1027,7 @@ jobs:
             echo "Operator image push completed successfully"
 
   build-and-push-scanner:
-    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-24.04' }}
     needs:
       - define-job-matrix
       - build-and-push-db
@@ -1111,7 +1111,7 @@ jobs:
           push_scanner_image_set "${{ matrix.registry }}" "${{ matrix.arch }}"
 
   push-scanner-manifests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - define-job-matrix
       - build-and-push-scanner
@@ -1171,7 +1171,7 @@ jobs:
           push_scanner_image_manifest_lists "${{ matrix.registry }}" "$architectures"
 
   push-operator-manifests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
     - define-job-matrix
     - build-and-push-operator
@@ -1228,7 +1228,7 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'scan-go-binaries')
     env:
       ARTIFACT_DIR: junit-reports/
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
     - pre-build-cli
     - pre-build-go-binaries
@@ -1289,7 +1289,7 @@ jobs:
           contains(github.event.pull_request.labels.*.name, 'ci-test-github-action-slack-messages')
       )
     name: Post failure message to Slack
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - build-and-push-db
       - build-and-push-main
diff --git a/.github/workflows/check-crd-compatibility.yaml b/.github/workflows/check-crd-compatibility.yaml
index 95ba18adc4a75..d5d2ba0ffd62b 100644
--- a/.github/workflows/check-crd-compatibility.yaml
+++ b/.github/workflows/check-crd-compatibility.yaml
@@ -23,7 +23,7 @@ jobs:
   check-crd-compatibility:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11@sha256:df3459cf038e73775314b3a5d36d14dda41e6df438a0273c9efa8d23e0f2358a # ratchet:quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11
     outputs:
@@ -88,19 +88,17 @@ jobs:
 
     - name: Run crdify for platform operator
       run: |
-        set -e
+        set -euo pipefail
         old_path="$PWD/.old-stackrox/operator/config/crd/bases"
         new_path="$PWD/operator/config/crd/bases"
-        crdify="go run -C operator/tools/crdify sigs.k8s.io/crdify --config=config.yaml"
-        set -x
-        $crdify "file://${old_path}/platform.stackrox.io_securedclusters.yaml" "file://${new_path}/platform.stackrox.io_securedclusters.yaml"
-        $crdify "file://${old_path}/platform.stackrox.io_centrals.yaml" "file://${new_path}/platform.stackrox.io_centrals.yaml"
+        crdify=".github/workflows/scripts/crdify.sh"
+        $crdify "${old_path}/platform.stackrox.io_securedclusters.yaml" "${new_path}/platform.stackrox.io_securedclusters.yaml"
+        $crdify "${old_path}/platform.stackrox.io_centrals.yaml" "${new_path}/platform.stackrox.io_centrals.yaml"
 
     - name: Run crdify for config operator
       run: |
-        set -e
+        set -euo pipefail
         old_path="$PWD/.old-stackrox/config-controller/config/crd/bases"
         new_path="$PWD/config-controller/config/crd/bases"
-        crdify="go run -C operator/tools/crdify sigs.k8s.io/crdify --config=config.yaml"
-        set -x
-        $crdify "file://${old_path}/config.stackrox.io_securitypolicies.yaml" "file://${new_path}/config.stackrox.io_securitypolicies.yaml"
+        crdify=".github/workflows/scripts/crdify.sh"
+        $crdify "${old_path}/config.stackrox.io_securitypolicies.yaml" "${new_path}/config.stackrox.io_securitypolicies.yaml"
diff --git a/.github/workflows/check-crd-frozen-on-release.yaml b/.github/workflows/check-crd-frozen-on-release.yaml
new file mode 100644
index 0000000000000..981253e8cfb15
--- /dev/null
+++ b/.github/workflows/check-crd-frozen-on-release.yaml
@@ -0,0 +1,140 @@
+# On release branches that already shipped their first (.0) release, CRD schemas
+# must stay frozen: no changes to the platform (Central/SecuredCluster) and
+# config (SecurityPolicy) CRDs are allowed in a patch release.
+#
+# The freeze only kicks in once the first release of the branch has been tagged.
+# The tag is derived from the branch name: release-X.Y -> X.Y.0. Before X.Y.0 is
+# tagged the branch is still stabilizing toward its first release, so CRD changes
+# are still permitted and this check is skipped.
+#
+# When the freeze is active:
+# - For PRs targeting a release branch, we diff the release branch (target)
+#   against the PR tip.
+# - For commits pushed to a release branch, we diff the first release tag (X.Y.0)
+#   against the current commit, so only changes made after the first release are
+#   considered.
+#
+# See https://redhat.atlassian.net/browse/ROX-36823
+name: Check CRDs Frozen on Release Branches
+
+on:
+  push:
+    branches:
+    - release-*
+  pull_request:
+    # Only PRs whose base (target) branch is a release branch.
+    branches:
+    - release-*
+    types:
+    - opened
+    - reopened
+    - synchronize
+
+permissions:
+  contents: read
+
+jobs:
+  check-crds-frozen:
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout stackrox/stackrox
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+      with:
+        # Full history so we can compute the point from which the release branch
+        # (or the PR) diverged.
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+    - name: Ensure CRD schemas are unchanged
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        BASE_REF: ${{ github.event.pull_request.base.ref }}
+        BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        # Determine the release branch this event concerns.
+        if [[ "$EVENT_NAME" == "pull_request" ]]; then
+          branch="$BASE_REF"
+        else
+          branch="$GITHUB_REF_NAME"
+        fi
+
+        # Derive the first release tag from the branch name: release-X.Y -> X.Y.0.
+        # Anything that is not a plain release-X.Y branch (e.g. a scanner branch)
+        # is out of scope for this check.
+        if [[ ! "$branch" =~ ^release-([0-9]+)\.([0-9]+)$ ]]; then
+          echo "Branch '$branch' is not a standard release-X.Y branch; skipping CRD freeze check."
+          exit 0
+        fi
+        first_release_tag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
+
+        # Only freeze CRDs for patch releases, i.e. once the first (.0) release of
+        # this branch has been tagged. Before that the branch is still
+        # stabilizing and CRD changes are allowed.
+        #
+        # `git ls-remote --exit-code` distinguishes its outcomes: 0 = the tag
+        # exists, 2 = the tag is definitively absent, any other code = a
+        # transport/other error. We must not treat a transient network failure as
+        # "not tagged" (that would silently disable the freeze), so we retry and
+        # fail closed if we cannot get an authoritative answer.
+        tag_ref="refs/tags/${first_release_tag}"
+        rc=0
+        for attempt in 1 2 3; do
+          rc=0
+          git ls-remote --exit-code --tags origin "$tag_ref" >/dev/null 2>&1 || rc=$?
+          if [[ "$rc" -eq 0 || "$rc" -eq 2 ]]; then
+            break
+          fi
+          echo "git ls-remote for '${tag_ref}' failed (exit $rc); retry ${attempt}/3..." >&2
+          sleep 5
+        done
+
+        case "$rc" in
+          0)
+            echo "First release '${first_release_tag}' is tagged; enforcing CRD freeze for patch releases."
+            ;;
+          2)
+            echo "First release '${first_release_tag}' is not tagged yet; branch is still stabilizing. CRD changes are allowed."
+            exit 0
+            ;;
+          *)
+            echo "::error::Could not determine whether '${first_release_tag}' is tagged (git ls-remote exit $rc). Failing closed."
+            exit 1
+            ;;
+        esac
+
+        # Platform and config CRD manifests that must remain frozen on release
+        # branches.
+        crd_files=(
+          operator/config/crd/bases/platform.stackrox.io_centrals.yaml
+          operator/config/crd/bases/platform.stackrox.io_securedclusters.yaml
+          config-controller/config/crd/bases/config.stackrox.io_securitypolicies.yaml
+        )
+
+        if [[ "$EVENT_NAME" == "pull_request" ]]; then
+          # Diff the release branch (target) against the PR tip.
+          base="$BASE_SHA"
+          head="$HEAD_SHA"
+          echo "Comparing release branch target ($base) against PR tip ($head)"
+        else
+          # Diff the first release tag (X.Y.0) against the current commit, so
+          # only changes made after the first release are considered.
+          head="$GITHUB_SHA"
+          git fetch --no-tags --quiet origin "refs/tags/${first_release_tag}:refs/tags/${first_release_tag}"
+          base="$first_release_tag"
+          echo "Comparing first release tag $base against current commit ($head)"
+        fi
+
+        diff="$(git diff "$base" "$head" -- "${crd_files[@]}")"
+
+        if [[ -n "$diff" ]]; then
+          echo "::error::CRD schema changes are not allowed on release branches (ROX-36823)."
+          echo "The following platform/config CRD changes were detected:"
+          echo "$diff"
+          exit 1
+        fi
+
+        echo "No platform/config CRD schema changes detected. CRDs are frozen. ✅"
diff --git a/.github/workflows/check-pr-title.yaml b/.github/workflows/check-pr-title.yaml
index 5212dfd3ac09b..49afd75bf89a4 100644
--- a/.github/workflows/check-pr-title.yaml
+++ b/.github/workflows/check-pr-title.yaml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   check-title:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       PR_TITLE: ${{ github.event.pull_request.title }}
     steps:
diff --git a/.github/workflows/ci-failures-report.yml b/.github/workflows/ci-failures-report.yml
index 9be7d94707cf8..a2e0e03d9a7bf 100644
--- a/.github/workflows/ci-failures-report.yml
+++ b/.github/workflows/ci-failures-report.yml
@@ -18,7 +18,7 @@ on:
 jobs:
   report-e2e-failures-to-slack:
     if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
diff --git a/.github/workflows/create-clusters.yml b/.github/workflows/create-clusters.yml
index 40d939145dfcc..2693c27c9311c 100644
--- a/.github/workflows/create-clusters.yml
+++ b/.github/workflows/create-clusters.yml
@@ -42,7 +42,7 @@ concurrency: Release automation ${{ inputs.version }}
 
 jobs:
   trim-cluster-names:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       cluster-with-fake-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-fake-load-name-cleaned }}
       cluster-with-real-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-real-load-name-cleaned }}
@@ -64,7 +64,7 @@ jobs:
   clusters:
     name: Setup demo clusters
     needs: trim-cluster-names
-    uses: stackrox/actions/.github/workflows/create-demo-clusters.yml@43bb707aa4f32ead5bfb8d5ab11fb409f971ffc8 # ratchet:stackrox/actions/.github/workflows/create-demo-clusters.yml@v1
+    uses: stackrox/actions/.github/workflows/create-demo-clusters.yml@f3893761af7aff7477e3dde7a4d9656b173fc687 # ratchet:stackrox/actions/.github/workflows/create-demo-clusters.yml@v1
     secrets: inherit
     with:
       version: ${{github.event.inputs.version}}
diff --git a/.github/workflows/cut-rc.yml b/.github/workflows/cut-rc.yml
index 55870ab183efc..d28a3ce950815 100644
--- a/.github/workflows/cut-rc.yml
+++ b/.github/workflows/cut-rc.yml
@@ -37,6 +37,8 @@ on:
         default: true
         type: boolean
 
+cache-mode: read
+
 env:
   main_branch: ${{github.event.repository.default_branch}}
   script_url: /repos/${{github.repository}}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }}
@@ -60,7 +62,7 @@ concurrency: Release automation ${{ inputs.version }}
 
 jobs:
   properties:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.fetch.outputs.dry-slack-channel, steps.fetch.outputs.slack-channel))[github.event.inputs.dry-run != 'true'] }}
       jira-project: ${{ steps.fetch.outputs.jira-project }}
@@ -73,7 +75,7 @@ jobs:
 
   run-parameters:
     name: Run parameters
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - run: |
           [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run"
@@ -96,7 +98,7 @@ jobs:
   check-jira:
     name: Check Jira tickets for release
     needs: [variables, properties]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Query JIRA
         # Checking unequal with "false" because closed milestones have unset input values.
@@ -117,7 +119,7 @@ jobs:
   postpone-prs:
     name: Postpone open PRs
     needs: variables
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check open PRs
         id: check
@@ -173,7 +175,7 @@ jobs:
 
   cut-rc:
     name: Tag RC for milestone ${{needs.variables.outputs.milestone}}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [variables, properties, postpone-prs, check-jira]
     steps:
       - name: Check out code
@@ -308,7 +310,7 @@ jobs:
                     :arrow_right: Once all checks pass and you're ready for release, run the <${{ github.server_url }}/${{ github.repository }}/actions/workflows/finish-release.yml|Finish Release> workflow and delete the `${{ needs.variables.outputs.next-milestone }}` milestone to avoid confusion.
 
   trim-cluster-names:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       cluster-with-fake-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-fake-load-name-cleaned }}
       cluster-with-real-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-real-load-name-cleaned }}
@@ -331,7 +333,7 @@ jobs:
     name: Setup demo clusters
     secrets: inherit
     needs: [variables, cut-rc, trim-cluster-names]
-    uses: stackrox/actions/.github/workflows/create-demo-clusters.yml@4efb76aa74694b9ee55e95c4ead57fdf50d79ddf # ratchet:stackrox/actions/.github/workflows/create-demo-clusters.yml@v1
+    uses: stackrox/actions/.github/workflows/create-demo-clusters.yml@f3893761af7aff7477e3dde7a4d9656b173fc687 # ratchet:stackrox/actions/.github/workflows/create-demo-clusters.yml@v1
     if: >- # Skip if no clusters are going to be created. Checking unequal with "false" because closed milestones have unset input values.
       github.event.inputs.create-k8s-cluster != 'false' ||
       github.event.inputs.create-os4-cluster != 'false' ||
diff --git a/.github/workflows/detect-changes.yml b/.github/workflows/detect-changes.yml
index b36dab630fc9f..8cced67cfd949 100644
--- a/.github/workflows/detect-changes.yml
+++ b/.github/workflows/detect-changes.yml
@@ -39,7 +39,7 @@ on:
 
 jobs:
   detect:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       files: ${{ steps.list.outputs.files }}
       ui_only: ${{ steps.list.outputs.ui_only }}
diff --git a/.github/workflows/e2e-byodb-tests.yaml b/.github/workflows/e2e-byodb-tests.yaml
index de83b6151f835..f9a52ad5547a6 100644
--- a/.github/workflows/e2e-byodb-tests.yaml
+++ b/.github/workflows/e2e-byodb-tests.yaml
@@ -29,24 +29,26 @@ defaults:
 jobs:
   gke-byodb-qa-e2e-tests:
     if: github.event_name == 'workflow_dispatch' || inputs.should-run
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       MAIN_IMAGE_TAG: ${{ inputs.tag }}
       BUILD_TAG: ${{ inputs.tag }}
-      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
       GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
       CI_JOB_NAME: gke-byodb-qa-e2e-tests
       ARTIFACT_DIR: ./junit-reports
       LOAD_BALANCER: lb
       ORCHESTRATOR_FLAVOR: k8s
       KUBERNETES_PROVIDER: gke
+      SCANNER_V4_DB_STORAGE_CLASS: stackrox-gke-ssd
       POSTGRES_VERSION: "17"
       LONGTERM_LICENSE: "unused"
       BYODB_TEST: "true"
+      # roxctl helm values pin scannerV4.disable=true unless this is set.
+      ROX_SCANNER_V4: "true"
       ROX_RISK_REPROCESSING_INTERVAL: "15s"
       ROX_SENSOR_CONNECTION_RETRY_MAX_INTERVAL: "30s"
       PYTHONUNBUFFERED: "1"
-    timeout-minutes: 150
+    timeout-minutes: 361
     steps:
 
     - name: Checkout repo
@@ -74,17 +76,12 @@ jobs:
     - name: Create GKE cluster
       env:
         MACHINE_TYPE: e2-standard-8
-        NUM_NODES: "3"
+        NUM_NODES: "1"
         GKE_SPOT: "false"
       timeout-minutes: 20
       run: |
-        source scripts/ci/gke.sh
-        provision_gke_cluster byodb
-        {
-          echo "CLUSTER_NAME=${CLUSTER_NAME}"
-          echo "ZONE=${ZONE}"
-          echo "KUBECONFIG=${HOME}/.kube/config"
-        } >> "$GITHUB_ENV"
+        scripts/ci/gke.sh provision_gke_cluster byodb
+        echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"
 
     - name: Build roxctl
       run: |
@@ -102,6 +99,16 @@ jobs:
     - name: Create artifact directory
       run: mkdir -p "$ARTIFACT_DIR"
 
+    - name: Retrieve roxie version from repository
+      id: roxie-version
+      run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+    - name: Install roxie
+      uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1
+      with:
+        version: "v${{ steps.roxie-version.outputs.version }}"
+        gh-token: ${{ github.token }}
+
     - name: Run pre-test
       shell: python
       env:
@@ -120,8 +127,6 @@ jobs:
         QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
         REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
         REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
-        AWS_S3_BACKUP_TEST_BUCKET_NAME: ${{ secrets.AWS_S3_BACKUP_TEST_BUCKET_NAME }}
-        AWS_S3_BACKUP_TEST_BUCKET_REGION: ${{ secrets.AWS_S3_BACKUP_TEST_BUCKET_REGION || 'us-east-2' }}
         AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
         AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         AWS_ECR_REGISTRY_REGION: ${{ secrets.AWS_ECR_REGISTRY_REGION }}
@@ -140,13 +145,15 @@ jobs:
         QUAY_RHACS_ENG_BEARER_TOKEN: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}
         REDHAT_USERNAME: ${{ secrets.RH_REGISTRY_USERNAME_RO }}
         REDHAT_PASSWORD: ${{ secrets.RH_REGISTRY_PASSWORD_RO }}
+        SLACK_FIXABLE_VULNS_CHANNEL: ${{ secrets.SLACK_FIXABLE_VULNS_CHANNEL }}
         SLACK_MAIN_WEBHOOK: ${{ secrets.SLACK_MAIN_WEBHOOK }}
         SLACK_ALT_WEBHOOK: ${{ secrets.SLACK_ALT_WEBHOOK }}
         OCM_OFFLINE_TOKEN: ${{ secrets.OCM_OFFLINE_TOKEN }}
         CLOUD_SOURCES_TEST_OCM_CLIENT_ID: ${{ secrets.CLOUD_SOURCES_TEST_OCM_CLIENT_ID }}
         CLOUD_SOURCES_TEST_OCM_CLIENT_SECRET: ${{ secrets.CLOUD_SOURCES_TEST_OCM_CLIENT_SECRET }}
         BUILD_ID: ${{ github.run_id }}
-      timeout-minutes: 110
+        USE_ROXIE_DEPLOY: true
+      timeout-minutes: 245
       run: tests/byodb/run.sh /tmp/byodb-test-logs
 
     - name: Persist env vars for post-test
@@ -195,12 +202,18 @@ jobs:
           exit 6
         fi
 
-    - name: Publish test summary
+    - name: Publish summary for failed tests
+      uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
+      if: always()
+      with:
+        paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
+        show: "fail"
+    - name: Publish summary for passed and skipped tests
       uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
       if: always()
       with:
         paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
-        show: all
+        show: "pass, skip"
 
     - name: Report junit failures in jira
       if: (!cancelled())
diff --git a/.github/workflows/e2e-db-backup-restore-test.yaml b/.github/workflows/e2e-db-backup-restore-tests.yaml
similarity index 80%
rename from .github/workflows/e2e-db-backup-restore-test.yaml
rename to .github/workflows/e2e-db-backup-restore-tests.yaml
index 18287a9003361..7ea0636f763b1 100644
--- a/.github/workflows/e2e-db-backup-restore-test.yaml
+++ b/.github/workflows/e2e-db-backup-restore-tests.yaml
@@ -1,4 +1,4 @@
-name: e2e-db-backup-restore-test
+name: e2e-db-backup-restore-tests
 
 on:
   workflow_call:
@@ -27,17 +27,15 @@ defaults:
     shell: bash
 
 jobs:
-  gke-db-backup-restore-test:
+  gke-db-backup-restore-tests:
     if: github.event_name == 'workflow_dispatch' || inputs.should-run
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       MAIN_IMAGE_TAG: ${{ inputs.tag }}
       BUILD_TAG: ${{ inputs.tag }}
-      CI_JOB_NAME: gke-db-backup-restore-test
+      CI_JOB_NAME: gke-db-backup-restore-tests
       ARTIFACT_DIR: ./junit-reports
-      LOAD_BALANCER: lb
       ROX_SCANNER_V4: "false"
-      STORAGE: pvc
       STORAGE_CLASS: faster
       PYTHONUNBUFFERED: "1"
     timeout-minutes: 60
@@ -62,17 +60,12 @@ jobs:
     - name: Create GKE cluster
       env:
         MACHINE_TYPE: e2-standard-8
-        NUM_NODES: "3"
+        NUM_NODES: "1"
         GKE_SPOT: "false"
       timeout-minutes: 20
       run: |
-        source scripts/ci/gke.sh
-        provision_gke_cluster dbbr
-        {
-          echo "CLUSTER_NAME=${CLUSTER_NAME}"
-          echo "ZONE=${ZONE}"
-          echo "KUBECONFIG=${HOME}/.kube/config"
-        } >> "$GITHUB_ENV"
+        scripts/ci/gke.sh provision_gke_cluster dbbr
+        echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"
 
     - name: Build roxctl
       # The test uses roxctl for central backup/restore operations
@@ -80,6 +73,16 @@ jobs:
         make roxctl_linux-amd64
         echo "$(pwd)/bin/linux_amd64" >> "$GITHUB_PATH"
 
+    - name: Retrieve roxie version from repository
+      id: roxie-version
+      run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+    - name: Install roxie
+      uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1
+      with:
+        version: "v${{ steps.roxie-version.outputs.version }}"
+        gh-token: ${{ secrets.GITHUB_TOKEN }}
+
     - name: Verify kubectl access and wait for cluster to stabilize
       timeout-minutes: 5
       run: |
@@ -87,6 +90,9 @@ jobs:
         kubectl get nodes
         scripts/ci/gke.sh wait_for_cluster
 
+    - name: Create artifact directory
+      run: mkdir -p "$ARTIFACT_DIR"
+
     - name: Run pre-test
       shell: python
       env:
@@ -103,16 +109,24 @@ jobs:
         QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
         REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
         REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
-        ORCHESTRATOR_FLAVOR: k8s
       run: |
         source tests/e2e/lib.sh
         source tests/scripts/setup-certs.sh
         source scripts/ci/sensor-wait.sh
+
         export_test_environment
         setup_deployment_env false false
-        deploy_stackrox
-        # Persist API_ENDPOINT for post-test steps (ci_export only sets it in this shell)
-        echo "API_ENDPOINT=${API_ENDPOINT}" >> "$GITHUB_ENV"
+
+        roxie_config="$(mktemp)"
+        merge_yaml "$roxie_config" <<'EOF'
+        central:
+          resourceProfile: ci
+        securedCluster:
+          resourceProfile: ci
+        EOF
+        deploy_stackrox_with_roxie_compat "$roxie_config"
+        rm -f "$roxie_config"
+
         db_backup_and_restore_test /tmp/db-backup-restore-test
 
     - name: Run post-test
@@ -149,7 +163,7 @@ jobs:
           exit 6
         fi
 
-    - name: Publish test summary
+    - name: Publish summary for all tests
       uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
       if: always()
       with:
diff --git a/.github/workflows/e2e-dispatch.yaml b/.github/workflows/e2e-dispatch.yaml
index 3261dac6988e2..4335fefeb05cb 100644
--- a/.github/workflows/e2e-dispatch.yaml
+++ b/.github/workflows/e2e-dispatch.yaml
@@ -32,7 +32,8 @@ jobs:
     needs: [ detect-changes ]
     runs-on: ubuntu-slim
     outputs:
-      dispatch-any: ${{ steps.determine.outputs.dispatch-any }}
+      wait-for-gha-images: ${{ steps.determine.outputs.wait-for-gha-images }}
+      wait-for-konflux-images: ${{ steps.determine.outputs.wait-for-konflux-images }}
       jobs: ${{ steps.determine.outputs.jobs }}
     steps:
     - name: Determine whether should dispatch workflows
@@ -52,37 +53,67 @@ jobs:
         import os
         import subprocess
         from types import SimpleNamespace
+        from dataclasses import dataclass
+
+        @dataclass
+        class Job:
+            name: str
+            require_pr_label: bool = False
+            require_konflux_build: bool = False
+
+            def should_run(self, input):
+                if input.is_fork == 'true':
+                    return False
+
+                if input.event_name != 'pull_request':
+                    return True
+                elif self.name in input.pr_labels:
+                    return True
+
+                # We are in a PR context, job is not explicitly listed among the PR labels.
+
+                # TODO(ROX-21073): re-enable Konflux for all PR branches
+                if self.require_konflux_build and 'konflux-build' not in input.pr_labels:
+                    return False
+
+                if input.ui_only_change == 'true':
+                    # For now, all the workflows that we dispatch should be skipped for PRs that only change UI.
+                    # As we add more E2E test workflows, we may want to make this more flexible.
+                    return False
+                if self.require_pr_label:
+                    return False
+                if input.is_draft != 'true':
+                    return True
+
+                return False
+
 
         input = SimpleNamespace(**{
             key.removeprefix('input__'): val
             for (key, val) in os.environ.items()
             if key.startswith('input__')})
-        for k, v in vars(input).items():
-            print(f'{k} = {v}')
 
         if input.event_name != 'pull_request':
-            all_labels = []
+            input.pr_labels = []
         else:
             p = subprocess.run(
                 ['gh', 'pr', 'view', input.pr_number, '--repo', input.repo, '--json', 'labels', '--jq', '.labels[].name'],
                 check=True, encoding='utf-8', stdout=subprocess.PIPE, stdin=subprocess.DEVNULL)
-            all_labels = p.stdout.strip().splitlines()
-        print(f'all_labels = {", ".join(all_labels)}')
+            input.pr_labels = p.stdout.strip().splitlines()
 
-        def should_run(job):
-            if input.is_fork == 'true':
-                return False
-            if input.event_name != 'pull_request':
-                return True
-            if input.ui_only_change == 'true':
-                # For now, all the workflows that we dispatch should be skipped for PRs that only change UI.
-                # As we add more E2E test workflows, we may want to make this more flexible.
-                return False
-            if input.is_draft != 'true':
-                return True
-            if job in all_labels:
-                return True
-            return False
+        for k, v in vars(input).items():
+            print(f'{k} = {v}')
+
+        jobs_registry = [
+            Job(name='e2e-byodb-tests', require_pr_label=True),
+            Job(name='e2e-db-backup-restore-tests'),
+            Job(name='e2e-gke-upgrade-tests'),
+            Job(name='e2e-nongroovy-tests-gke'),
+            Job(name='e2e-nongroovy-tests-gke-konflux', require_konflux_build=True),
+            Job(name='e2e-qa-tests-gke', require_pr_label=True),
+            Job(name='e2e-qa-tests-gke-konflux', require_konflux_build=True),
+            Job(name='e2e-qa-tests-ocp-fips-konflux', require_konflux_build=True),
+        ]
 
         with open(os.environ['GITHUB_OUTPUT'], mode='at', encoding='utf-8') as file:
             def write(job, val):
@@ -90,34 +121,32 @@ jobs:
                 print(line)
                 file.write(line + '\n')
 
-            jobs = { job: should_run(job) for job in [
-                    'e2e-byodb-tests',
-                    'e2e-db-backup-restore-test',
-                    'e2e-gke-upgrade-tests',
-                    'e2e-nongroovy-tests',
-                ]}
+            jobs = {job.name: job.should_run(input) for job in jobs_registry}
 
             write('jobs', json.dumps(jobs))
 
-            # dispatch_any==False is a shortcut to prevent executing the further workflow for draft PRs which don't
-            # qualify for running any actual e2e jobs.
-            # We must make sure that dispatch_any is True for non-drafts even if no actual jobs are to be dispatched
-            # (the case of UI-only PRs) because this lets GHA enter the corresponding workflows and skip the test jobs
-            # inside them "in proper way" that allows to satisfy branch protection rules.
-            dispatch_any = any(jobs.values()) or input.is_draft != 'true'
-            write('dispatch-any', str(dispatch_any).lower())
+            # Find out when we can complete the workflow early by not even waiting for GHA-built images.
+            wait_for_gha_images = input.event_name != 'pull_request' or input.is_draft != 'true' or any(jobs.values())
+            write('wait-for-gha-images', str(wait_for_gha_images).lower())
+
+            # Waiting for konflux-built images in PR request context requires the 'konflux-build' PR label.
+            wait_for_konflux_images = input.event_name != 'pull_request' or ('konflux-build' in input.pr_labels and any(jobs.values()))
+            write('wait-for-konflux-images', str(wait_for_konflux_images).lower())
 
-  # Waits for images to be built so we don't start testing until they are available.
   wait-for-images:
     needs: [ should-dispatch ]
-    if: needs.should-dispatch.outputs.dispatch-any == 'true'
-    runs-on: ubuntu-slim
+    if: needs.should-dispatch.outputs.wait-for-gha-images == 'true'
+    runs-on: ubuntu-24.04
+    env:
+      MAIN_IMAGE_TAG_DIR: "."
+      IMAGE_PREFIX: ""
+      OPERATOR_IMAGE_PREFIX: "stackrox-"
+      DEV_TAG_SUFFIX: ""
+      # MAIN_IMAGE_TAG can be used for overriding when you want to run workflows for particular images.
+      # MAIN_IMAGE_TAG: 4.12.x-350-gc76d76b0fb
     outputs:
-      tag: ${{ steps.build-tag.outputs.tag }}
-      operator_tag: ${{ steps.build-tag.outputs.operator_tag }}
-      ## MAIN_IMAGE_TAG can be used for overriding when you want to run workflows for particular images.
-      # env:
-      #   MAIN_IMAGE_TAG: 4.12.x-350-gc76d76b0fb
+      tag: ${{ steps.image-references.outputs.tag }}
+      tag_suffix: ${{ steps.image-references.outputs.tag_suffix }}
     concurrency:
       group: wait-for-images-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
@@ -129,30 +158,77 @@ jobs:
         ref: ${{ github.event.pull_request.head.sha || github.sha }}
         persist-credentials: false
     - uses: ./.github/actions/handle-tagged-build
-    - name: Compute build tag
-      id: build-tag
-      run: |
-        tag="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory tag)"}"
-        echo "tag=$tag" | tee -a "$GITHUB_OUTPUT" -a "$GITHUB_ENV"
-        echo "operator_tag=$(BUILD_TAG="${tag}" make -C operator --quiet --no-print-directory tag)" | tee -a "$GITHUB_OUTPUT" -a "$GITHUB_ENV"
+    - name: Determine image references
+      id: image-references
+      run: &image-references |
+        IMAGE_TAG="${MAIN_IMAGE_TAG:-"$(make -C "$MAIN_IMAGE_TAG_DIR" --quiet --no-print-directory tag)"}"
+        echo "IMAGE_TAG=$IMAGE_TAG" | tee -a "$GITHUB_ENV"
+        echo "tag=$IMAGE_TAG" | tee -a "$GITHUB_OUTPUT"
+
+        OPERATOR_IMAGE_TAG="$(BUILD_TAG="${IMAGE_TAG}" make -C operator --quiet --no-print-directory tag)"
+        echo "OPERATOR_IMAGE_TAG=${OPERATOR_IMAGE_TAG}" | tee -a "$GITHUB_ENV"
+
+        # Mirrors the logic in https://github.com/stackrox/konflux-tasks/blob/main/tasks/determine-image-tag-task.yaml.
+        source_branch="${GITHUB_HEAD_REF:-}"
+        target_branch="${GITHUB_BASE_REF:-${GITHUB_REF}}"
+        TAG_SUFFIX=""
+        if [[ "${source_branch}" == *konflux-release-like* ]]; then
+          echo "Source branch contains 'konflux-release-like', suppressing suffix."
+        elif ! grep -qE '^((refs/heads/)?release-[0-9a-z]+\.[0-9a-z]+|refs/tags/[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?)$' <<< "${target_branch}"; then
+          TAG_SUFFIX="${DEV_TAG_SUFFIX}"
+        fi
+        echo "TAG_SUFFIX=${TAG_SUFFIX}" | tee -a "$GITHUB_ENV"
+        echo "tag_suffix=${TAG_SUFFIX}" | tee -a "$GITHUB_OUTPUT"
+
     - name: Wait for images
       uses: stackrox/actions/release/wait-for-image@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/wait-for-image@v1
       with:
         token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}
-        image: |
-          rhacs-eng/central-db:${{ env.tag }}
-          rhacs-eng/collector:${{ env.tag }}
-          rhacs-eng/fact:${{ env.tag }}
-          rhacs-eng/main:${{ env.tag }}
-          rhacs-eng/roxctl:${{ env.tag }}
-          rhacs-eng/scanner-db-slim:${{ env.tag }}
-          rhacs-eng/scanner-db:${{ env.tag }}
-          rhacs-eng/scanner-slim:${{ env.tag }}
-          rhacs-eng/scanner-v4-db:${{ env.tag }}
-          rhacs-eng/scanner-v4:${{ env.tag }}
-          rhacs-eng/scanner:${{ env.tag }}
-          rhacs-eng/stackrox-operator-bundle:v${{ env.operator_tag }}
-          rhacs-eng/stackrox-operator:${{ env.operator_tag }}
+        limit: 1800 # Seconds, corresponding to 30m.
+        image: &stackrox-required-images |
+          rhacs-eng/${{ env.IMAGE_PREFIX }}central-db:${{ env.IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.IMAGE_PREFIX }}collector:${{ env.IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.IMAGE_PREFIX }}fact:${{ env.IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.IMAGE_PREFIX }}main:${{ env.IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.IMAGE_PREFIX }}roxctl:${{ env.IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.IMAGE_PREFIX }}scanner-v4-db:${{ env.IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.IMAGE_PREFIX }}scanner-v4:${{ env.IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.OPERATOR_IMAGE_PREFIX }}operator-bundle:v${{ env.OPERATOR_IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+          rhacs-eng/${{ env.OPERATOR_IMAGE_PREFIX }}operator:${{ env.OPERATOR_IMAGE_TAG }}${{ env.TAG_SUFFIX }}
+
+  wait-for-konflux-images:
+    needs: [ should-dispatch ]
+    if: needs.should-dispatch.outputs.wait-for-konflux-images == 'true'
+    runs-on: ubuntu-24.04
+    env:
+      MAIN_IMAGE_TAG_DIR: "operator"
+      IMAGE_PREFIX: "release-"
+      OPERATOR_IMAGE_PREFIX: "release-"
+      DEV_TAG_SUFFIX: "-fast"
+    outputs:
+      tag: ${{ steps.image-references.outputs.tag }}
+      tag_suffix: ${{ steps.image-references.outputs.tag_suffix }}
+    concurrency:
+      group: wait-for-konflux-images-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+      cancel-in-progress: true
+    steps:
+    - name: Checkout repo
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.sha }}
+        persist-credentials: false
+    - uses: ./.github/actions/handle-tagged-build
+    - name: Determine image references
+      id: image-references
+      run: *image-references
+
+    - name: Wait for Konflux images
+      uses: stackrox/actions/release/wait-for-image@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/wait-for-image@v1
+      with:
+        token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}
+        image: *stackrox-required-images
+        limit: 14100 # Seconds, corresponding to 3h55m, which is the timeout for building the operator-index (.tekton/operator-index-build.yaml) + 5m buffer.
 
   e2e-byodb-tests:
     needs: [ wait-for-images, should-dispatch ]
@@ -165,15 +241,15 @@ jobs:
       group: e2e-byodb-tests-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
 
-  e2e-db-backup-restore-test:
+  e2e-db-backup-restore-tests:
     needs: [ wait-for-images, should-dispatch ]
-    uses: ./.github/workflows/e2e-db-backup-restore-test.yaml
+    uses: ./.github/workflows/e2e-db-backup-restore-tests.yaml
     with:
       tag: ${{ needs.wait-for-images.outputs.tag }}
-      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-db-backup-restore-test }}
+      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-db-backup-restore-tests }}
     secrets: inherit
     concurrency:
-      group: e2e-db-backup-restore-test-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+      group: e2e-db-backup-restore-tests-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
 
   e2e-gke-upgrade-tests:
@@ -187,13 +263,57 @@ jobs:
       group: e2e-gke-upgrade-tests-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
 
-  e2e-nongroovy-tests:
+  e2e-nongroovy-tests-gke:
+    needs: [ wait-for-images, should-dispatch ]
+    uses: ./.github/workflows/e2e-nongroovy-tests-gke.yaml
+    with:
+      tag: ${{ needs.wait-for-images.outputs.tag }}
+      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-nongroovy-tests-gke }}
+    secrets: inherit
+    concurrency:
+      group: e2e-nongroovy-tests-gke-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+      cancel-in-progress: true
+
+  e2e-nongroovy-tests-gke-konflux:
+    needs: [ wait-for-konflux-images, should-dispatch ]
+    uses: ./.github/workflows/e2e-nongroovy-tests-gke-konflux.yaml
+    with:
+      tag: ${{ needs.wait-for-konflux-images.outputs.tag }}${{ needs.wait-for-konflux-images.outputs.tag_suffix }}
+      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-nongroovy-tests-gke-konflux }}
+    secrets: inherit
+    concurrency:
+      group: e2e-nongroovy-tests-gke-konflux-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+      cancel-in-progress: true
+
+  e2e-qa-tests-gke:
     needs: [ wait-for-images, should-dispatch ]
-    uses: ./.github/workflows/e2e-nongroovy-tests.yaml
+    uses: ./.github/workflows/e2e-qa-tests-gke.yaml
     with:
       tag: ${{ needs.wait-for-images.outputs.tag }}
-      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-nongroovy-tests }}
+      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-qa-tests-gke }}
+    secrets: inherit
+    concurrency:
+      group: e2e-qa-tests-gke-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+      cancel-in-progress: true
+
+  e2e-qa-tests-ocp-fips-konflux:
+    needs: [ wait-for-konflux-images, should-dispatch ]
+    uses: ./.github/workflows/e2e-qa-tests-ocp-fips-konflux.yaml
+    with:
+      tag: ${{ needs.wait-for-konflux-images.outputs.tag }}${{ needs.wait-for-konflux-images.outputs.tag_suffix }}
+      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-qa-tests-ocp-fips-konflux }}
+    secrets: inherit
+    concurrency:
+      group: e2e-qa-tests-ocp-fips-konflux-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+      cancel-in-progress: true
+
+  e2e-qa-tests-gke-konflux:
+    needs: [ wait-for-konflux-images, should-dispatch ]
+    uses: ./.github/workflows/e2e-qa-tests-gke-konflux.yaml
+    with:
+      tag: ${{ needs.wait-for-konflux-images.outputs.tag }}${{ needs.wait-for-konflux-images.outputs.tag_suffix }}
+      should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-qa-tests-gke-konflux }}
     secrets: inherit
     concurrency:
-      group: e2e-nongroovy-tests-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+      group: e2e-qa-tests-gke-konflux-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
diff --git a/.github/workflows/e2e-gke-upgrade-tests.yaml b/.github/workflows/e2e-gke-upgrade-tests.yaml
index d08adbfbb61d9..bf779c3a02626 100644
--- a/.github/workflows/e2e-gke-upgrade-tests.yaml
+++ b/.github/workflows/e2e-gke-upgrade-tests.yaml
@@ -31,11 +31,10 @@ jobs:
   # Verifies Central DB upgrades/rollbacks.
   gke-upgrade-tests-central:
     if: github.event_name == 'workflow_dispatch' || inputs.should-run
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       MAIN_IMAGE_TAG: ${{ inputs.tag }}
       BUILD_TAG: ${{ inputs.tag }}
-      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
       # Not making CI_JOB_NAME match *gke-upgrade-tests because JUnit reporting will be broken since the former
       # gke-upgrade-tests expect all sensor, central and postgres tests to run together in a single sequence.
       CI_JOB_NAME: gke-upgrade-tests-central
@@ -59,17 +58,13 @@ jobs:
     - name: Create GKE cluster
       env:
         MACHINE_TYPE: e2-standard-8
-        NUM_NODES: "3"
+        # Leave room for the scale workload alongside both Scanner versions.
+        NUM_NODES: "4"
         GKE_SPOT: "false"
       timeout-minutes: 20
       run: |
-        source scripts/ci/gke.sh
-        provision_gke_cluster cent-up
-        {
-          echo "CLUSTER_NAME=${CLUSTER_NAME}"
-          echo "ZONE=${ZONE}"
-          echo "KUBECONFIG=${HOME}/.kube/config"
-        } >> "$GITHUB_ENV"
+        scripts/ci/gke.sh provision_gke_cluster cent-up
+        echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"
 
     - name: Docker login to Quay.io
       env:
@@ -85,6 +80,16 @@ jobs:
     - name: Build roxctl
       run: make roxctl_linux-amd64
 
+    - name: Retrieve roxie version from repository
+      id: roxie-version
+      run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+    - name: Install roxie
+      uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1
+      with:
+        version: "v${{ steps.roxie-version.outputs.version }}"
+        gh-token: ${{ secrets.GITHUB_TOKEN }}
+
     - name: Verify kubectl access and wait for cluster to stabilize
       timeout-minutes: 5
       run: |
@@ -92,6 +97,9 @@ jobs:
         kubectl get nodes
         scripts/ci/gke.sh wait_for_cluster
 
+    - name: Create artifact directory
+      run: mkdir -p "$ARTIFACT_DIR"
+
     - name: Run pre-test
       shell: python
       env:
@@ -110,7 +118,6 @@ jobs:
 
     - name: Run central upgrade test
       env:
-        LONGTERM_LICENSE: todo - remove me
         QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
         QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
         REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
@@ -119,7 +126,6 @@ jobs:
         GOOGLE_ARTIFACT_REGISTRY_SERVICE_ACCOUNT_V2: ${{ secrets.GOOGLE_ARTIFACT_REGISTRY_SERVICE_ACCOUNT_V2 }}
         REDHAT_USERNAME: ${{ secrets.RH_REGISTRY_USERNAME_RO }}
         REDHAT_PASSWORD: ${{ secrets.RH_REGISTRY_PASSWORD_RO }}
-        LOAD_BALANCER: lb
       run: |
         tests/upgrade/postgres_run.sh /tmp/postgres-upgrade-test-logs
         # This makes sure Stackrox_Deployment / Was Stackrox deployed to the cluster? test does not fail.
@@ -158,12 +164,18 @@ jobs:
           exit 6
         fi
 
-    - name: Publish test summary
+    - name: Publish summary for failed tests
+      uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
+      if: always()
+      with:
+        paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
+        show: "fail"
+    - name: Publish summary for passed and skipped tests
       uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
       if: always()
       with:
         paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
-        show: all
+        show: "pass, skip"
 
     - name: Report junit failures in jira
       if: (!cancelled())
@@ -176,14 +188,30 @@ jobs:
         gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
         directory: ${{ env.ARTIFACT_DIR }}
 
-  # Verifies we can do Postgres major version upgrade.
-  gke-upgrade-tests-postgres:
+  check-postgres-upgrade:
     if: github.event_name == 'workflow_dispatch' || inputs.should-run
     runs-on: ubuntu-latest
+    outputs:
+      required: ${{ steps.check.outputs.required }}
+    steps:
+    - name: Checkout repo
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.sha }}
+        persist-credentials: false
+    - name: Check whether PostgreSQL needs a major-version upgrade
+      id: check
+      run: tests/upgrade/postgres_upgrade_run.sh --check
+
+  # Verifies we can do Postgres major version upgrade.
+  gke-upgrade-tests-postgres:
+    needs: check-postgres-upgrade
+    if: needs.check-postgres-upgrade.outputs.required == 'true'
+    runs-on: ubuntu-24.04
     env:
       MAIN_IMAGE_TAG: ${{ inputs.tag }}
       BUILD_TAG: ${{ inputs.tag }}
-      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
       # Not making CI_JOB_NAME match *gke-upgrade-tests because JUnit reporting will be broken since the former
       # gke-upgrade-tests expect all sensor, central and postgres tests to run together in a single sequence.
       CI_JOB_NAME: gke-upgrade-tests-postgres
@@ -207,17 +235,13 @@ jobs:
     - name: Create GKE cluster
       env:
         MACHINE_TYPE: e2-standard-8
-        NUM_NODES: "3"
+        # Leave room for the scale workload alongside both Scanner versions.
+        NUM_NODES: "4"
         GKE_SPOT: "false"
       timeout-minutes: 20
       run: |
-        source scripts/ci/gke.sh
-        provision_gke_cluster pg-up
-        {
-          echo "CLUSTER_NAME=${CLUSTER_NAME}"
-          echo "ZONE=${ZONE}"
-          echo "KUBECONFIG=${HOME}/.kube/config"
-        } >> "$GITHUB_ENV"
+        scripts/ci/gke.sh provision_gke_cluster pg-up
+        echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"
 
     - name: Docker login to Quay.io
       env:
@@ -233,6 +257,16 @@ jobs:
     - name: Build roxctl
       run: make roxctl_linux-amd64
 
+    - name: Retrieve roxie version from repository
+      id: roxie-version
+      run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+    - name: Install roxie
+      uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1
+      with:
+        version: "v${{ steps.roxie-version.outputs.version }}"
+        gh-token: ${{ secrets.GITHUB_TOKEN }}
+
     - name: Verify kubectl access and wait for cluster to stabilize
       timeout-minutes: 5
       run: |
@@ -240,6 +274,9 @@ jobs:
         kubectl get nodes
         scripts/ci/gke.sh wait_for_cluster
 
+    - name: Create artifact directory
+      run: mkdir -p "$ARTIFACT_DIR"
+
     - name: Run pre-test
       shell: python
       env:
@@ -258,7 +295,6 @@ jobs:
 
     - name: Run postgres version upgrade test
       env:
-        LONGTERM_LICENSE: todo - remove me
         QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
         QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
         REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
@@ -266,7 +302,6 @@ jobs:
         GOOGLE_CREDENTIALS_GCR_SCANNER_V2: ${{ secrets.GOOGLE_CREDENTIALS_GCR_SCANNER_V2 }}
         REDHAT_USERNAME: ${{ secrets.RH_REGISTRY_USERNAME_RO }}
         REDHAT_PASSWORD: ${{ secrets.RH_REGISTRY_PASSWORD_RO }}
-        LOAD_BALANCER: lb
       run: |
         tests/upgrade/postgres_upgrade_run.sh /tmp/postgres-version-upgrade-test-logs
         # This makes sure Stackrox_Deployment / Was Stackrox deployed to the cluster? test does not fail.
@@ -305,12 +340,18 @@ jobs:
           exit 6
         fi
 
-    - name: Publish test summary
+    - name: Publish summary for failed tests
       uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
       if: always()
       with:
         paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
-        show: all
+        show: "fail"
+    - name: Publish summary for passed and skipped tests
+      uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
+      if: always()
+      with:
+        paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
+        show: "pass, skip"
 
     - name: Report junit failures in jira
       if: (!cancelled())
@@ -326,11 +367,10 @@ jobs:
   # Verifies Sensor/Secured Cluster `upgrader` (applicable to manifest installations only).
   gke-upgrade-tests-sensor:
     if: github.event_name == 'workflow_dispatch' || inputs.should-run
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       MAIN_IMAGE_TAG: ${{ inputs.tag }}
       BUILD_TAG: ${{ inputs.tag }}
-      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
       # Not making CI_JOB_NAME match *gke-upgrade-tests because JUnit reporting will be broken since the former
       # gke-upgrade-tests expect all sensor, central and postgres tests to run together in a single sequence.
       CI_JOB_NAME: gke-upgrade-tests-sensor
@@ -354,17 +394,12 @@ jobs:
     - name: Create GKE cluster
       env:
         MACHINE_TYPE: e2-standard-8
-        NUM_NODES: "3"
+        NUM_NODES: "1"
         GKE_SPOT: "false"
       timeout-minutes: 20
       run: |
-        source scripts/ci/gke.sh
-        provision_gke_cluster sens-up
-        {
-          echo "CLUSTER_NAME=${CLUSTER_NAME}"
-          echo "ZONE=${ZONE}"
-          echo "KUBECONFIG=${HOME}/.kube/config"
-        } >> "$GITHUB_ENV"
+        scripts/ci/gke.sh provision_gke_cluster sens-up
+        echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"
 
     - name: Docker login to Quay.io
       env:
@@ -387,6 +422,9 @@ jobs:
         kubectl get nodes
         scripts/ci/gke.sh wait_for_cluster
 
+    - name: Create artifact directory
+      run: mkdir -p "$ARTIFACT_DIR"
+
     - name: Run pre-test
       shell: python
       env:
@@ -439,12 +477,18 @@ jobs:
           exit 6
         fi
 
-    - name: Publish test summary
+    - name: Publish summary for failed tests
+      uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
+      if: always()
+      with:
+        paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
+        show: "fail"
+    - name: Publish summary for passed and skipped tests
       uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
       if: always()
       with:
         paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
-        show: all
+        show: "pass, skip"
 
     - name: Report junit failures in jira
       if: (!cancelled())
diff --git a/.github/workflows/e2e-nongroovy-tests-gke-konflux.yaml b/.github/workflows/e2e-nongroovy-tests-gke-konflux.yaml
new file mode 100644
index 0000000000000..1a7c511cb7970
--- /dev/null
+++ b/.github/workflows/e2e-nongroovy-tests-gke-konflux.yaml
@@ -0,0 +1,38 @@
+name: e2e-nongroovy-tests-gke-konflux
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: |
+          Image tag to test. The caller needs to make sure that the tag carries the
+          "-fast" Konflux suffix if required (e.g. for development builds).
+        type: string
+        required: true
+      should-run:
+        description: true if should really run the job. false - otherwise, i.e. the job should be skipped.
+        type: boolean
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: |
+          Image tag to test. You need to make sure that the tag carries the
+          "-fast" Konflux suffix if required (e.g. for development builds).
+        type: string
+        required: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  run:
+    uses: ./.github/workflows/e2e-nongroovy-tests.yaml
+    with:
+      should-run: ${{ github.event_name == 'workflow_dispatch' || inputs.should-run }}
+      tag: ${{ inputs.tag }}
+      ci-job-name: gke-nongroovy-e2e-tests-konflux
+      extra-env-vars: |
+        USE_KONFLUX_IMAGES=true
+    secrets: inherit
diff --git a/.github/workflows/e2e-nongroovy-tests-gke.yaml b/.github/workflows/e2e-nongroovy-tests-gke.yaml
new file mode 100644
index 0000000000000..d0370a2f6ace0
--- /dev/null
+++ b/.github/workflows/e2e-nongroovy-tests-gke.yaml
@@ -0,0 +1,32 @@
+name: e2e-nongroovy-tests-gke
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: Image tag to test.
+        type: string
+        required: true
+      should-run:
+        description: true if should really run the job. false - otherwise, i.e. the job should be skipped.
+        type: boolean
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Image tag to test.
+        type: string
+        required: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  run:
+    uses: ./.github/workflows/e2e-nongroovy-tests.yaml
+    with:
+      should-run: ${{ github.event_name == 'workflow_dispatch' || inputs.should-run }}
+      tag: ${{ inputs.tag }}
+      ci-job-name: gke-nongroovy-e2e-tests
+    secrets: inherit
diff --git a/.github/workflows/e2e-nongroovy-tests.yaml b/.github/workflows/e2e-nongroovy-tests.yaml
index 794c95bbde70c..768d5dfea1439 100644
--- a/.github/workflows/e2e-nongroovy-tests.yaml
+++ b/.github/workflows/e2e-nongroovy-tests.yaml
@@ -11,12 +11,14 @@ on:
         description: true if should really run the job. false - otherwise, i.e. the job should be skipped.
         type: boolean
         required: true
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Image tag to test.
+      ci-job-name:
+        description: Unique job name, e.g. gke-nongroovy-e2e-tests-konflux. Propagated to tests as CI_JOB_NAME for test dispatching.
         type: string
         required: true
+      extra-env-vars:
+        description: Additional environment variables as multi-line KEY=VALUE pairs (e.g., USE_ROXIE_DEPLOY=true)
+        type: string
+        required: false
 
 permissions:
   contents: read
@@ -28,27 +30,26 @@ defaults:
 
 jobs:
   gke-nongroovy-e2e-tests:
-    if: github.event_name == 'workflow_dispatch' || inputs.should-run
-    runs-on: ubuntu-latest
+    if: inputs.should-run
+    runs-on: ubuntu-24.04
     env:
       MAIN_IMAGE_TAG: ${{ inputs.tag }}
       BUILD_TAG: ${{ inputs.tag }}
-      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
       GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
-      CI_JOB_NAME: gke-nongroovy-e2e-tests
+      CI_JOB_NAME: ${{ inputs.ci-job-name }}
       ARTIFACT_DIR: ./junit-reports
       LOAD_BALANCER: lb
       ORCHESTRATOR_FLAVOR: k8s
       KUBERNETES_PROVIDER: gke
-      SENSOR_SCANNER_SUPPORT: "true"
+      SENSOR_SCANNER_V4_SUPPORT: "true"
       ROX_DEPLOY_SENSOR_WITH_CRS: "true"
       SENSOR_HELM_MANAGED: "true"
-      SCANNER_V4_DB_STORAGE_CLASS: faster
       STORAGE: pvc
       STORAGE_CLASS: faster
-      ROX_SCANNER_V4: "false"
+      SCANNER_V4_DB_STORAGE_CLASS: faster
+      ROX_SCANNER_V4: "true"
       PYTHONUNBUFFERED: "1"
-    timeout-minutes: 120
+    timeout-minutes: 361
     steps:
 
     - name: Checkout repo
@@ -62,6 +63,17 @@ jobs:
       with:
         gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
 
+    - name: Set additional env vars
+      if: inputs.extra-env-vars != ''
+      env:
+        EXTRA_ENV_VARS: ${{ inputs.extra-env-vars }}
+      run: |
+        while IFS= read -r line; do
+          if [[ -n "$line" ]]; then
+            echo "$line" >> "$GITHUB_ENV"
+          fi
+        done <<< "$EXTRA_ENV_VARS"
+
     - name: Docker login to Quay.io
       env:
         REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
@@ -76,22 +88,33 @@ jobs:
     - name: Create GKE cluster
       env:
         MACHINE_TYPE: e2-standard-8
-        NUM_NODES: "3"
+        NUM_NODES: "1"
         GKE_SPOT: "false"
       timeout-minutes: 20
       run: |
-        source scripts/ci/gke.sh
-        provision_gke_cluster nongroovy
-        {
-          echo "CLUSTER_NAME=${CLUSTER_NAME}"
-          echo "ZONE=${ZONE}"
-          echo "KUBECONFIG=${HOME}/.kube/config"
-        } >> "$GITHUB_ENV"
+        scripts/ci/gke.sh provision_gke_cluster nongroovy
+        echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"
+
+    - name: Retrieving roxie version from repository
+      id: roxie-version
+      run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+    - name: Install roxie
+      uses: stackrox/actions/roxie/install-cli@43bb707aa4f32ead5bfb8d5ab11fb409f971ffc8 # ratchet:stackrox/actions@v1
+      with:
+        version: "v${{ steps.roxie-version.outputs.version }}"
 
     - name: Build roxctl
-      # roxctl is used for various CLI e2e tests (token-file, authz-trace, istio-support, etc.)
-      # Copy to /usr/local/bin so it survives bats tests which mv the binary out of bin/
+      # roxctl is used for generate (deploy) and CLI e2e tests (token-file, etc).
+      # Copy to /usr/local/bin so it survives bats tests which mv the binary out of bin/.
+      # A release Central must be generated with a release roxctl; otherwise generate
+      # copies ROX_* into the bundle and TestFeatureFlagSettings cannot fail the way
+      # nightlies do.
       run: |
+        if [[ "${GITHUB_REF}" =~ ^refs/tags/ ]] || [[ "${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-release-build') }}" == "true" ]]; then
+          export GOTAGS=release
+          echo "Building release roxctl (tag or ci-release-build)"
+        fi
         make roxctl_linux-amd64
         sudo cp bin/linux_amd64/roxctl /usr/local/bin/roxctl
         echo "${HOME}/go/bin" >> "$GITHUB_PATH"
@@ -149,16 +172,14 @@ jobs:
         QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
         REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
         REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
-      timeout-minutes: 90
+      timeout-minutes: 245
       run: tests/e2e/run.sh /tmp/e2e-test-logs
 
-    - name: Persist env vars for post-test
+    - name: Ensure central stability before post-test
       if: always()
       run: |
         source tests/e2e/lib.sh
         wait_for_api
-        echo "API_ENDPOINT=${API_ENDPOINT}" >> "$GITHUB_ENV"
-        echo "ROX_ADMIN_PASSWORD=$(cat deploy/k8s/central-deploy/password)" >> "$GITHUB_ENV"
 
     - name: Run post-test
       if: always()
@@ -198,12 +219,18 @@ jobs:
           exit 6
         fi
 
-    - name: Publish test summary
+    - name: Publish summary for failed tests
+      uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
+      if: always()
+      with:
+        paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
+        show: "fail"
+    - name: Publish summary for passed and skipped tests
       uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
       if: always()
       with:
         paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
-        show: all
+        show: "pass, skip"
 
     - name: Report junit failures in jira
       if: (!cancelled())
diff --git a/.github/workflows/e2e-qa-tests-gke-konflux.yaml b/.github/workflows/e2e-qa-tests-gke-konflux.yaml
new file mode 100644
index 0000000000000..8b050adcc6ef9
--- /dev/null
+++ b/.github/workflows/e2e-qa-tests-gke-konflux.yaml
@@ -0,0 +1,40 @@
+name: e2e-qa-tests-gke-konflux
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: |
+          Image tag to test. The caller needs to make sure that the tag carries the
+          "-fast" Konflux suffix if required (e.g. for development builds).
+        type: string
+        required: true
+      should-run:
+        description: true if should really run the job. false - otherwise, i.e. the job should be skipped.
+        type: boolean
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: |
+          Image tag to test. You need to make sure that the tag carries the
+          "-fast" Konflux suffix if required (e.g. for development builds).
+        type: string
+        required: true
+
+jobs:
+  run:
+    uses: ./.github/workflows/e2e-qa-tests.yaml
+    with:
+      should-run: ${{ github.event_name == 'workflow_dispatch' || inputs.should-run }}
+      tag: ${{ inputs.tag }}
+      ci-job-name: gke-qa-e2e-tests-konflux
+      cluster-name-prefix: e2e-qa-gke-konflux
+      cluster-provisioning-method: direct-gke
+      extra-env-vars: |
+        ORCHESTRATOR_FLAVOR=k8s
+        KUBERNETES_PROVIDER=gke
+        USE_KONFLUX_IMAGES=true
+        STORAGE_CLASS=stackrox-gke-ssd
+        SCANNER_V4_DB_STORAGE_CLASS=stackrox-gke-ssd
+    secrets: inherit
diff --git a/.github/workflows/e2e-qa-tests-gke.yaml b/.github/workflows/e2e-qa-tests-gke.yaml
new file mode 100644
index 0000000000000..6fb0aca91414d
--- /dev/null
+++ b/.github/workflows/e2e-qa-tests-gke.yaml
@@ -0,0 +1,35 @@
+name: e2e-qa-tests-gke
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: Image tag to test.
+        type: string
+        required: true
+      should-run:
+        description: true if should really run the job. false - otherwise, i.e. the job should be skipped.
+        type: boolean
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Image tag to test.
+        type: string
+        required: true
+
+jobs:
+  run:
+    uses: ./.github/workflows/e2e-qa-tests.yaml
+    with:
+      should-run: ${{ github.event_name == 'workflow_dispatch' || inputs.should-run }}
+      tag: ${{ inputs.tag }}
+      ci-job-name: gke-qa-e2e-tests
+      cluster-name-prefix: e2e-qa-tests-gke
+      cluster-provisioning-method: direct-gke
+      extra-env-vars: |
+        ORCHESTRATOR_FLAVOR=k8s
+        KUBERNETES_PROVIDER=gke
+        STORAGE_CLASS=stackrox-gke-ssd
+        SCANNER_V4_DB_STORAGE_CLASS=stackrox-gke-ssd
+    secrets: inherit
diff --git a/.github/workflows/e2e-qa-tests-ocp-fips-konflux.yaml b/.github/workflows/e2e-qa-tests-ocp-fips-konflux.yaml
new file mode 100644
index 0000000000000..7670ec997452d
--- /dev/null
+++ b/.github/workflows/e2e-qa-tests-ocp-fips-konflux.yaml
@@ -0,0 +1,52 @@
+name: e2e-qa-tests-ocp-fips-konflux
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: |
+          Image tag to test. The caller needs to make sure that the tag carries the
+          "-fast" Konflux suffix if required (e.g. for development builds).
+        type: string
+        required: true
+      should-run:
+        description: true if should really run the job. false - otherwise, i.e. the job should be skipped.
+        type: boolean
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: |
+          Image tag to test. You need to make sure that the tag carries the
+          "-fast" Konflux suffix if required (e.g. for development builds).
+        type: string
+        required: true
+
+jobs:
+  run:
+    uses: ./.github/workflows/e2e-qa-tests.yaml
+    with:
+      should-run: ${{ github.event_name == 'workflow_dispatch' || inputs.should-run }}
+      tag: ${{ inputs.tag }}
+      ci-job-name: ocp-qa-e2e-tests-fips-konflux
+      cluster-name-prefix: e2e-qa-ocp-fps-knflx
+      cluster-provisioning-method: infra
+      cluster-wait-timeout-minutes: 60
+      infra-flavor: openshift-4
+      infra-args: |
+        openshift-version=ocp/stable
+        master-node-type=e2-standard-4
+        master-node-count=3
+        worker-node-type=e2-standard-8
+        worker-node-count=3
+        ssd-storage-class=true
+        fips-enabled=true
+      infra-lifespan: 5h
+      # TODO(ROX-36332): setup workload identities
+      #   SETUP_WORKLOAD_IDENTITIES=true
+      extra-env-vars: |
+        ORCHESTRATOR_FLAVOR=openshift
+        KUBERNETES_PROVIDER=ocp
+        SFA_AGENT=true
+        USE_KONFLUX_IMAGES=true
+    secrets: inherit
diff --git a/.github/workflows/e2e-qa-tests.yaml b/.github/workflows/e2e-qa-tests.yaml
new file mode 100644
index 0000000000000..543d5288be977
--- /dev/null
+++ b/.github/workflows/e2e-qa-tests.yaml
@@ -0,0 +1,376 @@
+name: e2e-qa-tests
+
+on:
+  workflow_call:
+    inputs:
+      should-run:
+        description: "true if should really run the job. false - otherwise, i.e. the job should be skipped."
+        required: true
+        type: boolean
+      tag:
+        description: "Image tag to test."
+        required: true
+        type: string
+      ci-job-name:
+        description: "Unique job name, e.g. e2e-qa-tests-<cluster flavor>. Used to configure the image prefetcher and name uploaded artifacts. Propagated to tests as CI_JOB_NAME for test dispatching."
+        required: true
+        type: string
+      cluster-name-prefix:
+        description: "Used as prefix in provisioned cluster names. Maximum 20 characters."
+        required: true
+        type: string
+      cluster-provisioning-method:
+        description: "Selects cluster provisioning method to use (supported: direct-gke, infra)."
+        type: string
+        default: "direct-gke"
+      extra-env-vars:
+        description: "Environment variables for this flavor of QA E2E tests, as multi-line KEY=VALUE pairs"
+        required: false
+        type: string
+      infra-flavor:
+        description: "Infra cluster flavor, e.g. gke-default, ocp-4."
+        type: string
+        default: "gke-default"
+      infra-args:
+        description: "Infra cluster args as multi-line KEY=VALUE pairs, one per line."
+        type: string
+        default: |
+          nodes=3
+          machine-type=e2-standard-8
+      infra-lifespan:
+        description: "Infra cluster lifespan (auto-deleted after expiry)."
+        type: string
+        default: "5h"
+      cluster-wait-timeout-minutes:
+        description: "Timeout for waiting on cluster provisioning (OCP needs longer)."
+        type: number
+        default: 25
+      job-timeout-minutes:
+        description: "Overall job timeout."
+        type: number
+        default: 361
+      part1-timeout-minutes:
+        description: "Part 1 test timeout."
+        type: number
+        default: 245
+      part2-timeout-minutes:
+        description: "Part 2 test timeout."
+        type: number
+        default: 35
+      db-backup-restore-timeout-minutes:
+        description: "DB backup and restore test timeout."
+        type: number
+        default: 30
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  qa-e2e-tests:
+    if: inputs.should-run
+    runs-on: ubuntu-24.04
+    env:
+      MAIN_IMAGE_TAG: ${{ inputs.tag }}
+      BUILD_TAG: ${{ inputs.tag }}
+      CI_JOB_NAME: ${{ inputs.ci-job-name }}
+      ARTIFACT_DIR: ./junit-reports/
+      USE_LOCAL_ROXCTL: "true"
+      ROX_RISK_REPROCESSING_INTERVAL: 15s
+      ROX_SENSOR_CONNECTION_RETRY_MAX_INTERVAL: 30s
+      GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
+      QA_TEST_DEBUG_LOGS: /tmp/qa-tests-backend-logs
+      PYTHONUNBUFFERED: "1"
+      CLUSTER_NAME_PREFIX: "${{ inputs.cluster-name-prefix }}"
+      CLUSTER_NAME_PREFIX_MAX: "20"
+    timeout-minutes: ${{ inputs.job-timeout-minutes }}
+    steps:
+      - name: Validate workflow input
+        run: |
+          case "${{ inputs.cluster-provisioning-method }}" in
+            direct-gke|infra) ;;
+            *) echo "::error::Unknown cluster-provisioning-method: '${{ inputs.cluster-provisioning-method }}'. Supported: direct-gke, infra"; exit 1 ;;
+          esac
+
+          if [[ "${#CLUSTER_NAME_PREFIX}" -gt "$CLUSTER_NAME_PREFIX_MAX" ]]; then
+            echo "::error::Workflow input cluster-name-prefix must not be larger than $CLUSTER_NAME_PREFIX_MAX characters (is ${#CLUSTER_NAME_PREFIX} characters long)."
+            exit 1
+          fi
+
+      - name: Checkout repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - uses: ./.github/actions/job-preamble
+        with:
+          gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
+
+      - name: Compute cluster name for infra-provisioned cluster
+        if: inputs.cluster-provisioning-method == 'infra'
+        # infractl enforces a 28-char limit for cluster names.
+        run: |
+          cluster_name_max=28
+
+          hash_length=$(( cluster_name_max - 1 - CLUSTER_NAME_PREFIX_MAX ))
+          hash_input="${{ github.run_id }}-${{ github.run_attempt }}"
+          hash="$(echo "$hash_input" | sha256sum)"
+          hash_truncated="${hash:0:$hash_length}"
+
+          cluster_name="${CLUSTER_NAME_PREFIX}-${hash_truncated}"
+          echo "CLUSTER_NAME=${cluster_name}" >> "$GITHUB_ENV"
+
+      - name: Prepare infra args
+        if: inputs.cluster-provisioning-method == 'infra'
+        id: prepare-infra-args
+        env:
+          INFRA_ARGS: ${{ inputs.infra-args }}
+        run: |
+          args=$(echo "$INFRA_ARGS" | grep -v '^$' | paste -sd ',' -)
+          echo "args=$args" >> "$GITHUB_OUTPUT"
+
+      - name: Trigger cluster creation via infra
+        if: inputs.cluster-provisioning-method == 'infra'
+        uses: stackrox/actions/infra/create-cluster@d624eeae7073b3acb838aab7705730b2de58a4a0 # ratchet:stackrox/actions/infra/create-cluster@v1
+        with:
+          token: ${{ secrets.INFRA_TOKEN }}
+          flavor: ${{ inputs.infra-flavor }}
+          name: ${{ env.CLUSTER_NAME }}
+          lifespan: ${{ inputs.infra-lifespan }}
+          args: ${{ steps.prepare-infra-args.outputs.args }}
+          wait: false
+
+      - name: Set up GCloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # ratchet:google-github-actions/setup-gcloud@v3
+        with:
+          install_components: "gke-gcloud-auth-plugin,beta"
+
+      # In the direct-gke provisioning case, this step also exports CLUSTER_NAME
+      # into the environments.
+      - name: Create cluster via direct-gke
+        if: inputs.cluster-provisioning-method == 'direct-gke'
+        timeout-minutes: ${{ inputs.cluster-wait-timeout-minutes }}
+        env:
+          MACHINE_TYPE: "e2-standard-8"
+          NUM_NODES: "3"
+          GKE_SPOT: "true"
+        run: |
+          scripts/ci/gke.sh provision_gke_cluster "$CLUSTER_NAME_PREFIX"
+          echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"
+
+      - name: Docker login to Quay.io
+        env:
+          REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
+        run: docker login -u "${REGISTRY_USERNAME}" --password-stdin quay.io <<<"${REGISTRY_PASSWORD}"
+
+      - name: Set flavor-specific env vars
+        env:
+          EXTRA_ENV_VARS: ${{ inputs.extra-env-vars }}
+        run: |
+          while IFS= read -r line; do
+            if [[ -n "$line" ]]; then
+              echo "$line" >> "$GITHUB_ENV"
+            fi
+          done <<< "$EXTRA_ENV_VARS"
+
+      - name: Install roxctl
+        uses: stackrox/roxctl-installer-action@47fb4f5b275066b8322369e6e33fa010915b0d13 # ratchet:stackrox/roxctl-installer-action@v1
+        with:
+          roxctl-release: latest
+
+      - name: Retrieving roxie version from repository
+        id: roxie-version
+        run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+      - name: Install roxie
+        uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1
+        with:
+          version: "v${{ steps.roxie-version.outputs.version }}"
+          gh-token: ${{ github.token }}
+
+      - name: Install oc
+        if: startsWith(inputs.infra-flavor, 'openshift')
+        run: |
+          curl -fsSL --retry 5 --retry-all-errors https://mirror.openshift.com/pub/openshift-v5/clients/ocp/stable/openshift-client-linux.tar.gz \
+            | tar xz -C /usr/local/bin oc
+          oc version --client
+
+      - uses: stackrox/actions/infra/install-infractl@3b27674f0fa69f2d8c31ab26aa63c9f76401c64e # ratchet:stackrox/actions/infra/install-infractl@v1
+        if: inputs.cluster-provisioning-method == 'infra'
+
+      - name: Wait for infra cluster and get kubeconfig
+        if: inputs.cluster-provisioning-method == 'infra'
+        env:
+          INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+        timeout-minutes: ${{ inputs.cluster-wait-timeout-minutes }}
+        run: |
+          infractl wait "${CLUSTER_NAME}"
+          infractl artifacts "${CLUSTER_NAME}" --download-dir artifacts > /dev/null
+          echo "KUBECONFIG=${PWD}/artifacts/kubeconfig" >> "$GITHUB_ENV"
+
+      # gcloud container clusters create is synchronous, so the cluster is
+      # already RUNNING at this point. wait_for_cluster provides additional
+      # guarantees by polling until all kube-system pods are ready.
+      - name: Wait for cluster to stabilize
+        timeout-minutes: 5
+        env:
+          CLUSTER_PROVISIONING_METHOD: ${{ inputs.cluster-provisioning-method }}
+        run: |
+          kubectl cluster-info
+          kubectl get nodes
+          if [[ "$CLUSTER_PROVISIONING_METHOD" == "direct-gke" ]]; then
+            scripts/ci/gke.sh wait_for_cluster
+          fi
+
+      - name: Create artifact directory
+        run: mkdir -p "$ARTIFACT_DIR"
+
+      - name: Download Go module dependencies
+        # The qa-tests-backend Makefile copies scanner protos from the Go module
+        # cache (via go list -m). Unlike Prow's apollo-ci image, GHA runners
+        # don't have the cache pre-populated.
+        run: go mod download github.com/stackrox/scanner
+
+      - name: Run pre-test
+        shell: python
+        env:
+          QUAY_RHACS_ENG_BEARER_TOKEN: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}
+          QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
+          QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
+        run: |
+          import sys
+          sys.path.append('.openshift-ci')
+          from pre_tests import PreSystemTests
+          PreSystemTests().run()
+
+      - name: Run Part 1 tests
+        env: &test_env
+          USE_ROXIE_DEPLOY: true
+          QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
+          QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
+          REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
+          REDHAT_USERNAME: ${{ secrets.REDHAT_USERNAME }}
+          REDHAT_PASSWORD: ${{ secrets.REDHAT_PASSWORD }}
+          GOOGLE_CREDENTIALS_GCR_SCANNER_V2: ${{ secrets.GOOGLE_CREDENTIALS_GCR_SCANNER_V2 }}
+          GOOGLE_CREDENTIALS_GCR_NO_ACCESS_KEY_V2: ${{ secrets.GOOGLE_CREDENTIALS_GCR_NO_ACCESS_KEY_V2 }}
+          GHCR_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}
+          GHCR_REGISTRY_PASSWORD: ${{ secrets.GHCR_REGISTRY_PASSWORD }}
+          AZURE_REGISTRY_PASSWORD: ${{ secrets.AZURE_REGISTRY_PASSWORD }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_ECR_REGISTRY_NAME: ${{ secrets.AWS_ECR_REGISTRY_NAME }}
+          AWS_ECR_REGISTRY_REGION: ${{ secrets.AWS_ECR_REGISTRY_REGION }}
+          AWS_ASSUME_ROLE_ACCESS_KEY_ID: ${{ secrets.AWS_ASSUME_ROLE_ACCESS_KEY_ID }}
+          AWS_ASSUME_ROLE_SECRET_ACCESS_KEY: ${{ secrets.AWS_ASSUME_ROLE_SECRET_ACCESS_KEY }}
+          AWS_ASSUME_ROLE_ROLE_ID: ${{ secrets.AWS_ASSUME_ROLE_ROLE_ID }}
+          AWS_ASSUME_ROLE_EXTERNAL_ID: ${{ secrets.AWS_ASSUME_ROLE_EXTERNAL_ID }}
+          AWS_ASSUME_ROLE_TEST_CONDITION_ID: ${{ secrets.AWS_ASSUME_ROLE_TEST_CONDITION_ID }}
+          SLACK_FIXABLE_VULNS_CHANNEL: ${{ secrets.SLACK_FIXABLE_VULNS_CHANNEL }}
+          SLACK_ALT_WEBHOOK: ${{ secrets.SLACK_ALT_WEBHOOK }}
+          GOOGLE_ARTIFACT_REGISTRY_SERVICE_ACCOUNT_V2: ${{ secrets.GOOGLE_ARTIFACT_REGISTRY_SERVICE_ACCOUNT_V2 }}
+          QUAY_RHACS_ENG_BEARER_TOKEN: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}
+          OCM_OFFLINE_TOKEN: ${{ secrets.OCM_OFFLINE_TOKEN }}
+          CLOUD_SOURCES_TEST_OCM_CLIENT_ID: ${{ secrets.CLOUD_SOURCES_TEST_OCM_CLIENT_ID }}
+          CLOUD_SOURCES_TEST_OCM_CLIENT_SECRET: ${{ secrets.CLOUD_SOURCES_TEST_OCM_CLIENT_SECRET }}
+          SLACK_MAIN_WEBHOOK: ${{ secrets.SLACK_MAIN_WEBHOOK }}
+          GCP_SERVICE_ACCOUNT_EMAIL_STACKROX_CI_WORKLOAD_IDENTITY: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL_STACKROX_CI_WORKLOAD_IDENTITY }}
+          GCP_PROJECT_NUMBER_WORKLOAD_IDENTITY: ${{ secrets.GCP_PROJECT_NUMBER_WORKLOAD_IDENTITY }}
+        timeout-minutes: ${{ inputs.part1-timeout-minutes }}
+        run: qa-tests-backend/scripts/run-part-1.sh
+
+      - name: Run Part 1 post-test
+        if: always() && env.KUBECONFIG != ''
+        shell: python
+        run: |
+          import os, sys
+          sys.path.append('.openshift-ci')
+          from post_tests import PostClusterTest
+          post = PostClusterTest(
+              check_stackrox_logs=True,
+              artifact_destination_prefix="part-1",
+          )
+          post.run([os.environ['ARTIFACT_DIR']])
+
+      - name: Run Part 2 tests
+        id: run-part-2
+        env: *test_env
+        timeout-minutes: ${{ inputs.part2-timeout-minutes }}
+        run: qa-tests-backend/scripts/run-part-2.sh
+
+      - name: Run Part 2 post-test
+        if: always() && steps.run-part-2.outcome != 'skipped' && env.KUBECONFIG != ''
+        shell: python
+        run: |
+          import os, sys
+          sys.path.append('.openshift-ci')
+          from post_tests import PostClusterTest
+          post = PostClusterTest(
+              check_stackrox_logs=True,
+              artifact_destination_prefix="part-2",
+          )
+          post.run([os.environ['ARTIFACT_DIR']])
+
+      - name: Run final-post
+        if: always()
+        shell: python
+        run: |
+          import sys
+          sys.path.append('.openshift-ci')
+          from post_tests import FinalPost
+          FinalPost(store_qa_tests_data=True).run()
+
+      - name: Publish summary for failed tests
+        uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
+        if: always()
+        with:
+          paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
+          show: "fail"
+      - name: Publish summary for passed and skipped tests
+        uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2
+        if: always()
+        with:
+          paths: ${{ env.ARTIFACT_DIR }}/**/*.xml
+          show: "pass, skip"
+
+      - name: Report junit failures in jira
+        if: (!cancelled())
+        id: junit2jira
+        uses: ./.github/actions/junit2jira
+        with:
+          create-jiras: ${{ github.event_name == 'push' }}
+          jira-user: ${{ secrets.JIRA_USER }}
+          jira-token: ${{ secrets.JIRA_TOKEN }}
+          gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
+          directory: ${{ env.ARTIFACT_DIR }}
+
+      # CLUSTER_NAME is set before cluster creation, so it may be non-empty
+      # even when creation ultimately failed. We intentionally attempt teardown
+      # here anyway, just in case a cluster has been provisioned even though
+      # a failure during cluster creation has been surfaced.
+      - name: Delete cluster via direct-gke
+        if: always() && inputs.cluster-provisioning-method == 'direct-gke'
+        continue-on-error: true
+        run: |
+          if [[ -z "${CLUSTER_NAME:-}" ]]; then
+            echo "No cluster to teardown"
+            exit 0
+          fi
+          if ! scripts/ci/gke.sh teardown_gke_cluster false; then
+            echo "::warning::WARNING: Could not delete the cluster ${CLUSTER_NAME}. See the step logs for details."
+            exit 6
+          fi
+
+      - name: Delete cluster via infra
+        if: always() && inputs.cluster-provisioning-method == 'infra'
+        continue-on-error: true
+        env:
+          INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+        run: |
+          infractl delete "${CLUSTER_NAME}"
diff --git a/.github/workflows/emailsender-central-compatibility.yaml b/.github/workflows/emailsender-central-compatibility.yaml
index 92e4b7be8941b..f5d3f3952dae0 100644
--- a/.github/workflows/emailsender-central-compatibility.yaml
+++ b/.github/workflows/emailsender-central-compatibility.yaml
@@ -27,7 +27,7 @@ jobs:
   e2e-test-on-kind:
     timeout-minutes: 60
     name: "Test on kind cluster"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ !github.event.pull_request.head.repo.fork }} # do not run for PRs from forks
     permissions:
       id-token: write
@@ -62,8 +62,19 @@ jobs:
       - uses: ./stackrox/.github/actions/job-preamble
         with:
           free-disk-space: 40
+
+      - name: Retrieve roxie version from repository
+        id: roxie-version
+        run: echo "version=$(cat stackrox/ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+      - name: Install roxie
+        uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1
+        with:
+          version: "v${{ steps.roxie-version.outputs.version }}"
+          gh-token: ${{ github.token }}
+
       - name: Create Kind cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # ratchet:helm/kind-action@v1
+        uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # ratchet:helm/kind-action@v1.15.0
         with:
           cluster_name: kind
           version: v0.32.0
diff --git a/.github/workflows/finish-release.yml b/.github/workflows/finish-release.yml
index 480a4b67d6bfc..3e7a22ecaeed7 100644
--- a/.github/workflows/finish-release.yml
+++ b/.github/workflows/finish-release.yml
@@ -34,7 +34,7 @@ concurrency: Release automation ${{ inputs.version }}
 
 jobs:
   properties:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.fetch.outputs.dry-slack-channel, steps.fetch.outputs.slack-channel))[github.event.inputs.dry-run != 'true'] }}
     steps:
@@ -47,7 +47,7 @@ jobs:
   run-parameters:
     if: github.event_name == 'workflow_dispatch'
     name: Run parameters
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - run: |
           [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run"
@@ -70,7 +70,7 @@ jobs:
 
   preflight-checks:
     needs: [variables]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Verify that this release is listed in scanner’s RELEASE_VERSION file on master
         run: |
@@ -81,7 +81,7 @@ jobs:
 
   publish-release:
     name: Tag Release ${{ needs.variables.outputs.named-release-patch }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [variables, properties, preflight-checks]
     steps:
       - name: Check out code
@@ -183,7 +183,7 @@ jobs:
 
   update-infra-demo-version:
     name: Update infra demo default versions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [publish-release]
     env:
       BRANCH: "bump-demo-versions-${{ inputs.version }}"
diff --git a/.github/workflows/fixxxer.yaml b/.github/workflows/fixxxer.yaml
index d581a1ae15229..f2706f6355ef5 100644
--- a/.github/workflows/fixxxer.yaml
+++ b/.github/workflows/fixxxer.yaml
@@ -15,7 +15,7 @@ jobs:
     name: Run PR Fixxxer
     # TODO: support leading and trailing whitespace too
     if: ${{ github.event.issue.pull_request && github.event.comment.body == '/fixxx' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11@sha256:df3459cf038e73775314b3a5d36d14dda41e6df438a0273c9efa8d23e0f2358a # ratchet:quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11
     steps:
diff --git a/.github/workflows/konflux-auto-retest.yml b/.github/workflows/konflux-auto-retest.yml
index 78ef8543bb472..2a76babeb7de6 100644
--- a/.github/workflows/konflux-auto-retest.yml
+++ b/.github/workflows/konflux-auto-retest.yml
@@ -1,24 +1,18 @@
-name: Retest Konflux Builds
+name: Periodic Retest Failed Konflux Builds
 
 on:
-  check_run:
-    types: [completed]
-  pull_request:
-    types: [synchronize]
+  schedule:
+    - cron: '5,15,25,35,45,55 * * * *'
+  workflow_dispatch:
 
 jobs:
-  retest-failed-builds:
-    # Guard against phantom fork PRs: when a fork has a sync PR whose head
-    # points at our master, GitHub populates check_run.pull_requests[0] with
-    # the fork's PR number. Verify the PR URL belongs to this repo.
-    if: >-
-      github.event_name == 'pull_request' ||
-      contains(github.event.check_run.pull_requests[0].url, format('/repos/{0}/pulls/', github.repository))
-    uses: stackrox/actions/.github/workflows/retest-konflux-builds.yml@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/.github/workflows/retest-konflux-builds.yml@v1
+  retest:
+    uses: stackrox/actions/.github/workflows/periodic-retest-konflux-builds.yml@6691d5c300d4af17546145bdbbb9862c53975af4 # ratchet:stackrox/actions/.github/workflows/periodic-retest-konflux-builds.yml@v1
     permissions:
       pull-requests: write
       issues: write
+      checks: read
+      contents: read
     with:
       max_retries: 3
-      check_name_suffix: '-on-push'
       retest_command: '/konflux-retest'
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 3a48fb21bfee2..53e135c2eebf5 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   label-pr:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ github.actor != 'dependabot[bot]' && !github.event.pull_request.head.repo.fork }}
     steps:
     - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # ratchet:actions/labeler@v6
diff --git a/.github/workflows/nightly-tag.yml b/.github/workflows/nightly-tag.yml
index d030b195015b5..6ef44bae5fd8f 100644
--- a/.github/workflows/nightly-tag.yml
+++ b/.github/workflows/nightly-tag.yml
@@ -2,11 +2,11 @@ name: Create nightly tag
 on:
   workflow_dispatch:
   schedule:
-  - cron: 0 0 * * 1-5
+  - cron: 0 2 * * 1-5
 jobs:
   create-nightly-tag:
     if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -20,7 +20,7 @@ jobs:
   slack-on-failure:
     needs: create-nightly-tag
     if: failure()
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Slack on failure
       uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # ratchet:slackapi/slack-github-action@v3.0.3
diff --git a/.github/workflows/notify-milestone-change.yml b/.github/workflows/notify-milestone-change.yml
index a6a648b50dec0..dc327ead0b241 100644
--- a/.github/workflows/notify-milestone-change.yml
+++ b/.github/workflows/notify-milestone-change.yml
@@ -18,7 +18,7 @@ env:
 jobs:
   properties:
     name: Read repository properties
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       docs-repository: ${{ steps.properties.outputs.docs-repository }}
       slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.properties.outputs.dry-slack-channel, steps.properties.outputs.slack-channel))[github.repository == 'stackrox/stackrox'] }}
@@ -31,7 +31,7 @@ jobs:
         run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT"
 
   notify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [properties]
     steps:
       - name: Determine Jira context for PR
diff --git a/.github/workflows/performance-tests.yml b/.github/workflows/performance-tests.yml
index 3cc84c9082110..3e33fc821ee70 100644
--- a/.github/workflows/performance-tests.yml
+++ b/.github/workflows/performance-tests.yml
@@ -10,7 +10,7 @@ concurrency: performance-tests-${{ github.ref }}
 jobs:
   wait-for-images:
     name: Wait for images
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci-performance-tests') }}
     steps:
       - name: Checkout repo
@@ -33,7 +33,7 @@ jobs:
   run-k6-performance-tests:
     needs: [wait-for-images]
     name: Run k6 performance tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci-performance-tests') }}
     env:
       USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
@@ -57,9 +57,19 @@ jobs:
           repository: "stackrox/workflow"
           path: workflow
 
+      - name: Retrieve roxie version from repository
+        id: roxie-version
+        run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"
+
+      - name: Install roxie
+        uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1
+        with:
+          version: "v${{ steps.roxie-version.outputs.version }}"
+          gh-token: ${{ secrets.GITHUB_TOKEN }}
+
       # Create scale cluster with larger nodes.
       - name: Create testing cluster
-        uses: stackrox/actions/infra/create-cluster@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/infra/create-cluster@v1
+        uses: stackrox/actions/infra/create-cluster@d624eeae7073b3acb838aab7705730b2de58a4a0 # ratchet:stackrox/actions/infra/create-cluster@v1
         with:
           token: ${{ secrets.INFRA_TOKEN }}
           flavor: gke-default
@@ -69,7 +79,7 @@ jobs:
           wait: true
 
       # Fetch infractl artifacts
-      - uses: stackrox/actions/infra/install-infractl@4efb76aa74694b9ee55e95c4ead57fdf50d79ddf # ratchet:stackrox/actions/infra/install-infractl@v1
+      - uses: stackrox/actions/infra/install-infractl@3b27674f0fa69f2d8c31ab26aa63c9f76401c64e # ratchet:stackrox/actions/infra/install-infractl@v1
       - uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # ratchet:google-github-actions/auth@v3
         with:
           credentials_json: "${{ secrets.GCP_PERFORMANCE_TESTER_CI_SA }}"
@@ -97,12 +107,8 @@ jobs:
       - name: Clean previous installation
         run: |
           source ./workflow/env.sh
-          ./scripts/k8s/cleanup.sh stackrox
-
-          # Delete all namespaces created by scale script.
-          for i in $(seq 1 "${SCALE_WORKLOAD_CLUSTERS}"); do
-          ./scripts/k8s/cleanup.sh "stackrox${i}"
-          done
+          roxie teardown central --single-namespace
+          ./scale/dev/kill-sensors.sh
 
       - name: Get PR image tag
         run: |
@@ -112,37 +118,29 @@ jobs:
       # Install Central + CentralDB
       - name: Launch central services
         env:
-          LOAD_BALANCER: lb
-          ROX_POSTGRES_DATASTORE: "true"
-          MONITORING_SUPPORT: "false"
           REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
           REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
         run: |
-          source ./workflow/env.sh
+          set -euo pipefail
 
-          # ROX-29641: We are facing issues with workload generation on GKE when Scanner v4 is enabled.
-          export ROX_SCANNER_V4=false
           ./scale/dev/launch_central.sh
-
+          source .roxie.env
           # Required for k6 tests to run.
-          echo "ROX_ADMIN_PASSWORD=$(cat ./deploy/k8s/central-deploy/password)" >> "$GITHUB_ENV"
-          echo "ROX_PASSWORD=$(cat ./deploy/k8s/central-deploy/password)" >> "$GITHUB_ENV"
-          echo "::add-mask::$(cat ./deploy/k8s/central-deploy/password)"
+          echo "ROX_ADMIN_PASSWORD=${ROX_ADMIN_PASSWORD}" >> "$GITHUB_ENV"
+          echo "ROX_PASSWORD=${ROX_ADMIN_PASSWORD}" >> "$GITHUB_ENV"
+          echo "::add-mask::${ROX_ADMIN_PASSWORD}"
 
-          LB_IP="$(kubectl -n stackrox get svc/central-loadbalancer -o json | jq -r '.status.loadBalancer.ingress[0] | .ip // .hostname')"
-          echo "HOST=https://${LB_IP}:443" >> "$GITHUB_ENV"
-          echo "API_ENDPOINT=${LB_IP}:443" >> "$GITHUB_ENV"
-          echo "::add-mask::${LB_IP}"
+          echo "HOST=${ROX_BASE_URL}" >> "$GITHUB_ENV"
+          echo "API_ENDPOINT=${API_ENDPOINT}" >> "$GITHUB_ENV"
+          echo "::add-mask::${API_ENDPOINT}"
 
       - name: Generate workload
         env:
-          LOAD_BALANCER: lb
-          ROX_POSTGRES_DATASTORE: "true"
-          MONITORING_SUPPORT: "false"
           REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
           REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
         run: |
           source ./workflow/env.sh
+          source .roxie.env
           ./scale/dev/run-many.sh "${SCALE_WORKLOAD_TYPE}" "${SCALE_WORKLOAD_CLUSTERS}"
 
           num_deployments=$(yq '.deploymentWorkload[] | select(.deploymentType == "Deployment") | .numDeployments' "./scale/workloads/${SCALE_WORKLOAD_TYPE}.yaml")
diff --git a/.github/workflows/release-ci.yaml b/.github/workflows/release-ci.yaml
index 70403c26c9ec1..7a631fd36b3ad 100644
--- a/.github/workflows/release-ci.yaml
+++ b/.github/workflows/release-ci.yaml
@@ -9,19 +9,23 @@ on:
 jobs:
   run-parameters:
     name: Run parameters
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - run: |
           echo "Event: ${{ github.event_name }}" >> "$GITHUB_STEP_SUMMARY"
           echo "Ref: ${{ github.ref_name }}" >> "$GITHUB_STEP_SUMMARY"
 
   build:
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
     name: Build
     uses: ./.github/workflows/build.yaml
     secrets: inherit
 
   check-is-release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       is_release: ${{ steps.is_release_check.outputs.is_release }}
     steps:
@@ -39,21 +43,8 @@ jobs:
             echo "is_release=false" | tee -a "$GITHUB_OUTPUT"
           fi
 
-  check-scanner-version:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref_name }}
-      - name: Check scanner version
-        run: |
-          scripts/ci/lib.sh \
-            check_scanner_version
-
   check-collector-version:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -66,7 +57,7 @@ jobs:
             check_collector_version
 
   check-fact-version:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -79,9 +70,9 @@ jobs:
             check_fact_version
 
   publish-helm-charts:
-    needs: [build, check-scanner-version, check-collector-version, check-fact-version, check-is-release]
+    needs: [build, check-collector-version, check-fact-version, check-is-release]
     if: needs.check-is-release.outputs.is_release == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -108,9 +99,9 @@ jobs:
 
   # Publish `roxagent` and `roxctl`.
   publish-cli:
-    needs: [build, check-scanner-version, check-collector-version, check-fact-version, check-is-release]
+    needs: [build, check-collector-version, check-fact-version, check-is-release]
     if: needs.check-is-release.outputs.is_release == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -134,9 +125,9 @@ jobs:
             publish_cli "${STACKROX_TAG}"
 
   publish-openapispec:
-    needs: [build, check-scanner-version, check-collector-version, check-fact-version, check-is-release]
+    needs: [build, check-collector-version, check-fact-version, check-is-release]
     if: needs.check-is-release.outputs.is_release == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
diff --git a/.github/workflows/retest_periodic.yml b/.github/workflows/retest_periodic.yml
index 60c49dd15f891..3c371a6102804 100644
--- a/.github/workflows/retest_periodic.yml
+++ b/.github/workflows/retest_periodic.yml
@@ -10,7 +10,7 @@ jobs:
   retest:
     if:  ${{ github.repository_owner == 'stackrox' }}
     timeout-minutes: 10
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -24,6 +24,9 @@ jobs:
       with:
         go-version-file: go.mod
 
+    - name: Test
+      run: cd tools/retest && go test ./...
+
     - name: Retest
       env:
         GITHUB_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/scan-image-vulnerabilities.yaml b/.github/workflows/scan-image-vulnerabilities.yaml
index d973a73cdfa7f..bb4befe0852d1 100644
--- a/.github/workflows/scan-image-vulnerabilities.yaml
+++ b/.github/workflows/scan-image-vulnerabilities.yaml
@@ -21,7 +21,7 @@ run-name: ${{ format('Scan images for vulnerabilities ({0})', inputs.version ||
 jobs:
   run-parameters:
     name: Run parameters
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       wait-for-images-limit: ${{ steps.run-parameters.outputs.wait-for-images-limit }}
       version: ${{ steps.run-parameters.outputs.version }}
@@ -47,7 +47,7 @@ jobs:
 
   scan-image-vulnerabilities-upstream:
     name: "Upstream: ${{ matrix.image }}:${{ needs.run-parameters.outputs.version }}"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [run-parameters]
     permissions:
       # Needed for stackrox/central-login to create the JWT token.
@@ -62,10 +62,6 @@ jobs:
             "fact",
             "main",
             "roxctl",
-            "scanner",
-            "scanner-db",
-            "scanner-db-slim",
-            "scanner-slim",
             "scanner-v4",
             "scanner-v4-db",
             "stackrox-operator",
@@ -83,7 +79,7 @@ jobs:
           echo "tag=${tag}" >> "${GITHUB_OUTPUT}"
 
       - name: Scan image vulnerabilities
-        uses: stackrox/actions/release/scan-image-vulnerabilities@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/scan-image-vulnerabilities@v1
+        uses: stackrox/actions/release/scan-image-vulnerabilities@df8c8f5830fc09d37908be1a9744365a93c5b3cc # ratchet:stackrox/actions/release/scan-image-vulnerabilities@v1
         id: scan-image
         with:
           image: rhacs-eng/${{ matrix.image }}
@@ -103,7 +99,7 @@ jobs:
 
   scan-image-vulnerabilities-konflux:
     name: "Konflux: ${{ matrix.image }}:${{ needs.run-parameters.outputs.version }}"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [run-parameters]
     permissions:
       # Needed for stackrox/central-login to create the JWT token.
@@ -118,10 +114,6 @@ jobs:
             "release-fact",
             "release-main",
             "release-roxctl",
-            "release-scanner",
-            "release-scanner-db",
-            "release-scanner-db-slim",
-            "release-scanner-slim",
             "release-scanner-v4",
             "release-scanner-v4-db",
             "release-operator",
@@ -141,7 +133,7 @@ jobs:
           echo "tag=${tag}" >> "${GITHUB_OUTPUT}"
 
       - name: Scan image vulnerabilities
-        uses: stackrox/actions/release/scan-image-vulnerabilities@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/scan-image-vulnerabilities@v1
+        uses: stackrox/actions/release/scan-image-vulnerabilities@df8c8f5830fc09d37908be1a9744365a93c5b3cc # ratchet:stackrox/actions/release/scan-image-vulnerabilities@v1
         id: scan-image
         with:
           image: rhacs-eng/${{ matrix.image }}
diff --git a/.github/workflows/scanner-db-integration-tests.yaml b/.github/workflows/scanner-db-integration-tests.yaml
index 785f47924b715..effbe1190271e 100644
--- a/.github/workflows/scanner-db-integration-tests.yaml
+++ b/.github/workflows/scanner-db-integration-tests.yaml
@@ -20,7 +20,7 @@ jobs:
   db-integration-tests:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.11@sha256:cea78f2b3a5a38c9ccda678712daaed90b7c372d6b5df963feb758b32dccebe1 # ratchet:quay.io/stackrox-io/apollo-ci:scanner-test-0.5.11
     steps:
diff --git a/.github/workflows/scanner-e2e-test.yaml b/.github/workflows/scanner-e2e-test.yaml
index e4ee1333e3964..b2d0e9670e165 100644
--- a/.github/workflows/scanner-e2e-test.yaml
+++ b/.github/workflows/scanner-e2e-test.yaml
@@ -14,7 +14,7 @@ jobs:
     if: >
       github.event_name != 'pull_request'
       || contains(github.event.pull_request.labels.*.name, 'scanner-functional-tests')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -36,7 +36,7 @@ jobs:
     name: Deploy and run
     needs:
       - scanner-ft-images
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       SCANNER_E2E_QUAY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
       SCANNER_E2E_QUAY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
diff --git a/.github/workflows/scanner-mapping-update.yaml b/.github/workflows/scanner-mapping-update.yaml
index 77c4faae80777..236c427937429 100644
--- a/.github/workflows/scanner-mapping-update.yaml
+++ b/.github/workflows/scanner-mapping-update.yaml
@@ -7,7 +7,7 @@ on:
 jobs:
   update-scanner-mappings:
     if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       REPOMAPPING_DIR: repomapping
     steps:
@@ -34,7 +34,18 @@ jobs:
         # Upload mapping.zip to Google Cloud Storage
         gsutil cp -r "redhat-repository-mappings" "gs://definitions.stackrox.io/v4"
 
-    - name: Send Slack notification on workflow failure
-      if: failure()
-      run: |
-        curl -X POST -H 'Content-type: application/json' --data '{"text":"<!subteam^S04S96AAVND|acs-scanner-primary> Failure in Scanner V4 Updater Workflow: Update Repository Mappings"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+  send-notification:
+    needs: update-scanner-mappings
+    if: failure()
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      checks: read
+      actions: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+        mention: "<!subteam^S04S96AAVND|acs-scanner-primary>"
diff --git a/.github/workflows/scanner-nvd-update.yaml b/.github/workflows/scanner-nvd-update.yaml
index 04839e21977d5..8294ffb27ab71 100644
--- a/.github/workflows/scanner-nvd-update.yaml
+++ b/.github/workflows/scanner-nvd-update.yaml
@@ -12,7 +12,7 @@ on:
 
 jobs:
   fetch-nvd-feeds:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >
       github.repository_owner == 'stackrox' &&
       github.event_name == 'schedule' ||
@@ -51,7 +51,7 @@ jobs:
         if-no-files-found: error
 
   fetch-nvd-api:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >
       github.event_name == 'schedule' ||
       github.event_name == 'workflow_dispatch' ||
@@ -94,7 +94,7 @@ jobs:
   upload-pr-nvd-feeds:
     needs:
     - fetch-nvd-feeds
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-nvd')
     steps:
     # Checkout master to get the latest local actions
@@ -153,7 +153,7 @@ jobs:
   upload-nvd-feeds:
     needs:
     - fetch-nvd-feeds
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
     steps:
     - name: Checkout repository
@@ -182,7 +182,7 @@ jobs:
   upload-nvd-api:
     needs:
     - fetch-nvd-api
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
     steps:
     - name: Checkout repository
@@ -212,9 +212,15 @@ jobs:
     needs:
       - upload-nvd-feeds
       - upload-nvd-api
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ failure() && github.ref_name == 'master' }}
+    permissions:
+      contents: read
+      checks: read
+      actions: read
     steps:
-    - name: Send Slack notification on workflow failure
-      run: |
-        curl -X POST -H 'Content-type: application/json' --data '{"text":"<${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|Workflow ${{ github.workflow }}> failed in repository ${{ github.repository }}: Failed to update NVD CVEs"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
diff --git a/.github/workflows/scanner-offline-bundle-update.yaml b/.github/workflows/scanner-offline-bundle-update.yaml
index 256665b2be78e..10213e553e435 100644
--- a/.github/workflows/scanner-offline-bundle-update.yaml
+++ b/.github/workflows/scanner-offline-bundle-update.yaml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   offline-bundle-matrix:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >
       github.repository_owner == 'stackrox' &&
       github.event_name == 'schedule' ||
@@ -36,7 +36,7 @@ jobs:
 
   offline-bundle-generate:
     needs: offline-bundle-matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -69,7 +69,7 @@ jobs:
         if-no-files-found: error
 
   offline-bundle-upload:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
     - offline-bundle-generate
     steps:
@@ -125,9 +125,15 @@ jobs:
     - offline-bundle-matrix
     - offline-bundle-generate
     - offline-bundle-upload
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'schedule' && failure()
+    permissions:
+      contents: read
+      checks: read
+      actions: read
     steps:
-    - name: Send Slack notification on workflow failure
-      run: |
-        curl -X POST -H 'Content-type: application/json' --data '{"text":"<${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|Workflow ${{ github.workflow }}> failed in repository ${{ github.repository }}: Failed to update offline vulnerabilities bundle"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
diff --git a/.github/workflows/scanner-updater-bundle.yaml b/.github/workflows/scanner-updater-bundle.yaml
index ff607c47241c4..de4e98dc7c40a 100644
--- a/.github/workflows/scanner-updater-bundle.yaml
+++ b/.github/workflows/scanner-updater-bundle.yaml
@@ -3,14 +3,17 @@ name: Scanner updater bundle
 # and assembles vulnerabilities.zip for each bundle stream defined in
 # VULNERABILITY_BUNDLE_VERSION. Missing or empty sources are skipped with a
 # Slack notification; if no sources are valid the job fails.
-# TODO(ROX-36127): production cutover — update storage.bucket in
-# source-config.yaml to definitions.stackrox.io and remove the schedule from
-# scanner-versioned-definitions-update.yaml.
 
 on:
   schedule:
   - cron: "47 * * * *"
   workflow_dispatch:
+    inputs:
+      force:
+        description: "Force rebuild even if no sources are newer than the bundle"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -18,7 +21,7 @@ permissions:
 jobs:
   build-matrix:
     if: github.repository_owner == 'stackrox'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       streams: ${{ steps.emit.outputs.streams }}
     steps:
@@ -37,7 +40,7 @@ jobs:
 
   bundle:
     needs: build-matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.11@sha256:cea78f2b3a5a38c9ccda678712daaed90b7c372d6b5df963feb758b32dccebe1
       volumes:
@@ -51,6 +54,9 @@ jobs:
     concurrency:
       group: scanner-updater-bundle-${{ matrix.stream }}
       cancel-in-progress: false
+    defaults:
+      run:
+        shell: bash
     env:
       STREAM: ${{ matrix.stream }}
       SOURCE_CONFIG: scanner/updater/ci/source-config.yaml
@@ -64,27 +70,100 @@ jobs:
     - name: Authenticate with GCS
       uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # ratchet:google-github-actions/auth@v3
       with:
-        # TODO(ROX-36127): production cutover — use GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER.
-        credentials_json: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
+        credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
 
     - name: Set up Cloud SDK
       uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # ratchet:google-github-actions/setup-gcloud@v3
 
-    - name: Download sources
+    - name: Check for changes
+      id: check-changes
+      env:
+        FORCE: ${{ inputs.force == true }}
       run: |
         set -euo pipefail
 
-        bucket=$(yq '.storage.bucket' "$SOURCE_CONFIG")
-        prefix=$(yq '.storage.prefix' "$SOURCE_CONFIG")
+        sc=./.github/workflows/scripts/scanner-updater-config.sh
+        bucket=$("$sc" bucket)
+        prefix=$("$sc" prefix)
 
         echo "GCS_BUCKET=$bucket" >> "$GITHUB_ENV"
         echo "GCS_PREFIX=$prefix" >> "$GITHUB_ENV"
 
+        if [[ "$FORCE" == "true" ]]; then
+            echo "Force rebuild requested"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+        fi
+
+        bundle_obj=$("$sc" bundle-object "$STREAM")
+
+        # Get the bundle's creation timestamp. If the bundle does not
+        # exist or the query fails, assume changes and proceed.
+        if ! bundle_ts=$(gcloud storage objects describe "$bundle_obj" \
+            --format="value(creation_time)" 2>/dev/null) || [ -z "$bundle_ts" ]; then
+            echo "Bundle not found or query failed; assuming changes"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+        fi
+        bundle_epoch=$(date -d "$bundle_ts" +%s)
+        echo "Bundle created: $bundle_ts (epoch: $bundle_epoch)"
+
+        # Check if any source has been updated after the bundle.
+        changed=false
+        while IFS= read -r source; do
+            object="gs://${bucket}/${prefix}/${STREAM}/sources/${source}.json.zst"
+            newer=$(GCS_OBJECT="$object" \
+                ./.github/workflows/scripts/scanner-updater-check-freshness.sh --newer-than "$bundle_epoch") || {
+                echo "Source '${source}': check failed; assuming changes"
+                changed=true; break
+            }
+            if [[ "$newer" == "true" ]]; then
+                echo "Source '${source}' is newer than bundle"
+                changed=true; break
+            fi
+        done < <("$sc" sources "$STREAM")
+
+        echo "changed=${changed}" >> "$GITHUB_OUTPUT"
+        if [ "$changed" = "false" ]; then
+            echo "No sources newer than bundle; skipping"
+        fi
+
+    - name: Download sources
+      if: steps.check-changes.outputs.changed == 'true'
+      run: |
+        set -euxo pipefail
+
+        sc=./.github/workflows/scripts/scanner-updater-config.sh
         mkdir -p bundles
-        gcloud storage cp "gs://${bucket}/${prefix}/${STREAM}/sources/*.json.zst" bundles/
+
+        while IFS= read -r source; do
+            object="gs://${GCS_BUCKET}/${GCS_PREFIX}/${STREAM}/sources/${source}.json.zst"
+            dest="bundles/${source}.json.zst"
+
+            # Retry if the source is overwritten between describe and cp.
+            downloaded=false
+            for attempt in 1 2 3; do
+                meta=$(gcloud storage objects describe "$object" --format=json)
+                gen=$(jq -r '.generation' <<< "$meta")
+                timestamp=$(jq -re '.custom_fields["refresh-completed-at"]' <<< "$meta")
+
+                if gcloud storage cp "$object" "$dest" --if-generation-match="$gen"; then
+                    touch -d "$timestamp" "$dest"
+                    downloaded=true
+                    break
+                fi
+                echo "Source '${source}': download attempt ${attempt} failed, retrying"
+            done
+
+            if [[ "$downloaded" != "true" ]]; then
+                echo "::error::${source}: download failed after 3 attempts"
+                exit 1
+            fi
+        done < <("$sc" sources "$STREAM")
 
     - name: Validate sources
       id: download-validate
+      if: steps.check-changes.outputs.changed == 'true'
       run: |
         set -euo pipefail
 
@@ -99,7 +178,7 @@ jobs:
                 echo "source '${source}': OK"
                 valid_files+=("$dest")
             fi
-        done < <(yq ".bundles.${STREAM}[]" "$SOURCE_CONFIG")
+        done < <(./.github/workflows/scripts/scanner-updater-config.sh sources "$STREAM")
 
         ( IFS=','; echo "failed=${failed_sources[*]}" >> "$GITHUB_OUTPUT" )
 
@@ -112,6 +191,7 @@ jobs:
         echo "Validated: ${#valid_files[@]} of $(( ${#valid_files[@]} + ${#failed_sources[@]} )) source(s) OK"
 
     - name: Assemble and upload bundle
+      if: steps.check-changes.outputs.changed == 'true'
       run: |
         set -euo pipefail
 
@@ -122,29 +202,28 @@ jobs:
         echo "Uploaded bundle for stream '${STREAM}' -> ${bundle_obj}"
 
     - name: Notify on partial failure
-      if: always() && steps.download-validate.outcome == 'success'
-      env:
-        FAILED: ${{ steps.download-validate.outputs.failed }}
-        SLACK_WEBHOOK: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
-        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-      run: |
-        [ -n "$FAILED" ] || exit 0
-        curl --fail --show-error --max-time 10 \
-          -X POST -H 'Content-type: application/json' \
-          --data "{\"text\":\"Vulnerability bundler: validation failures for stream '${STREAM}' (sources: ${FAILED}): <${RUN_URL}|View logs>\"}" \
-          "$SLACK_WEBHOOK"
+      if: >-
+        always() && steps.download-validate.outcome == 'success' &&
+        steps.download-validate.outputs.failed != ''
+      uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+        message: >-
+          Vulnerability bundler: validation failures for stream '${{ env.STREAM }}'
+          (sources: ${{ steps.download-validate.outputs.failed }}):
+          <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>
 
   notify:
     needs: [bundle]
     if: always() && needs.bundle.result == 'failure'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      checks: read
+      actions: read
     steps:
-    - name: Notify on failure
-      env:
-        SLACK_WEBHOOK: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
-        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-      run: |
-        curl --fail --show-error --max-time 10 \
-          -X POST -H 'Content-type: application/json' \
-          --data "{\"text\":\"Vulnerability bundler failed: <${RUN_URL}|View logs>\"}" \
-          "$SLACK_WEBHOOK"
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
diff --git a/.github/workflows/scanner-updater-export.yaml b/.github/workflows/scanner-updater-export.yaml
index 9192f8674006f..cbe0b3a3fa41c 100644
--- a/.github/workflows/scanner-updater-export.yaml
+++ b/.github/workflows/scanner-updater-export.yaml
@@ -40,7 +40,7 @@ permissions:
 jobs:
   recheck:
     if: ${{ !inputs.skip_freshness_check }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       result: ${{ steps.check.outputs.result }}
     concurrency:
@@ -56,8 +56,7 @@ jobs:
     - name: Authenticate with GCS
       uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # ratchet:google-github-actions/auth@v3
       with:
-        # TODO(ROX-36127): production cutover — use GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER.
-        credentials_json: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
+        credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
 
     - name: Set up Cloud SDK
       uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # ratchet:google-github-actions/setup-gcloud@v3
@@ -69,15 +68,16 @@ jobs:
         UPDATER_SOURCE: ${{ inputs.source }}
         SOURCE_CONFIG: scanner/updater/ci/source-config.yaml
       run: |
-        # check-freshness.sh exit codes: 0=fresh, 1=stale/missing, 2=error.
-        rc=0
-        ./.github/workflows/scripts/scanner-updater-check-freshness.sh || rc=$?
-        if [[ $rc -eq 0 ]]; then
+        interval_secs=$(./.github/workflows/scripts/scanner-updater-config.sh interval-secs "$UPDATER_SOURCE")
+
+        fresh=$(./.github/workflows/scripts/scanner-updater-check-freshness.sh --max-age "$interval_secs") || {
+            echo "result=error" >> "$GITHUB_OUTPUT"
+            exit 0
+        }
+        if [[ "$fresh" == "true" ]]; then
             echo "result=skip" >> "$GITHUB_OUTPUT"
-        elif [[ $rc -eq 1 ]]; then
-            echo "result=run" >> "$GITHUB_OUTPUT"
         else
-            echo "result=error" >> "$GITHUB_OUTPUT"
+            echo "result=run" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Fail on recheck error
@@ -89,7 +89,7 @@ jobs:
   update:
     needs: recheck
     if: always() && (needs.recheck.result == 'skipped' || needs.recheck.outputs.result == 'run')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     concurrency:
       group: scanner-updater-export-${{ inputs.object }}
       cancel-in-progress: false
@@ -104,6 +104,7 @@ jobs:
       ROX_GIT_REF: ${{ inputs.ref }}
       GCS_OBJECT: ${{ inputs.object }}
       STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT: "10m"
+      STACKROX_RHEL_VEX_IGNORE_KERNEL_PACKAGES: "true"
     steps:
     - name: Checkout repository (master for local actions)
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -150,10 +151,15 @@ jobs:
         scanner/bin/updater export --manual-url "$MANUAL_URL" bundles
 
     - name: Authenticate with GCS for upload
+      if: ${{ !inputs.skip_freshness_check }}
+      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # ratchet:google-github-actions/auth@v3
+      with:
+        credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
+
+    - name: Authenticate with GCS for upload (PR)
+      if: ${{ inputs.skip_freshness_check }}
       uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # ratchet:google-github-actions/auth@v3
       with:
-        # TODO(ROX-36127): production cutover — use GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER
-        # for non-PR runs (select via inputs.skip_freshness_check or a dedicated input).
         credentials_json: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
 
     - name: Set up Cloud SDK
@@ -189,15 +195,17 @@ jobs:
       !inputs.skip_freshness_check &&
       always() &&
       (needs.recheck.result == 'failure' || needs.update.result == 'failure')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      checks: read
+      actions: read
     steps:
-    - name: Notify on failure
-      env:
-        SOURCE: ${{ inputs.source }}
-        OBJECT: ${{ inputs.object }}
-        SLACK_WEBHOOK: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
-        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-      run: |
-        curl -X POST -H 'Content-type: application/json' \
-          --data "{\"text\":\"Vulnerability updater *${SOURCE}* failed (object: ${OBJECT}): <${RUN_URL}|View logs>\"}" \
-          "$SLACK_WEBHOOK"
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+        context: "Source: ${{ inputs.source }} (object: ${{ inputs.object }})"
+        # Scopes annotation/status collection to this matrix leg's own jobs.
+        job-name-filter: "update (${{ inputs.source }}, ${{ inputs.ref }},"
diff --git a/.github/workflows/scanner-updater-schedule.yaml b/.github/workflows/scanner-updater-schedule.yaml
index e1fb00dc1c2b4..7cdf390562a86 100644
--- a/.github/workflows/scanner-updater-schedule.yaml
+++ b/.github/workflows/scanner-updater-schedule.yaml
@@ -1,8 +1,4 @@
 name: Scanner updater schedule
-# This workflow writes to the test bucket while under validation.
-# Once the bundler workflow is ready and the full pipeline is verified,
-# update storage.bucket in source-config.yaml to definitions.stackrox.io
-# and remove the schedule from scanner-versioned-definitions-update.yaml.
 
 on:
   schedule:
@@ -20,12 +16,17 @@ permissions:
 
 jobs:
   build-matrix:
+    permissions:
+      contents: read
+      actions: read
     if: >-
       github.repository_owner == 'stackrox' && (
         github.event_name != 'pull_request' ||
         contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns')
       )
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    outputs:
+      needs-notification: ${{ steps.matrix-scheduled.outputs.has_errors }}
     steps:
     - name: Checkout repository
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -37,8 +38,7 @@ jobs:
       if: github.event_name != 'pull_request'
       uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # ratchet:google-github-actions/auth@v3
       with:
-        # TODO(ROX-36127): production cutover — use GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER.
-        credentials_json: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
+        credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
 
     - name: Set up Cloud SDK
       if: github.event_name != 'pull_request'
@@ -51,6 +51,9 @@ jobs:
         SOURCE_CONFIG: scanner/updater/ci/source-config.yaml
       run: |
         set -euo pipefail
+        # Keep cadence eligibility stable if this job is queued or rerun.
+        schedule_time=$(GH_TOKEN="${{ github.token }}" gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}" --jq '.created_at')
+        export SCHEDULE_TIME="$schedule_time"
         result=$(./.github/workflows/scripts/scanner-updater-matrix.sh)
         {
           echo "has_errors=$(echo "$result" | jq -r '.has_errors')"
@@ -61,17 +64,15 @@ jobs:
         } >> "$GITHUB_OUTPUT"
         echo "$result" > matrix-result.json
 
-    - name: Notify on matrix errors
+    - name: Log matrix errors
+      # This annotation is what send-notification (at the end of this
+      # workflow) picks up via include-successful-jobs, since this job
+      # doesn't fail just because some sources had scheduling errors.
       if: github.event_name != 'pull_request' && steps.matrix-scheduled.outputs.has_errors == 'true'
       env:
         ERRORS: ${{ steps.matrix-scheduled.outputs.errors }}
-        SLACK_WEBHOOK: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
-        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
       run: |
         echo "::error::vulnerability updater scheduling errors: ${ERRORS}"
-        curl -X POST -H 'Content-type: application/json' \
-          --data "{\"text\":\"Vulnerability updater scheduling errors: ${ERRORS}. <${RUN_URL}|View logs>\"}" \
-          "$SLACK_WEBHOOK"
 
     - name: Build updater matrix (PR)
       if: github.event_name == 'pull_request'
@@ -81,8 +82,9 @@ jobs:
         PR_NUMBER: ${{ github.event.pull_request.number }}
       run: |
         set -euo pipefail
-        bucket=$(yq '.storage.bucket' "$SOURCE_CONFIG")
-        prefix=$(yq '.storage.prefix' "$SOURCE_CONFIG")
+        sc=./.github/workflows/scripts/scanner-updater-config.sh
+        bucket="scanner-v4-test"
+        prefix=$("$sc" prefix)
         matrix="{\"include\":[{\"source\":\"manual\",\"ref\":\"${PR_SHA}\",\"object\":\"gs://${bucket}/${prefix}/pr-${PR_NUMBER}/sources/manual.json.zst\"}]}"
         printf '{"has_due":true,"has_errors":false,"errors":[],"matrix":%s}\n' "$matrix" > matrix-result.json
 
@@ -102,7 +104,7 @@ jobs:
 
   plan:
     needs: build-matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       has_due: ${{ steps.emit.outputs.has_due }}
       matrix: ${{ steps.emit.outputs.matrix }}
@@ -131,6 +133,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.plan.outputs.matrix) }}
+    # Propagates to scanner-updater-export.yaml's notify job.
+    permissions:
+      contents: read
+      checks: read
+      actions: read
     uses: ./.github/workflows/scanner-updater-export.yaml
     with:
       source: ${{ matrix.source }}
@@ -143,3 +150,23 @@ jobs:
       GOOGLE_SA_CIRCLECI_SCANNER: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
       GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
       SLACK_ONCALL_SCANNER_WEBHOOK: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+
+  send-notification:
+    # Covers both hard failures in build-matrix/plan and data-level scheduling
+    # errors reported by the matrix script (build-matrix succeeds either way).
+    needs: [build-matrix, plan]
+    if: >-
+      github.event_name != 'pull_request' &&
+      (failure() || needs.build-matrix.outputs.needs-notification == 'true')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      checks: read
+      actions: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+        include-successful-jobs: "true"
diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml
index c27d88b065243..c9ba26d32df8f 100644
--- a/.github/workflows/scanner-versioned-definitions-update.yaml
+++ b/.github/workflows/scanner-versioned-definitions-update.yaml
@@ -1,8 +1,6 @@
 name: Scanner versioned vulnerabilities update
 
 on:
-  schedule:
-  - cron: "30 */4 * * *"
   pull_request:
     types:
     - opened
@@ -45,7 +43,7 @@ on:
 jobs:
   parse-versions:
     if: github.repository_owner == 'stackrox' && github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       versions: ${{ steps.set-versions.outputs.versions }}
     steps:
@@ -104,7 +102,7 @@ jobs:
 
   prepare-environment:
     if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       manual_url: ${{ steps.set-manual-url.outputs.manual_url }}
     steps:
@@ -189,7 +187,7 @@ jobs:
     needs:
     - parse-versions
     - prepare-environment
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.11@sha256:cea78f2b3a5a38c9ccda678712daaed90b7c372d6b5df963feb758b32dccebe1 # ratchet:quay.io/stackrox-io/apollo-ci:scanner-test-0.5.11
       volumes:
@@ -342,7 +340,7 @@ jobs:
     if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns')
     needs:
     - prepare-environment
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.11@sha256:cea78f2b3a5a38c9ccda678712daaed90b7c372d6b5df963feb758b32dccebe1 # ratchet:quay.io/stackrox-io/apollo-ci:scanner-test-0.5.11
       volumes:
@@ -432,7 +430,7 @@ jobs:
     needs:
     - build-and-run
     if: ${{ (failure() || success()) && (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'false')) }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     # Checkout to run ./.github/actions/download-artifact-with-retry
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -512,119 +510,14 @@ jobs:
     needs:
     - build-and-run
     - upload-definitions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ failure() && github.ref_name == 'master' && (github.event_name == 'schedule' || github.event.inputs.dry_run == 'false') }}
     permissions:
       checks: read
       actions: read
     steps:
-    - name: Collect failure annotations
-      # Pulls ::error:: annotations from every failed job for the Slack
-      # message below; jobs with none get a generic fallback line.
-      id: annotations
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        REPO: ${{ github.repository }}
-        RUN_ID: ${{ github.run_id }}
-      run: |
-        set -euo pipefail
-
-        # --paginate output is multiple JSON docs back-to-back; jq below
-        # handles that as a stream, no --slurp needed.
-        jobs_json=$(gh api "repos/${REPO}/actions/runs/${RUN_ID}/jobs" --paginate)
-
-        # Plain text: rendered inside a Slack code block, not mrkdwn.
-        max_messages_per_job=10
-        summary=""
-        while IFS=$'\t' read -r job_id job_name failed_step; do
-            # Exclude GitHub's generic "Process completed..." annotation (noise).
-            # --paginate: a job can have >30 annotations (API's page size).
-            if ! messages=$(gh api "repos/${REPO}/check-runs/${job_id}/annotations" --paginate \
-                --jq '.[] | select(.annotation_level == "failure") | select(.message | test("^Process completed with exit code") | not) | .message'); then
-                # Distinct fallback so an API failure isn't confused with "no annotations".
-                messages="(failed to fetch annotations for this job via the GitHub API; see the workflow run directly for details)"
-            fi
-
-            # Blank line between job blocks, but not before the first one.
-            if [ -n "$summary" ]; then
-                summary+=$'\n\n'
-            fi
-            summary+="${job_name}: ${failed_step}"$'\n'
-            if [ -n "$messages" ]; then
-                total=$(printf '%s\n' "$messages" | grep -c .)
-                summary+="$(printf '%s\n' "$messages" | sed -n "1,${max_messages_per_job}s/^/  - /p")"
-                if [ "$total" -gt "$max_messages_per_job" ]; then
-                    summary+=$'\n'"  - ... and $((total - max_messages_per_job)) more (see the workflow run for full details)"
-                fi
-            else
-                summary+="  - (no detailed error annotations found; see the workflow run for details)"
-            fi
-        done < <(printf '%s' "$jobs_json" | jq -r '.jobs[] | select(.conclusion | IN("failure","timed_out","action_required","neutral","stale","startup_failure")) | [.id, .name, ([.steps[]? | select(.conclusion | IN("failure","timed_out","action_required","neutral","stale","startup_failure")) | .name][0] // "unknown step")] | @tsv')
-
-        if [ -z "$summary" ]; then
-            summary="(no failed jobs found; see the workflow run for details)"
-        fi
-
-        # Safety-net truncation, on top of the per-job cap above.
-        summary="${summary:0:3000}"
-
-        # Status of every job (not just failed ones), icons matching GitHub's own.
-        job_status=""
-        while IFS=$'\t' read -r job_name job_conclusion; do
-            case "$job_conclusion" in
-                success) icon="✅" ;;
-                skipped) icon="⏭️" ;;
-                cancelled) icon="🚫" ;;
-                in_progress) icon="🟡" ;;
-                failure | timed_out | action_required | neutral | stale | startup_failure) icon="❌" ;;
-                *) icon="❔" ;; # genuinely unrecognized future conclusion value
-            esac
-            job_status+="${icon} ${job_name}"$'\n'
-        done < <(printf '%s' "$jobs_json" | jq -r '.jobs[] | [.name, (.conclusion // "in_progress")] | @tsv')
-
-        job_status="${job_status:0:3000}"
-
-        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
-        {
-            echo "summary<<$EOF"
-            echo "$summary"
-            echo "$EOF"
-        } >> "$GITHUB_OUTPUT"
-
-        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
-        {
-            echo "job_status<<$EOF"
-            echo "$job_status"
-            echo "$EOF"
-        } >> "$GITHUB_OUTPUT"
-
-    - name: Send Slack notification on workflow failure
-      # Runs even if "Collect failure annotations" failed, so a degraded
-      # message still reaches on-call instead of nothing at all.
-      if: always()
-      env:
-        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        WORKFLOW: ${{ github.workflow }}
-        REPO: ${{ github.repository }}
-        SUMMARY: ${{ steps.annotations.outputs.summary }}
-        JOB_STATUS: ${{ steps.annotations.outputs.job_status }}
-        ANNOTATIONS_OUTCOME: ${{ steps.annotations.outcome }}
-        SLACK_WEBHOOK: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
-      run: |
-        set -euo pipefail
-        # shellcheck disable=SC2016 # backticks below are a Slack code-block
-        # delimiter, not shell command substitution.
-        if [ "$ANNOTATIONS_OUTCOME" != "success" ]; then
-            text=$(printf ':warning: *Failed Workflow:* <%s|%s>\n*Repository:* %s\nCould not collect failure annotations for this run (the collection step itself failed) -- please check the workflow run directly for details.' \
-                "$RUN_URL" "$WORKFLOW" "$REPO")
-        else
-            text=$(printf '*Failed Workflow:* <%s|%s>\n*Repository:* %s\n*Job Status:*\n```\n%s```\n*Failed steps:*\n```\n%s\n```' \
-                "$RUN_URL" "$WORKFLOW" "$REPO" "$JOB_STATUS" "$SUMMARY")
-        fi
-        # --retry-all-errors means a slow-but-eventually-successful post could be
-        # retried and sent twice; unlikely in practice, but possible.
-        jq -n --arg text "$text" '{text: $text}' \
-            | curl --fail --silent --show-error \
-                --retry 3 --retry-all-errors --retry-delay 5 \
-                --connect-timeout 10 --max-time 300 \
-                -X POST -H 'Content-type: application/json' --data @- "$SLACK_WEBHOOK"
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
diff --git a/.github/workflows/scripts/crdify.sh b/.github/workflows/scripts/crdify.sh
new file mode 100755
index 0000000000000..37e9ce64b545f
--- /dev/null
+++ b/.github/workflows/scripts/crdify.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Run crdify on copies of CRDs after stripping out known false positives.
+# Usage:
+#   crdify.sh <old-crd> <new-crd> [crdify flags]
+
+set -euo pipefail
+
+ROOT_DIR="$(dirname "${BASH_SOURCE[0]}")/../../.."
+readonly ROOT_DIR
+
+if [[ $# -lt 2 ]]; then
+    echo "usage: $0 <old-crd> <new-crd> [crdify flags]" >&2
+    exit 2
+fi
+
+old_crd="${1:?missing required argument 'old-crd'}"
+new_crd="${2:?missing required argument 'new-crd'}"
+shift
+shift
+
+if [[ ! -f "$old_crd" ]]; then
+    echo "::error::CRD file not found: $old_crd" >&2
+    exit 1
+fi
+
+if [[ ! -f "$new_crd" ]]; then
+    echo "::error::CRD file not found: $new_crd" >&2
+    exit 1
+fi
+
+
+# The addition of this particular validation rule, even though considered a breaking change by definition
+# (https://github.com/kubernetes/community/blob/main/contributors/devel/sig-architecture/api_changes.md#backward-compatibility-gotchas)
+# is fine in practice, since the `excludeByKind` branch is being added in the same release cycle as the rule itself,
+# meaning no production CRS could have existed that violated the validation.
+filter_spec_exclusions_one_of() {
+    local input="$1"
+    local output="$2"
+
+    local message='at most one of the fields in [deployment excludeByKind] may be set'
+    local rule='(has(self.deployment)?1:0)+(has(self.excludeByKind)?1:0) <= 1'
+
+    # Remove matching rule, and the validations list if empty afterwards.
+    message="${message}" rule="${rule}" \
+    go run -C "${ROOT_DIR}/operator/tools/yq" github.com/mikefarah/yq/v4 eval '
+      del(
+        .spec.versions[].schema.openAPIV3Schema.properties.spec.properties.exclusions.items."x-kubernetes-validations"[]
+        | select(.message == strenv(message) and .rule == strenv(rule))
+      )
+      | del(
+          .spec.versions[].schema.openAPIV3Schema.properties.spec.properties.exclusions.items."x-kubernetes-validations"
+          | select(length == 0)
+        )
+    ' "$input" > "$output"
+}
+
+
+crd_basename="$(basename "${old_crd}")"
+case "$crd_basename" in
+config.stackrox.io_securitypolicies.yaml)
+    filtered_dir="$(mktemp -d)"
+    echo >&2 "Filtering known false positives from ${old_crd} and ${new_crd}"
+    filter_spec_exclusions_one_of "${old_crd}" "${filtered_dir}/old-${crd_basename}"
+    filter_spec_exclusions_one_of "${new_crd}" "${filtered_dir}/new-${crd_basename}"
+    old_crd="${filtered_dir}/old-${crd_basename}"
+    new_crd="${filtered_dir}/new-${crd_basename}"
+    ;;
+*)
+    echo >&2 "No filtering rules for ${old_crd}, running crdify on original CRDs."
+    ;;
+esac
+
+set -x
+go run -C "${ROOT_DIR}/operator/tools/crdify" sigs.k8s.io/crdify --config=config.yaml "$@" \
+    "file://${old_crd}" "file://${new_crd}"
diff --git a/.github/workflows/scripts/scanner-updater-check-freshness.sh b/.github/workflows/scripts/scanner-updater-check-freshness.sh
index 961a679bea2f5..562c838df0577 100755
--- a/.github/workflows/scripts/scanner-updater-check-freshness.sh
+++ b/.github/workflows/scripts/scanner-updater-check-freshness.sh
@@ -1,86 +1,97 @@
 #!/usr/bin/env bash
 #
-# Check whether an updater's vulnerability data is fresh.
+# Check whether a GCS object is newer than a reference point.
 #
-# Uses an unauthenticated curl against the public GCS download URL to
-# classify the object state (200/404/other), then gcloud for creation_time
-# when the object exists.
+# Uses an unauthenticated HTTP HEAD request against the public GCS
+# download URL to classify the object state (200/404/other), then
+# gcloud for the object timestamp when it exists.
+#
+# Exactly one of --newer-than or --max-age must be provided.
+#
+# --newer-than <epoch>:
+#   The object is "fresh" if its timestamp is after <epoch>.
+#
+# --max-age <seconds>:
+#   The object is "fresh" if its age is below <seconds>
+#   (equivalent to --newer-than "$(date +%s) - N").
+#
+# Output (stdout):
+#   "true"  — object exists and is newer than the threshold
+#   "false" — object is not newer, or does not exist (404)
 #
 # Exit codes:
-#   0 — object exists and is fresh (age < interval)
-#   1 — object is missing (404) or stale (age >= interval)
-#   2 — unexpected failure: caller should treat as error and notify
+#   0 — check completed (result is on stdout)
+#   non-zero — unexpected failure (stdout is irrelevant)
 #
 # Inputs (environment):
-#   GCS_OBJECT       — full GCS object path (gs://bucket/path/to/data.json.zst)
-#   UPDATER_SOURCE   — updater name, used to look up interval in config
-#   SOURCE_CONFIG    — path to source-config.yaml
+#   GCS_OBJECT — full GCS object path (gs://bucket/path/to/object)
 #
-# Requires: curl, yq, gcloud.
+# Requires: curl, gcloud, date.
 
 set -euo pipefail
 
-# The ERR trap below forces any unexpected command failure to exit 2 instead of
-# the failing command's own exit code. Without it, set -e would exit with the
-# failing command's code (usually 1), making it indistinguishable from the
-# intentional "not fresh" exit. The trap guarantees that exit 1 can only come
-# from our explicit exit 1 calls.
-trap 'echo "::error::unexpected failure in check-freshness.sh at line $LINENO"; exit 2' ERR
+trap 'echo "::error::unexpected failure in check-freshness.sh at line $LINENO" >&2; exit 2' ERR
 
-object="${GCS_OBJECT:?GCS_OBJECT is required}"
-updater="${UPDATER_SOURCE:?UPDATER_SOURCE is required}"
-config="${SOURCE_CONFIG:?SOURCE_CONFIG is required}"
+threshold=""
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --newer-than)
+            if [[ -n "$threshold" ]]; then
+                echo "::error::--newer-than and --max-age are mutually exclusive" >&2
+                exit 1
+            fi
+            threshold="${2:?--newer-than requires an epoch value}"
+            shift 2
+            ;;
+        --max-age)
+            if [[ -n "$threshold" ]]; then
+                echo "::error::--newer-than and --max-age are mutually exclusive" >&2
+                exit 1
+            fi
+            max_age="${2:?--max-age requires a value in seconds}"
+            threshold=$(( $(date +%s) - max_age ))
+            shift 2
+            ;;
+        *)
+            echo "::error::unknown argument: $1" >&2
+            exit 1
+            ;;
+    esac
+done
 
-# Derive the download URL from the gs:// path.
-download_url="https://storage.googleapis.com/${object#gs://}"
+if [[ -z "$threshold" ]]; then
+    echo "::error::one of --newer-than or --max-age is required" >&2
+    exit 1
+fi
 
-duration_to_seconds() {
-    local dur="${1:?}"
-    local total=0 remaining="$dur"
-    while [[ -n "$remaining" ]]; do
-        if [[ "$remaining" =~ ^([0-9]+)h(.*)$ ]]; then
-            total=$(( total + BASH_REMATCH[1] * 3600 )); remaining="${BASH_REMATCH[2]}"
-        elif [[ "$remaining" =~ ^([0-9]+)m(.*)$ ]]; then
-            total=$(( total + BASH_REMATCH[1] * 60 )); remaining="${BASH_REMATCH[2]}"
-        elif [[ "$remaining" =~ ^([0-9]+)s(.*)$ ]]; then
-            total=$(( total + BASH_REMATCH[1] )); remaining="${BASH_REMATCH[2]}"
-        else
-            echo "::error::cannot parse duration: $remaining"; exit 2
-        fi
-    done
-    echo "$total"
-}
+object="${GCS_OBJECT:?GCS_OBJECT is required}"
 
-# Read interval from config.
-default_interval=$(yq '.updaters.default.interval // "4h"' "$config")
-interval=$(yq ".updaters.\"${updater}\".interval // \"$default_interval\"" "$config")
-interval_secs=$(duration_to_seconds "$interval")
+# Derive the public download URL from the gs:// path.
+download_url="https://storage.googleapis.com/${object#gs://}"
 
-# Check object existence via unauthenticated curl.
-http_code=$(curl -s -o /dev/null -w "%{http_code}" \
+http_code=$(curl --head --silent --show-error -o /dev/null -w "%{http_code}" \
     --connect-timeout 10 --max-time 15 \
     "$download_url")
 
 case "$http_code" in
     200)
-        creation_time=$(gcloud storage objects describe "$object" \
+        creation_time=$(timeout 30 gcloud storage objects describe "$object" \
             --format="value(creation_time)")
-        created_epoch=$(date -d "$creation_time" +%s)
-        now=$(date +%s)
-        age=$(( now - created_epoch ))
-        if (( age < interval_secs )); then
-            echo >&2 "INFO: ${object}: fresh (age=${age}s < interval=${interval_secs}s)"
-            exit 0
+        object_epoch=$(date -d "$creation_time" +%s)
+        if (( object_epoch > threshold )); then
+            echo >&2 "INFO: ${object}: newer than threshold (${object_epoch} > ${threshold})"
+            echo "true"
+        else
+            echo >&2 "INFO: ${object}: not newer than threshold (${object_epoch} <= ${threshold})"
+            echo "false"
         fi
-        echo >&2 "INFO: ${object}: stale (age=${age}s >= interval=${interval_secs}s)"
-        exit 1
         ;;
     404)
         echo >&2 "INFO: ${object}: not found"
-        exit 1
+        echo "false"
         ;;
     *)
-        echo "::error::${object}: GCS returned HTTP $http_code"
-        exit 2
+        echo "::error::${object}: GCS returned HTTP $http_code" >&2
+        exit 1
         ;;
 esac
diff --git a/.github/workflows/scripts/scanner-updater-config.sh b/.github/workflows/scripts/scanner-updater-config.sh
new file mode 100755
index 0000000000000..95a63e7200a3a
--- /dev/null
+++ b/.github/workflows/scripts/scanner-updater-config.sh
@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# Query source-config.yaml for scanner updater workflows.
+#
+# Usage:
+#   scanner-updater-config.sh <command> [args...]
+#
+# Commands:
+#   bucket                      Storage bucket name.
+#   prefix                      Storage prefix path.
+#   sources <stream>            List updater sources for a stream, one per line.
+#   source-object <stream> <source>  GCS object path for a source.
+#   bundle-object <stream>      GCS object path for a bundle.
+#   interval-secs <source>      Updater refresh interval in seconds.
+#   attempt-cadence-secs <source>  Attempt cadence in seconds; 0 if unset.
+#
+# Inputs (environment):
+#   SOURCE_CONFIG — path to source-config.yaml
+#
+# Requires: yq.
+
+set -euo pipefail
+
+config="${SOURCE_CONFIG:?SOURCE_CONFIG is required}"
+
+if [[ ! -f "$config" ]]; then
+    echo "::error::config file not found: $config" >&2
+    exit 1
+fi
+
+if ! yq eval '.' "$config" > /dev/null 2>&1; then
+    echo "::error::config file is not valid YAML: $config" >&2
+    exit 1
+fi
+
+duration_to_seconds() {
+    local dur="${1:?missing required argument 'duration'}"; shift
+    local total=0 remaining="$dur"
+    while [[ -n "$remaining" ]]; do
+        if [[ "$remaining" =~ ^([0-9]+)h(.*)$ ]]; then
+            total=$(( total + BASH_REMATCH[1] * 3600 )); remaining="${BASH_REMATCH[2]}"
+        elif [[ "$remaining" =~ ^([0-9]+)m(.*)$ ]]; then
+            total=$(( total + BASH_REMATCH[1] * 60 )); remaining="${BASH_REMATCH[2]}"
+        elif [[ "$remaining" =~ ^([0-9]+)s(.*)$ ]]; then
+            total=$(( total + BASH_REMATCH[1] )); remaining="${BASH_REMATCH[2]}"
+        else
+            echo "::error::cannot parse duration: $remaining" >&2; exit 1
+        fi
+    done
+    echo "$total"
+}
+
+command="${1:?missing required argument 'command'}"; shift
+
+case "$command" in
+    bucket)
+        yq eval '.storage.bucket' "$config"
+        ;;
+    prefix)
+        yq eval '.storage.prefix' "$config"
+        ;;
+    sources)
+        stream="${1:?missing required argument 'stream'}"; shift
+        yq eval ".bundles.\"${stream}\"[]" "$config"
+        ;;
+    source-object)
+        stream="${1:?missing required argument 'stream'}"; shift
+        source="${1:?missing required argument 'source'}"; shift
+        bucket=$(yq eval '.storage.bucket' "$config")
+        prefix=$(yq eval '.storage.prefix' "$config")
+        echo "gs://${bucket}/${prefix}/${stream}/sources/${source}.json.zst"
+        ;;
+    bundle-object)
+        stream="${1:?missing required argument 'stream'}"; shift
+        bucket=$(yq eval '.storage.bucket' "$config")
+        prefix=$(yq eval '.storage.prefix' "$config")
+        echo "gs://${bucket}/${prefix}/${stream}/vulnerabilities.zip"
+        ;;
+    interval-secs)
+        source="${1:?missing required argument 'source'}"; shift
+        default_interval=$(yq eval '.updaters.default.interval // "4h"' "$config")
+        interval=$(yq eval ".updaters.\"${source}\".interval // \"$default_interval\"" "$config")
+        duration_to_seconds "$interval"
+        ;;
+    attempt-cadence-secs)
+        source="${1:?missing required argument 'source'}"; shift
+        cadence=$(yq eval ".updaters.\"${source}\".attempt_cadence // .updaters.default.attempt_cadence // \"\"" "$config")
+        if [[ -z "$cadence" ]]; then
+            echo 0
+            exit 0
+        fi
+        cadence_secs=$(duration_to_seconds "$cadence")
+        if (( cadence_secs <= 0 || cadence_secs % 3600 != 0 )); then
+            echo "::error::attempt_cadence must be a positive whole-hour duration: $cadence" >&2
+            exit 1
+        fi
+        echo "$cadence_secs"
+        ;;
+    *)
+        echo "::error::unknown command: $command" >&2
+        exit 1
+        ;;
+esac
diff --git a/.github/workflows/scripts/scanner-updater-matrix.sh b/.github/workflows/scripts/scanner-updater-matrix.sh
index 682162ad42d44..4e99bfd923e37 100755
--- a/.github/workflows/scripts/scanner-updater-matrix.sh
+++ b/.github/workflows/scripts/scanner-updater-matrix.sh
@@ -10,6 +10,7 @@
 #
 # Inputs (environment):
 #   SOURCE_CONFIG — path to source-config.yaml
+#   SCHEDULE_TIME — workflow run creation time; defaults to the current time.
 #
 # Outputs (stdout):
 #   JSON object with "has_due", "has_errors", "errors", and "matrix"
@@ -20,8 +21,6 @@
 
 set -euo pipefail
 
-config="${SOURCE_CONFIG:?SOURCE_CONFIG is required}"
-
 for cmd in yq jq; do
     if ! command -v "$cmd" &>/dev/null; then
         echo "::error::$cmd is required but not found"
@@ -29,40 +28,48 @@ for cmd in yq jq; do
     fi
 done
 
-# Read storage location from config.
-bucket=$(yq '.storage.bucket' "$config")
-prefix=$(yq '.storage.prefix' "$config")
+sc="$(dirname "$0")/scanner-updater-config.sh"
+
+bucket=$("$sc" bucket)
+prefix=$("$sc" prefix)
+
+schedule_epoch=$(date -u -d "${SCHEDULE_TIME:-now}" +%s)
+schedule_hour=$(( schedule_epoch / 3600 ))
 
 # Expand stream/ref/updater triples, check freshness, emit due pairs.
 ./.github/workflows/scripts/scanner-get-released-tags.sh \
     | jq -r '.[] | "\(.version) \(.ref)"' \
     | while read -r stream ref; do
-          yq ".bundles.\"$stream\" | .[]" "$config" \
+          "$sc" sources "$stream" \
               | while read -r updater; do
                     echo "$stream $ref $updater"
                 done
       done \
     | while read -r stream ref updater; do
           object="gs://${bucket}/${prefix}/${stream}/sources/${updater}.json.zst"
+          interval_secs=$("$sc" interval-secs "$updater")
+          cadence_secs=$("$sc" attempt-cadence-secs "$updater")
+          if (( cadence_secs > 0 )); then
+              cadence_hours=$(( cadence_secs / 3600 ))
+              if (( schedule_hour % cadence_hours != 0 )); then
+                  continue
+              fi
+          fi
 
-          # check-freshness.sh exit codes: 0=fresh, 1=stale/missing, 2=error.
-          if GCS_OBJECT="$object" \
-             UPDATER_SOURCE="$updater" \
-             SOURCE_CONFIG="$config" \
-             ./.github/workflows/scripts/scanner-updater-check-freshness.sh
-          then
-              continue
-          elif [[ $? -eq 1 ]]; then
-              jq -n \
-                  --arg source "$updater" \
-                  --arg ref "$ref" \
-                  --arg object "$object" \
-                  '{source: $source, ref: $ref, object: $object}'
-          else
-              echo "::error::${object}: freshness check failed"
+          fresh=$(GCS_OBJECT="$object" \
+              ./.github/workflows/scripts/scanner-updater-check-freshness.sh --max-age "$interval_secs") || {
+              echo "::error::${object}: freshness check failed" >&2
               jq -n --arg msg "${object}: freshness check failed" '{error: $msg}'
               continue
+          }
+          if [[ "$fresh" == "true" ]]; then
+              continue
           fi
+          jq -n \
+              --arg source "$updater" \
+              --arg ref "$ref" \
+              --arg object "$object" \
+              '{source: $source, ref: $ref, object: $object}'
       done \
     | jq -s '{
           has_due:    (map(select(.source)) | length > 0 | tostring),
diff --git a/.github/workflows/scripts/validate-signing-key-bundle.sh b/.github/workflows/scripts/validate-signing-key-bundle.sh
new file mode 100755
index 0000000000000..3be88e7ab3b70
--- /dev/null
+++ b/.github/workflows/scripts/validate-signing-key-bundle.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Validates a Red Hat signing key bundle JSON file.
+#
+# Checks mirror the Go ParseKeyBundle logic in pkg/signatures/key_bundle.go:
+#   - valid JSON with non-empty "cosignKeys" array
+#   - each key has a non-empty "name" (after trimming) without path separators
+#   - no duplicate key names
+#   - each "publicKey" value is a valid PEM-encoded public key
+#
+# USAGE: validate-signing-key-bundle.sh <bundle.json>
+
+set -euo pipefail
+
+bundle="${1:?Usage: validate-signing-key-bundle.sh <bundle.json>}"
+
+if [[ ! -f "$bundle" ]]; then
+    echo "ERROR: file not found: $bundle" >&2
+    exit 1
+fi
+
+# 1. Valid JSON structure with non-empty cosignKeys array.
+key_count=$(jq -e '.cosignKeys | length' "$bundle") || {
+    echo "ERROR: invalid JSON or missing 'cosignKeys' array" >&2
+    exit 1
+}
+
+if [[ "$key_count" -eq 0 ]]; then
+    echo "ERROR: key bundle must contain at least one key" >&2
+    exit 1
+fi
+
+echo "Found $key_count key(s), validating..."
+
+# 2-4. Validate each key entry.
+seen_names=()
+for i in $(seq 0 $((key_count - 1))); do
+    raw_name=$(jq -r ".cosignKeys[$i].name // empty" "$bundle")
+    pem_data=$(jq -r ".cosignKeys[$i].publicKey // empty" "$bundle")
+
+    # Trim whitespace to match Go's strings.TrimSpace before all checks.
+    name="${raw_name#"${raw_name%%[![:space:]]*}"}"
+    name="${name%"${name##*[![:space:]]}"}"
+
+    if [[ -z "$name" ]]; then
+        echo "ERROR: key at index $i has empty name" >&2
+        exit 1
+    fi
+
+    if [[ "$name" == */* || "$name" == *\\* ]]; then
+        echo "ERROR: key name '$name' contains path separators" >&2
+        exit 1
+    fi
+
+    for seen in "${seen_names[@]+"${seen_names[@]}"}"; do
+        if [[ "$seen" == "$name" ]]; then
+            echo "ERROR: duplicate key name '$name'" >&2
+            exit 1
+        fi
+    done
+    seen_names+=("$name")
+
+    if [[ -z "$pem_data" ]]; then
+        echo "ERROR: key '$name' has empty publicKey" >&2
+        exit 1
+    fi
+
+    if ! echo "$pem_data" | openssl pkey -pubin -noout 2>/dev/null; then
+        echo "ERROR: key '$name' has invalid PEM public key" >&2
+        exit 1
+    fi
+
+    echo "  [$i] '$name' — valid"
+done
+
+echo "Bundle validation passed: $key_count key(s) OK"
diff --git a/.github/workflows/scripts/verify-release.sh b/.github/workflows/scripts/verify-release.sh
index 6e9f0f0b2c200..528cf5c4660ad 100644
--- a/.github/workflows/scripts/verify-release.sh
+++ b/.github/workflows/scripts/verify-release.sh
@@ -102,7 +102,7 @@ validate_images() {
 
 validate_docs() {
     RELEASE="$1"
-    check_url_page_exists "https://docs.openshift.com/acs/${RELEASE}/welcome/index.html"
+    check_url_page_exists "https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/${RELEASE}"
 }
 
 validate_jira_release() {
diff --git a/.github/workflows/signing-key-bundle-update.yaml b/.github/workflows/signing-key-bundle-update.yaml
new file mode 100644
index 0000000000000..fda57fde6bd44
--- /dev/null
+++ b/.github/workflows/signing-key-bundle-update.yaml
@@ -0,0 +1,63 @@
+name: Red Hat signing key bundle update
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - pkg/signatures/bundle.json
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate-and-upload:
+    if: ${{ github.repository_owner == 'stackrox' }}
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+      with:
+        persist-credentials: false
+
+    - name: Validate key bundle
+      run: .github/workflows/scripts/validate-signing-key-bundle.sh pkg/signatures/bundle.json
+
+    - name: Authenticate with Google Cloud
+      if: github.ref == 'refs/heads/master'
+      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # ratchet:google-github-actions/auth@v3
+      with:
+        credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
+
+    - name: Set up Cloud SDK
+      if: github.ref == 'refs/heads/master'
+      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # ratchet:google-github-actions/setup-gcloud@v3
+
+    - name: Upload key bundle to GCS
+      if: github.ref == 'refs/heads/master'
+      run: |
+        gsutil -h "Content-Type: application/json" \
+          cp pkg/signatures/bundle.json \
+          gs://definitions.stackrox.io/signing-keys/bundle.json
+
+  send-notification:
+    needs:
+    - validate-and-upload
+    runs-on: ubuntu-24.04
+    if: failure()
+    permissions:
+      contents: read
+      checks: read
+      actions: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+    - uses: ./.github/actions/notify-slack-on-failure
+      with:
+        slack-webhook: ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}
+        mention: "<!subteam^S04S96AAVND|acs-scanner-primary>"
diff --git a/.github/workflows/start-release.yml b/.github/workflows/start-release.yml
index 34116d543db82..d23caf47e4a8b 100644
--- a/.github/workflows/start-release.yml
+++ b/.github/workflows/start-release.yml
@@ -42,7 +42,7 @@ concurrency: Release automation ${{ inputs.version }}
 jobs:
   start-sha:
     name: Find commit for release branch
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       start-sha: ${{ fromJSON(format('["{0}","{1}"]', env.USER_REF, steps.find.outputs.merge_base))[env.USER_REF == ''] }}
     steps:
@@ -67,7 +67,7 @@ jobs:
 
   properties:
     name: Read repository properties
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       docs-repository: ${{ steps.properties.outputs.docs-repository }}
       slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.properties.outputs.dry-slack-channel, steps.properties.outputs.slack-channel))[github.event.inputs.dry-run != 'true'] }}
@@ -81,7 +81,7 @@ jobs:
 
   run-parameters:
     name: Run parameters
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - run: |
           [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run"
@@ -102,7 +102,7 @@ jobs:
   check-jira:
     name: Check Jira release
     needs: [variables, properties]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       release-date: ${{steps.check-jira-release.outputs.date}}
     steps:
@@ -122,7 +122,7 @@ jobs:
   branch:
     name: Prepare release branch
     needs: [variables, start-sha, check-jira]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out code (normal release)
         if: needs.variables.outputs.patch == 0
@@ -193,7 +193,7 @@ jobs:
     name: Configure OpenShift CI jobs
     needs: [variables, branch]
     if: needs.variables.outputs.patch == 0
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       RELEASE: "${{needs.variables.outputs.release}}"
       BRANCH: "stackrox-release-${{needs.variables.outputs.release}}"
@@ -262,7 +262,7 @@ jobs:
     name: Patch CHANGELOG.md on the default branch
     needs: [variables, branch, start-sha]
     if: needs.variables.outputs.patch == 0
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -288,7 +288,7 @@ jobs:
   patch-scanner-versions:
     name: Patch Scanner updater configuration
     needs: [variables, branch]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -310,7 +310,7 @@ jobs:
   milestone:
     name: Create milestone
     needs: [variables]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Create ${{needs.variables.outputs.next-milestone}} milestone
         if: env.DRY_RUN == 'false'
@@ -336,7 +336,7 @@ jobs:
   notify:
     name: Notify everybody
     needs: [variables, properties, branch, milestone]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Post to Slack (normal release)
         if: needs.variables.outputs.patch == 0
diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml
index 392824d9d3503..3989115a09bab 100644
--- a/.github/workflows/style.yaml
+++ b/.github/workflows/style.yaml
@@ -27,7 +27,7 @@ jobs:
     if: ${{ !needs.detect-changes.outputs.ui_only }}
     env:
       ARTIFACT_DIR: junit-reports/
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -54,7 +54,7 @@ jobs:
   misc-checks:
     env:
       ARTIFACT_DIR: junit-reports/
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -97,7 +97,7 @@ jobs:
       run: if [ -s scripts/ci/jobs/check-dependabot-gomod.sh ]; then scripts/ci/jobs/check-dependabot-gomod.sh; fi
 
   style-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -159,7 +159,7 @@ jobs:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
     timeout-minutes: 240
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -205,10 +205,10 @@ jobs:
   check-dependent-images-exist:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
-    # This job ensures that COLLECTOR_VERSION, FACT_VERSION or SCANNER_VERSION files cannot be updated to a version
+    # This job ensures that COLLECTOR_VERSION or FACT_VERSION files cannot be updated to a version
     # for which the image was not successfully built on Konflux (suffix "-fast"). It also verifies that GHA-built image
     # is there (no suffix) so that the failure also happens in this job.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -217,12 +217,11 @@ jobs:
         with:
           gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
 
-      - name: Get image tags from COLLECTOR|FACT|SCANNER_VERSION file
+      - name: Get image tags from COLLECTOR_|FACT_VERSION file
         run: |
           {
             echo "collector_tag=$(make --quiet --no-print-directory collector-tag)"
             echo "fact_tag=$(make --quiet --no-print-directory fact-tag)"
-            echo "scanner_tag=$(make --quiet --no-print-directory scanner-tag)"
           } >> "$GITHUB_ENV"
 
       - name: Check GHA-built image exists
@@ -236,10 +235,6 @@ jobs:
           image: |
             rhacs-eng/collector:${{ env.collector_tag }}
             rhacs-eng/fact:${{ env.fact_tag }}
-            rhacs-eng/scanner:${{ env.scanner_tag }}
-            rhacs-eng/scanner-slim:${{ env.scanner_tag }}
-            rhacs-eng/scanner-db:${{ env.scanner_tag }}
-            rhacs-eng/scanner-db-slim:${{ env.scanner_tag }}
 
       - name: Check Konflux-built image exists
         uses: stackrox/actions/release/wait-for-image@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/wait-for-image@v1
@@ -252,17 +247,13 @@ jobs:
           image: |
             rhacs-eng/release-collector:${{ env.collector_tag }}-fast
             rhacs-eng/release-fact:${{ env.fact_tag }}-fast
-            rhacs-eng/release-scanner:${{ env.scanner_tag }}-fast
-            rhacs-eng/release-scanner-slim:${{ env.scanner_tag }}-fast
-            rhacs-eng/release-scanner-db:${{ env.scanner_tag }}-fast
-            rhacs-eng/release-scanner-db-slim:${{ env.scanner_tag }}-fast
 
   github-actions-lint:
     needs: detect-changes
     if: >-
       !needs.detect-changes.outputs.files ||
       contains(needs.detect-changes.outputs.files, '^.github/')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
       - uses: ./.github/actions/job-preamble
@@ -276,7 +267,7 @@ jobs:
     if: >-
       !needs.detect-changes.outputs.files ||
       contains(needs.detect-changes.outputs.files, '^.github/')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
       - uses: ./.github/actions/job-preamble
@@ -290,7 +281,7 @@ jobs:
     if: >-
       !needs.detect-changes.outputs.files ||
       contains(needs.detect-changes.outputs.files, '^.openshift-ci/')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -322,7 +313,7 @@ jobs:
           contains(github.event.pull_request.labels.*.name, 'ci-test-github-action-slack-messages')
       )
     name: Post failure message to Slack
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - check-generated-files
       - misc-checks
diff --git a/.github/workflows/tag-more-reviewers.yaml b/.github/workflows/tag-more-reviewers.yaml
index f6ce74aac7c50..4b94157c38a6d 100644
--- a/.github/workflows/tag-more-reviewers.yaml
+++ b/.github/workflows/tag-more-reviewers.yaml
@@ -18,7 +18,7 @@ jobs:
       github.event.pull_request.user.login != 'red-hat-konflux[bot]'
     env:
       GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Tag Konflux Maintainers for review
       run: |
diff --git a/.github/workflows/tagged-ci.yaml b/.github/workflows/tagged-ci.yaml
index 028412d071aa8..e936f4f4ea0ca 100644
--- a/.github/workflows/tagged-ci.yaml
+++ b/.github/workflows/tagged-ci.yaml
@@ -8,7 +8,7 @@ on:
 jobs:
   slack-tagged-notice:
     name: Slack Tagged Notice
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
diff --git a/.github/workflows/triage-report_periodic.yml b/.github/workflows/triage-report_periodic.yml
index 4843660c8ab0b..2df7169befde0 100644
--- a/.github/workflows/triage-report_periodic.yml
+++ b/.github/workflows/triage-report_periodic.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   triage-report:
     if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml
index fd943d81c93be..48ea27c9d0873 100644
--- a/.github/workflows/unit-tests.yaml
+++ b/.github/workflows/unit-tests.yaml
@@ -41,7 +41,7 @@ jobs:
         gotags: [ 'GOTAGS=""', 'GOTAGS=release' ]
         exclude:
           - gotags: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-release-build') && 'GOTAGS=release' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new-jiras: ${{ steps.junit2jira.outputs.new-jiras }}
     steps:
@@ -61,7 +61,7 @@ jobs:
     - name: Go Unit Tests
       run: ${{ matrix.gotags }} make go-unit-tests
 
-    - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # ratchet:codecov/codecov-action@v7.0.0
+    - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # ratchet:codecov/codecov-action@v7.1.1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: go-unit-tests
@@ -112,11 +112,10 @@ jobs:
       fail-fast: false
       matrix:
         gotags: [ 'GOTAGS=""', 'GOTAGS=release' ]
-        pg: [ 'default', '15' ]
+        pg: [ '16' ]
         exclude:
           - gotags: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-release-build') && 'GOTAGS=release' }}
-          - pg: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-postgres-tests') && 'default' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new-jiras: ${{ steps.junit2jira.outputs.new-jiras }}
     env:
@@ -173,7 +172,7 @@ jobs:
     - name: Go Unit Tests
       run: ${{ matrix.gotags }} make go-postgres-unit-tests
 
-    - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # ratchet:codecov/codecov-action@v7.0.0
+    - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # ratchet:codecov/codecov-action@v7.1.1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: go-unit-tests
@@ -205,7 +204,7 @@ jobs:
   go-bench:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
@@ -264,7 +263,7 @@ jobs:
       !needs.detect-changes.outputs.files ||
       contains(needs.detect-changes.outputs.files, '^ui/') ||
       contains(needs.detect-changes.outputs.files, '^.github/actions/cache-ui-dependencies/')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new-jiras: ${{ steps.junit2jira.outputs.new-jiras }}
     steps:
@@ -318,7 +317,7 @@ jobs:
       !needs.detect-changes.outputs.files ||
       contains(needs.detect-changes.outputs.files, '^ui/') ||
       contains(needs.detect-changes.outputs.files, '^.github/actions/cache-ui-dependencies/')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new-jiras: ${{ steps.junit2jira.outputs.new-jiras }}
     steps:
@@ -380,7 +379,7 @@ jobs:
   local-roxctl-tests:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new-jiras: ${{ steps.junit2jira.outputs.new-jiras }}
     container:
@@ -426,7 +425,7 @@ jobs:
   shell-unit-tests:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new-jiras: ${{ steps.junit2jira.outputs.new-jiras }}
     container:
@@ -464,7 +463,7 @@ jobs:
   openshift-ci-unit-tests:
     needs: detect-changes
     if: ${{ !needs.detect-changes.outputs.ui_only }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11@sha256:df3459cf038e73775314b3a5d36d14dda41e6df438a0273c9efa8d23e0f2358a # ratchet:quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11
     steps:
@@ -486,7 +485,7 @@ jobs:
     if: ${{ !needs.detect-changes.outputs.ui_only }}
     env:
       KUBECONFIG: "/tmp/kubeconfig"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new-jiras: ${{ steps.junit2jira.outputs.new-jiras }}
     steps:
@@ -508,7 +507,7 @@ jobs:
         password: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
 
     - name: Create k8s Kind Cluster
-      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # ratchet:helm/kind-action@v1
+      uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # ratchet:helm/kind-action@v1.15.0
       with:
         kubeconfig: "${{ env.KUBECONFIG }}"
 
@@ -565,7 +564,7 @@ jobs:
           contains(github.event.pull_request.labels.*.name, 'ci-test-github-action-slack-messages')
       )
     name: Post failure message to Slack
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - go
       - go-bench
@@ -585,7 +584,7 @@ jobs:
     - name: Slack message
       env:
         GITHUB_CONTEXT: ${{ toJSON(github) }}
-        mention_author: ${{ needs.go.outputs.new-jiras || needs.go-postgres.outputs.new-jiras || needs.local-roxctl-tests.outputs.new-jiras || needs.ui.outputs.new-jiras || needs.go.outputs.new-jiras || needs.shell-unit-tests.outputs.new-jiras || needs.sensor-integration-tests.outputs.new-jiras }}
+        mention_author: true
       run: |
         source scripts/ci/lib.sh
         slack_workflow_failure
diff --git a/.github/workflows/update_collector_periodic.yaml b/.github/workflows/update_collector_periodic.yaml
index aca8fd0cf0f3e..6eec999095b3d 100644
--- a/.github/workflows/update_collector_periodic.yaml
+++ b/.github/workflows/update_collector_periodic.yaml
@@ -6,7 +6,7 @@ on:
 jobs:
   update-collector:
     if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
       with:
diff --git a/.github/workflows/update_fact_periodic.yaml b/.github/workflows/update_fact_periodic.yaml
index 12ec44dd22b65..1ba1644308290 100644
--- a/.github/workflows/update_fact_periodic.yaml
+++ b/.github/workflows/update_fact_periodic.yaml
@@ -6,7 +6,7 @@ on:
 jobs:
   update-fact:
     if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
       with:
diff --git a/.github/workflows/update_scanner_periodic.yaml b/.github/workflows/update_scanner_periodic.yaml
deleted file mode 100644
index 6b5a72c198e8e..0000000000000
--- a/.github/workflows/update_scanner_periodic.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Update scanner version
-on:
-  workflow_dispatch:
-  schedule:
-  - cron: 0 5 * * 1
-jobs:
-  update-scanner:
-    if:  ${{ github.repository_owner == 'stackrox' }}
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
-      with:
-        ref: master # this is our target branch
-        fetch-depth: 0 # we need to fetch all branches
-    - name: Checkout scanner repo
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
-      with:
-        repository: stackrox/scanner
-        path: deps/scanner
-        fetch-depth: 0 # we need to fetch tags
-    - name: Update version
-      run: make -sC deps/scanner tag | tee SCANNER_VERSION
-    - name: Create Pull Request
-      id: cpr
-      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # ratchet:peter-evans/create-pull-request@v8
-      with:
-        token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}'
-        commit-message: Update SCANNER_VERSION
-        committer: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>'
-        author: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>'
-        branch: update_scanner_version
-        signoff: false
-        delete-branch: true
-        title: 'chore(scanner): Update SCANNER_VERSION'
-        body: |
-          Weekly update of SCANNER_VERSION to latest master version
-        labels: |
-          ci-all-qa-tests
-          dependencies
-          konflux-build
-        team-reviewers: scanner
-        draft: false
-    - name: Enable Pull Request Automerge
-      if: steps.cpr.outputs.pull-request-operation == 'created'
-      uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # ratchet:peter-evans/enable-pull-request-automerge@v3
-      with:
-        token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}'
-        pull-request-number: '${{ steps.cpr.outputs.pull-request-number }}'
-        merge-method: squash
diff --git a/.github/workflows/upgrade-test.yml b/.github/workflows/upgrade-test.yml
index 0b710b0c9959a..71e46fe283973 100644
--- a/.github/workflows/upgrade-test.yml
+++ b/.github/workflows/upgrade-test.yml
@@ -40,7 +40,7 @@ concurrency: Release automation ${{ inputs.milestone }}
 jobs:
   properties:
     name: Read repository properties
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.properties.outputs.dry-slack-channel, steps.properties.outputs.slack-channel))[inputs.dry-run != 'true'] }}
     steps:
@@ -52,7 +52,7 @@ jobs:
 
   run-parameters:
     name: Run parameters
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - run: |
           [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run"
@@ -66,13 +66,13 @@ jobs:
   create-clusters:
     needs: [properties]
     if: github.event.inputs.dry-run != 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         name: [test1, test2]
     steps:
       - name: Create the ${{ matrix.name }} cluster
-        uses: stackrox/actions/infra/create-cluster@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/infra/create-cluster@v1
+        uses: stackrox/actions/infra/create-cluster@d624eeae7073b3acb838aab7705730b2de58a4a0 # ratchet:stackrox/actions/infra/create-cluster@v1
         with:
           token: ${{ secrets.INFRA_TOKEN }}
           flavor: gke-default
@@ -83,13 +83,13 @@ jobs:
 
   prepare-clusters:
     needs: [properties, create-clusters]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
         with:
           ref: ${{ github.ref_name }}
-      - uses: stackrox/actions/infra/install-infractl@4efb76aa74694b9ee55e95c4ead57fdf50d79ddf # ratchet:stackrox/actions/infra/install-infractl@v1
+      - uses: stackrox/actions/infra/install-infractl@3b27674f0fa69f2d8c31ab26aa63c9f76401c64e # ratchet:stackrox/actions/infra/install-infractl@v1
       - uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # ratchet:google-github-actions/auth@v3
         with:
           credentials_json: "${{ secrets.GCP_RELEASE_AUTOMATION_SA }}"
@@ -136,7 +136,7 @@ jobs:
     name: Notify about failed cluster creation
     needs: [properties, prepare-clusters]
     if: always() && needs.prepare-clusters.result == 'failure'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Post to Slack
         uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # ratchet:slackapi/slack-github-action@v3.0.3
diff --git a/.github/workflows/variables.yml b/.github/workflows/variables.yml
index f574eec48faa4..6fedd4d7f5546 100644
--- a/.github/workflows/variables.yml
+++ b/.github/workflows/variables.yml
@@ -56,7 +56,7 @@ on:
 jobs:
   parse:
     name: Parse ${{inputs.version}}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       release: ${{steps.parse.outputs.release}}
       major: ${{steps.parse.outputs.major}}
diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
index 5751a5121b968..3792e9c80958b 100644
--- a/.github/workflows/verify-release.yml
+++ b/.github/workflows/verify-release.yml
@@ -32,7 +32,7 @@ concurrency: Release automation ${{ inputs.version }}
 jobs:
   run-parameters:
     name: Run parameters
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - run: |
           {
@@ -52,7 +52,7 @@ jobs:
 
   properties:
     name: Read repository properties
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       jira-project: ${{ steps.properties.outputs.jira-project }}
     steps:
@@ -64,7 +64,7 @@ jobs:
 
   verify-release:
     name: Verify all artifacts for release ${{ needs.variables.outputs.named-release-patch }} are published
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [variables, properties]
     env:
       JIRA_USER: ${{ vars.RHACS_BOT_GITHUB_EMAIL }}
diff --git a/.golangci.yml b/.golangci.yml
index b35db3e3ff515..1bc4853049192 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -31,6 +31,7 @@ linters:
     - ineffassign
     - modernize
     - nolintlint
+    - prealloc
     - protogetter
     - revive # replaces golint
     - rowserrcheck
@@ -188,6 +189,12 @@ linters:
       - linters:
           - forbidigo
         path: roxctl/central/generate/interactive.go
+      - linters:
+          - prealloc
+        path-except: ^(pkg)/
+      - linters:
+          - prealloc
+        path: _test\.go
       - linters:
           - forbidigo
           - wrapcheck
diff --git a/.konflux/konflux.check-go-builder-version.Dockerfile b/.konflux/konflux.check-go-builder-version.Dockerfile
index 262af6002fa6a..f9b99226d5379 100644
--- a/.konflux/konflux.check-go-builder-version.Dockerfile
+++ b/.konflux/konflux.check-go-builder-version.Dockerfile
@@ -1,4 +1,4 @@
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:3ca2c34c83e6563fa574b7c7ecda92a5fdae2ec7a5f37a408e5e383947fb1957
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:e74b03198cccc24c24a27071ad4d6c2edcfe0bb10c6de99c609ce6e3c06d6d04
 
 WORKDIR /workspace
 
diff --git a/.openshift-ci/begin.sh b/.openshift-ci/begin.sh
index fd9b736b76c6d..b5411a9922b01 100755
--- a/.openshift-ci/begin.sh
+++ b/.openshift-ci/begin.sh
@@ -22,6 +22,36 @@ openshift_ci_mods
 openshift_ci_import_creds
 
 setup_gcp
+
+# Pre-flight DNS check (mitigation for DPTP-5138)
+info "Pre-flight DNS health check (DPTP-5138 mitigation)"
+
+_check_dns() {
+    local domain="$1"
+    getent hosts "$domain" >/dev/null 2>&1
+}
+
+dns_check_failed=false
+for domain in oauth2.googleapis.com compute.googleapis.com storage.googleapis.com; do
+    if retry 5 true _check_dns "$domain"; then
+        info "✓ DNS OK for $domain"
+    else
+        warn "⚠️  DNS resolution FAILED for $domain after retries"
+        dns_check_failed=true
+    fi
+done
+
+if [[ "$dns_check_failed" == "true" ]]; then
+    local error_msg="DNS is broken after retries (likely persistent node-resolver issue - see https://redhat.atlassian.net/browse/DPTP-5138). Failing fast to avoid wasted cluster creation time."
+
+    # Generate structured JUnit report for better CI dashboard visibility
+    if [[ -n "${ARTIFACT_DIR:-}" ]] && command -v save_junit_failure >/dev/null 2>&1; then
+        save_junit_failure "DNS_Preflight_Check" "DNS resolution failed" "$error_msg"
+    fi
+
+    die "$error_msg"
+fi
+
 set_ci_shared_export started_at "$(date -u +%s)"
 
 if [[ -z "${SHARED_DIR:-}" ]]; then
diff --git a/.openshift-ci/ci_tests.py b/.openshift-ci/ci_tests.py
index 8fe503c524f21..b3d602f46e2ec 100755
--- a/.openshift-ci/ci_tests.py
+++ b/.openshift-ci/ci_tests.py
@@ -43,37 +43,6 @@ def run(self):
         pass
 
 
-class UpgradeTest(BaseTest):
-    TEST_TIMEOUT = 60 * 60 * 2
-    TEST_OUTPUT_DIR = "/tmp/postgres-upgrade-test-logs"
-    TEST_PG_UPGRADE_OUTPUT_DIR = "/tmp/postgres-version-upgrade-test-logs"
-    TEST_SENSOR_OUTPUT_DIR = "/tmp/postgres-sensor-upgrade-test-logs"
-
-    def run(self):
-        print("Executing the Upgrade Test")
-
-        self.run_with_graceful_kill(
-            [
-                "tests/upgrade/postgres_sensor_run.sh",
-                self.TEST_SENSOR_OUTPUT_DIR,
-            ],
-            self.TEST_TIMEOUT,
-            output_dir=self.TEST_SENSOR_OUTPUT_DIR,
-        )
-
-        self.run_with_graceful_kill(
-            ["tests/upgrade/postgres_run.sh", self.TEST_OUTPUT_DIR],
-            self.TEST_TIMEOUT,
-            output_dir=self.TEST_OUTPUT_DIR,
-        )
-
-        self.run_with_graceful_kill(
-            ["tests/upgrade/postgres_upgrade_run.sh", self.TEST_PG_UPGRADE_OUTPUT_DIR],
-            self.TEST_TIMEOUT,
-            output_dir=self.TEST_PG_UPGRADE_OUTPUT_DIR,
-        )
-
-
 class OperatorE2eTest(BaseTest):
     OLM_SETUP_TIMEOUT_SEC = 60 * 2
     TEST_TIMEOUT_SEC = 60 * 60 * 2
@@ -193,7 +162,7 @@ def run(self):
 
 
 class UIE2eTest(BaseTest):
-    TEST_TIMEOUT = 2 * 60 * 60
+    TEST_TIMEOUT = 3 * 60 * 60
 
     def run(self):
         print("Executing UI e2e test")
@@ -223,7 +192,7 @@ def run(self):
 
 
 class NonGroovyE2e(BaseTest):
-    TEST_TIMEOUT = 120 * 60
+    TEST_TIMEOUT = 3 * 60 * 60
     TEST_OUTPUT_DIR = "/tmp/e2e-test-logs"
 
     def run(self):
@@ -292,7 +261,7 @@ def run(self):
 
 
 class BYODBTest(BaseTest):
-    TEST_TIMEOUT = 60 * 60 * 2
+    TEST_TIMEOUT = 60 * 60 * 3
     TEST_OUTPUT_DIR = "/tmp/byodb-test-logs"
 
     def run(self):
diff --git a/.openshift-ci/common.py b/.openshift-ci/common.py
index 06cebaab6985b..fdf0d0bd212e5 100644
--- a/.openshift-ci/common.py
+++ b/.openshift-ci/common.py
@@ -39,6 +39,14 @@ def enable_sfa_for_ocp():
     """
     try:
         ocp_variant = os.environ.get("CLUSTER_FLAVOR_VARIANT", "")
+
+        # A special case, OCP release candidate version. Most certainly newer
+        # than we require.
+        if ocp_variant == "openshift-4-ocp/candidate":
+            os.environ["SFA_AGENT"] = "true"
+            log_print("Enabled SFA agent for OCP", ocp_variant)
+            return
+
         expr = r"openshift-4-ocp/\w+-(?P<major>\d+)\.(?P<minor>\d+)"
         m = re.match(expr, ocp_variant)
         if m:
diff --git a/.openshift-ci/compatibility_test.py b/.openshift-ci/compatibility_test.py
index ca6ffea982d95..00a0967fe7375 100644
--- a/.openshift-ci/compatibility_test.py
+++ b/.openshift-ci/compatibility_test.py
@@ -9,7 +9,6 @@
 
 from pre_tests import (
     PreSystemTests,
-    CollectionMethodOverridePreTest
 )
 from post_tests import PostClusterTest, FinalPost
 from runners import ClusterTestSetsRunner, TestSet
@@ -23,7 +22,7 @@ def run_compatibility_tests(testfunc, cluster_name):
     # start logging
     logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)
 
-    # Get the test tuples (central_version, sensor_version) for supported versions with available helm charts
+    # Get the test tuples (central_version, sensor_version) for supported versions
     test_tuples = get_compatibility_test_tuples()
 
     if len(test_tuples) > 0:
@@ -32,9 +31,6 @@ def run_compatibility_tests(testfunc, cluster_name):
             os.environ["ROX_TELEMETRY_STORAGE_KEY_V1"] = 'DISABLED'
             test_versions = f'{test_tuple.central_version}--{test_tuple.sensor_version}'
 
-            # expected version string is like 74.x.x for ACS 3.74 versions
-            is_3_74_sensor = test_tuple.sensor_version.startswith('74')
-
             logging.info("Running compatibility tests for central-v%s, sensor-v%s with function %s",
                          test_tuple.central_version, test_tuple.sensor_version, testfunc.__name__)
 
@@ -43,12 +39,9 @@ def run_compatibility_tests(testfunc, cluster_name):
                     f'version compatibility tests: {test_versions}',
                     test=testfunc(test_tuple.central_version, test_tuple.sensor_version),
                     post=PostClusterTest(
-                        collect_collector_metrics=not is_3_74_sensor,
                         check_stackrox_logs=True,
                         artifact_destination_prefix=test_versions,
-                    ),
-                    # Collection not supported on 3.74
-                    pre=CollectionMethodOverridePreTest("NO_COLLECTION" if is_3_74_sensor else "core_bpf")
+                    )
                 )
             )
         ClusterTestSetsRunner(
diff --git a/.openshift-ci/get_compatibility_test_tuples.py b/.openshift-ci/get_compatibility_test_tuples.py
index abe1512a220e3..02c5ff99df27e 100755
--- a/.openshift-ci/get_compatibility_test_tuples.py
+++ b/.openshift-ci/get_compatibility_test_tuples.py
@@ -4,6 +4,7 @@
 Returns the central-sensor version tuples to be used for compatibility testing.
 """
 import logging
+import re
 import subprocess
 import sys
 from collections import namedtuple
@@ -11,7 +12,6 @@
 
 from get_latest_helm_chart_versions import (
     get_supported_helm_chart_versions,
-    get_latest_helm_chart_version_for_specific_release,
 )
 
 
@@ -19,17 +19,17 @@
 # get_compatibility_test_tuples.py provides the function get_compatibility_test_tuples() which is called in our
 # compatibility tests that returns all tuples of central and sensor versions for which:
 #    1. Central is latest and Sensor is a supported older version OR
-#    2. Sensor is latest and Central is a supported older version OR
-#    3. Is a support exception
-# These are returned only if Helm charts for both versions could be found.
+#    2. Sensor is latest and Central is a supported older version
+# These are returned only if charts for both versions could be found.
 # After running get_compatibility_test_tuples.py I received the following output:
 # INFO:root:Listing supported versions tuples:
-# INFO:root:Tuple 1: {Central v4.6.x-736-g48077a980e-dirty - Sensor v400.5.3}
-# INFO:root:Tuple 2: {Central v4.6.x-736-g48077a980e-dirty - Sensor v400.4.5}
-# INFO:root:Tuple 3: {Central v400.5.3 - Sensor v4.6.x-736-g48077a980e-dirty}
-# INFO:root:Tuple 4: {Central v400.4.5 - Sensor v4.6.x-736-g48077a980e-dirty}
-# INFO:root:Tuple 5: {Central v4.6.x-736-g48077a980e-dirty - Sensor v74.9.0}
-# If no supported versions with available Helm charts are found, an empty list is returned.
+# INFO:root:Tuple 1: {Central v4.12.x-793-gf6bf3cc40e - Sensor v4.11.2}
+# INFO:root:Tuple 2: {Central v4.12.x-793-gf6bf3cc40e - Sensor v4.10.6}
+# INFO:root:Tuple 3: {Central v4.12.x-793-gf6bf3cc40e - Sensor v4.9.10}
+# INFO:root:Tuple 4: {Central v4.11.2 - Sensor v4.12.x-793-gf6bf3cc40e}
+# INFO:root:Tuple 5: {Central v4.10.6 - Sensor v4.12.x-793-gf6bf3cc40e}
+# INFO:root:Tuple 6: {Central v4.9.10 - Sensor v4.12.x-793-gf6bf3cc40e}
+# If no supported versions with available charts are found, an empty list is returned.
 def main():
     logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)
     test_tuples = get_compatibility_test_tuples()
@@ -44,51 +44,40 @@ def main():
         )
 
 
-# Returns True if the helm_version is newer than the current_version
-def is_newer_version(current_version: str, helm_version: str):
-    helm_version_split = helm_version.split(sep='.')
-    current_version_split = current_version.split(sep='.')
-
-    # Parse helm version format using numeric encoding:
-    # - New format: X00MM where X=major digit, 00=padding, MM=minor (zero-padded)
-    #   Example: 40009 → major=4, minor=09 (version 4.9)
-    #   Example: 40011 → major=4, minor=11 (version 4.11)
-    #   Formula: major = n // 10000, minor = n % 100
-    # - Old format: X00 where X=major digit, 00=padding (version 4.0.x)
-    #   Formula: major = n // 100
-    helm_major_num = int(helm_version_split[0])
-    if helm_major_num >= 10000:
-        # New format: extract major (first digit) and minor (last 2 digits)
-        helm_major = helm_major_num // 10000
-        helm_minor = helm_major_num % 100
-        helm_version_split = [str(helm_major), str(helm_minor)] + helm_version_split[1:]
-    else:
-        # Old format: extract major by removing padding
-        helm_version_split[0] = str(helm_major_num // 100)
-
-    # Remove commit hash from the current version
-    current_version_split = current_version_split[:-1]
-    # If we are in a release branch, we will have patch version with '-rc'
-    if len(current_version_split) > 2:
-        # Remove '-rc' if present
-        current_version_split[2] = str(current_version_split[2]).rstrip("-rc")
-
-    for (current, helm) in zip(current_version_split, helm_version_split):
-        if int(current) > int(helm):
+# Returns True if the product_version is newer than the current_version.
+#
+# current_version examples: '4.11.x-736-g48077a980e', '4.11.1-rc.2', '4.11.1'
+# product_version examples:  '4.9.3', '4.11.0'
+def is_newer_version(current_version: str, product_version: str):
+    product_parts = [int(x) for x in product_version.split('.')]
+
+    # Parse the numeric major.minor[.patch] prefix from current_version, stopping
+    # at any component that does not begin with a digit (e.g. 'x-736-ghash').
+    # This correctly handles:
+    #   dev:     '4.11.x-736-ghash' -> [4, 11]
+    #   rc:      '4.11.1-rc.2'      -> [4, 11, 1]
+    #   release: '4.11.1'           -> [4, 11, 1]
+    current_parts = []
+    for part in current_version.split('.')[:3]:
+        m = re.match(r'^(\d+)', part)
+        if not m:
             break
-        if int(current) < int(helm):
+        current_parts.append(int(m.group(1)))
+
+    for (current, product) in zip(current_parts, product_parts):
+        if current > product:
+            return False
+        if current < product:
             return True
 
     return False
 
 
 def get_compatibility_test_tuples():
-    Release = namedtuple("Release", ["major", "minor"])
-
     # start logging
     logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)
 
-    central_chart_versions, sensor_chart_versions = get_supported_helm_chart_versions()
+    central_versions, sensor_versions = get_supported_helm_chart_versions()
 
     makefile_path = Path(__file__).parent.parent
     latest_tag = subprocess.check_output(
@@ -104,57 +93,35 @@ def get_compatibility_test_tuples():
     # versions.
     # There is no risk in excluding newer versions as the compatibility tests in
     # their respective branches will test against older versions.
-    central_chart_versions = [i for i in central_chart_versions
-                              if not
-                              is_newer_version(current_version=latest_tag,
-                                               helm_version=i)]
-    sensor_chart_versions = [i for i in sensor_chart_versions
-                             if not
-                             is_newer_version(current_version=latest_tag,
-                                              helm_version=i)]
-
-    if len(central_chart_versions) == 0:
-        logging.info("Found no older central chart versions to test against according to the product lifecycles API.")
-    if len(sensor_chart_versions) == 0:
-        logging.info("Found no older sensor chart versions to test against according to the product lifecycles API.")
-    if len(central_chart_versions) == 0 or len(sensor_chart_versions) == 0:
-        logging.info("However versions with support exceptions will still be tested against.")
-
-    ChartVersions = namedtuple(
-        "Chart_versions", ["central_version", "sensor_version"])
-
-    # Latest central vs sensor versions in sensor_chart_versions
+    central_versions = [i for i in central_versions
+                        if not is_newer_version(current_version=latest_tag,
+                                                product_version=i)]
+    sensor_versions = [i for i in sensor_versions
+                       if not is_newer_version(current_version=latest_tag,
+                                               product_version=i)]
+
+    if len(central_versions) == 0:
+        logging.info("Found no older central versions to test against according to the product lifecycles API.")
+    if len(sensor_versions) == 0:
+        logging.info("Found no older sensor versions to test against according to the product lifecycles API.")
+
+    VersionTuple = namedtuple("VersionTuple", ["central_version", "sensor_version"])
+
+    # Latest central vs older sensor versions
     test_tuples = [
-        ChartVersions(central_version=latest_tag,
-                      sensor_version=sensor_chart_version)
-        for sensor_chart_version in sensor_chart_versions
+        VersionTuple(central_version=latest_tag,
+                     sensor_version=sensor_version)
+        for sensor_version in sensor_versions
     ]
-    # Latest sensor vs central versions in central_chart_versions
+    # Older central versions vs latest sensor
     test_tuples.extend(
         [
-            ChartVersions(central_version=central_chart_version,
-                          sensor_version=latest_tag)
-            for central_chart_version in central_chart_versions
+            VersionTuple(central_version=central_version,
+                         sensor_version=latest_tag)
+            for central_version in central_versions
         ]
     )
 
-    # Currently there are no support exceptions, the last one expired on 2024-06-30, see:
-    # https://issues.redhat.com/browse/ROX-18223
-    # however a new support exception is being negotiated, add it here when it's ready
-    support_exceptions = [
-        ChartVersions(
-            central_version=latest_tag,
-            sensor_version=get_latest_helm_chart_version_for_specific_release(
-                "stackrox-secured-cluster-services", Release(major=3, minor=74)
-            ),
-        )
-    ]
-
-    test_tuples.extend(
-        support_exception
-        for support_exception in support_exceptions
-        if support_exception not in test_tuples
-    )
     return test_tuples
 
 
diff --git a/.openshift-ci/get_latest_helm_chart_versions.py b/.openshift-ci/get_latest_helm_chart_versions.py
index ae5c4b0f5d33f..c61a18049c978 100755
--- a/.openshift-ci/get_latest_helm_chart_versions.py
+++ b/.openshift-ci/get_latest_helm_chart_versions.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 
 """
-Looks up N previous releases and outputs a Helm chart version for the most
+Looks up supported releases and outputs a product version for the most
 recent patch for each found release.
 """
 
@@ -46,11 +46,13 @@
 # with the current cadence and support period.
 NUM_RELEASES_DEFAULT = 3
 
-# For support exceptions we may need to get the latest patch for a specific
-# release that is not within the last N versions. In that case
-# get_latest_helm_chart_version_for_specific_release will provide the latest
-# patch of the input release.
-sample_support_exception = Release(major=3, minor=74)
+# From this release onward the stackrox-operator chart is used instead of the
+# per-component legacy charts (stackrox-central-services,
+# stackrox-secured-cluster-services), which are not published for new releases.
+# Drop legacy chart inspection can be dropped, once 4.10 goes EOL.
+OPERATOR_CHART_FIRST_RELEASE = Release(major=4, minor=11)
+
+OPERATOR_CHART_NAME = "stackrox-operator"
 
 
 def main(argv):
@@ -60,25 +62,29 @@ def main(argv):
         "stackrox-secured-cluster-services", num_releases
     )
     logging.info(
-        f"Helm chart versions for the latest {num_releases} releases:")
+        f"Product versions for the latest {num_releases} releases:")
 
     logging.info("\n".join(helm_versions))
-    helm_version_specific = get_latest_helm_chart_version_for_specific_release(
-        "stackrox-secured-cluster-services", sample_support_exception
-    )
-    logging.info(
-        f"Latest chart version for the {sample_support_exception} "
-        f"releases is {helm_version_specific}"
-    )
     supported_versions_string = [[f"{version.major}.{version.minor}"] for version in get_supported_releases()]
     supported_central_versions_from_api, supported_sensor_versions_from_api = get_supported_helm_chart_versions()
     logging.info(
         f"\nThe product lifecycles API denotes support for the following versions: {supported_versions_string}\n"
-        f"Found helm charts for the following supported versions: "
+        f"Found product versions for the following supported versions: "
         f"central{supported_central_versions_from_api} - sensor{supported_sensor_versions_from_api}"
     )
 
 
+def _is_legacy_release(release: Release) -> bool:
+    """Returns True for releases that use per-component charts (pre-4.11)."""
+    return release < OPERATOR_CHART_FIRST_RELEASE
+
+
+def _chart_to_product_version(chart: dict) -> str:
+    """Return a product version string (e.g. '4.9.3') from a chart dict."""
+    av = chart["parsed_app_version"]
+    return f"{av.major}.{av.minor}.{av.patch}"
+
+
 def get_latest_helm_chart_versions(chart_name, num_releases=NUM_RELEASES_DEFAULT):
     add_helm_repo()
     try:
@@ -110,22 +116,42 @@ def __get_supported_helm_chart_versions():
     supported_central_versions = []
     supported_sensor_versions = []
 
+    charts = read_charts()  # one helm search, reused for all releases
+
     supported_releases = get_supported_releases()
     for release in supported_releases:
-        if __does_chart_exist("stackrox-central-services", release):
-            supported_central_versions.append(__get_latest_helm_chart_version_for_specific_release(
-                "stackrox-central-services", release)
-            )
-        else:
-            logging.debug(f"Supported version \"{release.major}.{release.minor}\" has no corresponding helm chart for "
-                          f"stackrox-central-services.")
-        if __does_chart_exist("stackrox-secured-cluster-services", release):
-            supported_sensor_versions.append(__get_latest_helm_chart_version_for_specific_release(
-                "stackrox-secured-cluster-services", release)
-            )
+        if _is_legacy_release(release):
+            # Pre-4.11: separate charts for central and sensor.
+            for chart_name, version_list in [
+                ("stackrox-central-services", supported_central_versions),
+                ("stackrox-secured-cluster-services", supported_sensor_versions),
+            ]:
+                filtered = filter_charts_by_name(charts, chart_name)
+                if any(version_to_release(c["parsed_app_version"]) == release
+                       for c in filtered):
+                    chart = get_latest_chart_for_specific_release(filtered, release)
+                    version_list.append(_chart_to_product_version(chart))
+                else:
+                    logging.debug(
+                        f"Supported version \"{release.major}.{release.minor}\" has no "
+                        f"corresponding chart for {chart_name}."
+                    )
         else:
-            logging.debug(f"Supported version \"{release.major}.{release.minor}\" has no corresponding helm chart for "
-                          f"stackrox-secured-cluster-services.")
+            # 4.11+: one operator chart covers both central and sensor.
+            filtered = filter_charts_by_name(charts, OPERATOR_CHART_NAME)
+            if any(version_to_release(c["parsed_app_version"]) == release
+                   for c in filtered):
+                chart = get_latest_chart_for_specific_release(filtered, release)
+                version = _chart_to_product_version(chart)
+                supported_central_versions.append(version)
+                supported_sensor_versions.append(version)
+            else:
+                logging.warning(
+                    f"Supported version \"{release.major}.{release.minor}\" has no "
+                    f"corresponding chart for {OPERATOR_CHART_NAME}. "
+                    f"This release will be skipped in compatibility testing."
+                )
+
     return supported_central_versions, supported_sensor_versions
 
 
@@ -164,15 +190,6 @@ def __get_data_from_product_lifecycles_api():
     return []
 
 
-def __does_chart_exist(chart_name, release):
-    charts = read_charts()
-    filtered_charts = filter_charts_by_name(charts, chart_name)
-    for fchart in filtered_charts:
-        if version_to_release(fchart["parsed_app_version"]) == release:
-            return True
-    return False
-
-
 def __get_latest_helm_chart_versions(chart_name, num_releases):
     charts = read_charts()
     logging.info(f"Discovered total {len(charts)} charts")
@@ -187,8 +204,7 @@ def __get_latest_helm_chart_versions(chart_name, num_releases):
     logging.debug(
         f"Identified these charts as {num_releases} latest: {latest_charts}")
 
-    # Specifically remove 400.1.6 which is affected by a max message size bug, but is no longer supported.
-    return [c["version"] for c in latest_charts if c["version"] != "400.1.6"]
+    return [_chart_to_product_version(c) for c in latest_charts]
 
 
 def __get_latest_helm_chart_version_for_specific_release(chart_name, release):
@@ -204,7 +220,7 @@ def __get_latest_helm_chart_version_for_specific_release(chart_name, release):
     logging.debug(
         f"Identified {latest_chart} as latest version of release {release}")
 
-    return latest_chart["version"]
+    return _chart_to_product_version(latest_chart)
 
 
 def read_charts():
diff --git a/.openshift-ci/post_tests.py b/.openshift-ci/post_tests.py
index 10f8ed4947ace..64f27674b5204 100644
--- a/.openshift-ci/post_tests.py
+++ b/.openshift-ci/post_tests.py
@@ -34,6 +34,7 @@ class PostTestsConstants:
     DIAGNOSTIC_OUTPUT = "diagnostic-bundle"
     CENTRAL_DATA_OUTPUT = "central-data"
     STACKROX_LOG_DIR = "/tmp/stackrox-logs"
+    VM_GUEST_LOG_DIR = "/tmp/vm-diagnostics"
 
 
 class NullPostTest:
@@ -151,12 +152,13 @@ def _store_osci_artifact(self, source):
 class PostClusterTest(StoreArtifacts):
     """The standard cluster test suite of debug gathering and analysis"""
 
-    # pylint: disable=too-many-arguments
+    # pylint: disable=too-many-arguments,too-many-positional-arguments
     def __init__(
         self,
         collect_collector_metrics=True,
         collect_central_artifacts=True,
         collect_service_logs=True,
+        collect_vm_guest_logs=False,
         check_stackrox_logs=False,
         artifact_destination_prefix=None,
     ):
@@ -169,6 +171,7 @@ def __init__(
             self.service_logs_destination = self.K8S_LOG_DIR
         self._collect_collector_metrics = collect_collector_metrics
         self._collect_service_logs = collect_service_logs
+        self._collect_vm_guest_logs = collect_vm_guest_logs
         self._check_stackrox_logs = check_stackrox_logs
         self.k8s_namespaces = [
             "stackrox",
@@ -202,6 +205,8 @@ def run(self, test_outputs=None):
             self.grab_central_data()
         if self._collect_service_logs:
             self.collect_service_logs()
+        if self._collect_vm_guest_logs:
+            self.collect_vm_guest_logs()
         if self._check_stackrox_logs:
             self.check_stackrox_logs()
         self.store_artifacts(test_outputs)
@@ -232,6 +237,23 @@ def collect_service_logs(self):
         )
         self.data_to_store.append(self.service_logs_destination)
 
+    def collect_vm_guest_logs(self):
+        # Per-VM virtctl ssh is capped in the script. Cleanup is a second
+        # process because a collect timeout SIGKILLs the first before it can
+        # delete namespaces.
+        self.run_with_best_effort(
+            [
+                "scripts/ci/collect-vm-guest-logs.sh",
+                self.VM_GUEST_LOG_DIR,
+            ],
+            timeout=10 * 60,
+        )
+        self.data_to_store.append(self.VM_GUEST_LOG_DIR)
+        self.run_with_best_effort(
+            ["scripts/ci/delete-vm-ns.sh"],
+            timeout=60,
+        )
+
     def collect_collector_metrics(self):
         self.run_with_best_effort(
             [
diff --git a/.openshift-ci/pre_tests.py b/.openshift-ci/pre_tests.py
index 8b4d16e4e29d6..1902074fcc020 100644
--- a/.openshift-ci/pre_tests.py
+++ b/.openshift-ci/pre_tests.py
@@ -2,7 +2,6 @@
 PreTests - something to run before test but after resource provisioning.
 """
 
-import os
 import subprocess
 
 
@@ -57,15 +56,3 @@ def run(self):
             check=True,
             timeout=self.START_PREFETCH_TIMEOUT,
         )
-
-
-class CollectionMethodOverridePreTest:
-    """
-    CollectionPreTest - allows finer control over collection method
-    for individual test jobs
-    """
-    def __init__(self, method):
-        self._collection_method = method
-
-    def run(self):
-        os.environ['COLLECTION_METHOD'] = self._collection_method
diff --git a/.openshift-ci/tests/test_get_compatibility_test_tuples.py b/.openshift-ci/tests/test_get_compatibility_test_tuples.py
index 17e2669bfecfc..fabf092c277a9 100644
--- a/.openshift-ci/tests/test_get_compatibility_test_tuples.py
+++ b/.openshift-ci/tests/test_get_compatibility_test_tuples.py
@@ -19,77 +19,77 @@ class TestIsNewerVersion(unittest.TestCase):
     def test_double_digit_minor_version_not_newer(self):
         """4.11 should NOT consider 4.9 as newer (this was the bug)"""
         self.assertFalse(
-            is_newer_version('4.11.x-94-g75a2cb6b34', '40009.5.3'),
+            is_newer_version('4.11.x-94-g75a2cb6b34', '4.9.5'),
             "4.9 should not be considered newer than 4.11"
         )
 
     def test_double_digit_minor_version_4_10_vs_4_9(self):
         """4.10 should NOT consider 4.9 as newer"""
         self.assertFalse(
-            is_newer_version('4.10.x-50-ghash', '40009.5.3'),
+            is_newer_version('4.10.x-50-ghash', '4.9.5'),
             "4.9 should not be considered newer than 4.10"
         )
 
     def test_double_digit_minor_version_4_11_vs_4_10(self):
         """4.11 should NOT consider 4.10 as newer"""
         self.assertFalse(
-            is_newer_version('4.11.x-94-ghash', '40010.2.1'),
+            is_newer_version('4.11.x-94-ghash', '4.10.2'),
             "4.10 should not be considered newer than 4.11"
         )
 
     def test_double_digit_minor_version_is_newer(self):
         """4.10 should consider 4.11 as newer"""
         self.assertTrue(
-            is_newer_version('4.10.x-50-ghash', '40011.1.0'),
+            is_newer_version('4.10.x-50-ghash', '4.11.1'),
             "4.11 should be considered newer than 4.10"
         )
 
     def test_single_digit_minor_version_not_newer(self):
         """4.8 should NOT consider 4.7 as newer (existing behavior)"""
         self.assertFalse(
-            is_newer_version('4.8.x-325-ghash', '40007.0.0'),
+            is_newer_version('4.8.x-325-ghash', '4.7.0'),
             "4.7 should not be considered newer than 4.8"
         )
 
     def test_single_digit_minor_version_is_newer(self):
         """4.6 should consider 4.9 as newer (existing behavior)"""
         self.assertTrue(
-            is_newer_version('4.6.x-736-ghash', '40009.5.3'),
+            is_newer_version('4.6.x-736-ghash', '4.9.5'),
             "4.9 should be considered newer than 4.6"
         )
 
     def test_equal_major_minor_versions(self):
         """Equal major.minor versions should not be considered newer"""
         self.assertFalse(
-            is_newer_version('4.9.x-100-ghash', '40009.0.0'),
+            is_newer_version('4.9.x-100-ghash', '4.9.0'),
             "Same version should not be considered newer"
         )
 
     def test_major_version_difference(self):
         """Higher major version should be considered newer"""
         self.assertTrue(
-            is_newer_version('4.11.x-94-ghash', '50000.0.0'),
+            is_newer_version('4.11.x-94-ghash', '5.0.0'),
             "5.0 should be considered newer than 4.11"
         )
 
     def test_major_version_not_newer(self):
         """Lower major version should not be considered newer"""
         self.assertFalse(
-            is_newer_version('4.11.x-94-ghash', '30074.9.0'),
+            is_newer_version('4.11.x-94-ghash', '3.74.9'),
             "3.74 should not be considered newer than 4.11"
         )
 
     def test_release_candidate_version(self):
         """Test with release candidate versions"""
         self.assertTrue(
-            is_newer_version('4.11.1-rc.2', '40012.0.0'),
+            is_newer_version('4.11.1-rc.2', '4.12.0'),
             "4.12 should be considered newer than 4.11.1-rc.2"
         )
 
     def test_release_candidate_not_newer(self):
         """Test with release candidate versions - not newer"""
         self.assertFalse(
-            is_newer_version('4.11.1-rc.2', '40010.5.0'),
+            is_newer_version('4.11.1-rc.2', '4.10.5'),
             "4.10 should not be considered newer than 4.11.1-rc.2"
         )
 
@@ -97,7 +97,7 @@ def test_patch_version_differences(self):
         """Test that patch versions are handled correctly"""
         # 4.11.2 should not consider 4.11.1 as newer
         self.assertFalse(
-            is_newer_version('4.11.2-10-ghash', '40011.1.0'),
+            is_newer_version('4.11.2-10-ghash', '4.11.1'),
             "4.11.1 should not be considered newer than 4.11.2"
         )
 
@@ -105,17 +105,38 @@ def test_three_digit_minor_version(self):
         """Test edge case with hypothetical three-digit minor versions"""
         # If we ever reach 4.100, this should work
         self.assertFalse(
-            is_newer_version('4.100.x-1-ghash', '40099.0.0'),
+            is_newer_version('4.100.x-1-ghash', '4.99.0'),
             "4.99 should not be considered newer than 4.100"
         )
 
-    def test_helm_version_with_different_patch_levels(self):
-        """Test comparison with different helm chart patch versions"""
+    def test_product_version_with_different_patch_levels(self):
+        """Test comparison with different patch versions"""
         self.assertFalse(
-            is_newer_version('4.9.x-100-ghash', '40009.10.5'),
+            is_newer_version('4.9.x-100-ghash', '4.9.10'),
             "4.9.10 should not be considered newer than 4.9"
         )
 
+    def test_plain_release_tag_patch_newer(self):
+        """Plain release tag: newer patch should be detected"""
+        self.assertTrue(
+            is_newer_version('4.11.1', '4.11.5'),
+            "4.11.5 should be considered newer than plain release 4.11.1"
+        )
+
+    def test_plain_release_tag_patch_not_newer(self):
+        """Plain release tag: older patch should not be considered newer"""
+        self.assertFalse(
+            is_newer_version('4.11.5', '4.11.1'),
+            "4.11.1 should not be considered newer than plain release 4.11.5"
+        )
+
+    def test_plain_release_tag_same_version(self):
+        """Plain release tag: same version is not newer"""
+        self.assertFalse(
+            is_newer_version('4.11.1', '4.11.1'),
+            "Same plain release version should not be considered newer"
+        )
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/.tekton/basic-component-pipeline.yaml b/.tekton/basic-component-pipeline.yaml
index c472b099cb424..642db21c6996b 100644
--- a/.tekton/basic-component-pipeline.yaml
+++ b/.tekton/basic-component-pipeline.yaml
@@ -35,7 +35,7 @@ spec:
       - name: name
         value: post-bigquery-metrics
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -168,7 +168,7 @@ spec:
       - name: name
         value: init
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:4dbbfedc4edb21884fa2ad84521408d2fad090d4d34eb6c555992f8444eba40d
+        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:7854d7babe4136e53e337f6433d952532314433b48bb62b422ddc02700934d85
       - name: kind
         value: task
       resolver: bundles
@@ -192,7 +192,7 @@ spec:
       - name: name
         value: git-clone-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
       - name: kind
         value: task
       resolver: bundles
@@ -211,7 +211,7 @@ spec:
       - name: name
         value: determine-image-expiration
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -227,7 +227,7 @@ spec:
       - name: name
         value: determine-image-tag
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -251,7 +251,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.9.0@sha256:4486aaa69770d6b27c59c8df7d82e450d95dab2302aef9b8a345f2ac0fabbab0
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.3@sha256:0c386f2c26b46b978280c5c54caac26bcd524975f8f7cc06bb080ba00eae3ad4
       - name: kind
         value: task
       resolver: bundles
@@ -310,7 +310,7 @@ spec:
       - name: name
         value: buildah-remote-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:227cf5b487cd2221301ea2fccf2334f41c0f5b21edb04696609245520b2d2691
+        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.2@sha256:a68dce8ed79be8d9e10d98bd2b56895c27fc34f1ed7d67cbc9ec0a91d64cf641
       - name: kind
         value: task
       resolver: bundles
@@ -329,7 +329,7 @@ spec:
       - name: name
         value: build-image-index
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:714a86d454203804fe14e422b4ba8d775d9ec19e5b7922cedd55ef93a3bc9166
+        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.4@sha256:654446d8ec028b20ed6ada8a96486ff16692a25192755aa04a99cea8e0afb7e2
       - name: kind
         value: task
       resolver: bundles
@@ -350,7 +350,7 @@ spec:
       - name: name
         value: source-build-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:c7ecd1e518007e31e19188333a17dd3558e222ce2e3b2a484a1e59ec069799cf
+        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3.2@sha256:45091b5022754d452b4de60c7d7f4c6e03626efff55f96e9af937400fe3506eb
       - name: kind
         value: task
       resolver: bundles
@@ -379,12 +379,27 @@ spec:
       operator: in
       values: ["false"]
 
-  - name: clair-scan
-    matrix:
+  - name: roxctl-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    taskRef:
       params:
-      - name: image-platform
-        value:
-        - $(params.build-platforms)
+      - name: name
+        value: roxctl-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1@sha256:97e2b2cdca9110fdc8a93ba585a1a1a743f989f2fd85f4073f6e5ea9ad2ce828
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values: ["false"]
+
+  - name: clair-scan
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
@@ -395,7 +410,7 @@ spec:
       - name: name
         value: clair-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
+        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.1@sha256:219964897ac4d5a9473ec297a1b39ae078a34b76b45d04c4672bd569cc295c29
       - name: kind
         value: task
       resolver: bundles
@@ -418,7 +433,7 @@ spec:
       - name: name
         value: ecosystem-cert-preflight-checks
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7
+        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:fa53ef450ba538addafee1211ff6ac15b55865ce652fec15ac99b554680cb642
       - name: kind
         value: task
       resolver: bundles
@@ -444,7 +459,7 @@ spec:
       - name: name
         value: sast-shell-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d00c884c78489a52dc638e6ced0a01429670d0754f5b1305ad576709cf660312
       - name: kind
         value: task
       resolver: bundles
@@ -470,7 +485,7 @@ spec:
       - name: name
         value: sast-unicode-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:15d654c9576b9c4ee1f78b09fce541acf9afe33f1c2363fd6219a79dbf62c95d
       - name: kind
         value: task
       resolver: bundles
@@ -496,7 +511,7 @@ spec:
       - name: name
         value: sast-snyk-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:17b9587eba53fabaab35061275306bfe1f99661d55e14e22f62321fa7cb5ff3e
       - name: kind
         value: task
       resolver: bundles
@@ -521,7 +536,7 @@ spec:
       - name: name
         value: clamav-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
+        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.3@sha256:9df272d2180bd67e6a3e04d5cd30ffa7ba27af4e599a1922f7069f5c89888e5b
       - name: kind
         value: task
       resolver: bundles
@@ -541,7 +556,7 @@ spec:
       - name: name
         value: rpms-signature-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.2@sha256:d9df5d325f81a9fa132cb597c465aa9210b9b0fa3716b85b32be98d92c9c881a
       - name: kind
         value: task
       resolver: bundles
@@ -567,7 +582,7 @@ spec:
       - name: name
         value: push-dockerfile-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:ee041e2bdf5638faaca60baa171c3e13927097a0e69ed2172ccf1de5e5ee711a
+        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:4c567d11296850230fe32e76d129834d3bf337a0cae9989b64279b7cfaa4e735
       - name: kind
         value: task
       resolver: bundles
diff --git a/.tekton/checks.yaml b/.tekton/checks.yaml
index 2508b4492121d..5e7ce9e0f1912 100644
--- a/.tekton/checks.yaml
+++ b/.tekton/checks.yaml
@@ -66,7 +66,7 @@ spec:
         - name: name
           value: post-bigquery-metrics
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -117,7 +117,7 @@ spec:
         - name: name
           value: git-clone-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
         - name: kind
           value: task
         resolver: bundles
@@ -146,7 +146,7 @@ spec:
         - name: name
           value: buildah-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.12.0@sha256:de5580c99ca52588f9b8cec452023bc7e3de470a594c99243320752d250bb2a2
+          value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.12.2@sha256:e1bbe61a3a4bc543be9b5f6fc4174acaa2dd08fb5f7fe4d9db9f3193a7e1b03c
         - name: kind
           value: task
         resolver: bundles
diff --git a/.tekton/create-custom-snapshot.yaml b/.tekton/create-custom-snapshot.yaml
index 9806101ab1331..b96b14d7b28b3 100644
--- a/.tekton/create-custom-snapshot.yaml
+++ b/.tekton/create-custom-snapshot.yaml
@@ -75,7 +75,7 @@ spec:
         - name: name
           value: post-bigquery-metrics
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -132,7 +132,7 @@ spec:
         - name: SHOULD_REALLY_WORK
         steps:
         - name: determine
-          image: registry.redhat.io/ubi9-minimal:latest@sha256:692953368d8e630f40a3c0a6135163f8824fdafc26e0400b9a6c8d7fac850366
+          image: registry.redhat.io/ubi9-minimal:latest@sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661
           imagePullPolicy: IfNotPresent
           # The script expresses the same condition as pipelinesascode.tekton.dev/on-cel-expression in other pipelines
           # but in a more verbose way because, as it turns out, both syntax and fields of CEL expressions are slightly
@@ -201,7 +201,7 @@ spec:
         - name: name
           value: git-clone-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
         - name: kind
           value: task
         resolver: bundles
@@ -224,7 +224,7 @@ spec:
         - name: name
           value: determine-image-tag
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -242,7 +242,7 @@ spec:
         - name: name
           value: wait-for-image
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -299,26 +299,6 @@ spec:
               "internalRepo": "quay.io/rhacs-eng/release-roxctl",
               "component": "roxctl"
             },
-            {
-              "externalRepo": "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9",
-              "internalRepo": "quay.io/rhacs-eng/release-scanner-db",
-              "component": "scanner-db"
-            },
-            {
-              "externalRepo": "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9",
-              "internalRepo": "quay.io/rhacs-eng/release-scanner-db-slim",
-              "component": "scanner-db-slim"
-            },
-            {
-              "externalRepo": "registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9",
-              "internalRepo": "quay.io/rhacs-eng/release-scanner",
-              "component": "scanner"
-            },
-            {
-              "externalRepo": "registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9",
-              "internalRepo": "quay.io/rhacs-eng/release-scanner-slim",
-              "component": "scanner-slim"
-            },
             {
               "externalRepo": "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9",
               "internalRepo": "quay.io/rhacs-eng/release-scanner-v4-db",
@@ -335,7 +315,7 @@ spec:
         - name: name
           value: create-snapshot-from-bundle
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
diff --git a/.tekton/images-mirror-set.yaml b/.tekton/images-mirror-set.yaml
index 22352382973d0..f8f22c411a424 100644
--- a/.tekton/images-mirror-set.yaml
+++ b/.tekton/images-mirror-set.yaml
@@ -29,18 +29,6 @@ spec:
   - source: registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9
     mirrors:
     - quay.io/rhacs-eng/release-roxctl
-  - source: registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9
-    mirrors:
-    - quay.io/rhacs-eng/release-scanner-db
-  - source: registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9
-    mirrors:
-    - quay.io/rhacs-eng/release-scanner-db-slim
-  - source: registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9
-    mirrors:
-    - quay.io/rhacs-eng/release-scanner
-  - source: registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9
-    mirrors:
-    - quay.io/rhacs-eng/release-scanner-slim
   - source: registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9
     mirrors:
     - quay.io/rhacs-eng/release-scanner-v4-db
diff --git a/.tekton/main-pipeline.yaml b/.tekton/main-pipeline.yaml
index 667d630fce643..fb022d858b32c 100644
--- a/.tekton/main-pipeline.yaml
+++ b/.tekton/main-pipeline.yaml
@@ -35,7 +35,7 @@ spec:
       - name: name
         value: post-bigquery-metrics
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -169,7 +169,7 @@ spec:
       - name: name
         value: init
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:4dbbfedc4edb21884fa2ad84521408d2fad090d4d34eb6c555992f8444eba40d
+        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:7854d7babe4136e53e337f6433d952532314433b48bb62b422ddc02700934d85
       - name: kind
         value: task
       resolver: bundles
@@ -193,7 +193,7 @@ spec:
       - name: name
         value: git-clone-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
       - name: kind
         value: task
       resolver: bundles
@@ -212,7 +212,7 @@ spec:
       - name: name
         value: determine-image-expiration
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -228,7 +228,7 @@ spec:
       - name: name
         value: determine-image-tag
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -248,7 +248,7 @@ spec:
       - name: name
         value: fetch-external-networks
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -272,7 +272,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.9.0@sha256:4486aaa69770d6b27c59c8df7d82e450d95dab2302aef9b8a345f2ac0fabbab0
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.3@sha256:0c386f2c26b46b978280c5c54caac26bcd524975f8f7cc06bb080ba00eae3ad4
       - name: kind
         value: task
       resolver: bundles
@@ -331,7 +331,7 @@ spec:
       - name: name
         value: buildah-remote-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:227cf5b487cd2221301ea2fccf2334f41c0f5b21edb04696609245520b2d2691
+        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.2@sha256:a68dce8ed79be8d9e10d98bd2b56895c27fc34f1ed7d67cbc9ec0a91d64cf641
       - name: kind
         value: task
       resolver: bundles
@@ -351,7 +351,7 @@ spec:
       - name: name
         value: build-image-index
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:714a86d454203804fe14e422b4ba8d775d9ec19e5b7922cedd55ef93a3bc9166
+        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.4@sha256:654446d8ec028b20ed6ada8a96486ff16692a25192755aa04a99cea8e0afb7e2
       - name: kind
         value: task
       resolver: bundles
@@ -372,7 +372,7 @@ spec:
       - name: name
         value: source-build-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:c7ecd1e518007e31e19188333a17dd3558e222ce2e3b2a484a1e59ec069799cf
+        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3.2@sha256:45091b5022754d452b4de60c7d7f4c6e03626efff55f96e9af937400fe3506eb
       - name: kind
         value: task
       resolver: bundles
@@ -401,12 +401,27 @@ spec:
       operator: in
       values: ["false"]
 
-  - name: clair-scan
-    matrix:
+  - name: roxctl-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    taskRef:
       params:
-      - name: image-platform
-        value:
-        - $(params.build-platforms)
+      - name: name
+        value: roxctl-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1@sha256:97e2b2cdca9110fdc8a93ba585a1a1a743f989f2fd85f4073f6e5ea9ad2ce828
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values: ["false"]
+
+  - name: clair-scan
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
@@ -417,7 +432,7 @@ spec:
       - name: name
         value: clair-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
+        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.1@sha256:219964897ac4d5a9473ec297a1b39ae078a34b76b45d04c4672bd569cc295c29
       - name: kind
         value: task
       resolver: bundles
@@ -440,7 +455,7 @@ spec:
       - name: name
         value: ecosystem-cert-preflight-checks
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7
+        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:fa53ef450ba538addafee1211ff6ac15b55865ce652fec15ac99b554680cb642
       - name: kind
         value: task
       resolver: bundles
@@ -466,7 +481,7 @@ spec:
       - name: name
         value: sast-shell-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d00c884c78489a52dc638e6ced0a01429670d0754f5b1305ad576709cf660312
       - name: kind
         value: task
       resolver: bundles
@@ -492,7 +507,7 @@ spec:
       - name: name
         value: sast-unicode-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:15d654c9576b9c4ee1f78b09fce541acf9afe33f1c2363fd6219a79dbf62c95d
       - name: kind
         value: task
       resolver: bundles
@@ -518,7 +533,7 @@ spec:
       - name: name
         value: sast-snyk-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:17b9587eba53fabaab35061275306bfe1f99661d55e14e22f62321fa7cb5ff3e
       - name: kind
         value: task
       resolver: bundles
@@ -543,7 +558,7 @@ spec:
       - name: name
         value: clamav-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
+        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.3@sha256:9df272d2180bd67e6a3e04d5cd30ffa7ba27af4e599a1922f7069f5c89888e5b
       - name: kind
         value: task
       resolver: bundles
@@ -563,7 +578,7 @@ spec:
       - name: name
         value: rpms-signature-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.2@sha256:d9df5d325f81a9fa132cb597c465aa9210b9b0fa3716b85b32be98d92c9c881a
       - name: kind
         value: task
       resolver: bundles
@@ -589,7 +604,7 @@ spec:
       - name: name
         value: push-dockerfile-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:ee041e2bdf5638faaca60baa171c3e13927097a0e69ed2172ccf1de5e5ee711a
+        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:4c567d11296850230fe32e76d129834d3bf337a0cae9989b64279b7cfaa4e735
       - name: kind
         value: task
       resolver: bundles
diff --git a/.tekton/operator-bundle-pipeline.yaml b/.tekton/operator-bundle-pipeline.yaml
index c633a41366280..f7da2ba4be86b 100644
--- a/.tekton/operator-bundle-pipeline.yaml
+++ b/.tekton/operator-bundle-pipeline.yaml
@@ -35,7 +35,7 @@ spec:
       - name: name
         value: post-bigquery-metrics
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -120,42 +120,6 @@ spec:
     type: string
     default: "registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9"
 
-  - name: scanner-image-build-repo
-    description: Repository where the (unreleased) Scanner V2 image is pushed by its build pipeline.
-    type: string
-    default: "quay.io/rhacs-eng/release-scanner"
-  - name: scanner-image-catalog-repo
-    description: Repository within the Red Hat Container Catalog where the Scanner V2 image is pushed to during the release.
-    type: string
-    default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9"
-
-  - name: scanner-db-image-build-repo
-    description: Repository where the (unreleased) Scanner V2 DB image is pushed by its build pipeline.
-    type: string
-    default: "quay.io/rhacs-eng/release-scanner-db"
-  - name: scanner-db-image-catalog-repo
-    description: Repository within the Red Hat Container Catalog where the Scanner V2 DB image is pushed to during the release.
-    type: string
-    default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9"
-
-  - name: scanner-slim-image-build-repo
-    description: Repository where the (unreleased) Scanner V2 slim image is pushed by its build pipeline.
-    type: string
-    default: "quay.io/rhacs-eng/release-scanner-slim"
-  - name: scanner-slim-image-catalog-repo
-    description: Repository within the Red Hat Container Catalog where the Scanner V2 slim image is pushed to during the release.
-    type: string
-    default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9"
-
-  - name: scanner-db-slim-image-build-repo
-    description: Repository where the (unreleased) Scanner V2 DB slim image is pushed by its build pipeline.
-    type: string
-    default: "quay.io/rhacs-eng/release-scanner-db-slim"
-  - name: scanner-db-slim-image-catalog-repo
-    description: Repository within the Red Hat Container Catalog where the Scanner V2 DB slim image is pushed to during the release.
-    type: string
-    default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9"
-
   - name: scanner-v4-image-build-repo
     description: Repository where the (unreleased) Scanner V4 image is pushed by its build pipeline.
     type: string
@@ -265,7 +229,7 @@ spec:
       - name: name
         value: init
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:4dbbfedc4edb21884fa2ad84521408d2fad090d4d34eb6c555992f8444eba40d
+        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:7854d7babe4136e53e337f6433d952532314433b48bb62b422ddc02700934d85
       - name: kind
         value: task
       resolver: bundles
@@ -289,7 +253,7 @@ spec:
       - name: name
         value: git-clone-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
       - name: kind
         value: task
       resolver: bundles
@@ -308,7 +272,7 @@ spec:
       - name: name
         value: determine-image-expiration
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -324,7 +288,7 @@ spec:
       - name: name
         value: determine-image-tag
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -348,7 +312,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.9.0@sha256:4486aaa69770d6b27c59c8df7d82e450d95dab2302aef9b8a345f2ac0fabbab0
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.3@sha256:0c386f2c26b46b978280c5c54caac26bcd524975f8f7cc06bb080ba00eae3ad4
       - name: kind
         value: task
       resolver: bundles
@@ -365,7 +329,7 @@ spec:
       - name: name
         value: wait-for-image
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -380,38 +344,6 @@ spec:
     # This timeout must be the same as the pipeline timeout in `main-build.yaml`.
     timeout: 2h40m
 
-  - name: wait-for-scanner-image
-    params:
-    - name: IMAGE
-      value: "$(params.scanner-image-build-repo):$(tasks.determine-image-tag.results.IMAGE_TAG)"
-    taskRef: *wait-for-image-ref
-    # This timeout must be the same as the pipeline timeout in `scanner-retag.yaml`
-    timeout: 40m
-
-  - name: wait-for-scanner-db-image
-    params:
-    - name: IMAGE
-      value: "$(params.scanner-db-image-build-repo):$(tasks.determine-image-tag.results.IMAGE_TAG)"
-    taskRef: *wait-for-image-ref
-    # This timeout must be the same as the pipeline timeout in `scanner-db-retag.yaml`
-    timeout: 40m
-
-  - name: wait-for-scanner-slim-image
-    params:
-    - name: IMAGE
-      value: "$(params.scanner-slim-image-build-repo):$(tasks.determine-image-tag.results.IMAGE_TAG)"
-    taskRef: *wait-for-image-ref
-    # This timeout must be the same as the pipeline timeout in `scanner-slim-retag.yaml`
-    timeout: 40m
-
-  - name: wait-for-scanner-db-slim-image
-    params:
-    - name: IMAGE
-      value: "$(params.scanner-db-slim-image-build-repo):$(tasks.determine-image-tag.results.IMAGE_TAG)"
-    taskRef: *wait-for-image-ref
-    # This timeout must be the same as the pipeline timeout in `scanner-db-slim-retag.yaml`
-    timeout: 40m
-
   - name: wait-for-scanner-v4-image
     params:
     - name: IMAGE
@@ -482,10 +414,6 @@ spec:
       - OPERATOR_IMAGE_TAG=$(tasks.determine-image-tag.results.IMAGE_TAG)
       - OPERATOR_IMAGE_REF=$(params.operator-image-catalog-repo)@$(tasks.wait-for-operator-image.results.IMAGE_DIGEST)
       - RELATED_IMAGE_MAIN=$(params.main-image-catalog-repo)@$(tasks.wait-for-main-image.results.IMAGE_DIGEST)
-      - RELATED_IMAGE_SCANNER=$(params.scanner-image-catalog-repo)@$(tasks.wait-for-scanner-image.results.IMAGE_DIGEST)
-      - RELATED_IMAGE_SCANNER_DB=$(params.scanner-db-image-catalog-repo)@$(tasks.wait-for-scanner-db-image.results.IMAGE_DIGEST)
-      - RELATED_IMAGE_SCANNER_SLIM=$(params.scanner-slim-image-catalog-repo)@$(tasks.wait-for-scanner-slim-image.results.IMAGE_DIGEST)
-      - RELATED_IMAGE_SCANNER_DB_SLIM=$(params.scanner-db-slim-image-catalog-repo)@$(tasks.wait-for-scanner-db-slim-image.results.IMAGE_DIGEST)
       - RELATED_IMAGE_SCANNER_V4=$(params.scanner-v4-image-catalog-repo)@$(tasks.wait-for-scanner-v4-image.results.IMAGE_DIGEST)
       - RELATED_IMAGE_SCANNER_V4_DB=$(params.scanner-v4-db-image-catalog-repo)@$(tasks.wait-for-scanner-v4-db-image.results.IMAGE_DIGEST)
       - RELATED_IMAGE_COLLECTOR=$(params.collector-image-catalog-repo)@$(tasks.wait-for-collector-image.results.IMAGE_DIGEST)
@@ -517,7 +445,7 @@ spec:
       - name: name
         value: buildah-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.12.0@sha256:de5580c99ca52588f9b8cec452023bc7e3de470a594c99243320752d250bb2a2
+        value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.12.2@sha256:e1bbe61a3a4bc543be9b5f6fc4174acaa2dd08fb5f7fe4d9db9f3193a7e1b03c
       - name: kind
         value: task
       resolver: bundles
@@ -536,7 +464,7 @@ spec:
       - name: name
         value: apply-tags
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:f89a59d4d043fd3c545a9cb5e89b53396f1e04017c6f68da1e50626715c2d423
+        value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3.1@sha256:c177fc2b2482b1299e713c51bf258eba4972c016ef260d9f45335c2550dc7b2b
       - name: kind
         value: task
       resolver: bundles
@@ -556,7 +484,7 @@ spec:
       - name: name
         value: source-build-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:c7ecd1e518007e31e19188333a17dd3558e222ce2e3b2a484a1e59ec069799cf
+        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3.2@sha256:45091b5022754d452b4de60c7d7f4c6e03626efff55f96e9af937400fe3506eb
       - name: kind
         value: task
       resolver: bundles
@@ -585,6 +513,26 @@ spec:
       operator: in
       values: ["false"]
 
+  - name: roxctl-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-container.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-container.results.IMAGE_URL)
+    taskRef:
+      params:
+      - name: name
+        value: roxctl-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1@sha256:97e2b2cdca9110fdc8a93ba585a1a1a743f989f2fd85f4073f6e5ea9ad2ce828
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values: ["false"]
+
   - name: clair-scan
     params:
     - name: image-digest
@@ -596,7 +544,7 @@ spec:
       - name: name
         value: clair-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
+        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.1@sha256:219964897ac4d5a9473ec297a1b39ae078a34b76b45d04c4672bd569cc295c29
       - name: kind
         value: task
       resolver: bundles
@@ -644,7 +592,7 @@ spec:
       - name: name
         value: sast-shell-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d00c884c78489a52dc638e6ced0a01429670d0754f5b1305ad576709cf660312
       - name: kind
         value: task
       resolver: bundles
@@ -670,7 +618,7 @@ spec:
       - name: name
         value: sast-unicode-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:15d654c9576b9c4ee1f78b09fce541acf9afe33f1c2363fd6219a79dbf62c95d
       - name: kind
         value: task
       resolver: bundles
@@ -696,7 +644,7 @@ spec:
       - name: name
         value: sast-snyk-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:17b9587eba53fabaab35061275306bfe1f99661d55e14e22f62321fa7cb5ff3e
       - name: kind
         value: task
       resolver: bundles
@@ -716,7 +664,7 @@ spec:
       - name: name
         value: clamav-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
+        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.3@sha256:9df272d2180bd67e6a3e04d5cd30ffa7ba27af4e599a1922f7069f5c89888e5b
       - name: kind
         value: task
       resolver: bundles
@@ -736,7 +684,7 @@ spec:
       - name: name
         value: rpms-signature-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.2@sha256:d9df5d325f81a9fa132cb597c465aa9210b9b0fa3716b85b32be98d92c9c881a
       - name: kind
         value: task
       resolver: bundles
@@ -762,7 +710,7 @@ spec:
       - name: name
         value: push-dockerfile-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:ee041e2bdf5638faaca60baa171c3e13927097a0e69ed2172ccf1de5e5ee711a
+        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:4c567d11296850230fe32e76d129834d3bf337a0cae9989b64279b7cfaa4e735
       - name: kind
         value: task
       resolver: bundles
diff --git a/.tekton/operator-index-build.yaml b/.tekton/operator-index-build.yaml
index 05d8643c56d99..3d4a96d8d9a0b 100644
--- a/.tekton/operator-index-build.yaml
+++ b/.tekton/operator-index-build.yaml
@@ -98,7 +98,7 @@ spec:
         - name: name
           value: post-bigquery-metrics
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -195,7 +195,7 @@ spec:
         - name: name
           value: git-clone-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
         - name: kind
           value: task
         resolver: bundles
@@ -214,7 +214,7 @@ spec:
         - name: name
           value: determine-image-expiration
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -230,7 +230,7 @@ spec:
         - name: name
           value: determine-image-tag
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -249,7 +249,7 @@ spec:
           description: Full operator-index image tag with v prefix and -fast suffix to avoid collision with GHA builds
         steps:
         - name: compute-index-tag
-          image: registry.access.redhat.com/ubi9-minimal:latest@sha256:7c372902c8d211db2d25c8277ba534a73b92742a334874dced829a63b0f21221
+          image: registry.access.redhat.com/ubi9-minimal:latest@sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661
           imagePullPolicy: IfNotPresent
           script: |
             #!/bin/bash
@@ -276,7 +276,7 @@ spec:
         - name: name
           value: wait-for-image
         - name: bundle
-          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+          value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
         - name: kind
           value: task
         resolver: bundles
@@ -334,7 +334,7 @@ spec:
           - use
           - $(params.SOURCE_ARTIFACT)=/var/workdir/source
         - name: build-index-content
-          image: registry.access.redhat.com/ubi9/go-toolset:9.8-1786522985@sha256:444e81b3e88d8a68b92a081a7b3abc7d3fed2450f8473ea6b3caebf3bb73a0b8
+          image: registry.access.redhat.com/ubi9/go-toolset:9.8-1792010711@sha256:60fd6fb2998c40ad0d6561c34e83588b986a0cf7771f64e5e5c295ba87101f9b
           imagePullPolicy: IfNotPresent
           workingDir: /var/workdir/source/operator
           securityContext:
@@ -414,7 +414,7 @@ spec:
         - name: name
           value: buildah-remote-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:227cf5b487cd2221301ea2fccf2334f41c0f5b21edb04696609245520b2d2691
+          value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.2@sha256:a68dce8ed79be8d9e10d98bd2b56895c27fc34f1ed7d67cbc9ec0a91d64cf641
         - name: kind
           value: task
         resolver: bundles
@@ -433,7 +433,7 @@ spec:
         - name: name
           value: build-image-index
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:714a86d454203804fe14e422b4ba8d775d9ec19e5b7922cedd55ef93a3bc9166
+          value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.4@sha256:654446d8ec028b20ed6ada8a96486ff16692a25192755aa04a99cea8e0afb7e2
         - name: kind
           value: task
         resolver: bundles
diff --git a/.tekton/retag-pipeline.yaml b/.tekton/retag-pipeline.yaml
index bc0d6222e788e..023b634a93706 100644
--- a/.tekton/retag-pipeline.yaml
+++ b/.tekton/retag-pipeline.yaml
@@ -35,7 +35,7 @@ spec:
       - name: name
         value: post-bigquery-metrics
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -117,7 +117,7 @@ spec:
       - name: name
         value: git-clone-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
       - name: kind
         value: task
       resolver: bundles
@@ -136,7 +136,7 @@ spec:
       - name: name
         value: determine-image-tag
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -154,7 +154,7 @@ spec:
       - name: name
         value: determine-dependency-image-tag
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -170,7 +170,7 @@ spec:
       - name: name
         value: wait-for-image
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -195,7 +195,7 @@ spec:
       - name: name
         value: retag-image
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
diff --git a/.tekton/retag-scanner-db-slim.yaml b/.tekton/retag-scanner-db-slim.yaml
deleted file mode 100644
index b9554d16be051..0000000000000
--- a/.tekton/retag-scanner-db-slim.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox?rev={{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/max-keep-runs: "500"
-    pipelinesascode.tekton.dev/on-comment: "/konflux-retest retag-scanner-db-slim"
-    # TODO(ROX-21073): re-enable for all PR branches
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        event == "push" && target_branch.matches("^(master|release-.*|refs/tags/.*)$")
-      ) || (
-        event == "pull_request" && (
-          target_branch.startsWith("release-") ||
-          source_branch.matches("(konflux|renovate|appstudio|rhtap)") ||
-          (has(body.pull_request) && has(body.pull_request.labels) && body.pull_request.labels.exists(l, l.name == "konflux-build"))
-        ) && body.action != "ready_for_review"
-      )
-    # The empty `on-label` annotation is a workaround to make sure the pipeline gets triggered when the label gets first
-    # added to the PR. See the Slack tread linked from ROX-30580.
-    pipelinesascode.tekton.dev/on-label: "[]"
-  labels:
-    appstudio.openshift.io/application: acs
-  name: retag-scanner-db-slim
-  namespace: rh-acs-tenant
-
-spec:
-
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: input-image-repo
-    value: quay.io/rhacs-eng/release-scanner-db-slim
-  - name: input-image-tag-makefile-target
-    value: scanner-tag
-  - name: output-image-repo
-    value: quay.io/rhacs-eng/release-scanner-db-slim
-
-  pipelineRef:
-    name: retag-pipeline
-
-  taskRunTemplate:
-    serviceAccountName: build-pipeline-scanner-db-slim
-
-  timeouts:
-    tasks: 30m
-    # Reserve time for final tasks to run.
-    finally: 10m
-    pipeline: 40m
-
-  workspaces:
-  - name: git-auth
-    secret:
-      secretName: '{{ git_auth_secret }}'
diff --git a/.tekton/retag-scanner-db.yaml b/.tekton/retag-scanner-db.yaml
deleted file mode 100644
index 36865cf08e4b4..0000000000000
--- a/.tekton/retag-scanner-db.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox?rev={{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/max-keep-runs: "500"
-    pipelinesascode.tekton.dev/on-comment: "/konflux-retest retag-scanner-db"
-    # TODO(ROX-21073): re-enable for all PR branches
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        event == "push" && target_branch.matches("^(master|release-.*|refs/tags/.*)$")
-      ) || (
-        event == "pull_request" && (
-          target_branch.startsWith("release-") ||
-          source_branch.matches("(konflux|renovate|appstudio|rhtap)") ||
-          (has(body.pull_request) && has(body.pull_request.labels) && body.pull_request.labels.exists(l, l.name == "konflux-build"))
-        ) && body.action != "ready_for_review"
-      )
-    # The empty `on-label` annotation is a workaround to make sure the pipeline gets triggered when the label gets first
-    # added to the PR. See the Slack tread linked from ROX-30580.
-    pipelinesascode.tekton.dev/on-label: "[]"
-  labels:
-    appstudio.openshift.io/application: acs
-  name: retag-scanner-db
-  namespace: rh-acs-tenant
-
-spec:
-
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: input-image-repo
-    value: quay.io/rhacs-eng/release-scanner-db
-  - name: input-image-tag-makefile-target
-    value: scanner-tag
-  - name: output-image-repo
-    value: quay.io/rhacs-eng/release-scanner-db
-
-  pipelineRef:
-    name: retag-pipeline
-
-  taskRunTemplate:
-    serviceAccountName: build-pipeline-scanner-db
-
-  timeouts:
-    tasks: 30m
-    # Reserve time for final tasks to run.
-    finally: 10m
-    pipeline: 40m
-
-  workspaces:
-  - name: git-auth
-    secret:
-      secretName: '{{ git_auth_secret }}'
diff --git a/.tekton/retag-scanner-slim.yaml b/.tekton/retag-scanner-slim.yaml
deleted file mode 100644
index dcac863485fa7..0000000000000
--- a/.tekton/retag-scanner-slim.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox?rev={{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/max-keep-runs: "500"
-    pipelinesascode.tekton.dev/on-comment: "/konflux-retest retag-scanner-slim"
-    # TODO(ROX-21073): re-enable for all PR branches
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        event == "push" && target_branch.matches("^(master|release-.*|refs/tags/.*)$")
-      ) || (
-        event == "pull_request" && (
-          target_branch.startsWith("release-") ||
-          source_branch.matches("(konflux|renovate|appstudio|rhtap)") ||
-          (has(body.pull_request) && has(body.pull_request.labels) && body.pull_request.labels.exists(l, l.name == "konflux-build"))
-        ) && body.action != "ready_for_review"
-      )
-    # The empty `on-label` annotation is a workaround to make sure the pipeline gets triggered when the label gets first
-    # added to the PR. See the Slack tread linked from ROX-30580.
-    pipelinesascode.tekton.dev/on-label: "[]"
-  labels:
-    appstudio.openshift.io/application: acs
-  name: retag-scanner-slim
-  namespace: rh-acs-tenant
-
-spec:
-
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: input-image-repo
-    value: quay.io/rhacs-eng/release-scanner-slim
-  - name: input-image-tag-makefile-target
-    value: scanner-tag
-  - name: output-image-repo
-    value: quay.io/rhacs-eng/release-scanner-slim
-
-  pipelineRef:
-    name: retag-pipeline
-
-  taskRunTemplate:
-    serviceAccountName: build-pipeline-scanner-slim
-
-  timeouts:
-    tasks: 30m
-    # Reserve time for final tasks to run.
-    finally: 10m
-    pipeline: 40m
-
-  workspaces:
-  - name: git-auth
-    secret:
-      secretName: '{{ git_auth_secret }}'
diff --git a/.tekton/retag-scanner.yaml b/.tekton/retag-scanner.yaml
deleted file mode 100644
index 8875548f55572..0000000000000
--- a/.tekton/retag-scanner.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox?rev={{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/max-keep-runs: "500"
-    pipelinesascode.tekton.dev/on-comment: "/konflux-retest retag-scanner"
-    # TODO(ROX-21073): re-enable for all PR branches
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        event == "push" && target_branch.matches("^(master|release-.*|refs/tags/.*)$")
-      ) || (
-        event == "pull_request" && (
-          target_branch.startsWith("release-") ||
-          source_branch.matches("(konflux|renovate|appstudio|rhtap)") ||
-          (has(body.pull_request) && has(body.pull_request.labels) && body.pull_request.labels.exists(l, l.name == "konflux-build"))
-        ) && body.action != "ready_for_review"
-      )
-    # The empty `on-label` annotation is a workaround to make sure the pipeline gets triggered when the label gets first
-    # added to the PR. See the Slack tread linked from ROX-30580.
-    pipelinesascode.tekton.dev/on-label: "[]"
-  labels:
-    appstudio.openshift.io/application: acs
-  name: retag-scanner
-  namespace: rh-acs-tenant
-
-spec:
-
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: input-image-repo
-    value: quay.io/rhacs-eng/release-scanner
-  - name: input-image-tag-makefile-target
-    value: scanner-tag
-  - name: output-image-repo
-    value: quay.io/rhacs-eng/release-scanner
-
-  pipelineRef:
-    name: retag-pipeline
-
-  taskRunTemplate:
-    serviceAccountName: build-pipeline-scanner
-
-  timeouts:
-    tasks: 30m
-    # Reserve time for final tasks to run.
-    finally: 10m
-    pipeline: 40m
-
-  workspaces:
-  - name: git-auth
-    secret:
-      secretName: '{{ git_auth_secret }}'
diff --git a/.tekton/scanner-v4-pipeline.yaml b/.tekton/scanner-v4-pipeline.yaml
index d72064834c14e..05368bff8ca56 100644
--- a/.tekton/scanner-v4-pipeline.yaml
+++ b/.tekton/scanner-v4-pipeline.yaml
@@ -35,7 +35,7 @@ spec:
       - name: name
         value: post-bigquery-metrics
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -168,7 +168,7 @@ spec:
       - name: name
         value: init
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:4dbbfedc4edb21884fa2ad84521408d2fad090d4d34eb6c555992f8444eba40d
+        value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:7854d7babe4136e53e337f6433d952532314433b48bb62b422ddc02700934d85
       - name: kind
         value: task
       resolver: bundles
@@ -192,7 +192,7 @@ spec:
       - name: name
         value: git-clone-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:5e56115ccb92a1ac49432eef7255929839d02dd43f0e2d6f9557b561e7251a25
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
       - name: kind
         value: task
       resolver: bundles
@@ -211,7 +211,7 @@ spec:
       - name: name
         value: determine-image-expiration
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -227,7 +227,7 @@ spec:
       - name: name
         value: determine-image-tag
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -247,7 +247,7 @@ spec:
       - name: name
         value: fetch-scanner-v4-vuln-mappings
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:2d425bf6d8d292d31e641fa71a23a866d329f4339ba57bf84dd55dc55c4b1b67
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510
       - name: kind
         value: task
       resolver: bundles
@@ -271,7 +271,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.9.0@sha256:4486aaa69770d6b27c59c8df7d82e450d95dab2302aef9b8a345f2ac0fabbab0
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.3@sha256:0c386f2c26b46b978280c5c54caac26bcd524975f8f7cc06bb080ba00eae3ad4
       - name: kind
         value: task
       resolver: bundles
@@ -330,7 +330,7 @@ spec:
       - name: name
         value: buildah-remote-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:227cf5b487cd2221301ea2fccf2334f41c0f5b21edb04696609245520b2d2691
+        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.2@sha256:a68dce8ed79be8d9e10d98bd2b56895c27fc34f1ed7d67cbc9ec0a91d64cf641
       - name: kind
         value: task
       resolver: bundles
@@ -349,7 +349,7 @@ spec:
       - name: name
         value: build-image-index
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:714a86d454203804fe14e422b4ba8d775d9ec19e5b7922cedd55ef93a3bc9166
+        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.4@sha256:654446d8ec028b20ed6ada8a96486ff16692a25192755aa04a99cea8e0afb7e2
       - name: kind
         value: task
       resolver: bundles
@@ -370,7 +370,7 @@ spec:
       - name: name
         value: source-build-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:c7ecd1e518007e31e19188333a17dd3558e222ce2e3b2a484a1e59ec069799cf
+        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3.2@sha256:45091b5022754d452b4de60c7d7f4c6e03626efff55f96e9af937400fe3506eb
       - name: kind
         value: task
       resolver: bundles
@@ -399,12 +399,27 @@ spec:
       operator: in
       values: ["false"]
 
-  - name: clair-scan
-    matrix:
+  - name: roxctl-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    taskRef:
       params:
-      - name: image-platform
-        value:
-        - $(params.build-platforms)
+      - name: name
+        value: roxctl-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1@sha256:97e2b2cdca9110fdc8a93ba585a1a1a743f989f2fd85f4073f6e5ea9ad2ce828
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values: ["false"]
+
+  - name: clair-scan
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
@@ -415,7 +430,7 @@ spec:
       - name: name
         value: clair-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
+        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.1@sha256:219964897ac4d5a9473ec297a1b39ae078a34b76b45d04c4672bd569cc295c29
       - name: kind
         value: task
       resolver: bundles
@@ -438,7 +453,7 @@ spec:
       - name: name
         value: ecosystem-cert-preflight-checks
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7
+        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:fa53ef450ba538addafee1211ff6ac15b55865ce652fec15ac99b554680cb642
       - name: kind
         value: task
       resolver: bundles
@@ -464,7 +479,7 @@ spec:
       - name: name
         value: sast-shell-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d00c884c78489a52dc638e6ced0a01429670d0754f5b1305ad576709cf660312
       - name: kind
         value: task
       resolver: bundles
@@ -490,7 +505,7 @@ spec:
       - name: name
         value: sast-unicode-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:15d654c9576b9c4ee1f78b09fce541acf9afe33f1c2363fd6219a79dbf62c95d
       - name: kind
         value: task
       resolver: bundles
@@ -516,7 +531,7 @@ spec:
       - name: name
         value: sast-snyk-check-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:17b9587eba53fabaab35061275306bfe1f99661d55e14e22f62321fa7cb5ff3e
       - name: kind
         value: task
       resolver: bundles
@@ -541,7 +556,7 @@ spec:
       - name: name
         value: clamav-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
+        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.3@sha256:9df272d2180bd67e6a3e04d5cd30ffa7ba27af4e599a1922f7069f5c89888e5b
       - name: kind
         value: task
       resolver: bundles
@@ -561,7 +576,7 @@ spec:
       - name: name
         value: rpms-signature-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.2@sha256:d9df5d325f81a9fa132cb597c465aa9210b9b0fa3716b85b32be98d92c9c881a
       - name: kind
         value: task
       resolver: bundles
@@ -587,7 +602,7 @@ spec:
       - name: name
         value: push-dockerfile-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:ee041e2bdf5638faaca60baa171c3e13927097a0e69ed2172ccf1de5e5ee711a
+        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:4c567d11296850230fe32e76d129834d3bf337a0cae9989b64279b7cfaa4e735
       - name: kind
         value: task
       resolver: bundles
diff --git a/AGENTS.md b/AGENTS.md
index b3d59803da998..52856e8ddb89a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -147,6 +147,11 @@ StackRox is a Kubernetes-native security platform with a distributed microservic
 - **Secured Cluster Services**: Deployed per monitored cluster (Sensor, Admission Controller)
 - **Multi-cluster support**: One Central instance monitors multiple Kubernetes clusters
 
+### CI Image (Prow / OpenShift CI)
+- The CI image is built from the **[stackrox/rox-ci-image](https://github.com/stackrox/rox-ci-image)** repo, not this repo.
+- Tool versions bundled in the CI image (e.g. roxie, helm, docker) are pinned in Dockerfiles in that repo.
+- `.openshift-ci/Dockerfile.build_root` in this repo only references the resulting image for validation purposes.
+
 ### Key Directories
 - `/central/` - Central management service code
 - `/sensor/` - Sensor agent code for cluster monitoring
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f60c0cc0a46e..ec4b4f4196c90 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,27 +14,66 @@ Changes should still be described appropriately in JIRA/doc input pages, for inc
 
 ### Added Features
 
+### Removed Features
+
+- ROX-35079: The `app.k8s.io/v1beta1/Application` CR is no longer shipped.
+
+### Deprecated Features
+
+### Technical Changes
+- ROX-36534: roxctl binaries in the Central image are now stored as `.tar.gz` archives. Central extracts and streams the binary on download, so the user-facing download behavior is unchanged.
+- ROX-35137: Central now prunes deployments whose cluster no longer exists in the database.
+- ROX-37048: Central writes its version in `Rh-Central-Version` gRPC response header to authenticated clients. `roxctl` compares this version with its own version and reports a warning to stderr if the version skew is outside of a supported range.
+- ROX-37315: Image exclusions no longer turn off deploy-time checks. Previously, an image exclusion on a policy with Build and Deploy stages stopped that policy from raising deploy-time violations or blocking any deployment. Image exclusions now apply only at Build, so after upgrading, affected policies raise deploy-time violations again and block deployments if enforcement is on. To skip apps at deploy time, use deployment exclusions.
+- ROX-37265: Feature flag `ROX_SCANNER_V4_RED_HAT_LAYERS_RED_HAT_VULNS_ONLY` will now correctly filter non Red Hat vulnerabilities from RH image layers in newer Konflux built images where it previously had no affect. The flag must now be set on Central INSTEAD of Scanner V4 Matcher.
+- ROX-37385: Scanner V4 node scans now record the operating system (for example `rhcos:9.6`) for OpenShift 4.19 and later nodes. RHCOS switched to RHEL-based dotted versions such as `9.6.20250701-0` in OpenShift 4.19, and Central previously stored an empty operating system for these nodes.
+
+- ROX-37149: `roxctl` now honors the `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` environment variables when connecting to Central over HTTP, so it works where direct egress to Central is blocked but a proxy is available.
+
+## [5.0.0]
+
+
+
+### Added Features
+
+- ROX-32148: Virtual machine scanning is now enabled by default. RHEL VMs created with OpenShift Virtualization can be scanned for package vulnerabilities after installing roxagent in the guest.
 - ROX-34997: The Central CR now supports `spec.central.rolloutStrategy` (`Recreate` or `RollingUpdate`) to configure the central deployment rollout strategy. Default remains `Recreate`.
 - ROX-35181: Administrative events are now exposed as configurable custom Prometheus metrics (`rox_central_admin_event_*`), aggregated by Type, Level, Domain, ResourceType, and ResourceName. Requires permission to read Administration resource, globally scoped.
 - ROX-35545: Added ACL change as a file access operation for runtime policies.
 - ROX-35546: File access policies now detect extended attribute (xattr) changes.
 - ROX-32461: Red Hat OpenShift Data Foundation is now officially supported as an S3-compatible backup target.
 - ROX-35962: On OCP, central API is exposed via a new `central-ocp` service, signed and rotated by OCP.
+- ROX-35508: Scanner V4 now suppresses duplicate OSV.dev vulnerability records when Red Hat VEX data covers the same CVE for a Red Hat product image, showing Red Hat's own severity/CVSS/remediation data instead of a conflicting OSV.dev one. Enabled by default; disable via `ROX_SCANNER_V4_SUPPRESS_OSV_WITH_RED_HAT_VEX=false` if needed.
+- ROX-34488: Added support for cosign signature discovery via OCI 1.1 referrers, including
+  DSSE envelope verification for sigstore bundle-format signatures.
+- ROX-36858: Added more supported labels to the image and node vulnerability central custom metrics.
+- Pruning (garbage collection) and vulnerability report scheduling now run in a separate `central-worker` deployment by default instead of inside Central. Disable with the Helm value `centralWorker.enabled=false` or `spec.centralWorker.enabled: false` in the Central CR.
 
 ### Removed Features
 
+- Compliance container no longer collects Scanner V2 node inventories. Node scanning continues via Scanner V4 index reports, as long as Scanner V4 is enabled.
+- ROX-36654: Removed legacy scanner (StackRox Scanner) across all installation methods.
+
 ### Deprecated Features
 
 - ROX-26281: block creation of new GCR integrations. Users are directed to use Google Artifact Registry instead.
 - ROX-35079: installation of the `app.k8s.io/v1beta1/Application` resource when central is installed is deprecated. It will be removed in a future release.
+- The `priority` field on API responses for deployments, images, nodes, and components is deprecated and will be removed in a future release. Use the `risk_score` field on the same objects instead. Sorting by "Risk Priority" in search queries is also deprecated; sort by "Risk Score" instead. For clusters and namespaces, the `priority` field will be removed and replaced by a `risk_score` field where applicable.
+- ROX-37014: The Images by severity, Nodes by severity, CVEs by severity, and Virtual machines by severity counts—including summary widgets and table columns—are deprecated and will be removed in a future release to improve page performance
 
 ### Technical Changes
+- ROX-36784: Scanner V4 node indexing on OpenShift now reads the host RPM database Claircore reports: SQLite on RHEL 9+ (`/usr/share/rpm`, `/usr/lib/sysimage/rpm`) and Berkeley DB on RHEL 8 (`/usr/share/rpm`, `/usr/lib/sysimage/rpm-ostree-base-db`).
+- ROX-36824: Diagnostic bundles now redact the value of the `openshift.io/token-secret.value` annotation on secrets. Previously this OpenShift-managed annotation, which contains a plaintext service account token on generated dockercfg secrets, was included unredacted in the bundle.
+- ROX-36660: The **Fixable → CVE is not yet fixable** policy criterion now matches Scanner V4 CVEs that have no fix version. Scanner V4 leaves `Fixed By` unset instead of empty (Scanner V2 always set an empty string), so the matcher previously skipped those CVEs.
+- ROX-36490: The virtual machine enhanced data model (`ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL`) is now enabled by default.
 - ROX-32969: The `roxctl-linux` symlink has been removed from the `/assets/downloads/cli/` directory inside the main container image. Only the architecture-specific binaries (`roxctl-linux-amd64`, `roxctl-linux-arm64`, etc.) remain. This change does not affect CLI downloads from the Central UI or any other supported download path.
 - ROX-33078: Fixed telemetry gatherer failing to report database size metrics when using an external database. The database name is now read from the connection config instead of using the hardcoded default.
 - ROX-35006: Go runtime upgraded to 1.26. Unbracketed IPv6 addresses (e.g. `2001:db8::1`) are no longer accepted; use bracketed format instead (e.g. `[2001:db8::1]:443`).
 - ROX-34804: The machine access configuration for `config-controller` now validates the audience (`aud` claim) of the service account token. The expected audience is `central.stackrox.io`. When users have added their own role bindings to this machine access configuration, the audience check is not enforced by default to keep backwards compatibility. It is recommended to set the expected audience to `central.stackrox.io` after ensuring that all exchange tokens are being created with this audience claim.
 
 - ROX-34535: Fixes an issue where if ScannerV2 is disabled or unavailable on initial startup the central deployment leaks GRPC connections until the scanner becomes available.
+- ROX-36509: Improved Central memory efficiency by optimizing process filter data structures in high-cardinality scenarios. The `ROX_PROCESS_FILTER_FAN_OUT_LEVELS` environment variable now accepts values up to 255; higher values are automatically clamped with a warning.
+- ROX-36432: Fixed node scan results (`scan.scanTime`) silently freezing on installs whose default Scanner V4 integration lacked the `NODE_SCANNER` category. Central now restores the default categories on startup. Affected nodes move from Scanner V2 results to Scanner V4 results, so their vulnerability counts may change.
 
 ## [4.11.0]
 
diff --git a/COLLECTOR_VERSION b/COLLECTOR_VERSION
index 98822bb3fc4b5..12a33ce182018 100644
--- a/COLLECTOR_VERSION
+++ b/COLLECTOR_VERSION
@@ -1 +1 @@
-3.25.0-71-gf833aaf49f
+3.25.0-188-g237a0275dc
diff --git a/FACT_VERSION b/FACT_VERSION
index 5f054639b4ac2..3d828935ed6bc 100644
--- a/FACT_VERSION
+++ b/FACT_VERSION
@@ -1 +1 @@
-0.3.x-230-g922750cb27
+0.3.x-340-gcbfa5e1fc2
diff --git a/Makefile b/Makefile
index 9e5daa549c260..54fca4db3901d 100644
--- a/Makefile
+++ b/Makefile
@@ -8,15 +8,28 @@ BENCHTIME ?= 1x
 BENCHTIMEOUT ?= 20m
 BENCHCOUNT ?= 1
 
+CONTAINER_ENGINE ?= docker
+export CONTAINER_ENGINE
+
 podman =
+# If CONTAINER_ENGINE is explicitly set to podman, detect it
+ifeq ($(CONTAINER_ENGINE),podman)
+	podman = yes
 # docker --version might not contain any traces of podman in the latest
 # version, search for more output
-ifneq (,$(findstring podman,$(shell docker --version 2>/dev/null)))
+else ifneq (,$(findstring podman,$(shell $(CONTAINER_ENGINE) --version 2>/dev/null)))
+	podman = yes
+else ifneq (,$(findstring Podman,$(shell $(CONTAINER_ENGINE) version 2>/dev/null)))
 	podman = yes
 endif
-ifneq (,$(findstring Podman,$(shell docker version 2>/dev/null)))
+# if docker is not available and podman is installed, use podman instead
+ifeq (,$(shell command -v docker 2>/dev/null))
+ifneq (,$(shell command -v podman 2>/dev/null))
 	podman = yes
+	CONTAINER_ENGINE=podman
 endif
+endif
+
 
 ifdef podman
 # Disable selinux for local podman builds.
@@ -125,7 +138,7 @@ $(call go-tool, MOCKGEN_BIN, go.uber.org/mock/mockgen)
 $(call go-tool, GO_JUNIT_REPORT_BIN, github.com/jstemmer/go-junit-report/v2, tools/test)
 $(call go-tool, PROTOLOCK_BIN, github.com/nilslice/protolock/cmd/protolock, tools/linters)
 $(call go-tool, RATCHET_BIN, github.com/sethvargo/ratchet, tools/linters)
-$(call go-tool, ACTIONLINT_BIN, github.com/rhysd/actionlint/cmd/actionlint, tools/linters)
+$(call go-tool, ACTIONLINT_BIN, actionlint.kjanat.dev/cmd/actionlint, tools/linters)
 $(call go-tool, GOVULNCHECK_BIN, golang.org/x/vuln/cmd/govulncheck, tools/linters)
 $(call go-tool, IMAGE_PREFETCHER_DEPLOY_BIN, github.com/stackrox/image-prefetcher/deploy, tools/test)
 $(call go-tool, PROMETHEUS_METRIC_PARSER_BIN, github.com/stackrox/prometheus-metric-parser, tools/test)
@@ -236,7 +249,7 @@ config-controller-build-nodeps:
 .PHONY: fast-central
 fast-central: deps
 	@echo "+ $@"
-	docker run $(DOCKER_OPTS) -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make fast-central-build
+	$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make fast-central-build
 	$(SILENT)$(BASE_DIR)/scripts/k8s/kill-pod.sh central
 
 # fast is a dev mode options when using local dev
@@ -254,7 +267,7 @@ fast-sensor-kubernetes: sensor-kubernetes-build-dockerized
 .PHONY: fast-migrator
 fast-migrator:
 	@echo "+ $@"
-	docker run $(DOCKER_OPTS) -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make fast-migrator-build
+	$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make fast-migrator-build
 
 .PHONY: fast-migrator-build
 fast-migrator-build: migrator-build-nodeps
@@ -469,8 +482,8 @@ bin/$(HOST_OS)_$(GOARCH)/admission-control: build-prep
 .PHONY: build-volumes
 build-volumes:
 	$(SILENT)mkdir -p $(CURDIR)/linux-gocache
-	$(SILENT)docker volume inspect $(GOPATH_VOLUME_NAME) >/dev/null 2>&1 || docker volume create $(GOPATH_VOLUME_NAME)
-	$(SILENT)docker volume inspect $(GOCACHE_VOLUME_NAME) >/dev/null 2>&1 || docker volume create $(GOCACHE_VOLUME_NAME)
+	$(SILENT)$(CONTAINER_ENGINE) volume inspect $(GOPATH_VOLUME_NAME) >/dev/null 2>&1 || $(CONTAINER_ENGINE) volume create $(GOPATH_VOLUME_NAME)
+	$(SILENT)$(CONTAINER_ENGINE) volume inspect $(GOCACHE_VOLUME_NAME) >/dev/null 2>&1 || $(CONTAINER_ENGINE) volume create $(GOCACHE_VOLUME_NAME)
 
 .PHONY: main-build
 main-build: build-prep main-build-dockerized
@@ -479,12 +492,12 @@ main-build: build-prep main-build-dockerized
 .PHONY: sensor-build-dockerized
 sensor-build-dockerized: build-volumes
 	@echo "+ $@"
-	docker run $(DOCKER_OPTS) --rm -e CI -e BUILD_TAG -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make sensor-build
+	$(CONTAINER_ENGINE) run $(DOCKER_OPTS) --rm -e CI -e BUILD_TAG -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make sensor-build
 
 .PHONY: sensor-kubernetes-build-dockerized
 sensor-kubernetes-build-dockerized: build-volumes
 	@echo "+ $@"
-	docker run $(DOCKER_OPTS) -e CI -e BUILD_TAG -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make sensor-kubernetes-build
+	$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -e CI -e BUILD_TAG -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make sensor-kubernetes-build
 
 .PHONY: sensor-build
 sensor-build:
@@ -498,7 +511,7 @@ sensor-kubernetes-build:
 .PHONY: main-build-dockerized
 main-build-dockerized: build-volumes
 	@echo "+ $@"
-	docker run $(DOCKER_OPTS) -i -e RACE -e CI -e BUILD_TAG -e SHORTCOMMIT -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make main-build-nodeps
+	$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -i -e RACE -e CI -e BUILD_TAG -e SHORTCOMMIT -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make main-build-nodeps
 
 .PHONY: main-build-nodeps
 main-build-nodeps:
@@ -546,6 +559,13 @@ swagger-docs: $(MERGED_API_SWAGGER_SPEC) $(MERGED_API_SWAGGER_SPEC_V2)
 
 UNIT_TEST_PACKAGES ?= ./...
 
+# Root-module test discovery must not pass tests from nested Go modules to the
+# root module's go list. Those modules are tested separately in their own
+# working directories.
+NESTED_GO_MODULE_DIRS := $(shell find . -mindepth 2 -name go.mod -exec dirname {} \; | sed 's@^\./@@')
+NESTED_GO_MODULE_REGEX := $(shell printf '%s\n' $(NESTED_GO_MODULE_DIRS) | paste -sd'|' -)
+NESTED_GO_MODULES_WITH_TESTS := $(shell for dir in $(NESTED_GO_MODULE_DIRS); do git ls-files "$$dir/*_test.go" | grep -q . && echo "$$dir"; done)
+
 .PHONY: test-prep
 test-prep:
 	@echo "+ $@"
@@ -555,8 +575,15 @@ test-prep:
 go-unit-tests: build-prep test-prep
 	set -o pipefail ; \
 	CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test scripts/go-test.sh -timeout 25m -race -cover -coverprofile test-output/coverage.out -v \
-		$(shell git ls-files -- '*_test.go' | sed -e 's@^@./@g' | xargs -n 1 dirname | sort | uniq | xargs go list| grep -v '^github.com/stackrox/rox/tests$$' | grep -Ev $(UNIT_TEST_IGNORE)) \
+		$(shell git ls-files -- '*_test.go' | grep -v -E '^($(NESTED_GO_MODULE_REGEX))(/|$$)' | scripts/go-files-to-packages.sh | grep -Ev $(UNIT_TEST_IGNORE)) \
 		| tee $(GO_TEST_OUTPUT_PATH)
+	# Nested modules have independent coverage profiles, so keep their coverage
+	# out of the root profile while including their verbose output in JUnit.
+	@set -o pipefail; \
+	for module_dir in $(NESTED_GO_MODULES_WITH_TESTS); do \
+		echo "Run tests in $$module_dir"; \
+		(cd "$$module_dir" && go test -buildvcs=false -race -v ./...) 2>&1 | tee -a $(GO_TEST_OUTPUT_PATH); \
+	done
 	# Exercise the logging package for all supported logging levels to make sure that initialization works properly
 	@echo "Run log tests"
 	for encoding in console json; do \
@@ -577,19 +604,19 @@ sensor-pipeline-benchmark: build-prep test-prep
 go-postgres-unit-tests: build-prep test-prep
 	set -o pipefail ; \
 	CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test,sql_integration scripts/go-test.sh -timeout 15m  -race -cover -coverprofile test-output/coverage.out -v \
-		$(shell git grep -rl "//go:build sql_integration" central pkg tools | sed -e 's@^@./@g' | xargs -n 1 dirname | sort | uniq | xargs go list -tags sql_integration | grep -v '^github.com/stackrox/rox/tests$$' | grep -Ev $(UNIT_TEST_IGNORE)) \
+		$(shell git grep -rl "//go:build sql_integration" central pkg tools | scripts/go-files-to-packages.sh -tags sql_integration | grep -Ev $(UNIT_TEST_IGNORE)) \
 		| tee $(GO_TEST_OUTPUT_PATH)
 	@# The -p 1 passed to go test is required to ensure that tests of different packages are not run in parallel, so as to avoid conflicts when interacting with the DB.
 	set -o pipefail ; \
 	CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test,sql_integration scripts/go-test.sh -p 1 -race -cover -coverprofile test-output/migrator-coverage.out -v \
-		$(shell git grep -rl "//go:build sql_integration" migrator | sed -e 's@^@./@g' | xargs -n 1 dirname | sort | uniq | xargs go list -tags sql_integration | grep -v '^github.com/stackrox/rox/tests$$' | grep -Ev $(UNIT_TEST_IGNORE)) \
+		$(shell git grep -rl "//go:build sql_integration" migrator | scripts/go-files-to-packages.sh -tags sql_integration | grep -Ev $(UNIT_TEST_IGNORE)) \
 		| tee -a $(GO_TEST_OUTPUT_PATH)
 
 .PHONY: go-postgres-bench-tests
 go-postgres-bench-tests: build-prep test-prep
 	set -o pipefail ; \
 	CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test,sql_integration scripts/go-test.sh -run=nonthing -bench=. -benchtime=$(BENCHTIME) -benchmem -timeout $(BENCHTIMEOUT) -count $(BENCHCOUNT) -v \
-  $(shell git grep -rl "testing.B" central pkg migrator tools | sed -e 's@^@./@g' | xargs -n 1 dirname | sort | uniq | xargs go list -tags sql_integration | grep -v '^github.com/stackrox/rox/tests$$' | grep -Ev $(UNIT_TEST_IGNORE)) \
+		$(shell git grep -rl "testing.B" central pkg migrator tools | scripts/go-files-to-packages.sh -tags sql_integration | grep -Ev $(UNIT_TEST_IGNORE)) \
 		| tee $(GO_TEST_OUTPUT_PATH)
 
 .PHONY: shell-unit-tests
@@ -597,6 +624,7 @@ shell-unit-tests:
 	@echo "+ $@"
 	$(SILENT)mkdir -p shell-test-output
 	bats --print-output-on-failure --verbose-run --recursive --report-formatter junit --output shell-test-output \
+		scanner/image/db/bats \
 		scripts \
 		tests/e2e/bats
 
@@ -725,7 +753,7 @@ scale-image: scale-build clean-image
 	cp bin/linux_$(GOARCH)/profiler scale/image/rhel/bin/profiler
 	cp bin/linux_$(GOARCH)/chaos scale/image/rhel/bin/chaos
 	chmod +w scale/image/rhel/bin/*
-	docker build \
+	$(CONTAINER_ENGINE) build \
 		-t stackrox/scale:$(TAG) \
 		-t quay.io/rhacs-eng/scale:$(TAG) \
 		-f scale/image/Dockerfile scale
@@ -734,7 +762,7 @@ webhookserver-image: webhookserver-build
 	-mkdir webhookserver/bin
 	cp bin/linux_$(GOARCH)/webhookserver webhookserver/bin/webhookserver
 	chmod +w webhookserver/bin/webhookserver
-	docker build \
+	$(CONTAINER_ENGINE) build \
 		-t stackrox/webhookserver:1.2 \
 		-t quay.io/rhacs-eng/webhookserver:1.2 \
 		-f webhookserver/Dockerfile webhookserver
@@ -743,7 +771,7 @@ syslog-image: syslog-build
 	-mkdir qa-tests-backend/test-images/syslog/bin
 	cp bin/linux_$(GOARCH)/syslog qa-tests-backend/test-images/syslog/bin/syslog
 	chmod +w qa-tests-backend/test-images/syslog/bin/syslog
-	docker build \
+	$(DOCKERBUILD) \
 		-t stackrox/qa:syslog_server_1_0 \
 		-t quay.io/rhacs-eng/qa:syslog_server_1_0 \
 		-f qa-tests-backend/test-images/syslog/Dockerfile qa-tests-backend/test-images/syslog
@@ -844,14 +872,6 @@ roxvet: $(ROXVET_BIN)
 ##########
 ## Misc ##
 ##########
-.PHONY: clean-offline-bundle
-clean-offline-bundle:
-	$(SILENT)find scripts/offline-bundle -name '*.img' -delete -o -name '*.tgz' -delete -o -name 'bin' -type d -exec rm -r "{}" \;
-
-.PHONY: offline-bundle
-offline-bundle: clean-offline-bundle
-	$(SILENT)./scripts/offline-bundle/create.sh
-
 .PHONY: check-debugger
 check-debugger:
 	/usr/bin/env DEBUG_BUILD="$(DEBUG_BUILD)" BUILD_TAG="$(BUILD_TAG)" TAG="$(TAG)" ./scripts/check-debugger.sh
diff --git a/ROXIE_VERSION b/ROXIE_VERSION
index 2b7c5ae01848a..1f77169993b92 100644
--- a/ROXIE_VERSION
+++ b/ROXIE_VERSION
@@ -1 +1 @@
-0.4.2
+0.4.13
diff --git a/SCANNER_VERSION b/SCANNER_VERSION
index 272f66ef394cb..a8877242d134b 100644
--- a/SCANNER_VERSION
+++ b/SCANNER_VERSION
@@ -1 +1 @@
-2.40.x-76-g092f797e8e
+2.40.x-150-g4a18014bc5
diff --git a/SECURITY.md b/SECURITY.md
index 5e0a211857a53..37a22a5f32203 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -71,10 +71,9 @@ We follow established industry best practices for secure development incl. but n
 
 # EU Cyber Resilience Act — Open Source Steward Statement
 
-This project is stewarded by **Red Hat, Inc.**, an open source software steward
-as defined in Article 3(14) of the
-[EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng).
-Contact: cra-steward@redhat.com
+This project is stewarded by **Red Hat, Inc.**, an open source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng).
+Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com)
 
-Refer to [Red Hat's security practices and vulnerability management policy](https://access.redhat.com/security/)
-for detailed information.
+For guidance on reporting actively exploited vulnerabilities and severe incidents under the CRA, see [Reporting Actively Exploited Vulnerabilities and Severe Incidents](https://github.com/RedHatProductSecurity/CRA/blob/main/Guidelines/eu-cra-incident-and-vulnerability-reporting-guidelines.md).
+
+Refer to [Red Hat's security practices and vulnerability management policy](https://access.redhat.com/security/) for detailed information.
diff --git a/central/auth/openshift/metrics_auth.go b/central/auth/openshift/metrics_auth.go
new file mode 100644
index 0000000000000..98dc0928c3830
--- /dev/null
+++ b/central/auth/openshift/metrics_auth.go
@@ -0,0 +1,237 @@
+package openshift
+
+import (
+	"context"
+
+	groupDataStore "github.com/stackrox/rox/central/group/datastore"
+	rolePkg "github.com/stackrox/rox/central/role"
+	roleDataStore "github.com/stackrox/rox/central/role/datastore"
+	"github.com/stackrox/rox/central/tlsconfig"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/auth/authproviders"
+	"github.com/stackrox/rox/pkg/auth/authproviders/userpki"
+	permissionsUtils "github.com/stackrox/rox/pkg/auth/permissions/utils"
+	"github.com/stackrox/rox/pkg/declarativeconfig"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/k8scfgwatch"
+	"github.com/stackrox/rox/pkg/k8sutil"
+	"github.com/stackrox/rox/pkg/logging"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+const (
+	authProviderID  = "b3070020-ecc3-4f34-a3f6-ad28ffc9b80f"
+	permissionSetID = "b3070020-ecc3-4f34-a3f6-ad28ffc9b80e"
+
+	// Auth provider is hidden from the login screen but visible in Access Control.
+	// It trusts the Kubernetes client CA from extension-apiserver-authentication,
+	// which signs Prometheus client certs. This adds the CA to userTrustRoots on the
+	// public :8443 endpoint (optional client cert verification).
+	authProviderName  = "OpenShift Platform Client Certificates"
+	roleName          = "OpenShift Prometheus Metrics Reader"
+	permissionSetName = "OpenShift Prometheus Metrics Reader"
+)
+
+var log = logging.LoggerForModule()
+
+// SeedMetricsAuthProvider ensures that the userpki auth provider, permission set, role,
+// and group mapping required for OpenShift Prometheus to scrape /metrics exist.
+//
+// The auth provider uses the Kubernetes client CA from the
+// extension-apiserver-authentication ConfigMap (same CA that signs Prometheus client
+// certs). A ConfigMap watcher keeps the CA current across rotations.
+//
+// The permission set and role use IMPERATIVE origin. The auth provider and group
+// use DEFAULT origin so they cannot be modified through the user-facing APIs.
+func SeedMetricsAuthProvider(ctx context.Context, registry authproviders.Registry, roleDS roleDataStore.DataStore, groupDS groupDataStore.DataStore) {
+	if !tlsconfig.OpenShiftTLSConfigured() {
+		return
+	}
+
+	clientset, err := newK8sClient()
+	if err != nil {
+		log.Warnf("Cannot create Kubernetes client for OpenShift metrics auth: %v", err)
+		return
+	}
+
+	onCA := func(caPEM string) {
+		ensurePermissionSet(ctx, roleDS)
+		ensureRole(ctx, roleDS)
+		ensureAuthProvider(ctx, registry, caPEM)
+		ensureGroup(ctx, groupDS)
+	}
+
+	if caPEM := readClientCA(ctx, clientset); caPEM != "" {
+		onCA(caPEM)
+	}
+
+	watchClientCA(ctx, clientset, onCA)
+}
+
+func newK8sClient() (kubernetes.Interface, error) {
+	config, err := k8sutil.GetK8sInClusterConfig()
+	if err != nil {
+		return nil, err
+	}
+	return kubernetes.NewForConfig(config)
+}
+
+func readClientCA(ctx context.Context, clientset kubernetes.Interface) string {
+	cm, err := clientset.CoreV1().ConfigMaps(
+		env.SecureMetricsClientCANamespace.Setting(),
+	).Get(ctx, env.SecureMetricsClientCAConfigMap.Setting(), metav1.GetOptions{})
+	if err != nil {
+		log.Warnf("Cannot read client CA ConfigMap %s/%s: %v",
+			env.SecureMetricsClientCANamespace.Setting(),
+			env.SecureMetricsClientCAConfigMap.Setting(), err)
+		return ""
+	}
+	pem, ok := cm.Data[env.SecureMetricsClientCAKey.Setting()]
+	if !ok || pem == "" {
+		log.Warnf("Client CA key %q not found in ConfigMap %s/%s",
+			env.SecureMetricsClientCAKey.Setting(),
+			env.SecureMetricsClientCANamespace.Setting(),
+			env.SecureMetricsClientCAConfigMap.Setting())
+		return ""
+	}
+	return pem
+}
+
+func watchClientCA(ctx context.Context, clientset kubernetes.Interface, onCA func(string)) {
+	watcher := k8scfgwatch.NewConfigMapWatcher(clientset, func(cm *v1.ConfigMap) {
+		if cm == nil {
+			return
+		}
+		pem, ok := cm.Data[env.SecureMetricsClientCAKey.Setting()]
+		if !ok || pem == "" {
+			return
+		}
+		onCA(pem)
+	})
+	watcher.Watch(
+		ctx,
+		env.SecureMetricsClientCANamespace.Setting(),
+		env.SecureMetricsClientCAConfigMap.Setting(),
+	)
+}
+
+func refreshCA(ctx context.Context, registry authproviders.Registry, provider authproviders.Provider, caPEM string) {
+	config := provider.StorageView().GetConfig()
+	if config[userpki.ConfigKeys] == caPEM {
+		return
+	}
+	log.Info("Client CA changed, updating OpenShift metrics auth provider")
+	config[userpki.ConfigKeys] = caPEM
+
+	factory := provider.BackendFactory()
+	if factory == nil {
+		log.Warn("Auth provider has no backend factory, cannot apply the new client CA")
+		return
+	}
+	// WithConfig on its own only rewrites the stored config. The provider keeps its
+	// existing backend, which parsed the certificates once at construction time, and the
+	// registry then re-registers those same stale certificates with the client CA
+	// manager. Central would keep advertising the superseded CA until restart, so the
+	// backend has to be rebuilt from the new config as part of the same update.
+	if _, err := registry.UpdateProvider(declarativeconfig.WithModifyDefaultResource(ctx), authProviderID,
+		authproviders.WithConfig(config),
+		authproviders.WithBackendFromFactory(ctx, factory),
+	); err != nil {
+		log.Warnf("Failed to update client CA in auth provider: %v", err)
+	}
+}
+
+func ensurePermissionSet(ctx context.Context, roleDS roleDataStore.DataStore) {
+	if _, exists, err := roleDS.GetPermissionSet(ctx, permissionSetID); err != nil {
+		log.Warnf("Failed to check OpenShift metrics permission set: %v", err)
+		return
+	} else if exists {
+		return
+	}
+
+	ps := &storage.PermissionSet{
+		Id:          permissionSetID,
+		Name:        permissionSetName,
+		Description: "For OpenShift Prometheus: read access to Administration for /metrics scraping",
+		// Let's give no permissions by default to avoid unexpected sensitive data exposure.
+		ResourceToAccess: permissionsUtils.FromResourcesWithAccess(),
+	}
+	if err := roleDS.AddPermissionSet(ctx, ps); err != nil {
+		log.Warnf("Failed to create OpenShift metrics permission set: %v", err)
+	}
+}
+
+func ensureRole(ctx context.Context, roleDS roleDataStore.DataStore) {
+	if _, exists, err := roleDS.GetRole(ctx, roleName); err != nil {
+		log.Warnf("Failed to check OpenShift metrics role: %v", err)
+		return
+	} else if exists {
+		return
+	}
+
+	role := &storage.Role{
+		Name:            roleName,
+		Description:     "Maps OpenShift Prometheus service account to /metrics read access",
+		PermissionSetId: permissionSetID,
+		AccessScopeId:   rolePkg.AccessScopeIncludeAll.GetId(),
+	}
+	if err := roleDS.AddRole(ctx, role); err != nil {
+		log.Warnf("Failed to create OpenShift metrics role: %v", err)
+	}
+}
+
+func ensureAuthProvider(ctx context.Context, registry authproviders.Registry, caPEM string) {
+	if existing := registry.GetProvider(authProviderID); existing != nil {
+		refreshCA(ctx, registry, existing, caPEM)
+		return
+	}
+
+	_, err := registry.CreateProvider(declarativeconfig.WithModifyDefaultResource(ctx),
+		authproviders.WithType(userpki.TypeName),
+		authproviders.WithID(authProviderID),
+		authproviders.WithName(authProviderName),
+		authproviders.WithEnabled(true),
+		authproviders.WithActive(true),
+		authproviders.WithVisibility(storage.Traits_HIDDEN),
+		authproviders.WithOrigin(storage.Traits_DEFAULT),
+		authproviders.WithConfig(map[string]string{
+			userpki.ConfigKeys: caPEM,
+		}),
+	)
+	if err != nil {
+		log.Warnf("Failed to create OpenShift metrics auth provider: %v", err)
+	}
+}
+
+func ensureGroup(ctx context.Context, groupDS groupDataStore.DataStore) {
+	cn := env.SecureMetricsClientCertCN.Setting()
+	existing, err := groupDS.GetFiltered(ctx, func(g *storage.Group) bool {
+		p := g.GetProps()
+		return p.GetAuthProviderId() == authProviderID && p.GetKey() == "name" && p.GetValue() == cn
+	})
+	if err != nil {
+		log.Warnf("Failed to check OpenShift metrics group: %v", err)
+		return
+	}
+	if len(existing) > 0 {
+		return
+	}
+	group := &storage.Group{
+		Props: &storage.GroupProperties{
+			AuthProviderId: authProviderID,
+			Key:            "name",
+			Value:          cn,
+			Traits: &storage.Traits{
+				Origin: storage.Traits_DEFAULT,
+			},
+		},
+		RoleName: roleName,
+	}
+	// Group uses DEFAULT origin so a user can't repoint or delete the mapping and thereby
+	// orphan (and delete) the role out from under it.
+	if err := groupDS.Add(declarativeconfig.WithModifyDefaultResource(ctx), group); err != nil {
+		log.Warnf("Failed to create OpenShift metrics group: %v", err)
+	}
+}
diff --git a/central/auth/openshift/metrics_auth_test.go b/central/auth/openshift/metrics_auth_test.go
new file mode 100644
index 0000000000000..9355236e8d6d4
--- /dev/null
+++ b/central/auth/openshift/metrics_auth_test.go
@@ -0,0 +1,264 @@
+package openshift
+
+import (
+	"context"
+	"crypto/x509"
+	"errors"
+	"testing"
+
+	groupMocks "github.com/stackrox/rox/central/group/datastore/mocks"
+	roleMocks "github.com/stackrox/rox/central/role/datastore/mocks"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/auth/authproviders"
+	providerMocks "github.com/stackrox/rox/pkg/auth/authproviders/mocks"
+	"github.com/stackrox/rox/pkg/auth/authproviders/userpki"
+	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/auth/tokens"
+	"github.com/stackrox/rox/pkg/certgen"
+	"github.com/stackrox/rox/pkg/declarativeconfig"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+const testCAPEM = "-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----\n"
+
+func setupMocks(t *testing.T) (*providerMocks.MockRegistry, *roleMocks.MockDataStore, *groupMocks.MockDataStore) {
+	ctrl := gomock.NewController(t)
+	return providerMocks.NewMockRegistry(ctrl),
+		roleMocks.NewMockDataStore(ctrl),
+		groupMocks.NewMockDataStore(ctrl)
+}
+
+func TestSeed_FirstBoot_CreatesAllObjects(t *testing.T) {
+	registry, roleDS, groupDS := setupMocks(t)
+	ctx := context.Background()
+
+	roleDS.EXPECT().GetPermissionSet(gomock.Any(), permissionSetID).Return(nil, false, nil)
+	roleDS.EXPECT().AddPermissionSet(gomock.Any(), gomock.Any()).Return(nil)
+	roleDS.EXPECT().GetRole(gomock.Any(), roleName).Return(nil, false, nil)
+	roleDS.EXPECT().AddRole(gomock.Any(), gomock.Any()).Return(nil)
+
+	providerCreated := false
+	registry.EXPECT().GetProvider(authProviderID).Return(nil)
+	registry.EXPECT().CreateProvider(gomock.Any(), gomock.Any()).DoAndReturn(
+		func(_ context.Context, _ ...interface{}) (interface{}, error) {
+			providerCreated = true
+			return nil, nil
+		})
+	groupDS.EXPECT().GetFiltered(gomock.Any(), gomock.Any()).Return(nil, nil)
+	groupDS.EXPECT().Add(gomock.Any(), gomock.Any()).DoAndReturn(
+		func(_ context.Context, _ *storage.Group) error {
+			if !providerCreated {
+				t.Error("group Add called before provider creation")
+			}
+			return nil
+		})
+
+	ensurePermissionSet(ctx, roleDS)
+	ensureRole(ctx, roleDS)
+	ensureAuthProvider(ctx, registry, testCAPEM)
+	ensureGroup(ctx, groupDS)
+}
+
+func TestSeed_SubsequentBoot_CAUnchanged_NoUpdate(t *testing.T) {
+	registry, _, _ := setupMocks(t)
+	ctx := context.Background()
+
+	existing := providerMocks.NewMockProvider(gomock.NewController(t))
+	existing.EXPECT().StorageView().Return(&storage.AuthProvider{
+		Config: map[string]string{userpki.ConfigKeys: testCAPEM},
+	})
+	registry.EXPECT().GetProvider(authProviderID).Return(existing)
+
+	ensureAuthProvider(ctx, registry, testCAPEM)
+}
+
+func TestSeed_PartialRecovery_PermissionSetExists_RoleMissing(t *testing.T) {
+	registry, roleDS, groupDS := setupMocks(t)
+	ctx := context.Background()
+
+	roleDS.EXPECT().GetPermissionSet(gomock.Any(), permissionSetID).Return(&storage.PermissionSet{}, true, nil)
+	roleDS.EXPECT().GetRole(gomock.Any(), roleName).Return(nil, false, nil)
+	roleDS.EXPECT().AddRole(gomock.Any(), gomock.Any()).Return(nil)
+	registry.EXPECT().GetProvider(authProviderID).Return(nil)
+	registry.EXPECT().CreateProvider(gomock.Any(), gomock.Any()).Return(nil, nil)
+	groupDS.EXPECT().GetFiltered(gomock.Any(), gomock.Any()).Return(nil, nil)
+	groupDS.EXPECT().Add(gomock.Any(), gomock.Any()).Return(nil)
+
+	ensurePermissionSet(ctx, roleDS)
+	ensureRole(ctx, roleDS)
+	ensureAuthProvider(ctx, registry, testCAPEM)
+	ensureGroup(ctx, groupDS)
+}
+
+func TestSeed_Group_IsDefaultOriginAndImmutable(t *testing.T) {
+	_, _, groupDS := setupMocks(t)
+	ctx := context.Background()
+
+	groupDS.EXPECT().GetFiltered(gomock.Any(), gomock.Any()).Return(nil, nil)
+	groupDS.EXPECT().Add(gomock.Any(), gomock.Any()).DoAndReturn(
+		func(addCtx context.Context, group *storage.Group) error {
+			if group.GetProps().GetTraits().GetOrigin() != storage.Traits_DEFAULT {
+				t.Errorf("expected group to use DEFAULT origin, got %v", group.GetProps().GetTraits().GetOrigin())
+			}
+			assert.False(t, declarativeconfig.CanModifyResource(ctx, group.GetProps()))
+			if !declarativeconfig.CanModifyResource(addCtx, group.GetProps()) {
+				t.Error("expected ensureGroup to pass a context that can modify DEFAULT-origin resources")
+			}
+			return nil
+		})
+
+	ensureGroup(ctx, groupDS)
+}
+
+func TestSeed_SubsequentBoot_GroupExists_NotOverwritten(t *testing.T) {
+	_, _, groupDS := setupMocks(t)
+	ctx := context.Background()
+
+	groupDS.EXPECT().GetFiltered(gomock.Any(), gomock.Any()).Return([]*storage.Group{{
+		Props:    &storage.GroupProperties{AuthProviderId: authProviderID, Key: "name", Value: "system:serviceaccount:openshift-monitoring:prometheus-k8s"},
+		RoleName: "User Modified Role",
+	}}, nil)
+
+	ensureGroup(ctx, groupDS)
+}
+
+// TestSeed_CARotation_RegistersNewCA runs against a real auth provider registry because
+// the interesting part of a rotation happens past the registry: a mocked registry only
+// shows that UpdateProvider was called, not whether the new CA reached the client CA
+// manager. Persisting the bundle without also rebuilding the provider backend leaves
+// Central advertising the superseded CA until restart, breaking Prometheus scrapes
+// roughly monthly when OpenShift rotates its CSR signer.
+func TestSeed_CARotation_RegistersNewCA(t *testing.T) {
+	ctx := context.Background()
+	caManager := &recordingCAManager{}
+	store := &inMemoryAuthProviderStore{providers: map[string]*storage.AuthProvider{}}
+
+	registry := authproviders.NewStoreBackedRegistry("/sso/", "/auth/response/generic",
+		store, noopIssuerFactory{}, noopRoleMapperFactory{}, nil)
+	require.NoError(t, registry.RegisterBackendFactory(ctx, userpki.TypeName,
+		userpki.NewFactoryFactory(caManager)))
+	require.NoError(t, registry.Init())
+
+	oldCAPEM, oldCA := generateCA(t)
+	newCAPEM, newCA := generateCA(t)
+
+	ensureAuthProvider(ctx, registry, oldCAPEM)
+	require.Equal(t, []string{oldCA.Subject.String()}, registeredSubjects(caManager.certs))
+
+	ensureAuthProvider(ctx, registry, newCAPEM)
+
+	provider := registry.GetProvider(authProviderID)
+	require.NotNil(t, provider)
+	assert.Equal(t, storage.Traits_DEFAULT, provider.StorageView().GetTraits().GetOrigin())
+	assert.Equal(t, newCAPEM, provider.StorageView().GetConfig()[userpki.ConfigKeys],
+		"rotated CA should be persisted in the auth provider config")
+	assert.Equal(t, []string{newCA.Subject.String()}, registeredSubjects(caManager.certs),
+		"rotated CA should also be registered with the client CA manager")
+}
+
+func generateCA(t *testing.T) (string, *x509.Certificate) {
+	ca, err := certgen.GenerateCA()
+	require.NoError(t, err)
+	return string(ca.CertPEM()), ca.Certificate()
+}
+
+func registeredSubjects(certs []*x509.Certificate) []string {
+	subjects := make([]string, 0, len(certs))
+	for _, cert := range certs {
+		subjects = append(subjects, cert.Subject.String())
+	}
+	return subjects
+}
+
+// recordingCAManager stands in for central/tlsconfig.Manager, which is what Central wires
+// into the userpki backend factory. It records the certificates the backend hands over,
+// i.e. what ends up in the client CA pool advertised during the TLS handshake.
+type recordingCAManager struct {
+	certs []*x509.Certificate
+}
+
+func (c *recordingCAManager) RegisterAuthProvider(_ authproviders.Provider, certs []*x509.Certificate) {
+	c.certs = certs
+}
+
+func (c *recordingCAManager) UnregisterAuthProvider(authproviders.Provider) {
+	c.certs = nil
+}
+
+func (c *recordingCAManager) GetProviderForFingerprint(string) authproviders.Provider {
+	return nil
+}
+
+type inMemoryAuthProviderStore struct {
+	providers map[string]*storage.AuthProvider
+}
+
+func (s *inMemoryAuthProviderStore) GetAuthProvider(_ context.Context, id string) (*storage.AuthProvider, bool, error) {
+	provider, found := s.providers[id]
+	return provider, found, nil
+}
+
+func (s *inMemoryAuthProviderStore) ForEachAuthProvider(_ context.Context, fn func(*storage.AuthProvider) error) error {
+	for _, provider := range s.providers {
+		if err := fn(provider); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *inMemoryAuthProviderStore) GetAuthProvidersFiltered(_ context.Context,
+	filter func(*storage.AuthProvider) bool) ([]*storage.AuthProvider, error) {
+	var filtered []*storage.AuthProvider
+	for _, provider := range s.providers {
+		if filter(provider) {
+			filtered = append(filtered, provider)
+		}
+	}
+	return filtered, nil
+}
+
+func (s *inMemoryAuthProviderStore) AuthProviderExistsWithName(_ context.Context, name string) (bool, error) {
+	for _, provider := range s.providers {
+		if provider.GetName() == name {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (s *inMemoryAuthProviderStore) AddAuthProvider(ctx context.Context, provider *storage.AuthProvider) error {
+	if !declarativeconfig.CanModifyResource(ctx, provider) {
+		return errors.New("cannot create provider with this origin context")
+	}
+	s.providers[provider.GetId()] = provider.CloneVT()
+	return nil
+}
+
+func (s *inMemoryAuthProviderStore) UpdateAuthProvider(ctx context.Context, provider *storage.AuthProvider) error {
+	if !declarativeconfig.CanModifyResource(ctx, s.providers[provider.GetId()]) ||
+		!declarativeconfig.CanModifyResource(ctx, provider) {
+		return errors.New("cannot update provider with this origin context")
+	}
+	s.providers[provider.GetId()] = provider.CloneVT()
+	return nil
+}
+
+func (s *inMemoryAuthProviderStore) RemoveAuthProvider(_ context.Context, id string, _ bool) error {
+	delete(s.providers, id)
+	return nil
+}
+
+type noopIssuerFactory struct{}
+
+func (noopIssuerFactory) CreateIssuer(tokens.Source, ...tokens.Option) (tokens.Issuer, error) {
+	return nil, nil
+}
+
+func (noopIssuerFactory) UnregisterSource(tokens.Source) error { return nil }
+
+type noopRoleMapperFactory struct{}
+
+func (noopRoleMapperFactory) GetRoleMapper(string) permissions.RoleMapper { return nil }
diff --git a/central/authprovider/registry/singleton.go b/central/authprovider/registry/singleton.go
index def0c6fad846d..a57a9f90435ac 100644
--- a/central/authprovider/registry/singleton.go
+++ b/central/authprovider/registry/singleton.go
@@ -2,6 +2,7 @@ package registry
 
 import (
 	authProviderDS "github.com/stackrox/rox/central/authprovider/datastore"
+	clusterDataStore "github.com/stackrox/rox/central/cluster/datastore"
 	groupDataStore "github.com/stackrox/rox/central/group/datastore"
 	"github.com/stackrox/rox/central/jwt"
 	"github.com/stackrox/rox/central/role/mapper"
@@ -24,7 +25,7 @@ func initialize() {
 	registry = authproviders.NewStoreBackedRegistry(
 		ssoURLPathPrefix, tokenRedirectURLPath,
 		authProviderDS.Singleton(), jwt.IssuerFactorySingleton(),
-		mapper.FactorySingleton())
+		mapper.FactorySingleton(), clusterDataStore.Singleton())
 	// Set the auth provider registry function in the group datastore to break circular dependency
 	groupDataStore.SetAuthProviderRegistryFunc(func() authproviders.Registry {
 		return registry
diff --git a/central/authprovider/service/service_impl_postgres_test.go b/central/authprovider/service/service_impl_postgres_test.go
index 7cc7ea126330b..c12bbb8a5e8ff 100644
--- a/central/authprovider/service/service_impl_postgres_test.go
+++ b/central/authprovider/service/service_impl_postgres_test.go
@@ -55,6 +55,7 @@ func (s *authProviderServiceTestSuite) SetupSuite() {
 		authProviderDS,
 		tokenIssuerFactory,
 		mapperFactory,
+		nil,
 	)
 
 	ctx := sac.WithAllAccess(context.Background())
diff --git a/central/authprovider/service/service_impl_test.go b/central/authprovider/service/service_impl_test.go
index c4a7c5b806e5b..8144ac20c5286 100644
--- a/central/authprovider/service/service_impl_test.go
+++ b/central/authprovider/service/service_impl_test.go
@@ -58,6 +58,7 @@ func (s *mockedAuthProviderServiceTestSuite) SetupTest() {
 		s.providerMockStore,
 		tokenIssuerFactory,
 		mapperFactory,
+		nil,
 	)
 
 	s.providerMockBEFactory = authProviderMocks.NewMockBackendFactory(s.mockCtrl)
diff --git a/central/baseimage/service/service_impl.go b/central/baseimage/service/service_impl.go
index daa0e46b4a470..2c163a6817495 100644
--- a/central/baseimage/service/service_impl.go
+++ b/central/baseimage/service/service_impl.go
@@ -5,6 +5,8 @@ import (
 	"errors"
 	"fmt"
 	"path"
+	"strings"
+	"unicode"
 
 	"github.com/distribution/reference"
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
@@ -189,12 +191,28 @@ func (s *serviceImpl) validateBaseImageRepository(ctx context.Context, repoPath
 	return nil
 }
 
-// isValidTagPattern checks if the given string is a valid [path.Match] glob pattern.
+// maxTagPatternLength bounds a tag pattern to the maximum length of a container image
+// tag: one leading character plus up to 127 more (see [reference.TagRegexp]).
+const maxTagPatternLength = 128
+
+// isValidTagPattern checks that the given string is a glob pattern that could match a
+// container image tag. Besides validating the [path.Match] glob syntax, it rejects
+// characters that are illegal in a tag ('/', ':', '@', whitespace). Their presence
+// signals that the repository path or a registry port leaked into the tag field -
+// common when the registry includes a port and the user mistypes the input. Such a
+// pattern can never match a real tag, so it is rejected here instead of silently
+// matching nothing.
 func isValidTagPattern(tagPattern string) (bool, error) {
 	// Reject empty tag patterns. Use * to match all tags.
 	if tagPattern == "" {
 		return false, errox.InvalidArgs.New("tag pattern cannot be empty")
 	}
+	if len(tagPattern) > maxTagPatternLength {
+		return false, errox.InvalidArgs.Newf("tag pattern is too long: %d bytes (max %d)", len(tagPattern), maxTagPatternLength)
+	}
+	if strings.ContainsAny(tagPattern, "/:@") || strings.ContainsFunc(tagPattern, unicode.IsSpace) {
+		return false, errox.InvalidArgs.Newf("tag pattern '%s' must not contain '/', ':', '@' or whitespace - for a registry with a port, set baseImageRepoPath to 'registry:port/repo' and baseImageTagPattern to the tag pattern (e.g. '1.*')", tagPattern)
+	}
 	// path.Match validates the pattern and returns an error for malformed input.
 	_, err := path.Match(tagPattern, "")
 	if err != nil {
diff --git a/central/baseimage/service/service_impl_test.go b/central/baseimage/service/service_impl_test.go
index 8064d7a8753db..5c94a73ec53f6 100644
--- a/central/baseimage/service/service_impl_test.go
+++ b/central/baseimage/service/service_impl_test.go
@@ -233,6 +233,42 @@ func (suite *ServiceTestSuite) TestIsValidTagPattern() {
 			expectedValid:  true,
 			expectedErrMsg: "",
 		},
+		{
+			description:    "rejects pattern with slash (repo path leaked into tag field)",
+			input:          "5000/library/ubuntu*",
+			expectedValid:  false,
+			expectedErrMsg: "set baseImageRepoPath to 'registry:port/repo' and baseImageTagPattern to the tag pattern",
+		},
+		{
+			description:    "rejects pattern with colon (registry port leaked into tag field)",
+			input:          "5000:latest",
+			expectedValid:  false,
+			expectedErrMsg: "must not contain",
+		},
+		{
+			description:    "rejects pattern with digest separator",
+			input:          "sha256@abc",
+			expectedValid:  false,
+			expectedErrMsg: "must not contain",
+		},
+		{
+			description:    "rejects pattern with whitespace",
+			input:          "1. *",
+			expectedValid:  false,
+			expectedErrMsg: "must not contain",
+		},
+		{
+			description:    "rejects pattern with non-ASCII whitespace",
+			input:          "1.\u00a0*",
+			expectedValid:  false,
+			expectedErrMsg: "must not contain",
+		},
+		{
+			description:    "rejects pattern longer than max tag length",
+			input:          strings.Repeat("a", maxTagPatternLength+1),
+			expectedValid:  false,
+			expectedErrMsg: "129 bytes (max 128)",
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/central/baseimage/service/singleton.go b/central/baseimage/service/singleton.go
index a3ad7d955ed19..6b7f5ef540112 100644
--- a/central/baseimage/service/singleton.go
+++ b/central/baseimage/service/singleton.go
@@ -27,6 +27,7 @@ func initialize() {
 		scanwaiter.Singleton(),
 		scanwaiterv2.Singleton(),
 		sachelper.NewClusterNamespaceSacHelper(clusterDataStore.Singleton(), namespaceDataStore.Singleton()),
+		clusterDataStore.Singleton(),
 	)
 
 	as = New(repository.Singleton(), imageintegration.Set(), scanDelegator)
diff --git a/central/baseimage/watcher/singleton.go b/central/baseimage/watcher/singleton.go
index 0cb56659572ed..5d48ef671fa25 100644
--- a/central/baseimage/watcher/singleton.go
+++ b/central/baseimage/watcher/singleton.go
@@ -32,6 +32,7 @@ func Singleton() Watcher {
 			scanwaiter.Singleton(),
 			scanwaiterv2.Singleton(),
 			sachelper.NewClusterNamespaceSacHelper(clusterDataStore.Singleton(), namespaceDataStore.Singleton()),
+			clusterDataStore.Singleton(),
 		)
 
 		watcher = New(
diff --git a/central/blob/datastore/datastore.go b/central/blob/datastore/datastore.go
index 07ada065363d1..032932e4afbd2 100644
--- a/central/blob/datastore/datastore.go
+++ b/central/blob/datastore/datastore.go
@@ -10,6 +10,7 @@ import (
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stackrox/rox/pkg/postgres"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/sac/resources"
 	pkgSearch "github.com/stackrox/rox/pkg/search"
@@ -27,6 +28,7 @@ var (
 type Datastore interface {
 	GetIDs(ctx context.Context) ([]string, error)
 	Upsert(ctx context.Context, obj *storage.Blob, reader io.Reader) error
+	UpsertWithWriter(ctx context.Context, tx *postgres.Tx, obj *storage.Blob, writeFn func(io.Writer) error) error
 	Get(ctx context.Context, name string, writer io.Writer) (*storage.Blob, bool, error)
 	Delete(ctx context.Context, name string) error
 	GetMetadata(ctx context.Context, name string) (*storage.Blob, bool, error)
@@ -53,6 +55,12 @@ func (d *datastoreImpl) Upsert(ctx context.Context, obj *storage.Blob, reader io
 	return d.store.Upsert(ctx, obj, reader)
 }
 
+// UpsertWithWriter writes a blob using the caller's transaction and a callback
+// that writes directly to the large object.
+func (d *datastoreImpl) UpsertWithWriter(ctx context.Context, tx *postgres.Tx, obj *storage.Blob, writeFn func(io.Writer) error) error {
+	return d.store.UpsertWithWriter(ctx, tx, obj, writeFn)
+}
+
 // Get retrieves a blob from the database
 func (d *datastoreImpl) Get(ctx context.Context, name string, writer io.Writer) (*storage.Blob, bool, error) {
 	return d.store.Get(ctx, name, writer)
diff --git a/central/blob/datastore/mocks/datastore.go b/central/blob/datastore/mocks/datastore.go
index b6ed7a5d2e1a6..84fb9b90926ab 100644
--- a/central/blob/datastore/mocks/datastore.go
+++ b/central/blob/datastore/mocks/datastore.go
@@ -17,6 +17,7 @@ import (
 
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	storage "github.com/stackrox/rox/generated/storage"
+	postgres "github.com/stackrox/rox/pkg/postgres"
 	search "github.com/stackrox/rox/pkg/search"
 	gomock "go.uber.org/mock/gomock"
 )
@@ -181,3 +182,17 @@ func (mr *MockDatastoreMockRecorder) Upsert(ctx, obj, reader any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Upsert", reflect.TypeOf((*MockDatastore)(nil).Upsert), ctx, obj, reader)
 }
+
+// UpsertWithWriter mocks base method.
+func (m *MockDatastore) UpsertWithWriter(ctx context.Context, tx *postgres.Tx, obj *storage.Blob, writeFn func(io.Writer) error) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpsertWithWriter", ctx, tx, obj, writeFn)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpsertWithWriter indicates an expected call of UpsertWithWriter.
+func (mr *MockDatastoreMockRecorder) UpsertWithWriter(ctx, tx, obj, writeFn any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertWithWriter", reflect.TypeOf((*MockDatastore)(nil).UpsertWithWriter), ctx, tx, obj, writeFn)
+}
diff --git a/central/blob/datastore/store/mocks/store.go b/central/blob/datastore/store/mocks/store.go
index 8982a9a900b89..53e4bab0a7ee4 100644
--- a/central/blob/datastore/store/mocks/store.go
+++ b/central/blob/datastore/store/mocks/store.go
@@ -16,6 +16,7 @@ import (
 
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	storage "github.com/stackrox/rox/generated/storage"
+	postgres "github.com/stackrox/rox/pkg/postgres"
 	search "github.com/stackrox/rox/pkg/search"
 	gomock "go.uber.org/mock/gomock"
 )
@@ -163,3 +164,17 @@ func (mr *MockStoreMockRecorder) Upsert(ctx, obj, reader any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Upsert", reflect.TypeOf((*MockStore)(nil).Upsert), ctx, obj, reader)
 }
+
+// UpsertWithWriter mocks base method.
+func (m *MockStore) UpsertWithWriter(ctx context.Context, tx *postgres.Tx, obj *storage.Blob, writeFn func(io.Writer) error) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpsertWithWriter", ctx, tx, obj, writeFn)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpsertWithWriter indicates an expected call of UpsertWithWriter.
+func (mr *MockStoreMockRecorder) UpsertWithWriter(ctx, tx, obj, writeFn any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertWithWriter", reflect.TypeOf((*MockStore)(nil).UpsertWithWriter), ctx, tx, obj, writeFn)
+}
diff --git a/central/blob/datastore/store/store.go b/central/blob/datastore/store/store.go
index 3fd5064c5cbc8..c5d3fd693053b 100644
--- a/central/blob/datastore/store/store.go
+++ b/central/blob/datastore/store/store.go
@@ -30,6 +30,7 @@ type Store interface {
 	GetIDs(ctx context.Context) ([]string, error)
 	GetMetadata(ctx context.Context, name string) (*storage.Blob, bool, error)
 	Upsert(ctx context.Context, obj *storage.Blob, reader io.Reader) error
+	UpsertWithWriter(ctx context.Context, tx *pgPkg.Tx, obj *storage.Blob, writeFn func(io.Writer) error) error
 	Delete(ctx context.Context, name string) error
 }
 
@@ -139,6 +140,81 @@ func (s *storeImpl) Upsert(ctx context.Context, obj *storage.Blob, reader io.Rea
 	return tx.Commit(ctx)
 }
 
+// UpsertWithWriter writes a blob using the caller's transaction and a callback
+// that writes directly to the large object. The caller is responsible for
+// committing or rolling back the transaction. ctx must already carry the
+// transaction (via postgres.ContextWithTx) so that internal store operations
+// reuse the same connection. writeFn receives a writer backed by the PostgreSQL
+// large object; all writes happen on the calling goroutine, so the caller can
+// safely interleave other operations on the same transaction (e.g. cursor reads).
+func (s *storeImpl) UpsertWithWriter(ctx context.Context, tx *pgPkg.Tx, obj *storage.Blob, writeFn func(io.Writer) error) error {
+	if err := sac.VerifyAuthzOK(scopeChecker.WriteAllowed(ctx)); err != nil {
+		return err
+	}
+	ctx = sac.WithGlobalAccessScopeChecker(ctx,
+		sac.AllowFixedScopes(
+			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS, storage.Access_READ_WRITE_ACCESS),
+			sac.ResourceScopeKeys(resources.Administration)))
+
+	existingBlob, exists, err := s.store.Get(ctx, obj.GetName())
+	if err != nil {
+		return err
+	}
+
+	los := tx.LargeObjects()
+	var lo *pgx.LargeObject
+	if exists {
+		lo, err = los.Open(ctx, existingBlob.GetOid(), pgx.LargeObjectModeWrite)
+		if err != nil {
+			return errors.Wrapf(err, "opening blob with oid %d", existingBlob.GetOid())
+		}
+		if err := lo.Truncate(0); err != nil {
+			return errors.Wrapf(err, "truncating blob with oid %d", existingBlob.GetOid())
+		}
+		obj.Oid = existingBlob.GetOid()
+	} else {
+		oid, err := los.Create(ctx, 0)
+		if err != nil {
+			return errors.Wrap(err, "error creating new blob")
+		}
+		lo, err = los.Open(ctx, oid, pgx.LargeObjectModeWrite)
+		if err != nil {
+			return errors.Wrapf(err, "opening blob with oid %d", oid)
+		}
+		obj.Oid = oid
+	}
+
+	cw := &countingWriter{w: lo}
+	if err := writeFn(cw); err != nil {
+		return err
+	}
+
+	if err := lo.Close(); err != nil {
+		return errors.Wrap(err, "closing large object for blob")
+	}
+	if obj.GetLength() < 0 {
+		obj.Length = cw.n
+	} else if cw.n != obj.GetLength() {
+		return errors.Errorf("Blob metadata mismatch. Blob metadata shows %d in length, but data has length of %d", obj.GetLength(), cw.n)
+	}
+
+	if err := s.store.Upsert(ctx, obj); err != nil {
+		return errors.Wrapf(err, "error upserting blob %q", obj.GetName())
+	}
+	return nil
+}
+
+type countingWriter struct {
+	w io.Writer
+	n int64
+}
+
+func (cw *countingWriter) Write(p []byte) (int, error) {
+	n, err := cw.w.Write(p)
+	cw.n += int64(n)
+	return n, err
+}
+
 // Get returns a blob from the database
 func (s *storeImpl) Get(ctx context.Context, name string, writer io.Writer) (*storage.Blob, bool, error) {
 	tx, err := s.db.Begin(ctx)
diff --git a/central/blob/datastore/test_utils.go b/central/blob/datastore/test_utils.go
index 5f6e54c03d647..845e95189aff1 100644
--- a/central/blob/datastore/test_utils.go
+++ b/central/blob/datastore/test_utils.go
@@ -7,8 +7,8 @@ import (
 	pgPkg "github.com/stackrox/rox/pkg/postgres"
 )
 
-// NewTestDatastore creates the data store for testing.
-func NewTestDatastore(_ *testing.T, db pgPkg.DB) Datastore {
+// NewTestDatastore creates the data store for testing and benchmarks.
+func NewTestDatastore(_ testing.TB, db pgPkg.DB) Datastore {
 	return &datastoreImpl{
 		store: store.New(db),
 	}
diff --git a/central/certgen/central_scanner.go b/central/certgen/central_scanner.go
index ac0d482b346df..485a91162e519 100644
--- a/central/certgen/central_scanner.go
+++ b/central/certgen/central_scanner.go
@@ -77,33 +77,19 @@ func (s *serviceImpl) scannerHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	secrets, ca, err := initializeSecretsWithCACertAndKey()
-	if err != nil {
-		httputil.WriteGRPCStyleError(w, codes.Internal, err)
-		return
-	}
-
-	namespace := env.Namespace.Setting()
-	if r.URL.Query().Get("v") == "4" {
-		s.scannerV4Handler(w, secrets, ca, namespace)
+	if r.URL.Query().Get("v") != "4" {
+		httputil.WriteErrorf(w, http.StatusBadRequest,
+			"legacy Scanner certificate generation is not supported; pass v=4 for Scanner V4")
 		return
 	}
 
-	if err := certgen.IssueScannerCerts(secrets, ca, mtls.WithNamespace(namespace)); err != nil {
-		httputil.WriteGRPCStyleError(w, codes.Internal, err)
-		return
-	}
-
-	rendered, err := renderer.RenderScannerTLSSecretOnly(renderer.Config{
-		K8sConfig:      &renderer.K8sConfig{},
-		SecretsByteMap: secrets,
-	}, defaults.GetImageFlavorFromEnv())
+	secrets, ca, err := initializeSecretsWithCACertAndKey()
 	if err != nil {
-		httputil.WriteGRPCStyleErrorf(w, codes.Internal, "failed to render scanner TLS file: %v", err)
+		httputil.WriteGRPCStyleError(w, codes.Internal, err)
 		return
 	}
 
-	writeFile(w, rendered, "scanner-tls.yaml")
+	s.scannerV4Handler(w, secrets, ca, env.Namespace.Setting())
 }
 
 func (s *serviceImpl) scannerV4Handler(w http.ResponseWriter, secrets map[string][]byte, ca mtls.CA, namespace string) {
diff --git a/central/certgen/central_scanner_test.go b/central/certgen/central_scanner_test.go
new file mode 100644
index 0000000000000..3ee7daee90088
--- /dev/null
+++ b/central/certgen/central_scanner_test.go
@@ -0,0 +1,42 @@
+package certgen
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestScannerHandlerRejectsUnsupportedVersion(t *testing.T) {
+	s := &serviceImpl{}
+	cases := map[string]struct {
+		method string
+		rawURL string
+		want   int
+	}{
+		"should reject GET": {
+			method: http.MethodGet,
+			rawURL: "/api/extensions/certgen/scanner?v=4",
+			want:   http.StatusMethodNotAllowed,
+		},
+		"should reject scanner v2": {
+			method: http.MethodPost,
+			rawURL: "/api/extensions/certgen/scanner",
+			want:   http.StatusBadRequest,
+		},
+		"should reject unknown version": {
+			method: http.MethodPost,
+			rawURL: "/api/extensions/certgen/scanner?v=2",
+			want:   http.StatusBadRequest,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.method, tc.rawURL, nil)
+			rec := httptest.NewRecorder()
+			s.scannerHandler(rec, req)
+			assert.Equal(t, tc.want, rec.Code)
+		})
+	}
+}
diff --git a/central/cli/download.go b/central/cli/download.go
index e0ad06abf0ecc..cdc705a28dcb3 100644
--- a/central/cli/download.go
+++ b/central/cli/download.go
@@ -1,17 +1,85 @@
 package cli
 
 import (
+	"archive/tar"
+	"compress/gzip"
+	"fmt"
+	"io"
 	"net/http"
+	"os"
 	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/stackrox/rox/pkg/logging"
+	"github.com/stackrox/rox/pkg/utils"
 )
 
 const downloadPath = "/assets/downloads/cli"
 
-// Handler returns a handler for serving files from Central's downloads folder
+var log = logging.LoggerForModule()
+
+// Handler serves roxctl binaries from Central UI.
+// Binaries are stored as .tar.gz and extracted on the fly on each request.
 func Handler() http.HandlerFunc {
+	return handlerWithDir(downloadPath)
+}
+
+func handlerWithDir(dir string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Need to remove the rest of the URL path so that it just contains the file wanted
-		r.URL.Path = filepath.Base(r.URL.Path)
-		http.FileServer(http.Dir(downloadPath)).ServeHTTP(w, r)
+		if r.Method != http.MethodGet && r.Method != http.MethodHead {
+			w.Header().Set("Allow", http.MethodGet+", "+http.MethodHead)
+			http.Error(w, fmt.Sprintf("method %s not allowed", r.Method), http.StatusMethodNotAllowed)
+			return
+		}
+
+		filename := filepath.Base(r.URL.Path)
+		tarPath := filepath.Join(dir, strings.TrimSuffix(filename, ".exe")+".tar.gz")
+
+		f, err := os.Open(tarPath)
+		if err != nil {
+			log.Warnf("error opening tarball for requested binary %q: %v", filename, err)
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		defer utils.IgnoreError(f.Close)
+
+		gz, err := gzip.NewReader(f)
+		if err != nil {
+			log.Warnf("error opening gzip reader for %s: %v", tarPath, err)
+			http.Error(w, "invalid archive", http.StatusInternalServerError)
+			return
+		}
+		defer utils.IgnoreError(gz.Close)
+
+		tr := tar.NewReader(gz)
+		for {
+			hdr, err := tr.Next()
+			if err == io.EOF {
+				log.Warnf("binary %q not found in %s; tarball entry name may not match the requested filename", filename, tarPath)
+				http.Error(w, "not found", http.StatusNotFound)
+				return
+			}
+			if err != nil {
+				log.Warnf("error reading archive %s: %v", tarPath, err)
+				http.Error(w, "error reading archive", http.StatusInternalServerError)
+				return
+			}
+			if hdr.Name != filename {
+				continue
+			}
+			w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))
+			w.Header().Set("Content-Type", "application/octet-stream")
+			w.Header().Set("Content-Length", strconv.FormatInt(hdr.Size, 10))
+			w.Header().Set("Accept-Ranges", "none")
+			w.Header().Set("Cache-Control", "no-cache")
+			if r.Method == http.MethodGet {
+				if _, err = io.Copy(w, tr); err != nil {
+					log.Warnf("failed to stream %s: %v", filename, err)
+					panic(http.ErrAbortHandler)
+				}
+			}
+			return
+		}
 	}
 }
diff --git a/central/cli/download_test.go b/central/cli/download_test.go
new file mode 100644
index 0000000000000..7a32eee16e2d3
--- /dev/null
+++ b/central/cli/download_test.go
@@ -0,0 +1,139 @@
+package cli
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+)
+
+func writeTarball(t *testing.T, dir, tarName, entryName string, content []byte) {
+	t.Helper()
+	f, err := os.Create(filepath.Join(dir, tarName+".tar.gz"))
+	require.NoError(t, err)
+
+	gz := gzip.NewWriter(f)
+	tw := tar.NewWriter(gz)
+	err = tw.WriteHeader(&tar.Header{
+		Name: entryName,
+		Size: int64(len(content)),
+		Mode: 0755,
+	})
+	require.NoError(t, err)
+	_, err = tw.Write(content)
+	require.NoError(t, err)
+	require.NoError(t, tw.Close())
+	require.NoError(t, gz.Close())
+	require.NoError(t, f.Close())
+}
+
+type HandlerSuite struct {
+	suite.Suite
+	dir     string
+	handler http.HandlerFunc
+	payload []byte
+}
+
+func TestHandlerSuite(t *testing.T) {
+	suite.Run(t, new(HandlerSuite))
+}
+
+func (s *HandlerSuite) SetupTest() {
+	s.dir = s.T().TempDir()
+	s.handler = handlerWithDir(s.dir)
+	s.payload = []byte("fake roxctl binary content")
+	writeTarball(s.T(), s.dir, "roxctl-linux-amd64", "roxctl-linux-amd64", s.payload)
+	// Windows: tarball strips .exe from the name (required by release pipeline),
+	// but the entry inside the tarball preserves .exe.
+	writeTarball(s.T(), s.dir, "roxctl-windows-amd64", "roxctl-windows-amd64.exe", s.payload)
+}
+
+func (s *HandlerSuite) TestServesLinuxBinaryViaGET() {
+	req := httptest.NewRequest(http.MethodGet, "/api/cli/download/roxctl-linux-amd64", nil)
+	rr := httptest.NewRecorder()
+	s.handler(rr, req)
+	s.Equal(http.StatusOK, rr.Code)
+	s.Equal(`attachment; filename="roxctl-linux-amd64"`, rr.Header().Get("Content-Disposition"))
+	s.Equal("application/octet-stream", rr.Header().Get("Content-Type"))
+	s.Equal("26", rr.Header().Get("Content-Length"))
+	s.Equal("none", rr.Header().Get("Accept-Ranges"))
+	s.Equal("no-cache", rr.Header().Get("Cache-Control"))
+	s.Equal(s.payload, rr.Body.Bytes())
+}
+
+func (s *HandlerSuite) TestServesWindowsBinaryViaGET() {
+	req := httptest.NewRequest(http.MethodGet, "/api/cli/download/roxctl-windows-amd64.exe", nil)
+	rr := httptest.NewRecorder()
+	s.handler(rr, req)
+	s.Equal(http.StatusOK, rr.Code)
+	s.Equal(`attachment; filename="roxctl-windows-amd64.exe"`, rr.Header().Get("Content-Disposition"))
+	s.Equal(s.payload, rr.Body.Bytes())
+}
+
+func (s *HandlerSuite) TestReturnsHeadersButNoBodyForHEAD() {
+	req := httptest.NewRequest(http.MethodHead, "/api/cli/download/roxctl-linux-amd64", nil)
+	rr := httptest.NewRecorder()
+	s.handler(rr, req)
+	s.Equal(http.StatusOK, rr.Code)
+	s.Equal("26", rr.Header().Get("Content-Length"))
+	s.Empty(rr.Body.Bytes())
+}
+
+func (s *HandlerSuite) TestReturns404ForMissingTarball() {
+	req := httptest.NewRequest(http.MethodGet, "/api/cli/download/roxctl-darwin-amd64", nil)
+	rr := httptest.NewRecorder()
+	s.handler(rr, req)
+	s.Equal(http.StatusNotFound, rr.Code)
+}
+
+func (s *HandlerSuite) TestReturns404WhenBinaryNotInTarball() {
+	dir := s.T().TempDir()
+	// Tarball exists but entry name does not match the requested filename.
+	writeTarball(s.T(), dir, "roxctl-linux-amd64", "wrong-entry-name", s.payload)
+	handler := handlerWithDir(dir)
+	req := httptest.NewRequest(http.MethodGet, "/api/cli/download/roxctl-linux-amd64", nil)
+	rr := httptest.NewRecorder()
+	handler(rr, req)
+	s.Equal(http.StatusNotFound, rr.Code)
+}
+
+func (s *HandlerSuite) TestReturns405ForUnsupportedMethod() {
+	req := httptest.NewRequest(http.MethodPost, "/api/cli/download/roxctl-linux-amd64", nil)
+	rr := httptest.NewRecorder()
+	s.handler(rr, req)
+	s.Equal(http.StatusMethodNotAllowed, rr.Code)
+	s.Equal("GET, HEAD", rr.Header().Get("Allow"))
+}
+
+func (s *HandlerSuite) TestReturns500ForCorruptedGzip() {
+	dir := s.T().TempDir()
+	err := os.WriteFile(filepath.Join(dir, "roxctl-linux-amd64.tar.gz"), []byte("not a gzip"), 0600)
+	s.Require().NoError(err)
+	handler := handlerWithDir(dir)
+	req := httptest.NewRequest(http.MethodGet, "/api/cli/download/roxctl-linux-amd64", nil)
+	rr := httptest.NewRecorder()
+	handler(rr, req)
+	s.Equal(http.StatusInternalServerError, rr.Code)
+}
+
+func (s *HandlerSuite) TestReturns500ForCorruptedTar() {
+	dir := s.T().TempDir()
+	f, err := os.Create(filepath.Join(dir, "roxctl-linux-amd64.tar.gz"))
+	s.Require().NoError(err)
+	gz := gzip.NewWriter(f)
+	_, err = gz.Write([]byte("valid gzip but not a tar"))
+	s.Require().NoError(err)
+	s.Require().NoError(gz.Close())
+	s.Require().NoError(f.Close())
+	handler := handlerWithDir(dir)
+	req := httptest.NewRequest(http.MethodGet, "/api/cli/download/roxctl-linux-amd64", nil)
+	rr := httptest.NewRecorder()
+	handler(rr, req)
+	s.Equal(http.StatusInternalServerError, rr.Code)
+}
diff --git a/central/cluster/datastore/datastore.go b/central/cluster/datastore/datastore.go
index 3efff3d52c9aa..fc119157ef87e 100644
--- a/central/cluster/datastore/datastore.go
+++ b/central/cluster/datastore/datastore.go
@@ -23,6 +23,8 @@ import (
 	secretDataStore "github.com/stackrox/rox/central/secret/datastore"
 	"github.com/stackrox/rox/central/sensor/service/connection"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
+	virtualMachineDataStore "github.com/stackrox/rox/central/virtualmachine/datastore"
+	virtualMachineV2DataStore "github.com/stackrox/rox/central/virtualmachine/v2/datastore"
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/generated/storage"
@@ -44,6 +46,7 @@ var (
 //go:generate mockgen-wrapper
 type DataStore interface {
 	GetCluster(ctx context.Context, id string) (*storage.Cluster, bool, error)
+	GetClusterID(ctx context.Context, name string) (string, bool, error)
 	GetClusterName(ctx context.Context, id string) (string, bool, error)
 	GetClusters(ctx context.Context) ([]*storage.Cluster, error)
 	GetClustersForSAC() ([]effectiveaccessscope.Cluster, error)
@@ -100,6 +103,8 @@ func New(
 	networkBaselineMgr networkBaselineManager.Manager,
 	compliancePruner compliancePruning.Pruner,
 	clusterInitStore clusterInitStore.Store,
+	virtualMachines virtualMachineDataStore.DataStore,
+	virtualMachinesV2 virtualMachineV2DataStore.DataStore,
 ) (DataStore, error) {
 	ds := &datastoreImpl{
 		clusterStorage:            clusterStorage,
@@ -126,6 +131,8 @@ func New(
 		nameToIDCache:             simplecache.New(),
 		compliancePruner:          compliancePruner,
 		clusterInitStore:          clusterInitStore,
+		virtualMachineDataStore:   virtualMachines,
+		virtualMachineV2DataStore: virtualMachinesV2,
 	}
 
 	if err := ds.buildCache(sac.WithAllAccess(context.Background())); err != nil {
diff --git a/central/cluster/datastore/datastore_impl.go b/central/cluster/datastore/datastore_impl.go
index 04afdcd772bbd..fea57dfb7bf47 100644
--- a/central/cluster/datastore/datastore_impl.go
+++ b/central/cluster/datastore/datastore_impl.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"maps"
+	"math"
 	"regexp"
 	"slices"
 	"strings"
@@ -11,6 +12,7 @@ import (
 
 	"github.com/pkg/errors"
 	alertDataStore "github.com/stackrox/rox/central/alert/datastore"
+	"github.com/stackrox/rox/central/cluster/lifecycle"
 	clusterStore "github.com/stackrox/rox/central/cluster/store/cluster"
 	clusterHealthStore "github.com/stackrox/rox/central/cluster/store/clusterhealth"
 	clusterInitStore "github.com/stackrox/rox/central/clusterinit/store"
@@ -34,6 +36,8 @@ import (
 	"github.com/stackrox/rox/central/sensor/service/common"
 	"github.com/stackrox/rox/central/sensor/service/connection"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
+	virtualMachineDataStore "github.com/stackrox/rox/central/virtualmachine/datastore"
+	virtualMachineV2DataStore "github.com/stackrox/rox/central/virtualmachine/v2/datastore"
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/generated/storage"
@@ -96,6 +100,9 @@ type datastoreImpl struct {
 	compliancePruner          compliancePruning.Pruner
 	cm                        connection.Manager
 	networkBaselineMgr        networkBaselineManager.Manager
+	virtualMachineDataStore   virtualMachineDataStore.DataStore
+	// virtualMachineV2DataStore is nil when VirtualMachinesEnhancedDataModel is off.
+	virtualMachineV2DataStore virtualMachineV2DataStore.DataStore
 
 	notifier      notifierProcessor.Processor
 	clusterRanker *ranking.Ranker
@@ -372,6 +379,18 @@ func (ds *datastoreImpl) GetClusterName(ctx context.Context, id string) (string,
 	return val.(string), true, nil
 }
 
+func (ds *datastoreImpl) GetClusterID(ctx context.Context, name string) (string, bool, error) {
+	idVal, ok := ds.nameToIDCache.Get(name)
+	if !ok {
+		return "", false, nil
+	}
+	id := idVal.(string)
+	if allowed, err := clusterSAC.ReadAllowed(ctx, sac.ClusterScopeKey(id)); err != nil || !allowed {
+		return "", false, err
+	}
+	return id, true, nil
+}
+
 // Figure out if an indicator matches provided namespace filter. We consider
 // SAC errors or failure to find the pre-compiled filter regex as not matching
 // cases.
@@ -640,7 +659,9 @@ func (ds *datastoreImpl) RemoveCluster(ctx context.Context, id string, done *con
 		return err
 	}
 
+	release := lifecycle.Singleton().BeginDeletion(id)
 	if err := ds.clusterStorage.Delete(ctx, id); err != nil {
+		release()
 		return errors.Wrapf(err, "failed to remove cluster %q", id)
 	}
 	ds.idToNameCache.Remove(id)
@@ -648,11 +669,12 @@ func (ds *datastoreImpl) RemoveCluster(ctx context.Context, id string, done *con
 	ds.nameToIDCache.Remove(cluster.GetName())
 
 	deleteRelatedCtx := sac.WithAllAccess(context.Background())
-	go ds.postRemoveCluster(deleteRelatedCtx, cluster, done)
+	go ds.postRemoveCluster(deleteRelatedCtx, cluster, done, release)
 	return nil
 }
 
-func (ds *datastoreImpl) postRemoveCluster(ctx context.Context, cluster *storage.Cluster, done *concurrency.Signal) {
+func (ds *datastoreImpl) postRemoveCluster(ctx context.Context, cluster *storage.Cluster, done *concurrency.Signal, release func()) {
+	defer release()
 	// Terminate the cluster connection to prevent new data from being stored.
 	if ds.cm != nil {
 		ds.cm.CloseConnection(cluster.GetId())
@@ -679,6 +701,8 @@ func (ds *datastoreImpl) postRemoveCluster(ctx context.Context, cluster *storage
 		log.Errorf("failed to remove nodes for cluster %s: %v", cluster.GetId(), err)
 	}
 
+	ds.removeClusterVirtualMachines(ctx, cluster)
+
 	if err := ds.netEntityDataStore.DeleteExternalNetworkEntitiesForCluster(ctx, cluster.GetId()); err != nil {
 		log.Errorf("failed to delete external network graph entities for removed cluster %s: %v", cluster.GetId(), err)
 	}
@@ -756,6 +780,43 @@ func (ds *datastoreImpl) removeClusterPods(ctx context.Context, cluster *storage
 	}
 }
 
+// removeClusterVirtualMachines deletes V1 and V2 VM inventory for the cluster.
+// Child scan/component/CVE rows cascade from the VM; ClusterID has no FK to clusters.
+func (ds *datastoreImpl) removeClusterVirtualMachines(ctx context.Context, cluster *storage.Cluster) {
+	q := pkgSearch.NewQueryBuilder().AddExactMatches(pkgSearch.ClusterID, cluster.GetId()).ProtoQuery()
+	q.Pagination = &v1.QueryPagination{Limit: math.MaxInt32}
+
+	if ds.virtualMachineDataStore != nil {
+		vms, err := ds.virtualMachineDataStore.SearchRawVirtualMachines(ctx, q)
+		if err != nil {
+			log.Errorf("Failed to get virtual machines for removed cluster %s: %v", cluster.GetId(), err)
+		} else if ids := virtualMachineIDs(vms); len(ids) > 0 {
+			if err := ds.virtualMachineDataStore.DeleteVirtualMachines(ctx, ids...); err != nil {
+				log.Errorf("Failed to remove virtual machines as part of removal of cluster %s: %v", cluster.GetId(), err)
+			}
+		}
+	}
+
+	if ds.virtualMachineV2DataStore != nil {
+		results, err := ds.virtualMachineV2DataStore.Search(ctx, q)
+		if err != nil {
+			log.Errorf("Failed to get v2 virtual machines for removed cluster %s: %v", cluster.GetId(), err)
+		} else if ids := pkgSearch.ResultsToIDs(results); len(ids) > 0 {
+			if err := ds.virtualMachineV2DataStore.DeleteVirtualMachines(ctx, ids...); err != nil {
+				log.Errorf("Failed to remove v2 virtual machines as part of removal of cluster %s: %v", cluster.GetId(), err)
+			}
+		}
+	}
+}
+
+func virtualMachineIDs(vms []*storage.VirtualMachine) []string {
+	ids := make([]string, 0, len(vms))
+	for _, vm := range vms {
+		ids = append(ids, vm.GetId())
+	}
+	return ids
+}
+
 func (ds *datastoreImpl) removeClusterDeployments(ctx context.Context, cluster *storage.Cluster) []string {
 	q := pkgSearch.NewQueryBuilder().AddExactMatches(pkgSearch.ClusterID, cluster.GetId()).ProtoQuery()
 	deployments, err := ds.deploymentDataStore.Search(ctx, q)
diff --git a/central/cluster/datastore/datastore_impl_postgres_test.go b/central/cluster/datastore/datastore_impl_postgres_test.go
index 13af916ca3ac2..ed85aee19f140 100644
--- a/central/cluster/datastore/datastore_impl_postgres_test.go
+++ b/central/cluster/datastore/datastore_impl_postgres_test.go
@@ -30,6 +30,10 @@ import (
 	secretDataStore "github.com/stackrox/rox/central/secret/datastore"
 	"github.com/stackrox/rox/central/sensor/service/connection"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
+	vmCVEDatastore "github.com/stackrox/rox/central/virtualmachine/cve/v2/datastore"
+	vmDatastore "github.com/stackrox/rox/central/virtualmachine/datastore"
+	vmV2Datastore "github.com/stackrox/rox/central/virtualmachine/v2/datastore"
+	"github.com/stackrox/rox/central/virtualmachine/v2/datastore/store/common"
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/generated/storage"
@@ -78,6 +82,9 @@ type ClusterPostgresDataStoreTestSuite struct {
 	imageIntegrationDatastore imageIntegrationDataStore.DataStore
 	clusterDatastore          DataStore
 	clusterInitStore          clusterInitStore.Store
+	vmDatastore               vmDatastore.DataStore
+	vmV2Datastore             vmV2Datastore.DataStore
+	vmCVEDatastore            vmCVEDatastore.DataStore
 
 	clusterHealthDBStore clusterHealthPostgresStore.Store
 }
@@ -112,11 +119,15 @@ func (s *ClusterPostgresDataStoreTestSuite) SetupTest() {
 	s.roleBindingDatastore = k8sRoleBindingDataStore.GetTestPostgresDataStore(s.T(), s.db.DB)
 	s.imageIntegrationDatastore = imageIntegrationDataStore.GetTestPostgresDataStore(s.T(), s.db.DB)
 	s.clusterInitStore = clusterInitStore.GetTestPostgresDataStore(s.T(), s.db.DB)
+	s.vmDatastore = vmDatastore.GetTestPostgresDataStore(s.T(), s.db)
+	s.vmV2Datastore = vmV2Datastore.GetTestPostgresDataStore(s.T(), s.db)
+	s.vmCVEDatastore = vmCVEDatastore.GetTestPostgresDataStore(s.T(), s.db)
 	s.clusterDatastore, err = New(clusterDBStore, s.clusterHealthDBStore, clusterCVEStore,
 		s.alertDatastore, s.imageIntegrationDatastore, s.nsDatastore, s.deploymentDatastore,
 		nodeStore, s.podDatastore, s.secretDatastore, netFlowStore, netEntityStore,
 		s.serviceAccountDatastore, s.roleDatastore, s.roleBindingDatastore, sensorCnxMgr, nil,
-		clusterRanker, networkBaselineM, compliancePruner, s.clusterInitStore)
+		clusterRanker, networkBaselineM, compliancePruner, s.clusterInitStore,
+		s.vmDatastore, s.vmV2Datastore)
 	s.NoError(err)
 }
 
@@ -170,6 +181,43 @@ func (s *ClusterPostgresDataStoreTestSuite) TestRemoveCluster() {
 	s.NotEmpty(imageIntegrationId)
 	s.NoError(imageIntegrationAddErr)
 
+	testV1VM := &storage.VirtualMachine{
+		Id:        fixtureconsts.VirtualMachine1,
+		Name:      "retired-vm-v1",
+		Namespace: "default",
+		ClusterId: clusterId,
+		Scan: &storage.VirtualMachineScan{
+			Components: []*storage.EmbeddedVirtualMachineScanComponent{
+				{Name: "openssl", Version: "1.1.1"},
+			},
+		},
+	}
+	s.NoError(s.vmDatastore.UpsertVirtualMachine(ctx, testV1VM))
+
+	testV2VM := &storage.VirtualMachineV2{
+		Id:          fixtureconsts.VirtualMachine2,
+		Name:        "retired-vm-v2",
+		Namespace:   "default",
+		ClusterId:   clusterId,
+		ClusterName: testCluster.GetName(),
+		GuestOs:     "rhel9",
+		State:       storage.VirtualMachineV2_RUNNING,
+	}
+	s.NoError(s.vmV2Datastore.UpsertVirtualMachine(ctx, testV2VM))
+	s.NoError(s.vmV2Datastore.UpsertScan(ctx, testV2VM.GetId(), clusterRemovalTestScanParts(testV2VM.GetId())))
+
+	keptCluster := &storage.Cluster{Name: fixtureconsts.ClusterName2, MainImage: mainImage, CentralApiEndpoint: centralEndpoint}
+	keptClusterID, keptClusterAddErr := s.clusterDatastore.AddCluster(ctx, keptCluster)
+	s.NotEmpty(keptClusterID)
+	s.NoError(keptClusterAddErr)
+	keptV1VM := &storage.VirtualMachine{
+		Id:        fixtureconsts.VirtualMachineFake,
+		Name:      "kept-vm-v1",
+		Namespace: "default",
+		ClusterId: keptClusterID,
+	}
+	s.NoError(s.vmDatastore.UpsertVirtualMachine(ctx, keptV1VM))
+
 	// Remove cluster and verify that the removal has been cascaded to all related components
 	doneSignal := concurrency.NewSignal()
 	clusterRemoveErr := s.clusterDatastore.RemoveCluster(ctx, clusterId, &doneSignal)
@@ -213,6 +261,66 @@ func (s *ClusterPostgresDataStoreTestSuite) TestRemoveCluster() {
 	_, imageIntegrationFound, imageIntegrationGetErr := s.imageIntegrationDatastore.GetImageIntegration(ctx, testImageIntegration.GetId())
 	s.NoError(imageIntegrationGetErr)
 	s.False(imageIntegrationFound)
+
+	v1Count, v1CountErr := s.vmDatastore.CountVirtualMachines(ctx, pkgSearch.NewQueryBuilder().AddExactMatches(pkgSearch.ClusterID, clusterId).ProtoQuery())
+	s.NoError(v1CountErr)
+	s.Zero(v1Count)
+	_, v1Found, v1GetErr := s.vmDatastore.GetVirtualMachine(ctx, testV1VM.GetId())
+	s.NoError(v1GetErr)
+	s.False(v1Found)
+
+	v2Count, v2CountErr := s.vmV2Datastore.CountVirtualMachines(ctx, pkgSearch.NewQueryBuilder().AddExactMatches(pkgSearch.ClusterID, clusterId).ProtoQuery())
+	s.NoError(v2CountErr)
+	s.Zero(v2Count)
+	_, v2Found, v2GetErr := s.vmV2Datastore.GetVirtualMachine(ctx, testV2VM.GetId())
+	s.NoError(v2GetErr)
+	s.False(v2Found)
+
+	cves, cveSearchErr := s.vmCVEDatastore.SearchRawVMCVEs(ctx, pkgSearch.EmptyQuery())
+	s.NoError(cveSearchErr)
+	s.Empty(cves)
+
+	_, keptFound, keptGetErr := s.vmDatastore.GetVirtualMachine(ctx, keptV1VM.GetId())
+	s.NoError(keptGetErr)
+	s.True(keptFound)
+}
+
+func clusterRemovalTestScanParts(vmID string) common.VMScanParts {
+	scanID := uuid.NewV4().String()
+	compID := uuid.NewV4().String()
+	cveID := uuid.NewV4().String()
+	return common.VMScanParts{
+		Scan: &storage.VirtualMachineScanV2{
+			Id:     scanID,
+			VmV2Id: vmID,
+			ScanOs: "rhel9",
+		},
+		Components: []*storage.VirtualMachineComponentV2{
+			{
+				Id:              compID,
+				VmScanId:        scanID,
+				Name:            "openssl",
+				Version:         "1.1.1",
+				Source:          storage.SourceType_OS,
+				OperatingSystem: "rhel:9",
+			},
+		},
+		CVEs: []*storage.VirtualMachineCVEV2{
+			{
+				Id:            cveID,
+				VmV2Id:        vmID,
+				VmComponentId: compID,
+				CveBaseInfo: &storage.CVEInfo{
+					Cve:     "CVE-2024-0001",
+					Summary: "test vulnerability",
+				},
+				PreferredCvss: 7.5,
+				Severity:      storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
+				IsFixable:     true,
+				HasFixedBy:    &storage.VirtualMachineCVEV2_FixedBy{FixedBy: "1.1.2"},
+			},
+		},
+	}
 }
 
 func (s *ClusterPostgresDataStoreTestSuite) TestPopulateClusterHealthInfo() {
diff --git a/central/cluster/datastore/datastore_impl_test.go b/central/cluster/datastore/datastore_impl_test.go
index 18fb22376ce0c..0ba81c3c61ccf 100644
--- a/central/cluster/datastore/datastore_impl_test.go
+++ b/central/cluster/datastore/datastore_impl_test.go
@@ -2,6 +2,7 @@ package datastore
 
 import (
 	"errors"
+	"math"
 	"regexp"
 	"testing"
 	"time"
@@ -27,6 +28,9 @@ import (
 	secretDataStoreMocks "github.com/stackrox/rox/central/secret/datastore/mocks"
 	connectionMocks "github.com/stackrox/rox/central/sensor/service/connection/mocks"
 	serviceAccountDataStoreMocks "github.com/stackrox/rox/central/serviceaccount/datastore/mocks"
+	virtualMachineDSMocks "github.com/stackrox/rox/central/virtualmachine/datastore/mocks"
+	virtualMachineV2DSMocks "github.com/stackrox/rox/central/virtualmachine/v2/datastore/mocks"
+	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/generated/storage"
 	clusterPkg "github.com/stackrox/rox/pkg/cluster"
@@ -80,6 +84,8 @@ type clusterDataStoreTestSuite struct {
 	k8sRoleBindingDS     *roleBindingDataStoreMocks.MockDataStore
 	secretDS             *secretDataStoreMocks.MockDataStore
 	serviceAccountDS     *serviceAccountDataStoreMocks.MockDataStore
+	vmDS                 *virtualMachineDSMocks.MockDataStore
+	vmV2DS               *virtualMachineV2DSMocks.MockDataStore
 
 	networkBaselineMgr *networkBaselineManagerMocks.MockManager
 
@@ -112,6 +118,8 @@ func (s *clusterDataStoreTestSuite) SetupTest() {
 	s.k8sRoleBindingDS = roleBindingDataStoreMocks.NewMockDataStore(s.mockCtrl)
 	s.secretDS = secretDataStoreMocks.NewMockDataStore(s.mockCtrl)
 	s.serviceAccountDS = serviceAccountDataStoreMocks.NewMockDataStore(s.mockCtrl)
+	s.vmDS = virtualMachineDSMocks.NewMockDataStore(s.mockCtrl)
+	s.vmV2DS = virtualMachineV2DSMocks.NewMockDataStore(s.mockCtrl)
 
 	s.networkBaselineMgr = networkBaselineManagerMocks.NewMockManager(s.mockCtrl)
 
@@ -138,6 +146,8 @@ func (s *clusterDataStoreTestSuite) SetupTest() {
 		serviceAccountDataStore:   s.serviceAccountDS,
 		roleDataStore:             s.k8sRoleDS,
 		roleBindingDataStore:      s.k8sRoleBindingDS,
+		virtualMachineDataStore:   s.vmDS,
+		virtualMachineV2DataStore: s.vmV2DS,
 		cm:                        s.sensorConnectionMgr,
 		notifier:                  s.notifierProcessor,
 		clusterRanker:             ranking.NewRanker(),
@@ -177,6 +187,9 @@ func (s *clusterDataStoreTestSuite) TestPostRemoveCluster() {
 
 	clusterIDSearchQuery := pkgSearch.NewQueryBuilder().AddExactMatches(pkgSearch.ClusterID, clusterID).ProtoQuery()
 	matchClusterIDSearchQuery := protomock.GoMockMatcherEqualMessage(clusterIDSearchQuery)
+	vmClusterIDSearchQuery := clusterIDSearchQuery.CloneVT()
+	vmClusterIDSearchQuery.Pagination = &v1.QueryPagination{Limit: math.MaxInt32}
+	matchVMClusterIDSearchQuery := protomock.GoMockMatcherEqualMessage(vmClusterIDSearchQuery)
 
 	testError := errors.New("test error")
 
@@ -300,6 +313,31 @@ func (s *clusterDataStoreTestSuite) TestPostRemoveCluster() {
 				Times(1).
 				Return(tc.status)
 
+			// Remove virtual machines (v1 and v2)
+			v1VMs := make([]*storage.VirtualMachine, 0, len(tc.results))
+			for _, result := range tc.results {
+				v1VMs = append(v1VMs, &storage.VirtualMachine{Id: result.ID})
+			}
+			s.vmDS.EXPECT().
+				SearchRawVirtualMachines(gomock.Any(), matchVMClusterIDSearchQuery).
+				Times(1).
+				Return(v1VMs, tc.status)
+			s.vmV2DS.EXPECT().
+				Search(gomock.Any(), matchVMClusterIDSearchQuery).
+				Times(1).
+				Return(searchResults, tc.status)
+			if tc.status == nil && len(resultIDs) > 0 {
+				var deleteErr error
+				for _, result := range tc.results {
+					if result.status != nil {
+						deleteErr = result.status
+						break
+					}
+				}
+				s.vmDS.EXPECT().DeleteVirtualMachines(gomock.Any(), resultIDs[0], resultIDs[1]).Times(1).Return(deleteErr)
+				s.vmV2DS.EXPECT().DeleteVirtualMachines(gomock.Any(), resultIDs[0], resultIDs[1]).Times(1).Return(deleteErr)
+			}
+
 			// 9. Delete external network entities for cluster
 			s.networkEntityDS.EXPECT().
 				DeleteExternalNetworkEntitiesForCluster(gomock.Any(), clusterID).
@@ -396,7 +434,7 @@ func (s *clusterDataStoreTestSuite) TestPostRemoveCluster() {
 
 			ctx := sac.WithAllAccess(s.T().Context())
 			doneSignal := concurrency.NewSignal()
-			s.datastore.postRemoveCluster(ctx, removedCluster, &doneSignal)
+			s.datastore.postRemoveCluster(ctx, removedCluster, &doneSignal, func() {})
 
 			doneSignal.Wait()
 		})
diff --git a/central/cluster/datastore/datastore_test_constructors.go b/central/cluster/datastore/datastore_test_constructors.go
index a3c35532a3601..b231c9eacfc82 100644
--- a/central/cluster/datastore/datastore_test_constructors.go
+++ b/central/cluster/datastore/datastore_test_constructors.go
@@ -25,6 +25,8 @@ import (
 	secretDataStore "github.com/stackrox/rox/central/secret/datastore"
 	"github.com/stackrox/rox/central/sensor/service/connection"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
+	virtualMachineDataStore "github.com/stackrox/rox/central/virtualmachine/datastore"
+	virtualMachineV2DataStore "github.com/stackrox/rox/central/virtualmachine/v2/datastore"
 	"github.com/stackrox/rox/pkg/postgres"
 )
 
@@ -75,5 +77,7 @@ func GetTestPostgresDataStore(t testing.TB, pool postgres.DB) (DataStore, error)
 		alertStore, iiStore, namespaceStore, deploymentStore,
 		nodeStore, podStore, secretStore, netFlowStore, netEntityStore,
 		serviceAccountStore, k8sRoleStore, k8sRoleBindingStore, sensorCnxMgr, nil,
-		clusterRanker, networkBaselineManager, compliancePruner, clusterInitStore)
+		clusterRanker, networkBaselineManager, compliancePruner, clusterInitStore,
+		virtualMachineDataStore.GetTestPostgresDataStore(t, pool),
+		virtualMachineV2DataStore.GetTestPostgresDataStore(t, pool))
 }
diff --git a/central/cluster/datastore/mocks/datastore.go b/central/cluster/datastore/mocks/datastore.go
index 31785e5b30bde..ba643ce95df76 100644
--- a/central/cluster/datastore/mocks/datastore.go
+++ b/central/cluster/datastore/mocks/datastore.go
@@ -122,6 +122,22 @@ func (mr *MockDataStoreMockRecorder) GetCluster(ctx, id any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCluster", reflect.TypeOf((*MockDataStore)(nil).GetCluster), ctx, id)
 }
 
+// GetClusterID mocks base method.
+func (m *MockDataStore) GetClusterID(ctx context.Context, name string) (string, bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterID", ctx, name)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetClusterID indicates an expected call of GetClusterID.
+func (mr *MockDataStoreMockRecorder) GetClusterID(ctx, name any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterID", reflect.TypeOf((*MockDataStore)(nil).GetClusterID), ctx, name)
+}
+
 // GetClusterLabels mocks base method.
 func (m *MockDataStore) GetClusterLabels(ctx context.Context, clusterID string) (map[string]string, error) {
 	m.ctrl.T.Helper()
diff --git a/central/cluster/datastore/singleton.go b/central/cluster/datastore/singleton.go
index 80961a103f9e4..17f7b0408f68e 100644
--- a/central/cluster/datastore/singleton.go
+++ b/central/cluster/datastore/singleton.go
@@ -23,6 +23,8 @@ import (
 	secretDataStore "github.com/stackrox/rox/central/secret/datastore"
 	"github.com/stackrox/rox/central/sensor/service/connection"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
+	virtualMachineDataStore "github.com/stackrox/rox/central/virtualmachine/datastore"
+	virtualMachineV2DataStore "github.com/stackrox/rox/central/virtualmachine/v2/datastore"
 	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stackrox/rox/pkg/utils"
 )
@@ -60,7 +62,9 @@ func initialize() {
 		ranking.ClusterRanker(),
 		networkBaselineManager.Singleton(),
 		compliancePruning.Singleton(),
-		clusterInitStoreSingleton.Singleton())
+		clusterInitStoreSingleton.Singleton(),
+		virtualMachineDataStore.Singleton(),
+		virtualMachineV2DataStore.Singleton())
 
 	utils.CrashOnError(err)
 }
diff --git a/central/cluster/datastore/telemetry.go b/central/cluster/datastore/telemetry.go
index e75f00e398ff6..bd636efd5f689 100644
--- a/central/cluster/datastore/telemetry.go
+++ b/central/cluster/datastore/telemetry.go
@@ -2,6 +2,10 @@ package datastore
 
 import (
 	"context"
+	"encoding/json"
+	"maps"
+	"slices"
+	"strings"
 	"time"
 
 	"github.com/stackrox/rox/central/telemetry/centralclient"
@@ -79,9 +83,58 @@ var Gather phonehome.GatherFunc = func(ctx context.Context) (map[string]any, err
 	return props, nil
 }
 
+type versionEntry struct {
+	Version string `json:"version"`
+	Count   int32  `json:"count"`
+}
+
+// buildVMTraits returns Segment trait key/value pairs for VM telemetry.
+// Returns nil when the Sensor lacks VirtualMachineTelemetryCap (old Sensor,
+// leave existing traits untouched).
+func buildVMTraits(hasCapability bool, vmm *central.VirtualMachineMetrics) map[string]any {
+	if !hasCapability {
+		return nil
+	}
+	if vmm == nil {
+		return map[string]any{
+			"VM Scanning Enabled":     false,
+			"VM Tracked Count":        int32(0),
+			"VM Scanned Count":        int32(0),
+			"VM Unscanned Count":      int32(0),
+			"Roxagent Version Counts": "[]",
+		}
+	}
+
+	traits := map[string]any{
+		"VM Scanning Enabled":     true,
+		"VM Tracked Count":        vmm.GetTrackedVms(),
+		"VM Scanned Count":        vmm.GetVmsScanned(),
+		"VM Unscanned Count":      max(int32(0), vmm.GetTrackedVms()-vmm.GetVmsScanned()),
+		"Roxagent Version Counts": "[]",
+	}
+
+	if vc := vmm.GetRoxagentVersionCounts(); len(vc) > 0 {
+		entries := make([]versionEntry, 0, len(vc))
+		for v, c := range vc {
+			entries = append(entries, versionEntry{Version: v, Count: c})
+		}
+		slices.SortFunc(entries, func(a, b versionEntry) int {
+			return strings.Compare(a.Version, b.Version)
+		})
+		raw, err := json.Marshal(entries)
+		if err != nil {
+			log.Warnf("Failed to marshal roxagent version counts: %v", err)
+			return traits
+		}
+		traits["Roxagent Version Counts"] = string(raw)
+	}
+
+	return traits
+}
+
 // UpdateSecuredClusterIdentity is called by the clustermetrics pipeline on
 // the reception of the cluster metrics from a sensor.
-func UpdateSecuredClusterIdentity(ctx context.Context, clusterID string, metrics *central.ClusterMetrics) {
+func UpdateSecuredClusterIdentity(ctx context.Context, clusterID string, metrics *central.ClusterMetrics, hasVMTelemetryCap bool) {
 	c := centralclient.Singleton()
 	// This is a shortcut to avoid calling the cluster datastore in case
 	// telemetry is for sure not enabled.
@@ -127,6 +180,12 @@ func UpdateSecuredClusterIdentity(ctx context.Context, clusterID string, metrics
 	}
 	props["Orchestrator Version"] = omd.GetVersion()
 
+	props["Sensor Version Compatibility"] = cluster.GetStatus().GetSensorVersionCompatibility().String()
+
+	if vmTraits := buildVMTraits(hasVMTelemetryCap, metrics.GetVirtualMachineMetrics()); vmTraits != nil {
+		maps.Copy(props, vmTraits)
+	}
+
 	c.Track("Updated Secured Cluster Identity", nil, append(
 		c.WithGroups(),
 		telemeter.WithClient(clusterID, securedClusterClient, cluster.GetMainImage()),
diff --git a/central/cluster/datastore/telemetry_test.go b/central/cluster/datastore/telemetry_test.go
new file mode 100644
index 0000000000000..9ff1275ad590b
--- /dev/null
+++ b/central/cluster/datastore/telemetry_test.go
@@ -0,0 +1,86 @@
+package datastore
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/internalapi/central"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildVMTraits(t *testing.T) {
+	tests := map[string]struct {
+		hasCapability bool
+		metrics       *central.VirtualMachineMetrics
+		wantTraits    map[string]any
+	}{
+		"should set VM Scanning Enabled true with sorted version JSON when metrics are non-nil": {
+			hasCapability: true,
+			metrics: &central.VirtualMachineMetrics{
+				TrackedVms: 10,
+				VmsScanned: 7,
+				RoxagentVersionCounts: map[string]int32{
+					"4.7.0-12-gabcdef0123": 4,
+					"4.8.0-3-gfedcba9876":  2,
+					"unknown":              1,
+				},
+			},
+			wantTraits: map[string]any{
+				"VM Scanning Enabled":     true,
+				"VM Tracked Count":        int32(10),
+				"VM Scanned Count":        int32(7),
+				"VM Unscanned Count":      int32(3),
+				"Roxagent Version Counts": `[{"version":"4.7.0-12-gabcdef0123","count":4},{"version":"4.8.0-3-gfedcba9876","count":2},{"version":"unknown","count":1}]`,
+			},
+		},
+		"should zero traits including version counts when capable Sensor sends nil metrics (feature off)": {
+			hasCapability: true,
+			metrics:       nil,
+			wantTraits: map[string]any{
+				"VM Scanning Enabled":     false,
+				"VM Tracked Count":        int32(0),
+				"VM Scanned Count":        int32(0),
+				"VM Unscanned Count":      int32(0),
+				"Roxagent Version Counts": "[]",
+			},
+		},
+		"should set empty version counts for non-nil-but-all-zero metrics (feature on, zero VMs)": {
+			hasCapability: true,
+			metrics:       &central.VirtualMachineMetrics{},
+			wantTraits: map[string]any{
+				"VM Scanning Enabled":     true,
+				"VM Tracked Count":        int32(0),
+				"VM Scanned Count":        int32(0),
+				"VM Unscanned Count":      int32(0),
+				"Roxagent Version Counts": "[]",
+			},
+		},
+		"should omit unknown from version JSON when the map has no unknown bucket": {
+			hasCapability: true,
+			metrics: &central.VirtualMachineMetrics{
+				TrackedVms: 4,
+				VmsScanned: 4,
+				RoxagentVersionCounts: map[string]int32{
+					"4.7.0-12-gabcdef0123": 4,
+				},
+			},
+			wantTraits: map[string]any{
+				"VM Scanning Enabled":     true,
+				"VM Tracked Count":        int32(4),
+				"VM Scanned Count":        int32(4),
+				"VM Unscanned Count":      int32(0),
+				"Roxagent Version Counts": `[{"version":"4.7.0-12-gabcdef0123","count":4}]`,
+			},
+		},
+		"should return nil traits when Sensor lacks capability (old Sensor)": {
+			hasCapability: false,
+			metrics:       nil,
+			wantTraits:    nil,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tc.wantTraits, buildVMTraits(tc.hasCapability, tc.metrics))
+		})
+	}
+}
diff --git a/central/cluster/lifecycle/gate.go b/central/cluster/lifecycle/gate.go
new file mode 100644
index 0000000000000..cb1513f543220
--- /dev/null
+++ b/central/cluster/lifecycle/gate.go
@@ -0,0 +1,93 @@
+package lifecycle
+
+import (
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/sync"
+)
+
+// Gate serializes cluster deletion with writes that must not outlive the cluster.
+type Gate struct {
+	mu      sync.Mutex
+	entries map[string]*entry
+}
+
+type entry struct {
+	mu       sync.RWMutex
+	stateMu  sync.Mutex
+	deleting bool
+	refs     int
+}
+
+var singleton = New()
+
+// Singleton returns the process-wide cluster lifecycle gate.
+func Singleton() *Gate {
+	return singleton
+}
+
+// New creates a cluster lifecycle gate.
+func New() *Gate {
+	return &Gate{entries: make(map[string]*entry)}
+}
+
+// Enter acquires a shared lifecycle lease unless deletion has started. The
+// returned release function must be called when active is true.
+func (g *Gate) Enter(clusterID string) (active bool, release func()) {
+	e := g.retain(clusterID)
+
+	active = concurrency.WithLock1(&e.stateMu, func() bool {
+		if e.deleting {
+			return false
+		}
+		e.mu.RLock()
+		return true
+	})
+	if !active {
+		g.release(clusterID, e)
+		return false, nil
+	}
+
+	return true, func() {
+		concurrency.UnsafeRUnlock(&e.mu)
+		g.release(clusterID, e)
+	}
+}
+
+// BeginDeletion prevents new active writes and waits for in-flight writes to finish.
+// The returned function must be called once cluster cleanup completes.
+func (g *Gate) BeginDeletion(clusterID string) func() {
+	e := g.retain(clusterID)
+	concurrency.WithLock(&e.stateMu, func() {
+		e.deleting = true
+	})
+	// Drain in-flight read locks, then release.
+	concurrency.WithLock(&e.mu, func() {})
+
+	return func() {
+		concurrency.WithLock(&e.stateMu, func() {
+			e.deleting = false
+		})
+		g.release(clusterID, e)
+	}
+}
+
+func (g *Gate) retain(clusterID string) *entry {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	e := g.entries[clusterID]
+	if e == nil {
+		e = &entry{}
+		g.entries[clusterID] = e
+	}
+	e.refs++
+	return e
+}
+
+func (g *Gate) release(clusterID string, e *entry) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	e.refs--
+	if e.refs == 0 && !e.deleting {
+		delete(g.entries, clusterID)
+	}
+}
diff --git a/central/cluster/lifecycle/gate_test.go b/central/cluster/lifecycle/gate_test.go
new file mode 100644
index 0000000000000..5ad0da55a097f
--- /dev/null
+++ b/central/cluster/lifecycle/gate_test.go
@@ -0,0 +1,72 @@
+package lifecycle
+
+import (
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGateBlocksDeletionUntilActiveWriteCompletes(t *testing.T) {
+	clusterID := "cluster-id"
+
+	gate := New()
+	writeStarted := make(chan struct{})
+	releaseWrite := make(chan struct{})
+	writeFinished := make(chan struct{})
+	go func() {
+		active, release := gate.Enter(clusterID)
+		if !active {
+			t.Error("active write was rejected")
+			return
+		}
+		defer release()
+		close(writeStarted)
+		<-releaseWrite
+		close(writeFinished)
+	}()
+	<-writeStarted
+
+	deletionStarted := make(chan func(), 1)
+	go func() { deletionStarted <- gate.BeginDeletion(clusterID) }()
+	require.Eventually(t, func() bool {
+		active, release := gate.Enter(clusterID)
+		if release != nil {
+			release()
+		}
+
+		return !active
+	}, time.Second, 5*time.Millisecond)
+
+	// yield -> to give additional cycles to BeginDeletion.
+	runtime.Gosched()
+	require.Empty(t, deletionStarted)
+
+	close(releaseWrite)
+	<-writeFinished
+	releaseDeletion := <-deletionStarted
+	releaseDeletion()
+
+	active, release := gate.Enter(clusterID)
+	require.True(t, active)
+	release()
+}
+
+// TestBeginDeletionDropsWriteLockBeforeCleanup checks that BeginDeletion only
+// holds the write lock long enough to drain in-flight leases. The dev mutex
+// watchdog aborts the process if that lock stays held through cleanup.
+func TestBeginDeletionDropsWriteLockBeforeCleanup(t *testing.T) {
+	gate := New()
+	releaseDeletion := gate.BeginDeletion("cluster-id")
+	t.Cleanup(releaseDeletion)
+
+	e := gate.entries["cluster-id"]
+	require.NotNil(t, e)
+	require.True(t, e.mu.TryLock(), "write lock still held after BeginDeletion returned")
+	e.mu.Unlock()
+
+	active, release := gate.Enter("cluster-id")
+	require.False(t, active)
+	require.Nil(t, release)
+}
diff --git a/central/clusters/deployer.go b/central/clusters/deployer.go
index 7aafce48cb341..c7a8f1f38b449 100644
--- a/central/clusters/deployer.go
+++ b/central/clusters/deployer.go
@@ -32,7 +32,6 @@ func FieldsFromClusterAndRenderOpts(c *storage.Cluster, imageFlavor *defaults.Im
 
 	baseValues := getBaseMetaValues(c, imageFlavor, imageFlavor.ChartRepo, &opts)
 	setMainOverride(mainImage, baseValues)
-	deriveScannerRemoteFromMain(mainImage, baseValues)
 	baseValues.EnablePodSecurityPolicies = !opts.DisablePodSecurityPolicies
 
 	collector := determineCollectorImage(mainImage, collectorImage, imageFlavor)
@@ -61,15 +60,6 @@ func MakeClusterImageNames(flavor *defaults.ImageFlavor, c *storage.Cluster) (*s
 	return mainImageName, collectorImageName, nil
 }
 
-// deriveScannerRemoteFromMain sets scanner-slim image remote, so that it comes from the same location as the main image
-func deriveScannerRemoteFromMain(mainImage *storage.ImageName, metaValues *charts.MetaValues) {
-	scannerRemoteSlice := strings.Split(mainImage.GetRemote(), "/")
-	if len(scannerRemoteSlice) > 0 {
-		scannerRemoteSlice[len(scannerRemoteSlice)-1] = metaValues.ScannerSlimImageRemote
-		metaValues.ScannerSlimImageRemote = strings.Join(scannerRemoteSlice, "/")
-	}
-}
-
 // setMainOverride adds main image values to meta values as defined in secured cluster object.
 func setMainOverride(mainImage *storage.ImageName, metaValues *charts.MetaValues) {
 	metaValues.MainRegistry = mainImage.GetRegistry()
@@ -151,9 +141,6 @@ func getBaseMetaValues(c *storage.Cluster, imageFlavor *defaults.ImageFlavor, ch
 		FactImageTag:    versions.FactVersion,
 		FactImageRemote: imageFlavor.FactImageName,
 
-		ScannerImageTag:        versions.ScannerVersion,
-		ScannerSlimImageRemote: imageFlavor.ScannerSlimImageName,
-
 		KubectlOutput: true,
 
 		Versions: versions,
@@ -177,11 +164,10 @@ func getBaseMetaValues(c *storage.Cluster, imageFlavor *defaults.ImageFlavor, ch
 }
 
 func getFeatureFlagsAsManifestBundleEnv() map[string]string {
-	// For the environment variables we need to filter out ROX_SCANNER_V4, because it would
-	// wrongly enable Scanner V4 delegated scanning on secured clusters which are set up
-	// using manifest bundles. But delegated scanning is not supported for manifest bundle
-	// installed secured clusters.
-	skipFeatureFlags := set.NewFrozenStringSet("ROX_SCANNER_V4")
+	// ROX_SCANNER_V4 would enable delegated scanning, which bundles do not support.
+	// ROX_VIRTUAL_MACHINES is already set from virtualMachines.enabled; a duplicate
+	// env name would make kubectl apply fail to patch an existing Sensor Deployment.
+	skipFeatureFlags := set.NewFrozenStringSet("ROX_SCANNER_V4", "ROX_VIRTUAL_MACHINES")
 	featureFlagVals := make(map[string]string)
 	for _, feature := range features.Flags {
 		envVar := feature.EnvVar()
diff --git a/central/clusters/deployer_test.go b/central/clusters/deployer_test.go
index 8b15d537962cd..08e800b6dc56d 100644
--- a/central/clusters/deployer_test.go
+++ b/central/clusters/deployer_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/helm/charts"
 	"github.com/stackrox/rox/pkg/images/defaults"
 	flavorUtils "github.com/stackrox/rox/pkg/images/defaults/testutils"
@@ -17,10 +18,6 @@ func getCollectorImage(fields *charts.MetaValues) string {
 	return fmt.Sprintf("%s/%s:%s", fields.CollectorRegistry, fields.CollectorImageRemote, fields.CollectorImageTag)
 }
 
-func getScannerSlim(fields *charts.MetaValues) string {
-	return fmt.Sprintf("%s/%s:%s", fields.MainRegistry, fields.ScannerSlimImageRemote, fields.ScannerImageTag)
-}
-
 func getMain(fields *charts.MetaValues) string {
 	return fmt.Sprintf("%s/%s:%s", fields.MainRegistry, fields.ImageRemote, fields.ImageTag)
 }
@@ -113,121 +110,102 @@ func testMetaValueGenerationWithImageFlavor(s *deployerTestSuite, flavor default
 	defaultMainImage := flavor.MainImage()
 	defaultCollectorImageNoTag := flavor.CollectorImageNoTag()
 	defaultCollectorImage := flavor.CollectorImage()
-	defaultScannerSlimImage := flavor.ScannerSlimImage()
 
 	var cases = map[string]struct {
-		cluster                *storage.Cluster
-		expectedErrorMessage   string
-		expectedMain           string
-		expectedCollectorRef   string
-		expectedScannerSlimRef string
+		cluster              *storage.Cluster
+		expectedErrorMessage string
+		expectedMain         string
+		expectedCollectorRef string
 	}{
 		// we're testing possible main & collector combinations, grouped by main image setting
 
 		// default main image
 		"default main / no collector": {
-			cluster:                makeTestCluster(defaultMainImageNoTag, ""),
-			expectedMain:           defaultMainImage,
-			expectedCollectorRef:   defaultCollectorImage,
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(defaultMainImageNoTag, ""),
+			expectedMain:         defaultMainImage,
+			expectedCollectorRef: defaultCollectorImage,
 		},
 		"default main / default collector": {
-			cluster:                makeTestCluster(defaultMainImageNoTag, defaultCollectorImageNoTag),
-			expectedMain:           defaultMainImage,
-			expectedCollectorRef:   defaultCollectorImage,
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(defaultMainImageNoTag, defaultCollectorImageNoTag),
+			expectedMain:         defaultMainImage,
+			expectedCollectorRef: defaultCollectorImage,
 		},
 		"default main / default collector: custom tag": {
-			cluster:                makeTestCluster(defaultMainImageNoTag, fmt.Sprintf("%s:custom", defaultCollectorImageNoTag)),
-			expectedMain:           defaultMainImage,
-			expectedCollectorRef:   flavor.CollectorImage(),
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(defaultMainImageNoTag, fmt.Sprintf("%s:custom", defaultCollectorImageNoTag)),
+			expectedMain:         defaultMainImage,
+			expectedCollectorRef: flavor.CollectorImage(),
 		},
 		"default main / custom collector: with namespace": {
-			cluster:                makeTestCluster(defaultMainImage, "quay.io/rhacs/collector"),
-			expectedMain:           defaultMainImage,
-			expectedCollectorRef:   fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(defaultMainImage, "quay.io/rhacs/collector"),
+			expectedMain:         defaultMainImage,
+			expectedCollectorRef: fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
 		},
 		"default main / custom collector: with namespace & custom tag": {
-			cluster:                makeTestCluster(defaultMainImage, "quay.io/rhacs/collector:custom"),
-			expectedMain:           defaultMainImage,
-			expectedCollectorRef:   fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(defaultMainImage, "quay.io/rhacs/collector:custom"),
+			expectedMain:         defaultMainImage,
+			expectedCollectorRef: fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
 		},
 		"default main / custom collector: without namespace": {
-			cluster:                makeTestCluster(defaultMainImage, "example.io/collector"),
-			expectedMain:           defaultMainImage,
-			expectedCollectorRef:   fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(defaultMainImage, "example.io/collector"),
+			expectedMain:         defaultMainImage,
+			expectedCollectorRef: fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
 		},
 		"default main / custom collector: without namespace & custom tag": {
-			cluster:                makeTestCluster(defaultMainImage, "example.io/collector:custom"),
-			expectedMain:           defaultMainImage,
-			expectedCollectorRef:   fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(defaultMainImage, "example.io/collector:custom"),
+			expectedMain:         defaultMainImage,
+			expectedCollectorRef: fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
 		},
 		"default main: custom tag / no collector": {
-			cluster:                makeTestCluster(fmt.Sprintf("%s:custom", defaultMainImageNoTag), ""),
-			expectedMain:           fmt.Sprintf("%s:custom", defaultMainImageNoTag),
-			expectedCollectorRef:   defaultCollectorImage,
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(fmt.Sprintf("%s:custom", defaultMainImageNoTag), ""),
+			expectedMain:         fmt.Sprintf("%s:custom", defaultMainImageNoTag),
+			expectedCollectorRef: defaultCollectorImage,
 		},
 		"default main: custom tag / default collector": {
-			cluster:                makeTestCluster(fmt.Sprintf("%s:custom", defaultMainImageNoTag), ""),
-			expectedMain:           fmt.Sprintf("%s:custom", defaultMainImageNoTag),
-			expectedCollectorRef:   defaultCollectorImage,
-			expectedScannerSlimRef: defaultScannerSlimImage,
+			cluster:              makeTestCluster(fmt.Sprintf("%s:custom", defaultMainImageNoTag), ""),
+			expectedMain:         fmt.Sprintf("%s:custom", defaultMainImageNoTag),
+			expectedCollectorRef: defaultCollectorImage,
 		},
 		"default main: custom registry / no collector": {
-			cluster:                makeTestCluster("quay.io/rhacs/"+flavor.MainImageName, ""),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.MainImageName, flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/"+flavor.MainImageName, ""),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.MainImageName, flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
 		},
 
 		// custom main image
 		"custom main: with namespace / no collector": {
-			cluster:                makeTestCluster("quay.io/rhacs/main", ""),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/main", ""),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
 		},
 		"custom main: without namespace / no collector": {
-			cluster:                makeTestCluster("example.io/main", ""),
-			expectedMain:           fmt.Sprintf("example.io/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("example.io/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("example.io/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("example.io/main", ""),
+			expectedMain:         fmt.Sprintf("example.io/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("example.io/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
 		},
 		"custom main / default collector": {
-			cluster:                makeTestCluster("quay.io/rhacs/main", defaultCollectorImageNoTag),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   defaultCollectorImage,
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/main", defaultCollectorImageNoTag),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: defaultCollectorImage,
 		},
 		"custom main / custom collector: with namespace": {
-			cluster:                makeTestCluster("quay.io/rhacs/main", "quay.io/rhacs/collector"),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/main", "quay.io/rhacs/collector"),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
 		},
 		"custom main / custom collector: with namespace & custom tag": {
-			cluster:                makeTestCluster("quay.io/rhacs/main", "quay.io/rhacs/collector:custom"),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/main", "quay.io/rhacs/collector:custom"),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("quay.io/rhacs/collector:%s", flavor.CollectorImageTag),
 		},
 		"custom main / custom collector: without namespace": {
-			cluster:                makeTestCluster("quay.io/rhacs/main", "example.io/collector"),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/main", "example.io/collector"),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
 		},
 		"custom main / custom collector: without namespace & custom tag": {
-			cluster:                makeTestCluster("quay.io/rhacs/main", "example.io/collector:custom"),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/main", "example.io/collector:custom"),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("example.io/collector:%s", flavor.CollectorImageTag),
 		},
 		/*
 			// These tests are failing right now but should succeed after ROX-15691 has been implemented
@@ -243,16 +221,14 @@ func testMetaValueGenerationWithImageFlavor(s *deployerTestSuite, flavor default
 			},
 		*/
 		"custom main / custom collector: same registry, different namespaces": {
-			cluster:                makeTestCluster("quay.io/namespace-a/main", "quay.io/namespace-b/collector"),
-			expectedMain:           fmt.Sprintf("quay.io/namespace-a/main:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("quay.io/namespace-b/collector:%s", flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/namespace-a/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/namespace-a/main", "quay.io/namespace-b/collector"),
+			expectedMain:         fmt.Sprintf("quay.io/namespace-a/main:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("quay.io/namespace-b/collector:%s", flavor.CollectorImageTag),
 		},
 		"custom main: non-default name / no collector": {
-			cluster:                makeTestCluster("quay.io/rhacs/customname", ""),
-			expectedMain:           fmt.Sprintf("quay.io/rhacs/customname:%s", flavor.MainImageTag),
-			expectedCollectorRef:   fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
-			expectedScannerSlimRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.ScannerSlimImageName, flavor.ScannerImageTag),
+			cluster:              makeTestCluster("quay.io/rhacs/customname", ""),
+			expectedMain:         fmt.Sprintf("quay.io/rhacs/customname:%s", flavor.MainImageTag),
+			expectedCollectorRef: fmt.Sprintf("quay.io/rhacs/%s:%s", flavor.CollectorImageName, flavor.CollectorImageTag),
 		},
 		// Expected fail cases
 		"expectedError: empty main image": {
@@ -279,7 +255,6 @@ func testMetaValueGenerationWithImageFlavor(s *deployerTestSuite, flavor default
 				s.NoError(err)
 				s.Equal(c.expectedMain, getMain(fields), "Main image does not match")
 				s.Equal(c.expectedCollectorRef, getCollectorImage(fields), "Collector image does not match")
-				s.Equal(c.expectedScannerSlimRef, getScannerSlim(fields), "Scanner slim image does not match")
 			}
 		})
 	}
@@ -312,6 +287,15 @@ func (s *deployerTestSuite) TestFieldsFromClusterAndRenderOpts() {
 
 }
 
+// TestGetFeatureFlagsAsManifestBundleEnv_OmitsChartOwnedFlags checks that
+// certain flags (normally already set from chart config) are not also injected as EnvVars.
+func TestGetFeatureFlagsAsManifestBundleEnv_OmitsChartOwnedFlags(t *testing.T) {
+	t.Parallel()
+	env := getFeatureFlagsAsManifestBundleEnv()
+	assert.NotContains(t, env, features.ScannerV4.EnvVar())
+	assert.NotContains(t, env, features.VirtualMachines.EnvVar())
+}
+
 func TestRequiredFieldsArePresent(t *testing.T) {
 	testutils.SetExampleVersion(t)
 
@@ -328,7 +312,6 @@ func TestRequiredFieldsArePresent(t *testing.T) {
 	assert.NotEmpty(t, fields.Versions.ChartVersion)
 	assert.NotEmpty(t, fields.Versions.MainVersion)
 	assert.NotEmpty(t, fields.Versions.CollectorVersion)
-	assert.NotEmpty(t, fields.Versions.ScannerVersion)
 
 	assert.NotEmpty(t, fields.ChartRepo.URL)
 }
diff --git a/central/clusters/zip/render_test.go b/central/clusters/zip/render_test.go
index 45a5f34ddbe4c..d07839e397119 100644
--- a/central/clusters/zip/render_test.go
+++ b/central/clusters/zip/render_test.go
@@ -3,7 +3,6 @@ package zip
 import (
 	"bufio"
 	"bytes"
-	"strings"
 	"testing"
 
 	"github.com/stackrox/rox/central/clusters"
@@ -86,25 +85,10 @@ func doTestRenderOpenshif(t *testing.T, clusterType storage.ClusterType) {
 		assert.True(t, foundMain)
 		assert.Equal(t, "compliance", complianceCont.Name)
 
-		if clusterType == storage.ClusterType_OPENSHIFT4_CLUSTER {
-			nInvCont, found := findContainer(ds.Spec.Template.Spec.Containers, "node-inventory")
-			assert.True(t, found, "node-inventory container should exist under collector DS")
-			assert.Equal(t, "node-inventory", nInvCont.Name)
-
-			expectedScannerParts := strings.Split(strings.ReplaceAll(complianceCont.Image, "/main:", "/scanner-slim:"), ":")
-			assert.Truef(t, strings.HasPrefix(nInvCont.Image, expectedScannerParts[0]), "scanner-slim image (%q) should be from the same registry as main (%q)", nInvCont.Image, complianceCont.Image)
-
-			value, exists := getEnvVarValue(complianceCont.Env, env.NodeInventoryContainerEnabled.EnvVar())
-			assert.True(t, exists)
-			assert.Equal(t, "true", value, "compliance should have %s=true", env.NodeInventoryContainerEnabled.EnvVar())
-		} else {
-			_, foundNInv := findContainer(ds.Spec.Template.Spec.Containers, "node-inventory")
-			assert.False(t, foundNInv, "node-inventory container must not exist under collector DS")
-
-			value, exists := getEnvVarValue(complianceCont.Env, env.NodeInventoryContainerEnabled.EnvVar())
-			assert.True(t, exists)
-			assert.Equalf(t, "false", value, "compliance should have %s=false", env.NodeInventoryContainerEnabled.EnvVar())
-		}
+		_, exists := getEnvVarValue(complianceCont.Env, env.NodeInventoryContainerEnabled.EnvVar())
+		assert.False(t, exists, "compliance should not set %s; Go default is false", env.NodeInventoryContainerEnabled.EnvVar())
+		_, foundNInv := findContainer(ds.Spec.Template.Spec.Containers, "node-inventory")
+		assert.False(t, foundNInv, "node-inventory container must not exist under collector DS")
 	}
 
 	cases := map[string]func(object runtime.Object){
diff --git a/central/complianceoperator/v2/benchmark/benchmark.go b/central/complianceoperator/v2/benchmark/benchmark.go
index 28c677d0f6d84..53c3980bea2f1 100644
--- a/central/complianceoperator/v2/benchmark/benchmark.go
+++ b/central/complianceoperator/v2/benchmark/benchmark.go
@@ -22,11 +22,11 @@ var (
 		regexp.MustCompile(".+-nerc-cip$|.+-nerc-cip-.+"): {shortName: "NERC-CIP", provider: "NERC"},
 		regexp.MustCompile(".+-pci-dss$|.+-pci-dss-.+"):   {shortName: "PCI-DSS", provider: "PCI"},
 
-		regexp.MustCompile("^ocp4-cis$|^ocp4-cis-.+"):               {shortName: "CIS-OCP", provider: "CIS"},
-		regexp.MustCompile("^ocp4-high$|^ocp4-high-.+"):             {shortName: "NIST-800-53", provider: "NIST"},
-		regexp.MustCompile("^ocp4-moderate$|^ocp4-moderate-.+"):     {shortName: "NIST-800-53", provider: "NIST"},
-		regexp.MustCompile("^rhcos4-high$|^rhcos4-high-.+"):         {shortName: "NIST-800-53", provider: "NIST"},
-		regexp.MustCompile("^rhcos4-moderate$|^rhcos4-moderate-.+"): {shortName: "NIST-800-53", provider: "NIST"},
+		regexp.MustCompile("^ocp[45]-cis(-.+)?$"):        {shortName: "CIS-OCP", provider: "CIS"},
+		regexp.MustCompile("^ocp[45]-high(-.+)?$"):       {shortName: "NIST-800-53", provider: "NIST"},
+		regexp.MustCompile("^ocp[45]-moderate(-.+)?$"):   {shortName: "NIST-800-53", provider: "NIST"},
+		regexp.MustCompile("^rhcos[45]-high(-.+)?$"):     {shortName: "NIST-800-53", provider: "NIST"},
+		regexp.MustCompile("^rhcos[45]-moderate(-.+)?$"): {shortName: "NIST-800-53", provider: "NIST"},
 	}
 
 	log = logging.LoggerForModule()
diff --git a/central/complianceoperator/v2/benchmark/fixtures/bsi-benchmark-2022.json b/central/complianceoperator/v2/benchmark/fixtures/bsi-benchmark-2022.json
index 83c0710a20bfa..02cb0df653f4b 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/bsi-benchmark-2022.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/bsi-benchmark-2022.json
@@ -8,6 +8,12 @@
     { "profileName": "ocp4-bsi-2022" },
     { "profileName": "ocp4-bsi-node-2022" },
     { "profileName": "rhcos4-bsi" },
-    { "profileName": "rhcos4-bsi-2022" }
+    { "profileName": "rhcos4-bsi-2022" },
+    { "profileName": "ocp5-bsi" },
+    { "profileName": "ocp5-bsi-node" },
+    { "profileName": "ocp5-bsi-2022" },
+    { "profileName": "ocp5-bsi-node-2022" },
+    { "profileName": "rhcos5-bsi" },
+    { "profileName": "rhcos5-bsi-2022" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-4.json b/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-4.json
index 4abed7a261874..c2eb1d26c2b20 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-4.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-4.json
@@ -4,6 +4,8 @@
   "shortName": "CIS-OCP",
   "profiles": [
     { "profileName": "ocp4-cis-1-4" },
-    { "profileName": "ocp4-cis-node-1-4" }
+    { "profileName": "ocp4-cis-node-1-4" },
+    { "profileName": "ocp5-cis-1-4" },
+    { "profileName": "ocp5-cis-node-1-4" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-5.json b/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-5.json
index 1910846e70fbf..1b26b8c2cfe5d 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-5.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-5.json
@@ -4,6 +4,8 @@
   "shortName": "CIS-OCP",
   "profiles": [
     { "profileName": "ocp4-cis-1-5" },
-    { "profileName": "ocp4-cis-node-1-5" }
+    { "profileName": "ocp4-cis-node-1-5" },
+    { "profileName": "ocp5-cis-1-5" },
+    { "profileName": "ocp5-cis-node-1-5" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-7.json b/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-7.json
index 951f7f4b4da16..2a7f7909aa843 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-7.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/cis-benchmark-1-7.json
@@ -6,6 +6,10 @@
     { "profileName": "ocp4-cis" },
     { "profileName": "ocp4-cis-node" },
     { "profileName": "ocp4-cis-1-7" },
-    { "profileName": "ocp4-cis-node-1-7" }
+    { "profileName": "ocp4-cis-node-1-7" },
+    { "profileName": "ocp5-cis" },
+    { "profileName": "ocp5-cis-node" },
+    { "profileName": "ocp5-cis-1-7" },
+    { "profileName": "ocp5-cis-node-1-7" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v1r1.json b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v1r1.json
index 80e96a831ccfb..dbdea4bdf9cd3 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v1r1.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v1r1.json
@@ -5,6 +5,9 @@
   "profiles": [
     { "profileName": "ocp4-stig-v1r1" },
     { "profileName": "ocp4-stig-node-v1r1" },
-    { "profileName": "rhcos4-stig-v1r1" }
+    { "profileName": "rhcos4-stig-v1r1" },
+    { "profileName": "ocp5-stig-v1r1" },
+    { "profileName": "ocp5-stig-node-v1r1" },
+    { "profileName": "rhcos5-stig-v1r1" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r1.json b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r1.json
index cee74738e8284..1e766128d4e01 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r1.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r1.json
@@ -5,6 +5,9 @@
   "profiles": [
     { "profileName": "ocp4-stig-v2r1" },
     { "profileName": "ocp4-stig-node-v2r1" },
-    { "profileName": "rhcos4-stig-v2r1" }
+    { "profileName": "rhcos4-stig-v2r1" },
+    { "profileName": "ocp5-stig-v2r1" },
+    { "profileName": "ocp5-stig-node-v2r1" },
+    { "profileName": "rhcos5-stig-v2r1" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r2.json b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r2.json
index 1a2f7a5d425d6..3905957e625bb 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r2.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r2.json
@@ -5,6 +5,9 @@
   "profiles": [
     { "profileName": "ocp4-stig-v2r2" },
     { "profileName": "ocp4-stig-node-v2r2" },
-    { "profileName": "rhcos4-stig-v2r2" }
+    { "profileName": "rhcos4-stig-v2r2" },
+    { "profileName": "ocp5-stig-v2r2" },
+    { "profileName": "ocp5-stig-node-v2r2" },
+    { "profileName": "rhcos5-stig-v2r2" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r3.json b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r3.json
index af9f11f83304b..9d84177943bfc 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r3.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/disa-stig-benchmark-v2r3.json
@@ -8,6 +8,12 @@
     { "profileName": "rhcos4-stig" },
     { "profileName": "ocp4-stig-v2r3" },
     { "profileName": "ocp4-stig-node-v2r3" },
-    { "profileName": "rhcos4-stig-v2r3" }
+    { "profileName": "rhcos4-stig-v2r3" },
+    { "profileName": "ocp5-stig" },
+    { "profileName": "ocp5-stig-node" },
+    { "profileName": "rhcos5-stig" },
+    { "profileName": "ocp5-stig-v2r3" },
+    { "profileName": "ocp5-stig-node-v2r3" },
+    { "profileName": "rhcos5-stig-v2r3" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/e8-benchmark.json b/central/complianceoperator/v2/benchmark/fixtures/e8-benchmark.json
index 410f8560979bd..08dea2d91bc10 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/e8-benchmark.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/e8-benchmark.json
@@ -4,6 +4,8 @@
   "shortName": "E8",
   "profiles": [
     { "profileName": "ocp4-e8" },
-    { "profileName": "rhcos4-e8" }
+    { "profileName": "rhcos4-e8" },
+    { "profileName": "ocp5-e8" },
+    { "profileName": "rhcos5-e8" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/nerc-benchmark.json b/central/complianceoperator/v2/benchmark/fixtures/nerc-benchmark.json
index f39e001ca8353..902f626a95900 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/nerc-benchmark.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/nerc-benchmark.json
@@ -5,6 +5,9 @@
   "profiles": [
     { "profileName": "ocp4-nerc-cip" },
     { "profileName": "ocp4-nerc-cip-node" },
-    { "profileName": "rhcos4-nerc-cip" }
+    { "profileName": "rhcos4-nerc-cip" },
+    { "profileName": "ocp5-nerc-cip" },
+    { "profileName": "ocp5-nerc-cip-node" },
+    { "profileName": "rhcos5-nerc-cip" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/nist-high-benchmark-revision-4.json b/central/complianceoperator/v2/benchmark/fixtures/nist-high-benchmark-revision-4.json
index cdee4264d7f50..e2fe05c6f5106 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/nist-high-benchmark-revision-4.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/nist-high-benchmark-revision-4.json
@@ -8,6 +8,12 @@
     { "profileName": "rhcos4-high" },
     { "profileName": "ocp4-high-rev-4" },
     { "profileName": "ocp4-high-node-rev-4" },
-    { "profileName": "rhcos4-high-rev-4" }
+    { "profileName": "rhcos4-high-rev-4" },
+    { "profileName": "ocp5-high" },
+    { "profileName": "ocp5-high-node" },
+    { "profileName": "rhcos5-high" },
+    { "profileName": "ocp5-high-rev-4" },
+    { "profileName": "ocp5-high-node-rev-4" },
+    { "profileName": "rhcos5-high-rev-4" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/nist-moderate-benchmark-revision-4.json b/central/complianceoperator/v2/benchmark/fixtures/nist-moderate-benchmark-revision-4.json
index b4e1d384f045c..f0e58f494995c 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/nist-moderate-benchmark-revision-4.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/nist-moderate-benchmark-revision-4.json
@@ -8,6 +8,12 @@
     { "profileName": "rhcos4-moderate" },
     { "profileName": "ocp4-moderate-rev-4" },
     { "profileName": "ocp4-moderate-node-rev-4" },
-    { "profileName": "rhcos4-moderate-rev-4" }
+    { "profileName": "rhcos4-moderate-rev-4" },
+    { "profileName": "ocp5-moderate" },
+    { "profileName": "ocp5-moderate-node" },
+    { "profileName": "rhcos5-moderate" },
+    { "profileName": "ocp5-moderate-rev-4" },
+    { "profileName": "ocp5-moderate-node-rev-4" },
+    { "profileName": "rhcos5-moderate-rev-4" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-3-2-1.json b/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-3-2-1.json
index e69ad1ee5ac6b..4627c8f76eece 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-3-2-1.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-3-2-1.json
@@ -6,6 +6,10 @@
     { "profileName": "ocp4-pci-dss" },
     { "profileName": "ocp4-pci-dss-node" },
     { "profileName": "ocp4-pci-dss-3-2" },
-    { "profileName": "ocp4-pci-dss-node-3-2" }
+    { "profileName": "ocp4-pci-dss-node-3-2" },
+    { "profileName": "ocp5-pci-dss" },
+    { "profileName": "ocp5-pci-dss-node" },
+    { "profileName": "ocp5-pci-dss-3-2" },
+    { "profileName": "ocp5-pci-dss-node-3-2" }
   ]
 }
diff --git a/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-4-0.json b/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-4-0.json
index b2965bca8b530..2e8d506a5bc57 100644
--- a/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-4-0.json
+++ b/central/complianceoperator/v2/benchmark/fixtures/pci-benchmark-4-0.json
@@ -4,6 +4,8 @@
   "shortName": "PCI-DSS",
   "profiles": [
     { "profileName": "ocp4-pci-dss-4-0" },
-    { "profileName": "ocp4-pci-dss-node-4-0" }
+    { "profileName": "ocp4-pci-dss-node-4-0" },
+    { "profileName": "ocp5-pci-dss-4-0" },
+    { "profileName": "ocp5-pci-dss-node-4-0" }
   ]
 }
diff --git a/central/convert/internaltostorage/virtual_machine_v2.go b/central/convert/internaltostorage/virtual_machine_v2.go
index 95bdfbd32b16b..34af48f85c62a 100644
--- a/central/convert/internaltostorage/virtual_machine_v2.go
+++ b/central/convert/internaltostorage/virtual_machine_v2.go
@@ -12,9 +12,9 @@ func VirtualMachineV2(vm *virtualMachineV1.VirtualMachine) *storage.VirtualMachi
 		return nil
 	}
 
-	guestOS := vm.GetFacts()[pkgVM.GuestOSKey]
-	if guestOS == "" {
-		guestOS = pkgVM.UnknownGuestOS
+	informerOS := vm.GetFacts()[pkgVM.GuestOSKey]
+	if informerOS == "" {
+		informerOS = pkgVM.UnknownGuestOS
 	}
 
 	return &storage.VirtualMachineV2{
@@ -23,7 +23,7 @@ func VirtualMachineV2(vm *virtualMachineV1.VirtualMachine) *storage.VirtualMachi
 		Namespace: vm.GetNamespace(),
 		ClusterId: vm.GetClusterId(),
 		Facts:     vm.GetFacts(),
-		GuestOs:   guestOS,
+		GuestOs:   pkgVM.DisplayGuestOS(vm.GetFacts(), informerOS),
 		State:     convertVirtualMachineV2State(vm.GetState()),
 		VsockCid:  vm.GetVsockCid(),
 	}
diff --git a/central/convert/internaltostorage/virtual_machine_v2_test.go b/central/convert/internaltostorage/virtual_machine_v2_test.go
index 73bc39ab420a9..63047a6b157d7 100644
--- a/central/convert/internaltostorage/virtual_machine_v2_test.go
+++ b/central/convert/internaltostorage/virtual_machine_v2_test.go
@@ -48,6 +48,34 @@ func TestVirtualMachineV2(t *testing.T) {
 				State:    storage.VirtualMachineV2_RUNNING,
 			},
 		},
+		{
+			name: "writes detected guest OS into GuestOs column",
+			input: &virtualMachineV1.VirtualMachine{
+				Id:        "VM-ID-3",
+				Namespace: "ns",
+				Name:      "vm-agent-facts",
+				ClusterId: uuid.NewTestUUID(3).String(),
+				Facts: map[string]string{
+					pkgVM.GuestOSKey:         "Red Hat Enterprise Linux",
+					pkgVM.DetectedGuestOSKey: "Red Hat Enterprise Linux 9.2",
+					pkgVM.AgentVersionKey:    "4.10.0",
+				},
+				State: virtualMachineV1.VirtualMachine_RUNNING,
+			},
+			expected: &storage.VirtualMachineV2{
+				Id:        "VM-ID-3",
+				Namespace: "ns",
+				Name:      "vm-agent-facts",
+				ClusterId: uuid.NewTestUUID(3).String(),
+				Facts: map[string]string{
+					pkgVM.GuestOSKey:         "Red Hat Enterprise Linux",
+					pkgVM.DetectedGuestOSKey: "Red Hat Enterprise Linux 9.2",
+					pkgVM.AgentVersionKey:    "4.10.0",
+				},
+				GuestOs: "Red Hat Enterprise Linux 9.2",
+				State:   storage.VirtualMachineV2_RUNNING,
+			},
+		},
 		{
 			name: "virtual machine without guestOS fact",
 			input: &virtualMachineV1.VirtualMachine{
diff --git a/central/convert/storagetov2/virtual_machine_v2.go b/central/convert/storagetov2/virtual_machine_v2.go
index b1d32d718b991..c93dbcf03efbd 100644
--- a/central/convert/storagetov2/virtual_machine_v2.go
+++ b/central/convert/storagetov2/virtual_machine_v2.go
@@ -2,10 +2,12 @@ package storagetov2
 
 import (
 	"slices"
+	"time"
 
 	"github.com/stackrox/rox/central/views/common"
 	v2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/generated/storage"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 // VirtualMachineV2ToListItem converts a storage VM V2 to an API list item.
@@ -49,6 +51,18 @@ func VirtualMachineV2ToDetail(vm *storage.VirtualMachineV2) *v2.VMDetail {
 	}
 }
 
+// AgentStatusFromLastContact maps scrape freshness onto the GetVM enum.
+// A nil/invalid timestamp is UNKNOWN; age >= staleAfter is INACTIVE.
+func AgentStatusFromLastContact(ts *timestamppb.Timestamp, now time.Time, staleAfter time.Duration) v2.AgentStatus {
+	if ts == nil || !ts.IsValid() {
+		return v2.AgentStatus_AGENT_STATUS_UNKNOWN
+	}
+	if now.Sub(ts.AsTime()) < staleAfter {
+		return v2.AgentStatus_AGENT_STATUS_ACTIVE
+	}
+	return v2.AgentStatus_AGENT_STATUS_INACTIVE
+}
+
 func convertVMNote(note storage.VirtualMachineV2_Note) v2.VMNote {
 	switch note {
 	case storage.VirtualMachineV2_MISSING_SCAN_DATA:
diff --git a/central/convert/storagetov2/virtual_machine_v2_test.go b/central/convert/storagetov2/virtual_machine_v2_test.go
index c62cdaf940aa5..8381abddf867a 100644
--- a/central/convert/storagetov2/virtual_machine_v2_test.go
+++ b/central/convert/storagetov2/virtual_machine_v2_test.go
@@ -2,10 +2,14 @@ package storagetov2
 
 import (
 	"testing"
+	"time"
 
 	v2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/generated/storage"
+	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 func TestVirtualMachineV2ToDetail_Notes(t *testing.T) {
@@ -50,3 +54,83 @@ func TestVirtualMachineV2ToDetail_Notes(t *testing.T) {
 		})
 	}
 }
+
+func TestAgentStatusFromLastContact(t *testing.T) {
+	now := time.Unix(1_700_000_000, 0).UTC()
+	staleAfter := 12 * time.Hour
+
+	tests := map[string]struct {
+		ts       *timestamppb.Timestamp
+		expected v2.AgentStatus
+	}{
+		"should return unknown when never scraped": {
+			ts:       nil,
+			expected: v2.AgentStatus_AGENT_STATUS_UNKNOWN,
+		},
+		"should return unknown when timestamp is invalid": {
+			ts:       &timestamppb.Timestamp{Nanos: 2_000_000_000},
+			expected: v2.AgentStatus_AGENT_STATUS_UNKNOWN,
+		},
+		"should return active when last scrape is still inside the window": {
+			ts:       timestamppb.New(now.Add(-time.Hour)),
+			expected: v2.AgentStatus_AGENT_STATUS_ACTIVE,
+		},
+		"should return inactive when last scrape is exactly the window": {
+			ts:       timestamppb.New(now.Add(-staleAfter)),
+			expected: v2.AgentStatus_AGENT_STATUS_INACTIVE,
+		},
+		"should return inactive when last scrape is older than the window": {
+			ts:       timestamppb.New(now.Add(-13 * time.Hour)),
+			expected: v2.AgentStatus_AGENT_STATUS_INACTIVE,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tc.expected, AgentStatusFromLastContact(tc.ts, now, staleAfter))
+		})
+	}
+}
+
+func TestVirtualMachineV2GuestOsDisplay(t *testing.T) {
+	tests := map[string]struct {
+		facts    map[string]string
+		storedOS string
+		want     string
+	}{
+		"returns stored guest OS": {
+			facts: map[string]string{
+				pkgVM.DetectedGuestOSKey: "Red Hat Enterprise Linux 9.2",
+				pkgVM.GuestOSKey:         "Red Hat Enterprise Linux",
+			},
+			storedOS: "Red Hat Enterprise Linux 9.2",
+			want:     "Red Hat Enterprise Linux 9.2",
+		},
+		"returns stored guest OS when detected is absent": {
+			facts:    map[string]string{pkgVM.GuestOSKey: "Red Hat Enterprise Linux"},
+			storedOS: "Red Hat Enterprise Linux",
+			want:     "Red Hat Enterprise Linux",
+		},
+		"does not overlay detected onto the stored column": {
+			facts: map[string]string{
+				pkgVM.DetectedGuestOSKey: "Red Hat Enterprise Linux 9.2",
+				pkgVM.GuestOSKey:         "Red Hat Enterprise Linux",
+			},
+			storedOS: "Red Hat Enterprise Linux",
+			want:     "Red Hat Enterprise Linux",
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			vm := &storage.VirtualMachineV2{
+				Id:      "vm-1",
+				Facts:   tt.facts,
+				GuestOs: tt.storedOS,
+			}
+			assert.Equal(t, tt.want, VirtualMachineV2ToDetail(vm).GetGuestOs())
+			assert.Equal(t, tt.want, VirtualMachineV2ToListItem(vm).GetGuestOs())
+			assert.Equal(t, tt.storedOS, vm.GetGuestOs())
+		})
+	}
+}
diff --git a/central/convert/v1tov2storage/vm_scan_parts.go b/central/convert/v1tov2storage/vm_scan_parts.go
index c14d9d9bb0cb3..9f83ccb53dcce 100644
--- a/central/convert/v1tov2storage/vm_scan_parts.go
+++ b/central/convert/v1tov2storage/vm_scan_parts.go
@@ -54,6 +54,7 @@ func ScanPartsFromV1Scan(vmID string, scan *storage.VirtualMachineScan) *common.
 			},
 			FixedBy:  highestFixedBy(comp.GetVulnerabilities()),
 			CveCount: compCveCount,
+			Notes:    convertComponentNotes(comp.GetNotes()),
 		})
 	}
 
@@ -126,6 +127,14 @@ func convertCVEBaseInfo(info *storage.VirtualMachineCVEInfo) *storage.CVEInfo {
 		})
 	}
 
+	var epss *storage.EPSS
+	if e := info.GetEpss(); e != nil {
+		epss = &storage.EPSS{
+			EpssProbability: e.GetEpssProbability(),
+			EpssPercentile:  e.GetEpssPercentile(),
+		}
+	}
+
 	return &storage.CVEInfo{
 		Cve:          info.GetCve(),
 		Summary:      info.GetSummary(),
@@ -135,7 +144,24 @@ func convertCVEBaseInfo(info *storage.VirtualMachineCVEInfo) *storage.CVEInfo {
 		LastModified: info.GetLastModified(),
 		CvssMetrics:  info.GetCvssMetrics(),
 		References:   refs,
+		Epss:         epss,
+	}
+}
+
+func convertComponentNotes(notes []storage.EmbeddedVirtualMachineScanComponent_Note) []storage.VirtualMachineComponentV2_Note {
+	if len(notes) == 0 {
+		return nil
 	}
+	out := make([]storage.VirtualMachineComponentV2_Note, 0, len(notes))
+	for _, n := range notes {
+		switch n {
+		case storage.EmbeddedVirtualMachineScanComponent_UNSCANNED:
+			out = append(out, storage.VirtualMachineComponentV2_UNSCANNED)
+		default:
+			out = append(out, storage.VirtualMachineComponentV2_UNSPECIFIED)
+		}
+	}
+	return out
 }
 
 func convertScanNotes(notes []storage.VirtualMachineScan_Note) []storage.VirtualMachineScanV2_Note {
diff --git a/central/convert/v1tov2storage/vm_scan_parts_test.go b/central/convert/v1tov2storage/vm_scan_parts_test.go
index 57d09ba60d726..7810642a9e9ee 100644
--- a/central/convert/v1tov2storage/vm_scan_parts_test.go
+++ b/central/convert/v1tov2storage/vm_scan_parts_test.go
@@ -3,6 +3,8 @@ package v1tov2storage
 import (
 	"testing"
 
+	"github.com/stackrox/rox/central/convert/storagetov2"
+	v2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -116,6 +118,50 @@ func TestScanPartsFromV1Scan_WithComponentsAndVulns(t *testing.T) {
 	assert.Equal(t, "openssl", result.SourceComponents[0].GetName())
 }
 
+func TestScanPartsFromV1Scan_PreservesComponentNotes(t *testing.T) {
+	tests := map[string]struct {
+		notes          []storage.EmbeddedVirtualMachineScanComponent_Note
+		wantNotes      []storage.VirtualMachineComponentV2_Note
+		wantScanStatus v2.ScanStatus
+	}{
+		"should map UNSCANNED notes to NOT_SCANNED on the V2 row": {
+			notes: []storage.EmbeddedVirtualMachineScanComponent_Note{
+				storage.EmbeddedVirtualMachineScanComponent_UNSCANNED,
+			},
+			wantNotes: []storage.VirtualMachineComponentV2_Note{
+				storage.VirtualMachineComponentV2_UNSCANNED,
+			},
+			wantScanStatus: v2.ScanStatus_NOT_SCANNED,
+		},
+		"should treat a component with no notes as scanned": {
+			wantScanStatus: v2.ScanStatus_SCANNED,
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			result := ScanPartsFromV1Scan("vm-1", &storage.VirtualMachineScan{
+				OperatingSystem: "rhel:9",
+				Components: []*storage.EmbeddedVirtualMachineScanComponent{
+					{
+						Name:    "curl",
+						Version: "7.0",
+						Source:  storage.SourceType_OS,
+						Notes:   tt.notes,
+					},
+				},
+			})
+			require.NotNil(t, result)
+			require.Len(t, result.Components, 1)
+			assert.Equal(t, tt.wantNotes, result.Components[0].GetNotes())
+
+			row := storagetov2.VirtualMachineComponentV2ToRow(result.Components[0])
+			require.NotNil(t, row)
+			assert.Equal(t, tt.wantScanStatus, row.GetScanStatus())
+		})
+	}
+}
+
 func TestCompareVersionSegments(t *testing.T) {
 	tests := []struct {
 		name string
diff --git a/central/cve/cluster/datastore/store/postgres/store.go b/central/cve/cluster/datastore/store/postgres/store.go
index 363da067cdea3..ef90c0d4b9e6b 100644
--- a/central/cve/cluster/datastore/store/postgres/store.go
+++ b/central/cve/cluster/datastore/store/postgres/store.go
@@ -106,6 +106,7 @@ func insertIntoClusterCves(batch *pgx.Batch, obj *storage.ClusterCVE) error {
 		protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 		obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 		obj.GetCveBaseInfo().GetCisaKev(),
+		obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 		obj.GetCvss(),
 		obj.GetSeverity(),
 		obj.GetImpactScore(),
@@ -115,7 +116,7 @@ func insertIntoClusterCves(batch *pgx.Batch, obj *storage.ClusterCVE) error {
 		serialized,
 	}
 
-	finalStr := "INSERT INTO cluster_cves (Id, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, Cvss, Severity, ImpactScore, Snoozed, SnoozeExpiry, Type, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Snoozed = EXCLUDED.Snoozed, SnoozeExpiry = EXCLUDED.SnoozeExpiry, Type = EXCLUDED.Type, serialized = EXCLUDED.serialized"
+	finalStr := "INSERT INTO cluster_cves (Id, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign, Cvss, Severity, ImpactScore, Snoozed, SnoozeExpiry, Type, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign = EXCLUDED.CveBaseInfo_KnownRansomwareCampaign, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Snoozed = EXCLUDED.Snoozed, SnoozeExpiry = EXCLUDED.SnoozeExpiry, Type = EXCLUDED.Type, serialized = EXCLUDED.serialized"
 	batch.Queue(finalStr, values...)
 
 	return nil
@@ -128,6 +129,7 @@ var copyColsClusterCves = []string{
 	"cvebaseinfo_createdat",
 	"cvebaseinfo_epss_epssprobability",
 	"cvebaseinfo_cisakev",
+	"cvebaseinfo_knownransomwarecampaign",
 	"cvss",
 	"severity",
 	"impactscore",
@@ -174,6 +176,7 @@ func copyFromClusterCves(ctx context.Context, s pgSearch.Deleter, tx *postgres.T
 			protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 			obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 			obj.GetCveBaseInfo().GetCisaKev(),
+			obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 			obj.GetCvss(),
 			obj.GetSeverity(),
 			obj.GetImpactScore(),
diff --git a/central/cve/converter/utils/convert_utils.go b/central/cve/converter/utils/convert_utils.go
index cddd6d82bf5b8..a910783666165 100644
--- a/central/cve/converter/utils/convert_utils.go
+++ b/central/cve/converter/utils/convert_utils.go
@@ -214,7 +214,7 @@ func ImageCVEToEmbeddedVulnerability(vuln *storage.ImageCVE) *storage.EmbeddedVu
 		NvdCvss:               vuln.GetNvdcvss(),
 		Epss:                  vuln.GetCveBaseInfo().GetEpss(),
 		Exploit:               vuln.GetCveBaseInfo().GetExploit(),
-		CisaKev:               vuln.GetCveBaseInfo().GetExploit() != nil,
+		CisaKev:               vuln.GetCveBaseInfo().GetCisaKev(),
 	}
 	if vuln.GetCveBaseInfo().GetCvssV3() != nil {
 		embeddedCVE.ScoreVersion = storage.EmbeddedVulnerability_V3
@@ -292,17 +292,18 @@ func EmbeddedVulnerabilityToImageCVE(os string, from *storage.EmbeddedVulnerabil
 		Id:              cve.ID(from.GetCve(), os),
 		OperatingSystem: os,
 		CveBaseInfo: &storage.CVEInfo{
-			Cve:          from.GetCve(),
-			Summary:      from.GetSummary(),
-			Link:         from.GetLink(),
-			PublishedOn:  from.GetPublishedOn(),
-			CreatedAt:    from.GetFirstSystemOccurrence(),
-			LastModified: from.GetLastModified(),
-			CvssV2:       from.GetCvssV2(),
-			CvssV3:       from.GetCvssV3(),
-			Epss:         from.GetEpss(),
-			Exploit:      from.GetExploit(),
-			CisaKev:      from.GetExploit() != nil,
+			Cve:                     from.GetCve(),
+			Summary:                 from.GetSummary(),
+			Link:                    from.GetLink(),
+			PublishedOn:             from.GetPublishedOn(),
+			CreatedAt:               from.GetFirstSystemOccurrence(),
+			LastModified:            from.GetLastModified(),
+			CvssV2:                  from.GetCvssV2(),
+			CvssV3:                  from.GetCvssV3(),
+			Epss:                    from.GetEpss(),
+			Exploit:                 from.GetExploit(),
+			CisaKev:                 from.GetCisaKev(),
+			KnownRansomwareCampaign: from.GetExploit() != nil && from.GetExploit().GetKnownRansomwareCampaignUse() == "Known",
 		},
 		Cvss:            from.GetCvss(),
 		Nvdcvss:         nvdCvss,
diff --git a/central/cve/converter/utils/convert_utils_v2.go b/central/cve/converter/utils/convert_utils_v2.go
index 432f6a8131c25..c02e2f9b3b4d2 100644
--- a/central/cve/converter/utils/convert_utils_v2.go
+++ b/central/cve/converter/utils/convert_utils_v2.go
@@ -36,6 +36,7 @@ func ImageCVEV2ToEmbeddedVulnerability(vuln *storage.ImageCVEV2) *storage.Embedd
 		VulnerabilityTypes:    []storage.EmbeddedVulnerability_VulnerabilityType{storage.EmbeddedVulnerability_IMAGE_VULNERABILITY},
 		State:                 vuln.GetState(),
 		Datasource:            vuln.GetDatasource(),
+		Origin:                vuln.GetOrigin(),
 	}
 
 	if vuln.GetIsFixable() {
@@ -86,19 +87,20 @@ func EmbeddedVulnerabilityToImageCVEV2(imageID string, componentID string, index
 		Id:          cveID,
 		ComponentId: componentID,
 		CveBaseInfo: &storage.CVEInfo{
-			Cve:          from.GetCve(),
-			Summary:      from.GetSummary(),
-			Link:         from.GetLink(),
-			PublishedOn:  from.GetPublishedOn(),
-			CreatedAt:    from.GetFirstSystemOccurrence(),
-			LastModified: from.GetLastModified(),
-			CvssV2:       from.GetCvssV2(),
-			CvssV3:       from.GetCvssV3(),
-			CvssMetrics:  from.GetCvssMetrics(),
-			Epss:         from.GetEpss(),
-			Exploit:      from.GetExploit(),
-			CisaKev:      from.GetExploit() != nil,
-			ScoreVersion: scoreVersion,
+			Cve:                     from.GetCve(),
+			Summary:                 from.GetSummary(),
+			Link:                    from.GetLink(),
+			PublishedOn:             from.GetPublishedOn(),
+			CreatedAt:               from.GetFirstSystemOccurrence(),
+			LastModified:            from.GetLastModified(),
+			CvssV2:                  from.GetCvssV2(),
+			CvssV3:                  from.GetCvssV3(),
+			CvssMetrics:             from.GetCvssMetrics(),
+			Epss:                    from.GetEpss(),
+			Exploit:                 from.GetExploit(),
+			CisaKev:                 from.GetExploit() != nil,
+			KnownRansomwareCampaign: from.GetExploit() != nil && from.GetExploit().GetKnownRansomwareCampaignUse() == "Known",
+			ScoreVersion:            scoreVersion,
 		},
 		Cvss:                  from.GetCvss(),
 		Nvdcvss:               nvdCvss,
@@ -111,6 +113,7 @@ func EmbeddedVulnerabilityToImageCVEV2(imageID string, componentID string, index
 		ImpactScore:           impactScore,
 		Advisory:              from.GetAdvisory(),
 		Datasource:            from.GetDatasource(),
+		Origin:                from.GetOrigin(),
 	}
 	if !features.FlattenImageData.Enabled() {
 		ret.ImageId = imageID
diff --git a/central/cve/converter/utils/convert_utils_v2_test.go b/central/cve/converter/utils/convert_utils_v2_test.go
index ef2188bdb06fc..d4cdc4c5b4348 100644
--- a/central/cve/converter/utils/convert_utils_v2_test.go
+++ b/central/cve/converter/utils/convert_utils_v2_test.go
@@ -101,6 +101,7 @@ var (
 			},
 			CisaKev:    true,
 			Datasource: "test-ds",
+			Origin:     storage.VulnOrigin_VULN_ORIGIN_RED_HAT,
 		},
 		{
 			Cve:     "cve2",
@@ -244,6 +245,7 @@ func getTestCVEs(t *testing.T) []*storage.ImageCVEV2 {
 		HasFixedBy:           nil,
 		ComponentId:          getTestComponentID(0),
 		Datasource:           "test-ds",
+		Origin:               storage.VulnOrigin_VULN_ORIGIN_RED_HAT,
 	}
 
 	cve2 := &storage.ImageCVEV2{
diff --git a/central/cve/image/v2/datastore/store/postgres/store.go b/central/cve/image/v2/datastore/store/postgres/store.go
index 8e98d58955c64..d76c93ecd28f4 100644
--- a/central/cve/image/v2/datastore/store/postgres/store.go
+++ b/central/cve/image/v2/datastore/store/postgres/store.go
@@ -108,6 +108,7 @@ func insertIntoImageCvesV2(batch *pgx.Batch, obj *storage.ImageCVEV2) error {
 		protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 		obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 		obj.GetCveBaseInfo().GetCisaKev(),
+		obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 		obj.GetCvss(),
 		obj.GetSeverity(),
 		obj.GetImpactScore(),
@@ -121,10 +122,11 @@ func insertIntoImageCvesV2(batch *pgx.Batch, obj *storage.ImageCVEV2) error {
 		obj.GetAdvisory().GetLink(),
 		pgutils.NilOrString(obj.GetImageIdV2()),
 		protocompat.NilOrTime(obj.GetFixAvailableTimestamp()),
+		obj.GetOrigin(),
 		serialized,
 	}
 
-	finalStr := "INSERT INTO image_cves_v2 (Id, ImageId, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, Cvss, Severity, ImpactScore, Nvdcvss, FirstImageOccurrence, State, IsFixable, FixedBy, ComponentId, Advisory_Name, Advisory_Link, ImageIdV2, FixAvailableTimestamp, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, ImageId = EXCLUDED.ImageId, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, FirstImageOccurrence = EXCLUDED.FirstImageOccurrence, State = EXCLUDED.State, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, ComponentId = EXCLUDED.ComponentId, Advisory_Name = EXCLUDED.Advisory_Name, Advisory_Link = EXCLUDED.Advisory_Link, ImageIdV2 = EXCLUDED.ImageIdV2, FixAvailableTimestamp = EXCLUDED.FixAvailableTimestamp, serialized = EXCLUDED.serialized"
+	finalStr := "INSERT INTO image_cves_v2 (Id, ImageId, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign, Cvss, Severity, ImpactScore, Nvdcvss, FirstImageOccurrence, State, IsFixable, FixedBy, ComponentId, Advisory_Name, Advisory_Link, ImageIdV2, FixAvailableTimestamp, Origin, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, ImageId = EXCLUDED.ImageId, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign = EXCLUDED.CveBaseInfo_KnownRansomwareCampaign, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, FirstImageOccurrence = EXCLUDED.FirstImageOccurrence, State = EXCLUDED.State, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, ComponentId = EXCLUDED.ComponentId, Advisory_Name = EXCLUDED.Advisory_Name, Advisory_Link = EXCLUDED.Advisory_Link, ImageIdV2 = EXCLUDED.ImageIdV2, FixAvailableTimestamp = EXCLUDED.FixAvailableTimestamp, Origin = EXCLUDED.Origin, serialized = EXCLUDED.serialized"
 	batch.Queue(finalStr, values...)
 
 	return nil
@@ -138,6 +140,7 @@ var copyColsImageCvesV2 = []string{
 	"cvebaseinfo_createdat",
 	"cvebaseinfo_epss_epssprobability",
 	"cvebaseinfo_cisakev",
+	"cvebaseinfo_knownransomwarecampaign",
 	"cvss",
 	"severity",
 	"impactscore",
@@ -151,6 +154,7 @@ var copyColsImageCvesV2 = []string{
 	"advisory_link",
 	"imageidv2",
 	"fixavailabletimestamp",
+	"origin",
 	"serialized",
 }
 
@@ -192,6 +196,7 @@ func copyFromImageCvesV2(ctx context.Context, s pgSearch.Deleter, tx *postgres.T
 			protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 			obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 			obj.GetCveBaseInfo().GetCisaKev(),
+			obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 			obj.GetCvss(),
 			obj.GetSeverity(),
 			obj.GetImpactScore(),
@@ -205,6 +210,7 @@ func copyFromImageCvesV2(ctx context.Context, s pgSearch.Deleter, tx *postgres.T
 			obj.GetAdvisory().GetLink(),
 			pgutils.NilOrString(obj.GetImageIdV2()),
 			protocompat.NilOrTime(obj.GetFixAvailableTimestamp()),
+			obj.GetOrigin(),
 			serialized,
 		}, nil
 	})
diff --git a/central/cve/node/datastore/store/postgres/store.go b/central/cve/node/datastore/store/postgres/store.go
index 3eecc6e7d7e97..d60a5591f2700 100644
--- a/central/cve/node/datastore/store/postgres/store.go
+++ b/central/cve/node/datastore/store/postgres/store.go
@@ -106,6 +106,7 @@ func insertIntoNodeCves(batch *pgx.Batch, obj *storage.NodeCVE) error {
 		protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 		obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 		obj.GetCveBaseInfo().GetCisaKev(),
+		obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 		obj.GetOperatingSystem(),
 		obj.GetCvss(),
 		obj.GetSeverity(),
@@ -117,7 +118,7 @@ func insertIntoNodeCves(batch *pgx.Batch, obj *storage.NodeCVE) error {
 		serialized,
 	}
 
-	finalStr := "INSERT INTO node_cves (Id, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, OperatingSystem, Cvss, Severity, ImpactScore, Snoozed, SnoozeExpiry, Orphaned, OrphanedTime, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, OperatingSystem = EXCLUDED.OperatingSystem, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Snoozed = EXCLUDED.Snoozed, SnoozeExpiry = EXCLUDED.SnoozeExpiry, Orphaned = EXCLUDED.Orphaned, OrphanedTime = EXCLUDED.OrphanedTime, serialized = EXCLUDED.serialized"
+	finalStr := "INSERT INTO node_cves (Id, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign, OperatingSystem, Cvss, Severity, ImpactScore, Snoozed, SnoozeExpiry, Orphaned, OrphanedTime, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign = EXCLUDED.CveBaseInfo_KnownRansomwareCampaign, OperatingSystem = EXCLUDED.OperatingSystem, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Snoozed = EXCLUDED.Snoozed, SnoozeExpiry = EXCLUDED.SnoozeExpiry, Orphaned = EXCLUDED.Orphaned, OrphanedTime = EXCLUDED.OrphanedTime, serialized = EXCLUDED.serialized"
 	batch.Queue(finalStr, values...)
 
 	return nil
@@ -130,6 +131,7 @@ var copyColsNodeCves = []string{
 	"cvebaseinfo_createdat",
 	"cvebaseinfo_epss_epssprobability",
 	"cvebaseinfo_cisakev",
+	"cvebaseinfo_knownransomwarecampaign",
 	"operatingsystem",
 	"cvss",
 	"severity",
@@ -178,6 +180,7 @@ func copyFromNodeCves(ctx context.Context, s pgSearch.Deleter, tx *postgres.Tx,
 			protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 			obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 			obj.GetCveBaseInfo().GetCisaKev(),
+			obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 			obj.GetOperatingSystem(),
 			obj.GetCvss(),
 			obj.GetSeverity(),
diff --git a/central/declarativeconfig/updater/role_updater_test.go b/central/declarativeconfig/updater/role_updater_test.go
index f961b6c80133f..544450e72bc47 100644
--- a/central/declarativeconfig/updater/role_updater_test.go
+++ b/central/declarativeconfig/updater/role_updater_test.go
@@ -70,6 +70,7 @@ func (s *roleUpdaterTestSuite) SetupTest() {
 		ads,
 		tokenIssuerFactory,
 		mapperFactory,
+		nil,
 	)
 	s.Require().NoError(s.authProviderRegistry.RegisterBackendFactory(
 		s.ctx,
diff --git a/central/delegatedregistryconfig/delegator/delegator.go b/central/delegatedregistryconfig/delegator/delegator.go
index 00af344df8377..c1e128ad0ed97 100644
--- a/central/delegatedregistryconfig/delegator/delegator.go
+++ b/central/delegatedregistryconfig/delegator/delegator.go
@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
+	clusterDS "github.com/stackrox/rox/central/cluster/datastore"
 	"github.com/stackrox/rox/central/delegatedregistryconfig/datastore"
 	deleConnection "github.com/stackrox/rox/central/delegatedregistryconfig/util/connection"
 	centralMetrics "github.com/stackrox/rox/central/metrics"
@@ -31,13 +32,14 @@ var (
 )
 
 // New creates a new delegator.
-func New(deleRegConfigDS datastore.DataStore, connManager connection.Manager, scanWaiterManager waiter.Manager[*storage.Image], scanWaiterManagerV2 waiter.Manager[*storage.ImageV2], namespaceSACHelper sachelper.ClusterNamespaceSacHelper) *delegatorImpl {
+func New(deleRegConfigDS datastore.DataStore, connManager connection.Manager, scanWaiterManager waiter.Manager[*storage.Image], scanWaiterManagerV2 waiter.Manager[*storage.ImageV2], namespaceSACHelper sachelper.ClusterNamespaceSacHelper, clusterDataStore clusterDS.DataStore) *delegatorImpl {
 	return &delegatorImpl{
 		deleRegConfigDS:     deleRegConfigDS,
 		connManager:         connManager,
 		scanWaiterManager:   scanWaiterManager,
 		scanWaiterManagerV2: scanWaiterManagerV2,
 		namespaceSACHelper:  namespaceSACHelper,
+		clusterDataStore:    clusterDataStore,
 	}
 }
 
@@ -48,6 +50,10 @@ type delegatorImpl struct {
 	// namespaceSACHelper for confirming namespace exists and user has access.
 	namespaceSACHelper sachelper.ClusterNamespaceSacHelper
 
+	// clusterDataStore for resolving cluster names in user-facing messages within
+	// the requester's scope.
+	clusterDataStore clusterDS.DataStore
+
 	// connManager for sending scan requests to secured clusters and ensuring
 	// clusters are valid for delegation.
 	connManager connection.Manager
@@ -79,7 +85,7 @@ func (d *delegatorImpl) GetDelegateClusterID(ctx context.Context, imgName *stora
 		return "", true, delegatedregistry.ErrNoClusterSpecified
 	}
 
-	if err := d.ValidateCluster(clusterID); err != nil {
+	if err := d.ValidateCluster(ctx, clusterID); err != nil {
 		return "", true, err
 	}
 
@@ -264,19 +270,34 @@ func (d *delegatorImpl) shouldDelegate(imgName *storage.ImageName, config *stora
 }
 
 // ValidateCluster returns nil if a cluster is a valid target for delegation, otherwise returns an error.
-func (d *delegatorImpl) ValidateCluster(clusterID string) error {
+func (d *delegatorImpl) ValidateCluster(ctx context.Context, clusterID string) error {
 	conn := d.connManager.GetConnection(clusterID)
 	if conn == nil {
-		return errors.Errorf("no connection to %q", clusterID)
+		return errors.Errorf("no connection to cluster %q (%s), verify the cluster is healthy and connected", d.clusterName(ctx, clusterID), clusterID)
 	}
 
 	if !deleConnection.ValidForDelegation(conn) {
-		return errors.Errorf("cluster %q does not support delegated scanning", clusterID)
+		return errors.Errorf("cluster %q (%s) does not support delegated scanning", d.clusterName(ctx, clusterID), clusterID)
 	}
 
 	return nil
 }
 
+// clusterName resolves a human-readable cluster name for user-facing messages,
+// falling back to the cluster ID when the name cannot be resolved within the
+// requester's scope.
+func (d *delegatorImpl) clusterName(ctx context.Context, clusterID string) string {
+	// GetClusterName enforces a cluster-read SAC check against the passed context, so
+	// resolving under the requester's own (non-elevated) context reveals the name only
+	// to callers allowed to view this cluster. Everyone else keeps the opaque ID.
+	name, exists, err := d.clusterDataStore.GetClusterName(ctx, clusterID)
+	if err != nil || !exists {
+		return clusterID
+	}
+
+	return name
+}
+
 // withAdminRead elevates a context to include admin read access.
 func withAdminRead(ctx context.Context) context.Context {
 	elevatedCtx := sac.WithGlobalAccessScopeChecker(
diff --git a/central/delegatedregistryconfig/delegator/delegator_test.go b/central/delegatedregistryconfig/delegator/delegator_test.go
index 3f955add7c913..9532d6a952e9b 100644
--- a/central/delegatedregistryconfig/delegator/delegator_test.go
+++ b/central/delegatedregistryconfig/delegator/delegator_test.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"testing"
 
+	clusterDSMocks "github.com/stackrox/rox/central/cluster/datastore/mocks"
 	deleDSMocks "github.com/stackrox/rox/central/delegatedregistryconfig/datastore/mocks"
 	sacHelperMocks "github.com/stackrox/rox/central/role/sachelper/mocks"
 	connMocks "github.com/stackrox/rox/central/sensor/service/connection/mocks"
@@ -51,7 +52,9 @@ func TestGetDelegateClusterID(t *testing.T) {
 		connMgr = connMocks.NewMockManager(ctrl)
 		waiterMgr = waiterMocks.NewMockManager[*storage.Image](ctrl)
 		deleClusterDS = deleDSMocks.NewMockDataStore(ctrl)
-		d = New(deleClusterDS, connMgr, waiterMgr, nil, nil)
+		clusterDS := clusterDSMocks.NewMockDataStore(ctrl)
+		clusterDS.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).Return("fake-cluster-name", true, nil).AnyTimes()
+		d = New(deleClusterDS, connMgr, waiterMgr, nil, nil, clusterDS)
 	}
 
 	t.Run("error get config", func(t *testing.T) {
@@ -111,7 +114,7 @@ func TestGetDelegateClusterID(t *testing.T) {
 		connMgr.EXPECT().GetConnection(gomock.Any()).Return(nil)
 		_, shouldDelegate, err := d.GetDelegateClusterID(ctxBG, nil)
 		assert.True(t, shouldDelegate)
-		assert.ErrorContains(t, err, "no connection")
+		assert.ErrorContains(t, err, "no connection to cluster")
 	})
 
 	t.Run("all def cluster id conn no cap", func(t *testing.T) {
@@ -263,7 +266,7 @@ func TestDelegateEnrichImage(t *testing.T) {
 		namespaceSACHelper = sacHelperMocks.NewMockClusterNamespaceSacHelper(ctrl)
 
 		waiter.EXPECT().ID().Return(fakeWaiterID).AnyTimes()
-		d = New(deleClusterDS, connMgr, waiterMgr, nil, namespaceSACHelper)
+		d = New(deleClusterDS, connMgr, waiterMgr, nil, namespaceSACHelper, nil)
 	}
 
 	t.Run("empty cluster id", func(t *testing.T) {
@@ -357,7 +360,7 @@ func TestDelegateScanImageV2(t *testing.T) {
 		namespaceSACHelper = sacHelperMocks.NewMockClusterNamespaceSacHelper(ctrl)
 
 		waiter.EXPECT().ID().Return(fakeWaiterID).AnyTimes()
-		d = New(deleClusterDS, connMgr, nil, waiterMgr, namespaceSACHelper)
+		d = New(deleClusterDS, connMgr, nil, waiterMgr, namespaceSACHelper, nil)
 	}
 
 	t.Run("empty cluster id", func(t *testing.T) {
@@ -440,7 +443,7 @@ func TestInferNamespace(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		namespaceSACHelper = sacHelperMocks.NewMockClusterNamespaceSacHelper(ctrl)
 
-		d = New(nil, nil, nil, nil, namespaceSACHelper)
+		d = New(nil, nil, nil, nil, namespaceSACHelper, nil)
 	}
 
 	t.Run("no namespace on error", func(t *testing.T) {
diff --git a/central/deployment/datastore/datastore.go b/central/deployment/datastore/datastore.go
index b8daec8bdf512..8b9bb033ff99c 100644
--- a/central/deployment/datastore/datastore.go
+++ b/central/deployment/datastore/datastore.go
@@ -34,6 +34,8 @@ type DataStore interface {
 	ListDeployment(ctx context.Context, id string) (*storage.ListDeployment, bool, error)
 
 	GetDeployment(ctx context.Context, id string) (*storage.Deployment, bool, error)
+	// DeploymentExists reports whether the deployment is stored, without fetching or copying it.
+	DeploymentExists(ctx context.Context, id string) (bool, error)
 	GetDeployments(ctx context.Context, ids []string) ([]*storage.Deployment, error)
 	CountDeployments(ctx context.Context) (int, error)
 	// UpsertDeployment adds or updates a deployment. If the deployment exists, the tags in the deployment are taken from
@@ -48,6 +50,8 @@ type DataStore interface {
 	WalkByQuery(ctx context.Context, query *v1.Query, fn func(deployment *storage.Deployment) error) error
 
 	GetContainerImageViews(ctx context.Context, q *v1.Query) ([]*views.ContainerImageView, error)
+
+	GetV2ImageIDsForDigests(ctx context.Context, digests []string) (map[string][]string, error)
 }
 
 func newDataStore(
diff --git a/central/deployment/datastore/datastore_impl.go b/central/deployment/datastore/datastore_impl.go
index 432fd2e55d4b3..4c69aa96b9a0b 100644
--- a/central/deployment/datastore/datastore_impl.go
+++ b/central/deployment/datastore/datastore_impl.go
@@ -227,6 +227,11 @@ func (ds *datastoreImpl) GetDeployment(ctx context.Context, id string) (*storage
 	return deployment, true, nil
 }
 
+// DeploymentExists
+func (ds *datastoreImpl) DeploymentExists(ctx context.Context, id string) (bool, error) {
+	return ds.deploymentStore.Exists(ctx, id)
+}
+
 // GetDeployments
 func (ds *datastoreImpl) GetDeployments(ctx context.Context, ids []string) ([]*storage.Deployment, error) {
 	var deployments []*storage.Deployment
@@ -361,7 +366,8 @@ func (ds *datastoreImpl) RemoveDeployment(ctx context.Context, clusterID, id str
 		return sac.ErrResourceAccessDenied
 	}
 	// Dedupe the removed deployments. This can happen because Pods have many completion states
-	// and we may receive multiple Remove calls
+	// and we may receive multiple Remove calls. Marking up front also stops concurrent UpsertFlows
+	// from writing flows for the deployment while it is being removed.
 	if ds.deletedDeploymentCache != nil {
 		if ds.deletedDeploymentCache.Contains(id) {
 			return nil
@@ -387,22 +393,20 @@ func (ds *datastoreImpl) RemoveDeployment(ctx context.Context, clusterID, id str
 		errorList.AddError(err)
 	}
 
-	flowStore, err := ds.networkFlows.GetFlowStore(deleteRelatedCtx, clusterID)
-	if err != nil {
-		errorList.AddError(err)
-		return errorList.ToError()
-	}
-
-	if err := flowStore.RemoveFlowsForDeployment(deleteRelatedCtx, id); err != nil {
-		errorList.AddError(err)
+	// clusterID is nullable in the DB; guard against an empty value to avoid an error from flow store.
+	if clusterID != "" {
+		// A missing flow store must not block the delete, else deployments of a deleted cluster
+		// could never be pruned.
+		if flowStore, err := ds.networkFlows.GetFlowStore(deleteRelatedCtx, clusterID); err != nil {
+			errorList.AddError(err)
+		} else if err := flowStore.RemoveFlowsForDeployment(deleteRelatedCtx, id); err != nil {
+			errorList.AddError(err)
+		}
 	}
 
 	// Delete should be last to ensure that the above is always cleaned up even in the case of crash
-	err = ds.keyedMutex.DoStatusWithLock(id, func() error {
-		if err := ds.deploymentStore.Delete(ctx, id); err != nil {
-			return err
-		}
-		return nil
+	err := ds.keyedMutex.DoStatusWithLock(id, func() error {
+		return ds.deploymentStore.Delete(ctx, id)
 	})
 	if err != nil {
 		errorList.AddError(err)
@@ -488,6 +492,11 @@ func (ds *datastoreImpl) GetContainerImageViews(ctx context.Context, q *v1.Query
 	return ds.deploymentStore.GetContainerImageViews(ctx, q)
 }
 
+func (ds *datastoreImpl) GetV2ImageIDsForDigests(ctx context.Context, digests []string) (map[string][]string, error) {
+	defer metrics.SetDatastoreFunctionDuration(time.Now(), "Deployment", "GetV2ImageIDsForDigests")
+	return ds.deploymentStore.GetV2ImageIDsForDigests(ctx, digests)
+}
+
 type DeploymentSearchResultConverter struct{}
 
 func (c *DeploymentSearchResultConverter) BuildName(result *pkgSearch.Result) string {
diff --git a/central/deployment/datastore/datastore_impl_test.go b/central/deployment/datastore/datastore_impl_test.go
index 04c1d610f3f37..4440e5631294f 100644
--- a/central/deployment/datastore/datastore_impl_test.go
+++ b/central/deployment/datastore/datastore_impl_test.go
@@ -2,10 +2,13 @@ package datastore
 
 import (
 	"context"
+	"errors"
 	"testing"
 
 	storeMocks "github.com/stackrox/rox/central/deployment/datastore/internal/store/mocks"
+	flowMocks "github.com/stackrox/rox/central/networkgraph/flow/datastore/mocks"
 	matcherMocks "github.com/stackrox/rox/central/platform/matcher/mocks"
+	baselineMocks "github.com/stackrox/rox/central/processbaseline/datastore/mocks"
 	"github.com/stackrox/rox/central/ranking"
 	riskMocks "github.com/stackrox/rox/central/risk/datastore/mocks"
 	v1 "github.com/stackrox/rox/generated/api/v1"
@@ -98,6 +101,50 @@ func (suite *DeploymentDataStoreTestSuite) TestInitializeRanker() {
 	suite.Equal(int64(3), deploymentRanker.GetRankForID("3"))
 }
 
+// Regression: a failed flow store lookup must not block the row delete, else
+// deployments of an already-deleted cluster could never be pruned.
+func (suite *DeploymentDataStoreTestSuite) TestRemoveDeploymentDeletesRowWhenFlowStoreLookupFails() {
+	baselines := baselineMocks.NewMockDataStore(suite.mockCtrl)
+	flows := flowMocks.NewMockClusterDataStore(suite.mockCtrl)
+
+	ds := newDatastoreImpl(suite.storage, nil, nil, baselines, flows, suite.riskStore, nil, suite.filter,
+		ranking.NewRanker(), ranking.NewRanker(), ranking.NewRanker(), suite.matcher)
+
+	const clusterID = "c1"
+	const deploymentID = "d1"
+
+	suite.riskStore.EXPECT().RemoveRisk(gomock.Any(), deploymentID, gomock.Any()).Return(nil)
+	baselines.EXPECT().RemoveProcessBaselinesByDeployment(gomock.Any(), deploymentID).Return(nil)
+	flows.EXPECT().GetFlowStore(gomock.Any(), clusterID).Return(nil, errors.New("flow store gone"))
+	// The deployment row must still be deleted despite the flow-store failure.
+	suite.storage.EXPECT().Delete(gomock.Any(), deploymentID).Return(nil)
+
+	err := ds.RemoveDeployment(suite.ctx, clusterID, deploymentID)
+	suite.Require().Error(err)
+	suite.ErrorContains(err, "flow store gone")
+}
+
+// An empty clusterID (e.g. an orphaned deployment whose clusterid column is NULL) has no
+// flow partition, so the flow store lookup must be skipped rather than dereferencing a nil
+// store, while the row is still deleted.
+func (suite *DeploymentDataStoreTestSuite) TestRemoveDeploymentSkipsFlowStoreWhenClusterIDEmpty() {
+	baselines := baselineMocks.NewMockDataStore(suite.mockCtrl)
+	flows := flowMocks.NewMockClusterDataStore(suite.mockCtrl)
+
+	ds := newDatastoreImpl(suite.storage, nil, nil, baselines, flows, suite.riskStore, nil, suite.filter,
+		ranking.NewRanker(), ranking.NewRanker(), ranking.NewRanker(), suite.matcher)
+
+	const deploymentID = "d1"
+
+	suite.riskStore.EXPECT().RemoveRisk(gomock.Any(), deploymentID, gomock.Any()).Return(nil)
+	baselines.EXPECT().RemoveProcessBaselinesByDeployment(gomock.Any(), deploymentID).Return(nil)
+	// flows.GetFlowStore must not be called for an empty clusterID; the mock has no
+	// expectation set, so any call would fail the test.
+	suite.storage.EXPECT().Delete(gomock.Any(), deploymentID).Return(nil)
+
+	suite.Require().NoError(ds.RemoveDeployment(suite.ctx, "", deploymentID))
+}
+
 func walkMockFunc(deployments []*storage.Deployment) func(_ context.Context, _ *v1.Query, fn func(group *storage.Deployment) error) error {
 	return func(_ context.Context, _ *v1.Query, fn func(deployment *storage.Deployment) error) error {
 		for _, g := range deployments {
diff --git a/central/deployment/datastore/internal/store/mocks/store.go b/central/deployment/datastore/internal/store/mocks/store.go
index e5fd8e0f6b138..10a0a236b9c4c 100644
--- a/central/deployment/datastore/internal/store/mocks/store.go
+++ b/central/deployment/datastore/internal/store/mocks/store.go
@@ -73,6 +73,21 @@ func (mr *MockStoreMockRecorder) Delete(ctx, id any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Delete", reflect.TypeOf((*MockStore)(nil).Delete), ctx, id)
 }
 
+// Exists mocks base method.
+func (m *MockStore) Exists(ctx context.Context, id string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Exists", ctx, id)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Exists indicates an expected call of Exists.
+func (mr *MockStoreMockRecorder) Exists(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Exists", reflect.TypeOf((*MockStore)(nil).Exists), ctx, id)
+}
+
 // Get mocks base method.
 func (m *MockStore) Get(ctx context.Context, id string) (*storage.Deployment, bool, error) {
 	m.ctrl.T.Helper()
@@ -172,6 +187,21 @@ func (mr *MockStoreMockRecorder) GetManyListDeployments(ctx any, ids ...any) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetManyListDeployments", reflect.TypeOf((*MockStore)(nil).GetManyListDeployments), varargs...)
 }
 
+// GetV2ImageIDsForDigests mocks base method.
+func (m *MockStore) GetV2ImageIDsForDigests(ctx context.Context, digests []string) (map[string][]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetV2ImageIDsForDigests", ctx, digests)
+	ret0, _ := ret[0].(map[string][]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetV2ImageIDsForDigests indicates an expected call of GetV2ImageIDsForDigests.
+func (mr *MockStoreMockRecorder) GetV2ImageIDsForDigests(ctx, digests any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetV2ImageIDsForDigests", reflect.TypeOf((*MockStore)(nil).GetV2ImageIDsForDigests), ctx, digests)
+}
+
 // Search mocks base method.
 func (m *MockStore) Search(ctx context.Context, q *v1.Query) ([]search.Result, error) {
 	m.ctrl.T.Helper()
diff --git a/central/deployment/datastore/internal/store/postgres/full_store.go b/central/deployment/datastore/internal/store/postgres/full_store.go
index b59cfa667bed6..a5cc1f314be26 100644
--- a/central/deployment/datastore/internal/store/postgres/full_store.go
+++ b/central/deployment/datastore/internal/store/postgres/full_store.go
@@ -162,6 +162,37 @@ func (f *fullStoreImpl) GetContainerImageViews(ctx context.Context, q *v1.Query)
 	return results, nil
 }
 
+type v2ImageIDsByDigestView struct {
+	ImageIDs    []string `db:"image_id"`
+	ImageDigest string   `db:"image_sha"`
+}
+
+func (f *fullStoreImpl) GetV2ImageIDsForDigests(ctx context.Context, digests []string) (map[string][]string, error) {
+	if len(digests) == 0 {
+		return nil, nil
+	}
+	q := pkgSearch.NewQueryBuilder().
+		AddExactMatches(pkgSearch.ImageSHA, digests...).
+		ProtoQuery()
+	q.Selects = []*v1.QuerySelect{
+		pkgSearch.NewQuerySelect(pkgSearch.ImageID).Distinct().Proto(),
+		pkgSearch.NewQuerySelect(pkgSearch.ImageSHA).Proto(),
+	}
+	q.GroupBy = &v1.QueryGroupBy{
+		Fields: []string{pkgSearch.ImageSHA.String()},
+	}
+
+	queryCtx, cancel := contextutil.ContextWithTimeoutIfNotExists(ctx, queryTimeout)
+	defer cancel()
+
+	result := make(map[string][]string, len(digests))
+	err := pgSearch.RunSelectRequestForSchemaFn(queryCtx, f.db, pkgSchema.DeploymentsSchema, q, func(row *v2ImageIDsByDigestView) error {
+		result[row.ImageDigest] = row.ImageIDs
+		return nil
+	})
+	return result, err
+}
+
 // NewFullTestStore is used for testing.
 func NewFullTestStore(ctx context.Context, _ testing.TB, store Store, db postgres.DB, gormDB *gorm.DB) store.Store {
 	pkgSchema.ApplySchemaForTable(ctx, gormDB, baseTable)
diff --git a/central/deployment/datastore/internal/store/postgres/full_store_test.go b/central/deployment/datastore/internal/store/postgres/full_store_test.go
index d57a623f6e522..5f794b14ff714 100644
--- a/central/deployment/datastore/internal/store/postgres/full_store_test.go
+++ b/central/deployment/datastore/internal/store/postgres/full_store_test.go
@@ -7,6 +7,8 @@ import (
 	"testing"
 
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/images/types"
+	"github.com/stackrox/rox/pkg/images/utils"
 	"github.com/stackrox/rox/pkg/postgres/pgtest"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/testutils"
@@ -173,3 +175,76 @@ func TestGetManyListDeployments(t *testing.T) {
 		assert.Equal(t, dep1.GetNamespace(), result.GetNamespace())
 	})
 }
+
+func TestGetV2ImageIDsForDigests(t *testing.T) {
+	ctx := sac.WithAllAccess(context.Background())
+	testDB := pgtest.ForT(t)
+	fullStore := NewFullStore(testDB.DB)
+
+	digest1 := types.NewDigest("digest-1").Digest()
+	digest2 := types.NewDigest("digest-2").Digest()
+	digest3 := types.NewDigest("digest-3").Digest()
+
+	name1a := &storage.ImageName{FullName: "registry.io/repo/image1a:latest"}
+	name1b := &storage.ImageName{FullName: "registry.io/repo/image1b:latest"}
+	name2 := &storage.ImageName{FullName: "registry.io/repo/image2:latest"}
+
+	v2ID1a := utils.NewImageV2ID(name1a, digest1)
+	v2ID1b := utils.NewImageV2ID(name1b, digest1)
+	v2ID2 := utils.NewImageV2ID(name2, digest2)
+
+	// Two deployments reference digest1 with different V2 IDs (different image names).
+	dep1 := &storage.Deployment{
+		Id: uuid.NewV4().String(), Name: "dep-1", Namespace: "ns",
+		ClusterId: "c1", ClusterName: "c1", NamespaceId: "c1ns",
+		Containers: []*storage.Container{{
+			Image: &storage.ContainerImage{Id: digest1, IdV2: v2ID1a, Name: name1a},
+		}},
+	}
+	dep2 := &storage.Deployment{
+		Id: uuid.NewV4().String(), Name: "dep-2", Namespace: "ns",
+		ClusterId: "c1", ClusterName: "c1", NamespaceId: "c1ns",
+		Containers: []*storage.Container{{
+			Image: &storage.ContainerImage{Id: digest1, IdV2: v2ID1b, Name: name1b},
+		}},
+	}
+	// One deployment references digest2.
+	dep3 := &storage.Deployment{
+		Id: uuid.NewV4().String(), Name: "dep-3", Namespace: "ns",
+		ClusterId: "c1", ClusterName: "c1", NamespaceId: "c1ns",
+		Containers: []*storage.Container{{
+			Image: &storage.ContainerImage{Id: digest2, IdV2: v2ID2, Name: name2},
+		}},
+	}
+
+	require.NoError(t, fullStore.Upsert(ctx, dep1))
+	require.NoError(t, fullStore.Upsert(ctx, dep2))
+	require.NoError(t, fullStore.Upsert(ctx, dep3))
+
+	t.Run("multiple digests with multiple V2 IDs", func(t *testing.T) {
+		result, err := fullStore.GetV2ImageIDsForDigests(ctx, []string{digest1, digest2})
+		assert.NoError(t, err)
+		assert.Len(t, result, 2)
+		assert.ElementsMatch(t, []string{v2ID1a, v2ID1b}, result[digest1])
+		assert.ElementsMatch(t, []string{v2ID2}, result[digest2])
+	})
+
+	t.Run("digest not in any deployment", func(t *testing.T) {
+		result, err := fullStore.GetV2ImageIDsForDigests(ctx, []string{digest3})
+		assert.NoError(t, err)
+		assert.Empty(t, result)
+	})
+
+	t.Run("empty input", func(t *testing.T) {
+		result, err := fullStore.GetV2ImageIDsForDigests(ctx, nil)
+		assert.NoError(t, err)
+		assert.Nil(t, result)
+	})
+
+	t.Run("mix of existing and non-existing digests", func(t *testing.T) {
+		result, err := fullStore.GetV2ImageIDsForDigests(ctx, []string{digest1, digest3})
+		assert.NoError(t, err)
+		assert.Len(t, result, 1)
+		assert.ElementsMatch(t, []string{v2ID1a, v2ID1b}, result[digest1])
+	})
+}
diff --git a/central/deployment/datastore/internal/store/store.go b/central/deployment/datastore/internal/store/store.go
index 0fbd7c80edfe4..b2f155aa1cf6e 100644
--- a/central/deployment/datastore/internal/store/store.go
+++ b/central/deployment/datastore/internal/store/store.go
@@ -18,6 +18,7 @@ type Store interface {
 	SearchListDeployments(ctx context.Context, q *v1.Query) ([]*storage.ListDeployment, error)
 
 	Get(ctx context.Context, id string) (*storage.Deployment, bool, error)
+	Exists(ctx context.Context, id string) (bool, error)
 	GetMany(ctx context.Context, ids []string) ([]*storage.Deployment, []int, error)
 	Walk(ctx context.Context, fn func(deployment *storage.Deployment) error) error
 	WalkByQuery(ctx context.Context, query *v1.Query, fn func(deployment *storage.Deployment) error) error
@@ -30,4 +31,6 @@ type Store interface {
 	GetIDs(ctx context.Context) ([]string, error)
 
 	GetContainerImageViews(ctx context.Context, q *v1.Query) ([]*views.ContainerImageView, error)
+
+	GetV2ImageIDsForDigests(ctx context.Context, digests []string) (map[string][]string, error)
 }
diff --git a/central/deployment/datastore/mocks/datastore.go b/central/deployment/datastore/mocks/datastore.go
index bcf147d1cfa52..206d20c2f17fd 100644
--- a/central/deployment/datastore/mocks/datastore.go
+++ b/central/deployment/datastore/mocks/datastore.go
@@ -74,6 +74,21 @@ func (mr *MockDataStoreMockRecorder) CountDeployments(ctx any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountDeployments", reflect.TypeOf((*MockDataStore)(nil).CountDeployments), ctx)
 }
 
+// DeploymentExists mocks base method.
+func (m *MockDataStore) DeploymentExists(ctx context.Context, id string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeploymentExists", ctx, id)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeploymentExists indicates an expected call of DeploymentExists.
+func (mr *MockDataStoreMockRecorder) DeploymentExists(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeploymentExists", reflect.TypeOf((*MockDataStore)(nil).DeploymentExists), ctx, id)
+}
+
 // GetContainerImageViews mocks base method.
 func (m *MockDataStore) GetContainerImageViews(ctx context.Context, q *v1.Query) ([]*views.ContainerImageView, error) {
 	m.ctrl.T.Helper()
@@ -150,6 +165,21 @@ func (mr *MockDataStoreMockRecorder) GetImagesForDeployment(ctx, deployment any)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetImagesForDeployment", reflect.TypeOf((*MockDataStore)(nil).GetImagesForDeployment), ctx, deployment)
 }
 
+// GetV2ImageIDsForDigests mocks base method.
+func (m *MockDataStore) GetV2ImageIDsForDigests(ctx context.Context, digests []string) (map[string][]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetV2ImageIDsForDigests", ctx, digests)
+	ret0, _ := ret[0].(map[string][]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetV2ImageIDsForDigests indicates an expected call of GetV2ImageIDsForDigests.
+func (mr *MockDataStoreMockRecorder) GetV2ImageIDsForDigests(ctx, digests any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetV2ImageIDsForDigests", reflect.TypeOf((*MockDataStore)(nil).GetV2ImageIDsForDigests), ctx, digests)
+}
+
 // ListDeployment mocks base method.
 func (m *MockDataStore) ListDeployment(ctx context.Context, id string) (*storage.ListDeployment, bool, error) {
 	m.ctrl.T.Helper()
diff --git a/central/deployment/service/ai_prompt.go b/central/deployment/service/ai_prompt.go
new file mode 100644
index 0000000000000..35863fcc83529
--- /dev/null
+++ b/central/deployment/service/ai_prompt.go
@@ -0,0 +1,45 @@
+package service
+
+// This is the prompt for AI risk summary
+const aiSummaryPrompt = `You are a Kubernetes security advisor embedded in Red Hat Advanced
+Cluster Security. A security operator is investigating a deployment
+flagged for review.
+
+AUDIENCE: Kubernetes cluster admin managing thousands of deployments.
+
+TONE: Brief incident report. Short declarative sentences. No filler.
+
+CONTEXT ALREADY VISIBLE TO THE USER:
+The user already sees the deployment name, namespace, cluster,
+risk score, container images, and a stat summary bar (policy
+violations, CVE count, image age, component count) in the UI.
+Do NOT restate any of that. Start with the insight.
+
+Use these exact section labels with no additional text:
+
+SUMMARY
+2-3 sentences. Why the risk is high and the single most dangerous
+finding. Name specific images, permission levels, and CVE counts
+where relevant. Start with the insight, not the deployment metadata.
+
+RISK BREAKDOWN
+Max 4 bullets, each on its own line starting with "- ". Top risk
+factors ordered by score impact. One sentence per bullet, max 20
+words. Group related findings under one bullet (e.g., image age +
+image CVEs). Skip factors scoring below 1.5.
+
+CONSTRAINTS:
+- Plain text only. No markdown: no **, no backticks, no #.
+- Refer to container images by name only or container name;
+  never include the exact tag or version.
+- Report suspicious processes by executable name only; strip any
+  technical suffix (e.g. write "runc", not "runc:[1:CHILD]").
+- When a finding references a policy or compliance guideline
+  (e.g. CIS, NIST, BSI, PCI-DSS), describe the security risk it
+  represents, not the guideline name or code.
+- Do NOT explain ACS, risk scoring, or how the system works.
+- Do NOT hedge. Be direct.
+- Do NOT echo these instructions or section descriptions in
+  your response.
+- CLUSTER_ADMIN service accounts are always a top-priority finding
+  regardless of score.`
diff --git a/central/deployment/service/risk_ai_summary_test.go b/central/deployment/service/risk_ai_summary_test.go
new file mode 100644
index 0000000000000..2273fbc66c9f3
--- /dev/null
+++ b/central/deployment/service/risk_ai_summary_test.go
@@ -0,0 +1,631 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	deploymentMocks "github.com/stackrox/rox/central/deployment/datastore/mocks"
+	olsClient "github.com/stackrox/rox/central/lightspeed/client"
+	processViews "github.com/stackrox/rox/central/processindicator/views"
+	riskMocks "github.com/stackrox/rox/central/risk/datastore/mocks"
+	deployment "github.com/stackrox/rox/central/risk/multipliers/deployment"
+	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+type mockOLSClient struct {
+	response *olsClient.QueryResponse
+	err      error
+	captured *olsClient.QueryRequest
+}
+
+func (m *mockOLSClient) Query(_ context.Context, req *olsClient.QueryRequest) (*olsClient.QueryResponse, error) {
+	m.captured = req
+	return m.response, m.err
+}
+
+func (m *mockOLSClient) TestConnectivity() error {
+	return m.err
+}
+
+func TestGetDeploymentRiskAISummary_Success(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockDS := deploymentMocks.NewMockDataStore(ctrl)
+	mockRisks := riskMocks.NewMockDataStore(ctrl)
+
+	deployment := &storage.Deployment{
+		Id:                            "dep-1",
+		Name:                          "nginx-frontend",
+		Namespace:                     "production",
+		ClusterName:                   "cluster-east",
+		Type:                          "Deployment",
+		Created:                       timestamppb.Now(),
+		ServiceAccount:                "default",
+		ServiceAccountPermissionLevel: storage.PermissionLevel_CLUSTER_ADMIN,
+		AutomountServiceAccountToken:  true,
+		HostNetwork:                   false,
+		Containers: []*storage.Container{
+			{
+				Name: "nginx",
+				Image: &storage.ContainerImage{
+					Name: &storage.ImageName{FullName: "docker.io/nginx:1.25"},
+				},
+				SecurityContext: &storage.SecurityContext{
+					Privileged:               true,
+					AllowPrivilegeEscalation: true,
+				},
+				Resources: &storage.Resources{
+					CpuCoresRequest: 0.5,
+					CpuCoresLimit:   1.0,
+					MemoryMbRequest: 256,
+					MemoryMbLimit:   512,
+				},
+				Config: &storage.ContainerConfig{
+					Uid: 0,
+					Env: []*storage.ContainerConfig_EnvironmentConfig{
+						{Key: "SECRET_KEY", Value: "super-secret-123"},
+						{Key: "DB_URL", Value: "postgres://db.internal:5432/mydb"}, // #nosec G101
+					},
+				},
+				LivenessProbe:  &storage.LivenessProbe{Defined: true},
+				ReadinessProbe: &storage.ReadinessProbe{Defined: false},
+				Secrets: []*storage.EmbeddedSecret{
+					{Name: "db-creds", Path: "/var/run/secrets/db"},
+				},
+			},
+		},
+	}
+
+	risk := &storage.Risk{
+		Id:    "risk-1",
+		Score: 8.5,
+		Subject: &storage.RiskSubject{
+			Id:        "dep-1",
+			Namespace: "production",
+			ClusterId: "cluster-1",
+			Type:      storage.RiskSubjectType_DEPLOYMENT,
+		},
+		Results: []*storage.Risk_Result{
+			{
+				Name:  "Service Configuration",
+				Score: 3.5,
+				Factors: []*storage.Risk_Result_Factor{
+					{Message: "Service account is cluster-admin"},
+					{Message: "Automount SA token enabled"},
+				},
+			},
+			{
+				Name:  "Image Vulnerabilities",
+				Score: 2.0,
+				Factors: []*storage.Risk_Result_Factor{
+					{Message: "Image has 42 CVEs", Url: "https://example.com/cves"},
+				},
+			},
+		},
+	}
+
+	mockDS.EXPECT().GetDeployment(gomock.Any(), "dep-1").Return(deployment, true, nil)
+	mockRisks.EXPECT().GetRiskForDeployment(gomock.Any(), deployment).Return(risk, true, nil)
+
+	olsMock := &mockOLSClient{
+		response: &olsClient.QueryResponse{
+			Response: "SUMMARY\nThis deployment runs as cluster-admin with a privileged container.",
+		},
+	}
+
+	svc := &serviceImpl{
+		datastore:        mockDS,
+		risks:            mockRisks,
+		lightspeedClient: olsMock,
+	}
+
+	resp, err := svc.GetDeploymentRiskAISummary(context.Background(), &v1.ResourceByID{Id: "dep-1"})
+	require.NoError(t, err)
+	assert.Equal(t, "SUMMARY\nThis deployment runs as cluster-admin with a privileged container.", resp.GetSummary())
+
+	// Verify prompt and context were combined into the query.
+	assert.Contains(t, olsMock.captured.Query, aiSummaryPrompt)
+	assert.Contains(t, olsMock.captured.Query, "DEPLOYMENT AND RISK DATA:")
+	assert.Contains(t, olsMock.captured.Query, "nginx-frontend")
+}
+
+func TestGetDeploymentRiskAISummary_SensitiveFieldsStripped(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockDS := deploymentMocks.NewMockDataStore(ctrl)
+	mockRisks := riskMocks.NewMockDataStore(ctrl)
+
+	deployment := &storage.Deployment{
+		Id:          "dep-2",
+		Name:        "mid-server",
+		Namespace:   "operations",
+		ClusterName: "cluster-west",
+		Type:        "Deployment",
+		Containers: []*storage.Container{
+			{
+				Name: "app",
+				Image: &storage.ContainerImage{
+					Id:   "sha256:abc123",
+					IdV2: "img-v2-id",
+					Name: &storage.ImageName{FullName: "registry.example.com/app:v2"},
+				},
+				Config: &storage.ContainerConfig{
+					Uid: 1000,
+					Env: []*storage.ContainerConfig_EnvironmentConfig{
+						{Key: "SERVICENOW_URL", Value: "https://company.service-now.com"},
+						{Key: "SN_USER", Value: "admin"},
+						{Key: "SN_SECRET_REF", Value: "vault:secret/data/sn-key"},
+					},
+					Command:   []string{"/bin/app"},
+					Args:      []string{"--port=8080"},
+					Directory: "/app",
+				},
+				Secrets: []*storage.EmbeddedSecret{
+					{Name: "sn-credentials", Path: "/var/run/secrets/servicenow"},
+				},
+				SecurityContext: &storage.SecurityContext{
+					Privileged: false,
+				},
+			},
+		},
+	}
+
+	risk := &storage.Risk{
+		Id:    "risk-2",
+		Score: 6.0,
+		Subject: &storage.RiskSubject{
+			Id:        "dep-2",
+			Namespace: "operations",
+		},
+		Results: []*storage.Risk_Result{
+			{
+				Name:  "Image Freshness",
+				Score: 2.0,
+				Factors: []*storage.Risk_Result_Factor{
+					{Message: "Image is 180 days old", Url: ""},
+				},
+			},
+		},
+	}
+
+	mockDS.EXPECT().GetDeployment(gomock.Any(), "dep-2").Return(deployment, true, nil)
+	mockRisks.EXPECT().GetRiskForDeployment(gomock.Any(), deployment).Return(risk, true, nil)
+
+	olsMock := &mockOLSClient{
+		response: &olsClient.QueryResponse{Response: "Low risk deployment."},
+	}
+
+	svc := &serviceImpl{
+		datastore:        mockDS,
+		risks:            mockRisks,
+		lightspeedClient: olsMock,
+	}
+
+	_, err := svc.GetDeploymentRiskAISummary(context.Background(), &v1.ResourceByID{Id: "dep-2"})
+	require.NoError(t, err)
+
+	capturedQuery := olsMock.captured.Query
+
+	// Sensitive env vars must NOT appear in query sent to LLM.
+	assert.NotContains(t, capturedQuery, "SERVICENOW_URL")
+	assert.NotContains(t, capturedQuery, "https://company.service-now.com")
+	assert.NotContains(t, capturedQuery, "SN_USER")
+	assert.NotContains(t, capturedQuery, "SN_SECRET_REF")
+	assert.NotContains(t, capturedQuery, "vault:secret/data/sn-key")
+
+	// Secret mount paths must NOT appear.
+	assert.NotContains(t, capturedQuery, "/var/run/secrets/servicenow")
+	assert.NotContains(t, capturedQuery, "sn-credentials")
+
+	// Internal IDs must NOT appear.
+	assert.NotContains(t, capturedQuery, "sha256:abc123")
+	assert.NotContains(t, capturedQuery, "img-v2-id")
+	assert.NotContains(t, capturedQuery, "dep-2")  // deployment ID
+	assert.NotContains(t, capturedQuery, "risk-2") // risk ID
+
+	// Command, args, and directory must NOT appear.
+	assert.NotContains(t, capturedQuery, "/bin/app")
+	assert.NotContains(t, capturedQuery, "--port=8080")
+
+	// Relevant fields MUST appear.
+	assert.Contains(t, capturedQuery, "mid-server")
+	assert.Contains(t, capturedQuery, "operations")
+	assert.Contains(t, capturedQuery, "cluster-west")
+	assert.Contains(t, capturedQuery, "registry.example.com/app:v2")
+	assert.Contains(t, capturedQuery, "Image is 180 days old")
+}
+
+func TestGetDeploymentRiskAISummary_DeploymentNotFound(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockDS := deploymentMocks.NewMockDataStore(ctrl)
+
+	mockDS.EXPECT().GetDeployment(gomock.Any(), "nonexistent").Return(nil, false, nil)
+
+	svc := &serviceImpl{
+		datastore: mockDS,
+	}
+
+	resp, err := svc.GetDeploymentRiskAISummary(context.Background(), &v1.ResourceByID{Id: "nonexistent"})
+	assert.Nil(t, resp)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "does not exist")
+}
+
+func TestGetDeploymentRiskAISummary_OLSError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockDS := deploymentMocks.NewMockDataStore(ctrl)
+	mockRisks := riskMocks.NewMockDataStore(ctrl)
+
+	deployment := &storage.Deployment{
+		Id:          "dep-3",
+		Name:        "test-app",
+		Namespace:   "default",
+		ClusterName: "test-cluster",
+		Type:        "Deployment",
+	}
+	risk := &storage.Risk{Score: 8.0}
+
+	mockDS.EXPECT().GetDeployment(gomock.Any(), "dep-3").Return(deployment, true, nil)
+	mockRisks.EXPECT().GetRiskForDeployment(gomock.Any(), deployment).Return(risk, true, nil)
+
+	olsMock := &mockOLSClient{
+		err: errors.New("Lightspeed API returned HTTP 503"),
+	}
+
+	svc := &serviceImpl{
+		datastore:        mockDS,
+		risks:            mockRisks,
+		lightspeedClient: olsMock,
+	}
+
+	resp, err := svc.GetDeploymentRiskAISummary(context.Background(), &v1.ResourceByID{Id: "dep-3"})
+	assert.Nil(t, resp)
+	require.Error(t, err)
+
+	st, ok := status.FromError(err)
+	require.True(t, ok, "expected a gRPC status error")
+	assert.Equal(t, codes.Unavailable, st.Code())
+	assert.Equal(t, "AI service unavailable", st.Message())
+}
+
+func TestGetDeploymentRiskAISummary_NilRisk(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockDS := deploymentMocks.NewMockDataStore(ctrl)
+	mockRisks := riskMocks.NewMockDataStore(ctrl)
+
+	deployment := &storage.Deployment{
+		Id:          "dep-4",
+		Name:        "new-app",
+		Namespace:   "staging",
+		ClusterName: "staging-cluster",
+		Type:        "Deployment",
+	}
+
+	mockDS.EXPECT().GetDeployment(gomock.Any(), "dep-4").Return(deployment, true, nil)
+	mockRisks.EXPECT().GetRiskForDeployment(gomock.Any(), deployment).Return(nil, false, nil)
+
+	// OLS client should NOT be called for nil/low risk - no mock needed
+	svc := &serviceImpl{
+		datastore: mockDS,
+		risks:     mockRisks,
+	}
+
+	resp, err := svc.GetDeploymentRiskAISummary(context.Background(), &v1.ResourceByID{Id: "dep-4"})
+	require.NoError(t, err)
+	// Nil risk returns a specific message without calling OLS
+	assert.Equal(t, "No risk data available for this deployment.", resp.GetSummary())
+}
+
+func TestGetDeploymentRiskAISummary_LowRiskScore(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockDS := deploymentMocks.NewMockDataStore(ctrl)
+	mockRisks := riskMocks.NewMockDataStore(ctrl)
+
+	deployment := &storage.Deployment{
+		Id:          "dep-5",
+		Name:        "low-risk-app",
+		Namespace:   "default",
+		ClusterName: "test-cluster",
+		Type:        "Deployment",
+	}
+
+	risk := &storage.Risk{Score: 3.5} // Below threshold of 5.0
+
+	mockDS.EXPECT().GetDeployment(gomock.Any(), "dep-5").Return(deployment, true, nil)
+	mockRisks.EXPECT().GetRiskForDeployment(gomock.Any(), deployment).Return(risk, true, nil)
+
+	// OLS client should NOT be called for low risk scores
+	svc := &serviceImpl{
+		datastore: mockDS,
+		risks:     mockRisks,
+	}
+
+	resp, err := svc.GetDeploymentRiskAISummary(context.Background(), &v1.ResourceByID{Id: "dep-5"})
+	require.NoError(t, err)
+	assert.Equal(t, "Skipping AI summary since this is a low risk deployment with normalized risk score below 5.", resp.GetSummary())
+}
+
+func TestBuildSanitizedRiskContext_FieldSelection(t *testing.T) {
+	deployment := &storage.Deployment{
+		Id:                            "id-should-be-stripped",
+		Hash:                          12345,
+		Name:                          "my-deployment",
+		Namespace:                     "my-namespace",
+		NamespaceId:                   "ns-id-should-be-stripped",
+		ClusterId:                     "cluster-id-should-be-stripped",
+		ClusterName:                   "my-cluster",
+		Type:                          "Deployment",
+		Created:                       timestamppb.Now(),
+		ServiceAccount:                "deployer-sa",
+		ServiceAccountPermissionLevel: storage.PermissionLevel_ELEVATED_IN_NAMESPACE,
+		AutomountServiceAccountToken:  true,
+		HostNetwork:                   true,
+		HostPid:                       false,
+		HostIpc:                       false,
+		StateTimestamp:                999999,
+		ImagePullSecrets:              []string{"registry-secret"},
+		Tolerations: []*storage.Toleration{
+			{Key: "node-role.kubernetes.io/master"},
+		},
+		Ports: []*storage.PortConfig{
+			{Name: "http", ContainerPort: 8080},
+		},
+		Labels:      map[string]string{"app": "web"},
+		Annotations: map[string]string{"note": "test"},
+		Containers: []*storage.Container{
+			{
+				Id:   "container-id-should-be-stripped",
+				Name: "web",
+				Image: &storage.ContainerImage{
+					Id:             "sha256:deadbeef",
+					IdV2:           "idv2-stripped",
+					Name:           &storage.ImageName{FullName: "quay.io/app:latest"},
+					NotPullable:    true,
+					IsClusterLocal: true,
+				},
+				SecurityContext: &storage.SecurityContext{
+					Privileged:               true,
+					ReadOnlyRootFilesystem:   true,
+					AllowPrivilegeEscalation: false,
+					DropCapabilities:         []string{"ALL"},
+					AddCapabilities:          []string{"NET_BIND_SERVICE"},
+				},
+				Resources: &storage.Resources{
+					CpuCoresRequest: 0.25,
+					CpuCoresLimit:   1.0,
+					MemoryMbRequest: 128,
+					MemoryMbLimit:   512,
+				},
+				Config: &storage.ContainerConfig{
+					Uid: 0,
+					Env: []*storage.ContainerConfig_EnvironmentConfig{
+						{Key: "PASSWORD", Value: "secret123"},
+					},
+					Command:   []string{"/entrypoint.sh"},
+					Directory: "/app",
+				},
+				LivenessProbe:  &storage.LivenessProbe{Defined: true},
+				ReadinessProbe: &storage.ReadinessProbe{Defined: true},
+				Secrets: []*storage.EmbeddedSecret{
+					{Name: "tls-cert", Path: "/etc/tls/certs"},
+				},
+			},
+		},
+	}
+
+	risk := &storage.Risk{
+		Id:    "risk-id-stripped",
+		Score: 7.2,
+		Subject: &storage.RiskSubject{
+			Id:        "dep-subject",
+			Namespace: "my-namespace",
+			ClusterId: "cluster-1",
+		},
+		Results: []*storage.Risk_Result{
+			{
+				Name:  "Policy Violations",
+				Score: 4.0,
+				Factors: []*storage.Risk_Result_Factor{
+					{Message: "Privileged container detected", Url: "https://docs.example.com/priv"},
+					{Message: "Running as root"},
+				},
+			},
+		},
+	}
+
+	contextJSON, err := buildSanitizedRiskContext(deployment, risk)
+	require.NoError(t, err)
+
+	// Parse to verify structure.
+	var parsed map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal([]byte(contextJSON), &parsed))
+	assert.Contains(t, string(parsed["deployment"]), "my-deployment")
+	assert.Contains(t, string(parsed["risk"]), "Policy Violations")
+
+	// Fields that MUST be present.
+	assert.Contains(t, contextJSON, "my-deployment")
+	assert.Contains(t, contextJSON, "my-namespace")
+	assert.Contains(t, contextJSON, "my-cluster")
+	assert.Contains(t, contextJSON, "Deployment")
+	assert.Contains(t, contextJSON, "deployer-sa")
+	assert.Contains(t, contextJSON, "ELEVATED_IN_NAMESPACE")
+	assert.Contains(t, contextJSON, "quay.io/app:latest")
+	assert.Contains(t, contextJSON, "Privileged container detected")
+	assert.Contains(t, contextJSON, "Running as root")
+
+	// Fields that MUST be stripped — IDs and metadata.
+	assert.NotContains(t, contextJSON, "id-should-be-stripped")
+	assert.NotContains(t, contextJSON, "ns-id-should-be-stripped")
+	assert.NotContains(t, contextJSON, "cluster-id-should-be-stripped")
+	assert.NotContains(t, contextJSON, "container-id-should-be-stripped")
+	assert.NotContains(t, contextJSON, "sha256:deadbeef")
+	assert.NotContains(t, contextJSON, "idv2-stripped")
+	assert.NotContains(t, contextJSON, "risk-id-stripped")
+	assert.NotContains(t, contextJSON, "dep-subject")
+	assert.NotContains(t, contextJSON, "999999") // stateTimestamp
+
+	// Fields stripped for security.
+	assert.NotContains(t, contextJSON, "PASSWORD")
+	assert.NotContains(t, contextJSON, "secret123")
+	assert.NotContains(t, contextJSON, "/etc/tls/certs")
+	assert.NotContains(t, contextJSON, "tls-cert")
+	assert.NotContains(t, contextJSON, "/entrypoint.sh")
+
+	// Wasteful fields stripped.
+	assert.NotContains(t, contextJSON, "registry-secret")                // imagePullSecrets
+	assert.NotContains(t, contextJSON, "node-role.kubernetes.io/master") // tolerations
+	assert.NotContains(t, contextJSON, "https://docs.example.com/priv")  // factor URLs
+
+	// notPullable and isClusterLocal should not be included.
+	assert.NotContains(t, contextJSON, "notPullable")
+	assert.NotContains(t, contextJSON, "isClusterLocal")
+}
+
+func TestBuildSanitizedRiskContext_ProcessArgsStripped(t *testing.T) {
+	dep := &storage.Deployment{
+		Id:          "dep-1",
+		Name:        "test-app",
+		Namespace:   "default",
+		ClusterName: "test-cluster",
+		Type:        "Deployment",
+	}
+
+	// Use FormatProcess to generate realistic messages. This ensures the test
+	// will catch any changes to FormatProcess that break our sanitization regex.
+	processWithSensitiveArgs1 := &processViews.ProcessIndicatorRiskView{
+		SignalName:    "/bin/bash",
+		SignalArgs:    "-c export PASSWORD=secret123 && ./script.sh",
+		ContainerName: "app",
+	}
+	processWithSensitiveArgs2 := &processViews.ProcessIndicatorRiskView{
+		SignalName:    "/usr/bin/curl",
+		SignalArgs:    "https://api.example.com?token=abc123&secret=xyz",
+		ContainerName: "app",
+	}
+	processWithoutArgs := &processViews.ProcessIndicatorRiskView{
+		SignalName:    "/bin/sh",
+		SignalArgs:    "", // no args
+		ContainerName: "sidecar",
+	}
+
+	risk := &storage.Risk{
+		Id:    "risk-1",
+		Score: 8.0,
+		Results: []*storage.Risk_Result{
+			{
+				Name:  deployment.ProcessBaselineHeading,
+				Score: 2.5,
+				Factors: []*storage.Risk_Result_Factor{
+					// Generated using FormatProcess to stay in sync with the actual format.
+					{Message: deployment.FormatProcess(processWithSensitiveArgs1)},
+					{Message: deployment.FormatProcess(processWithSensitiveArgs2)},
+					{Message: deployment.FormatProcess(processWithoutArgs)},
+				},
+			},
+			{
+				// Other risk results should NOT have args stripped.
+				Name:  "Policy Violations",
+				Score: 1.5,
+				Factors: []*storage.Risk_Result_Factor{
+					{Message: `Some message with args "should not be stripped"`},
+				},
+			},
+		},
+	}
+
+	contextJSON, err := buildSanitizedRiskContext(dep, risk)
+	require.NoError(t, err)
+
+	// Process names and container names SHOULD be present.
+	assert.Contains(t, contextJSON, "/bin/bash")
+	assert.Contains(t, contextJSON, "/usr/bin/curl")
+	assert.Contains(t, contextJSON, "/bin/sh")
+	assert.Contains(t, contextJSON, "container app")
+	assert.Contains(t, contextJSON, "container sidecar")
+	assert.Contains(t, contextJSON, deployment.ProcessBaselineHeading)
+
+	// Process arguments MUST be redacted from process baseline results (may contain secrets).
+	assert.NotContains(t, contextJSON, "PASSWORD=secret123")
+	assert.NotContains(t, contextJSON, "token=abc123")
+	assert.NotContains(t, contextJSON, "secret=xyz")
+	assert.NotContains(t, contextJSON, "script.sh")
+
+	// The ' with args "..."' pattern should be replaced with '<redacted args>'.
+	// Note: JSON encoding escapes < and > as \u003c and \u003e.
+	assert.NotContains(t, contextJSON, `with args "-c export`)
+	assert.NotContains(t, contextJSON, `with args "https://api`)
+	assert.Contains(t, contextJSON, `\u003credacted args\u003e`)
+
+	// Message without args should remain intact (no <redacted args> added).
+	// Use the exact format from FormatProcess.
+	assert.Contains(t, contextJSON, `Detected execution of suspicious process \"/bin/sh\" in container sidecar`)
+
+	// Other risk results should NOT have their messages modified.
+	assert.Contains(t, contextJSON, `with args \"should not be stripped\"`)
+}
+
+func TestBuildSanitizedRiskContext_ProcessArgsWithEmbeddedQuotes(t *testing.T) {
+	// Regression test: strconv.Quote escapes embedded quotes as \".
+	// The regex must handle escaped quotes to avoid leaving sensitive data exposed.
+	// Using FormatProcess ensures this test will catch format changes.
+	dep := &storage.Deployment{
+		Id:          "dep-1",
+		Name:        "test-app",
+		Namespace:   "default",
+		ClusterName: "test-cluster",
+		Type:        "Deployment",
+	}
+
+	// Args with embedded quotes - FormatProcess uses strconv.Quote which escapes them.
+	processWithEmbeddedQuotes1 := &processViews.ProcessIndicatorRiskView{
+		SignalName:    "/bin/bash",
+		SignalArgs:    `-c echo "password=secret123"`,
+		ContainerName: "app",
+	}
+	processWithEmbeddedQuotes2 := &processViews.ProcessIndicatorRiskView{
+		SignalName:    "/bin/sh",
+		SignalArgs:    `cmd with "nested" quotes and token=abc123`,
+		ContainerName: "app",
+	}
+
+	risk := &storage.Risk{
+		Id:    "risk-1",
+		Score: 8.0,
+		Results: []*storage.Risk_Result{
+			{
+				Name:  deployment.ProcessBaselineHeading,
+				Score: 2.0,
+				Factors: []*storage.Risk_Result_Factor{
+					{Message: deployment.FormatProcess(processWithEmbeddedQuotes1)},
+					{Message: deployment.FormatProcess(processWithEmbeddedQuotes2)},
+				},
+			},
+		},
+	}
+
+	contextJSON, err := buildSanitizedRiskContext(dep, risk)
+	require.NoError(t, err)
+
+	// Process names SHOULD be present.
+	assert.Contains(t, contextJSON, "/bin/bash")
+	assert.Contains(t, contextJSON, "/bin/sh")
+
+	// Sensitive data with embedded quotes MUST be fully redacted.
+	assert.NotContains(t, contextJSON, "password=secret123")
+	assert.NotContains(t, contextJSON, "token=abc123")
+	assert.NotContains(t, contextJSON, "nested")
+
+	// The entire args section should be replaced with <redacted args>.
+	assert.Contains(t, contextJSON, `\u003credacted args\u003e`)
+
+	// Ensure no partial args remain (the old regex would stop at the first escaped quote).
+	assert.NotContains(t, contextJSON, `with args "-c echo`)
+	assert.NotContains(t, contextJSON, `with args "cmd with`)
+}
diff --git a/central/deployment/service/risk_sanitization.go b/central/deployment/service/risk_sanitization.go
new file mode 100644
index 0000000000000..2a9c8ab2da26e
--- /dev/null
+++ b/central/deployment/service/risk_sanitization.go
@@ -0,0 +1,152 @@
+package service
+
+import (
+	"encoding/json"
+	"regexp"
+
+	"github.com/stackrox/rox/central/risk/multipliers/deployment"
+	"github.com/stackrox/rox/generated/storage"
+)
+
+// processArgsPattern matches ' with args "..."' in process baseline messages.
+// Process arguments may contain sensitive data (passwords, tokens) and must be
+// redacted before sending to an external LLM.
+// The pattern handles escaped quotes (from strconv.Quote) to ensure the entire
+// argument string is matched even when it contains embedded quotes.
+var processArgsPattern = regexp.MustCompile(` with args "(\\.|[^"\\])*"`)
+
+// buildSanitizedRiskContext produces a minimal JSON representation of the
+// deployment and risk data suitable for sending to an external LLM. It keeps
+// only fields relevant to risk analysis and strips sensitive data (env vars,
+// secret paths) and wasteful metadata (IDs, hashes, empty fields).
+func buildSanitizedRiskContext(deployment *storage.Deployment, risk *storage.Risk) (string, error) {
+	ctx := sanitizedContext{
+		Deployment: sanitizeDeployment(deployment),
+		Risk:       sanitizeRisk(risk),
+	}
+	data, err := json.Marshal(ctx)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+type sanitizedContext struct {
+	Deployment sanitizedDeployment `json:"deployment"`
+	Risk       sanitizedRisk       `json:"risk"`
+}
+
+type sanitizedDeployment struct {
+	Name                          string               `json:"name"`
+	Namespace                     string               `json:"namespace"`
+	ClusterName                   string               `json:"clusterName"`
+	Type                          string               `json:"type"`
+	Created                       string               `json:"created,omitempty"`
+	ServiceAccount                string               `json:"serviceAccount,omitempty"`
+	ServiceAccountPermissionLevel string               `json:"serviceAccountPermissionLevel,omitempty"`
+	AutomountServiceAccountToken  bool                 `json:"automountServiceAccountToken"`
+	HostNetwork                   bool                 `json:"hostNetwork"`
+	HostPid                       bool                 `json:"hostPid"`
+	HostIpc                       bool                 `json:"hostIpc"`
+	Containers                    []sanitizedContainer `json:"containers"`
+}
+
+type sanitizedContainer struct {
+	Name            string                   `json:"name"`
+	ImageFullName   string                   `json:"imageFullName,omitempty"`
+	SecurityContext *storage.SecurityContext `json:"securityContext,omitempty"`
+	Resources       *storage.Resources       `json:"resources,omitempty"`
+	UID             int64                    `json:"uid,omitempty"`
+	LivenessProbe   *storage.LivenessProbe   `json:"livenessProbe,omitempty"`
+	ReadinessProbe  *storage.ReadinessProbe  `json:"readinessProbe,omitempty"`
+}
+
+type sanitizedRisk struct {
+	Score   float32               `json:"score"`
+	Results []sanitizedRiskResult `json:"results,omitempty"`
+}
+
+type sanitizedRiskResult struct {
+	Name    string                `json:"name"`
+	Score   float32               `json:"score"`
+	Factors []sanitizedRiskFactor `json:"factors,omitempty"`
+}
+
+type sanitizedRiskFactor struct {
+	Message string `json:"message"`
+}
+
+func sanitizeDeployment(d *storage.Deployment) sanitizedDeployment {
+	sd := sanitizedDeployment{
+		Name:                         d.GetName(),
+		Namespace:                    d.GetNamespace(),
+		ClusterName:                  d.GetClusterName(),
+		Type:                         d.GetType(),
+		ServiceAccount:               d.GetServiceAccount(),
+		AutomountServiceAccountToken: d.GetAutomountServiceAccountToken(),
+		HostNetwork:                  d.GetHostNetwork(),
+		HostPid:                      d.GetHostPid(),
+		HostIpc:                      d.GetHostIpc(),
+	}
+
+	if d.GetServiceAccountPermissionLevel() != storage.PermissionLevel_UNSET {
+		sd.ServiceAccountPermissionLevel = d.GetServiceAccountPermissionLevel().String()
+	}
+
+	if d.GetCreated() != nil {
+		sd.Created = d.GetCreated().AsTime().Format("2006-01-02T15:04:05Z")
+	}
+
+	for _, c := range d.GetContainers() {
+		sc := sanitizedContainer{
+			Name:            c.GetName(),
+			SecurityContext: c.GetSecurityContext(),
+			UID:             c.GetConfig().GetUid(),
+		}
+
+		if img := c.GetImage(); img != nil && img.GetName() != nil {
+			sc.ImageFullName = img.GetName().GetFullName()
+		}
+
+		if res := c.GetResources(); res != nil {
+			sc.Resources = res
+		}
+
+		sc.LivenessProbe = c.GetLivenessProbe()
+		sc.ReadinessProbe = c.GetReadinessProbe()
+
+		sd.Containers = append(sd.Containers, sc)
+	}
+	return sd
+}
+
+func sanitizeRisk(r *storage.Risk) sanitizedRisk {
+	if r == nil {
+		return sanitizedRisk{}
+	}
+	sr := sanitizedRisk{
+		Score: r.GetScore(),
+	}
+	for _, result := range r.GetResults() {
+		srr := sanitizedRiskResult{
+			Name:  result.GetName(),
+			Score: result.GetScore(),
+		}
+		for _, factor := range result.GetFactors() {
+			msg := factor.GetMessage()
+			if msg == "" {
+				continue
+			}
+			// Redact process arguments from process baseline violation messages
+			// as they may contain sensitive information (passwords, tokens, etc.).
+			if result.GetName() == deployment.ProcessBaselineHeading {
+				msg = processArgsPattern.ReplaceAllString(msg, "<redacted args>")
+			}
+			srr.Factors = append(srr.Factors, sanitizedRiskFactor{
+				Message: msg,
+			})
+		}
+		sr.Results = append(sr.Results, srr)
+	}
+	return sr
+}
diff --git a/central/deployment/service/service.go b/central/deployment/service/service.go
index 85a5236c9de5f..9918f55fdf9f5 100644
--- a/central/deployment/service/service.go
+++ b/central/deployment/service/service.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/stackrox/rox/central/deployment/datastore"
+	olsClient "github.com/stackrox/rox/central/lightspeed/client"
 	processBaselineDataStore "github.com/stackrox/rox/central/processbaseline/datastore"
 	processBaselineResultsStore "github.com/stackrox/rox/central/processbaselineresults/datastore"
 	processIndicatorDataStore "github.com/stackrox/rox/central/processindicator/datastore"
@@ -24,7 +25,7 @@ type Service interface {
 
 // New returns a new Service instance using the given DataStore.
 func New(datastore datastore.DataStore, processIndicators processIndicatorDataStore.DataStore, processBaselines processBaselineDataStore.DataStore,
-	processBaselineResults processBaselineResultsStore.DataStore, risks riskDataStore.DataStore, manager riskManager.Manager) Service {
+	processBaselineResults processBaselineResultsStore.DataStore, risks riskDataStore.DataStore, manager riskManager.Manager, lightspeed olsClient.Client) Service {
 	return &serviceImpl{
 		datastore:              datastore,
 		processIndicators:      processIndicators,
@@ -32,5 +33,6 @@ func New(datastore datastore.DataStore, processIndicators processIndicatorDataSt
 		processBaselineResults: processBaselineResults,
 		risks:                  risks,
 		manager:                manager,
+		lightspeedClient:       lightspeed,
 	}
 }
diff --git a/central/deployment/service/service_impl.go b/central/deployment/service/service_impl.go
index 6cefc43bc7aef..3ba4f12a378f5 100644
--- a/central/deployment/service/service_impl.go
+++ b/central/deployment/service/service_impl.go
@@ -9,6 +9,7 @@ import (
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/central/deployment/datastore"
+	olsClient "github.com/stackrox/rox/central/lightspeed/client"
 	processBaselineStore "github.com/stackrox/rox/central/processbaseline/datastore"
 	processBaselineResultsStore "github.com/stackrox/rox/central/processbaselineresults/datastore"
 	processIndicatorStore "github.com/stackrox/rox/central/processindicator/datastore"
@@ -21,6 +22,7 @@ import (
 	"github.com/stackrox/rox/pkg/grpc/authz"
 	"github.com/stackrox/rox/pkg/grpc/authz/perrpc"
 	"github.com/stackrox/rox/pkg/grpc/authz/user"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/sac/resources"
 	"github.com/stackrox/rox/pkg/search"
 	"github.com/stackrox/rox/pkg/search/options/deployments"
@@ -29,17 +31,23 @@ import (
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/utils"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 const (
 	maxDeploymentsReturned = 1000
+	lowRiskThreshold       = 5.0
 )
 
+var log = logging.LoggerForModule()
+
 var (
 	authorizer = perrpc.FromMap(map[authz.Authorizer][]string{
 		user.With(permissions.View(resources.Deployment)): {
 			v1.DeploymentService_GetDeployment_FullMethodName,
 			v1.DeploymentService_GetDeploymentWithRisk_FullMethodName,
+			v1.DeploymentService_GetDeploymentRiskAISummary_FullMethodName,
 			v1.DeploymentService_CountDeployments_FullMethodName,
 			v1.DeploymentService_ListDeployments_FullMethodName,
 			v1.DeploymentService_GetLabels_FullMethodName,
@@ -60,6 +68,7 @@ type serviceImpl struct {
 	processBaselineResults processBaselineResultsStore.DataStore
 	risks                  riskDataStore.DataStore
 	manager                manager.Manager
+	lightspeedClient       olsClient.Client
 }
 
 func (s *serviceImpl) ExportDeployments(req *v1.ExportDeploymentRequest, srv v1.DeploymentService_ExportDeploymentsServer) error {
@@ -279,3 +288,51 @@ func labelsMapFromSearchResults(results []search.Result) (map[string]*v1.Deploym
 
 	return keyValuesMap, values
 }
+
+// GetDeploymentRiskAISummary returns an AI-generated risk summary for a deployment.
+func (s *serviceImpl) GetDeploymentRiskAISummary(ctx context.Context, request *v1.ResourceByID) (*v1.DeploymentRiskAISummaryResponse, error) {
+	deployment, exists, err := s.datastore.GetDeployment(ctx, request.GetId())
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.Wrapf(errox.NotFound, "deployment with id '%s' does not exist", request.GetId())
+	}
+
+	risk, _, err := s.risks.GetRiskForDeployment(ctx, deployment)
+	if err != nil {
+		return nil, err
+	}
+
+	// Skip LLM call for deployments without risk data.
+	if risk == nil {
+		return &v1.DeploymentRiskAISummaryResponse{
+			Summary: "No risk data available for this deployment.",
+		}, nil
+	}
+
+	// Skip LLM call for low-risk deployments.
+	if risk.GetScore() < lowRiskThreshold {
+		return &v1.DeploymentRiskAISummaryResponse{
+			Summary: "Skipping AI summary since this is a low risk deployment with normalized risk score below 5.",
+		}, nil
+	}
+
+	contextJSON, err := buildSanitizedRiskContext(deployment, risk)
+	if err != nil {
+		return nil, errors.Wrap(err, "building risk context for AI summary")
+	}
+
+	query := aiSummaryPrompt + "\n\nDEPLOYMENT AND RISK DATA:\n" + contextJSON
+	olsResp, err := s.lightspeedClient.Query(ctx, &olsClient.QueryRequest{
+		Query: query,
+	})
+	if err != nil {
+		log.Errorf("Lightspeed query failed for deployment %s: %v", request.GetId(), err)
+		return nil, status.Error(codes.Unavailable, "AI service unavailable")
+	}
+
+	return &v1.DeploymentRiskAISummaryResponse{
+		Summary: olsResp.Response,
+	}, nil
+}
diff --git a/central/deployment/service/service_impl_benchmark_test.go b/central/deployment/service/service_impl_benchmark_test.go
index 7d6af56a21247..a2daed471bb34 100644
--- a/central/deployment/service/service_impl_benchmark_test.go
+++ b/central/deployment/service/service_impl_benchmark_test.go
@@ -21,7 +21,7 @@ func BenchmarkService_Export(b *testing.B) {
 	if err != nil {
 		b.Error(err)
 	}
-	svc := New(testHelper.Deployments, nil, nil, nil, nil, nil)
+	svc := New(testHelper.Deployments, nil, nil, nil, nil, nil, nil)
 	benchmarkFunc := getExportServiceBenchmark(testHelper, svc)
 	testHelper.InjectDataAndRunBenchmark(b, false, benchmarkFunc)
 }
diff --git a/central/deployment/service/singleton.go b/central/deployment/service/singleton.go
index 9453236863d01..e3d1042365d6d 100644
--- a/central/deployment/service/singleton.go
+++ b/central/deployment/service/singleton.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"github.com/stackrox/rox/central/deployment/datastore"
+	olsClient "github.com/stackrox/rox/central/lightspeed/client"
 	processBaselineDataStore "github.com/stackrox/rox/central/processbaseline/datastore"
 	processBaselineResultsStore "github.com/stackrox/rox/central/processbaselineresults/datastore"
 	processIndicatorDataStore "github.com/stackrox/rox/central/processindicator/datastore"
@@ -17,7 +18,7 @@ var (
 )
 
 func initialize() {
-	as = New(datastore.Singleton(), processIndicatorDataStore.Singleton(), processBaselineDataStore.Singleton(), processBaselineResultsStore.Singleton(), riskDataStore.Singleton(), manager.Singleton())
+	as = New(datastore.Singleton(), processIndicatorDataStore.Singleton(), processBaselineDataStore.Singleton(), processBaselineResultsStore.Singleton(), riskDataStore.Singleton(), manager.Singleton(), olsClient.NewClient())
 }
 
 // Singleton provides the instance of the Service interface to register.
diff --git a/central/detection/alertmanager/alert_manager_impl.go b/central/detection/alertmanager/alert_manager_impl.go
index 2662875455e4b..1891a4fa08e4a 100644
--- a/central/detection/alertmanager/alert_manager_impl.go
+++ b/central/detection/alertmanager/alert_manager_impl.go
@@ -374,6 +374,12 @@ func mergeAlerts(old, newAlert *storage.Alert) *storage.Alert {
 	}
 
 	newAlert.FirstOccurred = old.GetFirstOccurred()
+	// Sensor's payload does not set Inactive; keep the stored flag on the merged alert.
+	if oldDep := old.GetDeployment(); oldDep != nil && oldDep.GetInactive() {
+		if newDep := newAlert.GetDeployment(); newDep != nil {
+			newDep.Inactive = true
+		}
+	}
 	return newAlert
 }
 
@@ -427,7 +433,7 @@ func (d *alertManagerImpl) mergeManyAlerts(
 	}
 
 	// Phase 2: fetch full alerts for matched keys and merge.
-	mergedAlertIDs, mergedNew, mergedUpdated, mergeErr := d.fetchAndMergeCandidates(ctx, mergeCandidates)
+	_, mergedNew, mergedUpdated, mergeErr := d.fetchAndMergeCandidates(ctx, mergeCandidates)
 	if mergeErr != nil {
 		err = mergeErr
 		return
@@ -435,7 +441,6 @@ func (d *alertManagerImpl) mergeManyAlerts(
 	newAlerts = append(newAlerts, mergedNew...)
 	updatedAlerts = append(updatedAlerts, mergedUpdated...)
 
-	// Find old alerts no longer being produced, and identify inactive deployments.
 	deploymentsBeingRemoved := set.NewStringSet()
 	for _, f := range oldAlertFilters {
 		if depID := f.removedDeploymentID(); depID != "" {
@@ -443,6 +448,20 @@ func (d *alertManagerImpl) mergeManyAlerts(
 		}
 	}
 
+	for _, a := range newAlerts {
+		d.stampInactiveIfDeploymentGone(a, deploymentsBeingRemoved)
+	}
+	for _, a := range updatedAlerts {
+		d.stampInactiveIfDeploymentGone(a, deploymentsBeingRemoved)
+	}
+
+	// IDs already in updatedAlerts were stamped in memory. Re-fetching them
+	// would upsert the stored blob and drop merged processes.
+	alreadyUpdated := set.NewStringSet()
+	for _, a := range updatedAlerts {
+		alreadyUpdated.Add(a.GetId())
+	}
+
 	var needInactiveIDs []string
 	for _, key := range previousKeys {
 		if d.shouldMarkAlertResolved(key, incomingAlerts, oldAlertFilters...) {
@@ -454,10 +473,10 @@ func (d *alertManagerImpl) mergeManyAlerts(
 
 		if key.GetLifecycleStage() == storage.LifecycleStage_RUNTIME ||
 			key.GetState() == storage.ViolationState_ATTEMPTED {
-			if mergedAlertIDs.Contains(key.GetId()) {
-				continue
-			}
 			if key.HasDeployment() && !key.IsDeploymentInactive() {
+				if alreadyUpdated.Contains(key.GetId()) {
+					continue
+				}
 				depID := key.GetDeploymentId()
 				if deploymentsBeingRemoved.Contains(depID) || d.runtimeDetector.DeploymentInactive(depID) {
 					needInactiveIDs = append(needInactiveIDs, key.GetId())
@@ -466,7 +485,7 @@ func (d *alertManagerImpl) mergeManyAlerts(
 		}
 	}
 
-	// Mark deployments inactive for alerts not already handled by the merge phase.
+	// Stored runtime alerts with no incoming write still need an inactive stamp.
 	inactiveUpdates, inactiveErr := d.markDeploymentsInactive(ctx, needInactiveIDs)
 	if inactiveErr != nil {
 		err = inactiveErr
@@ -479,9 +498,8 @@ func (d *alertManagerImpl) mergeManyAlerts(
 }
 
 // fetchAndMergeCandidates fetches full alerts for merge candidates and merges
-// them with incoming alerts. Returns the set of merged alert IDs (to skip in
-// inactive marking), any alerts treated as new (deleted between phases), and
-// any updated alerts from merging.
+// them with incoming alerts. Returns merged IDs, alerts treated as new
+// (deleted between phases), and updated alerts from merging.
 func (d *alertManagerImpl) fetchAndMergeCandidates(ctx context.Context, candidates []mergeCandidate) (mergedIDs set.StringSet, newAlerts, updatedAlerts []*storage.Alert, err error) {
 	mergedIDs = set.NewStringSet()
 	if len(candidates) == 0 {
@@ -546,6 +564,22 @@ func (d *alertManagerImpl) markDeploymentsInactive(ctx context.Context, alertIDs
 	return updated, nil
 }
 
+// stampInactiveIfDeploymentGone sets deployment.Inactive when the deployment is
+// being removed or is already gone. Sensor can still send runtime alerts after that.
+func (d *alertManagerImpl) stampInactiveIfDeploymentGone(alert *storage.Alert, deploymentsBeingRemoved set.StringSet) {
+	if alert.GetLifecycleStage() != storage.LifecycleStage_RUNTIME &&
+		alert.GetState() != storage.ViolationState_ATTEMPTED {
+		return
+	}
+	dep := alert.GetDeployment()
+	if dep == nil || dep.GetInactive() {
+		return
+	}
+	if deploymentsBeingRemoved.Contains(dep.GetId()) || d.runtimeDetector.DeploymentInactive(dep.GetId()) {
+		dep.Inactive = true
+	}
+}
+
 func (d *alertManagerImpl) shouldMarkAlertResolved(old alertviews.AlertMatcher, incomingAlerts []*storage.Alert, oldAlertFilters ...AlertFilterOption) bool {
 	// Do not mark any attempted alerts as stale. All attempted alerts must be resolved by users.
 	if old.GetState() == storage.ViolationState_ATTEMPTED {
diff --git a/central/detection/alertmanager/alert_manager_impl_test.go b/central/detection/alertmanager/alert_manager_impl_test.go
index 4d2114b15e46d..aecff5c1961c8 100644
--- a/central/detection/alertmanager/alert_manager_impl_test.go
+++ b/central/detection/alertmanager/alert_manager_impl_test.go
@@ -171,6 +171,26 @@ func getFakeRuntimeAlert(indicators ...*storage.ProcessIndicator) *storage.Alert
 	}
 }
 
+func runtimeDeploymentAlert(id, depID string, inactive bool, process *storage.ProcessIndicator) *storage.Alert {
+	v := &storage.Alert_ProcessViolation{Processes: []*storage.ProcessIndicator{process}}
+	printer.UpdateProcessAlertViolationMessage(v)
+	return &storage.Alert{
+		Id:     id,
+		Policy: getPolicies()[0],
+		Entity: &storage.Alert_Deployment_{
+			Deployment: &storage.Alert_Deployment{
+				Id:       depID,
+				Name:     depID,
+				Inactive: inactive,
+			},
+		},
+		LifecycleStage:   storage.LifecycleStage_RUNTIME,
+		State:            storage.ViolationState_ACTIVE,
+		Time:             protocompat.GetProtoTimestampFromSeconds(100),
+		ProcessViolation: v,
+	}
+}
+
 func getFakeResourceRuntimeAlert(resourceType storage.Alert_Resource_ResourceType, resourceName, clusterID, namespaceID, namespace string) *storage.Alert {
 	return &storage.Alert{
 		LifecycleStage: storage.LifecycleStage_RUNTIME,
@@ -710,6 +730,113 @@ func (suite *AlertManagerTestSuite) TestDeploymentMarkedInactiveOnRemoval() {
 	suite.True(modified.Contains("dep-to-remove"), "removed deployment should appear in modified set")
 }
 
+func (suite *AlertManagerTestSuite) TestRepeatedDeploymentRemovalPreservesRuntimeAlert() {
+	stored := &storage.Alert{
+		Id:             "runtime-alert-1",
+		Policy:         fixtures.GetNetworkFlowPolicy(),
+		Entity:         &storage.Alert_Deployment_{Deployment: &storage.Alert_Deployment{Id: "dep-to-remove"}},
+		LifecycleStage: storage.LifecycleStage_RUNTIME,
+		State:          storage.ViolationState_ACTIVE,
+		Time:           protocompat.GetProtoTimestampFromSeconds(100),
+	}
+	suite.Require().NoError(suite.policySet.UpsertPolicy(stored.GetPolicy()))
+	suite.runtimeDetectorMock.EXPECT().PolicySet().Return(suite.policySet).AnyTimes()
+
+	// Each removal reads the current persisted state. Only the first should write.
+	suite.alertsMock.EXPECT().SearchAlertMatchKeys(suite.ctx, gomock.Any(), true).
+		DoAndReturn(func(context.Context, *v1.Query, bool) ([]*alertviews.AlertMatchKey, error) {
+			return alertsToMatchKeys([]*storage.Alert{stored}), nil
+		}).Times(2)
+	suite.alertsMock.EXPECT().SearchRawAlerts(suite.ctx, gomock.Any(), false).
+		Return([]*storage.Alert{stored.CloneVT()}, nil)
+	suite.alertsMock.EXPECT().UpsertAlert(suite.ctx, gomock.Any()).
+		DoAndReturn(func(_ context.Context, a *storage.Alert) error {
+			suite.True(a.GetDeployment().GetInactive())
+			suite.Equal(storage.ViolationState_ACTIVE, a.GetState())
+			stored = a.CloneVT()
+			return nil
+		})
+	suite.notifierMock.EXPECT().ProcessAlert(gomock.Any(), gomock.Any()).Return()
+
+	modified, err := suite.alertManager.AlertAndNotify(suite.ctx, nil,
+		WithDeploymentID("dep-to-remove", true))
+	suite.Require().NoError(err)
+	suite.True(modified.Contains("dep-to-remove"))
+
+	modified, err = suite.alertManager.AlertAndNotify(suite.ctx, nil,
+		WithDeploymentID("dep-to-remove", true))
+	suite.Require().NoError(err)
+	suite.Empty(modified.AsSlice())
+	suite.True(stored.GetDeployment().GetInactive())
+	suite.Equal(storage.ViolationState_ACTIVE, stored.GetState())
+}
+
+// TestNewRuntimeAlertMarkedInactiveWhenDeploymentGone covers a first runtime
+// alert arriving after the deployment is already gone.
+func (suite *AlertManagerTestSuite) TestNewRuntimeAlertMarkedInactiveWhenDeploymentGone() {
+	incoming := runtimeDeploymentAlert("runtime-alert-new", "dep-gone", false, nowProcess)
+
+	suite.runtimeDetectorMock.EXPECT().DeploymentInactive("dep-gone").Return(true).AnyTimes()
+	suite.alertsMock.EXPECT().SearchAlertMatchKeys(suite.ctx, gomock.Any(), true).Return(nil, nil)
+	suite.alertsMock.EXPECT().UpsertAlert(suite.ctx, gomock.Any()).DoAndReturn(func(_ context.Context, a *storage.Alert) error {
+		suite.True(a.GetDeployment().GetInactive(), "new runtime alert should be marked inactive")
+		return nil
+	})
+	suite.notifierMock.EXPECT().ProcessAlert(gomock.Any(), gomock.Any()).Return()
+
+	modified, err := suite.alertManager.AlertAndNotify(suite.ctx, []*storage.Alert{incoming})
+	suite.NoError(err)
+	suite.True(modified.Contains("dep-gone"))
+}
+
+// TestMergedRuntimeAlertMarkedInactiveWhenDeploymentGone covers a later runtime
+// alert merging into a stored one after the deployment is already gone.
+func (suite *AlertManagerTestSuite) TestMergedRuntimeAlertMarkedInactiveWhenDeploymentGone() {
+	previous := runtimeDeploymentAlert("runtime-alert-1", "dep-gone", false, yesterdayProcess)
+	incoming := runtimeDeploymentAlert("runtime-alert-incoming", "dep-gone", false, nowProcess)
+
+	suite.runtimeDetectorMock.EXPECT().DeploymentInactive("dep-gone").Return(true).AnyTimes()
+	suite.runtimeDetectorMock.EXPECT().PolicySet().Return(suite.policySet).AnyTimes()
+
+	suite.alertsMock.EXPECT().SearchAlertMatchKeys(suite.ctx, gomock.Any(), true).
+		Return(alertsToMatchKeys([]*storage.Alert{previous}), nil)
+	suite.alertsMock.EXPECT().SearchRawAlerts(suite.ctx, gomock.Any(), false).Return([]*storage.Alert{previous.CloneVT()}, nil)
+
+	suite.alertsMock.EXPECT().UpsertAlert(suite.ctx, gomock.Any()).DoAndReturn(func(_ context.Context, a *storage.Alert) error {
+		suite.True(a.GetDeployment().GetInactive(), "merged runtime alert should be marked inactive")
+		suite.Len(a.GetProcessViolation().GetProcesses(), 2, "inactive stamp must not replace the merged processes")
+		return nil
+	})
+	suite.notifierMock.EXPECT().ProcessAlert(gomock.Any(), gomock.Any()).Return()
+
+	modified, err := suite.alertManager.AlertAndNotify(suite.ctx, []*storage.Alert{incoming})
+	suite.NoError(err)
+	suite.True(modified.Contains("dep-gone"))
+}
+
+func (suite *AlertManagerTestSuite) TestUnchangedRuntimeAlertMarkedInactiveWhenDeploymentGone() {
+	previous := runtimeDeploymentAlert("runtime-alert-1", "dep-gone", false, yesterdayProcess)
+	incoming := runtimeDeploymentAlert("runtime-alert-incoming", "dep-gone", false, yesterdayProcess)
+
+	suite.alertsMock.EXPECT().SearchAlertMatchKeys(suite.ctx, gomock.Any(), true).
+		Return(alertsToMatchKeys([]*storage.Alert{previous}), nil)
+	suite.alertsMock.EXPECT().SearchRawAlerts(suite.ctx, gomock.Any(), false).
+		Return([]*storage.Alert{previous.CloneVT()}, nil)
+	suite.runtimeDetectorMock.EXPECT().DeploymentInactive("dep-gone").Return(true)
+	suite.alertsMock.EXPECT().SearchRawAlerts(suite.ctx, gomock.Any(), false).
+		Return([]*storage.Alert{previous.CloneVT()}, nil)
+	suite.alertsMock.EXPECT().UpsertAlert(suite.ctx, gomock.Any()).DoAndReturn(func(_ context.Context, stored *storage.Alert) error {
+		suite.Equal(previous.GetId(), stored.GetId())
+		suite.True(stored.GetDeployment().GetInactive(), "stored runtime alert should be marked inactive")
+		return nil
+	})
+	suite.notifierMock.EXPECT().ProcessAlert(gomock.Any(), gomock.Any()).Return()
+
+	modified, err := suite.alertManager.AlertAndNotify(suite.ctx, []*storage.Alert{incoming})
+	suite.NoError(err)
+	suite.True(modified.Contains("dep-gone"))
+}
+
 func (suite *AlertManagerTestSuite) TestResolvedDeploymentAlertReturnsDeploymentID() {
 	alerts := getAlerts()
 
@@ -731,6 +858,33 @@ func (suite *AlertManagerTestSuite) TestResolvedDeploymentAlertReturnsDeployment
 		"resolved deployment alert's deployment ID should appear in modified set")
 }
 
+func TestMergeAlertsPreservesDeploymentInactive(t *testing.T) {
+	cases := map[string]struct {
+		oldInactive bool
+		newInactive bool
+		want        bool
+	}{
+		"stored inactive is kept when Sensor sends a new process": {
+			oldInactive: true,
+			newInactive: false,
+			want:        true,
+		},
+		"active stays active when both sides are active": {
+			oldInactive: false,
+			newInactive: false,
+			want:        false,
+		},
+	}
+	for name, c := range cases {
+		t.Run(name, func(t *testing.T) {
+			old := runtimeDeploymentAlert("alert-1", "dep", c.oldInactive, yesterdayProcess)
+			newAlert := runtimeDeploymentAlert("alert-incoming", "dep", c.newInactive, nowProcess)
+			merged := mergeAlerts(old, newAlert)
+			assert.Equal(t, c.want, merged.GetDeployment().GetInactive())
+		})
+	}
+}
+
 func TestMergeProcessesFromOldIntoNew(t *testing.T) {
 	for _, c := range []struct {
 		desc           string
diff --git a/central/detection/runtime/detector_impl.go b/central/detection/runtime/detector_impl.go
index c7cbc63af811c..5746c5927b238 100644
--- a/central/detection/runtime/detector_impl.go
+++ b/central/detection/runtime/detector_impl.go
@@ -50,7 +50,7 @@ func (d *detectorImpl) DeploymentWhitelistedForPolicy(deploymentID, policyID str
 }
 
 func (d *detectorImpl) DeploymentInactive(deploymentID string) bool {
-	_, exists, err := d.deployments.ListDeployment(detectorCtx, deploymentID)
+	exists, err := d.deployments.DeploymentExists(detectorCtx, deploymentID)
 	if err != nil {
 		log.Errorf("Couldn't determine inactive state of deployment %q: %v", deploymentID, err)
 		return false
diff --git a/central/detection/runtime/detector_impl_test.go b/central/detection/runtime/detector_impl_test.go
new file mode 100644
index 0000000000000..53cd5d5f228d2
--- /dev/null
+++ b/central/detection/runtime/detector_impl_test.go
@@ -0,0 +1,42 @@
+package runtime
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stackrox/rox/central/deployment/datastore/mocks"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
+)
+
+func TestDeploymentInactive(t *testing.T) {
+	tests := map[string]struct {
+		exists   bool
+		err      error
+		inactive bool
+	}{
+		"present deployment": {
+			exists:   true,
+			inactive: false,
+		},
+		"missing deployment": {
+			exists:   false,
+			inactive: true,
+		},
+		// A failed lookup must not mark live deployments' alerts inactive.
+		"datastore error": {
+			err:      errors.New("database unavailable"),
+			inactive: false,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			deployments := mocks.NewMockDataStore(gomock.NewController(t))
+			deployments.EXPECT().DeploymentExists(gomock.Any(), "deployment-id").Return(test.exists, test.err)
+
+			detector := NewDetector(nil, deployments)
+			assert.Equal(t, test.inactive, detector.DeploymentInactive("deployment-id"))
+		})
+	}
+}
diff --git a/central/enrichment/singleton.go b/central/enrichment/singleton.go
index ba236d20af19c..598731bd43634 100644
--- a/central/enrichment/singleton.go
+++ b/central/enrichment/singleton.go
@@ -57,6 +57,7 @@ func initialize() {
 		scanwaiterv2.Singleton(),
 
 		sachelper.NewClusterNamespaceSacHelper(clusterDataStore.Singleton(), namespaceDataStore.Singleton()),
+		clusterDataStore.Singleton(),
 	)
 
 	if !features.FlattenImageData.Enabled() {
diff --git a/central/globaldb/postgres.go b/central/globaldb/postgres.go
index abe878815af26..a1a1005f02565 100644
--- a/central/globaldb/postgres.go
+++ b/central/globaldb/postgres.go
@@ -134,6 +134,12 @@ func SetPostgresTest(t *testing.T, db postgres.DB) postgres.DB {
 
 // InitializePostgres creates and returns returns a global database instance.
 func InitializePostgres(ctx context.Context) postgres.DB {
+	return InitializePostgresWithPoolSize(ctx, 0)
+}
+
+// InitializePostgresWithPoolSize creates a global database instance with an overridden
+// connection pool size. If maxConns is 0, the default from the DSN is used.
+func InitializePostgresWithPoolSize(ctx context.Context, maxConns int32) postgres.DB {
 	pgSync.Do(func() {
 		_, dbConfig, err := pgconfig.GetPostgresConfig()
 		if err != nil {
@@ -141,13 +147,14 @@ func InitializePostgres(ctx context.Context) postgres.DB {
 		}
 
 		if !pgconfig.IsExternalDatabase() {
-			// Get the active database name for the connection
 			activeDB := pgconfig.GetActiveDB()
-
-			// Set the connection to be the active database.
 			dbConfig.ConnConfig.Database = activeDB
 		}
 
+		if maxConns > 0 {
+			dbConfig.MaxConns = maxConns
+		}
+
 		if err := retry.WithRetry(func() error {
 			postgresDB, err = postgres.New(ctx, dbConfig)
 			return err
diff --git a/central/globalindex/mapping/mapping.go b/central/globalindex/mapping/mapping.go
index 7226709613ab4..a62952f6a41e6 100644
--- a/central/globalindex/mapping/mapping.go
+++ b/central/globalindex/mapping/mapping.go
@@ -8,6 +8,7 @@ import (
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/postgres/schema"
 	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/search/policycategory"
 )
 
 // GetEntityOptionsMap is a mapping from search categories to the options
@@ -52,6 +53,11 @@ func GetEntityOptionsMap() map[v1.SearchCategory]search.OptionsMap {
 		schema.RoleBindingsSchema.OptionsMap,
 	)
 
+	policiesSearchOptions := search.CombineOptionsMaps(
+		policycategory.CategorySearchOptions,
+		schema.PoliciesSchema.OptionsMap,
+	)
+
 	// EntityOptionsMap is a mapping from search categories to the options map for that category.
 	// search document maps are also built off this map
 	entityOptionsMap := map[v1.SearchCategory]search.OptionsMap{
@@ -69,7 +75,7 @@ func GetEntityOptionsMap() map[v1.SearchCategory]search.OptionsMap {
 		v1.SearchCategory_NODE_VULNERABILITIES:    nodeToVulnerabilitySearchOptions,
 		v1.SearchCategory_NODES:                   nodeToVulnerabilitySearchOptions,
 		v1.SearchCategory_PODS:                    schema.PodsSchema.OptionsMap,
-		v1.SearchCategory_POLICIES:                schema.PoliciesSchema.OptionsMap,
+		v1.SearchCategory_POLICIES:                policiesSearchOptions,
 		v1.SearchCategory_POLICY_CATEGORIES:       schema.PolicyCategoriesSchema.OptionsMap,
 		v1.SearchCategory_PROCESS_BASELINES:       schema.ProcessBaselinesSchema.OptionsMap,
 		v1.SearchCategory_PROCESS_INDICATORS:      schema.ProcessIndicatorsSchema.OptionsMap,
diff --git a/central/graphql/generator/codegen/typewalk.go b/central/graphql/generator/codegen/typewalk.go
index 80c5cb3a0140b..b1a1bcb84d58b 100644
--- a/central/graphql/generator/codegen/typewalk.go
+++ b/central/graphql/generator/codegen/typewalk.go
@@ -126,6 +126,9 @@ func (ctx *walkState) walkField(td *typeData, p reflect.Type, sf reflect.StructF
 	if !td.IsInputType && protoreflect.IsInternalGeneratorField(sf) {
 		return
 	}
+	if _, ok := sf.Tag.Lookup("protobuf_oneof"); ok {
+		return
+	}
 	if strings.HasPrefix(sf.Name, "DEPRECATED") {
 		return
 	}
diff --git a/central/graphql/resolvers/generated.go b/central/graphql/resolvers/generated.go
index e567571423f44..1e9ccedb56b07 100644
--- a/central/graphql/resolvers/generated.go
+++ b/central/graphql/resolvers/generated.go
@@ -199,6 +199,7 @@ func registerGeneratedTypes(builder generator.SchemaBuilder) {
 		"cvssV3: CVSSV3",
 		"epss: EPSS",
 		"exploit: Exploit",
+		"knownRansomwareCampaign: Boolean!",
 		"lastModified: Time",
 		"link: String!",
 		"publishedOn: Time",
@@ -668,17 +669,27 @@ func registerGeneratedTypes(builder generator.SchemaBuilder) {
 	generator.RegisterProtoEnum(builder, reflect.TypeOf(storage.EventSource(0)))
 	utils.Must(builder.AddType("Exclusion", []string{
 		"deployment: Exclusion_Deployment",
+		"excludeByKind: Exclusion_ExcludeByKind",
 		"expiration: Time",
 		"image: Exclusion_Image",
 		"name: String!",
+		"matcher: ExclusionMatcher",
+	}))
+	utils.Must(builder.AddUnionType("ExclusionMatcher", []string{
+		"Exclusion_Deployment",
+		"Exclusion_ExcludeByKind",
 	}))
 	utils.Must(builder.AddType("Exclusion_Deployment", []string{
 		"name: String!",
 		"scope: Scope",
 	}))
+	utils.Must(builder.AddType("Exclusion_ExcludeByKind", []string{
+		"kinds: [Exclusion_WorkloadKind!]!",
+	}))
 	utils.Must(builder.AddType("Exclusion_Image", []string{
 		"name: String!",
 	}))
+	generator.RegisterProtoEnum(builder, reflect.TypeOf(storage.Exclusion_WorkloadKind(0)))
 	utils.Must(builder.AddType("Exploit", []string{
 		"dateAdded: String!",
 		"dueDate: String!",
@@ -1575,6 +1586,7 @@ func registerGeneratedTypes(builder generator.SchemaBuilder) {
 		"type: String!",
 	}))
 	generator.RegisterProtoEnum(builder, reflect.TypeOf(storage.Volume_MountPropagation(0)))
+	generator.RegisterProtoEnum(builder, reflect.TypeOf(storage.VulnOrigin(0)))
 	utils.Must(builder.AddInput("VulnReqGlobalScope", []string{
 		"images: VulnReqImageScope",
 	}))
@@ -3435,6 +3447,11 @@ func (resolver *cVEInfoResolver) Exploit(ctx context.Context) (*exploitResolver,
 	return resolver.root.wrapExploit(value, true, nil)
 }
 
+func (resolver *cVEInfoResolver) KnownRansomwareCampaign(ctx context.Context) bool {
+	value := resolver.data.GetKnownRansomwareCampaign()
+	return value
+}
+
 func (resolver *cVEInfoResolver) LastModified(ctx context.Context) (*graphql.Time, error) {
 	value := resolver.data.GetLastModified()
 	return protocompat.ConvertTimestampToGraphqlTimeOrError(value)
@@ -8026,6 +8043,11 @@ func (resolver *exclusionResolver) Deployment(ctx context.Context) (*exclusion_D
 	return resolver.root.wrapExclusion_Deployment(value, true, nil)
 }
 
+func (resolver *exclusionResolver) ExcludeByKind(ctx context.Context) (*exclusion_ExcludeByKindResolver, error) {
+	value := resolver.data.GetExcludeByKind()
+	return resolver.root.wrapExclusion_ExcludeByKind(value, true, nil)
+}
+
 func (resolver *exclusionResolver) Expiration(ctx context.Context) (*graphql.Time, error) {
 	value := resolver.data.GetExpiration()
 	return protocompat.ConvertTimestampToGraphqlTimeOrError(value)
@@ -8041,6 +8063,34 @@ func (resolver *exclusionResolver) Name(ctx context.Context) string {
 	return value
 }
 
+type exclusionMatcherResolver struct {
+	resolver interface{}
+}
+
+func (resolver *exclusionResolver) Matcher() *exclusionMatcherResolver {
+	if val := resolver.data.GetDeployment(); val != nil {
+		return &exclusionMatcherResolver{
+			resolver: &exclusion_DeploymentResolver{root: resolver.root, data: val},
+		}
+	}
+	if val := resolver.data.GetExcludeByKind(); val != nil {
+		return &exclusionMatcherResolver{
+			resolver: &exclusion_ExcludeByKindResolver{root: resolver.root, data: val},
+		}
+	}
+	return nil
+}
+
+func (resolver *exclusionMatcherResolver) ToExclusion_Deployment() (*exclusion_DeploymentResolver, bool) {
+	res, ok := resolver.resolver.(*exclusion_DeploymentResolver)
+	return res, ok
+}
+
+func (resolver *exclusionMatcherResolver) ToExclusion_ExcludeByKind() (*exclusion_ExcludeByKindResolver, bool) {
+	res, ok := resolver.resolver.(*exclusion_ExcludeByKindResolver)
+	return res, ok
+}
+
 type exclusion_DeploymentResolver struct {
 	ctx  context.Context
 	root *Resolver
@@ -8093,6 +8143,53 @@ func (resolver *exclusion_DeploymentResolver) Scope(ctx context.Context) (*scope
 	return resolver.root.wrapScope(value, true, nil)
 }
 
+type exclusion_ExcludeByKindResolver struct {
+	ctx  context.Context
+	root *Resolver
+	data *storage.Exclusion_ExcludeByKind
+}
+
+func (resolver *Resolver) wrapExclusion_ExcludeByKind(value *storage.Exclusion_ExcludeByKind, ok bool, err error) (*exclusion_ExcludeByKindResolver, error) {
+	if !ok || err != nil || value == nil {
+		return nil, err
+	}
+	return &exclusion_ExcludeByKindResolver{root: resolver, data: value}, nil
+}
+
+func (resolver *Resolver) wrapExclusion_ExcludeByKinds(values []*storage.Exclusion_ExcludeByKind, err error) ([]*exclusion_ExcludeByKindResolver, error) {
+	if err != nil || len(values) == 0 {
+		return nil, err
+	}
+	output := make([]*exclusion_ExcludeByKindResolver, len(values))
+	for i, v := range values {
+		output[i] = &exclusion_ExcludeByKindResolver{root: resolver, data: v}
+	}
+	return output, nil
+}
+
+func (resolver *Resolver) wrapExclusion_ExcludeByKindWithContext(ctx context.Context, value *storage.Exclusion_ExcludeByKind, ok bool, err error) (*exclusion_ExcludeByKindResolver, error) {
+	if !ok || err != nil || value == nil {
+		return nil, err
+	}
+	return &exclusion_ExcludeByKindResolver{ctx: ctx, root: resolver, data: value}, nil
+}
+
+func (resolver *Resolver) wrapExclusion_ExcludeByKindsWithContext(ctx context.Context, values []*storage.Exclusion_ExcludeByKind, err error) ([]*exclusion_ExcludeByKindResolver, error) {
+	if err != nil || len(values) == 0 {
+		return nil, err
+	}
+	output := make([]*exclusion_ExcludeByKindResolver, len(values))
+	for i, v := range values {
+		output[i] = &exclusion_ExcludeByKindResolver{ctx: ctx, root: resolver, data: v}
+	}
+	return output, nil
+}
+
+func (resolver *exclusion_ExcludeByKindResolver) Kinds(ctx context.Context) []string {
+	value := resolver.data.GetKinds()
+	return stringSlice(value)
+}
+
 type exclusion_ImageResolver struct {
 	ctx  context.Context
 	root *Resolver
@@ -8140,6 +8237,24 @@ func (resolver *exclusion_ImageResolver) Name(ctx context.Context) string {
 	return value
 }
 
+func toExclusion_WorkloadKind(value *string) storage.Exclusion_WorkloadKind {
+	if value != nil {
+		return storage.Exclusion_WorkloadKind(storage.Exclusion_WorkloadKind_value[*value])
+	}
+	return storage.Exclusion_WorkloadKind(0)
+}
+
+func toExclusion_WorkloadKinds(values *[]string) []storage.Exclusion_WorkloadKind {
+	if values == nil {
+		return nil
+	}
+	output := make([]storage.Exclusion_WorkloadKind, len(*values))
+	for i, v := range *values {
+		output[i] = toExclusion_WorkloadKind(&v)
+	}
+	return output
+}
+
 type exploitResolver struct {
 	ctx  context.Context
 	root *Resolver
@@ -16916,6 +17031,24 @@ func toVolume_MountPropagations(values *[]string) []storage.Volume_MountPropagat
 	return output
 }
 
+func toVulnOrigin(value *string) storage.VulnOrigin {
+	if value != nil {
+		return storage.VulnOrigin(storage.VulnOrigin_value[*value])
+	}
+	return storage.VulnOrigin(0)
+}
+
+func toVulnOrigins(values *[]string) []storage.VulnOrigin {
+	if values == nil {
+		return nil
+	}
+	output := make([]storage.VulnOrigin, len(*values))
+	for i, v := range *values {
+		output[i] = toVulnOrigin(&v)
+	}
+	return output
+}
+
 type vulnerabilityRequest_CVEsResolver struct {
 	ctx  context.Context
 	root *Resolver
diff --git a/central/graphql/resolvers/image_vulnerabilities.go b/central/graphql/resolvers/image_vulnerabilities.go
index 6d939f8aa78db..6d81452f5e2da 100644
--- a/central/graphql/resolvers/image_vulnerabilities.go
+++ b/central/graphql/resolvers/image_vulnerabilities.go
@@ -59,6 +59,7 @@ func init() {
 				"images(query: String, pagination: Pagination): [Image!]!",
 				"operatingSystem: String!",
 				"vulnerabilityState: String!",
+				"origin: String!",
 				"nvdCvss: Float!",
 				"nvdScoreVersion: String!",
 			)),
@@ -86,6 +87,7 @@ type ImageVulnerabilityResolver interface {
 	Images(ctx context.Context, args PaginatedQuery) ([]ImageResolver, error)
 	OperatingSystem(ctx context.Context) string
 	VulnerabilityState(ctx context.Context) string
+	Origin(ctx context.Context) string
 	Nvdcvss(ctx context.Context) float64
 	NvdScoreVersion(ctx context.Context) string
 }
diff --git a/central/graphql/resolvers/image_vulnerabilities_utilities.go b/central/graphql/resolvers/image_vulnerabilities_utilities.go
index b6434795d4577..63f3dec694cfc 100644
--- a/central/graphql/resolvers/image_vulnerabilities_utilities.go
+++ b/central/graphql/resolvers/image_vulnerabilities_utilities.go
@@ -108,3 +108,7 @@ func (resolver *imageCVEV2Resolver) State(ctx context.Context) string {
 	value := resolver.data.GetState()
 	return value.String()
 }
+
+func (resolver *imageCVEV2Resolver) Origin(_ context.Context) string {
+	return resolver.data.GetOrigin().String()
+}
diff --git a/central/graphql/resolvers/test_setup_utils.go b/central/graphql/resolvers/test_setup_utils.go
index 0709b99e18a4c..d34ad58c09ae7 100644
--- a/central/graphql/resolvers/test_setup_utils.go
+++ b/central/graphql/resolvers/test_setup_utils.go
@@ -256,7 +256,8 @@ func CreateTestClusterDatastore(t testing.TB, testDB *pgtest.TestPostgres, ctrl
 	connMgr.EXPECT().GetConnection(gomock.Any()).AnyTimes()
 	datastore, err := clusterDataStore.New(storage, healthStorage,
 		clusterCVEDS, nil, nil, namespaceDS, nil, nodeDataStore, nil, nil,
-		netFlows, netEntities, nil, nil, nil, connMgr, nil, ranking.ClusterRanker(), nil, nil, nil)
+		netFlows, netEntities, nil, nil, nil, connMgr, nil, ranking.ClusterRanker(), nil, nil, nil,
+		nil, nil)
 	assert.NoError(t, err, "failed to create cluster datastore")
 	return datastore
 }
diff --git a/central/image/datastore/datastore.go b/central/image/datastore/datastore.go
index 5d4fee9f0987e..b3aac9d1f2fff 100644
--- a/central/image/datastore/datastore.go
+++ b/central/image/datastore/datastore.go
@@ -29,6 +29,7 @@ type DataStore interface {
 	GetManyImageMetadata(ctx context.Context, ids []string) ([]*storage.Image, error)
 	GetImagesBatch(ctx context.Context, shas []string) ([]*storage.Image, error)
 	WalkByQuery(ctx context.Context, q *v1.Query, fn func(image *storage.Image) error) error
+	WalkMetadataByQuery(ctx context.Context, q *v1.Query, fn func(image *storage.Image) error) error
 
 	UpsertImage(ctx context.Context, image *storage.Image) error
 	UpdateVulnerabilityState(ctx context.Context, cve string, images []string, state storage.VulnerabilityState) error
diff --git a/central/image/datastore/datastore_impl.go b/central/image/datastore/datastore_impl.go
index cfd3c50017d5b..443f30ef90bdb 100644
--- a/central/image/datastore/datastore_impl.go
+++ b/central/image/datastore/datastore_impl.go
@@ -149,6 +149,10 @@ func (ds *datastoreImpl) WalkByQuery(ctx context.Context, q *v1.Query, fn func(i
 	return ds.storage.WalkByQuery(ctx, q, wrappedFn)
 }
 
+func (ds *datastoreImpl) WalkMetadataByQuery(ctx context.Context, q *v1.Query, fn func(image *storage.Image) error) error {
+	return ds.storage.WalkMetadataByQuery(ctx, q, fn)
+}
+
 // CountImages delegates to the underlying store.
 func (ds *datastoreImpl) CountImages(ctx context.Context) (int, error) {
 	if _, err := imagesSAC.ReadAllowed(ctx); err != nil {
diff --git a/central/image/datastore/mocks/datastore.go b/central/image/datastore/mocks/datastore.go
index fe28488fb626e..90e0fe6f61efb 100644
--- a/central/image/datastore/mocks/datastore.go
+++ b/central/image/datastore/mocks/datastore.go
@@ -286,3 +286,17 @@ func (mr *MockDataStoreMockRecorder) WalkByQuery(ctx, q, fn any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WalkByQuery", reflect.TypeOf((*MockDataStore)(nil).WalkByQuery), ctx, q, fn)
 }
+
+// WalkMetadataByQuery mocks base method.
+func (m *MockDataStore) WalkMetadataByQuery(ctx context.Context, q *v1.Query, fn func(*storage.Image) error) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WalkMetadataByQuery", ctx, q, fn)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// WalkMetadataByQuery indicates an expected call of WalkMetadataByQuery.
+func (mr *MockDataStoreMockRecorder) WalkMetadataByQuery(ctx, q, fn any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WalkMetadataByQuery", reflect.TypeOf((*MockDataStore)(nil).WalkMetadataByQuery), ctx, q, fn)
+}
diff --git a/central/image/datastore/store/v2/postgres/store.go b/central/image/datastore/store/v2/postgres/store.go
index 60c5528d23d44..d9abd944a4c44 100644
--- a/central/image/datastore/store/v2/postgres/store.go
+++ b/central/image/datastore/store/v2/postgres/store.go
@@ -329,6 +329,7 @@ func copyFromImageComponentV2Cves(ctx context.Context, tx *postgres.Tx, iTime ti
 		"advisory_name",
 		"advisory_link",
 		"fixavailabletimestamp",
+		"origin",
 		"serialized",
 	}
 
@@ -370,6 +371,7 @@ func copyFromImageComponentV2Cves(ctx context.Context, tx *postgres.Tx, iTime ti
 			obj.GetAdvisory().GetName(),
 			obj.GetAdvisory().GetLink(),
 			protocompat.NilOrTime(obj.GetFixAvailableTimestamp()),
+			obj.GetOrigin(),
 			serialized,
 		})
 
@@ -421,10 +423,17 @@ func (s *storeImpl) isUpdated(oldImage, image *storage.Image) (bool, bool, error
 
 type hashWrapper struct {
 	Components []*storage.EmbeddedImageScanComponent `hash:"set"`
+	Count      int
+	VulnCount  int
 }
 
 func populateImageScanHash(scan *storage.ImageScan) error {
-	hash, err := hashstructure.Hash(hashWrapper{scan.GetComponents()}, &hashstructure.HashOptions{ZeroNil: true})
+	components := scan.GetComponents()
+	vulnCount := 0
+	for _, c := range components {
+		vulnCount += len(c.GetVulns())
+	}
+	hash, err := hashstructure.Hash(hashWrapper{Components: components, Count: len(components), VulnCount: vulnCount}, &hashstructure.HashOptions{ZeroNil: true})
 	if err != nil {
 		return errors.Wrap(err, "calculating hash for image scan")
 	}
@@ -1009,11 +1018,13 @@ func (s *storeImpl) insertIntoImageComponentV2Cves(batch *pgx.Batch, obj *storag
 		obj.GetFixedBy(),
 		obj.GetComponentId(),
 		obj.GetAdvisory().GetName(),
+		obj.GetAdvisory().GetLink(),
 		protocompat.NilOrTime(obj.GetFixAvailableTimestamp()),
+		obj.GetOrigin(),
 		serialized,
 	}
 
-	finalStr := "INSERT INTO image_cves_v2 (Id, ImageId, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, Cvss, Severity, ImpactScore, Nvdcvss, FirstImageOccurrence, State, IsFixable, FixedBy, ComponentId, advisory_name, FixAvailableTimestamp, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, ImageId = EXCLUDED.ImageId, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, FirstImageOccurrence = EXCLUDED.FirstImageOccurrence, State = EXCLUDED.State, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, ComponentId = EXCLUDED.ComponentId, advisory_name = EXCLUDED.advisory_name, FixAvailableTimestamp = EXCLUDED.FixAvailableTimestamp, serialized = EXCLUDED.serialized"
+	finalStr := "INSERT INTO image_cves_v2 (Id, ImageId, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, Cvss, Severity, ImpactScore, Nvdcvss, FirstImageOccurrence, State, IsFixable, FixedBy, ComponentId, advisory_name, advisory_link, FixAvailableTimestamp, Origin, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, ImageId = EXCLUDED.ImageId, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, FirstImageOccurrence = EXCLUDED.FirstImageOccurrence, State = EXCLUDED.State, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, ComponentId = EXCLUDED.ComponentId, advisory_name = EXCLUDED.advisory_name, advisory_link = EXCLUDED.advisory_link, FixAvailableTimestamp = EXCLUDED.FixAvailableTimestamp, Origin = EXCLUDED.Origin, serialized = EXCLUDED.serialized"
 	batch.Queue(finalStr, values...)
 
 	return nil
diff --git a/central/image/datastore/store/v2/postgres/store_hash_test.go b/central/image/datastore/store/v2/postgres/store_hash_test.go
new file mode 100644
index 0000000000000..568bb7f32398f
--- /dev/null
+++ b/central/image/datastore/store/v2/postgres/store_hash_test.go
@@ -0,0 +1,108 @@
+package postgres
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPopulateImageScanHash_DuplicateComponentsChangeHash(t *testing.T) {
+	component := &storage.EmbeddedImageScanComponent{
+		Name:    "ubi10/ubi-micro",
+		Version: "1784668691",
+	}
+
+	scanWith1 := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{component},
+	}
+	scanWith3 := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{component, component, component},
+	}
+
+	require.NoError(t, populateImageScanHash(scanWith1))
+	require.NoError(t, populateImageScanHash(scanWith3))
+
+	assert.NotEqual(t, scanWith1.GetHash(), scanWith3.GetHash(),
+		"removing duplicate components must produce a different hash")
+}
+
+func TestPopulateImageScanHash_DuplicateVulnsChangeHash(t *testing.T) {
+	vuln := &storage.EmbeddedVulnerability{
+		Cve:      "CVE-2025-1234",
+		Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
+	}
+
+	scanWith1Vuln := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{vuln}},
+		},
+	}
+	scanWith3Vulns := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{vuln, vuln, vuln}},
+		},
+	}
+
+	require.NoError(t, populateImageScanHash(scanWith1Vuln))
+	require.NoError(t, populateImageScanHash(scanWith3Vulns))
+
+	assert.NotEqual(t, scanWith1Vuln.GetHash(), scanWith3Vulns.GetHash(),
+		"removing duplicate vulns must produce a different hash")
+}
+
+func TestPopulateImageScanHash_DistinctChangesDetected(t *testing.T) {
+	scanA := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{
+				{Cve: "CVE-2025-1111"},
+			}},
+		},
+	}
+	scanB := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{
+				{Cve: "CVE-2025-2222"},
+			}},
+		},
+	}
+
+	require.NoError(t, populateImageScanHash(scanA))
+	require.NoError(t, populateImageScanHash(scanB))
+
+	assert.NotEqual(t, scanA.GetHash(), scanB.GetHash(),
+		"different CVEs must produce a different hash")
+}
+
+func TestPopulateImageScanHash_IdenticalScansMatch(t *testing.T) {
+	scan1 := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg-a", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{
+				{Cve: "CVE-2025-1111"},
+			}},
+			{Name: "pkg-b", Version: "2.0"},
+		},
+	}
+	scan2 := scan1.CloneVT()
+
+	require.NoError(t, populateImageScanHash(scan1))
+	require.NoError(t, populateImageScanHash(scan2))
+
+	assert.Equal(t, scan1.GetHash(), scan2.GetHash(),
+		"identical scans must produce the same hash")
+}
+
+func TestPopulateImageScanHash_OrderIndependent(t *testing.T) {
+	compA := &storage.EmbeddedImageScanComponent{Name: "aaa", Version: "1.0"}
+	compB := &storage.EmbeddedImageScanComponent{Name: "bbb", Version: "2.0"}
+
+	scanAB := &storage.ImageScan{Components: []*storage.EmbeddedImageScanComponent{compA, compB}}
+	scanBA := &storage.ImageScan{Components: []*storage.EmbeddedImageScanComponent{compB, compA}}
+
+	require.NoError(t, populateImageScanHash(scanAB))
+	require.NoError(t, populateImageScanHash(scanBA))
+
+	assert.Equal(t, scanAB.GetHash(), scanBA.GetHash(),
+		"component order must not affect the hash")
+}
diff --git a/central/image/service/sbom_scan_http_handler_test.go b/central/image/service/sbom_scan_http_handler_test.go
index f895204ff9a36..869d9c7b2815b 100644
--- a/central/image/service/sbom_scan_http_handler_test.go
+++ b/central/image/service/sbom_scan_http_handler_test.go
@@ -42,6 +42,7 @@ func TestScanSBOMHttpHandler_ServeHTTP(t *testing.T) {
 
 	t.Run("invalid request method", func(t *testing.T) {
 		testutils.MustUpdateFeature(t, features.ScannerV4, true)
+		testutils.MustUpdateFeature(t, features.SBOMScanning, true)
 
 		req := httptest.NewRequest(http.MethodGet, "/sbom", nil)
 		recorder := httptest.NewRecorder()
@@ -50,12 +51,9 @@ func TestScanSBOMHttpHandler_ServeHTTP(t *testing.T) {
 		handler.ServeHTTP(recorder, req)
 
 		res := recorder.Result()
-		body, err := io.ReadAll(res.Body)
-		require.NoError(t, err)
-		err = res.Body.Close()
+		err := res.Body.Close()
 		assert.NoError(t, err)
-		assert.Equal(t, http.StatusNotImplemented, res.StatusCode)
-		assert.Contains(t, string(body), "SBOM Scanning is disabled")
+		assert.Equal(t, http.StatusMethodNotAllowed, res.StatusCode)
 	})
 
 	t.Run("invalid media type", func(t *testing.T) {
diff --git a/central/image/service/service_impl.go b/central/image/service/service_impl.go
index 2a6fd35804413..a98dd40cf79ca 100644
--- a/central/image/service/service_impl.go
+++ b/central/image/service/service_impl.go
@@ -71,6 +71,7 @@ var (
 		},
 		or.SensorOr(idcheck.AdmissionControlOnly()): {
 			v1.ImageService_ScanImageInternal_FullMethodName,
+			v1.ImageService_ScanImageInternalForAdmission_FullMethodName,
 		},
 		idcheck.SensorsOnly(): {
 			v1.ImageService_GetImageVulnerabilitiesInternal_FullMethodName,
@@ -302,8 +303,24 @@ func (s *serviceImpl) saveImageV2(img *storage.ImageV2) error {
 
 // ScanImageInternal handles an image request from Sensor and Admission Controller.
 func (s *serviceImpl) ScanImageInternal(ctx context.Context, request *v1.ScanImageInternalRequest) (*v1.ScanImageInternalResponse, error) {
+	return s.scanImageInternalWithOpt(ctx, request, enricher.ForceRefetch)
+}
+
+// ScanImageInternalForAdmission handles admission-controller image requests.
+// For tag-only images it refreshes registry metadata but reuses an existing
+// scan from Central's DB when the resolved digest is already known, avoiding
+// a redundant Scanner round-trip. For digest-based images it behaves
+// identically to ScanImageInternal.
+func (s *serviceImpl) ScanImageInternalForAdmission(ctx context.Context, request *v1.ScanImageInternalRequest) (*v1.ScanImageInternalResponse, error) {
+	return s.scanImageInternalWithOpt(ctx, request, enricher.ForceRefetchMetadataOnly)
+}
+
+// scanImageInternalWithOpt is the shared implementation for ScanImageInternal
+// and ScanImageInternalForAdmission. tagOnlyFetchOpt controls the enricher
+// FetchOption used when the request has no digest (tag-only image).
+func (s *serviceImpl) scanImageInternalWithOpt(ctx context.Context, request *v1.ScanImageInternalRequest, tagOnlyFetchOpt enricher.FetchOption) (*v1.ScanImageInternalResponse, error) {
 	if features.FlattenImageData.Enabled() {
-		return s.scanImageV2Internal(ctx, request)
+		return s.scanImageV2InternalWithOpt(ctx, request, tagOnlyFetchOpt)
 	}
 
 	if err := s.acquireScanSemaphore(ctx); err != nil {
@@ -380,8 +397,8 @@ func (s *serviceImpl) ScanImageInternal(ctx context.Context, request *v1.ScanIma
 		fetchOpt = enricher.UseCachesIfPossible
 		if request.GetCachedOnly() {
 			fetchOpt = enricher.NoExternalMetadata
-		} else if imgID == "" { // If no ID, then don't use caches as they could return stale data.
-			fetchOpt = enricher.ForceRefetch
+		} else if imgID == "" {
+			fetchOpt = tagOnlyFetchOpt
 		}
 		img = types.ToImage(request.GetImage())
 	}
@@ -400,7 +417,7 @@ func (s *serviceImpl) ScanImageInternal(ctx context.Context, request *v1.ScanIma
 	return internalScanRespFromImage(img), nil
 }
 
-func (s *serviceImpl) scanImageV2Internal(ctx context.Context, request *v1.ScanImageInternalRequest) (*v1.ScanImageInternalResponse, error) {
+func (s *serviceImpl) scanImageV2InternalWithOpt(ctx context.Context, request *v1.ScanImageInternalRequest, tagOnlyFetchOpt enricher.FetchOption) (*v1.ScanImageInternalResponse, error) {
 	imgID := request.GetImage().GetIdV2()
 	if imgID == "" {
 		imgID = utils.NewImageV2ID(request.GetImage().GetName(), request.GetImage().GetId())
@@ -465,8 +482,8 @@ func (s *serviceImpl) scanImageV2Internal(ctx context.Context, request *v1.ScanI
 		fetchOpt = enricher.UseCachesIfPossible
 		if request.GetCachedOnly() {
 			fetchOpt = enricher.NoExternalMetadata
-		} else if imgID == "" { // If no ID, then don't use caches as they could return stale data.
-			fetchOpt = enricher.ForceRefetch
+		} else if imgID == "" {
+			fetchOpt = tagOnlyFetchOpt
 		}
 		imgV2 = types.ToImageV2(request.GetImage())
 		if imgV2.GetId() == "" {
diff --git a/central/image/service/service_impl_test.go b/central/image/service/service_impl_test.go
index 6ec5c9e6beb58..023538816f75d 100644
--- a/central/image/service/service_impl_test.go
+++ b/central/image/service/service_impl_test.go
@@ -405,6 +405,193 @@ func TestResetClusterLocal(t *testing.T) {
 	}
 }
 
+// TestScanImageInternalForAdmission_FetchOpt verifies that the admission RPC
+// uses ForceRefetchMetadataOnly for tag-only requests and behaves identically
+// to ScanImageInternal for digest-based requests.
+func TestScanImageInternalForAdmission_FetchOpt(t *testing.T) {
+	name, _, err := utils.GenerateImageNameFromString("reg.invalid/some/image:latest")
+	require.NoError(t, err)
+
+	names := []*storage.ImageName{name}
+
+	tcs := map[string]struct {
+		request          *v1.ScanImageInternalRequest
+		existingImg      *storage.Image
+		existingImgV2    *storage.ImageV2
+		expectedFetchOpt enricher.FetchOption
+		expectEnrich     bool
+	}{
+		"tag-only uses ForceRefetchMetadataOnly": {
+			request: &v1.ScanImageInternalRequest{
+				Image: &storage.ContainerImage{Name: name},
+			},
+			expectedFetchOpt: enricher.ForceRefetchMetadataOnly,
+			expectEnrich:     true,
+		},
+		"digest request, image in DB, skips enricher entirely": {
+			request: &v1.ScanImageInternalRequest{
+				Image: &storage.ContainerImage{Id: "sha256:abc", Name: name},
+			},
+			existingImg: &storage.Image{
+				Id: "sha256:abc", Name: name, Names: names,
+				Scan: &storage.ImageScan{},
+			},
+			existingImgV2: &storage.ImageV2{
+				Id: utils.NewImageV2ID(name, "sha256:abc"), Digest: "sha256:abc",
+				Name: name, Scan: &storage.ImageScan{},
+			},
+			expectEnrich: false,
+		},
+		"digest request, image NOT in DB, uses UseCachesIfPossible": {
+			request: &v1.ScanImageInternalRequest{
+				Image: &storage.ContainerImage{Id: "sha256:abc", Name: name},
+			},
+			expectedFetchOpt: enricher.UseCachesIfPossible,
+			expectEnrich:     true,
+		},
+	}
+
+	for desc, tc := range tcs {
+		t.Run(desc, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			riskManagerMock := riskManagerMocks.NewMockManager(ctrl)
+
+			var s *serviceImpl
+			if features.FlattenImageData.Enabled() {
+				imageEnricherV2Mock := enricherMocks.NewMockImageEnricherV2(ctrl)
+				if tc.expectEnrich {
+					fetchOptMatcher := gomock.Cond(func(eCtx enricher.EnrichmentContext) bool {
+						return eCtx.FetchOpt == tc.expectedFetchOpt
+					})
+					imageEnricherV2Mock.EXPECT().
+						EnrichImage(gomock.Any(), fetchOptMatcher, gomock.Any()).
+						Return(enricher.EnrichmentResult{}, nil).Times(1)
+				}
+
+				riskManagerMock.EXPECT().
+					CalculateRiskAndUpsertImageV2(gomock.Any()).
+					Return(nil).AnyTimes()
+
+				imageV2DSMock := imageV2DSMocks.NewMockDataStore(ctrl)
+				imageV2DSMock.EXPECT().
+					GetImage(gomock.Any(), gomock.Any()).
+					Return(tc.existingImgV2, tc.existingImgV2 != nil, nil).AnyTimes()
+				imageV2DSMock.EXPECT().
+					GetImageNames(gomock.Any(), gomock.Any()).
+					Return(names, nil).AnyTimes()
+
+				connMgrMock := connMgrMocks.NewMockManager(ctrl)
+				connMgrMock.EXPECT().AllSensorsHaveCapability(gomock.Any()).AnyTimes().Return(false)
+
+				s = &serviceImpl{
+					internalScanSemaphore: semaphore.NewWeighted(int64(env.MaxParallelImageScanInternal.IntegerSetting())),
+					enricherV2:            imageEnricherV2Mock,
+					datastoreV2:           imageV2DSMock,
+					riskManager:           riskManagerMock,
+					connManager:           connMgrMock,
+				}
+			} else {
+				imageEnricherMock := enricherMocks.NewMockImageEnricher(ctrl)
+				if tc.expectEnrich {
+					fetchOptMatcher := gomock.Cond(func(eCtx enricher.EnrichmentContext) bool {
+						return eCtx.FetchOpt == tc.expectedFetchOpt
+					})
+					imageEnricherMock.EXPECT().
+						EnrichImage(gomock.Any(), fetchOptMatcher, gomock.Any()).
+						Return(enricher.EnrichmentResult{}, nil).Times(1)
+				}
+
+				riskManagerMock.EXPECT().
+					CalculateRiskAndUpsertImage(gomock.Any()).
+					Return(nil).AnyTimes()
+
+				imageDSMock := imageDSMocks.NewMockDataStore(ctrl)
+				imageDSMock.EXPECT().
+					GetImage(gomock.Any(), gomock.Any()).
+					Return(tc.existingImg, tc.existingImg != nil, nil).AnyTimes()
+
+				s = &serviceImpl{
+					internalScanSemaphore: semaphore.NewWeighted(int64(env.MaxParallelImageScanInternal.IntegerSetting())),
+					enricher:              imageEnricherMock,
+					datastore:             imageDSMock,
+					riskManager:           riskManagerMock,
+				}
+			}
+
+			resp, err := s.ScanImageInternalForAdmission(context.Background(), tc.request)
+			require.NoError(t, err)
+			assert.NotNil(t, resp)
+		})
+	}
+}
+
+// TestScanImageInternalForAdmission_DigestParity ensures the admission RPC
+// produces the same result as ScanImageInternal for digest-based requests.
+func TestScanImageInternalForAdmission_DigestParity(t *testing.T) {
+	name, _, err := utils.GenerateImageNameFromString("reg.invalid/some/image:latest")
+	require.NoError(t, err)
+
+	names := []*storage.ImageName{name}
+	req := &v1.ScanImageInternalRequest{
+		Image: &storage.ContainerImage{Id: "sha256:abc", Name: name},
+	}
+
+	curScan := &storage.ImageScan{ScanTime: timestamppb.New(time.Now())}
+
+	buildService := func(ctrl *gomock.Controller) *serviceImpl {
+		riskManagerMock := riskManagerMocks.NewMockManager(ctrl)
+		if features.FlattenImageData.Enabled() {
+			existingImgV2 := &storage.ImageV2{
+				Id: utils.NewImageV2ID(name, "sha256:abc"), Digest: "sha256:abc",
+				Name: name, Scan: curScan,
+			}
+			imageV2DSMock := imageV2DSMocks.NewMockDataStore(ctrl)
+			imageV2DSMock.EXPECT().
+				GetImage(gomock.Any(), gomock.Any()).
+				Return(existingImgV2, true, nil).AnyTimes()
+			imageV2DSMock.EXPECT().
+				GetImageNames(gomock.Any(), gomock.Any()).
+				Return(names, nil).AnyTimes()
+
+			connMgrMock := connMgrMocks.NewMockManager(ctrl)
+			connMgrMock.EXPECT().AllSensorsHaveCapability(gomock.Any()).AnyTimes().Return(false)
+
+			return &serviceImpl{
+				internalScanSemaphore: semaphore.NewWeighted(int64(env.MaxParallelImageScanInternal.IntegerSetting())),
+				datastoreV2:           imageV2DSMock,
+				riskManager:           riskManagerMock,
+				connManager:           connMgrMock,
+			}
+		}
+		existingImg := &storage.Image{
+			Id: "sha256:abc", Name: name, Names: names, Scan: curScan,
+		}
+		imageDSMock := imageDSMocks.NewMockDataStore(ctrl)
+		imageDSMock.EXPECT().
+			GetImage(gomock.Any(), gomock.Any()).
+			Return(existingImg, true, nil).AnyTimes()
+
+		return &serviceImpl{
+			internalScanSemaphore: semaphore.NewWeighted(int64(env.MaxParallelImageScanInternal.IntegerSetting())),
+			datastore:             imageDSMock,
+			riskManager:           riskManagerMock,
+		}
+	}
+
+	ctrl1 := gomock.NewController(t)
+	ctrl2 := gomock.NewController(t)
+
+	s1 := buildService(ctrl1)
+	s2 := buildService(ctrl2)
+
+	resp1, err1 := s1.ScanImageInternal(context.Background(), req)
+	resp2, err2 := s2.ScanImageInternalForAdmission(context.Background(), req)
+
+	require.NoError(t, err1)
+	require.NoError(t, err2)
+	protoassert.Equal(t, resp1.GetImage(), resp2.GetImage())
+}
+
 // TestEnrichLocalImageInternal_ImageNames ensures that image names are
 // populated from the existing image in Central DB when the image
 // requires re-enrichment. (ie: when scan has expired)
diff --git a/central/imageintegration/datastore/singleton.go b/central/imageintegration/datastore/singleton.go
index a3d683a1b9258..f54a5acc8fd93 100644
--- a/central/imageintegration/datastore/singleton.go
+++ b/central/imageintegration/datastore/singleton.go
@@ -2,6 +2,7 @@ package datastore
 
 import (
 	"context"
+	"slices"
 
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/central/globaldb"
@@ -132,19 +133,46 @@ func setupScannerV4Integration(ctx context.Context, iiStore store.Store, iis []*
 }
 
 // createDefaultScannerV4Integration will create the default Scanner V4 integration if it does
-// not currently exist.
+// not currently exist, or reconcile its categories if they differ from the default.
 func createDefaultScannerV4Integration(ctx context.Context, iiStore store.Store) {
-	if _, exists, err := iiStore.Get(ctx, store.DefaultScannerV4Integration.GetId()); err != nil {
+	defaultID := store.DefaultScannerV4Integration.GetId()
+	existing, exists, err := iiStore.Get(ctx, defaultID)
+	if err != nil {
 		utils.Should(errors.Wrap(err, "unable to detect if default Scanner V4 integration exists"))
 		return
-	} else if exists {
-		// Nothing to do, integration exists.
+	}
+
+	if !exists {
+		log.Infof("Upserting default Scanner V4 integration %q (%s)", store.DefaultScannerV4Integration.GetName(), defaultID)
+		err := iiStore.Upsert(ctx, store.DefaultScannerV4Integration)
+		utils.Should(errors.Wrap(err, "unable to upsert default ScannerV4 integration"))
+		return
+	}
+
+	// Restore default categories on records that predate them. The API rejects category changes,
+	// so this only repairs older data. Preserve other settings.
+	if categoriesMatch(existing.GetCategories(), store.DefaultScannerV4Integration.GetCategories()) {
 		return
 	}
 
-	log.Infof("Upserting default Scanner V4 integration %q (%s)", store.DefaultScannerV4Integration.GetName(), store.DefaultScannerV4Integration.GetId())
-	err := iiStore.Upsert(ctx, store.DefaultScannerV4Integration)
-	utils.Should(errors.Wrap(err, "unable to upsert default ScannerV4 integration"))
+	log.Warnf("Reconciling categories for default Scanner V4 integration %q (%s): updating from %v to %v",
+		existing.GetName(), defaultID, existing.GetCategories(), store.DefaultScannerV4Integration.GetCategories())
+
+	existing.Categories = store.DefaultScannerV4Integration.GetCategories()
+	err = iiStore.Upsert(ctx, existing)
+	utils.Should(errors.Wrap(err, "unable to reconcile default ScannerV4 integration categories"))
+}
+
+// categoriesMatch returns true if two category slices contain the same elements (order-independent).
+func categoriesMatch(a, b []storage.ImageIntegrationCategory) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	a = slices.Clone(a)
+	b = slices.Clone(b)
+	slices.Sort(a)
+	slices.Sort(b)
+	return slices.Equal(a, b)
 }
 
 // deleteScannerV4Integrations will delete all Scanner V4 integrations except for
diff --git a/central/imageintegration/datastore/singleton_test.go b/central/imageintegration/datastore/singleton_test.go
index cbbf1e712e097..94b79b4e8b4d2 100644
--- a/central/imageintegration/datastore/singleton_test.go
+++ b/central/imageintegration/datastore/singleton_test.go
@@ -149,11 +149,23 @@ func TestSetupScannerV4Integration(t *testing.T) {
 		}
 	})
 
-	t.Run("do not try upsert if default integration exists", func(t *testing.T) {
+	t.Run("do not try upsert if default integration exists with correct categories", func(t *testing.T) {
 		testutils.MustUpdateFeature(t, features.ScannerV4, true)
 		s := mockIIStore.NewMockStore(gomock.NewController(t))
 
-		s.EXPECT().Get(ctx, defID).Return(nil, true, nil)
+		existingCorrect := &storage.ImageIntegration{
+			Id:   defID,
+			Name: "Scanner V4",
+			Type: scannerTypes.ScannerV4,
+			Categories: []storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_SCANNER,
+				storage.ImageIntegrationCategory_NODE_SCANNER,
+			},
+			IntegrationConfig: &storage.ImageIntegration_ScannerV4{
+				ScannerV4: &storage.ScannerV4Config{},
+			},
+		}
+		s.EXPECT().Get(ctx, defID).Return(existingCorrect, true, nil)
 		s.EXPECT().PruneMany(ctx, []string{"ID-Other-ScannerV4"})
 		setupScannerV4Integration(ctx, s, iis)
 	})
@@ -212,3 +224,177 @@ func TestSetupLegacyScannerIntegration(t *testing.T) {
 		setupLegacyScannerIntegration(ctx, s, h, iis)
 	})
 }
+
+func TestCreateDefaultScannerV4Integration(t *testing.T) {
+	ctx := context.Background()
+	defaultID := store.DefaultScannerV4Integration.GetId()
+
+	t.Run("create default integration when it does not exist", func(t *testing.T) {
+		s := mockIIStore.NewMockStore(gomock.NewController(t))
+
+		s.EXPECT().Get(ctx, defaultID).Return(nil, false, nil)
+		s.EXPECT().Upsert(ctx, store.DefaultScannerV4Integration).Return(nil)
+
+		createDefaultScannerV4Integration(ctx, s)
+	})
+
+	t.Run("reconcile categories when existing integration has SCANNER only", func(t *testing.T) {
+		s := mockIIStore.NewMockStore(gomock.NewController(t))
+
+		existingScannerOnly := &storage.ImageIntegration{
+			Id:   defaultID,
+			Name: "Scanner V4",
+			Type: scannerTypes.ScannerV4,
+			Categories: []storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_SCANNER,
+			},
+			IntegrationConfig: &storage.ImageIntegration_ScannerV4{
+				ScannerV4: &storage.ScannerV4Config{
+					IndexerEndpoint: "custom-indexer:8443",
+					MatcherEndpoint: "custom-matcher:8443",
+				},
+			},
+		}
+
+		s.EXPECT().Get(ctx, defaultID).Return(existingScannerOnly, true, nil)
+		s.EXPECT().Upsert(ctx, gomock.Any()).DoAndReturn(func(_ context.Context, ii *storage.ImageIntegration) error {
+			assert.ElementsMatch(t, store.DefaultScannerV4Integration.GetCategories(), ii.GetCategories())
+			assert.Equal(t, "custom-indexer:8443", ii.GetScannerV4().GetIndexerEndpoint())
+			assert.Equal(t, "custom-matcher:8443", ii.GetScannerV4().GetMatcherEndpoint())
+			return nil
+		})
+
+		createDefaultScannerV4Integration(ctx, s)
+	})
+
+	t.Run("reconcile categories when existing integration has wrong categories", func(t *testing.T) {
+		s := mockIIStore.NewMockStore(gomock.NewController(t))
+
+		existingNodeOnly := &storage.ImageIntegration{
+			Id:   defaultID,
+			Name: "Scanner V4",
+			Type: scannerTypes.ScannerV4,
+			Categories: []storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_NODE_SCANNER,
+			},
+			IntegrationConfig: &storage.ImageIntegration_ScannerV4{
+				ScannerV4: &storage.ScannerV4Config{
+					IndexerEndpoint: "indexer:8080",
+					MatcherEndpoint: "matcher:8080",
+				},
+			},
+		}
+
+		s.EXPECT().Get(ctx, defaultID).Return(existingNodeOnly, true, nil)
+		s.EXPECT().Upsert(ctx, gomock.Any()).DoAndReturn(func(_ context.Context, ii *storage.ImageIntegration) error {
+			assert.ElementsMatch(t, store.DefaultScannerV4Integration.GetCategories(), ii.GetCategories())
+			assert.Equal(t, "indexer:8080", ii.GetScannerV4().GetIndexerEndpoint())
+			return nil
+		})
+
+		createDefaultScannerV4Integration(ctx, s)
+	})
+
+	t.Run("reconcile categories when existing integration has nil categories", func(t *testing.T) {
+		s := mockIIStore.NewMockStore(gomock.NewController(t))
+
+		existingNilCategories := &storage.ImageIntegration{
+			Id:         defaultID,
+			Name:       "Scanner V4",
+			Type:       scannerTypes.ScannerV4,
+			Categories: nil,
+			IntegrationConfig: &storage.ImageIntegration_ScannerV4{
+				ScannerV4: &storage.ScannerV4Config{
+					IndexerEndpoint: "legacy-indexer:8443",
+				},
+			},
+		}
+
+		s.EXPECT().Get(ctx, defaultID).Return(existingNilCategories, true, nil)
+		s.EXPECT().Upsert(ctx, gomock.Any()).DoAndReturn(func(_ context.Context, ii *storage.ImageIntegration) error {
+			assert.ElementsMatch(t, store.DefaultScannerV4Integration.GetCategories(), ii.GetCategories())
+			assert.Equal(t, "legacy-indexer:8443", ii.GetScannerV4().GetIndexerEndpoint())
+			return nil
+		})
+
+		createDefaultScannerV4Integration(ctx, s)
+	})
+
+	t.Run("do nothing when Get returns error", func(t *testing.T) {
+		s := mockIIStore.NewMockStore(gomock.NewController(t))
+
+		s.EXPECT().Get(ctx, defaultID).Return(nil, false, errors.New("database error"))
+
+		if buildinfo.ReleaseBuild {
+			createDefaultScannerV4Integration(ctx, s)
+		} else {
+			assert.Panics(t, func() { createDefaultScannerV4Integration(ctx, s) })
+		}
+	})
+}
+
+func TestCategoriesMatch(t *testing.T) {
+	testCases := map[string]struct {
+		a        []storage.ImageIntegrationCategory
+		b        []storage.ImageIntegrationCategory
+		expected bool
+	}{
+		"empty slices match": {
+			[]storage.ImageIntegrationCategory{},
+			[]storage.ImageIntegrationCategory{},
+			true,
+		},
+		"nil and empty slice match": {
+			nil,
+			[]storage.ImageIntegrationCategory{},
+			true,
+		},
+		"same single element": {
+			[]storage.ImageIntegrationCategory{storage.ImageIntegrationCategory_SCANNER},
+			[]storage.ImageIntegrationCategory{storage.ImageIntegrationCategory_SCANNER},
+			true,
+		},
+		"same multiple elements in same order": {
+			[]storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_SCANNER,
+				storage.ImageIntegrationCategory_NODE_SCANNER,
+			},
+			[]storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_SCANNER,
+				storage.ImageIntegrationCategory_NODE_SCANNER,
+			},
+			true,
+		},
+		"same multiple elements in different order": {
+			[]storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_NODE_SCANNER,
+				storage.ImageIntegrationCategory_SCANNER,
+			},
+			[]storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_SCANNER,
+				storage.ImageIntegrationCategory_NODE_SCANNER,
+			},
+			true,
+		},
+		"different lengths do not match": {
+			[]storage.ImageIntegrationCategory{storage.ImageIntegrationCategory_SCANNER},
+			[]storage.ImageIntegrationCategory{
+				storage.ImageIntegrationCategory_SCANNER,
+				storage.ImageIntegrationCategory_NODE_SCANNER,
+			},
+			false,
+		},
+		"different elements do not match": {
+			[]storage.ImageIntegrationCategory{storage.ImageIntegrationCategory_SCANNER},
+			[]storage.ImageIntegrationCategory{storage.ImageIntegrationCategory_NODE_SCANNER},
+			false,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			result := categoriesMatch(tc.a, tc.b)
+			assert.Equal(t, tc.expected, result)
+		})
+	}
+}
diff --git a/central/imageintegration/service/service_impl.go b/central/imageintegration/service/service_impl.go
index 9ba22efa473cb..57eccf6e553c7 100644
--- a/central/imageintegration/service/service_impl.go
+++ b/central/imageintegration/service/service_impl.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"slices"
 	"sort"
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
@@ -131,6 +132,18 @@ func sortCategories(categories []storage.ImageIntegrationCategory) {
 	})
 }
 
+// sameCategories returns true if both slices contain the same categories, ignoring order.
+func sameCategories(a, b []storage.ImageIntegrationCategory) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	a = slices.Clone(a)
+	b = slices.Clone(b)
+	slices.Sort(a)
+	slices.Sort(b)
+	return slices.Equal(a, b)
+}
+
 func (s *serviceImpl) validateTestAndNormalize(ctx context.Context, request *storage.ImageIntegration) error {
 	if err := s.validateIntegration(ctx, request); err != nil {
 		return err
@@ -404,6 +417,9 @@ func (s *serviceImpl) reconcileUpdateImageIntegrationRequest(ctx context.Context
 		if newType != oldType && (newType == scannerTypes.ScannerV4 || oldType == scannerTypes.ScannerV4) {
 			return errors.Wrap(errox.InvalidArgs, "cannot change integration type to/from scanner V4")
 		}
+		if oldType == scannerTypes.ScannerV4 && !sameCategories(integration.GetCategories(), updateRequest.GetConfig().GetCategories()) {
+			return errors.Wrap(errox.InvalidArgs, "cannot change categories of scanner V4 integration")
+		}
 
 		// Note that integrations of type "azure" support both `DockerConfig` (deprecated in 4.7) and `AzureConfig`.
 		// Here we migrate requests with type "azure" and `DockerConfig` on the fly to type `AzureConfig`.
diff --git a/central/imageintegration/service/service_impl_test.go b/central/imageintegration/service/service_impl_test.go
index 623dc7ed4a152..7d930eb0e97a8 100644
--- a/central/imageintegration/service/service_impl_test.go
+++ b/central/imageintegration/service/service_impl_test.go
@@ -513,6 +513,44 @@ func TestScannerV4Restrictions(t *testing.T) {
 		_, err := s.UpdateImageIntegration(context.Background(), &v1.UpdateImageIntegrationRequest{Config: iiNew})
 		assert.ErrorContains(t, err, "scanner V4")
 	})
+
+	t.Run("prevent category change on scannerv4", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		iiDS := integrationMocks.NewMockDataStore(ctrl)
+		s := &serviceImpl{datastore: iiDS}
+
+		iiNew := ii.CloneVT()
+		iiNew.Categories = append(iiNew.Categories, storage.ImageIntegrationCategory_NODE_SCANNER)
+
+		iiDS.EXPECT().GetImageIntegrations(gomock.Any(), gomock.Any()).Return([]*storage.ImageIntegration{ii}, nil)
+		iiDS.EXPECT().GetImageIntegration(gomock.Any(), gomock.Any()).Return(ii, true, nil)
+
+		_, err := s.UpdateImageIntegration(context.Background(), &v1.UpdateImageIntegrationRequest{Config: iiNew})
+		assert.ErrorIs(t, err, errox.InvalidArgs)
+		assert.ErrorContains(t, err, "categories of scanner V4")
+	})
+}
+
+func TestSameCategories(t *testing.T) {
+	scanner := storage.ImageIntegrationCategory_SCANNER
+	nodeScanner := storage.ImageIntegrationCategory_NODE_SCANNER
+
+	cases := map[string]struct {
+		a, b     []storage.ImageIntegrationCategory
+		expected bool
+	}{
+		"both empty":       {expected: true},
+		"same order":       {a: []storage.ImageIntegrationCategory{scanner, nodeScanner}, b: []storage.ImageIntegrationCategory{scanner, nodeScanner}, expected: true},
+		"different order":  {a: []storage.ImageIntegrationCategory{nodeScanner, scanner}, b: []storage.ImageIntegrationCategory{scanner, nodeScanner}, expected: true},
+		"category added":   {a: []storage.ImageIntegrationCategory{scanner}, b: []storage.ImageIntegrationCategory{scanner, nodeScanner}, expected: false},
+		"category removed": {a: []storage.ImageIntegrationCategory{scanner, nodeScanner}, b: []storage.ImageIntegrationCategory{scanner}, expected: false},
+		"category swapped": {a: []storage.ImageIntegrationCategory{scanner}, b: []storage.ImageIntegrationCategory{nodeScanner}, expected: false},
+	}
+	for name, c := range cases {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, c.expected, sameCategories(c.a, c.b))
+		})
+	}
 }
 
 func TestGCRCreationBlocked(t *testing.T) {
diff --git a/central/imagev2/datastore/mapper/datastore/datastore_impl.go b/central/imagev2/datastore/mapper/datastore/datastore_impl.go
index cf3e15d8d149e..31b63d3812be7 100644
--- a/central/imagev2/datastore/mapper/datastore/datastore_impl.go
+++ b/central/imagev2/datastore/mapper/datastore/datastore_impl.go
@@ -186,6 +186,10 @@ func (ds *datastoreImpl) WalkByQuery(ctx context.Context, q *v1.Query, fn func(i
 	})
 }
 
+func (ds *datastoreImpl) WalkMetadataByQuery(_ context.Context, _ *v1.Query, _ func(image *storage.Image) error) error {
+	return errors.New("WalkMetadataByQuery is not implemented for mapper datastore")
+}
+
 func (ds *datastoreImpl) UpsertImage(ctx context.Context, image *storage.Image) error {
 	if !ds.flattenImageData {
 		return ds.imageDataStore.UpsertImage(ctx, image)
diff --git a/central/imagev2/datastore/store/postgres/store.go b/central/imagev2/datastore/store/postgres/store.go
index bd475da9c840c..80d94e4117421 100644
--- a/central/imagev2/datastore/store/postgres/store.go
+++ b/central/imagev2/datastore/store/postgres/store.go
@@ -320,6 +320,8 @@ func copyFromImageComponentV2Cves(ctx context.Context, tx *postgres.Tx, iTimesta
 		"cvebaseinfo_publishedon",
 		"cvebaseinfo_createdat",
 		"cvebaseinfo_epss_epssprobability",
+		"cvebaseinfo_cisakev",
+		"cvebaseinfo_knownransomwarecampaign",
 		"cvss",
 		"severity",
 		"impactscore",
@@ -332,6 +334,7 @@ func copyFromImageComponentV2Cves(ctx context.Context, tx *postgres.Tx, iTimesta
 		"advisory_name",
 		"advisory_link",
 		"fixavailabletimestamp",
+		"origin",
 		"serialized",
 	}
 
@@ -361,6 +364,8 @@ func copyFromImageComponentV2Cves(ctx context.Context, tx *postgres.Tx, iTimesta
 			protocompat.NilOrTime(obj.GetCveBaseInfo().GetPublishedOn()),
 			protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 			obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
+			obj.GetCveBaseInfo().GetCisaKev(),
+			obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 			obj.GetCvss(),
 			obj.GetSeverity(),
 			obj.GetImpactScore(),
@@ -373,6 +378,7 @@ func copyFromImageComponentV2Cves(ctx context.Context, tx *postgres.Tx, iTimesta
 			obj.GetAdvisory().GetName(),
 			obj.GetAdvisory().GetLink(),
 			protocompat.NilOrTime(obj.GetFixAvailableTimestamp()),
+			obj.GetOrigin(),
 			serialized,
 		})
 
@@ -416,10 +422,17 @@ func (s *storeImpl) isUpdated(oldImage, image *storage.ImageV2) (bool, bool, err
 
 type hashWrapper struct {
 	Components []*storage.EmbeddedImageScanComponent `hash:"set"`
+	Count      int
+	VulnCount  int
 }
 
 func populateImageScanHash(scan *storage.ImageScan) error {
-	hash, err := hashstructure.Hash(hashWrapper{scan.GetComponents()}, &hashstructure.HashOptions{ZeroNil: true})
+	components := scan.GetComponents()
+	vulnCount := 0
+	for _, c := range components {
+		vulnCount += len(c.GetVulns())
+	}
+	hash, err := hashstructure.Hash(hashWrapper{Components: components, Count: len(components), VulnCount: vulnCount}, &hashstructure.HashOptions{ZeroNil: true})
 	if err != nil {
 		return errors.Wrap(err, "calculating hash for image scan")
 	}
@@ -1068,11 +1081,13 @@ func (s *storeImpl) insertIntoImageComponentV2Cves(batch *pgx.Batch, obj *storag
 		obj.GetFixedBy(),
 		obj.GetComponentId(),
 		obj.GetAdvisory().GetName(),
+		obj.GetAdvisory().GetLink(),
 		protocompat.NilOrTime(obj.GetFixAvailableTimestamp()),
+		obj.GetOrigin(),
 		serialized,
 	}
 
-	finalStr := "INSERT INTO image_cves_v2 (Id, ImageIdV2, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, Cvss, Severity, ImpactScore, Nvdcvss, FirstImageOccurrence, State, IsFixable, FixedBy, ComponentId, advisory_name, FixAvailableTimestamp, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, ImageIdV2 = EXCLUDED.ImageIdV2, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, FirstImageOccurrence = EXCLUDED.FirstImageOccurrence, State = EXCLUDED.State, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, ComponentId = EXCLUDED.ComponentId, advisory_name = EXCLUDED.advisory_name, FixAvailableTimestamp = EXCLUDED.FixAvailableTimestamp, serialized = EXCLUDED.serialized"
+	finalStr := "INSERT INTO image_cves_v2 (Id, ImageIdV2, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, Cvss, Severity, ImpactScore, Nvdcvss, FirstImageOccurrence, State, IsFixable, FixedBy, ComponentId, advisory_name, advisory_link, FixAvailableTimestamp, Origin, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, ImageIdV2 = EXCLUDED.ImageIdV2, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, Cvss = EXCLUDED.Cvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, FirstImageOccurrence = EXCLUDED.FirstImageOccurrence, State = EXCLUDED.State, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, ComponentId = EXCLUDED.ComponentId, advisory_name = EXCLUDED.advisory_name, advisory_link = EXCLUDED.advisory_link, FixAvailableTimestamp = EXCLUDED.FixAvailableTimestamp, Origin = EXCLUDED.Origin, serialized = EXCLUDED.serialized"
 	batch.Queue(finalStr, values...)
 
 	return nil
diff --git a/central/imagev2/datastore/store/postgres/store_hash_test.go b/central/imagev2/datastore/store/postgres/store_hash_test.go
new file mode 100644
index 0000000000000..568bb7f32398f
--- /dev/null
+++ b/central/imagev2/datastore/store/postgres/store_hash_test.go
@@ -0,0 +1,108 @@
+package postgres
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPopulateImageScanHash_DuplicateComponentsChangeHash(t *testing.T) {
+	component := &storage.EmbeddedImageScanComponent{
+		Name:    "ubi10/ubi-micro",
+		Version: "1784668691",
+	}
+
+	scanWith1 := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{component},
+	}
+	scanWith3 := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{component, component, component},
+	}
+
+	require.NoError(t, populateImageScanHash(scanWith1))
+	require.NoError(t, populateImageScanHash(scanWith3))
+
+	assert.NotEqual(t, scanWith1.GetHash(), scanWith3.GetHash(),
+		"removing duplicate components must produce a different hash")
+}
+
+func TestPopulateImageScanHash_DuplicateVulnsChangeHash(t *testing.T) {
+	vuln := &storage.EmbeddedVulnerability{
+		Cve:      "CVE-2025-1234",
+		Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
+	}
+
+	scanWith1Vuln := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{vuln}},
+		},
+	}
+	scanWith3Vulns := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{vuln, vuln, vuln}},
+		},
+	}
+
+	require.NoError(t, populateImageScanHash(scanWith1Vuln))
+	require.NoError(t, populateImageScanHash(scanWith3Vulns))
+
+	assert.NotEqual(t, scanWith1Vuln.GetHash(), scanWith3Vulns.GetHash(),
+		"removing duplicate vulns must produce a different hash")
+}
+
+func TestPopulateImageScanHash_DistinctChangesDetected(t *testing.T) {
+	scanA := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{
+				{Cve: "CVE-2025-1111"},
+			}},
+		},
+	}
+	scanB := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{
+				{Cve: "CVE-2025-2222"},
+			}},
+		},
+	}
+
+	require.NoError(t, populateImageScanHash(scanA))
+	require.NoError(t, populateImageScanHash(scanB))
+
+	assert.NotEqual(t, scanA.GetHash(), scanB.GetHash(),
+		"different CVEs must produce a different hash")
+}
+
+func TestPopulateImageScanHash_IdenticalScansMatch(t *testing.T) {
+	scan1 := &storage.ImageScan{
+		Components: []*storage.EmbeddedImageScanComponent{
+			{Name: "pkg-a", Version: "1.0", Vulns: []*storage.EmbeddedVulnerability{
+				{Cve: "CVE-2025-1111"},
+			}},
+			{Name: "pkg-b", Version: "2.0"},
+		},
+	}
+	scan2 := scan1.CloneVT()
+
+	require.NoError(t, populateImageScanHash(scan1))
+	require.NoError(t, populateImageScanHash(scan2))
+
+	assert.Equal(t, scan1.GetHash(), scan2.GetHash(),
+		"identical scans must produce the same hash")
+}
+
+func TestPopulateImageScanHash_OrderIndependent(t *testing.T) {
+	compA := &storage.EmbeddedImageScanComponent{Name: "aaa", Version: "1.0"}
+	compB := &storage.EmbeddedImageScanComponent{Name: "bbb", Version: "2.0"}
+
+	scanAB := &storage.ImageScan{Components: []*storage.EmbeddedImageScanComponent{compA, compB}}
+	scanBA := &storage.ImageScan{Components: []*storage.EmbeddedImageScanComponent{compB, compA}}
+
+	require.NoError(t, populateImageScanHash(scanAB))
+	require.NoError(t, populateImageScanHash(scanBA))
+
+	assert.Equal(t, scanAB.GetHash(), scanBA.GetHash(),
+		"component order must not affect the hash")
+}
diff --git a/central/lightspeed/client/client.go b/central/lightspeed/client/client.go
new file mode 100644
index 0000000000000..867f400ffe27d
--- /dev/null
+++ b/central/lightspeed/client/client.go
@@ -0,0 +1,120 @@
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/httputil/proxy"
+	"github.com/stackrox/rox/pkg/satoken"
+	"github.com/stackrox/rox/pkg/tlsutils"
+	"github.com/stackrox/rox/pkg/utils"
+)
+
+const (
+	serviceOperatorCAPath = "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
+	defaultRequestTimeout = 120 * time.Second
+)
+
+var (
+	// LightspeedEndpoint is the URL of the OpenShift Lightspeed API. URL will be populated from integration in a follow up PR
+	LightspeedEndpoint = env.RegisterSetting("ROX_LIGHTSPEED_ENDPOINT",
+		env.WithDefault("https://lightspeed-app-server.openshift-lightspeed.svc:8443"))
+)
+
+// QueryRequest is the request payload for the OLS query API.
+type QueryRequest struct {
+	Query string `json:"query"`
+}
+
+// QueryResponse is the response payload from the OLS query API.
+type QueryResponse struct {
+	Response string `json:"response"`
+}
+
+// Client calls the OpenShift Lightspeed API.
+type Client interface {
+	Query(ctx context.Context, req *QueryRequest) (*QueryResponse, error)
+	TestConnectivity() error
+}
+
+// NewClient creates a Client that authenticates with the OLS API using the
+// pod's Kubernetes service account token and trusts the service CA.
+func NewClient() Client {
+	transport := tlsutils.TransportWithServiceCA()
+	transport.Proxy = proxy.FromConfig()
+
+	return &clientImpl{
+		loadToken: satoken.LoadTokenFromFile,
+		endpoint:  LightspeedEndpoint.Setting(),
+		httpClient: &http.Client{
+			Transport: transport,
+			Timeout:   defaultRequestTimeout,
+		},
+	}
+}
+
+type clientImpl struct {
+	loadToken  func() (string, error)
+	endpoint   string
+	httpClient *http.Client
+}
+
+func (c *clientImpl) Query(ctx context.Context, req *QueryRequest) (*QueryResponse, error) {
+	token, err := c.loadToken()
+	if err != nil {
+		return nil, errors.Wrap(err, "loading service account token")
+	}
+
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, errors.Wrap(err, "marshaling request")
+	}
+
+	url := fmt.Sprintf("%s/v1/query", c.endpoint)
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	if err != nil {
+		return nil, errors.Wrap(err, "building HTTP request")
+	}
+
+	httpReq.Header.Set("Content-Type", "application/json")
+	httpReq.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
+
+	resp, err := c.httpClient.Do(httpReq)
+	if err != nil {
+		return nil, errors.Wrap(err, "sending request to Lightspeed")
+	}
+	defer utils.IgnoreError(resp.Body.Close)
+
+	if resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("Lightspeed API returned HTTP %d", resp.StatusCode)
+	}
+
+	var result QueryResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, errors.Wrap(err, "decoding Lightspeed response")
+	}
+
+	return &result, nil
+}
+
+// TestConnectivity checks if the Lightspeed service is reachable.
+func (c *clientImpl) TestConnectivity() error {
+	healthURL := fmt.Sprintf("%s/readiness", c.endpoint)
+	resp, err := c.httpClient.Get(healthURL)
+	if err != nil {
+		return errors.Wrap(err, "failed to connect to AI service")
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("AI service returned status %d", resp.StatusCode)
+	}
+
+	return nil
+}
diff --git a/central/main.go b/central/main.go
index 79d9a2aedf853..cb3bb5d8a53a4 100755
--- a/central/main.go
+++ b/central/main.go
@@ -24,6 +24,7 @@ import (
 	"github.com/stackrox/rox/central/audit"
 	authDS "github.com/stackrox/rox/central/auth/datastore"
 	internalTokenAuthService "github.com/stackrox/rox/central/auth/internaltokens/service"
+	openshiftAuth "github.com/stackrox/rox/central/auth/openshift"
 	authService "github.com/stackrox/rox/central/auth/service"
 	"github.com/stackrox/rox/central/auth/userpass"
 	authProviderRegistry "github.com/stackrox/rox/central/authprovider/registry"
@@ -144,7 +145,7 @@ import (
 	rbacService "github.com/stackrox/rox/central/rbac/service"
 	vulnReportV2Scheduler "github.com/stackrox/rox/central/reports/scheduler/v2"
 	reportServiceV2 "github.com/stackrox/rox/central/reports/service/v2"
-	v2Service "github.com/stackrox/rox/central/reports/service/v2"
+	nodeReportServiceV2 "github.com/stackrox/rox/central/reports/service/v2/node"
 	"github.com/stackrox/rox/central/reprocessor"
 	collectionService "github.com/stackrox/rox/central/resourcecollection/service"
 	"github.com/stackrox/rox/central/risk/handlers/timeline"
@@ -178,7 +179,9 @@ import (
 	"github.com/stackrox/rox/central/version"
 	vStore "github.com/stackrox/rox/central/version/store"
 	virtualMachineDS "github.com/stackrox/rox/central/virtualmachine/datastore"
+	virtualMachineScanV2DS "github.com/stackrox/rox/central/virtualmachine/scan/v2/datastore"
 	virtualmachineService "github.com/stackrox/rox/central/virtualmachine/service"
+	virtualMachineV2DS "github.com/stackrox/rox/central/virtualmachine/v2/datastore"
 	virtualmachineV2Service "github.com/stackrox/rox/central/virtualmachine/v2/service"
 	vulnMgmtService "github.com/stackrox/rox/central/vulnmgmt/service"
 	vulnRequestManager "github.com/stackrox/rox/central/vulnmgmt/vulnerabilityrequest/manager/requestmgr"
@@ -216,6 +219,7 @@ import (
 	"github.com/stackrox/rox/pkg/grpc/errors"
 	"github.com/stackrox/rox/pkg/grpc/ratelimit"
 	"github.com/stackrox/rox/pkg/grpc/routes"
+	"github.com/stackrox/rox/pkg/grpc/versionheader"
 	"github.com/stackrox/rox/pkg/httputil/proxy"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/memlimit"
@@ -380,11 +384,7 @@ func startServices() {
 
 	reprocessor.Singleton().Start()
 	suppress.Singleton().Start()
-	if !env.CentralWorkerEnabled.BooleanSetting() {
-		pruning.Singleton().Start()
-	} else {
-		log.Info("Pruning is managed by central-worker, skipping start in Central")
-	}
+	pruning.Singleton().Start()
 	if baseImageWatcher.Enabled() {
 		baseImageWatcher.Singleton().Start()
 	}
@@ -491,6 +491,10 @@ func servicesToRegister() []pkgGRPC.APIService {
 
 	servicesToRegister = append(servicesToRegister, reportServiceV2.Singleton())
 
+	if features.NodeVulnerabilityReports.Enabled() {
+		servicesToRegister = append(servicesToRegister, nodeReportServiceV2.Singleton())
+	}
+
 	if features.ComplianceEnhancements.Enabled() {
 		servicesToRegister = append(servicesToRegister, complianceOperatorIntegrationService.Singleton())
 		servicesToRegister = append(servicesToRegister, complianceScanSettings.Singleton())
@@ -579,6 +583,9 @@ func startGRPCServer() {
 	// is the case, we can be setting up an auth providers which won't work.
 	if env.EnableOpenShiftAuth.BooleanSetting() {
 		authProviderBackendFactories[openshift.TypeName] = openshift.NewFactory
+		if features.ACMAccessControlDelegation.Enabled() {
+			authProviderBackendFactories[openshift.TypeNameWithACMAccessControlDelegation] = openshift.NewFactoryWithACMAccessControlDelegation
+		}
 	}
 
 	for typeName, factoryCreator := range authProviderBackendFactories {
@@ -597,6 +604,8 @@ func startGRPCServer() {
 
 	basicAuthProvider := userpass.RegisterAuthProviderOrPanic(authProviderRegisteringCtx, basicAuthMgr, registry)
 
+	openshiftAuth.SeedMetricsAuthProvider(authProviderRegisteringCtx, registry, roleDataStore.Singleton(), groupDataStore.Singleton())
+
 	clusterInitBackend := backend.Singleton()
 	serviceMTLSExtractor, err := service.NewExtractorWithCertValidation(clusterInitBackend)
 	if err != nil {
@@ -656,6 +665,8 @@ func startGRPCServer() {
 		centralSAC.GetEnricher().GetPreAuthContextEnricher(authzTraceSink),
 	)
 
+	config.UnaryInterceptors = append(config.UnaryInterceptors, versionheader.CentralVersionServerInterceptor())
+
 	// Telemetry client has to add interceptors before starting the server.
 	c := phonehomeClient.Singleton()
 	config.HTTPInterceptors = append(config.HTTPInterceptors, c.GetHTTPInterceptor())
@@ -716,6 +727,10 @@ func addCentralIdentityGatherers(c *phonehomeClient.CentralClient) {
 	add(roleDataStore.Gather)
 	add(signatureIntegrationDS.Gather)
 	add(virtualMachineDS.Gather(virtualMachineDS.Singleton()))
+	add(virtualMachineDS.GatherV2(
+		virtualMachineV2DS.Singleton(),
+		virtualMachineScanV2DS.Singleton(),
+	))
 }
 
 func registerDelayedIntegrations(integrationsInput []iiStore.DelayedIntegration) {
@@ -987,10 +1002,19 @@ func customRoutes() (customRoutes []routes.CustomRoute) {
 	customRoutes = append(customRoutes, routes.CustomRoute{
 		Route:         "/api/reports/jobs/download",
 		Authorizer:    user.With(permissions.View(resources.Image)),
-		ServerHandler: v2Service.NewDownloadHandler(),
+		ServerHandler: reportServiceV2.NewDownloadHandler(),
 		Compression:   true,
 	})
 
+	if features.NodeVulnerabilityReports.Enabled() {
+		customRoutes = append(customRoutes, routes.CustomRoute{
+			Route:         "/api/reports/node/jobs/download",
+			Authorizer:    user.With(permissions.View(resources.Node), permissions.View(resources.Cluster)),
+			ServerHandler: reportServiceV2.NewNodeDownloadHandler(),
+			Compression:   true,
+		})
+	}
+
 	if features.ComplianceEnhancements.Enabled() && features.ComplianceReporting.Enabled() && features.ScanScheduleReportJobs.Enabled() {
 		customRoutes = append(customRoutes, routes.CustomRoute{
 			Route:         "/v2/compliance/scan/configurations/reports/download",
@@ -1042,9 +1066,7 @@ func waitForTerminationSignal() {
 		{reprocessor.Singleton(), "reprocessor loop"},
 		{suppress.Singleton(), "cve unsuppress loop"},
 	}
-	if !env.CentralWorkerEnabled.BooleanSetting() {
-		stoppables = append(stoppables, stoppableWithName{pruning.Singleton(), "garbage collector"})
-	}
+	stoppables = append(stoppables, stoppableWithName{pruning.Singleton(), "garbage collector"})
 	stoppables = append(stoppables, []stoppableWithName{
 		{gatherer.Singleton(), "network graph default external sources gatherer"},
 		{vulnRequestManager.Singleton(), "vuln deferral requests expiry loop"},
diff --git a/central/metadata/service/service.go b/central/metadata/service/service.go
index c1e18a07c8fd6..ab17f66d74b27 100644
--- a/central/metadata/service/service.go
+++ b/central/metadata/service/service.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/stackrox/rox/central/globaldb"
+	olsClient "github.com/stackrox/rox/central/lightspeed/client"
 	systemInfoStorage "github.com/stackrox/rox/central/systeminfo/store/postgres"
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/pkg/grpc"
@@ -24,14 +25,15 @@ type Service interface {
 
 // New returns a new instance of service.
 func New() Service {
-	return NewWithCertificateProvider(&defaultCertificateProvider{})
+	return NewWithCertificateProvider(&defaultCertificateProvider{}, olsClient.NewClient())
 }
 
 // NewWithCertificateProvider returns a new instance of service with a custom certificate provider.
-func NewWithCertificateProvider(certProvider CertificateProvider) Service {
+func NewWithCertificateProvider(certProvider CertificateProvider, lightspeedClient olsClient.Client) Service {
 	return &serviceImpl{
-		db:              globaldb.GetPostgres(),
-		systemInfoStore: systemInfoStorage.Singleton(),
-		certProvider:    certProvider,
+		db:               globaldb.GetPostgres(),
+		systemInfoStore:  systemInfoStorage.Singleton(),
+		certProvider:     certProvider,
+		lightspeedClient: lightspeedClient,
 	}
 }
diff --git a/central/metadata/service/service_impl.go b/central/metadata/service/service_impl.go
index 6fd1140ee89a4..3f88b23ae1037 100644
--- a/central/metadata/service/service_impl.go
+++ b/central/metadata/service/service_impl.go
@@ -12,6 +12,7 @@ import (
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/central/globaldb"
+	olsClient "github.com/stackrox/rox/central/lightspeed/client"
 	"github.com/stackrox/rox/central/metadata/centralcapabilities"
 	systemInfoStorage "github.com/stackrox/rox/central/systeminfo/store/postgres"
 	"github.com/stackrox/rox/central/tlsconfig"
@@ -42,6 +43,7 @@ var (
 			v1.MetadataService_GetDatabaseStatus_FullMethodName,
 			v1.MetadataService_GetDatabaseBackupStatus_FullMethodName,
 			v1.MetadataService_GetCentralCapabilities_FullMethodName,
+			v1.MetadataService_GetLightspeedStatus_FullMethodName,
 		},
 		// When this endpoint was public, Sensor relied on it to check Central's
 		// availability. While Sensor might not do so today, we need to ensure
@@ -177,9 +179,10 @@ func issueSecondaryCALeafCert(certProvider CertificateProvider) (tls.Certificate
 type serviceImpl struct {
 	v1.UnimplementedMetadataServiceServer
 
-	db              postgres.DB
-	systemInfoStore systemInfoStorage.Store
-	certProvider    CertificateProvider
+	db               postgres.DB
+	systemInfoStore  systemInfoStorage.Store
+	certProvider     CertificateProvider
+	lightspeedClient olsClient.Client
 }
 
 // RegisterServiceServer registers this service with the given gRPC Server.
@@ -368,3 +371,25 @@ func (s *serviceImpl) GetDatabaseBackupStatus(ctx context.Context, _ *v1.Empty)
 func (s *serviceImpl) GetCentralCapabilities(_ context.Context, _ *v1.Empty) (*v1.CentralServicesCapabilities, error) {
 	return centralcapabilities.GetCentralCapabilities(), nil
 }
+
+// GetLightspeedStatus returns the availability status of the Lightspeed AI service.
+func (s *serviceImpl) GetLightspeedStatus(_ context.Context, _ *v1.Empty) (*v1.LightspeedStatusResponse, error) {
+	if s.lightspeedClient == nil {
+		return &v1.LightspeedStatusResponse{
+			Available: false,
+			Message:   "Lightspeed client not configured",
+		}, nil
+	}
+
+	if err := s.lightspeedClient.TestConnectivity(); err != nil {
+		return &v1.LightspeedStatusResponse{
+			Available: false,
+			Message:   errors.Wrap(err, "Lightspeed AI service connectivity test failed").Error(),
+		}, nil
+	}
+
+	return &v1.LightspeedStatusResponse{
+		Available: true,
+		Message:   "Lightspeed AI service is available",
+	}, nil
+}
diff --git a/central/metrics/custom/image_vulnerabilities/labels.go b/central/metrics/custom/image_vulnerabilities/labels.go
index b0e7a39f19153..5745307489f81 100644
--- a/central/metrics/custom/image_vulnerabilities/labels.go
+++ b/central/metrics/custom/image_vulnerabilities/labels.go
@@ -14,6 +14,7 @@ var lazyLabels = tracker.LazyLabelGetters[*finding]{
 	"Deployment":         func(f *finding) string { return f.deployment.GetName() },
 	"Type":               func(f *finding) string { return f.deployment.GetType() },
 	"IsActive":           func(f *finding) string { return strconv.FormatBool(!f.deployment.GetInactive()) },
+	"IsSuppressed":       func(f *finding) string { return strconv.FormatBool(f.vuln.GetSuppressed()) },
 	"IsPlatformWorkload": isPlatformWorkload,
 
 	"ImageID":          func(f *finding) string { return f.image.GetId() },
@@ -33,7 +34,14 @@ var lazyLabels = tracker.LazyLabelGetters[*finding]{
 	"EPSSPercentile": func(f *finding) string {
 		return strconv.FormatFloat(float64(f.vuln.GetEpss().GetEpssPercentile()), 'f', 1, 32)
 	},
-	"IsFixable": func(f *finding) string { return strconv.FormatBool(f.vuln.GetFixedBy() != "") },
+	"Origin": func(f *finding) string { return f.vuln.GetOrigin().String() },
+
+	"IsFixable":             func(f *finding) string { return strconv.FormatBool(f.vuln.GetFixedBy() != "") },
+	"FixAvailable":          func(f *finding) string { return strconv.FormatInt(f.vuln.GetFixAvailableTimestamp().GetSeconds(), 10) },
+	"HasCisaKev":            func(f *finding) string { return strconv.FormatBool(f.vuln.GetCisaKev()) },
+	"Published":             func(f *finding) string { return strconv.FormatInt(f.vuln.GetPublishedOn().GetSeconds(), 10) },
+	"FirstImageOccurrence":  func(f *finding) string { return strconv.FormatInt(f.vuln.GetFirstImageOccurrence().GetSeconds(), 10) },
+	"FirstSystemOccurrence": func(f *finding) string { return strconv.FormatInt(f.vuln.GetFirstSystemOccurrence().GetSeconds(), 10) },
 }
 
 // finding holds all information for computing any label in this category.
diff --git a/central/metrics/custom/node_vulnerabilities/labels.go b/central/metrics/custom/node_vulnerabilities/labels.go
index f2e7afd9d5fc2..d25fb35066427 100644
--- a/central/metrics/custom/node_vulnerabilities/labels.go
+++ b/central/metrics/custom/node_vulnerabilities/labels.go
@@ -19,7 +19,6 @@ var lazyLabels = tracker.LazyLabelGetters[*finding]{
 	"CVE":       func(f *finding) string { return f.vulnerability.GetCveBaseInfo().GetCve() },
 	"CVSS":      func(f *finding) string { return strconv.FormatFloat(float64(f.vulnerability.GetCvss()), 'f', 1, 32) },
 	"Severity":  func(f *finding) string { return f.vulnerability.GetSeverity().String() },
-	"IsFixable": func(f *finding) string { return strconv.FormatBool(f.vulnerability.GetFixedBy() != "") },
 	"IsSnoozed": func(f *finding) string { return strconv.FormatBool(f.vulnerability.GetSnoozed()) },
 	"EPSSPercentile": func(f *finding) string {
 		return strconv.FormatFloat(float64(f.vulnerability.GetCveBaseInfo().GetEpss().GetEpssPercentile()), 'f', 1, 32)
@@ -27,6 +26,12 @@ var lazyLabels = tracker.LazyLabelGetters[*finding]{
 	"EPSSProbability": func(f *finding) string {
 		return strconv.FormatFloat(float64(f.vulnerability.GetCveBaseInfo().GetEpss().GetEpssProbability()), 'f', 1, 32)
 	},
+
+	"IsFixable":  func(f *finding) string { return strconv.FormatBool(f.vulnerability.GetFixedBy() != "") },
+	"HasCisaKev": func(f *finding) string { return strconv.FormatBool(f.vulnerability.GetCveBaseInfo().GetCisaKev()) },
+	"Published": func(f *finding) string {
+		return strconv.FormatInt(f.vulnerability.GetCveBaseInfo().GetPublishedOn().GetSeconds(), 10)
+	},
 }
 
 type finding struct {
diff --git a/central/node/datastore/datastore_impl_postgres_test.go b/central/node/datastore/datastore_impl_postgres_test.go
index 37c4fed5b63dc..34c364b82a20d 100644
--- a/central/node/datastore/datastore_impl_postgres_test.go
+++ b/central/node/datastore/datastore_impl_postgres_test.go
@@ -4,8 +4,11 @@ package datastore
 
 import (
 	"context"
+	"fmt"
 	"sort"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	nodeCVEDS "github.com/stackrox/rox/central/cve/node/datastore"
 	nodeCVEPostgres "github.com/stackrox/rox/central/cve/node/datastore/store/postgres"
@@ -31,6 +34,7 @@ import (
 	pkgSearch "github.com/stackrox/rox/pkg/search"
 	"github.com/stackrox/rox/pkg/search/scoped"
 	"github.com/stackrox/rox/pkg/set"
+	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stretchr/testify/suite"
 	"go.uber.org/mock/gomock"
 )
@@ -78,6 +82,99 @@ func (suite *NodePostgresDataStoreTestSuite) TearDownTest() {
 	suite.db.Close()
 }
 
+// TestConcurrentUpsertNode_KeyedMutexPreventsRegression is the datastore-layer counterpart of
+// store_test.go's TestStore_ConcurrentUpsert_BypassingOuterLock. That test proves the store layer alone has
+// a check-then-act race in isUpdated(): the read-old-scan-and-decide step isn't covered by the store's own
+// keyFence lock. This test drives the same workload through UpsertNode, the production call path, which
+// wraps the entire read-decide-write sequence in a per-node-ID keyedMutex (see UpsertNode in
+// datastore_impl.go). Every caller in this codebase reaches the store exclusively through UpsertNode, so
+// this path determines whether concurrent upserts can regress scan_time; the test asserts scan_time never
+// regresses even under heavy concurrency.
+func (suite *NodePostgresDataStoreTestSuite) TestConcurrentUpsertNode_KeyedMutexPreventsRegression() {
+	allowAllCtx := sac.WithAllAccess(context.Background())
+
+	node := getTestNodeForPostgres(fixtureconsts.Node1, "concurrent-node")
+	baseTime := time.Now().Add(-24 * time.Hour)
+	node.Scan.ScanTime = protocompat.ConvertTimeToTimestampOrNil(&baseTime)
+	suite.NoError(suite.datastore.UpsertNode(allowAllCtx, node))
+
+	const iterations = 500
+	const freshWriters = 4
+	const metaWriters = 4
+	var wg sync.WaitGroup
+	// A writer that fails leaves the intended workload incomplete, so a zero regression count would be
+	// meaningless. Track upsert failures and assert none happened.
+	var upsertFailures atomic.Int64
+
+	// Simulates the nodeindex pipeline: always a fresh, monotonically increasing ScanTime.
+	for w := range freshWriters {
+		wg.Go(func() {
+			for i := range iterations {
+				fresh := node.CloneVT()
+				t := baseTime.Add(time.Duration(w*iterations+i+1) * time.Millisecond)
+				fresh.Scan.ScanTime = protocompat.ConvertTimeToTimestampOrNil(&t)
+				if err := suite.datastore.UpsertNode(allowAllCtx, fresh); err != nil {
+					upsertFailures.Add(1)
+				}
+			}
+		})
+	}
+
+	// Simulates the nodes pipeline: frequent metadata-only churn, Scan explicitly nil.
+	for w := range metaWriters {
+		wg.Go(func() {
+			for i := range iterations {
+				metaOnly := node.CloneVT()
+				metaOnly.Scan = nil
+				metaOnly.Labels = map[string]string{"writer": fmt.Sprintf("%d-%d", w, i)}
+				if err := suite.datastore.UpsertNode(allowAllCtx, metaOnly); err != nil {
+					upsertFailures.Add(1)
+				}
+			}
+		})
+	}
+
+	var regressions atomic.Int64
+	stop := make(chan struct{})
+	var pollWG sync.WaitGroup
+	for range 2 {
+		pollWG.Go(func() {
+			lastSeen := baseTime
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+				}
+				current, exists, err := suite.datastore.GetNode(allowAllCtx, node.GetId())
+				if err == nil && exists {
+					st := current.GetScan().GetScanTime().AsTime()
+					if st.Before(lastSeen) {
+						regressions.Add(1)
+					} else {
+						lastSeen = st
+					}
+				}
+				// Yield between reads so the pollers don't hammer the DB in a tight busy-loop.
+				time.Sleep(time.Millisecond)
+			}
+		})
+	}
+
+	wg.Wait()
+	close(stop)
+	pollWG.Wait()
+
+	suite.Zero(upsertFailures.Load(),
+		"every concurrent UpsertNode must succeed; a failure means the intended workload did not complete, "+
+			"which would make the regression assertion below meaningless")
+	suite.Zero(regressions.Load(),
+		"scan_time must never regress through UpsertNode, since every real caller (nodeindex and nodes "+
+			"pipelines alike) goes through the per-node-ID keyedMutex that wraps the entire read-decide-write "+
+			"sequence; a non-zero count here would mean the keyedMutex itself has a bug, not just the store "+
+			"layer's already-known gap")
+}
+
 func (suite *NodePostgresDataStoreTestSuite) TestBasicOps() {
 	node := getTestNodeForPostgres(fixtureconsts.Node1, "name1")
 	allowAllCtx := sac.WithAllAccess(context.Background())
diff --git a/central/node/datastore/store/postgres/store.go b/central/node/datastore/store/postgres/store.go
index 1ecfdf88f7131..9f8a4ddbf51f3 100644
--- a/central/node/datastore/store/postgres/store.go
+++ b/central/node/datastore/store/postgres/store.go
@@ -529,6 +529,17 @@ func (s *storeImpl) isUpdated(ctx context.Context, node *storage.Node) (bool, er
 	// We skip rewriting components and vulnerabilities if the node scan is older.
 	scanUpdated := protocompat.CompareTimestamps(oldNode.GetScan().GetScanTime(), node.GetScan().GetScanTime()) <= 0
 	if !scanUpdated {
+		// Metadata-only upserts (e.g. from the informer-driven nodes pipeline) intentionally send no scan at
+		// all, relying on this method to preserve the stored one; only warn when a real, incoming scan with
+		// its own scan_time was rejected as not newer than what's stored.
+		if node.GetScan().GetScanTime() != nil {
+			log.Warnf("Rejecting incoming node scan for node %s (%s) in cluster %s (%s) as not newer than the "+
+				"stored one: stored scan_time=%s, incoming scan_time=%s. The incoming scan and its "+
+				"component/CVE data will be discarded and the previously stored scan will be kept.",
+				node.GetId(), node.GetName(), node.GetClusterName(), node.GetClusterId(),
+				protocompat.ConvertTimestampToString(oldNode.GetScan().GetScanTime(), time.RFC3339Nano),
+				protocompat.ConvertTimestampToString(node.GetScan().GetScanTime(), time.RFC3339Nano))
+		}
 		node.Scan = oldNode.GetScan()
 		node.RiskScore = oldNode.GetRiskScore()
 		node.SetComponents = oldNode.GetSetComponents()
diff --git a/central/node/datastore/store/postgres/store_test.go b/central/node/datastore/store/postgres/store_test.go
index de012c53d363e..8c3ca0de4cc41 100644
--- a/central/node/datastore/store/postgres/store_test.go
+++ b/central/node/datastore/store/postgres/store_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/postgres"
 	"github.com/stackrox/rox/pkg/postgres/pgtest"
 	"github.com/stackrox/rox/pkg/protoassert"
@@ -21,9 +22,22 @@ import (
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/testutils"
 	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
 )
 
+const rejectionWarnSnippet = "Rejecting incoming node scan for node"
+
+func swapObservedLogger(t interface{ Cleanup(func()) }) *observer.ObservedLogs {
+	core, logs := observer.New(zap.WarnLevel)
+	orig := log
+	log = &logging.LoggerImpl{InnerLogger: zap.New(core).Sugar()}
+	t.Cleanup(func() { log = orig })
+	return logs
+}
+
 type NodesStoreSuite struct {
 	suite.Suite
 	ctx  context.Context
@@ -151,6 +165,73 @@ func (s *NodesStoreSuite) TestStore_UpsertWithoutScan() {
 	protoassert.Equal(s.T(), foundNode, newNode)
 }
 
+// TestStore_FreshScanAlwaysWinsSequential covers the sequential happy path of the isUpdated() freshness
+// guard: upsert an old scan, then upsert a strictly newer one for the same node ID, and confirm the newer
+// one is persisted (both scan_time and payload advance). This isolates single-threaded correctness of the
+// guard from the concurrency behavior exercised elsewhere.
+func (s *NodesStoreSuite) TestStore_FreshScanAlwaysWinsSequential() {
+	store := New(s.pool, false, concurrency.NewKeyFence())
+
+	node := &storage.Node{}
+	s.NoError(testutils.FullInit(node, testutils.UniqueInitializer(), testutils.JSONFieldsFilter))
+	for _, comp := range node.GetScan().GetComponents() {
+		comp.Vulns = nil
+	}
+
+	oldTime := time.Now().Add(-60 * 24 * time.Hour)
+	node.Scan.ScanTime = protocompat.ConvertTimeToTimestampOrNil(&oldTime)
+	s.NoError(store.Upsert(s.ctx, node))
+
+	fresh := node.CloneVT()
+	freshTime := time.Now()
+	fresh.Scan.ScanTime = protocompat.ConvertTimeToTimestampOrNil(&freshTime)
+	fresh.Scan.Components = fresh.GetScan().GetComponents()[:1] // Change the payload shape too, not just the timestamp.
+	s.NoError(store.Upsert(s.ctx, fresh))
+
+	found, exists, err := store.Get(s.ctx, node.GetId())
+	s.NoError(err)
+	s.True(exists)
+	s.Equal(freshTime.Unix(), found.GetScan().GetScanTime().AsTime().Unix(),
+		"a strictly newer scan must always replace an older one when applied sequentially")
+	s.Len(found.GetScan().GetComponents(), 1)
+}
+
+// TestStore_RejectionWarningFiresOnlyForRealStaleScan validates the rejection warning in isUpdated():
+// a real, non-nil incoming scan that is older than the stored one is rejected AND warned about, while a
+// metadata-only upsert (Scan == nil) - which is also "not newer" - is rejected silently (the gate).
+func (s *NodesStoreSuite) TestStore_RejectionWarningFiresOnlyForRealStaleScan() {
+	store := New(s.pool, false, concurrency.NewKeyFence())
+	logs := swapObservedLogger(s.T())
+
+	node := &storage.Node{}
+	s.NoError(testutils.FullInit(node, testutils.UniqueInitializer(), testutils.JSONFieldsFilter))
+	for _, comp := range node.GetScan().GetComponents() {
+		comp.Vulns = nil
+	}
+	newer := time.Now()
+	node.Scan.ScanTime = protocompat.ConvertTimeToTimestampOrNil(&newer)
+	s.NoError(store.Upsert(s.ctx, node))
+
+	// A real, non-nil, older scan must be rejected and warned about.
+	stale := node.CloneVT()
+	older := newer.Add(-time.Hour)
+	stale.Scan.ScanTime = protocompat.ConvertTimeToTimestampOrNil(&older)
+	s.NoError(store.Upsert(s.ctx, stale))
+
+	found, exists, err := store.Get(s.ctx, node.GetId())
+	s.NoError(err)
+	s.True(exists)
+	s.Equal(newer.Unix(), found.GetScan().GetScanTime().AsTime().Unix(), "stale scan must be rejected")
+	require.Len(s.T(), logs.FilterMessageSnippet(rejectionWarnSnippet).All(), 1)
+
+	// A metadata-only upsert (Scan == nil) is also "not newer" but must NOT emit the warning.
+	metaOnly := found.CloneVT()
+	metaOnly.Scan = nil
+	s.NoError(store.Upsert(s.ctx, metaOnly))
+	require.Len(s.T(), logs.FilterMessageSnippet(rejectionWarnSnippet).All(), 1,
+		"metadata-only upserts must not emit the rejection warning")
+}
+
 func (s *NodesStoreSuite) TestStore_OrphanedCVEs() {
 	s.T().Setenv(env.OrphanedCVEsKeepAlive.EnvVar(), "true")
 	if !env.OrphanedCVEsKeepAlive.BooleanSetting() {
@@ -203,7 +284,7 @@ func (s *NodesStoreSuite) TestStore_OrphanedCVEs() {
 	s.NoError(err)
 	s.NotEmpty(orphanedCVEs)
 	for _, cve := range orphanedCVEs {
-		s.NotNil(cve.OrphanedTime)
+		s.NotNil(cve.GetOrphanedTime())
 		s.True(vulnNames.Contains(cve.GetCveBaseInfo().GetCve()))
 	}
 
@@ -230,8 +311,8 @@ func (s *NodesStoreSuite) TestStore_OrphanedCVEs() {
 	s.NoError(err)
 	s.NotEmpty(nodeCVEs)
 	for _, cve := range nodeCVEs {
-		s.False(cve.Orphaned)
-		s.Nil(cve.OrphanedTime)
+		s.False(cve.GetOrphaned())
+		s.Nil(cve.GetOrphanedTime())
 		val, ok := orphanedCveIDToCve[cve.GetId()]
 		s.True(ok)
 		s.Equal(val.GetCveBaseInfo().GetCreatedAt(), cve.GetCveBaseInfo().GetCreatedAt())
diff --git a/central/notifier/service/service.go b/central/notifier/service/service.go
index 1b1d93c9c9fc0..da712971b88ec 100644
--- a/central/notifier/service/service.go
+++ b/central/notifier/service/service.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stackrox/rox/pkg/integrationhealth"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/notifier"
+	"github.com/stackrox/rox/pkg/postgres"
 )
 
 var (
@@ -30,12 +31,14 @@ func New(storage datastore.DataStore,
 	processor notifier.Processor,
 	policyCleaner policycleaner.PolicyCleaner,
 	reporter integrationhealth.Reporter,
-	cryptoKey string) Service {
+	cryptoKey string,
+	db postgres.DB) Service {
 	return &serviceImpl{
 		storage:       storage,
 		processor:     processor,
 		policyCleaner: policyCleaner,
 		reporter:      reporter,
 		cryptoKey:     cryptoKey,
+		db:            db,
 	}
 }
diff --git a/central/notifier/service/service_impl.go b/central/notifier/service/service_impl.go
index 186832a06d008..e720e0b3a2f97 100644
--- a/central/notifier/service/service_impl.go
+++ b/central/notifier/service/service_impl.go
@@ -24,6 +24,8 @@ import (
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/notifier"
 	pkgNotifiers "github.com/stackrox/rox/pkg/notifiers"
+	"github.com/stackrox/rox/pkg/postgres"
+	pgNotify "github.com/stackrox/rox/pkg/postgres/notify"
 	"github.com/stackrox/rox/pkg/sac/resources"
 	"github.com/stackrox/rox/pkg/secrets"
 	"google.golang.org/grpc"
@@ -58,6 +60,7 @@ type serviceImpl struct {
 	processor notifier.Processor
 	reporter  integrationhealth.Reporter
 	cryptoKey string
+	db        postgres.DB
 
 	policyCleaner policycleaner.PolicyCleaner
 }
@@ -164,6 +167,7 @@ func (s *serviceImpl) UpdateNotifier(ctx context.Context, request *v1.UpdateNoti
 		return nil, err
 	}
 	s.processor.UpdateNotifier(ctx, notifier)
+	s.notifyWorker(ctx, request.GetNotifier().GetId())
 	return &v1.Empty{}, nil
 }
 
@@ -195,6 +199,7 @@ func (s *serviceImpl) PostNotifier(ctx context.Context, request *storage.Notifie
 	}
 	request.Id = id
 	s.processor.UpdateNotifier(ctx, notifier)
+	s.notifyWorker(ctx, id)
 
 	if err = s.reporter.Register(request.GetId(), request.GetName(), storage.IntegrationHealth_NOTIFIER); err != nil {
 		return nil, err
@@ -266,12 +271,22 @@ func (s *serviceImpl) DeleteNotifier(ctx context.Context, request *v1.DeleteNoti
 	}
 
 	s.processor.RemoveNotifier(ctx, request.GetId())
+	s.notifyWorker(ctx, request.GetId())
 	if err := s.reporter.RemoveIntegrationHealth(request.GetId()); err != nil {
 		return nil, err
 	}
 	return &v1.Empty{}, nil
 }
 
+func (s *serviceImpl) notifyWorker(ctx context.Context, notifierID string) {
+	if s.db == nil {
+		return
+	}
+	if err := pgNotify.Notify(ctx, s.db, pgNotify.NotifierChanged, notifierID); err != nil {
+		log.Errorf("Failed to notify worker of notifier change %s: %v", notifierID, err)
+	}
+}
+
 func (s *serviceImpl) reconcileUpdateNotifierRequest(ctx context.Context, updateRequest *v1.UpdateNotifierRequest) error {
 	if updateRequest.GetUpdatePassword() {
 		return nil
diff --git a/central/notifier/service/singleton.go b/central/notifier/service/singleton.go
index 8e8e9ce009172..a95e071cff2a5 100644
--- a/central/notifier/service/singleton.go
+++ b/central/notifier/service/singleton.go
@@ -1,6 +1,7 @@
 package service
 
 import (
+	"github.com/stackrox/rox/central/globaldb"
 	"github.com/stackrox/rox/central/integrationhealth/reporter"
 	"github.com/stackrox/rox/central/notifier/datastore"
 	"github.com/stackrox/rox/central/notifier/policycleaner"
@@ -33,6 +34,7 @@ func initialize() {
 		policycleaner.Singleton(),
 		reporter.Singleton(),
 		cryptoKey,
+		globaldb.GetPostgres(),
 	)
 }
 
diff --git a/central/policy/customresource/custom_resource_test.go b/central/policy/customresource/custom_resource_test.go
index a2da8636955ff..b5462769f16bb 100644
--- a/central/policy/customresource/custom_resource_test.go
+++ b/central/policy/customresource/custom_resource_test.go
@@ -24,6 +24,29 @@ func TestConvertToCR(t *testing.T) {
 	assert.YAMLEq(t, templateFile, converted)
 }
 
+func TestConvertExcludeByKind(t *testing.T) {
+	policy := fixtures.GetPolicy()
+	policy.Exclusions = []*storage.Exclusion{
+		{
+			Name: "skip-batch",
+			Matcher: &storage.Exclusion_ExcludeByKind_{
+				ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+					Kinds: []storage.Exclusion_WorkloadKind{
+						storage.Exclusion_CRON_JOB,
+						storage.Exclusion_JOB,
+					},
+				},
+			},
+		},
+	}
+	cr := ConvertPolicyToCustomResource(policy)
+	require.Len(t, cr.SecurityPolicySpec.Exclusions, 1)
+	exclusion := cr.SecurityPolicySpec.Exclusions[0]
+	require.NotNil(t, exclusion.ExcludeByKind)
+	assert.Equal(t, []string{"CRON_JOB", "JOB"}, exclusion.ExcludeByKind.Kinds)
+	assert.Nil(t, exclusion.Deployment)
+}
+
 func getTestPolicy() *storage.Policy {
 	p := fixtures.GetPolicy()
 	p.Notifiers = []string{
@@ -45,8 +68,7 @@ func getTestPolicy() *storage.Policy {
 	}
 	p.Exclusions = []*storage.Exclusion{
 		{
-			Name: "exclusionName1",
-			Deployment: &storage.Exclusion_Deployment{
+			Name: "exclusionName1", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
 				Name: "deployment1",
 				Scope: &storage.Scope{
 					Cluster:   "cluster1",
@@ -56,12 +78,10 @@ func getTestPolicy() *storage.Policy {
 						Value: "value1",
 					},
 				},
-			},
-			Expiration: protocompat.GetProtoTimestampFromSeconds(2334221123),
+			}}, Expiration: protocompat.GetProtoTimestampFromSeconds(2334221123),
 		},
 		{
-			Name: "exclusionName2",
-			Deployment: &storage.Exclusion_Deployment{
+			Name: "exclusionName2", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
 				Name: "deployment2",
 				Scope: &storage.Scope{
 					Cluster:   "cluster2",
@@ -71,9 +91,16 @@ func getTestPolicy() *storage.Policy {
 						Value: "value2",
 					},
 				},
-			},
+			}},
 		},
 	}
+	p.Scope = append(p.Scope, &storage.Scope{
+		ClusterLabel:   &storage.Scope_Label{Key: "env", Value: "prod"},
+		NamespaceLabel: &storage.Scope_Label{Key: "team", Value: "platform"},
+	})
+	p.EvaluationFilter = &storage.EvaluationFilter{
+		SkipContainerTypes: []storage.ContainerType{storage.ContainerType_REGULAR, storage.ContainerType_INIT},
+	}
 	return p
 }
 
diff --git a/central/policy/customresource/policy.go b/central/policy/customresource/policy.go
index 3da76898b67b2..e4f6dae68366d 100644
--- a/central/policy/customresource/policy.go
+++ b/central/policy/customresource/policy.go
@@ -12,8 +12,8 @@ type Scope struct {
 	Cluster        string               `yaml:",omitempty"`
 	Namespace      string               `yaml:",omitempty"`
 	Label          *storage.Scope_Label `yaml:",omitempty"`
-	ClusterLabel   *storage.Scope_Label `yaml:",omitempty"`
-	NamespaceLabel *storage.Scope_Label `yaml:",omitempty"`
+	ClusterLabel   *storage.Scope_Label `yaml:"clusterLabel,omitempty"`
+	NamespaceLabel *storage.Scope_Label `yaml:"namespaceLabel,omitempty"`
 }
 
 // convertScope Converts storage.Scope to *Scope
@@ -23,11 +23,11 @@ func convertScope(p *storage.Scope) *Scope {
 	}
 
 	return &Scope{
-		Cluster:        p.Cluster,
-		Namespace:      p.Namespace,
-		Label:          p.Label,
-		ClusterLabel:   p.ClusterLabel,
-		NamespaceLabel: p.NamespaceLabel,
+		Cluster:        p.GetCluster(),
+		Namespace:      p.GetNamespace(),
+		Label:          p.GetLabel(),
+		ClusterLabel:   p.GetClusterLabel(),
+		NamespaceLabel: p.GetNamespaceLabel(),
 	}
 }
 
@@ -44,17 +44,34 @@ func convertExclusion_Deployment(p *storage.Exclusion_Deployment) *Exclusion_Dep
 	}
 
 	return &Exclusion_Deployment{
-		Name:  p.Name,
-		Scope: convertScope(p.Scope),
+		Name:  p.GetName(),
+		Scope: convertScope(p.GetScope()),
+	}
+}
+
+// Exclusion_ExcludeByKind represents storage.Exclusion_ExcludeByKind in the Custom Resource.
+type Exclusion_ExcludeByKind struct {
+	Kinds []string `yaml:",omitempty"`
+}
+
+// convertExclusion_ExcludeByKind Converts storage.Exclusion_ExcludeByKind to *Exclusion_ExcludeByKind
+func convertExclusion_ExcludeByKind(p *storage.Exclusion_ExcludeByKind) *Exclusion_ExcludeByKind {
+	if p == nil {
+		return nil
+	}
+
+	return &Exclusion_ExcludeByKind{
+		Kinds: sliceutils.StringSlice(p.GetKinds()...),
 	}
 }
 
 // Exclusion represents storage.Exclusion in the Custom Resource.
 type Exclusion struct {
-	Name       string                   `yaml:",omitempty"`
-	Deployment *Exclusion_Deployment    `yaml:",omitempty"`
-	Image      *storage.Exclusion_Image `yaml:",omitempty"`
-	Expiration string                   `yaml:",omitempty"`
+	Name          string                   `yaml:",omitempty"`
+	Image         *storage.Exclusion_Image `yaml:",omitempty"`
+	Expiration    string                   `yaml:",omitempty"`
+	Deployment    *Exclusion_Deployment    `yaml:",omitempty"`
+	ExcludeByKind *Exclusion_ExcludeByKind `yaml:"excludeByKind,omitempty"`
 }
 
 // convertExclusion Converts storage.Exclusion to *Exclusion
@@ -64,10 +81,11 @@ func convertExclusion(p *storage.Exclusion) *Exclusion {
 	}
 
 	return &Exclusion{
-		Name:       p.Name,
-		Deployment: convertExclusion_Deployment(p.Deployment),
-		Image:      p.Image,
-		Expiration: timestampToFormatRFC3339(p.Expiration),
+		Name:          p.GetName(),
+		Image:         p.GetImage(),
+		Expiration:    timestampToFormatRFC3339(p.GetExpiration()),
+		Deployment:    convertExclusion_Deployment(p.GetDeployment()),
+		ExcludeByKind: convertExclusion_ExcludeByKind(p.GetExcludeByKind()),
 	}
 }
 
@@ -86,10 +104,10 @@ func convertPolicyGroup(p *storage.PolicyGroup) *PolicyGroup {
 	}
 
 	return &PolicyGroup{
-		FieldName:       p.FieldName,
-		BooleanOperator: p.BooleanOperator.String(),
-		Negate:          p.Negate,
-		Values:          p.Values,
+		FieldName:       p.GetFieldName(),
+		BooleanOperator: p.GetBooleanOperator().String(),
+		Negate:          p.GetNegate(),
+		Values:          p.GetValues(),
 	}
 }
 
@@ -106,8 +124,24 @@ func convertPolicySection(p *storage.PolicySection) *PolicySection {
 	}
 
 	return &PolicySection{
-		SectionName:  p.SectionName,
-		PolicyGroups: sliceutils.ConvertSlice(p.PolicyGroups, convertPolicyGroup),
+		SectionName:  p.GetSectionName(),
+		PolicyGroups: sliceutils.ConvertSlice(p.GetPolicyGroups(), convertPolicyGroup),
+	}
+}
+
+// EvaluationFilter represents storage.EvaluationFilter in the Custom Resource.
+type EvaluationFilter struct {
+	SkipContainerTypes []string `yaml:"skipContainerTypes,omitempty"`
+}
+
+// convertEvaluationFilter Converts storage.EvaluationFilter to *EvaluationFilter
+func convertEvaluationFilter(p *storage.EvaluationFilter) *EvaluationFilter {
+	if p == nil {
+		return nil
+	}
+
+	return &EvaluationFilter{
+		SkipContainerTypes: sliceutils.StringSlice(p.GetSkipContainerTypes()...),
 	}
 }
 
@@ -131,7 +165,7 @@ type Policy struct {
 	CriteriaLocked     bool                                 `yaml:"criteriaLocked"`
 	MitreVectorsLocked bool                                 `yaml:"mitreVectorsLocked"`
 	IsDefault          bool                                 `yaml:"isDefault"`
-	EvaluationFilter   *storage.EvaluationFilter            `yaml:"evaluationFilter,omitempty"`
+	EvaluationFilter   *EvaluationFilter                    `yaml:"evaluationFilter,omitempty"`
 }
 
 // convertPolicy Converts storage.Policy to *Policy
@@ -141,25 +175,25 @@ func convertPolicy(p *storage.Policy) *Policy {
 	}
 
 	return &Policy{
-		Name:               p.Name,
-		Description:        p.Description,
-		Rationale:          p.Rationale,
-		Remediation:        p.Remediation,
-		Disabled:           p.Disabled,
-		Categories:         p.Categories,
-		LifecycleStages:    sliceutils.StringSlice(p.LifecycleStages...),
-		EventSource:        p.EventSource.String(),
-		Exclusions:         sliceutils.ConvertSlice(p.Exclusions, convertExclusion),
-		Scope:              sliceutils.ConvertSlice(p.Scope, convertScope),
-		Severity:           p.Severity.String(),
-		EnforcementActions: sliceutils.StringSlice(p.EnforcementActions...),
-		Notifiers:          p.Notifiers,
-		PolicySections:     sliceutils.ConvertSlice(p.PolicySections, convertPolicySection),
-		MitreAttackVectors: p.MitreAttackVectors,
-		CriteriaLocked:     p.CriteriaLocked,
-		MitreVectorsLocked: p.MitreVectorsLocked,
-		IsDefault:          p.IsDefault,
-		EvaluationFilter:   p.EvaluationFilter,
+		Name:               p.GetName(),
+		Description:        p.GetDescription(),
+		Rationale:          p.GetRationale(),
+		Remediation:        p.GetRemediation(),
+		Disabled:           p.GetDisabled(),
+		Categories:         p.GetCategories(),
+		LifecycleStages:    sliceutils.StringSlice(p.GetLifecycleStages()...),
+		EventSource:        p.GetEventSource().String(),
+		Exclusions:         sliceutils.ConvertSlice(p.GetExclusions(), convertExclusion),
+		Scope:              sliceutils.ConvertSlice(p.GetScope(), convertScope),
+		Severity:           p.GetSeverity().String(),
+		EnforcementActions: sliceutils.StringSlice(p.GetEnforcementActions()...),
+		Notifiers:          p.GetNotifiers(),
+		PolicySections:     sliceutils.ConvertSlice(p.GetPolicySections(), convertPolicySection),
+		MitreAttackVectors: p.GetMitreAttackVectors(),
+		CriteriaLocked:     p.GetCriteriaLocked(),
+		MitreVectorsLocked: p.GetMitreVectorsLocked(),
+		IsDefault:          p.GetIsDefault(),
+		EvaluationFilter:   convertEvaluationFilter(p.GetEvaluationFilter()),
 	}
 }
 
diff --git a/central/policy/customresource/testdata/custom_resource.yaml b/central/policy/customresource/testdata/custom_resource.yaml
index ceac71f4f2acb..bce167fd2d230 100644
--- a/central/policy/customresource/testdata/custom_resource.yaml
+++ b/central/policy/customresource/testdata/custom_resource.yaml
@@ -42,6 +42,12 @@ spec:
     label:
       key: com.docker.stack.namespace
       value: prevent
+  - clusterLabel:
+      key: env
+      value: prod
+    namespaceLabel:
+      key: team
+      value: platform
   severity: LOW_SEVERITY
   enforcementActions:
   - FAIL_BUILD_ENFORCEMENT
@@ -141,3 +147,7 @@ spec:
   criteriaLocked: false
   mitreVectorsLocked: false
   isDefault: false
+  evaluationFilter:
+    skipContainerTypes:
+    - INIT
+    - REGULAR
diff --git a/central/policy/datastore/datastore_impl_test.go b/central/policy/datastore/datastore_impl_test.go
index 607c4fb1f32fc..e8008bf94966c 100644
--- a/central/policy/datastore/datastore_impl_test.go
+++ b/central/policy/datastore/datastore_impl_test.go
@@ -318,12 +318,11 @@ func (s *PolicyDatastoreTestSuite) TestRemoveScopesAndNotifiers() {
 			},
 		},
 		Exclusions: []*storage.Exclusion{
-			{
-				Deployment: &storage.Exclusion_Deployment{
-					Scope: &storage.Scope{
-						Cluster: clusterName,
-					},
+			{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+				Scope: &storage.Scope{
+					Cluster: clusterName,
 				},
+			}},
 			},
 		},
 		Notifiers: []string{notifierName},
@@ -369,12 +368,11 @@ func (s *PolicyDatastoreTestSuite) TestDoesNotRemoveScopesAndNotifiers() {
 			},
 		},
 		Exclusions: []*storage.Exclusion{
-			{
-				Deployment: &storage.Exclusion_Deployment{
-					Scope: &storage.Scope{
-						Cluster: clusterID,
-					},
+			{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+				Scope: &storage.Scope{
+					Cluster: clusterID,
 				},
+			}},
 			},
 		},
 		Notifiers:  []string{notifierName},
diff --git a/central/policy/matcher/cluster.go b/central/policy/matcher/cluster.go
index b1b57f1bf151a..7196d41589c9b 100644
--- a/central/policy/matcher/cluster.go
+++ b/central/policy/matcher/cluster.go
@@ -48,6 +48,12 @@ func (m *clusterMatcher) anyExclusionMatches(exclusions []*storage.Exclusion) bo
 }
 
 func (m *clusterMatcher) exclusionMatches(exclusion *storage.Exclusion) bool {
+	// A kind exclusion does not take the policy off the cluster. Image-only exclusions have no
+	// deployment scope, and a nil scope would otherwise match every cluster.
+	if exclusion.GetDeployment() == nil {
+		return false
+	}
+
 	cs, err := scopecomp.CompileScope(exclusion.GetDeployment().GetScope(), nil, nil)
 	if err != nil {
 		utils.Should(errors.Wrap(err, "could not compile excluded scopes"))
diff --git a/central/policy/matcher/cluster_test.go b/central/policy/matcher/cluster_test.go
index 6ac6fe74ad1aa..e0b5532d19e4e 100644
--- a/central/policy/matcher/cluster_test.go
+++ b/central/policy/matcher/cluster_test.go
@@ -138,12 +138,11 @@ func TestClusterMatcherWithExclusion(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Namespace: "ns.*",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Namespace: "ns.*",
 						},
+					}},
 					},
 				},
 			},
@@ -167,12 +166,11 @@ func TestClusterMatcherWithExclusion(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Namespace: "ns.*",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Namespace: "ns.*",
 						},
+					}},
 					},
 				},
 			},
@@ -195,12 +193,11 @@ func TestClusterMatcherWithExclusion(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Cluster: "cluster1",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Cluster: "cluster1",
 						},
+					}},
 					},
 				},
 			},
@@ -218,12 +215,11 @@ func TestClusterMatcherWithExclusion(t *testing.T) {
 			},
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Namespace: "ns2.*",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Namespace: "ns2.*",
 						},
+					}},
 					},
 				},
 			},
diff --git a/central/policy/matcher/deployment.go b/central/policy/matcher/deployment.go
index 6058438bc79e8..86e035585a65f 100644
--- a/central/policy/matcher/deployment.go
+++ b/central/policy/matcher/deployment.go
@@ -56,6 +56,15 @@ func (m *deploymentMatcher) anyExclusionMatches(ctx context.Context, exclusions
 }
 
 func (m *deploymentMatcher) exclusionMatches(ctx context.Context, exclusion *storage.Exclusion) bool {
+	if !appliesToDeployments(exclusion) {
+		return false
+	}
+	// Kind exclusions have no deployment scope. Falling through would treat the nil scope as
+	// matching every deployment.
+	if exclusion.GetExcludeByKind() != nil {
+		return kindExclusionMatches(exclusion, m.deployment.GetType())
+	}
+
 	// If excluded scope does not match the deployment then no need to check for deployment name
 	if !m.scopeMatches(ctx, exclusion.GetDeployment().GetScope()) {
 		return false
diff --git a/central/policy/matcher/deployment_test.go b/central/policy/matcher/deployment_test.go
index 5512d0339120d..1221d49a70e1b 100644
--- a/central/policy/matcher/deployment_test.go
+++ b/central/policy/matcher/deployment_test.go
@@ -101,12 +101,11 @@ func TestDeploymentWithExclusion(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Namespace: "ns.*",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Namespace: "ns.*",
 						},
+					}},
 					},
 				},
 			},
@@ -126,13 +125,12 @@ func TestDeploymentWithExclusion(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Name: "deployment2",
-							Scope: &storage.Scope{
-								Namespace: "ns.*",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Name: "deployment2",
+						Scope: &storage.Scope{
+							Namespace: "ns.*",
 						},
+					}},
 					},
 				},
 			},
@@ -151,18 +149,16 @@ func TestDeploymentWithExclusion(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Name: "deployment2",
-							Scope: &storage.Scope{
-								Namespace: "ns1",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Name: "deployment2",
+						Scope: &storage.Scope{
+							Namespace: "ns1",
 						},
+					}},
 					},
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Name: "deployment1",
-						},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Name: "deployment1",
+					}},
 					},
 				},
 			},
@@ -181,20 +177,18 @@ func TestDeploymentWithExclusion(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Name: "deployment2",
-							Scope: &storage.Scope{
-								Namespace: "ns1",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Name: "deployment2",
+						Scope: &storage.Scope{
+							Namespace: "ns1",
 						},
+					}},
 					},
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Namespace: "ns1",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Namespace: "ns1",
 						},
+					}},
 					},
 				},
 			},
diff --git a/central/policy/matcher/matcher.go b/central/policy/matcher/matcher.go
index a80cd6c64ad54..c94097cd287c7 100644
--- a/central/policy/matcher/matcher.go
+++ b/central/policy/matcher/matcher.go
@@ -4,6 +4,8 @@ import (
 	"context"
 
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
+	"github.com/stackrox/rox/pkg/kubernetes"
 )
 
 // Matcher provides functionality to evaluate whether or not policies are applicable to an entity.
@@ -11,3 +13,32 @@ type Matcher interface {
 	FilterApplicablePolicies(ctx context.Context, policies []*storage.Policy) (applicable []*storage.Policy, notApplicable []*storage.Policy)
 	IsPolicyApplicable(ctx context.Context, policy *storage.Policy) bool
 }
+
+// appliesToDeployments reports whether the exclusion can take a deployment out of policy scope.
+// A deployment name/scope exclusion and a workload-kind exclusion both can. An image-only exclusion
+// cannot: its nil deployment scope matches every deployment and would make the policy look
+// inapplicable everywhere.
+func appliesToDeployments(exclusion *storage.Exclusion) bool {
+	return exclusion.GetDeployment() != nil || exclusion.GetExcludeByKind() != nil
+}
+
+// kindExclusionMatches reports whether a kind exclusion excludes this deployment.
+// The feature flag gates it. A disabled flag leaves the policy applicable, matching detection.
+func kindExclusionMatches(exclusion *storage.Exclusion, deploymentType string) bool {
+	if !features.PolicyWorkloadKindExclusion.Enabled() {
+		return false
+	}
+	for _, kind := range exclusion.GetExcludeByKind().GetKinds() {
+		switch kind {
+		case storage.Exclusion_CRON_JOB:
+			if deploymentType == kubernetes.CronJob {
+				return true
+			}
+		case storage.Exclusion_JOB:
+			if deploymentType == kubernetes.Job {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/central/policy/matcher/matcher_test.go b/central/policy/matcher/matcher_test.go
new file mode 100644
index 0000000000000..0642a5308378c
--- /dev/null
+++ b/central/policy/matcher/matcher_test.go
@@ -0,0 +1,79 @@
+package matcher
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
+	"github.com/stackrox/rox/pkg/kubernetes"
+	"github.com/stackrox/rox/pkg/testutils"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestImageOnlyExclusionDoesNotExcludeEntities checks that an image-only exclusion leaves the policy
+// applicable to every deployment, namespace, and cluster, while a deployment exclusion still excludes.
+func TestImageOnlyExclusionDoesNotExcludeEntities(t *testing.T) {
+	ctx := context.Background()
+	deployment := &storage.Deployment{Name: "payments", ClusterId: "cluster1", Namespace: "shop"}
+	namespace := &storage.NamespaceMetadata{Name: "shop", ClusterId: "cluster1"}
+	cluster := &storage.Cluster{Id: "cluster1"}
+
+	matchers := map[string]Matcher{
+		"deployment": NewDeploymentMatcher(deployment, nil, nil),
+		"namespace":  NewNamespaceMatcher(namespace),
+		"cluster":    NewClusterMatcher(cluster, []*storage.NamespaceMetadata{namespace}),
+	}
+
+	imageOnly := &storage.Policy{Exclusions: []*storage.Exclusion{
+		{Image: &storage.Exclusion_Image{Name: "docker.io/library/nginx"}},
+	}}
+	clusterExclusion := &storage.Policy{Exclusions: []*storage.Exclusion{
+		{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Cluster: "cluster1"}}}},
+	}}
+
+	for name, m := range matchers {
+		t.Run(name, func(t *testing.T) {
+			assert.True(t, m.IsPolicyApplicable(ctx, imageOnly), "image-only exclusion should not exclude")
+			assert.False(t, m.IsPolicyApplicable(ctx, clusterExclusion), "cluster-scoped exclusion should exclude")
+		})
+	}
+}
+
+func TestKindExclusionExcludesMatchingDeploymentsOnly(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.PolicyWorkloadKindExclusion, true)
+	ctx := context.Background()
+	namespace := &storage.NamespaceMetadata{Name: "shop", ClusterId: "cluster1"}
+	cluster := &storage.Cluster{Id: "cluster1"}
+	policy := &storage.Policy{Exclusions: []*storage.Exclusion{{
+		Matcher: &storage.Exclusion_ExcludeByKind_{
+			ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+				Kinds: []storage.Exclusion_WorkloadKind{storage.Exclusion_JOB, storage.Exclusion_CRON_JOB},
+			},
+		},
+	}}}
+
+	job := &storage.Deployment{Name: "batch", Type: kubernetes.Job, ClusterId: "cluster1", Namespace: "shop"}
+	cronJob := &storage.Deployment{Name: "nightly", Type: kubernetes.CronJob, ClusterId: "cluster1", Namespace: "shop"}
+	deploy := &storage.Deployment{Name: "web", Type: kubernetes.Deployment, ClusterId: "cluster1", Namespace: "shop"}
+
+	assert.False(t, NewDeploymentMatcher(job, nil, nil).IsPolicyApplicable(ctx, policy))
+	assert.False(t, NewDeploymentMatcher(cronJob, nil, nil).IsPolicyApplicable(ctx, policy))
+	assert.True(t, NewDeploymentMatcher(deploy, nil, nil).IsPolicyApplicable(ctx, policy))
+	assert.True(t, NewNamespaceMatcher(namespace).IsPolicyApplicable(ctx, policy))
+	assert.True(t, NewClusterMatcher(cluster, []*storage.NamespaceMetadata{namespace}).IsPolicyApplicable(ctx, policy))
+}
+
+func TestKindExclusionFlagOffLeavesPolicyApplicable(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.PolicyWorkloadKindExclusion, false)
+	job := &storage.Deployment{Name: "batch", Type: kubernetes.Job, ClusterId: "cluster1", Namespace: "shop"}
+	policy := &storage.Policy{Exclusions: []*storage.Exclusion{{
+		Matcher: &storage.Exclusion_ExcludeByKind_{
+			ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+				Kinds: []storage.Exclusion_WorkloadKind{storage.Exclusion_JOB},
+			},
+		},
+	}}}
+
+	assert.True(t, NewDeploymentMatcher(job, nil, nil).IsPolicyApplicable(context.Background(), policy))
+}
diff --git a/central/policy/matcher/namespace.go b/central/policy/matcher/namespace.go
index 1cf53532e9f72..6bd6ee7e7f2aa 100644
--- a/central/policy/matcher/namespace.go
+++ b/central/policy/matcher/namespace.go
@@ -46,6 +46,12 @@ func (m *namespaceMatcher) anyExclusionMatches(exclusions []*storage.Exclusion)
 }
 
 func (m *namespaceMatcher) exclusionMatches(exclusion *storage.Exclusion) bool {
+	// A kind exclusion does not take the policy off the namespace: other workload kinds there
+	// are still in scope. Image-only exclusions have no deployment scope, and a nil scope would
+	// otherwise match every namespace.
+	if exclusion.GetDeployment() == nil {
+		return false
+	}
 	return m.scopeMatches(exclusion.GetDeployment().GetScope())
 }
 
diff --git a/central/policy/matcher/namespace_test.go b/central/policy/matcher/namespace_test.go
index 4ca67b8d2755c..23bc5edb1b26a 100644
--- a/central/policy/matcher/namespace_test.go
+++ b/central/policy/matcher/namespace_test.go
@@ -114,12 +114,11 @@ func TestNamespaceMatcherWithWhitespace(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Namespace: "ns.*",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Namespace: "ns.*",
 						},
+					}},
 					},
 				},
 			},
@@ -137,13 +136,12 @@ func TestNamespaceMatcherWithWhitespace(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Cluster:   "cluster1",
-								Namespace: "ns1",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Cluster:   "cluster1",
+							Namespace: "ns1",
 						},
+					}},
 					},
 				},
 			},
@@ -161,12 +159,11 @@ func TestNamespaceMatcherWithWhitespace(t *testing.T) {
 					},
 				},
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{
-							Scope: &storage.Scope{
-								Cluster: "cluster1",
-							},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+						Scope: &storage.Scope{
+							Cluster: "cluster1",
 						},
+					}},
 					},
 				},
 			},
diff --git a/central/policy/service/validator.go b/central/policy/service/validator.go
index 90f6dc87ddc97..38c93dec4bb9a 100644
--- a/central/policy/service/validator.go
+++ b/central/policy/service/validator.go
@@ -286,7 +286,7 @@ func (s *policyValidator) validateExclusions(policy *storage.Policy) error {
 }
 
 func (s *policyValidator) validateExclusion(policy *storage.Policy, exclusion *storage.Exclusion) error {
-	if exclusion.GetDeployment() == nil && exclusion.GetImage() == nil {
+	if exclusion.GetDeployment() == nil && exclusion.GetImage() == nil && exclusion.GetExcludeByKind() == nil {
 		return errors.New("all excluded scopes must have some criteria to match on")
 	}
 	if exclusion.GetDeployment() != nil {
@@ -297,6 +297,17 @@ func (s *policyValidator) validateExclusion(policy *storage.Policy, exclusion *s
 			return err
 		}
 	}
+	if exclusion.GetExcludeByKind() != nil {
+		if !features.PolicyWorkloadKindExclusion.Enabled() {
+			return errors.New("exclude_by_kind requires feature flag ROX_POLICY_WORKLOAD_KIND_EXCLUSION to be enabled")
+		}
+		if !policies.AppliesAtDeployTime(policy) && !policies.AppliesAtRunTime(policy) {
+			return errors.New("excluding by workload kind is only valid during the DEPLOY and RUNTIME lifecycles")
+		}
+		if err := validateExcludeByKind(exclusion.GetExcludeByKind()); err != nil {
+			return err
+		}
+	}
 	if exclusion.GetImage() != nil {
 		if !policies.AppliesAtBuildTime(policy) {
 			return errors.New("excluding an image is only valid during the BUILD lifecycle")
@@ -308,6 +319,22 @@ func (s *policyValidator) validateExclusion(policy *storage.Policy, exclusion *s
 	return nil
 }
 
+func validateExcludeByKind(excludeByKind *storage.Exclusion_ExcludeByKind) error {
+	kinds := excludeByKind.GetKinds()
+	if len(kinds) == 0 {
+		return errors.New("exclude_by_kind must specify at least one workload kind")
+	}
+	for _, kind := range kinds {
+		if kind == storage.Exclusion_WORKLOAD_KIND_UNSPECIFIED {
+			return errors.New("exclude_by_kind cannot include WORKLOAD_KIND_UNSPECIFIED")
+		}
+		if kind != storage.Exclusion_CRON_JOB && kind != storage.Exclusion_JOB {
+			return errors.Errorf("exclude_by_kind contains unknown workload kind %s", kind)
+		}
+	}
+	return nil
+}
+
 func (s *policyValidator) validateDeploymentExclusion(exclusion *storage.Exclusion) error {
 	deployment := exclusion.GetDeployment()
 	if deployment.GetScope() == nil && deployment.GetName() == "" {
@@ -510,14 +537,15 @@ func (s *policyValidator) validateEvaluationFilter(policy *storage.Policy) error
 	if len(policy.GetEvaluationFilter().GetSkipContainerTypes()) == 0 {
 		return nil
 	}
-	if policies.AppliesAtBuildTime(policy) && !policies.AppliesAtDeployTime(policy) && !policies.AppliesAtRunTime(policy) {
-		return errors.New("container type filters in the evaluation filter are not applicable to build-only policies")
-	}
-	if s.isAuditEventPolicy(policy) {
-		return errors.New("container type filters in the evaluation filter are not applicable to audit log event policies")
-	}
-	if s.isNodeEventPolicy(policy) {
-		return errors.New("container type filters in the evaluation filter are not applicable to node event policies")
+	if !containerTypeFilterApplicable(policy) {
+		return errors.New("container type filters apply only to deploy-time policies and runtime policies with a deployment event source")
 	}
 	return nil
 }
+
+func containerTypeFilterApplicable(policy *storage.Policy) bool {
+	if policies.AppliesAtDeployTime(policy) {
+		return true
+	}
+	return policies.AppliesAtRunTime(policy) && policy.GetEventSource() == storage.EventSource_DEPLOYMENT_EVENT
+}
diff --git a/central/policy/service/validator_test.go b/central/policy/service/validator_test.go
index 1e317de9785e4..784601206355f 100644
--- a/central/policy/service/validator_test.go
+++ b/central/policy/service/validator_test.go
@@ -614,9 +614,7 @@ func (s *PolicyValidatorTestSuite) TestValidateExclusions() {
 	deployment := &storage.Exclusion_Deployment{
 		Name: "that phat cluster",
 	}
-	deploymentExclusion := &storage.Exclusion{
-		Deployment: deployment,
-	}
+	deploymentExclusion := &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: deployment}}
 	policy = &storage.Policy{
 		LifecycleStages: []storage.LifecycleStage{
 			storage.LifecycleStage_DEPLOY,
@@ -661,14 +659,13 @@ func (s *PolicyValidatorTestSuite) TestValidateExclusions() {
 	err = s.validator.validateExclusions(policy)
 	s.Error(err, "excluded scope requires either container or deployment configuration")
 
-	emptyLabelExclusion := &storage.Exclusion{
-		Deployment: &storage.Exclusion_Deployment{
-			Scope: &storage.Scope{
-				Label: &storage.Scope_Label{
-					Key: "",
-				},
+	emptyLabelExclusion := &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+		Scope: &storage.Scope{
+			Label: &storage.Scope_Label{
+				Key: "",
 			},
 		},
+	}},
 	}
 	policy = &storage.Policy{
 		Exclusions: []*storage.Exclusion{
@@ -678,15 +675,14 @@ func (s *PolicyValidatorTestSuite) TestValidateExclusions() {
 	err = s.validator.validateExclusions(policy)
 	s.Error(err, "label regex in excluded scope, if not nil, must be non-empty")
 
-	anyKeyLabelExclusion := &storage.Exclusion{
-		Deployment: &storage.Exclusion_Deployment{
-			Scope: &storage.Scope{
-				Label: &storage.Scope_Label{
-					Key:   ".*",
-					Value: "",
-				},
+	anyKeyLabelExclusion := &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+		Scope: &storage.Scope{
+			Label: &storage.Scope_Label{
+				Key:   ".*",
+				Value: "",
 			},
 		},
+	}},
 	}
 	policy = &storage.Policy{
 		LifecycleStages: []storage.LifecycleStage{
@@ -698,15 +694,14 @@ func (s *PolicyValidatorTestSuite) TestValidateExclusions() {
 	}
 	s.NoError(s.validator.validateExclusions(policy))
 
-	anyLabelExclusion := &storage.Exclusion{
-		Deployment: &storage.Exclusion_Deployment{
-			Scope: &storage.Scope{
-				Label: &storage.Scope_Label{
-					Key:   ".*",
-					Value: ".*",
-				},
+	anyLabelExclusion := &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+		Scope: &storage.Scope{
+			Label: &storage.Scope_Label{
+				Key:   ".*",
+				Value: ".*",
 			},
 		},
+	}},
 	}
 	policy = &storage.Policy{
 		LifecycleStages: []storage.LifecycleStage{
@@ -719,6 +714,79 @@ func (s *PolicyValidatorTestSuite) TestValidateExclusions() {
 	s.NoError(s.validator.validateExclusions(policy))
 }
 
+func (s *PolicyValidatorTestSuite) TestValidateExcludeByKind() {
+	kindExclusion := func(kinds ...storage.Exclusion_WorkloadKind) *storage.Exclusion {
+		return &storage.Exclusion{
+			Matcher: &storage.Exclusion_ExcludeByKind_{
+				ExcludeByKind: &storage.Exclusion_ExcludeByKind{Kinds: kinds},
+			},
+		}
+	}
+	deployPolicy := func(exclusion *storage.Exclusion) *storage.Policy {
+		return &storage.Policy{
+			LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_DEPLOY},
+			Exclusions:      []*storage.Exclusion{exclusion},
+		}
+	}
+
+	s.ErrorContains(s.validator.validateExclusions(deployPolicy(kindExclusion(storage.Exclusion_JOB))), "ROX_POLICY_WORKLOAD_KIND_EXCLUSION")
+
+	testutils.MustUpdateFeature(s.T(), features.PolicyWorkloadKindExclusion, true)
+
+	for name, tc := range map[string]struct {
+		policy      *storage.Policy
+		errContains string
+	}{
+		"JOB is valid": {
+			policy: deployPolicy(kindExclusion(storage.Exclusion_JOB)),
+		},
+		"CRON_JOB is valid": {
+			policy: deployPolicy(kindExclusion(storage.Exclusion_CRON_JOB)),
+		},
+		"JOB and CRON_JOB are valid": {
+			policy: deployPolicy(kindExclusion(storage.Exclusion_CRON_JOB, storage.Exclusion_JOB)),
+		},
+		"empty kind list is rejected": {
+			policy:      deployPolicy(kindExclusion()),
+			errContains: "at least one workload kind",
+		},
+		"UNSPECIFIED is rejected": {
+			policy:      deployPolicy(kindExclusion(storage.Exclusion_WORKLOAD_KIND_UNSPECIFIED)),
+			errContains: "WORKLOAD_KIND_UNSPECIFIED",
+		},
+		"unknown kind is rejected": {
+			policy:      deployPolicy(kindExclusion(storage.Exclusion_WorkloadKind(99))),
+			errContains: "unknown workload kind",
+		},
+		"mixed valid and unknown kinds are rejected": {
+			policy:      deployPolicy(kindExclusion(storage.Exclusion_JOB, storage.Exclusion_WorkloadKind(99))),
+			errContains: "unknown workload kind",
+		},
+		"RUNTIME lifecycle is valid": {
+			policy: &storage.Policy{
+				LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_RUNTIME},
+				Exclusions:      []*storage.Exclusion{kindExclusion(storage.Exclusion_JOB)},
+			},
+		},
+		"BUILD lifecycle is rejected": {
+			policy: &storage.Policy{
+				LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_BUILD},
+				Exclusions:      []*storage.Exclusion{kindExclusion(storage.Exclusion_JOB)},
+			},
+			errContains: "DEPLOY and RUNTIME",
+		},
+	} {
+		s.T().Run(name, func(t *testing.T) {
+			err := s.validator.validateExclusions(tc.policy)
+			if tc.errContains == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.errContains)
+			}
+		})
+	}
+}
+
 func (s *PolicyValidatorTestSuite) TestValidateExclusionRejectsLabels() {
 	for name, tc := range map[string]struct {
 		exclusion   *storage.Exclusion
@@ -726,44 +794,40 @@ func (s *PolicyValidatorTestSuite) TestValidateExclusionRejectsLabels() {
 		errContains string
 	}{
 		"cluster_label on exclusion scope is rejected": {
-			exclusion: &storage.Exclusion{
-				Deployment: &storage.Exclusion_Deployment{
-					Scope: &storage.Scope{
-						ClusterLabel: &storage.Scope_Label{Key: "env", Value: "prod"},
-					},
+			exclusion: &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+				Scope: &storage.Scope{
+					ClusterLabel: &storage.Scope_Label{Key: "env", Value: "prod"},
 				},
+			}},
 			},
 			errExpected: true,
 			errContains: "cluster labels",
 		},
 		"namespace_label on exclusion scope is rejected": {
-			exclusion: &storage.Exclusion{
-				Deployment: &storage.Exclusion_Deployment{
-					Scope: &storage.Scope{
-						NamespaceLabel: &storage.Scope_Label{Key: "team", Value: "backend"},
-					},
+			exclusion: &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+				Scope: &storage.Scope{
+					NamespaceLabel: &storage.Scope_Label{Key: "team", Value: "backend"},
 				},
+			}},
 			},
 			errExpected: true,
 			errContains: "namespace labels",
 		},
 		"deployment label on exclusion scope is allowed": {
-			exclusion: &storage.Exclusion{
-				Deployment: &storage.Exclusion_Deployment{
-					Scope: &storage.Scope{
-						Label: &storage.Scope_Label{Key: "app", Value: "nginx"},
-					},
+			exclusion: &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+				Scope: &storage.Scope{
+					Label: &storage.Scope_Label{Key: "app", Value: "nginx"},
 				},
+			}},
 			},
 			errExpected: false,
 		},
 		"cluster ID on exclusion scope is allowed": {
-			exclusion: &storage.Exclusion{
-				Deployment: &storage.Exclusion_Deployment{
-					Scope: &storage.Scope{
-						Cluster: "cluster-1",
-					},
+			exclusion: &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+				Scope: &storage.Scope{
+					Cluster: "cluster-1",
 				},
+			}},
 			},
 			errExpected: false,
 		},
@@ -1391,19 +1455,25 @@ func (s *PolicyValidatorTestSuite) TestValidateEvaluationFilter() {
 			lifecycleStages:    []storage.LifecycleStage{storage.LifecycleStage_DEPLOY},
 			skipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
 		},
+		"deploy with skip regular is allowed": {
+			lifecycleStages:    []storage.LifecycleStage{storage.LifecycleStage_DEPLOY},
+			skipContainerTypes: []storage.ContainerType{storage.ContainerType_REGULAR},
+		},
 		"build + deploy with skip init is allowed": {
 			lifecycleStages:    []storage.LifecycleStage{storage.LifecycleStage_BUILD, storage.LifecycleStage_DEPLOY},
 			skipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
 		},
-		"runtime with skip init is allowed": {
-			lifecycleStages:    []storage.LifecycleStage{storage.LifecycleStage_RUNTIME},
-			skipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
-		},
 		"build-only with no filter is allowed": {
 			lifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_BUILD},
 		},
-		"no lifecycle stages with skip init is allowed": {
+		"runtime without event source with skip init is rejected": {
+			lifecycleStages:    []storage.LifecycleStage{storage.LifecycleStage_RUNTIME},
+			skipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
+			expectError:        true,
+		},
+		"no lifecycle stages with skip init is rejected": {
 			skipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
+			expectError:        true,
 		},
 		"audit log event with skip init is rejected": {
 			lifecycleStages:    []storage.LifecycleStage{storage.LifecycleStage_RUNTIME},
@@ -1422,6 +1492,11 @@ func (s *PolicyValidatorTestSuite) TestValidateEvaluationFilter() {
 			eventSource:        storage.EventSource_DEPLOYMENT_EVENT,
 			skipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
 		},
+		"deployment event with skip regular is allowed": {
+			lifecycleStages:    []storage.LifecycleStage{storage.LifecycleStage_RUNTIME},
+			eventSource:        storage.EventSource_DEPLOYMENT_EVENT,
+			skipContainerTypes: []storage.ContainerType{storage.ContainerType_REGULAR},
+		},
 	}
 
 	for name, tc := range tests {
diff --git a/central/postgres/pruning.go b/central/postgres/pruning.go
index 14cdad7d9e2b3..2bb614e068468 100644
--- a/central/postgres/pruning.go
+++ b/central/postgres/pruning.go
@@ -29,6 +29,9 @@ const (
 	getAllOrphanedNodes = `SELECT id FROM nodes WHERE NOT EXISTS
 		(SELECT 1 FROM clusters WHERE nodes.clusterid = clusters.Id)`
 
+	getAllOrphanedDeployments = `SELECT id, clusterid FROM deployments WHERE NOT EXISTS
+		(SELECT 1 FROM clusters WHERE deployments.clusterid = clusters.Id)`
+
 	getOrphanedProcessesByDeployment = `SELECT id FROM process_indicators pi WHERE NOT EXISTS
 		(SELECT 1 FROM deployments WHERE pi.deploymentid = deployments.Id) AND
 		(signal_time < now() AT time zone 'utc' - INTERVAL '%d MINUTES' OR signal_time IS NULL)`
@@ -189,6 +192,37 @@ func GetOrphanedNodeIDs(ctx context.Context, pool postgres.DB) ([]string, error)
 	})
 }
 
+// OrphanedDeployment holds a deployment id with its clusterid
+type OrphanedDeployment struct {
+	ID        string
+	ClusterID string
+}
+
+// GetOrphanedDeploymentIDs returns the deployments that have a cluster that has been removed.
+func GetOrphanedDeploymentIDs(ctx context.Context, pool postgres.DB) ([]OrphanedDeployment, error) {
+	return pgutils.Retry2(ctx, func() ([]OrphanedDeployment, error) {
+		ctx, cancel := context.WithTimeout(ctx, orphanedQueryTimeout)
+		defer cancel()
+
+		rows, err := pool.Query(ctx, getAllOrphanedDeployments)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to get orphaned deployments")
+		}
+		return pgx.CollectRows(rows, func(r pgx.CollectableRow) (OrphanedDeployment, error) {
+			var d OrphanedDeployment
+			// clusterid is nullable; scan into a pointer so a NULL does not abort the pruning cycle.
+			var clusterID *string
+			if err := r.Scan(&d.ID, &clusterID); err != nil {
+				return OrphanedDeployment{}, errors.Wrap(err, "scanning orphaned deployment")
+			}
+			if clusterID != nil {
+				d.ClusterID = *clusterID
+			}
+			return d, nil
+		})
+	})
+}
+
 // GetOrphanedProcessIDsByDeployment returns the process ids that have a deployment that has been removed.
 func GetOrphanedProcessIDsByDeployment(ctx context.Context, pool postgres.DB, orphanWindow time.Duration) ([]string, error) {
 	return pgutils.Retry2(ctx, func() ([]string, error) {
diff --git a/central/postgres/pruning_test.go b/central/postgres/pruning_test.go
index c788459a7588d..ade6dd5c22796 100644
--- a/central/postgres/pruning_test.go
+++ b/central/postgres/pruning_test.go
@@ -233,6 +233,68 @@ func (s *PostgresPruningSuite) TestGetOrphanedPodIDs() {
 	s.Equal(len(idsToPrune), cluster2PodCount)
 }
 
+func (s *PostgresPruningSuite) TestGetOrphanedDeploymentIDs() {
+	deploymentDS, err := deploymentStore.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+	s.Require().NoError(err)
+
+	clusterDS, err := clusterStore.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+	s.Require().NoError(err)
+
+	liveClusterID, err := clusterDS.AddCluster(s.ctx, &storage.Cluster{Name: "testOrphanDeploymentCluster", MainImage: "docker.io/stackrox/rox:latest"})
+	s.Require().NoError(err)
+
+	// Deployment tied to a live cluster - never orphaned.
+	liveDeploymentID := uuid.NewV4().String()
+	s.Require().NoError(deploymentDS.UpsertDeployment(s.ctx, &storage.Deployment{Id: liveDeploymentID, ClusterId: liveClusterID}))
+
+	// Deployments whose clusterid has no matching cluster row - orphaned. This mirrors
+	// the field scenario where a cluster is hard-deleted but its deployments survive.
+	orphanClusterID := fixtureconsts.Cluster1
+	orphanedIDs := set.NewStringSet()
+	for range 3 {
+		id := uuid.NewV4().String()
+		orphanedIDs.Add(id)
+		s.Require().NoError(deploymentDS.UpsertDeployment(s.ctx, &storage.Deployment{Id: id, ClusterId: orphanClusterID}))
+	}
+
+	orphaned, err := GetOrphanedDeploymentIDs(s.ctx, s.testDB.DB)
+	s.Require().NoError(err)
+
+	got := set.NewStringSet()
+	for _, d := range orphaned {
+		got.Add(d.ID)
+		s.Equal(orphanClusterID, d.ClusterID)
+	}
+	s.Equal(orphanedIDs, got)
+	s.NotContains(got.AsSlice(), liveDeploymentID)
+}
+
+// A deployment with a NULL clusterid must not abort the sweep; it is orphaned (no matching
+// cluster row) and must be returned with an empty ClusterID.
+func (s *PostgresPruningSuite) TestGetOrphanedDeploymentIDsHandlesNullClusterID() {
+	deploymentDS, err := deploymentStore.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+	s.Require().NoError(err)
+
+	// Upsert with a non-matching cluster id, then null out the collumn, to verify
+	// the pruning works in the unlikely case deployments without clusterid made it to the DB
+	nullClusterDeploymentID := uuid.NewV4().String()
+	s.Require().NoError(deploymentDS.UpsertDeployment(s.ctx, &storage.Deployment{Id: nullClusterDeploymentID, ClusterId: fixtureconsts.Cluster1}))
+	_, err = s.testDB.DB.Exec(s.ctx, "UPDATE deployments SET clusterid = NULL WHERE id = $1", nullClusterDeploymentID)
+	s.Require().NoError(err)
+
+	orphaned, err := GetOrphanedDeploymentIDs(s.ctx, s.testDB.DB)
+	s.Require().NoError(err)
+
+	got := set.NewStringSet()
+	for _, d := range orphaned {
+		got.Add(d.ID)
+		if d.ID == nullClusterDeploymentID {
+			s.Empty(d.ClusterID)
+		}
+	}
+	s.Contains(got.AsSlice(), nullClusterDeploymentID)
+}
+
 func (s *PostgresPruningSuite) TestRemoveOrphanedProcesses() {
 	cases := []struct {
 		name              string
diff --git a/central/processlisteningonport/datastore/datastore.go b/central/processlisteningonport/datastore/datastore.go
index d7744f88b2b32..f7308a5a418ed 100644
--- a/central/processlisteningonport/datastore/datastore.go
+++ b/central/processlisteningonport/datastore/datastore.go
@@ -29,12 +29,9 @@ type DataStore interface {
 		deployment string,
 	) ([]*storage.ProcessListeningOnPort, error)
 	WalkAll(ctx context.Context, fn WalkFn) error
-	RemoveProcessListeningOnPort(ctx context.Context, ids []string) error
 	RemovePlopsByPod(ctx context.Context, id string) error
 	PruneOrphanedPLOPs(ctx context.Context, orphanWindow time.Duration) int64
-	PruneOrphanedPLOPsByProcessIndicators(ctx context.Context, orphanWindow time.Duration)
 	RemovePLOPsWithoutProcessIndicatorOrProcessInfo(ctx context.Context) (int64, error)
-	RemovePLOPsWithoutPodUID(ctx context.Context) (int64, error)
 }
 
 // New creates a data store object to access the database. Since some
diff --git a/central/processlisteningonport/datastore/datastore_impl.go b/central/processlisteningonport/datastore/datastore_impl.go
index cd8219320a726..3783a97139f7b 100644
--- a/central/processlisteningonport/datastore/datastore_impl.go
+++ b/central/processlisteningonport/datastore/datastore_impl.go
@@ -306,25 +306,6 @@ func (ds *datastoreImpl) WalkAll(ctx context.Context, fn WalkFn) error {
 	return ds.storage.Walk(ctx, fn)
 }
 
-func (ds *datastoreImpl) RemoveProcessListeningOnPort(ctx context.Context, ids []string) error {
-	if ok, err := plopSAC.WriteAllowed(ctx); err != nil {
-		return err
-	} else if !ok {
-		return sac.ErrResourceAccessDenied
-	}
-
-	return ds.removePLOP(ctx, ids)
-}
-
-func (ds *datastoreImpl) removePLOP(ctx context.Context, ids []string) error {
-
-	if len(ids) == 0 {
-		return nil
-	}
-
-	return ds.storage.DeleteMany(ctx, ids)
-}
-
 func (ds *datastoreImpl) fetchExistingPLOPs(
 	ctx context.Context,
 	indicatorIds []string,
@@ -596,27 +577,6 @@ func (ds *datastoreImpl) PruneOrphanedPLOPs(ctx context.Context, orphanWindow ti
 	return commandTag.RowsAffected()
 }
 
-// PruneOrphanedPLOPsByProcessIndicators prunes PLOPs that match process indicators without pods
-func (ds *datastoreImpl) PruneOrphanedPLOPsByProcessIndicators(ctx context.Context, orphanWindow time.Duration) {
-	// TODO(ROX-22443): Once it is guaranteed that all listening endpoints have PodUIDs, remove this function
-	ds.mutex.Lock()
-	defer ds.mutex.Unlock()
-
-	// Delete processes listening on ports orphaned because process indicators are orphaned due to
-	// missing deployments
-	query := fmt.Sprintf(deleteOrphanedPLOPDeploymentsAndPI, int(orphanWindow.Minutes()))
-	if _, err := ds.pool.Exec(ctx, query); err != nil {
-		log.Errorf("failed to prune process listening on ports by deployment: %v", err)
-	}
-
-	// Delete processes listening on ports orphaned because process indicators are orphaned due to
-	// missing pods.
-	query = fmt.Sprintf(deleteOrphanedPLOPPods, int(orphanWindow.Minutes()))
-	if _, err := ds.pool.Exec(ctx, query); err != nil {
-		log.Errorf("failed to prune process listening on ports by pods: %v", err)
-	}
-}
-
 func (ds *datastoreImpl) readRowsToFindPLOPsWithNoProcessInformation(rows pgx.Rows) ([]string, error) {
 	var ids []string
 
@@ -672,89 +632,3 @@ func (ds *datastoreImpl) RemovePLOPsWithoutProcessIndicatorOrProcessInfo(ctx con
 
 	return int64(len(plopsToDelete)), nil
 }
-
-// Removes PLOPs without poduids between a range of ids.
-func (ds *datastoreImpl) removePLOPsWithoutPodUIDOnePage(ctx context.Context, prevId string, nextId string) (int64, error) {
-	ds.mutex.Lock()
-	defer ds.mutex.Unlock()
-
-	query := fmt.Sprintf(deletePLOPsWithoutPoduidInPage, prevId, nextId)
-	commandTag, err := ds.pool.Exec(ctx, query)
-
-	if err != nil {
-		return 0, err
-	}
-
-	return commandTag.RowsAffected(), nil
-}
-
-// Given a set of rows with ids, returns the id of the last row. This is useful for pagination.
-func (ds *datastoreImpl) getLastIdFromRows(ctx context.Context, rows pgx.Rows) (string, error) {
-	id := ""
-
-	for rows.Next() {
-		if err := rows.Scan(&id); err != nil {
-			return "", pgutils.ErrNilIfNoRows(err)
-		}
-	}
-
-	return id, rows.Err()
-}
-
-// Given an id and a limit, returns the id a limit number of rows after the given id. This is useful
-// for efficient pagination.
-func (ds *datastoreImpl) getNextPageId(ctx context.Context, prevId string, limit int) (string, error) {
-	ds.mutex.Lock()
-	defer ds.mutex.Unlock()
-
-	query := fmt.Sprintf(getLastIdFromPage, prevId, limit)
-	rows, err := ds.pool.Query(ctx, query)
-
-	if err != nil {
-		// Do not be alarmed if the error is simply NoRows
-		err = pgutils.ErrNilIfNoRows(err)
-		if err != nil {
-			log.Warnf("%s: %s", query, err)
-		}
-		return "", err
-	}
-	defer rows.Close()
-
-	nextId, err := ds.getLastIdFromRows(ctx, rows)
-
-	if err != nil {
-		return "", err
-	}
-
-	return nextId, nil
-}
-
-func (ds *datastoreImpl) retryableRemovePLOPsWithoutPodUID(ctx context.Context) (int64, error) {
-	limit := 10000
-	totalRows := int64(0)
-
-	prevId := "00000000-0000-0000-0000-000000000000"
-	for {
-		nextId, err := ds.getNextPageId(ctx, prevId, limit)
-		if err != nil {
-			return totalRows, err
-		}
-		if nextId == "" {
-			break
-		}
-		nrows, err := ds.removePLOPsWithoutPodUIDOnePage(ctx, prevId, nextId)
-		if err != nil {
-			return totalRows, err
-		}
-		totalRows += nrows
-		prevId = nextId
-	}
-
-	return totalRows, nil
-}
-
-func (ds *datastoreImpl) RemovePLOPsWithoutPodUID(ctx context.Context) (int64, error) {
-	return pgutils.Retry2(ctx, func() (int64, error) {
-		return ds.retryableRemovePLOPsWithoutPodUID(ctx)
-	})
-}
diff --git a/central/processlisteningonport/datastore/datastore_impl_test.go b/central/processlisteningonport/datastore/datastore_impl_test.go
index 1b4b67b8d1bf4..66d5619a04dac 100644
--- a/central/processlisteningonport/datastore/datastore_impl_test.go
+++ b/central/processlisteningonport/datastore/datastore_impl_test.go
@@ -6,7 +6,6 @@ import (
 	"context"
 	"fmt"
 	"math/rand"
-	"slices"
 	"testing"
 	"time"
 
@@ -2500,174 +2499,6 @@ func (suite *PLOPDataStoreTestSuite) TestRemoveOrphanedPLOPs() {
 	}
 }
 
-func newIndicatorWithDeployment(id string, age time.Duration, deploymentID string) *storage.ProcessIndicator {
-	return &storage.ProcessIndicator{
-		Id:            id,
-		DeploymentId:  deploymentID,
-		ContainerName: "",
-		PodId:         "",
-		Signal: &storage.ProcessSignal{
-			Time: protoconv.NowMinus(age),
-		},
-	}
-}
-
-func newIndicatorWithDeploymentAndPod(id string, age time.Duration, deploymentID, podUID string) *storage.ProcessIndicator {
-	indicator := newIndicatorWithDeployment(id, age, deploymentID)
-	indicator.PodUid = podUID
-	return indicator
-}
-
-func (suite *PLOPDataStoreTestSuite) TestRemoveOrphanedPLOPsByProcesses() {
-	orphanWindow := 30 * time.Minute
-
-	cases := []struct {
-		name                  string
-		initialProcesses      []*storage.ProcessIndicator
-		initialPlops          []*storage.ProcessListeningOnPortStorage
-		deployments           set.FrozenStringSet
-		pods                  set.FrozenStringSet
-		expectedPlopDeletions []string
-	}{
-		{
-			name: "no deployments nor pods - remove all old indicators",
-			initialProcesses: []*storage.ProcessIndicator{
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID1, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID1),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID2, 1*time.Hour, fixtureconsts.Deployment5, fixtureconsts.PodUID2),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID3, 1*time.Hour, fixtureconsts.Deployment3, fixtureconsts.PodUID3),
-			},
-			initialPlops: []*storage.ProcessListeningOnPortStorage{
-				fixtures.GetPlopStorage1(),
-				fixtures.GetPlopStorage2(),
-				fixtures.GetPlopStorage3(),
-				fixtures.GetPlopStorage4(),
-				fixtures.GetPlopStorage5(),
-				fixtures.GetPlopStorage6(),
-			},
-			deployments: set.NewFrozenStringSet(),
-			pods:        set.NewFrozenStringSet(),
-			expectedPlopDeletions: []string{
-				fixtureconsts.PlopUID1,
-				fixtureconsts.PlopUID2,
-				fixtureconsts.PlopUID3,
-				fixtureconsts.PlopUID4,
-				fixtureconsts.PlopUID5,
-				fixtureconsts.PlopUID6,
-			},
-		},
-		{
-			name: "no deployments nor pods - remove no new orphaned indicators",
-			initialProcesses: []*storage.ProcessIndicator{
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID1, 20*time.Minute, fixtureconsts.Deployment6, fixtureconsts.PodUID1),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID2, 20*time.Minute, fixtureconsts.Deployment5, fixtureconsts.PodUID2),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID3, 20*time.Minute, fixtureconsts.Deployment3, fixtureconsts.PodUID3),
-			},
-			initialPlops: []*storage.ProcessListeningOnPortStorage{
-				fixtures.GetPlopStorage1(),
-				fixtures.GetPlopStorage2(),
-				fixtures.GetPlopStorage3(),
-			},
-			deployments:           set.NewFrozenStringSet(),
-			pods:                  set.NewFrozenStringSet(),
-			expectedPlopDeletions: nil,
-		},
-		{
-			name: "all pods separate deployments - remove no indicators",
-			initialProcesses: []*storage.ProcessIndicator{
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID1, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID1),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID2, 1*time.Hour, fixtureconsts.Deployment5, fixtureconsts.PodUID2),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID3, 1*time.Hour, fixtureconsts.Deployment3, fixtureconsts.PodUID3),
-			},
-			initialPlops: []*storage.ProcessListeningOnPortStorage{
-				fixtures.GetPlopStorage1(),
-				fixtures.GetPlopStorage2(),
-				fixtures.GetPlopStorage3(),
-			},
-			deployments:           set.NewFrozenStringSet(fixtureconsts.Deployment6, fixtureconsts.Deployment5, fixtureconsts.Deployment3),
-			pods:                  set.NewFrozenStringSet(fixtureconsts.PodUID1, fixtureconsts.PodUID2, fixtureconsts.PodUID3),
-			expectedPlopDeletions: nil,
-		},
-		{
-			name: "all pods same deployment - remove no indicators",
-			initialProcesses: []*storage.ProcessIndicator{
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID1, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID1),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID2, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID2),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID3, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID3),
-			},
-			deployments:           set.NewFrozenStringSet(fixtureconsts.Deployment6),
-			pods:                  set.NewFrozenStringSet(fixtureconsts.PodUID1, fixtureconsts.PodUID2, fixtureconsts.PodUID3),
-			expectedPlopDeletions: nil,
-		},
-		{
-			name: "some pods separate deployments - remove some indicators",
-			initialProcesses: []*storage.ProcessIndicator{
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID1, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID1),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID2, 20*time.Minute, fixtureconsts.Deployment5, fixtureconsts.PodUID2),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID3, 1*time.Hour, fixtureconsts.Deployment3, fixtureconsts.PodUID3),
-			},
-			initialPlops: []*storage.ProcessListeningOnPortStorage{
-				fixtures.GetPlopStorage1(),
-				fixtures.GetPlopStorage2(),
-				fixtures.GetPlopStorage3(),
-			},
-			deployments:           set.NewFrozenStringSet(fixtureconsts.Deployment3),
-			pods:                  set.NewFrozenStringSet(fixtureconsts.PodUID3),
-			expectedPlopDeletions: []string{fixtureconsts.PlopUID1},
-		},
-		{
-			name: "some pods same deployment - remove some indicators",
-			initialProcesses: []*storage.ProcessIndicator{
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID1, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID1),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID2, 20*time.Minute, fixtureconsts.Deployment6, fixtureconsts.PodUID2),
-				newIndicatorWithDeploymentAndPod(fixtureconsts.ProcessIndicatorID3, 1*time.Hour, fixtureconsts.Deployment6, fixtureconsts.PodUID3),
-			},
-			initialPlops: []*storage.ProcessListeningOnPortStorage{
-				fixtures.GetPlopStorage1(),
-				fixtures.GetPlopStorage2(),
-				fixtures.GetPlopStorage3(),
-			},
-			deployments:           set.NewFrozenStringSet(fixtureconsts.Deployment6),
-			pods:                  set.NewFrozenStringSet(fixtureconsts.PodUID3),
-			expectedPlopDeletions: []string{fixtureconsts.PlopUID1},
-		},
-	}
-	for _, c := range cases {
-		suite.T().Run(c.name, func(t *testing.T) {
-			suite.SetupTest()
-			// Add deployments if necessary
-			deploymentDS, err := deploymentStore.GetTestPostgresDataStore(suite.T(), suite.postgres.DB)
-			suite.Nil(err)
-			for deploymentID := range c.deployments.All() {
-				suite.NoError(deploymentDS.UpsertDeployment(suite.hasAllCtx, &storage.Deployment{Id: deploymentID, ClusterId: fixtureconsts.Cluster1}))
-			}
-
-			for podID := range c.pods.All() {
-				insertPod := fmt.Sprintf("INSERT INTO pods (id, clusterid) VALUES ('%s', '%s')", podID, fixtureconsts.Cluster1)
-				_, err := suite.postgres.DB.Exec(suite.hasWriteCtx, insertPod)
-				suite.Nil(err)
-			}
-
-			suite.NoError(suite.indicatorDataStore.AddProcessIndicators(suite.hasWriteCtx, c.initialProcesses...))
-			countFromDB, err := suite.indicatorDataStore.Count(suite.hasAllCtx, nil)
-			suite.NoError(err)
-			suite.Equal(len(c.initialProcesses), countFromDB)
-
-			err = suite.store.UpsertMany(suite.hasWriteCtx, c.initialPlops)
-			suite.NoError(err)
-			plopCount, err := suite.store.Count(suite.hasReadCtx, search.EmptyQuery())
-			suite.NoError(err)
-			suite.Equal(len(c.initialPlops), plopCount)
-
-			suite.datastore.PruneOrphanedPLOPsByProcessIndicators(suite.hasAllCtx, orphanWindow)
-
-			plopCount, err = suite.store.Count(suite.hasReadCtx, search.EmptyQuery())
-			suite.NoError(err)
-			suite.Equal(len(c.initialPlops)-len(c.expectedPlopDeletions), plopCount)
-
-		})
-	}
-}
-
 // RemovePLOPsWithoutProcessIndicatorOrProcessInfo Adds a PLOP with a matching process indicator.
 // The process indicator is then deleted. This means that the PLOP has no matching
 // process indicator and does not have any process information. A pruning function
@@ -2702,195 +2533,3 @@ func (suite *PLOPDataStoreTestSuite) RemovePLOPsWithoutProcessIndicatorOrProcess
 	newPlopsFromDB := suite.getPlopsFromDB()
 	suite.Len(newPlopsFromDB, 0)
 }
-
-func (suite *PLOPDataStoreTestSuite) TestRemovePLOPsWithoutPodUID() {
-	initialPlops := []*storage.ProcessListeningOnPortStorage{
-		fixtures.GetPlopStorage1(),
-		fixtures.GetPlopStorage2(),
-		fixtures.GetPlopStorage3(),
-		fixtures.GetPlopStorage4(),
-		fixtures.GetPlopStorage5(),
-		fixtures.GetPlopStorage6(),
-	}
-	expectedPlopDeletions := []string{fixtureconsts.PlopUID1, fixtureconsts.PlopUID2, fixtureconsts.PlopUID3}
-
-	err := suite.store.UpsertMany(suite.hasWriteCtx, initialPlops)
-	suite.NoError(err)
-	plopCount, err := suite.store.Count(suite.hasReadCtx, search.EmptyQuery())
-	suite.NoError(err)
-	suite.Equal(len(initialPlops), plopCount)
-
-	prunedCount, err := suite.datastore.RemovePLOPsWithoutPodUID(suite.hasWriteCtx)
-	suite.NoError(err)
-	suite.Equal(int64(3), prunedCount)
-
-	plopCount, err = suite.store.Count(suite.hasReadCtx, search.EmptyQuery())
-	suite.NoError(err)
-	suite.Equal(len(initialPlops)-len(expectedPlopDeletions), plopCount)
-
-	ids, err := suite.store.GetIDs(suite.hasReadCtx)
-	suite.NoError(err)
-	for id := range ids {
-		suite.NotContains(expectedPlopDeletions, id)
-	}
-}
-
-func (suite *PLOPDataStoreTestSuite) addTooMany(plops []*storage.ProcessListeningOnPortFromSensor) {
-	batchSize := 30000
-
-	// Use an explicit context timeout so that ContextWithTimeoutIfNotExists
-	// in the Postgres pool layer sees an existing deadline and skips the
-	// 60-second default per-query timeout, which is too short in some cases.
-	ctx, cancel := context.WithTimeout(suite.hasWriteCtx, 5*time.Minute)
-	defer cancel()
-
-	for plopBatch := range slices.Chunk(plops, batchSize) {
-		err := suite.datastore.AddProcessListeningOnPort(ctx, fixtureconsts.Cluster1, plopBatch...)
-		suite.NoError(err)
-	}
-}
-
-func (suite *PLOPDataStoreTestSuite) RemovePLOPsWithoutPodUIDScale(nport int, nprocess int, npod int) {
-	plopObjects := makeRandomPlops(nport, nprocess, npod, fixtureconsts.Deployment1)
-
-	plopsWithoutPodUids := 0
-	for _, plop := range plopObjects {
-		p := rand.Float32()
-		if p < 0.5 {
-			plop.PodUid = ""
-			plopsWithoutPodUids++
-		}
-	}
-
-	// Add the PLOPs
-	suite.addTooMany(plopObjects)
-
-	plopCount, err := suite.store.Count(suite.hasReadCtx, search.EmptyQuery())
-	suite.Equal(plopCount, 2*nport*nprocess*npod)
-	suite.NoError(err)
-
-	start := time.Now()
-	prunedCount, err := suite.datastore.RemovePLOPsWithoutPodUID(suite.hasWriteCtx)
-	suite.Equal(int64(plopsWithoutPodUids), prunedCount)
-	duration := time.Since(start)
-	suite.NoError(err)
-	log.Infof("Pruning %d plops took %s", prunedCount, duration)
-	_, err = suite.datastore.RemovePLOPsWithoutPodUID(suite.hasWriteCtx)
-	suite.NoError(err)
-}
-
-func (suite *PLOPDataStoreTestSuite) TestRemovePLOPsWithoutPodUIDScale27K() {
-	nport := 30
-	nprocess := 30
-	npod := 30
-
-	suite.RemovePLOPsWithoutPodUIDScale(nport, nprocess, npod)
-}
-
-func (suite *PLOPDataStoreTestSuite) TestRemovePLOPsWithoutPodUIDScale125K() {
-	nport := 50
-	nprocess := 50
-	npod := 50
-
-	suite.RemovePLOPsWithoutPodUIDScale(nport, nprocess, npod)
-}
-
-func (suite *PLOPDataStoreTestSuite) TestRemovePLOPsWithoutPodUIDScaleRaceCondition() {
-	var mutex sync.RWMutex
-	var wg sync.WaitGroup
-	wg.Add(1)
-
-	running := true
-	plopsWithoutPodUids := 0
-	go func() {
-		defer wg.Done()
-		iterations := 3
-		for range iterations {
-			nport := 30
-			nprocess := 30
-			npod := 30
-			plopObjects := makeRandomPlops(nport, nprocess, npod, fixtureconsts.Deployment1)
-
-			for _, plop := range plopObjects {
-				p := rand.Float32()
-				if p < 0.5 {
-					plop.PodUid = ""
-					plopsWithoutPodUids += 1
-				} else {
-					plop.PodUid = uuid.NewV4().String()
-				}
-			}
-
-			// Add the open PLOPs
-			suite.addTooMany(plopObjects)
-
-			// Close the PLOPs
-			// This is so that UpsertMany will trigger deletes
-			for _, plop := range plopObjects {
-				plop.CloseTimestamp = protoconv.ConvertTimeToTimestamp(time.Now())
-			}
-
-			// Add the closed PLOPs
-			suite.addTooMany(plopObjects)
-		}
-	}()
-
-	totalPrunedCount := 0
-
-	var wgPrune sync.WaitGroup
-	wgPrune.Go(func() {
-		for {
-			mutex.Lock()
-			stop := !running
-			mutex.Unlock()
-
-			if stop {
-				break
-			}
-
-			prunedCount, err := suite.datastore.RemovePLOPsWithoutPodUID(suite.hasWriteCtx)
-			suite.NoError(err)
-			totalPrunedCount += int(prunedCount)
-		}
-	})
-
-	wg.Wait()
-
-	mutex.Lock()
-	running = false
-	mutex.Unlock()
-
-	wgPrune.Wait()
-
-	prunedCount, err := suite.datastore.RemovePLOPsWithoutPodUID(suite.hasWriteCtx)
-	suite.NoError(err)
-	totalPrunedCount += int(prunedCount)
-
-	// Each PLOP is opened and closed. If a PLOP is opened then pruned, then closed,
-	// and pruned again, then it will be pruned twice. If a PLOP is opened, then closed,
-	// and pruned, then it will be pruned once. Therefore the number of rows pruned will
-	// be between the number of PLOPs that don't have poduids that were added and twice
-	// that number.
-	suite.GreaterOrEqual(plopsWithoutPodUids, totalPrunedCount/2)
-	suite.LessOrEqual(plopsWithoutPodUids, totalPrunedCount)
-}
-
-func (suite *PLOPDataStoreTestSuite) TestSortMany() {
-	nport := 50
-	nprocess := 50
-	npod := 50
-
-	plops := makeRandomPlops(nport, nprocess, npod, fixtureconsts.Deployment1)
-	suite.addTooMany(plops)
-
-	suite.addDeployments()
-
-	startTime := time.Now()
-	newPlops, err := suite.datastore.GetProcessListeningOnPort(
-		suite.hasWriteCtx, fixtureconsts.Deployment1)
-	suite.NoError(err)
-	duration := time.Since(startTime)
-
-	fmt.Printf("Fetching %d plops took %s\n", len(newPlops), duration)
-
-}
diff --git a/central/processlisteningonport/datastore/mocks/datastore.go b/central/processlisteningonport/datastore/mocks/datastore.go
index bc71a23f3157e..053977e9f8ed7 100644
--- a/central/processlisteningonport/datastore/mocks/datastore.go
+++ b/central/processlisteningonport/datastore/mocks/datastore.go
@@ -91,33 +91,6 @@ func (mr *MockDataStoreMockRecorder) PruneOrphanedPLOPs(ctx, orphanWindow any) *
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PruneOrphanedPLOPs", reflect.TypeOf((*MockDataStore)(nil).PruneOrphanedPLOPs), ctx, orphanWindow)
 }
 
-// PruneOrphanedPLOPsByProcessIndicators mocks base method.
-func (m *MockDataStore) PruneOrphanedPLOPsByProcessIndicators(ctx context.Context, orphanWindow time.Duration) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "PruneOrphanedPLOPsByProcessIndicators", ctx, orphanWindow)
-}
-
-// PruneOrphanedPLOPsByProcessIndicators indicates an expected call of PruneOrphanedPLOPsByProcessIndicators.
-func (mr *MockDataStoreMockRecorder) PruneOrphanedPLOPsByProcessIndicators(ctx, orphanWindow any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PruneOrphanedPLOPsByProcessIndicators", reflect.TypeOf((*MockDataStore)(nil).PruneOrphanedPLOPsByProcessIndicators), ctx, orphanWindow)
-}
-
-// RemovePLOPsWithoutPodUID mocks base method.
-func (m *MockDataStore) RemovePLOPsWithoutPodUID(ctx context.Context) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RemovePLOPsWithoutPodUID", ctx)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// RemovePLOPsWithoutPodUID indicates an expected call of RemovePLOPsWithoutPodUID.
-func (mr *MockDataStoreMockRecorder) RemovePLOPsWithoutPodUID(ctx any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemovePLOPsWithoutPodUID", reflect.TypeOf((*MockDataStore)(nil).RemovePLOPsWithoutPodUID), ctx)
-}
-
 // RemovePLOPsWithoutProcessIndicatorOrProcessInfo mocks base method.
 func (m *MockDataStore) RemovePLOPsWithoutProcessIndicatorOrProcessInfo(ctx context.Context) (int64, error) {
 	m.ctrl.T.Helper()
@@ -147,20 +120,6 @@ func (mr *MockDataStoreMockRecorder) RemovePlopsByPod(ctx, id any) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemovePlopsByPod", reflect.TypeOf((*MockDataStore)(nil).RemovePlopsByPod), ctx, id)
 }
 
-// RemoveProcessListeningOnPort mocks base method.
-func (m *MockDataStore) RemoveProcessListeningOnPort(ctx context.Context, ids []string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RemoveProcessListeningOnPort", ctx, ids)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// RemoveProcessListeningOnPort indicates an expected call of RemoveProcessListeningOnPort.
-func (mr *MockDataStoreMockRecorder) RemoveProcessListeningOnPort(ctx, ids any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveProcessListeningOnPort", reflect.TypeOf((*MockDataStore)(nil).RemoveProcessListeningOnPort), ctx, ids)
-}
-
 // WalkAll mocks base method.
 func (m *MockDataStore) WalkAll(ctx context.Context, fn datastore.WalkFn) error {
 	m.ctrl.T.Helper()
diff --git a/central/processlisteningonport/datastore/pruning.go b/central/processlisteningonport/datastore/pruning.go
index 1d4da65fcbc26..0b9a484590e9e 100644
--- a/central/processlisteningonport/datastore/pruning.go
+++ b/central/processlisteningonport/datastore/pruning.go
@@ -1,15 +1,6 @@
 package datastore
 
 const (
-	// Explain Analyze indicated that 2 statements for PLOP is faster than one.
-	deleteOrphanedPLOPDeploymentsAndPI = `DELETE FROM listening_endpoints WHERE processindicatorid in (SELECT id from process_indicators pi WHERE NOT EXISTS
-                (SELECT 1 FROM deployments WHERE pi.deploymentid = deployments.Id) AND
-                (signal_time < now() at time zone 'utc' - INTERVAL '%d MINUTES' OR signal_time is NULL))`
-
-	deleteOrphanedPLOPPods = `DELETE FROM listening_endpoints WHERE processindicatorid in (SELECT id from process_indicators pi WHERE NOT EXISTS
-                (SELECT 1 FROM pods WHERE pi.poduid = pods.Id) AND
-                (signal_time < now() at time zone 'utc' - INTERVAL '%d MINUTES' OR signal_time is NULL))`
-
 	// Unfortunately if a listening endpoint is marked as being open there is no indication of how old it is.
 	// This leads to a possible race condition where a listening endpoint reaches the database before the deployment,
 	// and the pruning job happens to run before the deployment information arrives in the database.
@@ -31,17 +22,4 @@ const (
 	// if the serialized data has process information. PLOPs without process information are then deleted.
 	getPotentiallyOrphanedPLOPs = `SELECT plop.serialized FROM listening_endpoints plop where NOT EXISTS
 			(select 1 FROM process_indicators proc where plop.processindicatorid = proc.id)`
-
-	// This is used to make pagination more efficient compared to using offset. The ids obtained using this query are used for deleting
-	// PLOPs without poduids in batches. See the query below this query.
-	getLastIdFromPage = `WITH tmp as (
-				SELECT id FROM listening_endpoints WHERE id > '%s' ORDER BY id LIMIT %d
-			)
-			SELECT id FROM tmp ORDER BY id DESC LIMIT 1`
-
-	// Deletes PLOPs without poduids in batches according to id, which is more efficient than using offset.
-	// It is possible that new rows may be inserted between the starting and ending ids, after the two ids
-	// are obtained. Meaning that the number of rows in the page may be different than what is expected for
-	// the page. This should not cause a problem.
-	deletePLOPsWithoutPoduidInPage = "DELETE FROM listening_endpoints WHERE poduid is null AND id >= '%s' AND id <= '%s'"
 )
diff --git a/central/pruning/image_pruning_bench_test.go b/central/pruning/image_pruning_bench_test.go
index 250053c98a4e2..7e18bdd665524 100644
--- a/central/pruning/image_pruning_bench_test.go
+++ b/central/pruning/image_pruning_bench_test.go
@@ -90,7 +90,7 @@ func setupBenchmarkTest(b *testing.B, pool postgres.DB) (
 	gc := newGarbageCollector(nil, nil, nil, imagesV2, nil, deployments, pods,
 		nil, nil, nil, mockConfigDS, nil,
 		nil, nil, nil, nil, nil, nil, nil,
-		nil, nil, nil).(*garbageCollectorImpl)
+		nil, nil, nil, nil).(*garbageCollectorImpl)
 	gc.postgres = pool
 
 	return imagesV2, deployments, pods, gc
diff --git a/central/pruning/pruning.go b/central/pruning/pruning.go
index 61e6b8e34ebdb..a1b82548091de 100644
--- a/central/pruning/pruning.go
+++ b/central/pruning/pruning.go
@@ -33,6 +33,7 @@ import (
 	roleDataStore "github.com/stackrox/rox/central/role/datastore"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
 	vulnReqDataStore "github.com/stackrox/rox/central/vulnmgmt/vulnerabilityrequest/datastore"
+	watchedImageDatastore "github.com/stackrox/rox/central/watchedimage/datastore"
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/concurrency"
@@ -40,6 +41,7 @@ import (
 	"github.com/stackrox/rox/pkg/dblock"
 	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/features"
+	imageUtils "github.com/stackrox/rox/pkg/images/utils"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/maputil"
 	pgPkg "github.com/stackrox/rox/pkg/postgres"
@@ -59,8 +61,7 @@ const (
 	logImbueGCFreq     = 24 * time.Hour
 	logImbueWindow     = 24 * 7 * time.Hour
 
-	alertQueryTimeout    = 10 * time.Minute
-	alertDeleteBatchSize = 5000
+	alertQueryTimeout = 10 * time.Minute
 
 	flowsSemaphoreWeight = 5
 
@@ -72,12 +73,13 @@ const (
 )
 
 var (
-	log                       = logging.LoggerForModule()
-	pruningCtx                = sac.WithAllAccess(context.Background())
-	lastClusterPruneTime      time.Time
-	lastLogImbuePruneTime     time.Time
-	pruningTimeout            = env.PostgresDefaultPruningStatementTimeout.DurationSetting()
-	prunedPLOPsWithoutPodUIDs = false
+	log                   = logging.LoggerForModule()
+	pruningCtx            = sac.WithAllAccess(context.Background())
+	lastClusterPruneTime  time.Time
+	lastLogImbuePruneTime time.Time
+	lastV1ImagePruneTime  time.Time
+	lastPrunedV1ImageID   string
+	pruningTimeout        = env.PostgresDefaultPruningStatementTimeout.DurationSetting()
 
 	pruneInterval = env.PruneInterval.DurationSetting()
 	orphanWindow  = env.PruneOrphanedWindow.DurationSetting()
@@ -127,6 +129,7 @@ func newGarbageCollector(alerts alertDatastore.DataStore,
 	blobStore blobDatastore.Datastore,
 	nodeCVEStore nodeCVEDS.DataStore,
 	roleStore roleDataStore.DataStore,
+	watchedImages watchedImageDatastore.DataStore,
 ) GarbageCollector {
 	return &garbageCollectorImpl{
 		alerts:          alerts,
@@ -153,6 +156,7 @@ func newGarbageCollector(alerts alertDatastore.DataStore,
 		blobStore:       blobStore,
 		nodeCVEStore:    nodeCVEStore,
 		roleStore:       roleStore,
+		watchedImages:   watchedImages,
 	}
 }
 
@@ -182,6 +186,7 @@ type garbageCollectorImpl struct {
 	blobStore       blobDatastore.Datastore
 	nodeCVEStore    nodeCVEDS.DataStore
 	roleStore       roleDataStore.DataStore
+	watchedImages   watchedImageDatastore.DataStore
 }
 
 func (g *garbageCollectorImpl) Start() {
@@ -229,6 +234,9 @@ func (g *garbageCollectorImpl) pruneBasedOnConfig() {
 	if env.OrphanedCVEsKeepAlive.BooleanSetting() {
 		g.pruneOrphanedNodeCVEs()
 	}
+	if features.FlattenImageData.Enabled() && env.PruneV1Images.BooleanSetting() {
+		g.pruneImageV1s()
+	}
 
 	log.Info("[Pruning] Finished garbage collection cycle")
 }
@@ -238,6 +246,7 @@ func (g *garbageCollectorImpl) runGC() {
 
 	lastClusterPruneTime = time.Now().Add(-24 * time.Hour)
 	lastLogImbuePruneTime = time.Now().Add(-24 * time.Hour)
+	lastV1ImagePruneTime = time.Now().Add(-env.V1ImagePruneInterval.DurationSetting())
 	g.pruneBasedOnConfig()
 
 	t := time.NewTicker(pruneInterval)
@@ -251,6 +260,212 @@ func (g *garbageCollectorImpl) runGC() {
 	}
 }
 
+func (g *garbageCollectorImpl) pruneImageV1s() {
+	if time.Since(lastV1ImagePruneTime) < env.V1ImagePruneInterval.DurationSetting() {
+		return
+	}
+	defer func() { lastV1ImagePruneTime = time.Now() }()
+	defer metrics.SetPruningDuration(time.Now(), "V1Images")
+
+	log.Info("[Pruning] Pruning V1 images with V2 twins")
+	g.pruneImageV1Batch()
+}
+
+// pruneImageV1Batch prunes V1 images from the old images table whose CVE data
+// has been migrated to V2.
+func (g *garbageCollectorImpl) pruneImageV1Batch() {
+	// Algorithm:
+	// 1. Fetch a batch of V1 images ordered by SHA, using cursor-based pagination.
+	// 2. Delete images with 0 CVEs (no scan data to preserve).
+	// 3. For images with CVEs, look up V2 twins from deployment containers;
+	//    for watched (undeployed) images, generate V2 IDs from watched names.
+	// 4. Delete undeployed, unwatched images (no V2 twin to check).
+	// 5. Delete images whose V2 twins are all enriched (have >0 CVEs).
+	//
+	// We check V2 twin enrichment rather than per-CVE migration because reprocessing
+	// already replaces the full scan — a partial scan loses first-discovered timestamps
+	// regardless of image model, so this doesn't make things worse.
+	batchSize := env.V1ImagePruneBatchSize.IntegerSetting()
+
+	sortOpt := search.NewSortOption(search.ImageSHA)
+	// Cursor-based pagination: fetch images with SHA > last processed SHA.
+	if lastPrunedV1ImageID != "" {
+		sortOpt = sortOpt.SearchAfter(lastPrunedV1ImageID)
+	}
+	q := search.NewQueryBuilder().
+		WithPagination(
+			search.NewPagination().
+				AddSortOption(sortOpt).
+				Limit(int32(batchSize)),
+		).ProtoQuery()
+
+	// Fetch a batch of V1 images
+	var v1Images []*storage.Image
+	err := g.images.WalkMetadataByQuery(pruningCtx, q, func(img *storage.Image) error {
+		v1Images = append(v1Images, img)
+		return nil
+	})
+	if err != nil {
+		log.Errorf("[Pruning] Error fetching V1 images: %v", err)
+		return
+	}
+	if len(v1Images) == 0 {
+		lastPrunedV1ImageID = ""
+		return
+	}
+
+	deleteIDs := g.filterV1ImageIDsToPrune(v1Images)
+
+	if len(deleteIDs) > 0 {
+		if err := g.images.DeleteImages(pruningCtx, deleteIDs...); err != nil {
+			log.Errorf("[Pruning] Error deleting V1 images: %v", err)
+			return
+		}
+		log.Infof("[Pruning] Deleted %d V1 images", len(deleteIDs))
+	}
+
+	if len(v1Images) < batchSize {
+		lastPrunedV1ImageID = ""
+	} else {
+		lastPrunedV1ImageID = v1Images[len(v1Images)-1].GetId()
+	}
+}
+
+func (g *garbageCollectorImpl) filterV1ImageIDsToPrune(v1Images []*storage.Image) []string {
+	var deleteIDs []string
+	var v1ImagesWithCVEs []*storage.Image
+
+	for _, img := range v1Images {
+		// V1 images with 0 CVEs have no scan data worth preserving, safe to delete.
+		if img.GetCves() == 0 {
+			deleteIDs = append(deleteIDs, img.GetId())
+		} else {
+			// V1 images with CVEs need to be checked against V2 twins. If all V2 twins have been enriched, we can delete the V1 image.
+			v1ImagesWithCVEs = append(v1ImagesWithCVEs, img)
+		}
+	}
+
+	if len(v1ImagesWithCVEs) == 0 {
+		return deleteIDs
+	}
+
+	var v1Digests []string
+	for _, img := range v1ImagesWithCVEs {
+		v1Digests = append(v1Digests, img.GetId())
+	}
+
+	// Image V2 twin IDs for the V1 image digests
+	digestToV2IDs, err := g.deployments.GetV2ImageIDsForDigests(pruningCtx, v1Digests)
+	if err != nil {
+		log.Errorf("[Pruning] Error fetching V2 image IDs for digests: %v", err)
+		return deleteIDs
+	}
+
+	watchedNames, err := g.getWatchedNameSet()
+	if err != nil {
+		log.Errorf("[Pruning] Error fetching watched images: %v", err)
+		return deleteIDs
+	}
+
+	for _, img := range v1ImagesWithCVEs {
+		digest := img.GetId()
+		v2IDs := digestToV2IDs[digest]
+
+		if len(v2IDs) == 0 {
+			// V2 twins of a digest can also be generated from watched images. So check if the image name is watched.
+			watchedV2IDs := g.watchedV2IDsForImage(img, watchedNames)
+			if len(watchedV2IDs) == 0 {
+				deleteIDs = append(deleteIDs, digest)
+				continue
+			}
+			digestToV2IDs[digest] = watchedV2IDs
+		}
+	}
+
+	// Get Image V2 twins from the IDs gathered above.
+	v2ImageMap := g.buildV2ImageMap(digestToV2IDs)
+	if v2ImageMap == nil {
+		return deleteIDs
+	}
+
+	for _, img := range v1ImagesWithCVEs {
+		digest := img.GetId()
+		v2IDs := digestToV2IDs[digest]
+		if len(v2IDs) == 0 {
+			continue
+		}
+		// If all V2 twins of a v1 image are enriched, we can delete the v1 image.
+		if g.allV2TwinsEnriched(v2IDs, v2ImageMap) {
+			deleteIDs = append(deleteIDs, digest)
+		}
+	}
+
+	return deleteIDs
+}
+
+func (g *garbageCollectorImpl) getWatchedNameSet() (set.StringSet, error) {
+	if g.watchedImages == nil {
+		return set.NewStringSet(), nil
+	}
+	watched, err := g.watchedImages.GetAllWatchedImages(pruningCtx)
+	if err != nil {
+		return nil, err
+	}
+	names := set.NewStringSet()
+	for _, w := range watched {
+		names.Add(w.GetName())
+	}
+	return names, nil
+}
+
+func (g *garbageCollectorImpl) watchedV2IDsForImage(img *storage.Image, watchedNames set.StringSet) []string {
+	var v2IDs []string
+	for _, name := range img.GetNames() {
+		if watchedNames.Contains(name.GetFullName()) {
+			v2IDs = append(v2IDs, imageUtils.NewImageV2ID(name, img.GetId()))
+		}
+	}
+	return v2IDs
+}
+
+func (g *garbageCollectorImpl) buildV2ImageMap(digestToV2IDs map[string][]string) map[string]*storage.ImageV2 {
+	var allV2IDs []string
+	for _, v2IDs := range digestToV2IDs {
+		allV2IDs = append(allV2IDs, v2IDs...)
+	}
+	if len(allV2IDs) == 0 {
+		return make(map[string]*storage.ImageV2)
+	}
+
+	v2Images, err := g.imagesV2.GetManyImageMetadata(pruningCtx, allV2IDs)
+	if err != nil {
+		log.Errorf("[Pruning] Error fetching V2 image metadata: %v", err)
+		return nil
+	}
+
+	v2Map := make(map[string]*storage.ImageV2, len(v2Images))
+	for _, img := range v2Images {
+		v2Map[img.GetId()] = img
+	}
+	return v2Map
+}
+
+// allV2TwinsEnriched returns true only if every V2 twin exists and has CVEs.
+// A V2 twin with 0 CVEs (remember that corresponging V1 image has CVEs) indicates it may not have been enriched yet.
+func (g *garbageCollectorImpl) allV2TwinsEnriched(v2IDs []string, v2ImageMap map[string]*storage.ImageV2) bool {
+	for _, v2ID := range v2IDs {
+		v2Img, exists := v2ImageMap[v2ID]
+		// It is enough to just check if the V2 twin has any CVEs.
+		// We don't check per-CVE migration because reprocessing already replaces the full
+		// scan result — a partial scan loses first-discovered timestamps regardless of
+		// image model, so this doesn't make things worse than they already are.
+		if !exists || v2Img.GetScanStats().GetCveCount() == 0 {
+			return false
+		}
+	}
+	return true
+}
+
 // Remove vulnerability requests that have expired and past the retention period.
 func (g *garbageCollectorImpl) removeExpiredVulnRequests() {
 	defer metrics.SetPruningDuration(time.Now(), "VulnRequests")
@@ -298,6 +513,30 @@ func (g *garbageCollectorImpl) removeOrphanedPods() {
 	}
 }
 
+// Remove deployments whose cluster has been deleted: fire-and-forget cluster-deletion cleanup can orphan them. No orphan window needed - cluster deletion is a hard delete that
+// never re-adopts its deployments.
+func (g *garbageCollectorImpl) removeOrphanedDeployments() {
+	defer metrics.SetPruningDuration(time.Now(), "Deployments")
+	deploymentsToRemove, err := postgres.GetOrphanedDeploymentIDs(pruningCtx, g.postgres)
+	if err != nil {
+		log.Errorf("Error finding orphaned deployments: %v", err)
+		return
+	}
+
+	if len(deploymentsToRemove) == 0 {
+		log.Info("[Pruning] Found no orphaned deployments...")
+		return
+	}
+	log.Infof("[Pruning] Found %d orphaned deployments (from formerly deleted clusters). Deleting...",
+		len(deploymentsToRemove))
+
+	for _, d := range deploymentsToRemove {
+		if err := g.deployments.RemoveDeployment(pruningCtx, d.ClusterID, d.ID); err != nil {
+			log.Errorf("Failed to remove deployment with id %s: %v", d.ID, err)
+		}
+	}
+}
+
 // Remove nodes where the cluster has been deleted.
 func (g *garbageCollectorImpl) removeOrphanedNodes() {
 	defer metrics.SetPruningDuration(time.Now(), "Nodes")
@@ -371,6 +610,10 @@ func (g *garbageCollectorImpl) removeOrphanedResources() {
 	}
 	clusterIDSet := set.NewFrozenStringSet(clusterIDs...)
 
+	// Before the deploymentSet snapshot and alert/process/risk sweeps so they observe the
+	// deletions this cycle. Child rows (deployments_containers, etc.) cascade.
+	g.removeOrphanedDeployments()
+
 	deploymentIDs, err := g.deployments.GetDeploymentIDs(pruningCtx)
 	if err != nil {
 		log.Error(errors.Wrap(err, "unable to fetch deployment IDs in pruning"))
@@ -426,9 +669,6 @@ func clusterIDsToNegationQuery(clusterIDSet set.FrozenStringSet) *v1.Query {
 
 func (g *garbageCollectorImpl) removeOrphanedProcesses() {
 	defer metrics.SetPruningDuration(time.Now(), "Processes")
-	g.plops.PruneOrphanedPLOPsByProcessIndicators(pruningCtx, orphanWindow)
-
-	log.Info("[PLOP pruning by processes] Pruning of orphaned PLOPs by processes complete")
 
 	// Prune processes in chunks.  First get the ones orphaned by deployments and then go back and
 	// do the same for those orphaned by pod
@@ -545,15 +785,6 @@ func (g *garbageCollectorImpl) removeOrphanedPLOPs() {
 		log.Errorf("error removing PLOPs with no matching process indicator or process information: %v", err)
 	}
 	log.Infof("[PLOP pruning] Pruning of %d orphaned PLOPs with no matching process indicator or process information complete", prunedCount)
-
-	// Only run once since we don't expect any new PLOPs without poduids.
-	if !prunedPLOPsWithoutPodUIDs {
-		prunedCount, err = g.plops.RemovePLOPsWithoutPodUID(pruningCtx)
-		if err != nil {
-			log.Errorf("error removing PLOPs without poduid: %v", err)
-		}
-		log.Infof("[PLOP pruning] Prunned %d orphaned PLOPs with no poduid", prunedCount)
-	}
 }
 
 func (g *garbageCollectorImpl) removeExpiredAdministrationEvents(config *storage.PrivateConfig) {
diff --git a/central/pruning/pruning_test.go b/central/pruning/pruning_test.go
index 4d583e3d31e44..7810806dee076 100644
--- a/central/pruning/pruning_test.go
+++ b/central/pruning/pruning_test.go
@@ -56,6 +56,7 @@ import (
 	connectionMocks "github.com/stackrox/rox/central/sensor/service/connection/mocks"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
 	serviceAccountMocks "github.com/stackrox/rox/central/serviceaccount/datastore/mocks"
+	watchedImageDatastore "github.com/stackrox/rox/central/watchedimage/datastore"
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/alert/convert"
@@ -420,7 +421,9 @@ func (s *PruningTestSuite) generateClusterDataStructures() (configDatastore.Data
 		ranking.NewRanker(),
 		networkBaselineMgr,
 		compliancePruner,
-		clusterInitStore)
+		clusterInitStore,
+		nil,
+		nil)
 	require.NoError(s.T(), err)
 
 	return mockConfigDatastore, deployments, clusterDataStore
@@ -577,7 +580,7 @@ func (s *PruningTestSuite) TestImagePruning() {
 			gc := newGarbageCollector(alerts, nodes, images, imagesV2, nil, deployments, pods,
 				nil, nil, nil, config, nil,
 				nil, nil, nil, nil, nil, nil, nil,
-				nil, nil, nil).(*garbageCollectorImpl)
+				nil, nil, nil, nil).(*garbageCollectorImpl)
 			gc.postgres = s.pool
 
 			// Add images, deployments, and pods into the datastores
@@ -603,10 +606,8 @@ func (s *PruningTestSuite) TestImagePruning() {
 
 			privateConfig, err := config.GetPrivateConfig(ctx)
 			require.NoError(t, err, "failed to get config")
-			// Garbage collect all of the images
 			gc.collectImages(privateConfig)
 
-			// Grab the  actual remaining images and make sure they match the images expected to be remaining
 			if features.FlattenImageData.Enabled() {
 				remainingImages, err := imagesV2.SearchRawImages(ctx, search.EmptyQuery())
 				require.NoError(t, err)
@@ -804,7 +805,7 @@ func (s *PruningTestSuite) TestImagePruningSameDigestDifferentName() {
 			gc := newGarbageCollector(nil, nil, nil, imagesV2, nil, deployments, pods,
 				nil, nil, nil, config, nil,
 				nil, nil, nil, nil, nil, nil, nil,
-				nil, nil, nil).(*garbageCollectorImpl)
+				nil, nil, nil, nil).(*garbageCollectorImpl)
 			gc.postgres = s.pool
 
 			for _, dep := range c.deployments {
@@ -1047,7 +1048,7 @@ func (s *PruningTestSuite) TestClusterPruning() {
 
 			gc := newGarbageCollector(nil, nil, nil, nil, clusterDS, deploymentsDS, nil,
 				nil, nil, nil, nil, nil,
-				nil, nil, nil, nil, nil, nil,
+				nil, nil, nil, nil, nil, nil, nil,
 				nil, nil, nil, nil).(*garbageCollectorImpl)
 			gc.collectClusters(c.config)
 
@@ -1174,7 +1175,7 @@ func (s *PruningTestSuite) TestClusterPruningCentralCheck() {
 
 			gc := newGarbageCollector(nil, nil, nil, nil, clusterDS, deploymentsDS, nil,
 				nil, nil, nil, nil, nil,
-				nil, nil, nil, nil, nil, nil,
+				nil, nil, nil, nil, nil, nil, nil,
 				nil, nil, nil, nil).(*garbageCollectorImpl)
 			gc.collectClusters(getCluserRetentionConfig(60, 90, 72))
 
@@ -1352,7 +1353,7 @@ func (s *PruningTestSuite) TestAlertPruning() {
 
 			gc := newGarbageCollector(alerts, nodes, images, imagesV2, nil, deployments, nil,
 				nil, nil, nil, config, nil,
-				nil, nil, nil, nil, nil, nil,
+				nil, nil, nil, nil, nil, nil, nil,
 				nil, nil, nil, nil).(*garbageCollectorImpl)
 
 			// Add alerts into the datastores
@@ -1682,30 +1683,6 @@ func (s *PruningTestSuite) TestRemoveOrphanedPLOPs() {
 			pods:              set.NewFrozenStringSet(fixtureconsts.PodUID1),
 			expectedDeletions: []string{},
 		},
-		{
-			name: "Plop does not have a poduid so it is removed",
-			initialPlops: []*storage.ProcessListeningOnPortStorage{
-				{
-					Id:                 plopID1,
-					Port:               1234,
-					Protocol:           storage.L4Protocol_L4_PROTOCOL_TCP,
-					CloseTimestamp:     nil,
-					ProcessIndicatorId: fixtureconsts.ProcessIndicatorID1,
-					Closed:             false,
-					Process: &storage.ProcessIndicatorUniqueKey{
-						PodId:               fixtureconsts.PodUID1,
-						ContainerName:       "test_container1",
-						ProcessName:         "test_process1",
-						ProcessArgs:         "test_arguments1",
-						ProcessExecFilePath: "test_path1",
-					},
-					DeploymentId: fixtureconsts.Deployment1,
-				},
-			},
-			deployments:       set.NewFrozenStringSet(fixtureconsts.Deployment1),
-			pods:              set.NewFrozenStringSet(fixtureconsts.PodUID1),
-			expectedDeletions: []string{plopID1},
-		},
 	}
 
 	for _, c := range cases {
@@ -1717,7 +1694,6 @@ func (s *PruningTestSuite) TestRemoveOrphanedPLOPs() {
 				postgres: db,
 				plops:    plopDS,
 			}
-			prunedPLOPsWithoutPodUIDs = false
 
 			// Populate some actual data so the query returns what needs deleted
 			deploymentDS, err := deploymentDatastore.GetTestPostgresDataStore(t, db.DB)
@@ -2405,6 +2381,94 @@ func (s *PruningTestSuite) TestRemoveOrphanedPods() {
 	s.Equal(updatedCount, podCount-cluster2PodCount)
 }
 
+func (s *PruningTestSuite) TestRemoveOrphanedDeployments() {
+	ctrl := gomock.NewController(s.T())
+
+	mockRisk := riskDatastoreMocks.NewMockDataStore(ctrl)
+	mockRisk.EXPECT().RemoveRisk(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes().Return(nil)
+	mockBaseline := processBaselineDatastoreMocks.NewMockDataStore(ctrl)
+	mockBaseline.EXPECT().RemoveProcessBaselinesByDeployment(gomock.Any(), gomock.Any()).AnyTimes().Return(nil)
+	mockFilter := filterMocks.NewMockFilter(ctrl)
+	mockFilter.EXPECT().Delete(gomock.Any()).AnyTimes()
+
+	flowStore := networkFlowDatastoreMocks.NewMockFlowDataStore(ctrl)
+	flowStore.EXPECT().RemoveFlowsForDeployment(gomock.Any(), gomock.Any()).AnyTimes().Return(nil)
+	flows := networkFlowDatastoreMocks.NewMockClusterDataStore(ctrl)
+	flows.EXPECT().GetFlowStore(gomock.Any(), gomock.Any()).AnyTimes().Return(flowStore, nil)
+
+	deployments, err := deploymentDatastore.New(s.pool, nil, nil, mockBaseline, flows, mockRisk, nil, mockFilter,
+		ranking.NewRanker(), ranking.NewRanker(), ranking.NewRanker(),
+		platformmatcher.GetTestPlatformMatcherWithDefaultPlatformComponentConfig(ctrl))
+	s.Require().NoError(err)
+
+	_, _, clusterDS := s.generateClusterDataStructures()
+	liveClusterID, err := clusterDS.AddCluster(s.ctx, &storage.Cluster{Name: "testOrphanDeploymentCluster", MainImage: "docker.io/stackrox/rox:latest"})
+	s.Require().NoError(err)
+
+	// Deployment on a live (healthy) cluster - must survive the sweep.
+	liveDeployment := newDeployment("id1")
+	liveDeployment.Id = fixtureconsts.Deployment2
+	liveDeployment.ClusterId = liveClusterID
+	s.Require().NoError(deployments.UpsertDeployment(s.ctx, liveDeployment))
+
+	// Clusters still in the DB but unhealthy/disconnected must keep their deployments -
+	// the sweep keys on the cluster row existing, not on health.
+	unhealthyClusters := []struct {
+		name         string
+		deploymentID string
+		status       storage.ClusterHealthStatus_HealthStatusLabel
+	}{
+		{"testUnhealthyDeploymentCluster", fixtureconsts.Deployment3, storage.ClusterHealthStatus_UNHEALTHY},
+		{"testDisconnectedDeploymentCluster", fixtureconsts.Deployment4, storage.ClusterHealthStatus_UNAVAILABLE},
+	}
+	var unhealthyDeployments []*storage.Deployment
+	for _, c := range unhealthyClusters {
+		clusterID, err := clusterDS.AddCluster(s.ctx, &storage.Cluster{Name: c.name, MainImage: "docker.io/stackrox/rox:latest"})
+		s.Require().NoError(err)
+		s.Require().NoError(clusterDS.UpdateClusterHealth(s.ctx, clusterID,
+			&storage.ClusterHealthStatus{SensorHealthStatus: c.status}))
+
+		dep := newDeployment("img")
+		dep.Id = c.deploymentID
+		dep.ClusterId = clusterID
+		s.Require().NoError(deployments.UpsertDeployment(s.ctx, dep))
+		unhealthyDeployments = append(unhealthyDeployments, dep)
+	}
+
+	// Deployment whose clusterid has no cluster row - orphaned.
+	orphanedDeployment := newDeployment("id2")
+	orphanedDeployment.ClusterId = fixtureconsts.Cluster1
+	s.Require().NoError(deployments.UpsertDeployment(s.ctx, orphanedDeployment))
+
+	gci := &garbageCollectorImpl{
+		deployments: deployments,
+		postgres:    s.pool,
+	}
+
+	gci.removeOrphanedDeployments()
+
+	_, exists, err := deployments.GetDeployment(s.ctx, orphanedDeployment.GetId())
+	s.Require().NoError(err)
+	s.False(exists, "orphaned deployment should be pruned")
+
+	_, exists, err = deployments.GetDeployment(s.ctx, liveDeployment.GetId())
+	s.Require().NoError(err)
+	s.True(exists, "deployment of a live cluster must not be pruned")
+
+	for _, dep := range unhealthyDeployments {
+		_, exists, err = deployments.GetDeployment(s.ctx, dep.GetId())
+		s.Require().NoError(err)
+		s.True(exists, "deployment of a cluster still in the DB must not be pruned")
+	}
+
+	// Cascaded deletion of deployments_containers rows is what makes the referenced
+	// image prunable - assert none remain.
+	var containerCount int
+	err = s.pool.QueryRow(s.ctx, "SELECT count(*) FROM deployments_containers WHERE deployments_id = $1", orphanedDeployment.GetId()).Scan(&containerCount)
+	s.Require().NoError(err)
+	s.Zero(containerCount)
+}
+
 func (s *PruningTestSuite) TestRemoveOrphanedNodes() {
 	_, _, clusterDS := s.generateClusterDataStructures()
 
@@ -2918,3 +2982,204 @@ func resourceWithAccess(access storage.Access, resource permissions.ResourceMeta
 		Resource: resource,
 	}
 }
+
+func (s *PruningTestSuite) generateImageV1PruningDataStructures() (imageDatastore.DataStore, imageV2Datastore.DataStore, deploymentDatastore.DataStore, watchedImageDatastore.DataStore) {
+	ctrl := gomock.NewController(s.T())
+
+	mockRiskDatastore := riskDatastoreMocks.NewMockDataStore(ctrl)
+	mockRiskDatastore.EXPECT().RemoveRisk(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+	mockFilter := filterMocks.NewMockFilter(ctrl)
+	mockFilter.EXPECT().UpdateByPod(gomock.Any()).AnyTimes()
+	mockFilter.EXPECT().DeleteByPod(gomock.Any()).AnyTimes()
+	mockFilter.EXPECT().Delete(gomock.Any()).AnyTimes()
+
+	mockBaselineDataStore := processBaselineDatastoreMocks.NewMockDataStore(ctrl)
+	mockBaselineDataStore.EXPECT().RemoveProcessBaselinesByDeployment(gomock.Any(), gomock.Any()).AnyTimes().Return(nil)
+
+	mockNetworkFlows := networkFlowDatastoreMocks.NewMockClusterDataStore(ctrl)
+	mockFlowStore := networkFlowDatastoreMocks.NewMockFlowDataStore(ctrl)
+	mockNetworkFlows.EXPECT().GetFlowStore(gomock.Any(), gomock.Any()).AnyTimes().Return(mockFlowStore, nil)
+	mockFlowStore.EXPECT().RemoveFlowsForDeployment(gomock.Any(), gomock.Any()).AnyTimes().Return(nil)
+
+	images := imageDatastore.NewWithPostgres(
+		imagePostgresV2.New(s.pool, true, concurrency.NewKeyFence()),
+		mockRiskDatastore,
+		ranking.ImageRanker(),
+		ranking.ComponentRanker(),
+	)
+	imagesV2 := imageV2Datastore.NewWithPostgres(
+		imageV2Postgres.New(s.pool, true, concurrency.NewKeyFence()),
+		mockRiskDatastore,
+		ranking.ImageRanker(),
+		ranking.ComponentRanker(),
+	)
+	deployments, err := deploymentDatastore.New(s.pool, nil, nil, mockBaselineDataStore, mockNetworkFlows, mockRiskDatastore, nil, mockFilter,
+		ranking.NewRanker(), ranking.NewRanker(), ranking.NewRanker(),
+		platformmatcher.GetTestPlatformMatcherWithDefaultPlatformComponentConfig(ctrl))
+	s.Require().NoError(err)
+
+	watchedImages := watchedImageDatastore.GetTestPostgresDataStore(s.T(), s.pool)
+
+	return images, imagesV2, deployments, watchedImages
+}
+
+func newV1ImageWithCVEs(id string, cves int32) *storage.Image {
+	digest := types.NewDigest(id).Digest()
+	name := &storage.ImageName{FullName: "test/" + id + ":latest"}
+	return &storage.Image{
+		Id:            digest,
+		LastUpdated:   protoconv.ConvertTimeToTimestamp(time.Now()),
+		Name:          name,
+		Names:         []*storage.ImageName{name},
+		SetCves:       &storage.Image_Cves{Cves: cves},
+		SetComponents: &storage.Image_Components{Components: cves},
+	}
+}
+
+func (s *PruningTestSuite) TestPruneImageV1Batch() {
+	if !features.FlattenImageData.Enabled() {
+		s.T().Skip("V1 image pruning only runs when FlattenImageData is enabled")
+	}
+	if !env.PruneV1Images.BooleanSetting() {
+		s.T().Skip("V1 image pruning is disabled")
+	}
+
+	ctx := sac.WithAllAccess(context.Background())
+	images, imagesV2, depDS, watchedDS := s.generateImageV1PruningDataStructures()
+
+	// Create V1 images covering all pruning scenarios.
+	image1 := newV1ImageWithCVEs("img-no-cves", 0)
+	image2 := newV1ImageWithCVEs("img-enriched", 5)
+	image3 := newV1ImageWithCVEs("img-not-enriched", 3)
+	image4 := newV1ImageWithCVEs("img-no-twin", 2)
+	image5 := newV1ImageWithCVEs("img-missing-v2", 4)
+	image6 := newV1ImageWithCVEs("img-watched-enriched", 6)
+	image7 := newV1ImageWithCVEs("img-watched-not-enriched", 7)
+	image8 := newV1ImageWithCVEs("img-watched-no-v2", 8)
+
+	v1Images := []*storage.Image{image1, image2, image3, image4, image5, image6, image7, image8}
+	for _, img := range v1Images {
+		s.Require().NoError(images.UpsertImage(ctx, img))
+	}
+
+	// Create V2 images: one enriched, one not enriched.
+	v2IDImg2 := utils.NewImageV2ID(image2.GetName(), image2.GetId())
+	v2IDImg3 := utils.NewImageV2ID(image3.GetName(), image3.GetId())
+	v2IDImg5 := utils.NewImageV2ID(image5.GetName(), image5.GetId())
+	v2IDImg6 := utils.NewImageV2ID(image6.GetName(), image6.GetId())
+	v2IDImg7 := utils.NewImageV2ID(image7.GetName(), image7.GetId())
+
+	s.Require().NoError(imagesV2.UpsertImage(ctx, &storage.ImageV2{
+		Id: v2IDImg2, Digest: image2.GetId(),
+		Name:      image2.GetName(),
+		ScanStats: &storage.ImageV2_ScanStats{CveCount: 5},
+	}))
+	s.Require().NoError(imagesV2.UpsertImage(ctx, &storage.ImageV2{
+		Id: v2IDImg3, Digest: image3.GetId(),
+		Name:      image3.GetName(),
+		ScanStats: &storage.ImageV2_ScanStats{CveCount: 0},
+	}))
+	// Watched image6: V2 twin enriched.
+	s.Require().NoError(imagesV2.UpsertImage(ctx, &storage.ImageV2{
+		Id: v2IDImg6, Digest: image6.GetId(),
+		Name:      image6.GetName(),
+		ScanStats: &storage.ImageV2_ScanStats{CveCount: 6},
+	}))
+	// Watched image7: V2 twin not enriched.
+	s.Require().NoError(imagesV2.UpsertImage(ctx, &storage.ImageV2{
+		Id: v2IDImg7, Digest: image7.GetId(),
+		Name:      image7.GetName(),
+		ScanStats: &storage.ImageV2_ScanStats{CveCount: 0},
+	}))
+
+	// Watch image6, image7, and image8 (none are deployed).
+	s.Require().NoError(watchedDS.UpsertWatchedImage(ctx, image6.GetName().GetFullName()))
+	s.Require().NoError(watchedDS.UpsertWatchedImage(ctx, image7.GetName().GetFullName()))
+	s.Require().NoError(watchedDS.UpsertWatchedImage(ctx, image8.GetName().GetFullName()))
+
+	// Create deployment referencing image2 (enriched), image3 (not enriched), and image5 (missing from images_v2).
+	dep := &storage.Deployment{
+		Id: fixtureconsts.Deployment1,
+		Containers: []*storage.Container{
+			{Image: &storage.ContainerImage{Id: image2.GetId(), IdV2: v2IDImg2, Name: image2.GetName()}},
+			{Image: &storage.ContainerImage{Id: image3.GetId(), IdV2: v2IDImg3, Name: image3.GetName()}},
+			{Image: &storage.ContainerImage{Id: image5.GetId(), IdV2: v2IDImg5, Name: image5.GetName()}},
+		},
+	}
+	s.Require().NoError(depDS.UpsertDeployment(ctx, dep))
+
+	gc := &garbageCollectorImpl{
+		images:        images,
+		imagesV2:      imagesV2,
+		deployments:   depDS,
+		watchedImages: watchedDS,
+		postgres:      s.pool,
+	}
+
+	lastPrunedV1ImageID = ""
+	gc.pruneImageV1Batch()
+
+	remaining, err := images.SearchListImages(ctx, search.EmptyQuery())
+	s.Require().NoError(err)
+
+	var remainingIDs []string
+	for _, img := range remaining {
+		remainingIDs = append(remainingIDs, img.GetId())
+	}
+
+	// image1 (0 CVEs): deleted
+	// image2 (deployed, V2 twin enriched): deleted
+	// image3 (deployed, V2 twin not enriched): kept
+	// image4 (not deployed, not watched): deleted
+	// image5 (deployed, V2 missing from images_v2): kept
+	// image6 (not deployed, watched, V2 twin enriched): deleted
+	// image7 (not deployed, watched, V2 twin not enriched): kept
+	// image8 (not deployed, watched, V2 missing): kept
+	s.Assert().ElementsMatch([]string{image3.GetId(), image5.GetId(), image7.GetId(), image8.GetId()}, remainingIDs)
+
+	// Cleanup
+	_ = images.DeleteImages(ctx, image3.GetId(), image5.GetId(), image7.GetId(), image8.GetId())
+	_ = imagesV2.DeleteImages(ctx, v2IDImg2, v2IDImg3, v2IDImg6, v2IDImg7)
+	_ = depDS.RemoveDeployment(ctx, "", dep.GetId())
+}
+
+func (s *PruningTestSuite) TestPruneImageV1BatchCursor() {
+	if !features.FlattenImageData.Enabled() {
+		s.T().Skip("V1 image pruning only runs when FlattenImageData is enabled")
+	}
+	if !env.PruneV1Images.BooleanSetting() {
+		s.T().Skip("V1 image pruning is disabled")
+	}
+
+	ctx := sac.WithAllAccess(context.Background())
+	images, imagesV2, depDS, watchedDS := s.generateImageV1PruningDataStructures()
+
+	for range 3 {
+		img := newV1ImageWithCVEs(uuid.NewV4().String(), 0)
+		s.Require().NoError(images.UpsertImage(ctx, img))
+	}
+
+	gc := &garbageCollectorImpl{
+		images:        images,
+		imagesV2:      imagesV2,
+		deployments:   depDS,
+		watchedImages: watchedDS,
+		postgres:      s.pool,
+	}
+
+	// With batch size = 2, first batch processes 2, cursor advances.
+	s.T().Setenv("ROX_V1_IMAGE_PRUNE_BATCH_SIZE", "2")
+
+	lastPrunedV1ImageID = ""
+	gc.pruneImageV1Batch()
+	s.Assert().NotEmpty(lastPrunedV1ImageID, "cursor should advance after full batch")
+
+	// Second batch processes remaining 1, cursor resets.
+	gc.pruneImageV1Batch()
+	s.Assert().Empty(lastPrunedV1ImageID, "cursor should reset when batch < batchSize")
+
+	remaining, err := images.SearchListImages(ctx, search.EmptyQuery())
+	s.Require().NoError(err)
+	s.Assert().Empty(remaining, "all 0-CVE images should be pruned")
+}
diff --git a/central/pruning/singleton.go b/central/pruning/singleton.go
index 8200e0c3ccb79..cf2cb4dd6f4f8 100644
--- a/central/pruning/singleton.go
+++ b/central/pruning/singleton.go
@@ -23,6 +23,7 @@ import (
 	roleDataStore "github.com/stackrox/rox/central/role/datastore"
 	serviceAccountDataStore "github.com/stackrox/rox/central/serviceaccount/datastore"
 	vulnReqDataStore "github.com/stackrox/rox/central/vulnmgmt/vulnerabilityrequest/datastore"
+	watchedImageDatastore "github.com/stackrox/rox/central/watchedimage/datastore"
 	"github.com/stackrox/rox/pkg/sync"
 )
 
@@ -56,6 +57,7 @@ func Singleton() GarbageCollector {
 			blobDS.Singleton(),
 			nodeCVEDS.Singleton(),
 			roleDataStore.Singleton(),
+			watchedImageDatastore.Singleton(),
 		)
 	})
 	return gc
diff --git a/central/reports/common/query_builder.go b/central/reports/common/query_builder.go
index 196fadc21457c..cbf2ada69d1c3 100644
--- a/central/reports/common/query_builder.go
+++ b/central/reports/common/query_builder.go
@@ -178,39 +178,9 @@ func (q *queryBuilder) buildEntityScopeQuery() (*v1.Query, error) {
 			fieldLabel == search.NamespaceAnnotation
 
 		if isMapField {
-			mapQueries := make([]*v1.Query, 0, len(rule.GetValues()))
-			for _, rv := range rule.GetValues() {
-				val := rv.GetValue()
-				key, value := splitLabelValue(val)
-				if rv.GetMatchType() == storage.MatchType_REGEX {
-					// For regex match, only apply the r/ prefix to parts that contain
-					// regex metacharacters. Literal parts stay quoted for exact matching.
-					rawParts := strings.SplitN(val, "=", 2)
-					rawValue := ""
-					if len(rawParts) == 2 {
-						rawValue = rawParts[1]
-					}
-					key = mapPartQueryString(rawParts[0])
-					value = mapPartQueryString(rawValue)
-				}
-				mapQueries = append(mapQueries,
-					search.NewQueryBuilder().AddMapQuery(fieldLabel, key, value).ProtoQuery())
-			}
-			conjuncts = append(conjuncts, search.DisjunctionQuery(mapQueries...))
+			conjuncts = append(conjuncts, MapFieldQuery(fieldLabel, rule))
 		} else {
-			var ruleQueries []*v1.Query
-			for _, rv := range rule.GetValues() {
-				val := rv.GetValue()
-				if rv.GetMatchType() == storage.MatchType_REGEX {
-					val = search.RegexPrefix + val
-					ruleQueries = append(ruleQueries,
-						search.NewQueryBuilder().AddStrings(fieldLabel, val).ProtoQuery())
-				} else {
-					ruleQueries = append(ruleQueries,
-						search.NewQueryBuilder().AddExactMatches(fieldLabel, val).ProtoQuery())
-				}
-			}
-			conjuncts = append(conjuncts, search.DisjunctionQuery(ruleQueries...))
+			conjuncts = append(conjuncts, ScalarFieldQuery(fieldLabel, rule))
 		}
 	}
 
@@ -220,6 +190,46 @@ func (q *queryBuilder) buildEntityScopeQuery() (*v1.Query, error) {
 	return search.ConjunctionQuery(conjuncts...), nil
 }
 
+// MapFieldQuery builds a disjunction query for a map-type search field
+// (labels/annotations) from the values in an entity scope rule.
+func MapFieldQuery(fieldLabel search.FieldLabel, rule *storage.EntityScopeRule) *v1.Query {
+	mapQueries := make([]*v1.Query, 0, len(rule.GetValues()))
+	for _, rv := range rule.GetValues() {
+		val := rv.GetValue()
+		key, value := splitLabelValue(val)
+		if rv.GetMatchType() == storage.MatchType_REGEX {
+			rawParts := strings.SplitN(val, "=", 2)
+			rawValue := ""
+			if len(rawParts) == 2 {
+				rawValue = rawParts[1]
+			}
+			key = mapPartQueryString(rawParts[0])
+			value = mapPartQueryString(rawValue)
+		}
+		mapQueries = append(mapQueries,
+			search.NewQueryBuilder().AddMapQuery(fieldLabel, key, value).ProtoQuery())
+	}
+	return search.DisjunctionQuery(mapQueries...)
+}
+
+// ScalarFieldQuery builds a disjunction query for a scalar-type search field
+// (names, IDs) from the values in an entity scope rule.
+func ScalarFieldQuery(fieldLabel search.FieldLabel, rule *storage.EntityScopeRule) *v1.Query {
+	values := rule.GetValues()
+	ruleQueries := make([]*v1.Query, 0, len(values))
+	for _, rv := range values {
+		val := rv.GetValue()
+		if rv.GetMatchType() == storage.MatchType_REGEX {
+			ruleQueries = append(ruleQueries,
+				search.NewQueryBuilder().AddRegexes(fieldLabel, val).ProtoQuery())
+		} else {
+			ruleQueries = append(ruleQueries,
+				search.NewQueryBuilder().AddExactMatches(fieldLabel, val).ProtoQuery())
+		}
+	}
+	return search.DisjunctionQuery(ruleQueries...)
+}
+
 // entityScopeRuleToFieldLabel returns search filter for given entity field pair
 func entityScopeRuleToFieldLabel(rule *storage.EntityScopeRule) (search.FieldLabel, error) {
 	switch rule.GetEntity() {
diff --git a/central/reports/common/query_builder_test.go b/central/reports/common/query_builder_test.go
index a8a8e7946da3f..33124ea2f53be 100644
--- a/central/reports/common/query_builder_test.go
+++ b/central/reports/common/query_builder_test.go
@@ -198,6 +198,48 @@ func assertByDirectComparison(t testing.TB, expected *v1.Query, actual *v1.Query
 	protoassert.Equal(t, expected, actual)
 }
 
+func TestBuildClusterOnlyAccessScopeQuery(t *testing.T) {
+	testCases := map[string]struct {
+		rules     []*storage.SimpleAccessScope_Rules
+		expectedQ *v1.Query
+	}{
+		"nil rules returns empty query": {
+			rules:     nil,
+			expectedQ: search.EmptyQuery(),
+		},
+		"cluster included by name": {
+			rules: []*storage.SimpleAccessScope_Rules{
+				{IncludedClusters: []string{"remote"}},
+			},
+			expectedQ: search.NewQueryBuilder().AddExactMatches(search.ClusterID, clusters[0].GetId()).ProtoQuery(),
+		},
+		"namespace-only rule grants cluster visibility": {
+			rules: []*storage.SimpleAccessScope_Rules{
+				{
+					IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+						{ClusterName: "secured", NamespaceName: "ns2"},
+					},
+				},
+			},
+			expectedQ: search.NewQueryBuilder().AddExactMatches(search.ClusterID, clusters[1].GetId()).ProtoQuery(),
+		},
+		"exclude all rules returns match none": {
+			rules: []*storage.SimpleAccessScope_Rules{
+				{},
+			},
+			expectedQ: getMatchNoneQuery(),
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			result, err := BuildClusterOnlyAccessScopeQuery(tc.rules, clusters, namespaces)
+			assert.NoError(t, err)
+			protoassert.Equal(t, tc.expectedQ, result)
+		})
+	}
+}
+
 func TestBuildEntityScopeQuery(t *testing.T) {
 	testCases := []struct {
 		name          string
diff --git a/central/reports/common/utils.go b/central/reports/common/utils.go
index 8b777b934fffb..ebac8257908a8 100644
--- a/central/reports/common/utils.go
+++ b/central/reports/common/utils.go
@@ -49,6 +49,32 @@ func HasValidResourceScope(scope *storage.ResourceScope) bool {
 	return true
 }
 
+// BuildClusterOnlyAccessScopeQuery builds a v1 query that filters by cluster ID
+// only. Currently nodes from partially included clusters (where only a subset of
+// namespaces are accessible) are visible to users, so the scope is computed with
+// both clusters and namespaces to match that behavior.
+func BuildClusterOnlyAccessScopeQuery(
+	accessScopeRules []*storage.SimpleAccessScope_Rules,
+	clusters []effectiveaccessscope.Cluster,
+	namespaces []effectiveaccessscope.Namespace,
+) (*v1.Query, error) {
+	if accessScopeRules == nil {
+		return search.EmptyQuery(), nil
+	}
+	scopeTree, err := computeScopeTree(accessScopeRules, clusters, namespaces)
+	if err != nil {
+		return nil, err
+	}
+	scopeQuery, err := sac.BuildClusterLevelSACQueryFilter(scopeTree)
+	if err != nil {
+		return nil, err
+	}
+	if scopeQuery == nil {
+		return search.EmptyQuery(), nil
+	}
+	return scopeQuery, nil
+}
+
 // BuildAccessScopeQuery builds v1 query for given access scope rules
 func BuildAccessScopeQuery(
 	accessScopeRules []*storage.SimpleAccessScope_Rules,
@@ -58,6 +84,25 @@ func BuildAccessScopeQuery(
 	if accessScopeRules == nil {
 		return search.EmptyQuery(), nil
 	}
+	scopeTree, err := computeScopeTree(accessScopeRules, clusters, namespaces)
+	if err != nil {
+		return nil, err
+	}
+	scopeQuery, err := sac.BuildClusterNamespaceLevelSACQueryFilter(scopeTree)
+	if err != nil {
+		return nil, err
+	}
+	if scopeQuery == nil {
+		return search.EmptyQuery(), nil
+	}
+	return scopeQuery, nil
+}
+
+func computeScopeTree(
+	accessScopeRules []*storage.SimpleAccessScope_Rules,
+	clusters []effectiveaccessscope.Cluster,
+	namespaces []effectiveaccessscope.Namespace,
+) (*effectiveaccessscope.ScopeTree, error) {
 	var scopeTree *effectiveaccessscope.ScopeTree
 	for _, rules := range accessScopeRules {
 		sct, err := effectiveaccessscope.ComputeEffectiveAccessScope(rules, clusters, namespaces, v1.ComputeEffectiveAccessScopeRequest_MINIMAL)
@@ -70,12 +115,5 @@ func BuildAccessScopeQuery(
 			scopeTree.Merge(sct)
 		}
 	}
-	scopeQuery, err := sac.BuildClusterNamespaceLevelSACQueryFilter(scopeTree)
-	if err != nil {
-		return nil, err
-	}
-	if scopeQuery == nil {
-		return search.EmptyQuery(), nil
-	}
-	return scopeQuery, nil
+	return scopeTree, nil
 }
diff --git a/central/reports/scheduler/v2/mocks/scheduler.go b/central/reports/scheduler/v2/mocks/scheduler.go
index 5aef7d3f80dd5..1b1dbb2e5e93a 100644
--- a/central/reports/scheduler/v2/mocks/scheduler.go
+++ b/central/reports/scheduler/v2/mocks/scheduler.go
@@ -73,6 +73,20 @@ func (mr *MockSchedulerMockRecorder) CancelReportRequest(ctx, reportID any) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CancelReportRequest", reflect.TypeOf((*MockScheduler)(nil).CancelReportRequest), ctx, reportID)
 }
 
+// GetScheduledConfigIDs mocks base method.
+func (m *MockScheduler) GetScheduledConfigIDs() []string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetScheduledConfigIDs")
+	ret0, _ := ret[0].([]string)
+	return ret0
+}
+
+// GetScheduledConfigIDs indicates an expected call of GetScheduledConfigIDs.
+func (mr *MockSchedulerMockRecorder) GetScheduledConfigIDs() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetScheduledConfigIDs", reflect.TypeOf((*MockScheduler)(nil).GetScheduledConfigIDs))
+}
+
 // RemoveReportSchedule mocks base method.
 func (m *MockScheduler) RemoveReportSchedule(reportConfigID string) {
 	m.ctrl.T.Helper()
diff --git a/central/reports/scheduler/v2/reportgenerator/common_helpers.go b/central/reports/scheduler/v2/reportgenerator/common_helpers.go
new file mode 100644
index 0000000000000..5ded30d95a420
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/common_helpers.go
@@ -0,0 +1,74 @@
+package reportgenerator
+
+import (
+	"bytes"
+	"context"
+	"time"
+
+	"github.com/pkg/errors"
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	"github.com/stackrox/rox/central/reports/common"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/notifiers"
+	"github.com/stackrox/rox/pkg/protocompat"
+	"github.com/stackrox/rox/pkg/retry"
+	"github.com/stackrox/rox/pkg/utils"
+)
+
+// RetryableSendReportResults sends report results via the notifier with retry logic.
+func RetryableSendReportResults(ctx context.Context, reportNotifier notifiers.ReportNotifier, mailingList []string,
+	zippedCSVData *bytes.Buffer, emailSubject, emailBody, baseFilename string) error {
+	return retry.WithRetry(func() error {
+		return reportNotifier.ReportNotify(ctx, zippedCSVData, mailingList, emailSubject, emailBody, baseFilename)
+	},
+		retry.OnlyRetryableErrors(),
+		retry.Tries(3),
+		retry.BetweenAttempts(func(previousAttempt int) {
+			wait := time.Duration(previousAttempt * previousAttempt * 100)
+			time.Sleep(wait * time.Millisecond)
+		}),
+	)
+}
+
+// SaveReportData saves zipped CSV report data to blob storage.
+func SaveReportData(ctx context.Context, blobStore blobDS.Datastore, configID, reportID string, data *bytes.Buffer) error {
+	if data == nil {
+		return errors.Errorf("No data found for report config %q and id %q", configID, reportID)
+	}
+	b := &storage.Blob{
+		Name:         common.GetReportBlobPath(configID, reportID),
+		LastUpdated:  protocompat.TimestampNow(),
+		ModifiedTime: protocompat.TimestampNow(),
+		Length:       int64(data.Len()),
+	}
+	return blobStore.Upsert(ctx, b, data)
+}
+
+// UpdateReportStatus updates the run state of a report snapshot.
+func UpdateReportStatus(ctx context.Context, snapshotStore reportSnapshotDS.DataStore, snapshot *storage.ReportSnapshot, status storage.ReportStatus_RunState) error {
+	snapshot.ReportStatus.RunState = status
+	return snapshotStore.UpdateReportSnapshot(ctx, snapshot)
+}
+
+// LogAndUpsertError logs the error and updates the report snapshot status to FAILURE.
+// requestCtx is used to check for user cancellation; statusCtx is used for the DB update
+// (should be an all-access context since requestCtx may be cancelled).
+func LogAndUpsertError(requestCtx, statusCtx context.Context, snapshotStore reportSnapshotDS.DataStore, reportErr error, req *ReportRequest) {
+	if req.ReportSnapshot == nil || req.ReportSnapshot.GetReportStatus() == nil {
+		utils.Should(errors.New("Request does not have non-nil report snapshot with a non-nil report status"))
+		return
+	}
+	if errors.Is(context.Cause(requestCtx), ErrUserCancelled) {
+		log.Infof("Report for config '%s' was cancelled by user", req.ReportSnapshot.GetName())
+		req.ReportSnapshot.ReportStatus.ErrorMsg = ErrUserCancelled.Error()
+	} else if reportErr != nil {
+		log.Errorf("Error while running report for config '%s': %s", req.ReportSnapshot.GetName(), reportErr)
+		req.ReportSnapshot.ReportStatus.ErrorMsg = reportErr.Error()
+	}
+	req.ReportSnapshot.ReportStatus.CompletedAt = protocompat.TimestampNow()
+	if err := UpdateReportStatus(statusCtx, snapshotStore, req.ReportSnapshot, storage.ReportStatus_FAILURE); err != nil {
+		log.Errorf("Error changing report status to FAILURE for report config '%s', report ID '%s': %s",
+			req.ReportSnapshot.GetName(), req.ReportSnapshot.GetReportId(), err)
+	}
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/consts.go b/central/reports/scheduler/v2/reportgenerator/consts.go
index 4ae09a1c5c034..ba1007eb7a762 100644
--- a/central/reports/scheduler/v2/reportgenerator/consts.go
+++ b/central/reports/scheduler/v2/reportgenerator/consts.go
@@ -8,4 +8,15 @@ const (
 		"Please review the vulnerable software packages/components from the impacted images and update them to a version containing the fix, if one is available.\n"
 
 	defaultNoVulnsEmailBodyTemplate = "{{.BrandedPrefix}} for Kubernetes has found no workload CVEs in the images matched by the following report configuration parameters.\n"
+
+	// NodeDefaultEmailSubjectTemplate is the default email subject for node CVE reports.
+	NodeDefaultEmailSubjectTemplate = "{{.BrandedProductNameShort}} Node CVE Report for {{.ReportConfigName}}"
+
+	// NodeDefaultEmailBodyTemplate is the default email body for node CVE reports.
+	NodeDefaultEmailBodyTemplate = "{{.BrandedPrefix}} for Kubernetes has identified node CVEs in the nodes matched by the following report configuration parameters. " +
+		"The attached vulnerability report lists those node CVEs and associated details to help with remediation. " +
+		"Please review the vulnerable software packages/components from the impacted nodes and update them to a version containing the fix, if one is available.\n"
+
+	// NodeDefaultNoVulnsEmailBodyTemplate is the default email body when no node CVEs are found.
+	NodeDefaultNoVulnsEmailBodyTemplate = "{{.BrandedPrefix}} for Kubernetes has found no node CVEs in the nodes matched by the following report configuration parameters.\n"
 )
diff --git a/central/reports/scheduler/v2/reportgenerator/csv_gen.go b/central/reports/scheduler/v2/reportgenerator/csv_gen.go
index 8880451710b1b..490b53aa6ed9f 100644
--- a/central/reports/scheduler/v2/reportgenerator/csv_gen.go
+++ b/central/reports/scheduler/v2/reportgenerator/csv_gen.go
@@ -4,12 +4,15 @@ import (
 	"archive/zip"
 	"bytes"
 	"fmt"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/pkg/errors"
+	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/csv"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/stringutils"
 )
 
@@ -29,16 +32,109 @@ var (
 		"NVDCVSS",
 		"EPSS Probability Percentage",
 		"Discovered At",
+		"Image Created Date",
 		"Reference",
 		"Advisory Name",
 		"Advisory Link",
+		"CVE Origin",
+	}
+
+	// originDisplayNames maps VulnOrigin enum values to human-readable names for the
+	// CSV report. This must be kept in sync with the equivalent UI map.
+	originDisplayNames = map[storage.VulnOrigin]string{
+		storage.VulnOrigin_VULN_ORIGIN_ALPINE:  "Alpine Linux",
+		storage.VulnOrigin_VULN_ORIGIN_AMAZON:  "Amazon Linux",
+		storage.VulnOrigin_VULN_ORIGIN_DEBIAN:  "Debian",
+		storage.VulnOrigin_VULN_ORIGIN_ORACLE:  "Oracle Linux",
+		storage.VulnOrigin_VULN_ORIGIN_OSV:     "OSV.dev",
+		storage.VulnOrigin_VULN_ORIGIN_PHOTON:  "Photon OS",
+		storage.VulnOrigin_VULN_ORIGIN_RED_HAT: "Red Hat",
+		storage.VulnOrigin_VULN_ORIGIN_SUSE:    "SUSE",
+		storage.VulnOrigin_VULN_ORIGIN_UBUNTU:  "Ubuntu",
+		storage.VulnOrigin_VULN_ORIGIN_OTHER:   "Other",
 	}
 )
 
+func originDisplayName(origin storage.VulnOrigin) string {
+	if name, ok := originDisplayNames[origin]; ok {
+		return name
+	}
+	return origin.String()
+}
+
+func formatCSVRow(r *ImageCVEQueryResponse) []string {
+	var epssScore string
+	if r.GetEPSSProbability() != nil {
+		epssScore = strconv.FormatFloat(*r.GetEPSSProbability()*100, 'f', 3, 64)
+	} else {
+		epssScore = "Not Available"
+	}
+
+	csvRow := []string{
+		r.GetCluster(),
+		r.GetNamespace(),
+		r.GetDeployment(),
+		r.GetImage(),
+		r.GetComponent(),
+		r.GetComponentVersion(),
+		r.GetCVE(),
+		strconv.FormatBool(r.GetFixable()),
+		r.GetFixedByVersion(),
+		strings.ToTitle(stringutils.GetUpTo(r.GetSeverity().String(), "_")),
+		strconv.FormatFloat(r.GetCVSS(), 'f', 2, 64),
+		strconv.FormatFloat(r.GetNVDCVSS(), 'f', 2, 64),
+		epssScore}
+
+	if features.KnownExploitedVulnerabilities.Enabled() {
+		var cisaKev string
+		if r.GetCisaKev() != nil {
+			cisaKev = strconv.FormatBool(*r.GetCisaKev())
+		} else {
+			cisaKev = "Not Available"
+		}
+		var knownRansomware string
+		if r.GetKnownRansomwareCampaign() != nil {
+			knownRansomware = strconv.FormatBool(*r.GetKnownRansomwareCampaign())
+		} else {
+			knownRansomware = "Not Available"
+		}
+		csvRow = append(csvRow, cisaKev, knownRansomware)
+	}
+
+	csvRow = append(csvRow,
+		r.GetDiscoveredAtImage(),
+		r.GetImageCreatedAt(),
+		r.Link,
+		r.GetAdvisoryName(),
+		r.GetAdvisoryLink(),
+		originDisplayName(r.GetOrigin()),
+	)
+
+	return csvRow
+}
+
+func formatCol() []string {
+	csvHeaderCols := csvHeader
+	if features.KnownExploitedVulnerabilities.Enabled() {
+		csvHeaderCols = append(csvHeaderCols[:0:0], csvHeader...)
+		epssIdx := slices.Index(csvHeaderCols, "EPSS Probability Percentage")
+		csvHeaderCols = slices.Insert(csvHeaderCols, epssIdx+1, "CISA KEV", "Known Ransomware Campaign")
+	}
+	return csvHeaderCols
+}
+
+func csvReportName(configName string) string {
+	truncatedName := configName
+	if len(configName) > 80 {
+		truncatedName = configName[0:80] + "..."
+	}
+	now := time.Now()
+	return fmt.Sprintf("RHACS_Vulnerability_Report_%s_%s.csv", truncatedName, now.Format("02_January_2006"))
+}
+
 // GenerateCSV takes in the results of vuln report query, converts to CSV and returns zipped data
 func GenerateCSV(cveResponses []*ImageCVEQueryResponse, configName string) (*bytes.Buffer, error) {
-	// add header for component version
-	csvWriter := csv.NewGenericWriter(csvHeader, true)
+	csvWriter := csv.NewGenericWriter(formatCol(), true)
 
 	for _, r := range cveResponses {
 		var epssScore string
@@ -61,11 +157,30 @@ func GenerateCSV(cveResponses []*ImageCVEQueryResponse, configName string) (*byt
 			strconv.FormatFloat(r.GetCVSS(), 'f', 2, 64),
 			strconv.FormatFloat(r.GetNVDCVSS(), 'f', 2, 64),
 			epssScore,
+		}
+		if features.KnownExploitedVulnerabilities.Enabled() {
+			var cisaKev string
+			if r.GetCisaKev() != nil {
+				cisaKev = strconv.FormatBool(*r.GetCisaKev())
+			} else {
+				cisaKev = "Not Available"
+			}
+			var knownRansomware string
+			if r.GetKnownRansomwareCampaign() != nil {
+				knownRansomware = strconv.FormatBool(*r.GetKnownRansomwareCampaign())
+			} else {
+				knownRansomware = "Not Available"
+			}
+			row = append(row, cisaKev, knownRansomware)
+		}
+		row = append(row,
 			r.GetDiscoveredAtImage(),
+			r.GetImageCreatedAt(),
 			r.Link,
 			r.GetAdvisoryName(),
 			r.GetAdvisoryLink(),
-		}
+			originDisplayName(r.GetOrigin()),
+		)
 		csvWriter.AddValue(row)
 	}
 
@@ -77,17 +192,10 @@ func GenerateCSV(cveResponses []*ImageCVEQueryResponse, configName string) (*byt
 
 	var zipBuf bytes.Buffer
 	zipWriter := zip.NewWriter(&zipBuf)
-	truncatedName := configName
-	if len(configName) > 80 {
-		truncatedName = configName[0:80] + "..."
-	}
-
-	now := time.Now()
-	reportName := fmt.Sprintf("RHACS_Vulnerability_Report_%s_%s.csv", truncatedName, now.Format("02_January_2006"))
 	header := &zip.FileHeader{
-		Name:     reportName,
+		Name:     csvReportName(configName),
 		Method:   zip.Deflate,
-		Modified: now,
+		Modified: time.Now(),
 	}
 	zipFile, err := zipWriter.CreateHeader(header)
 	if err != nil {
@@ -102,4 +210,5 @@ func GenerateCSV(cveResponses []*ImageCVEQueryResponse, configName string) (*byt
 		return nil, errors.Wrapf(err, "unable to close the zip file for report config %s", configName)
 	}
 	return &zipBuf, nil
+
 }
diff --git a/central/reports/scheduler/v2/reportgenerator/csv_gen_test.go b/central/reports/scheduler/v2/reportgenerator/csv_gen_test.go
index 8f06b9fbfe369..3de7b466a8b13 100644
--- a/central/reports/scheduler/v2/reportgenerator/csv_gen_test.go
+++ b/central/reports/scheduler/v2/reportgenerator/csv_gen_test.go
@@ -3,9 +3,12 @@ package reportgenerator
 import (
 	"archive/zip"
 	"bytes"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -21,3 +24,111 @@ func TestGenerateCSV_ZipEntryHasModifiedTimestamp(t *testing.T) {
 	assert.False(t, reader.File[0].Modified.IsZero(), "ZIP entry Modified timestamp should not be zero")
 	assert.True(t, reader.File[0].Modified.After(before), "ZIP entry Modified timestamp should be recent")
 }
+
+func TestFormatCSVRow(t *testing.T) {
+	cluster := "test-cluster"
+	ns := "test-ns"
+	deploy := "test-deploy"
+	image := "quay.io/test:latest"
+	component := "openssl"
+	compVersion := "1.1.1"
+	cve := "CVE-2024-1234"
+	fixable := true
+	fixedBy := "1.1.2"
+	severity := storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY
+	cvss := 9.8
+	nvdcvss := 9.5
+	epss := 0.95
+	discovered := time.Date(2024, 6, 15, 0, 0, 0, 0, time.UTC)
+	advisoryName := "RHSA-2024:1234"
+	advisoryLink := "https://access.redhat.com/errata/RHSA-2024:1234"
+
+	r := &ImageCVEQueryResponse{
+		Cluster:           &cluster,
+		Namespace:         &ns,
+		Deployment:        &deploy,
+		Image:             &image,
+		Component:         &component,
+		ComponentVersion:  &compVersion,
+		CVE:               &cve,
+		Fixable:           &fixable,
+		FixedByVersion:    &fixedBy,
+		Severity:          &severity,
+		CVSS:              &cvss,
+		NVDCVSS:           &nvdcvss,
+		EPSSProbability:   &epss,
+		DiscoveredAtImage: &discovered,
+		AdvisoryName:      &advisoryName,
+		AdvisoryLink:      &advisoryLink,
+		Link:              "https://nvd.nist.gov/vuln/detail/CVE-2024-1234",
+	}
+
+	t.Run("KEV disabled", func(t *testing.T) {
+		t.Setenv(features.KnownExploitedVulnerabilities.EnvVar(), "false")
+
+		row := formatCSVRow(r)
+		assert.Equal(t, len(formatCol()), len(row), "row should have same number of columns as header")
+		assert.Equal(t, "test-cluster", row[0])
+		assert.Equal(t, "test-ns", row[1])
+		assert.Equal(t, "test-deploy", row[2])
+		assert.Equal(t, "CVE-2024-1234", row[6])
+		assert.Equal(t, "true", row[7])
+		assert.Equal(t, "CRITICAL", row[9])
+		assert.Equal(t, "95.000", row[12])
+		assert.Equal(t, "Not Available", row[14]) // Image Created Date (nil → "Not Available")
+		assert.Equal(t, "https://nvd.nist.gov/vuln/detail/CVE-2024-1234", row[15])
+	})
+
+	t.Run("KEV enabled", func(t *testing.T) {
+		t.Setenv(features.KnownExploitedVulnerabilities.EnvVar(), "true")
+
+		// The two KEV columns are inserted after EPSS (index 12), shifting all
+		// trailing columns right by two.
+		row := formatCSVRow(r)
+		assert.Equal(t, len(formatCol()), len(row), "row should have same number of columns as header")
+		assert.Equal(t, "test-cluster", row[0])
+		assert.Equal(t, "95.000", row[12])
+		assert.Equal(t, "Not Available", row[13]) // CISA KEV (nil → "Not Available")
+		assert.Equal(t, "Not Available", row[14]) // Known Ransomware Campaign (nil → "Not Available")
+		assert.Equal(t, "Not Available", row[16]) // Image Created Date (nil → "Not Available")
+		assert.Equal(t, "https://nvd.nist.gov/vuln/detail/CVE-2024-1234", row[17])
+	})
+}
+
+func TestFormatCSVRow_NilFields(t *testing.T) {
+	r := &ImageCVEQueryResponse{}
+
+	t.Run("KEV disabled", func(t *testing.T) {
+		t.Setenv(features.KnownExploitedVulnerabilities.EnvVar(), "false")
+
+		row := formatCSVRow(r)
+		assert.Equal(t, len(formatCol()), len(row))
+		assert.Equal(t, "", row[0])
+		assert.Equal(t, "Not Available", row[12]) // EPSS Probability Percentage
+		assert.Equal(t, "Not Available", row[13]) // Discovered At
+		assert.Equal(t, "Not Available", row[14]) // Image Created Date
+	})
+
+	t.Run("KEV enabled", func(t *testing.T) {
+		t.Setenv(features.KnownExploitedVulnerabilities.EnvVar(), "true")
+
+		row := formatCSVRow(r)
+		assert.Equal(t, len(formatCol()), len(row))
+		assert.Equal(t, "", row[0])
+		assert.Equal(t, "Not Available", row[12]) // EPSS Probability Percentage
+		assert.Equal(t, "Not Available", row[13]) // CISA KEV
+		assert.Equal(t, "Not Available", row[14]) // Known Ransomware Campaign
+		assert.Equal(t, "Not Available", row[15]) // Discovered At
+		assert.Equal(t, "Not Available", row[16]) // Image Created Date
+	})
+}
+
+func TestCsvReportName(t *testing.T) {
+	name := csvReportName("My Report")
+	assert.Contains(t, name, "RHACS_Vulnerability_Report_My Report_")
+	assert.Contains(t, name, ".csv")
+
+	longName := strings.Repeat("a", 100)
+	name = csvReportName(longName)
+	assert.Contains(t, name, "...")
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/email_formatter.go b/central/reports/scheduler/v2/reportgenerator/email_formatter.go
index c4b33fe161848..87d5d99284906 100644
--- a/central/reports/scheduler/v2/reportgenerator/email_formatter.go
+++ b/central/reports/scheduler/v2/reportgenerator/email_formatter.go
@@ -39,7 +39,9 @@ var (
 	}
 )
 
-func formatEmailSubject(subjectTemplate string, snapshot *storage.ReportSnapshot) (string, error) {
+// FormatEmailSubject formats an email subject line from the given Go template
+// and report snapshot.
+func FormatEmailSubject(subjectTemplate string, snapshot *storage.ReportSnapshot) (string, error) {
 	configName := snapshot.GetName()
 	if len(configName) > maxConfigNameLenInSubject {
 		configName = fmt.Sprintf("%s...", configName[0:maxConfigNameLenInSubject])
@@ -65,7 +67,8 @@ func formatEmailSubject(subjectTemplate string, snapshot *storage.ReportSnapshot
 	return templates.ExecuteToString(tmpl, data)
 }
 
-func formatEmailBody(emailTemplate string) (string, error) {
+// FormatEmailBody formats an email body from the given Go template.
+func FormatEmailBody(emailTemplate string) (string, error) {
 	data := &reportEmailBodyFormat{
 		BrandedPrefix: branding.GetCombinedProductAndShortName(),
 	}
@@ -77,7 +80,8 @@ func formatEmailBody(emailTemplate string) (string, error) {
 	return templates.ExecuteToString(tmpl, data)
 }
 
-func addReportConfigDetails(emailBody, configDetailsHTML string) string {
+// AddReportConfigDetails appends report configuration details HTML to the email body.
+func AddReportConfigDetails(emailBody, configDetailsHTML string) string {
 	var writer strings.Builder
 	writer.WriteString(emailBody)
 	writer.WriteString("<br><br>")
@@ -144,6 +148,35 @@ func formatReportConfigDetails(snapshot *storage.ReportSnapshot, numDeployedImag
 	return writer.String(), nil
 }
 
+// FormatNodeReportConfigDetails formats node report configuration details as HTML
+// for inclusion in the notification email.
+func FormatNodeReportConfigDetails(snapshot *storage.ReportSnapshot, numNodeCVEs int) (string, error) {
+	filters := snapshot.GetNodeVulnReportFilters()
+	if filters == nil {
+		return "", errors.New("report snapshot is missing node vulnerability report filters")
+	}
+
+	var writer strings.Builder
+	writer.WriteString("<div>")
+
+	formatSingleDetail(&writer, "Config name", snapshot.GetName())
+	formatSingleDetail(&writer, "Number of CVEs found", fmt.Sprintf("%d", numNodeCVEs))
+
+	if query := filters.GetQuery(); query != "" {
+		formatSingleDetail(&writer, "Filter", query)
+	}
+
+	if entityScope := snapshot.GetResourceScope().GetEntityScope(); entityScope != nil {
+		scopeParts := formatEntityScope(entityScope)
+		if len(scopeParts) > 0 {
+			formatSingleDetail(&writer, "Report scope", scopeParts...)
+		}
+	}
+
+	writer.WriteString("</div>")
+	return writer.String(), nil
+}
+
 func formatEntityScope(entityScope *storage.EntityScope) []string {
 	parts := make([]string, 0, len(entityScope.GetRules()))
 	for _, rule := range entityScope.GetRules() {
diff --git a/central/reports/scheduler/v2/reportgenerator/email_formatter_test.go b/central/reports/scheduler/v2/reportgenerator/email_formatter_test.go
index 80085f66ded11..e1ae9b76e3d22 100644
--- a/central/reports/scheduler/v2/reportgenerator/email_formatter_test.go
+++ b/central/reports/scheduler/v2/reportgenerator/email_formatter_test.go
@@ -188,6 +188,101 @@ func (s *EmailFormatterTestSuite) configDetailsTestCases() []configDetailsTestCa
 	return cases
 }
 
+func (s *EmailFormatterTestSuite) TestFormatNodeReportConfigDetails() {
+	for _, tc := range s.nodeConfigDetailsTestCases() {
+		s.T().Run(tc.desc, func(t *testing.T) {
+			configHTML, err := FormatNodeReportConfigDetails(tc.snapshot, 25)
+			s.Require().NoError(err)
+			expectedHTML := strings.ReplaceAll(tc.expectedHTML, "\n", "")
+			expectedHTML = strings.ReplaceAll(expectedHTML, "\t", "")
+			s.Require().Equal(expectedHTML, configHTML)
+		})
+	}
+}
+
+func (s *EmailFormatterTestSuite) TestFormatNodeReportConfigDetails_NilFilters() {
+	snap := &storage.ReportSnapshot{
+		Name: "Node Report",
+	}
+	_, err := FormatNodeReportConfigDetails(snap, 0)
+	s.Require().Error(err)
+}
+
+func (s *EmailFormatterTestSuite) nodeConfigDetailsTestCases() []configDetailsTestCase {
+	return []configDetailsTestCase{
+		{
+			desc: "Node report with entity scope and filter query",
+			snapshot: &storage.ReportSnapshot{
+				Name: "Node Team Report",
+				Filter: &storage.ReportSnapshot_NodeVulnReportFilters{
+					NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+						Query: "CVSS > 7",
+					},
+				},
+				ResourceScope: &storage.ResourceScope{
+					ScopeReference: &storage.ResourceScope_EntityScope{
+						EntityScope: &storage.EntityScope{
+							Rules: []*storage.EntityScopeRule{
+								{
+									Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+									Field:  storage.EntityField_FIELD_NAME,
+									Values: []*storage.RuleValue{
+										{Value: "prod-us"},
+										{Value: "prod-eu"},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedHTML: `<div>
+						<div style="padding: 0 0 10px 0">
+							<span style="font-weight: bold; margin-right: 10px">
+								Config name: </span>
+							<span>Node Team Report</span>
+						</div>
+						<div style="padding: 0 0 10px 0">
+							<span style="font-weight: bold; margin-right: 10px">
+								Number of CVEs found: </span>
+							<span>25</span>
+						</div>
+						<div style="padding: 0 0 10px 0">
+							<span style="font-weight: bold; margin-right: 10px">
+								Filter: </span>
+							<span>CVSS > 7</span>
+						</div>
+						<div style="padding: 0 0 10px 0">
+							<span style="font-weight: bold; margin-right: 10px">
+								Report scope: </span>
+							<span>Cluster Name: prod-us, prod-eu</span>
+						</div>
+					</div>`,
+		},
+		{
+			desc: "Node report without filter query or entity scope",
+			snapshot: &storage.ReportSnapshot{
+				Name: "Simple Node Report",
+				Filter: &storage.ReportSnapshot_NodeVulnReportFilters{
+					NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{},
+				},
+			},
+			expectedHTML: `<div>
+						<div style="padding: 0 0 10px 0">
+							<span style="font-weight: bold; margin-right: 10px">
+								Config name: </span>
+							<span>Simple Node Report</span>
+						</div>
+						<div style="padding: 0 0 10px 0">
+							<span style="font-weight: bold; margin-right: 10px">
+								Number of CVEs found: </span>
+							<span>25</span>
+						</div>
+					</div>`,
+		},
+	}
+}
+
 func (s *EmailFormatterTestSuite) entityScopeTestCases() []configDetailsTestCase {
 	return []configDetailsTestCase{
 		{
diff --git a/central/reports/scheduler/v2/reportgenerator/node/csv_gen.go b/central/reports/scheduler/v2/reportgenerator/node/csv_gen.go
new file mode 100644
index 0000000000000..7117c8b747712
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/csv_gen.go
@@ -0,0 +1,77 @@
+package node
+
+import (
+	"archive/zip"
+	"bytes"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/pkg/csv"
+	"github.com/stackrox/rox/pkg/stringutils"
+)
+
+var csvHeader = []string{
+	"Cluster",
+	"Node",
+	"Operating System",
+	"Component",
+	"Component Version",
+	"CVE",
+	"Fixable",
+	"CVE Fixed In",
+	"Severity",
+	"CVSS",
+	"First System Occurrence",
+	"Reference",
+}
+
+func generateCSV(cveResponses []*NodeCVEQueryResponse, configName string) (*bytes.Buffer, error) {
+	csvWriter := csv.NewGenericWriter(csvHeader, true)
+
+	for _, r := range cveResponses {
+		row := csv.Value{
+			r.GetCluster(),
+			r.GetNode(),
+			r.GetOperatingSystem(),
+			r.GetComponent(),
+			r.GetComponentVersion(),
+			r.GetCVE(),
+			strconv.FormatBool(r.GetFixable()),
+			r.GetFixedByVersion(),
+			strings.ToTitle(stringutils.GetUpTo(r.GetSeverity().String(), "_")),
+			strconv.FormatFloat(r.GetCVSS(), 'f', 2, 64),
+			r.GetFirstOccurrence(),
+			r.GetLink(),
+		}
+		csvWriter.AddValue(row)
+	}
+
+	var zipBuf bytes.Buffer
+	zipWriter := zip.NewWriter(&zipBuf)
+	truncatedName := configName
+	if runes := []rune(configName); len(runes) > 80 {
+		truncatedName = string(runes[:80]) + "..."
+	}
+
+	now := time.Now()
+	reportName := fmt.Sprintf("RHACS_Node_Vulnerability_Report_%s_%s.csv", truncatedName, now.Format("02_January_2006"))
+	header := &zip.FileHeader{
+		Name:     reportName,
+		Method:   zip.Deflate,
+		Modified: now,
+	}
+	zipFile, err := zipWriter.CreateHeader(header)
+	if err != nil {
+		return nil, errors.Wrapf(err, "unable to create the zip file for report config '%s'", configName)
+	}
+	if err = csvWriter.WriteCSV(zipFile); err != nil {
+		return nil, errors.Wrapf(err, "unable to write the zip file for report config '%s'", configName)
+	}
+	if err = zipWriter.Close(); err != nil {
+		return nil, errors.Wrapf(err, "unable to close the zip file for report config %s", configName)
+	}
+	return &zipBuf, nil
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/csv_gen_test.go b/central/reports/scheduler/v2/reportgenerator/node/csv_gen_test.go
new file mode 100644
index 0000000000000..4943131f8ea0a
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/csv_gen_test.go
@@ -0,0 +1,174 @@
+package node
+
+import (
+	"archive/zip"
+	"bytes"
+	"encoding/csv"
+	"testing"
+	"time"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateCSV_EmptyResponses(t *testing.T) {
+	buf, err := generateCSV(nil, "test-report")
+	require.NoError(t, err)
+	require.NotNil(t, buf)
+
+	reader, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	require.NoError(t, err)
+	require.Len(t, reader.File, 1)
+	assert.Contains(t, reader.File[0].Name, "RHACS_Node_Vulnerability_Report_")
+	assert.Contains(t, reader.File[0].Name, "test-report")
+}
+
+func TestGenerateCSV_WithResponses(t *testing.T) {
+	cluster := "prod-us"
+	node := "node-1"
+	operatingSystem := "rhcos:4.14"
+	component := "openssl"
+	componentVersion := "1.1.1"
+	cve := "CVE-2021-1234"
+	fixable := true
+	fixedBy := "1.1.2"
+	severity := storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY
+	cvss := 9.8
+
+	firstOccurrence := time.Date(2021, 6, 15, 0, 0, 0, 0, time.UTC)
+
+	responses := []*NodeCVEQueryResponse{
+		{
+			Cluster:          &cluster,
+			Node:             &node,
+			OperatingSystem:  &operatingSystem,
+			Component:        &component,
+			ComponentVersion: &componentVersion,
+			CVE:              &cve,
+			Fixable:          &fixable,
+			FixedByVersion:   &fixedBy,
+			Severity:         &severity,
+			CVSS:             &cvss,
+			FirstOccurrence:  &firstOccurrence,
+			Link:             "https://nvd.nist.gov/vuln/detail/CVE-2021-1234",
+		},
+	}
+
+	buf, err := generateCSV(responses, "test-report")
+	require.NoError(t, err)
+
+	reader, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	require.NoError(t, err)
+	require.Len(t, reader.File, 1)
+
+	rc, err := reader.File[0].Open()
+	require.NoError(t, err)
+	defer func() { _ = rc.Close() }()
+
+	csvReader := csv.NewReader(rc)
+	records, err := csvReader.ReadAll()
+	require.NoError(t, err)
+
+	// Header + 1 data row
+	require.Len(t, records, 2)
+	assert.Equal(t, csvHeader, records[0])
+	assert.Equal(t, "prod-us", records[1][0])
+	assert.Equal(t, "node-1", records[1][1])
+	assert.Equal(t, "rhcos:4.14", records[1][2])
+	assert.Equal(t, "openssl", records[1][3])
+	assert.Equal(t, "1.1.1", records[1][4])
+	assert.Equal(t, "CVE-2021-1234", records[1][5])
+	assert.Equal(t, "true", records[1][6])
+	assert.Equal(t, "1.1.2", records[1][7])
+	assert.Equal(t, "CRITICAL", records[1][8])
+	assert.Equal(t, "9.80", records[1][9])
+	assert.Equal(t, "June 15, 2021", records[1][10])
+	assert.Equal(t, "https://nvd.nist.gov/vuln/detail/CVE-2021-1234", records[1][11])
+}
+
+func TestGenerateCSV_LongConfigNameIsTruncated(t *testing.T) {
+	longName := ""
+	for range 100 {
+		longName += "a"
+	}
+	buf, err := generateCSV(nil, longName)
+	require.NoError(t, err)
+
+	reader, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	require.NoError(t, err)
+	require.Len(t, reader.File, 1)
+	assert.Contains(t, reader.File[0].Name, "...")
+	assert.LessOrEqual(t, len(reader.File[0].Name), 200)
+}
+
+func TestGenerateCSV_ZipEntryHasModifiedTimestamp(t *testing.T) {
+	before := time.Now().Add(-time.Minute)
+	buf, err := generateCSV(nil, "test")
+	require.NoError(t, err)
+
+	reader, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	require.NoError(t, err)
+	require.Len(t, reader.File, 1)
+	assert.False(t, reader.File[0].Modified.IsZero(), "ZIP entry Modified timestamp should not be zero")
+	assert.True(t, reader.File[0].Modified.After(before), "ZIP entry Modified timestamp should be recent")
+}
+
+func TestGenerateCSV_NilFieldsProduceDefaults(t *testing.T) {
+	responses := []*NodeCVEQueryResponse{
+		{},
+	}
+
+	buf, err := generateCSV(responses, "defaults-test")
+	require.NoError(t, err)
+
+	reader, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	require.NoError(t, err)
+
+	rc, err := reader.File[0].Open()
+	require.NoError(t, err)
+	defer func() { _ = rc.Close() }()
+
+	csvReader := csv.NewReader(rc)
+	records, err := csvReader.ReadAll()
+	require.NoError(t, err)
+	require.Len(t, records, 2)
+
+	row := records[1]
+	assert.Equal(t, "", row[0])               // Cluster
+	assert.Equal(t, "", row[1])               // Node
+	assert.Equal(t, "Not Available", row[2])  // Operating System
+	assert.Equal(t, "", row[3])               // Component
+	assert.Equal(t, "", row[4])               // ComponentVersion
+	assert.Equal(t, "", row[5])               // CVE
+	assert.Equal(t, "false", row[6])          // Fixable
+	assert.Equal(t, "", row[7])               // FixedBy
+	assert.Equal(t, "UNKNOWN", row[8])        // Severity
+	assert.Equal(t, "0.00", row[9])           // CVSS
+	assert.Equal(t, "Not Available", row[10]) // First System Occurrence
+	assert.Equal(t, "", row[11])              // Link
+}
+
+func TestGenerateCSV_EmptyOperatingSystemProducesDefault(t *testing.T) {
+	emptyOS := ""
+	responses := []*NodeCVEQueryResponse{
+		{OperatingSystem: &emptyOS},
+	}
+
+	buf, err := generateCSV(responses, "empty-os-test")
+	require.NoError(t, err)
+
+	reader, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	require.NoError(t, err)
+
+	rc, err := reader.File[0].Open()
+	require.NoError(t, err)
+	defer func() { _ = rc.Close() }()
+
+	csvReader := csv.NewReader(rc)
+	records, err := csvReader.ReadAll()
+	require.NoError(t, err)
+	require.Len(t, records, 2)
+
+	assert.Equal(t, "Not Available", records[1][2])
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/query_builder.go b/central/reports/scheduler/v2/reportgenerator/node/query_builder.go
new file mode 100644
index 0000000000000..007d7b4cf7424
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/query_builder.go
@@ -0,0 +1,84 @@
+package node
+
+import (
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/central/reports/common"
+	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/sac/effectiveaccessscope"
+	"github.com/stackrox/rox/pkg/search"
+)
+
+type queryBuilder struct {
+	filters     *storage.NodeVulnerabilityReportFilters
+	entityScope *storage.EntityScope
+}
+
+func newQueryBuilder(entityScope *storage.EntityScope, filters *storage.NodeVulnerabilityReportFilters) *queryBuilder {
+	return &queryBuilder{
+		filters:     filters,
+		entityScope: entityScope,
+	}
+}
+
+func (q *queryBuilder) buildQuery(clusters []effectiveaccessscope.Cluster, namespaces []effectiveaccessscope.Namespace) (*v1.Query, error) {
+	var conjuncts []*v1.Query
+
+	if q.entityScope != nil {
+		scopeQuery, err := q.buildEntityScopeQuery()
+		if err != nil {
+			return nil, err
+		}
+		conjuncts = append(conjuncts, scopeQuery)
+	}
+
+	accessScopeQuery, err := common.BuildClusterOnlyAccessScopeQuery(q.filters.GetAccessScopeRules(), clusters, namespaces)
+	if err != nil {
+		return nil, err
+	}
+	conjuncts = append(conjuncts, accessScopeQuery)
+
+	cveFilterQuery, err := search.ParseQuery(q.filters.GetQuery(), search.MatchAllIfEmpty())
+	if err != nil {
+		return nil, err
+	}
+	conjuncts = append(conjuncts, cveFilterQuery)
+
+	return search.ConjunctionQuery(conjuncts...), nil
+}
+
+func (q *queryBuilder) buildEntityScopeQuery() (*v1.Query, error) {
+	var conjuncts []*v1.Query
+	for _, rule := range q.entityScope.GetRules() {
+		if len(rule.GetValues()) == 0 {
+			continue
+		}
+		fieldLabel, err := nodeEntityScopeRuleToFieldLabel(rule)
+		if err != nil {
+			return nil, err
+		}
+		if fieldLabel == search.ClusterLabel {
+			conjuncts = append(conjuncts, common.MapFieldQuery(fieldLabel, rule))
+		} else {
+			conjuncts = append(conjuncts, common.ScalarFieldQuery(fieldLabel, rule))
+		}
+	}
+
+	if len(conjuncts) == 0 {
+		return search.EmptyQuery(), nil
+	}
+	return search.ConjunctionQuery(conjuncts...), nil
+}
+
+func nodeEntityScopeRuleToFieldLabel(rule *storage.EntityScopeRule) (search.FieldLabel, error) {
+	if rule.GetEntity() != storage.EntityType_ENTITY_TYPE_CLUSTER {
+		return "", errors.Errorf("unsupported entity type %s for node reports; only ENTITY_TYPE_CLUSTER is allowed", rule.GetEntity())
+	}
+	switch rule.GetField() {
+	case storage.EntityField_FIELD_NAME:
+		return search.Cluster, nil
+	case storage.EntityField_FIELD_LABEL:
+		return search.ClusterLabel, nil
+	}
+	return "", errors.Errorf("unsupported field %s for cluster entity scope", rule.GetField())
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/query_builder_test.go b/central/reports/scheduler/v2/reportgenerator/node/query_builder_test.go
new file mode 100644
index 0000000000000..cbd75121835fe
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/query_builder_test.go
@@ -0,0 +1,277 @@
+package node
+
+import (
+	"testing"
+
+	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/protoassert"
+	"github.com/stackrox/rox/pkg/sac/effectiveaccessscope"
+	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+var testClusters = []effectiveaccessscope.Cluster{
+	&storage.Cluster{
+		Id:   uuid.NewV4().String(),
+		Name: "prod-us",
+	},
+	&storage.Cluster{
+		Id:   uuid.NewV4().String(),
+		Name: "prod-eu",
+	},
+}
+
+func TestNodeEntityScopeRuleToFieldLabel(t *testing.T) {
+	testCases := map[string]struct {
+		rule     *storage.EntityScopeRule
+		expected search.FieldLabel
+		hasError bool
+	}{
+		"Cluster name returns search.Cluster": {
+			rule: &storage.EntityScopeRule{
+				Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+				Field:  storage.EntityField_FIELD_NAME,
+			},
+			expected: search.Cluster,
+		},
+		"Cluster label returns search.ClusterLabel": {
+			rule: &storage.EntityScopeRule{
+				Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+				Field:  storage.EntityField_FIELD_LABEL,
+			},
+			expected: search.ClusterLabel,
+		},
+		"Namespace entity is not allowed": {
+			rule: &storage.EntityScopeRule{
+				Entity: storage.EntityType_ENTITY_TYPE_NAMESPACE,
+				Field:  storage.EntityField_FIELD_NAME,
+			},
+			hasError: true,
+		},
+		"Deployment entity is not allowed": {
+			rule: &storage.EntityScopeRule{
+				Entity: storage.EntityType_ENTITY_TYPE_DEPLOYMENT,
+				Field:  storage.EntityField_FIELD_NAME,
+			},
+			hasError: true,
+		},
+		"Cluster annotation is not allowed": {
+			rule: &storage.EntityScopeRule{
+				Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+				Field:  storage.EntityField_FIELD_ANNOTATION,
+			},
+			hasError: true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			result, err := nodeEntityScopeRuleToFieldLabel(tc.rule)
+			if tc.hasError {
+				assert.Error(t, err)
+				return
+			}
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expected, result)
+		})
+	}
+}
+
+func TestBuildEntityScopeQuery(t *testing.T) {
+	testCases := map[string]struct {
+		scope    *storage.EntityScope
+		expected *v1.Query
+		hasError bool
+	}{
+		"Empty rules returns empty query": {
+			scope:    &storage.EntityScope{},
+			expected: search.EmptyQuery(),
+		},
+		"Single cluster name rule": {
+			scope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{
+							{Value: "prod-us", MatchType: storage.MatchType_EXACT},
+						},
+					},
+				},
+			},
+			expected: search.NewQueryBuilder().AddExactMatches(search.Cluster, "prod-us").ProtoQuery(),
+		},
+		"Multiple cluster name values are ORed": {
+			scope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{
+							{Value: "prod-us", MatchType: storage.MatchType_EXACT},
+							{Value: "prod-eu", MatchType: storage.MatchType_EXACT},
+						},
+					},
+				},
+			},
+			expected: search.DisjunctionQuery(
+				search.NewQueryBuilder().AddExactMatches(search.Cluster, "prod-us").ProtoQuery(),
+				search.NewQueryBuilder().AddExactMatches(search.Cluster, "prod-eu").ProtoQuery(),
+			),
+		},
+		"Cluster label rule uses map query": {
+			scope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_LABEL,
+						Values: []*storage.RuleValue{
+							{Value: "env=prod", MatchType: storage.MatchType_EXACT},
+						},
+					},
+				},
+			},
+			expected: search.NewQueryBuilder().AddMapQuery(search.ClusterLabel, `"env"`, `"prod"`).ProtoQuery(),
+		},
+		"Regex match type": {
+			scope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{
+							{Value: "prod-.*", MatchType: storage.MatchType_REGEX},
+						},
+					},
+				},
+			},
+			expected: search.NewQueryBuilder().AddRegexes(search.Cluster, "prod-.*").ProtoQuery(),
+		},
+		"Multiple rules are ANDed": {
+			scope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{
+							{Value: "prod-us", MatchType: storage.MatchType_EXACT},
+						},
+					},
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_LABEL,
+						Values: []*storage.RuleValue{
+							{Value: "tier=premium", MatchType: storage.MatchType_EXACT},
+						},
+					},
+				},
+			},
+			expected: search.ConjunctionQuery(
+				search.NewQueryBuilder().AddExactMatches(search.Cluster, "prod-us").ProtoQuery(),
+				search.NewQueryBuilder().AddMapQuery(search.ClusterLabel, `"tier"`, `"premium"`).ProtoQuery(),
+			),
+		},
+		"Rule with empty values is skipped": {
+			scope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{},
+					},
+				},
+			},
+			expected: search.EmptyQuery(),
+		},
+		"Namespace rule returns error": {
+			scope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_NAMESPACE,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{
+							{Value: "default", MatchType: storage.MatchType_EXACT},
+						},
+					},
+				},
+			},
+			hasError: true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			qb := &queryBuilder{entityScope: tc.scope}
+			result, err := qb.buildEntityScopeQuery()
+			if tc.hasError {
+				assert.Error(t, err)
+				return
+			}
+			assert.NoError(t, err)
+			protoassert.Equal(t, tc.expected, result)
+		})
+	}
+}
+
+func TestBuildQuery(t *testing.T) {
+	testCases := map[string]struct {
+		entityScope *storage.EntityScope
+		filters     *storage.NodeVulnerabilityReportFilters
+		hasError    bool
+	}{
+		"View-based (nil entity scope) builds without error": {
+			entityScope: nil,
+			filters:     &storage.NodeVulnerabilityReportFilters{},
+		},
+		"Config-based with entity scope builds without error": {
+			entityScope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{
+							{Value: "prod-us", MatchType: storage.MatchType_EXACT},
+						},
+					},
+				},
+			},
+			filters: &storage.NodeVulnerabilityReportFilters{},
+		},
+		"Config-based with query filter": {
+			entityScope: &storage.EntityScope{},
+			filters: &storage.NodeVulnerabilityReportFilters{
+				Query: "CVE:CVE-2021-1234",
+			},
+		},
+		"Invalid entity scope returns error": {
+			entityScope: &storage.EntityScope{
+				Rules: []*storage.EntityScopeRule{
+					{
+						Entity: storage.EntityType_ENTITY_TYPE_NAMESPACE,
+						Field:  storage.EntityField_FIELD_NAME,
+						Values: []*storage.RuleValue{
+							{Value: "default", MatchType: storage.MatchType_EXACT},
+						},
+					},
+				},
+			},
+			filters:  &storage.NodeVulnerabilityReportFilters{},
+			hasError: true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			qb := newQueryBuilder(tc.entityScope, tc.filters)
+			result, err := qb.buildQuery(testClusters, nil)
+			if tc.hasError {
+				assert.Error(t, err)
+				return
+			}
+			assert.NoError(t, err)
+			assert.NotNil(t, result)
+		})
+	}
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/report_gen.go b/central/reports/scheduler/v2/reportgenerator/node/report_gen.go
new file mode 100644
index 0000000000000..3e1ead3cb5235
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/report_gen.go
@@ -0,0 +1,33 @@
+package node
+
+import (
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	clusterDS "github.com/stackrox/rox/central/cluster/datastore"
+	nodeCVEDS "github.com/stackrox/rox/central/cve/node/datastore"
+	namespaceDS "github.com/stackrox/rox/central/namespace/datastore"
+	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	"github.com/stackrox/rox/pkg/notifier"
+	"github.com/stackrox/rox/pkg/postgres"
+)
+
+// New creates a new NodeReportGenerator instance.
+func New(
+	db postgres.DB,
+	reportSnapshotStore reportSnapshotDS.DataStore,
+	notificationProcessor notifier.Processor,
+	blobDatastore blobDS.Datastore,
+	clusterDatastore clusterDS.DataStore,
+	namespaceDatastore namespaceDS.DataStore,
+	nodeCVEDatastore nodeCVEDS.DataStore,
+) reportGen.ReportGenerator {
+	return &nodeReportGeneratorImpl{
+		reportSnapshotStore:   reportSnapshotStore,
+		notificationProcessor: notificationProcessor,
+		blobStore:             blobDatastore,
+		clusterDatastore:      clusterDatastore,
+		namespaceDatastore:    namespaceDatastore,
+		nodeCVEDatastore:      nodeCVEDatastore,
+		db:                    db,
+	}
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/report_gen_impl.go b/central/reports/scheduler/v2/reportgenerator/node/report_gen_impl.go
new file mode 100644
index 0000000000000..af815384121a8
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/report_gen_impl.go
@@ -0,0 +1,266 @@
+package node
+
+import (
+	"bytes"
+	"context"
+
+	"github.com/pkg/errors"
+	clusterDS "github.com/stackrox/rox/central/cluster/datastore"
+	"github.com/stackrox/rox/central/convert/storagetoeffectiveaccessscope"
+	nodeCVEDS "github.com/stackrox/rox/central/cve/node/datastore"
+	namespaceDS "github.com/stackrox/rox/central/namespace/datastore"
+	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/errorhelpers"
+	"github.com/stackrox/rox/pkg/notifier"
+	"github.com/stackrox/rox/pkg/notifiers"
+	"github.com/stackrox/rox/pkg/postgres"
+	pkgSchema "github.com/stackrox/rox/pkg/postgres/schema"
+	"github.com/stackrox/rox/pkg/protocompat"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/effectiveaccessscope"
+	"github.com/stackrox/rox/pkg/search"
+	pgSearch "github.com/stackrox/rox/pkg/search/postgres"
+	"github.com/stackrox/rox/pkg/set"
+
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+)
+
+var (
+	nodeReportGenCtx = sac.WithAllAccess(context.Background())
+
+	nodeQueryParts = &reportGen.ReportQueryParts{
+		Schema: pkgSchema.NodeCvesSchema,
+		Selects: []*v1.QuerySelect{
+			search.NewQuerySelect(search.Cluster).Proto(),
+			search.NewQuerySelect(search.Node).Proto(),
+			search.NewQuerySelect(search.OperatingSystem).Proto(),
+			search.NewQuerySelect(search.Component).Proto(),
+			search.NewQuerySelect(search.ComponentVersion).Proto(),
+			search.NewQuerySelect(search.CVEID).Proto(),
+			search.NewQuerySelect(search.CVE).Proto(),
+			search.NewQuerySelect(search.Fixable).Proto(),
+			search.NewQuerySelect(search.FixedBy).Proto(),
+			search.NewQuerySelect(search.Severity).Proto(),
+			search.NewQuerySelect(search.CVSS).Proto(),
+			search.NewQuerySelect(search.CVECreatedTime).Proto(),
+		},
+		Pagination: search.NewPagination().
+			Limit(int32(env.ReportMaxRows.IntegerSetting())).
+			Offset(0).
+			AddSortOption(search.NewSortOption(search.Cluster)).
+			AddSortOption(search.NewSortOption(search.Node)).
+			Proto(),
+	}
+)
+
+type nodeReportGeneratorImpl struct {
+	reportSnapshotStore   reportSnapshotDS.DataStore
+	notificationProcessor notifier.Processor
+	blobStore             blobDS.Datastore
+	clusterDatastore      clusterDS.DataStore
+	namespaceDatastore    namespaceDS.DataStore
+	nodeCVEDatastore      nodeCVEDS.DataStore
+	db                    postgres.DB
+}
+
+func (rg *nodeReportGeneratorImpl) ProcessReportRequest(ctx context.Context, req *reportGen.ReportRequest) {
+	ctx = sac.WithAllAccess(ctx)
+
+	if err := reportGen.ValidateReportRequest(req); err != nil {
+		reportGen.LogAndUpsertError(ctx, nodeReportGenCtx, rg.reportSnapshotStore, errors.Wrap(err, "Invalid report request"), req)
+		return
+	}
+
+	if err := reportGen.UpdateReportStatus(nodeReportGenCtx, rg.reportSnapshotStore, req.ReportSnapshot, storage.ReportStatus_PREPARING); err != nil {
+		reportGen.LogAndUpsertError(ctx, nodeReportGenCtx, rg.reportSnapshotStore, errors.Wrap(err, "Error changing report status to PREPARING"), req)
+		return
+	}
+
+	if err := rg.generateReportAndNotify(ctx, req); err != nil {
+		reportGen.LogAndUpsertError(ctx, nodeReportGenCtx, rg.reportSnapshotStore, err, req)
+		return
+	}
+
+	if req.ReportSnapshot.GetReportStatus().GetReportNotificationMethod() == storage.ReportStatus_EMAIL {
+		if err := reportGen.UpdateReportStatus(nodeReportGenCtx, rg.reportSnapshotStore, req.ReportSnapshot, storage.ReportStatus_DELIVERED); err != nil {
+			reportGen.LogAndUpsertError(ctx, nodeReportGenCtx, rg.reportSnapshotStore, errors.Wrap(err, "Error changing report status to DELIVERED"), req)
+		}
+	}
+}
+
+func (rg *nodeReportGeneratorImpl) generateReportAndNotify(ctx context.Context, req *reportGen.ReportRequest) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+
+	cveResponses, numResults, err := rg.getReportData(ctx, req.ReportSnapshot)
+	if err != nil {
+		return err
+	}
+
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+
+	zippedCSVData, err := generateCSV(cveResponses, req.ReportSnapshot.GetName())
+	if err != nil {
+		return err
+	}
+
+	req.ReportSnapshot.ReportStatus.CompletedAt = protocompat.TimestampNow()
+	if err := reportGen.UpdateReportStatus(nodeReportGenCtx, rg.reportSnapshotStore, req.ReportSnapshot, storage.ReportStatus_GENERATED); err != nil {
+		return errors.Wrap(err, "Error changing report status to GENERATED")
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+
+	switch req.ReportSnapshot.GetReportStatus().GetReportNotificationMethod() {
+	case storage.ReportStatus_DOWNLOAD:
+		parentDir := req.ReportSnapshot.GetReportConfigurationId()
+		if req.ReportSnapshot.GetReportStatus().GetReportRequestType() == storage.ReportStatus_VIEW_BASED {
+			parentDir = "view-based-report"
+		}
+		if err := reportGen.SaveReportData(nodeReportGenCtx, rg.blobStore, parentDir, req.ReportSnapshot.GetReportId(), zippedCSVData); err != nil {
+			return errors.Wrap(err, "error persisting blob")
+		}
+	case storage.ReportStatus_EMAIL:
+		return rg.sendEmailNotification(req, zippedCSVData, numResults)
+	}
+	return nil
+}
+
+func (rg *nodeReportGeneratorImpl) sendEmailNotification(req *reportGen.ReportRequest, zippedCSVData *bytes.Buffer, numResults int) error {
+	defaultEmailSubject, err := reportGen.FormatEmailSubject(reportGen.NodeDefaultEmailSubjectTemplate, req.ReportSnapshot)
+	if err != nil {
+		return errors.Wrap(err, "Error generating email subject")
+	}
+
+	templateStr := reportGen.NodeDefaultEmailBodyTemplate
+	if numResults == 0 {
+		zippedCSVData = nil
+		templateStr = reportGen.NodeDefaultNoVulnsEmailBodyTemplate
+	}
+
+	defaultEmailBody, err := reportGen.FormatEmailBody(templateStr)
+	if err != nil {
+		return errors.Wrap(err, "Error generating email body")
+	}
+
+	configDetailsHTML, err := reportGen.FormatNodeReportConfigDetails(req.ReportSnapshot, numResults)
+	if err != nil {
+		return errors.Wrap(err, "Error adding report config details")
+	}
+
+	errorList := errorhelpers.NewErrorList("Error sending email notifications: ")
+	for _, notifierSnap := range req.ReportSnapshot.GetNotifiers() {
+		nf := rg.notificationProcessor.GetNotifier(nodeReportGenCtx, notifierSnap.GetEmailConfig().GetNotifierId())
+		reportNotifier, ok := nf.(notifiers.ReportNotifier)
+		if !ok {
+			errorList.AddError(errors.Errorf("incorrect type of notifier '%s'", notifierSnap.GetEmailConfig().GetNotifierId()))
+			continue
+		}
+		customBody := notifierSnap.GetEmailConfig().GetCustomBody()
+		emailBody := defaultEmailBody
+		if customBody != "" {
+			emailBody = customBody
+		}
+		customSubject := notifierSnap.GetEmailConfig().GetCustomSubject()
+		emailSubject := defaultEmailSubject
+		if customSubject != "" {
+			emailSubject = customSubject
+		}
+		emailBodyWithConfigDetails := reportGen.AddReportConfigDetails(emailBody, configDetailsHTML)
+		reportName := req.ReportSnapshot.GetName()
+		if err := reportGen.RetryableSendReportResults(nodeReportGenCtx, reportNotifier, notifierSnap.GetEmailConfig().GetMailingLists(),
+			zippedCSVData, emailSubject, emailBodyWithConfigDetails, reportName); err != nil {
+			errorList.AddError(errors.Errorf("Error sending email for notifier '%s': %s",
+				notifierSnap.GetEmailConfig().GetNotifierId(), err))
+		}
+	}
+	if !errorList.Empty() {
+		return errorList.ToError()
+	}
+	return nil
+}
+
+func (rg *nodeReportGeneratorImpl) getReportData(ctx context.Context, snap *storage.ReportSnapshot) ([]*NodeCVEQueryResponse, int, error) {
+	clusters, namespaces, err := rg.getClustersAndNamespacesForSAC(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	var entityScope *storage.EntityScope
+	if snap.GetReportStatus().GetReportRequestType() != storage.ReportStatus_VIEW_BASED {
+		entityScope = snap.GetResourceScope().GetEntityScope()
+	}
+
+	qb := newQueryBuilder(entityScope, snap.GetNodeVulnReportFilters())
+	query, err := qb.buildQuery(clusters, namespaces)
+	if err != nil {
+		return nil, 0, errors.Wrap(err, "error building node report query")
+	}
+
+	return rg.executeQuery(ctx, query)
+}
+
+func (rg *nodeReportGeneratorImpl) executeQuery(ctx context.Context, query *v1.Query) ([]*NodeCVEQueryResponse, int, error) {
+	query.Pagination = nodeQueryParts.Pagination
+	query.Selects = nodeQueryParts.Selects
+
+	var cveResponses []*NodeCVEQueryResponse
+	cveIDs := set.NewStringSet()
+	err := pgSearch.RunSelectRequestForSchemaFn[NodeCVEQueryResponse](ctx, rg.db,
+		nodeQueryParts.Schema, query, func(r *NodeCVEQueryResponse) error {
+			cveResponses = append(cveResponses, r)
+			if r.GetCVEID() != "" {
+				cveIDs.Add(r.GetCVEID())
+			}
+			return nil
+		})
+	if err != nil {
+		return nil, 0, errors.Wrap(err, "Failed to collect node CVE report data")
+	}
+
+	cveResponses, err = rg.withCVEReferenceLinks(ctx, cveResponses, cveIDs)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return cveResponses, len(cveResponses), nil
+}
+
+func (rg *nodeReportGeneratorImpl) getClustersAndNamespacesForSAC(ctx context.Context) ([]effectiveaccessscope.Cluster, []effectiveaccessscope.Namespace, error) {
+	allClusters, err := rg.clusterDatastore.GetClusters(ctx)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "error fetching clusters to build report query")
+	}
+	allNamespaces, err := rg.namespaceDatastore.GetAllNamespaces(ctx)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "error fetching namespaces to build report query")
+	}
+	return storagetoeffectiveaccessscope.Clusters(allClusters), storagetoeffectiveaccessscope.Namespaces(allNamespaces), nil
+}
+
+func (rg *nodeReportGeneratorImpl) withCVEReferenceLinks(ctx context.Context, responses []*NodeCVEQueryResponse, cveIDs set.StringSet) ([]*NodeCVEQueryResponse, error) {
+	nodeCVEs, err := rg.nodeCVEDatastore.GetBatch(ctx, cveIDs.AsSlice())
+	if err != nil {
+		return nil, err
+	}
+
+	cveRefLinks := make(map[string]string, len(nodeCVEs))
+	for _, cve := range nodeCVEs {
+		cveRefLinks[cve.GetId()] = cve.GetCveBaseInfo().GetLink()
+	}
+
+	for _, res := range responses {
+		if link, ok := cveRefLinks[res.GetCVEID()]; ok {
+			res.Link = link
+		}
+	}
+	return responses, nil
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/report_gen_impl_test.go b/central/reports/scheduler/v2/reportgenerator/node/report_gen_impl_test.go
new file mode 100644
index 0000000000000..81a0c959e7a1c
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/report_gen_impl_test.go
@@ -0,0 +1,387 @@
+//go:build sql_integration
+
+package node
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	clusterDSMocks "github.com/stackrox/rox/central/cluster/datastore/mocks"
+	nodeCVEDS "github.com/stackrox/rox/central/cve/node/datastore"
+	namespaceDSMocks "github.com/stackrox/rox/central/namespace/datastore/mocks"
+	nodeDS "github.com/stackrox/rox/central/node/datastore"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/fixtures"
+	"github.com/stackrox/rox/pkg/postgres/pgtest"
+	postgresSchema "github.com/stackrox/rox/pkg/postgres/schema"
+	"github.com/stackrox/rox/pkg/protocompat"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/set"
+	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/mock/gomock"
+)
+
+type nodeReportData struct {
+	clusterNames   []string
+	nodeNames      []string
+	componentNames []string
+	cveNames       []string
+}
+
+func TestNodeReportGenerator(t *testing.T) {
+	suite.Run(t, new(NodeReportGeneratorTestSuite))
+}
+
+type NodeReportGeneratorTestSuite struct {
+	suite.Suite
+
+	ctx                context.Context
+	testDB             *pgtest.TestPostgres
+	clusterDatastore   *clusterDSMocks.MockDataStore
+	namespaceDatastore *namespaceDSMocks.MockDataStore
+	nodeDatastore      nodeDS.DataStore
+	nodeCVEDatastore   nodeCVEDS.DataStore
+	reportGenerator    *nodeReportGeneratorImpl
+
+	clusters   []*storage.Cluster
+	namespaces []*storage.NamespaceMetadata
+}
+
+func (s *NodeReportGeneratorTestSuite) SetupSuite() {
+	s.ctx = sac.WithAllAccess(context.Background())
+	mockCtrl := gomock.NewController(s.T())
+	s.testDB = pgtest.ForT(s.T())
+
+	s.clusterDatastore = clusterDSMocks.NewMockDataStore(mockCtrl)
+	s.namespaceDatastore = namespaceDSMocks.NewMockDataStore(mockCtrl)
+
+	s.nodeDatastore = nodeDS.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+	var err error
+	s.nodeCVEDatastore, err = nodeCVEDS.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+	s.Require().NoError(err)
+
+	s.clusters = []*storage.Cluster{
+		{Id: uuid.NewV4().String(), Name: "c1"},
+		{Id: uuid.NewV4().String(), Name: "c2"},
+	}
+	s.namespaces = []*storage.NamespaceMetadata{
+		{Id: uuid.NewV4().String(), Name: "ns1", ClusterId: s.clusters[0].GetId(), ClusterName: "c1"},
+		{Id: uuid.NewV4().String(), Name: "ns2", ClusterId: s.clusters[1].GetId(), ClusterName: "c2"},
+	}
+	s.clusterDatastore.EXPECT().GetClusters(gomock.Any()).
+		Return(s.clusters, nil).AnyTimes()
+	s.namespaceDatastore.EXPECT().GetAllNamespaces(gomock.Any()).
+		Return(s.namespaces, nil).AnyTimes()
+
+	nodes := s.testNodes()
+	for _, node := range nodes {
+		s.Require().NoError(s.nodeDatastore.UpsertNode(s.ctx, node))
+	}
+
+	s.reportGenerator = &nodeReportGeneratorImpl{
+		clusterDatastore:   s.clusterDatastore,
+		namespaceDatastore: s.namespaceDatastore,
+		nodeCVEDatastore:   s.nodeCVEDatastore,
+		db:                 s.testDB.DB,
+	}
+}
+
+func (s *NodeReportGeneratorTestSuite) TearDownSuite() {
+	s.truncateTable(postgresSchema.NodeCvesTableName)
+	s.truncateTable(postgresSchema.NodeComponentsCvesEdgesTableName)
+	s.truncateTable(postgresSchema.NodeComponentsTableName)
+	s.truncateTable(postgresSchema.NodeComponentEdgesTableName)
+	s.truncateTable(postgresSchema.NodesTableName)
+}
+
+func (s *NodeReportGeneratorTestSuite) truncateTable(name string) {
+	sql := fmt.Sprintf("TRUNCATE %s CASCADE", name)
+	_, err := s.testDB.Exec(s.ctx, sql)
+	s.NoError(err)
+}
+
+func (s *NodeReportGeneratorTestSuite) testNodes() []*storage.Node {
+	t, err := protocompat.ConvertTimeToTimestampOrError(time.Unix(0, 1000))
+	s.Require().NoError(err)
+
+	var nodes []*storage.Node
+	for _, cluster := range s.clusters {
+		for i := range 2 {
+			nodeName := fmt.Sprintf("%s_node%d", cluster.GetName(), i)
+			node := &storage.Node{
+				Id:          uuid.NewV4().String(),
+				Name:        nodeName,
+				ClusterId:   cluster.GetId(),
+				ClusterName: cluster.GetName(),
+				Scan: &storage.NodeScan{
+					ScanTime:        protocompat.TimestampNow(),
+					OperatingSystem: "linux",
+					Components: []*storage.EmbeddedNodeScanComponent{
+						{
+							Name:    fmt.Sprintf("%s_comp", nodeName),
+							Version: "1.0",
+							Vulnerabilities: []*storage.NodeVulnerability{
+								{
+									CveBaseInfo: &storage.CVEInfo{
+										Cve:       fmt.Sprintf("CVE-critical-%s_comp", nodeName),
+										CreatedAt: t,
+									},
+									Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
+									Cvss:     9.0,
+									SetFixedBy: &storage.NodeVulnerability_FixedBy{
+										FixedBy: "1.1",
+									},
+								},
+								{
+									CveBaseInfo: &storage.CVEInfo{
+										Cve:       fmt.Sprintf("CVE-low-%s_comp", nodeName),
+										CreatedAt: t,
+									},
+									Severity: storage.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY,
+									Cvss:     2.0,
+								},
+							},
+						},
+					},
+				},
+			}
+			nodes = append(nodes, node)
+		}
+	}
+	return nodes
+}
+
+func (s *NodeReportGeneratorTestSuite) TestGetReportData_AllNodes() {
+	snap := s.testNodeReportSnapshot(nil, "", nil, storage.ReportStatus_ON_DEMAND)
+	cveResponses, _, err := s.reportGenerator.getReportData(s.ctx, snap)
+	s.NoError(err)
+
+	collected := collectNodeReportData(cveResponses)
+	s.ElementsMatch([]string{"c1", "c2"}, collected.clusterNames)
+	s.ElementsMatch(
+		[]string{"c1_node0", "c1_node1", "c2_node0", "c2_node1"},
+		collected.nodeNames,
+	)
+	s.ElementsMatch(
+		[]string{"c1_node0_comp", "c1_node1_comp", "c2_node0_comp", "c2_node1_comp"},
+		collected.componentNames,
+	)
+	s.ElementsMatch(
+		[]string{
+			"CVE-critical-c1_node0_comp", "CVE-low-c1_node0_comp",
+			"CVE-critical-c1_node1_comp", "CVE-low-c1_node1_comp",
+			"CVE-critical-c2_node0_comp", "CVE-low-c2_node0_comp",
+			"CVE-critical-c2_node1_comp", "CVE-low-c2_node1_comp",
+		},
+		collected.cveNames,
+	)
+}
+
+func (s *NodeReportGeneratorTestSuite) TestGetReportData_EntityScope_SingleCluster() {
+	entityScope := &storage.EntityScope{
+		Rules: []*storage.EntityScopeRule{
+			{
+				Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+				Field:  storage.EntityField_FIELD_NAME,
+				Values: []*storage.RuleValue{
+					{Value: "c1", MatchType: storage.MatchType_EXACT},
+				},
+			},
+		},
+	}
+	scopeRules := []*storage.SimpleAccessScope_Rules{
+		{IncludedClusters: []string{"c1"}},
+	}
+	snap := s.testNodeReportSnapshot(entityScope, "", scopeRules, storage.ReportStatus_ON_DEMAND)
+	cveResponses, _, err := s.reportGenerator.getReportData(s.ctx, snap)
+	s.NoError(err)
+
+	collected := collectNodeReportData(cveResponses)
+	s.ElementsMatch([]string{"c1"}, collected.clusterNames)
+	s.ElementsMatch([]string{"c1_node0", "c1_node1"}, collected.nodeNames)
+	s.ElementsMatch([]string{"c1_node0_comp", "c1_node1_comp"}, collected.componentNames)
+	s.ElementsMatch(
+		[]string{
+			"CVE-critical-c1_node0_comp", "CVE-low-c1_node0_comp",
+			"CVE-critical-c1_node1_comp", "CVE-low-c1_node1_comp",
+		},
+		collected.cveNames,
+	)
+}
+
+func (s *NodeReportGeneratorTestSuite) TestGetReportData_PartiallyIncludedCluster() {
+	// User has namespace-only access (no cluster-level rule) for c1.
+	// Nodes from c1 should still be visible because the cluster is partially included.
+	scopeRules := []*storage.SimpleAccessScope_Rules{
+		{
+			IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+				{ClusterName: "c1", NamespaceName: "ns1"},
+			},
+		},
+	}
+	snap := s.testNodeReportSnapshot(nil, "", scopeRules, storage.ReportStatus_VIEW_BASED)
+	cveResponses, _, err := s.reportGenerator.getReportData(s.ctx, snap)
+	s.NoError(err)
+
+	collected := collectNodeReportData(cveResponses)
+	s.ElementsMatch([]string{"c1"}, collected.clusterNames)
+	s.ElementsMatch([]string{"c1_node0", "c1_node1"}, collected.nodeNames)
+}
+
+func (s *NodeReportGeneratorTestSuite) TestGetReportData_EntityScope_WithCVSSFilter() {
+	entityScope := &storage.EntityScope{
+		Rules: []*storage.EntityScopeRule{
+			{
+				Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+				Field:  storage.EntityField_FIELD_NAME,
+				Values: []*storage.RuleValue{
+					{Value: "c1", MatchType: storage.MatchType_EXACT},
+				},
+			},
+		},
+	}
+	scopeRules := []*storage.SimpleAccessScope_Rules{
+		{IncludedClusters: []string{"c1"}},
+	}
+	snap := s.testNodeReportSnapshot(entityScope, "CVSS:>=7.0", scopeRules, storage.ReportStatus_ON_DEMAND)
+	cveResponses, _, err := s.reportGenerator.getReportData(s.ctx, snap)
+	s.NoError(err)
+
+	collected := collectNodeReportData(cveResponses)
+	s.ElementsMatch([]string{"c1"}, collected.clusterNames)
+	s.ElementsMatch([]string{"c1_node0", "c1_node1"}, collected.nodeNames)
+	s.ElementsMatch([]string{"c1_node0_comp", "c1_node1_comp"}, collected.componentNames)
+	s.ElementsMatch(
+		[]string{
+			"CVE-critical-c1_node0_comp",
+			"CVE-critical-c1_node1_comp",
+		},
+		collected.cveNames,
+	)
+}
+
+func (s *NodeReportGeneratorTestSuite) TestGetReportData_ViewBased() {
+	scopeRules := []*storage.SimpleAccessScope_Rules{
+		{IncludedClusters: []string{"c1"}},
+	}
+	snap := s.testNodeReportSnapshot(nil, "CVSS:>=7.0", scopeRules, storage.ReportStatus_VIEW_BASED)
+	cveResponses, _, err := s.reportGenerator.getReportData(s.ctx, snap)
+	s.NoError(err)
+
+	collected := collectNodeReportData(cveResponses)
+	s.ElementsMatch([]string{"c1"}, collected.clusterNames)
+	s.ElementsMatch([]string{"c1_node0", "c1_node1"}, collected.nodeNames)
+	s.ElementsMatch([]string{"c1_node0_comp", "c1_node1_comp"}, collected.componentNames)
+	s.ElementsMatch(
+		[]string{
+			"CVE-critical-c1_node0_comp",
+			"CVE-critical-c1_node1_comp",
+		},
+		collected.cveNames,
+	)
+}
+
+func (s *NodeReportGeneratorTestSuite) TestGetReportData_ClusterRegexScope() {
+	entityScope := &storage.EntityScope{
+		Rules: []*storage.EntityScopeRule{
+			{
+				Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+				Field:  storage.EntityField_FIELD_NAME,
+				Values: []*storage.RuleValue{
+					{Value: "c.*", MatchType: storage.MatchType_REGEX},
+				},
+			},
+		},
+	}
+	snap := s.testNodeReportSnapshot(entityScope, "", nil, storage.ReportStatus_ON_DEMAND)
+	cveResponses, _, err := s.reportGenerator.getReportData(s.ctx, snap)
+	s.NoError(err)
+
+	collected := collectNodeReportData(cveResponses)
+	s.ElementsMatch([]string{"c1", "c2"}, collected.clusterNames)
+	s.ElementsMatch(
+		[]string{"c1_node0", "c1_node1", "c2_node0", "c2_node1"},
+		collected.nodeNames,
+	)
+	s.ElementsMatch(
+		[]string{"c1_node0_comp", "c1_node1_comp", "c2_node0_comp", "c2_node1_comp"},
+		collected.componentNames,
+	)
+	s.ElementsMatch(
+		[]string{
+			"CVE-critical-c1_node0_comp", "CVE-low-c1_node0_comp",
+			"CVE-critical-c1_node1_comp", "CVE-low-c1_node1_comp",
+			"CVE-critical-c2_node0_comp", "CVE-low-c2_node0_comp",
+			"CVE-critical-c2_node1_comp", "CVE-low-c2_node1_comp",
+		},
+		collected.cveNames,
+	)
+}
+
+func (s *NodeReportGeneratorTestSuite) TestGetReportData_CancelledContext() {
+	snap := s.testNodeReportSnapshot(nil, "", nil, storage.ReportStatus_ON_DEMAND)
+	ctx, cancel := context.WithCancel(s.ctx)
+	cancel()
+
+	_, _, err := s.reportGenerator.getReportData(ctx, snap)
+	s.Error(err)
+	s.ErrorIs(err, context.Canceled)
+}
+
+func (s *NodeReportGeneratorTestSuite) testNodeReportSnapshot(
+	entityScope *storage.EntityScope,
+	query string,
+	scopeRules []*storage.SimpleAccessScope_Rules,
+	requestType storage.ReportStatus_RunMethod,
+) *storage.ReportSnapshot {
+	snap := fixtures.GetReportSnapshot()
+	snap.Filter = &storage.ReportSnapshot_NodeVulnReportFilters{
+		NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+			Query:            query,
+			AccessScopeRules: scopeRules,
+		},
+	}
+	snap.ReportStatus = &storage.ReportStatus{
+		ReportRequestType: requestType,
+	}
+	if entityScope != nil {
+		snap.ResourceScope = &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: entityScope,
+			},
+		}
+	} else {
+		snap.ResourceScope = nil
+	}
+	snap.Collection = nil
+	return snap
+}
+
+func collectNodeReportData(responses []*NodeCVEQueryResponse) *nodeReportData {
+	clusterNames := set.NewStringSet()
+	nodeNames := set.NewStringSet()
+	componentNames := set.NewStringSet()
+	cveNames := make([]string, 0, len(responses))
+
+	for _, res := range responses {
+		if res.GetCluster() != "" {
+			clusterNames.Add(res.GetCluster())
+		}
+		if res.GetNode() != "" {
+			nodeNames.Add(res.GetNode())
+		}
+		if res.GetComponent() != "" {
+			componentNames.Add(res.GetComponent())
+		}
+		cveNames = append(cveNames, res.GetCVE())
+	}
+	return &nodeReportData{
+		clusterNames:   clusterNames.AsSlice(),
+		nodeNames:      nodeNames.AsSlice(),
+		componentNames: componentNames.AsSlice(),
+		cveNames:       cveNames,
+	}
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/singleton.go b/central/reports/scheduler/v2/reportgenerator/node/singleton.go
new file mode 100644
index 0000000000000..20788359a00d3
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/singleton.go
@@ -0,0 +1,41 @@
+package node
+
+import (
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	clusterDS "github.com/stackrox/rox/central/cluster/datastore"
+	nodeCVEDS "github.com/stackrox/rox/central/cve/node/datastore"
+	"github.com/stackrox/rox/central/globaldb"
+	namespaceDS "github.com/stackrox/rox/central/namespace/datastore"
+	notifierProcessor "github.com/stackrox/rox/central/notifier/processor"
+	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	"github.com/stackrox/rox/pkg/features"
+	"github.com/stackrox/rox/pkg/sync"
+)
+
+var (
+	once sync.Once
+	rg   reportGen.ReportGenerator
+)
+
+func initialize() {
+	if !features.NodeVulnerabilityReports.Enabled() {
+		return
+	}
+	rg = New(
+		globaldb.GetPostgres(),
+		reportSnapshotDS.Singleton(),
+		notifierProcessor.Singleton(),
+		blobDS.Singleton(),
+		clusterDS.Singleton(),
+		namespaceDS.Singleton(),
+		nodeCVEDS.Singleton(),
+	)
+}
+
+// Singleton returns a singleton instance of the node ReportGenerator.
+// Returns nil when the NodeVulnerabilityReports feature flag is disabled.
+func Singleton() reportGen.ReportGenerator {
+	once.Do(initialize)
+	return rg
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/node/types.go b/central/reports/scheduler/v2/reportgenerator/node/types.go
new file mode 100644
index 0000000000000..7ae1c5418e752
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/node/types.go
@@ -0,0 +1,115 @@
+package node
+
+import (
+	"time"
+
+	"github.com/stackrox/rox/generated/storage"
+)
+
+// NodeCVEQueryResponse contains the fields of a node CVE report query response.
+type NodeCVEQueryResponse struct {
+	Cluster          *string                        `db:"cluster"`
+	Node             *string                        `db:"node"`
+	OperatingSystem  *string                        `db:"operating_system"`
+	Component        *string                        `db:"component"`
+	ComponentVersion *string                        `db:"component_version"`
+	CVEID            *string                        `db:"cve_id"`
+	CVE              *string                        `db:"cve"`
+	Fixable          *bool                          `db:"fixable"`
+	FixedByVersion   *string                        `db:"fixed_by"`
+	Severity         *storage.VulnerabilitySeverity `db:"severity"`
+	CVSS             *float64                       `db:"cvss"`
+	FirstOccurrence  *time.Time                     `db:"cve_created_time"`
+
+	Link string
+}
+
+func (r *NodeCVEQueryResponse) GetCluster() string {
+	if r.Cluster == nil {
+		return ""
+	}
+	return *r.Cluster
+}
+
+func (r *NodeCVEQueryResponse) GetNode() string {
+	if r.Node == nil {
+		return ""
+	}
+	return *r.Node
+}
+
+func (r *NodeCVEQueryResponse) GetOperatingSystem() string {
+	// Nodes scanned without OS metadata come back as an empty string rather than
+	// NULL, so both cases need the placeholder.
+	if r.OperatingSystem == nil || *r.OperatingSystem == "" {
+		return "Not Available"
+	}
+	return *r.OperatingSystem
+}
+
+func (r *NodeCVEQueryResponse) GetComponent() string {
+	if r.Component == nil {
+		return ""
+	}
+	return *r.Component
+}
+
+func (r *NodeCVEQueryResponse) GetComponentVersion() string {
+	if r.ComponentVersion == nil {
+		return ""
+	}
+	return *r.ComponentVersion
+}
+
+func (r *NodeCVEQueryResponse) GetCVEID() string {
+	if r.CVEID == nil {
+		return ""
+	}
+	return *r.CVEID
+}
+
+func (r *NodeCVEQueryResponse) GetCVE() string {
+	if r.CVE == nil {
+		return ""
+	}
+	return *r.CVE
+}
+
+func (r *NodeCVEQueryResponse) GetFixable() bool {
+	if r.Fixable == nil {
+		return false
+	}
+	return *r.Fixable
+}
+
+func (r *NodeCVEQueryResponse) GetFixedByVersion() string {
+	if r.FixedByVersion == nil {
+		return ""
+	}
+	return *r.FixedByVersion
+}
+
+func (r *NodeCVEQueryResponse) GetSeverity() storage.VulnerabilitySeverity {
+	if r.Severity == nil {
+		return storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY
+	}
+	return *r.Severity
+}
+
+func (r *NodeCVEQueryResponse) GetCVSS() float64 {
+	if r.CVSS == nil {
+		return 0.0
+	}
+	return *r.CVSS
+}
+
+func (r *NodeCVEQueryResponse) GetFirstOccurrence() string {
+	if r.FirstOccurrence == nil {
+		return "Not Available"
+	}
+	return r.FirstOccurrence.Format("January 02, 2006")
+}
+
+func (r *NodeCVEQueryResponse) GetLink() string {
+	return r.Link
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/report_gen.go b/central/reports/scheduler/v2/reportgenerator/report_gen.go
index b5916603941b9..92879bcc33aa3 100644
--- a/central/reports/scheduler/v2/reportgenerator/report_gen.go
+++ b/central/reports/scheduler/v2/reportgenerator/report_gen.go
@@ -3,7 +3,6 @@ package reportgenerator
 import (
 	"context"
 
-	"github.com/graph-gophers/graphql-go"
 	blobDS "github.com/stackrox/rox/central/blob/datastore"
 	clusterDS "github.com/stackrox/rox/central/cluster/datastore"
 	imageCVE2DS "github.com/stackrox/rox/central/cve/image/v2/datastore"
@@ -39,7 +38,6 @@ func New(
 	clusterDatastore clusterDS.DataStore,
 	namespaceDatastore namespaceDS.DataStore,
 	imageCVE2DataStore imageCVE2DS.DataStore,
-	schema *graphql.Schema,
 ) ReportGenerator {
 	return newReportGeneratorImpl(
 		db,
@@ -52,7 +50,6 @@ func New(
 		clusterDatastore,
 		namespaceDatastore,
 		imageCVE2DataStore,
-		schema,
 	)
 }
 
@@ -67,7 +64,6 @@ func newReportGeneratorImpl(
 	clusterDatastore clusterDS.DataStore,
 	namespaceDatastore namespaceDS.DataStore,
 	imageCVE2Datastore imageCVE2DS.DataStore,
-	schema *graphql.Schema,
 ) *reportGeneratorImpl {
 	return &reportGeneratorImpl{
 		reportSnapshotStore:     reportSnapshotStore,
@@ -80,6 +76,5 @@ func newReportGeneratorImpl(
 		imageCVE2Datastore:      imageCVE2Datastore,
 		blobStore:               blobStore,
 		db:                      db,
-		Schema:                  schema,
 	}
 }
diff --git a/central/reports/scheduler/v2/reportgenerator/report_gen_bench_flat_data_model_test.go b/central/reports/scheduler/v2/reportgenerator/report_gen_bench_flat_data_model_test.go
index 5bbef7cfb9604..f0a1f356215d0 100644
--- a/central/reports/scheduler/v2/reportgenerator/report_gen_bench_flat_data_model_test.go
+++ b/central/reports/scheduler/v2/reportgenerator/report_gen_bench_flat_data_model_test.go
@@ -7,7 +7,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/graph-gophers/graphql-go"
 	clusterDSMocks "github.com/stackrox/rox/central/cluster/datastore/mocks"
 	"github.com/stackrox/rox/central/graphql/resolvers"
 	"github.com/stackrox/rox/central/graphql/resolvers/loaders"
@@ -96,11 +95,10 @@ func (bts *FlatDataModelReportGeneratorBenchmarkTestSuite) setupTestSuite() {
 
 	// set up tables
 	bts.watchedImageDatastore = watchedImageDS.GetTestPostgresDataStore(bts.b, bts.testDB.DB)
-	var schema *graphql.Schema
 	// TODO(ROX-30117): Remove conditional when FlattenImageData feature flag is removed.
 	if features.FlattenImageData.Enabled() {
 		imgV2DataStore := resolvers.CreateTestImageV2Datastore(bts.b, bts.testDB, mockCtrl)
-		bts.resolver, schema = resolvers.SetupTestResolver(bts.b,
+		bts.resolver, _ = resolvers.SetupTestResolver(bts.b,
 			imagesView.NewImageView(bts.testDB.DB),
 			imgV2DataStore,
 			resolvers.CreateTestImageComponentV2Datastore(bts.b, bts.testDB, mockCtrl),
@@ -110,7 +108,7 @@ func (bts *FlatDataModelReportGeneratorBenchmarkTestSuite) setupTestSuite() {
 		)
 	} else {
 		imageDataStore := resolvers.CreateTestImageDatastore(bts.b, bts.testDB, mockCtrl)
-		bts.resolver, schema = resolvers.SetupTestResolver(bts.b,
+		bts.resolver, _ = resolvers.SetupTestResolver(bts.b,
 			imagesView.NewImageView(bts.testDB.DB),
 			imageDataStore,
 			resolvers.CreateTestImageComponentV2Datastore(bts.b, bts.testDB, mockCtrl),
@@ -127,7 +125,7 @@ func (bts *FlatDataModelReportGeneratorBenchmarkTestSuite) setupTestSuite() {
 
 	bts.reportGenerator = newReportGeneratorImpl(bts.testDB, nil, bts.resolver.DeploymentDataStore,
 		bts.watchedImageDatastore, collectionQueryResolver, nil, nil, bts.clusterDatastore,
-		bts.namespaceDatastore, bts.resolver.ImageCVEV2DataStore, schema)
+		bts.namespaceDatastore, bts.resolver.ImageCVEV2DataStore)
 }
 
 func BenchmarkEntityScopeReportGenerator(b *testing.B) {
@@ -136,11 +134,10 @@ func BenchmarkEntityScopeReportGenerator(b *testing.B) {
 	testDB := pgtest.ForT(b)
 
 	watchedImageDatastore := watchedImageDS.GetTestPostgresDataStore(b, testDB.DB)
-	var schema *graphql.Schema
 	var resolver *resolvers.Resolver
 	if features.FlattenImageData.Enabled() {
 		imgV2DataStore := resolvers.CreateTestImageV2Datastore(b, testDB, mockCtrl)
-		resolver, schema = resolvers.SetupTestResolver(b,
+		resolver, _ = resolvers.SetupTestResolver(b,
 			imagesView.NewImageView(testDB.DB),
 			imgV2DataStore,
 			resolvers.CreateTestImageComponentV2Datastore(b, testDB, mockCtrl),
@@ -150,7 +147,7 @@ func BenchmarkEntityScopeReportGenerator(b *testing.B) {
 		)
 	} else {
 		imageDataStore := resolvers.CreateTestImageDatastore(b, testDB, mockCtrl)
-		resolver, schema = resolvers.SetupTestResolver(b,
+		resolver, _ = resolvers.SetupTestResolver(b,
 			imagesView.NewImageView(testDB.DB),
 			imageDataStore,
 			resolvers.CreateTestImageComponentV2Datastore(b, testDB, mockCtrl),
@@ -166,7 +163,7 @@ func BenchmarkEntityScopeReportGenerator(b *testing.B) {
 
 	reportGenerator := newReportGeneratorImpl(testDB, nil, resolver.DeploymentDataStore,
 		watchedImageDatastore, nil, nil, nil, clusterDatastore,
-		nsDatastore, resolver.ImageCVEV2DataStore, schema)
+		nsDatastore, resolver.ImageCVEV2DataStore)
 
 	clusters := []*storage.Cluster{
 		{Id: uuid.NewV4().String(), Name: "c1"},
diff --git a/central/reports/scheduler/v2/reportgenerator/report_gen_impl.go b/central/reports/scheduler/v2/reportgenerator/report_gen_impl.go
index c9f0fd98a514b..ce4e4f4b144b2 100644
--- a/central/reports/scheduler/v2/reportgenerator/report_gen_impl.go
+++ b/central/reports/scheduler/v2/reportgenerator/report_gen_impl.go
@@ -1,12 +1,14 @@
 package reportgenerator
 
 import (
+	"archive/zip"
 	"bytes"
 	"context"
+	"encoding/csv"
+	"io"
 	"slices"
 	"time"
 
-	"github.com/graph-gophers/graphql-go"
 	"github.com/pkg/errors"
 	blobDS "github.com/stackrox/rox/central/blob/datastore"
 	clusterDS "github.com/stackrox/rox/central/cluster/datastore"
@@ -24,6 +26,7 @@ import (
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/errorhelpers"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/grpc/authz/allow"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/notifier"
@@ -32,13 +35,11 @@ import (
 	pkgSchema "github.com/stackrox/rox/pkg/postgres/schema"
 	"github.com/stackrox/rox/pkg/postgres/walker"
 	"github.com/stackrox/rox/pkg/protocompat"
-	"github.com/stackrox/rox/pkg/retry"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/sac/effectiveaccessscope"
 	"github.com/stackrox/rox/pkg/search"
 	pgSearch "github.com/stackrox/rox/pkg/search/postgres"
 	"github.com/stackrox/rox/pkg/set"
-	"github.com/stackrox/rox/pkg/utils"
 )
 
 var (
@@ -64,6 +65,7 @@ var (
 			Offset(int32(0)).
 			AddSortOption(search.NewSortOption(search.ImageName)).Proto(),
 	}
+	cursorBatchSize = env.PostgresDefaultCursorBatchSize.IntegerSetting()
 )
 
 type reportGeneratorImpl struct {
@@ -77,8 +79,6 @@ type reportGeneratorImpl struct {
 	namespaceDatastore      namespaceDS.DataStore
 	imageCVE2Datastore      imageCVE2DS.DataStore
 	db                      postgres.DB
-
-	Schema *graphql.Schema
 }
 
 type ImageCVEInterface interface {
@@ -143,12 +143,16 @@ func (rg *reportGeneratorImpl) generateReportAndNotify(ctx context.Context, req
 	// Get the results of running the report query
 	var err error
 	var reportData *ReportData
-	if req.ReportSnapshot.GetVulnReportFilters() != nil {
-		reportData, err = rg.getReportDataSQF(ctx, req.ReportSnapshot, req.Collection, req.DataStartTime)
-	}
-	if req.ReportSnapshot.GetViewBasedVulnReportFilters() != nil {
-		reportData, err = rg.getReportDataViewBased(ctx, req.ReportSnapshot)
+	if req.ReportSnapshot.GetReportStatus().GetReportNotificationMethod() == storage.ReportStatus_DOWNLOAD {
+		if features.VulnerabilityReportStreamingDownload.Enabled() {
+			log.Info("Streaming report generation")
+			return rg.generateReportTransaction(ctx, req)
+		}
+		return rg.generateReportInMemoryDownload(ctx, req)
 	}
+
+	// EMAIL path: use existing in-memory approach (email attachments have practical size limits)
+	reportData, err = rg.getReportDataSQF(ctx, req.ReportSnapshot, req.Collection, req.DataStartTime)
 	if err != nil {
 		return err
 	}
@@ -172,89 +176,312 @@ func (rg *reportGeneratorImpl) generateReportAndNotify(ctx context.Context, req
 		return err
 	}
 
-	switch req.ReportSnapshot.GetReportStatus().GetReportNotificationMethod() {
-	case storage.ReportStatus_DOWNLOAD:
-		parentDir := req.ReportSnapshot.GetReportConfigurationId()
-		if req.ReportSnapshot.GetVulnReportFilters() == nil {
-			parentDir = "view-based-report"
+	defaultEmailSubject, err := FormatEmailSubject(defaultEmailSubjectTemplate, req.ReportSnapshot)
+	if err != nil {
+		return errors.Wrap(err, "Error generating email subject")
+	}
+	templateStr := defaultEmailBodyTemplate
+	if reportData.NumDeployedImageResults == 0 && reportData.NumWatchedImageResults == 0 {
+		zippedCSVData = nil
+		templateStr = defaultNoVulnsEmailBodyTemplate
+	}
+
+	defaultEmailBody, err := FormatEmailBody(templateStr)
+	if err != nil {
+		return errors.Wrap(err, "Error generating email body")
+	}
+
+	configDetailsHTML, err := formatReportConfigDetails(req.ReportSnapshot, reportData.NumDeployedImageResults,
+		reportData.NumWatchedImageResults)
+	if err != nil {
+		return errors.Wrap(err, "Error adding report config details")
+	}
+
+	errorList := errorhelpers.NewErrorList("Error sending email notifications: ")
+	for _, notifierSnap := range req.ReportSnapshot.GetNotifiers() {
+		nf := rg.notificationProcessor.GetNotifier(reportGenCtx, notifierSnap.GetEmailConfig().GetNotifierId())
+		reportNotifier, ok := nf.(notifiers.ReportNotifier)
+		if !ok {
+			errorList.AddError(errors.Errorf("incorrect type of notifier '%s'", notifierSnap.GetEmailConfig().GetNotifierId()))
+			continue
+		}
+		customBody := notifierSnap.GetEmailConfig().GetCustomBody()
+		emailBody := defaultEmailBody
+		if customBody != "" {
+			emailBody = customBody
 		}
-		if err = rg.saveReportData(ctx, parentDir,
-			req.ReportSnapshot.GetReportId(), zippedCSVData); err != nil {
-			return errors.Wrap(err, "error persisting blob")
+		customSubject := notifierSnap.GetEmailConfig().GetCustomSubject()
+		emailSubject := defaultEmailSubject
+		if customSubject != "" {
+			emailSubject = customSubject
 		}
+		emailBodyWithConfigDetails := AddReportConfigDetails(emailBody, configDetailsHTML)
+		reportName := req.ReportSnapshot.GetName()
+		err := rg.retryableSendReportResults(reportNotifier, notifierSnap.GetEmailConfig().GetMailingLists(),
+			zippedCSVData, emailSubject, emailBodyWithConfigDetails, reportName)
+		if err != nil {
+			errorList.AddError(errors.Errorf("Error sending email for notifier '%s': %s",
+				notifierSnap.GetEmailConfig().GetNotifierId(), err))
+		}
+	}
+	if !errorList.Empty() {
+		return errorList.ToError()
+	}
+	return nil
+}
+
+// generateReportInMemoryDownload accumulates report data in memory, builds the CSV/ZIP, and stores it in blob storage.
+func (rg *reportGeneratorImpl) generateReportInMemoryDownload(ctx context.Context, req *ReportRequest) error {
+	snap := req.ReportSnapshot
+
+	var reportData *ReportData
+	var err error
+	if snap.GetViewBasedVulnReportFilters() != nil {
+		reportData, err = rg.getReportDataViewBased(ctx, snap)
+	} else {
+		reportData, err = rg.getReportDataSQF(ctx, snap, req.Collection, req.DataStartTime)
+	}
+	if err != nil {
+		return err
+	}
+
+	zippedCSVData, err := GenerateCSV(reportData.CVEResponses, snap.GetName())
+	if err != nil {
+		return err
+	}
+
+	parentDir := snap.GetReportConfigurationId()
+	if snap.GetVulnReportFilters() == nil {
+		parentDir = "view-based-report"
+	}
+	if err := rg.saveReportData(ctx, parentDir, snap.GetReportId(), zippedCSVData); err != nil {
+		return errors.Wrap(err, "error saving report to blob store")
+	}
+
+	snap.ReportStatus.CompletedAt = protocompat.TimestampNow()
+	if err := rg.updateReportStatus(snap, storage.ReportStatus_GENERATED); err != nil {
+		return errors.Wrap(err, "Error changing report status to GENERATED")
+	}
+	return nil
+}
+
+type querySpec struct {
+	schema *walker.Schema
+	query  *v1.Query
+}
+
+// buildReportQueries constructs the cursor queries for a report request.
+func (rg *reportGeneratorImpl) buildReportQueries(ctx context.Context, req *ReportRequest) ([]querySpec, error) {
+	var queries []querySpec
+	snap := req.ReportSnapshot
 
-	case storage.ReportStatus_EMAIL:
-		defaultEmailSubject, err := formatEmailSubject(defaultEmailSubjectTemplate, req.ReportSnapshot)
+	if snap.GetVulnReportFilters() != nil {
+		rQuery, err := rg.buildReportQuery(ctx, snap, req.Collection, req.DataStartTime)
 		if err != nil {
-			return errors.Wrap(err, "Error generating email subject")
+			return nil, err
 		}
-		// If it is an empty report, do not send an attachment in the final notification email and the email body
-		// will indicate that no vulns were found
-		templateStr := defaultEmailBodyTemplate
-		if reportData.NumDeployedImageResults == 0 && reportData.NumWatchedImageResults == 0 {
-			// If it is an empty report, the email body will indicate that no vulns were found
-			zippedCSVData = nil
-			templateStr = defaultNoVulnsEmailBodyTemplate
+		cveFilterQuery, err := search.ParseQuery(rQuery.CveFieldsQuery, search.MatchAllIfEmpty())
+		if err != nil {
+			return nil, err
 		}
-
-		defaultEmailBody, err := formatEmailBody(templateStr)
+		if slices.Contains(snap.GetVulnReportFilters().GetImageTypes(), storage.VulnerabilityReportFilters_DEPLOYED) {
+			q := search.ConjunctionQuery(rQuery.DeploymentsQuery, cveFilterQuery)
+			q.Pagination = deployedImagesQueryParts.Pagination
+			q.Selects = deployedImagesQueryParts.Selects
+			queries = append(queries, querySpec{schema: deployedImagesQueryParts.Schema, query: q})
+		}
+		if slices.Contains(snap.GetVulnReportFilters().GetImageTypes(), storage.VulnerabilityReportFilters_WATCHED) {
+			watchedImages, err := rg.getWatchedImages(ctx)
+			if err != nil {
+				return nil, err
+			}
+			if len(watchedImages) != 0 {
+				q := search.ConjunctionQuery(
+					search.NewQueryBuilder().AddExactMatches(search.ImageName, watchedImages...).ProtoQuery(),
+					cveFilterQuery)
+				q.Pagination = watchedImagesQueryParts.Pagination
+				q.Selects = watchedImagesQueryParts.Selects
+				queries = append(queries, querySpec{schema: watchedImagesQueryParts.Schema, query: q})
+			}
+		}
+	}
+	if snap.GetViewBasedVulnReportFilters() != nil {
+		watchedImages, err := rg.getWatchedImages(ctx)
 		if err != nil {
-			return errors.Wrap(err, "Error generating email body")
+			return nil, err
 		}
-
-		configDetailsHTML, err := formatReportConfigDetails(req.ReportSnapshot, reportData.NumDeployedImageResults,
-			reportData.NumWatchedImageResults)
+		vbQuery, err := rg.buildReportQueryViewBased(ctx, snap, watchedImages)
 		if err != nil {
-			return errors.Wrap(err, "Error adding report config details")
+			return nil, err
+		}
+		vbQuery.DeployedImagesQuery.Pagination = deployedImagesQueryParts.Pagination
+		vbQuery.DeployedImagesQuery.Selects = deployedImagesQueryParts.Selects
+		queries = append(queries, querySpec{schema: deployedImagesQueryParts.Schema, query: vbQuery.DeployedImagesQuery})
+
+		if len(watchedImages) != 0 {
+			vbQuery.WatchedImagesQuery.Pagination = watchedImagesQueryParts.Pagination
+			vbQuery.WatchedImagesQuery.Selects = watchedImagesQueryParts.Selects
+			queries = append(queries, querySpec{schema: watchedImagesQueryParts.Schema, query: vbQuery.WatchedImagesQuery})
 		}
+	}
+	return queries, nil
+}
+
+// generateReportTransaction runs all report operations — cursor reads, CVE
+// lookups, CSV/ZIP generation, and blob store write — within a single database
+// transaction. The writeFn callback writes directly to a PostgreSQL large
+// object, so memory usage stays constant regardless of report size.
+//
+// Connection usage: 1 connection. All operations (cursor FETCH, CVE lookups,
+// large object writes, metadata upsert) share the same transaction on a single
+// goroutine, so there are no concurrent-tx-access issues.
+func (rg *reportGeneratorImpl) generateReportTransaction(ctx context.Context, req *ReportRequest) error {
+	snap := req.ReportSnapshot
+	queries, err := rg.buildReportQueries(ctx, req)
+	if err != nil {
+		return err
+	}
 
-		errorList := errorhelpers.NewErrorList("Error sending email notifications: ")
-		for _, notifierSnap := range req.ReportSnapshot.GetNotifiers() {
-			nf := rg.notificationProcessor.GetNotifier(reportGenCtx, notifierSnap.GetEmailConfig().GetNotifierId())
-			reportNotifier, ok := nf.(notifiers.ReportNotifier)
-			if !ok {
-				errorList.AddError(errors.Errorf("incorrect type of notifier '%s'", notifierSnap.GetEmailConfig().GetNotifierId()))
-				continue
+	tx, err := rg.db.Begin(ctx)
+	if err != nil {
+		return errors.Wrap(err, "starting report transaction")
+	}
+	committed := false
+	defer func() {
+		if !committed {
+			if rbErr := tx.Rollback(context.Background()); rbErr != nil {
+				log.Errorf("failed to rollback report transaction: %v", rbErr)
 			}
-			customBody := notifierSnap.GetEmailConfig().GetCustomBody()
-			emailBody := defaultEmailBody
-			if customBody != "" {
-				emailBody = customBody
+		}
+	}()
+	txCtx := postgres.ContextWithTx(ctx, tx)
+
+	parentDir := snap.GetReportConfigurationId()
+	if snap.GetVulnReportFilters() == nil {
+		parentDir = "view-based-report"
+	}
+	blobPath := common.GetReportBlobPath(parentDir, snap.GetReportId())
+	blob := &storage.Blob{
+		Name:         blobPath,
+		LastUpdated:  protocompat.TimestampNow(),
+		ModifiedTime: protocompat.TimestampNow(),
+		Length:       -1,
+	}
+
+	//  cveRefLinksCache is a map[string]string that maps CVE ID -> reference URL.
+	//  It caches the "Reference" link for each CVE (the external URL pointing to the CVE advisory, e.g., on NVD).
+	cveRefLinksCache := make(map[string]string)
+	rowCount := 0
+
+	err = rg.blobStore.UpsertWithWriter(txCtx, tx, blob, func(w io.Writer) error {
+		zipWriter := zip.NewWriter(w)
+		zipEntry, err := zipWriter.Create(csvReportName(snap.GetName()))
+		if err != nil {
+			return errors.Wrap(err, "creating zip entry")
+		}
+		csvW := csv.NewWriter(zipEntry)
+		csvW.UseCRLF = true
+		if err := csvW.Write(formatCol()); err != nil {
+			return errors.Wrap(err, "writing CSV header")
+		}
+
+		for _, qs := range queries {
+			if err := rg.streamQueryToCSV(txCtx, qs.schema, qs.query, csvW, cveRefLinksCache, &rowCount); err != nil {
+				return err
 			}
-			customSubject := notifierSnap.GetEmailConfig().GetCustomSubject()
-			emailSubject := defaultEmailSubject
-			if customSubject != "" {
-				emailSubject = customSubject
+		}
+
+		csvW.Flush()
+		if err := csvW.Error(); err != nil {
+			return errors.Wrap(err, "flushing CSV writer")
+		}
+		return zipWriter.Close()
+	})
+	if err != nil {
+		return errors.Wrap(err, "error streaming report to blob store")
+	}
+
+	if err := tx.Commit(context.Background()); err != nil {
+		return errors.Wrap(err, "committing report transaction")
+	}
+	committed = true
+
+	snap.ReportStatus.CompletedAt = protocompat.TimestampNow()
+	if err := rg.updateReportStatus(snap, storage.ReportStatus_GENERATED); err != nil {
+		return errors.Wrap(err, "Error changing report status to GENERATED")
+	}
+	return nil
+}
+
+// streamQueryToCSV runs a cursor-based query and streams each row directly through CSV formatting
+// to the provided csv.Writer. CVE reference links are resolved incrementally in batches and cached.
+func (rg *reportGeneratorImpl) streamQueryToCSV(
+	ctx context.Context,
+	schema *walker.Schema,
+	query *v1.Query,
+	csvW *csv.Writer,
+	cveRefLinksCache map[string]string,
+	rowCount *int,
+) error {
+	var batch []*ImageCVEQueryResponse
+
+	flushBatch := func() error {
+		unseenIDs := set.NewStringSet()
+		for _, r := range batch {
+			id := r.GetCVEID()
+			if id != "" {
+				if _, cached := cveRefLinksCache[id]; !cached {
+					unseenIDs.Add(id)
+				}
 			}
-			emailBodyWithConfigDetails := addReportConfigDetails(emailBody, configDetailsHTML)
-			reportName := req.ReportSnapshot.GetName()
-			err := rg.retryableSendReportResults(reportNotifier, notifierSnap.GetEmailConfig().GetMailingLists(),
-				zippedCSVData, emailSubject, emailBodyWithConfigDetails, reportName)
+		}
+		if unseenIDs.Cardinality() > 0 {
+			cves, err := rg.imageCVE2Datastore.GetBatch(ctx, unseenIDs.AsSlice())
 			if err != nil {
-				errorList.AddError(errors.Errorf("Error sending email for notifier '%s': %s",
-					notifierSnap.GetEmailConfig().GetNotifierId(), err))
+				return errors.Wrap(err, "fetching CVE reference links")
+			}
+			for _, cve := range cves {
+				cveRefLinksCache[cve.GetId()] = cve.GetCveBaseInfo().GetLink()
 			}
 		}
-		if !errorList.Empty() {
-			return errorList.ToError()
+		for _, r := range batch {
+			if link, ok := cveRefLinksCache[r.GetCVEID()]; ok {
+				r.Link = link
+			}
+			if err := csvW.Write(formatCSVRow(r)); err != nil {
+				return err
+			}
 		}
+		batch = batch[:0]
+		return nil
 	}
-	return nil
-}
 
-func (rg *reportGeneratorImpl) saveReportData(ctx context.Context, configID, reportID string, data *bytes.Buffer) error {
-	if data == nil {
-		return errors.Errorf("No data found for report config %q and id %q", configID, reportID)
+	err := pgSearch.RunSelectCursorForSchemaFn[ImageCVEQueryResponse](
+		ctx, rg.db, schema, query,
+		func(r *ImageCVEQueryResponse) error {
+			batch = append(batch, r)
+			*rowCount++
+			if len(batch) >= cursorBatchSize {
+				return flushBatch()
+			}
+			return nil
+		})
+	if err != nil {
+		return err
 	}
 
-	// Store downloadable report in blob storage
-	b := &storage.Blob{
-		Name:         common.GetReportBlobPath(configID, reportID),
-		LastUpdated:  protocompat.TimestampNow(),
-		ModifiedTime: protocompat.TimestampNow(),
-		Length:       int64(data.Len()),
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+
+	if len(batch) > 0 {
+		return flushBatch()
 	}
-	return rg.blobStore.Upsert(ctx, b, data)
+	return nil
+}
+
+func (rg *reportGeneratorImpl) saveReportData(ctx context.Context, configID, reportID string, data *bytes.Buffer) error {
+	return SaveReportData(ctx, rg.blobStore, configID, reportID, data)
 }
 
 func (rg *reportGeneratorImpl) getReportDataSQF(ctx context.Context, snap *storage.ReportSnapshot, collection *storage.ResourceCollection,
@@ -430,16 +657,8 @@ func (rg *reportGeneratorImpl) buildReportQuery(ctx context.Context, snap *stora
 
 func (rg *reportGeneratorImpl) retryableSendReportResults(reportNotifier notifiers.ReportNotifier, mailingList []string,
 	zippedCSVData *bytes.Buffer, emailSubject, emailBody, baseFilename string) error {
-	return retry.WithRetry(func() error {
-		return reportNotifier.ReportNotify(reportGenCtx, zippedCSVData, mailingList, emailSubject, emailBody, baseFilename)
-	},
-		retry.OnlyRetryableErrors(),
-		retry.Tries(3),
-		retry.BetweenAttempts(func(previousAttempt int) {
-			wait := time.Duration(previousAttempt * previousAttempt * 100)
-			time.Sleep(wait * time.Millisecond)
-		}),
-	)
+	return RetryableSendReportResults(reportGenCtx, reportNotifier, mailingList,
+		zippedCSVData, emailSubject, emailBody, baseFilename)
 }
 
 func (rg *reportGeneratorImpl) lastSuccessfulScheduledReportTime(snap *storage.ReportSnapshot) (time.Time, error) {
@@ -497,6 +716,7 @@ func (rg *reportGeneratorImpl) withCVEReferenceLinks(ctx context.Context, imageC
 		cves = append(cves, v2)
 	}
 
+	// cveRefLinks is a map[string]string that maps CVE ID -> reference URL
 	cveRefLinks := make(map[string]string)
 	for _, cve := range cves {
 		cveRefLinks[cve.GetId()] = cve.GetCveBaseInfo().GetLink()
@@ -511,30 +731,11 @@ func (rg *reportGeneratorImpl) withCVEReferenceLinks(ctx context.Context, imageC
 }
 
 func (rg *reportGeneratorImpl) updateReportStatus(snapshot *storage.ReportSnapshot, status storage.ReportStatus_RunState) error {
-	snapshot.ReportStatus.RunState = status
-	return rg.reportSnapshotStore.UpdateReportSnapshot(reportGenCtx, snapshot)
+	return UpdateReportStatus(reportGenCtx, rg.reportSnapshotStore, snapshot, status)
 }
 
 func (rg *reportGeneratorImpl) logAndUpsertError(ctx context.Context, reportErr error, req *ReportRequest) {
-	if req.ReportSnapshot == nil || req.ReportSnapshot.GetReportStatus() == nil {
-		utils.Should(errors.New("Request does not have non-nil report snapshot with a non-nil report status"))
-		return
-	}
-	if errors.Is(context.Cause(ctx), ErrUserCancelled) {
-		log.Infof("Report for config '%s' was cancelled by user", req.ReportSnapshot.GetName())
-		req.ReportSnapshot.ReportStatus.ErrorMsg = ErrUserCancelled.Error()
-	} else if reportErr != nil {
-		log.Errorf("Error while running report for config '%s': %s", req.ReportSnapshot.GetName(), reportErr)
-		req.ReportSnapshot.ReportStatus.ErrorMsg = reportErr.Error()
-	}
-	req.ReportSnapshot.ReportStatus.CompletedAt = protocompat.TimestampNow()
-	// Use reportGenCtx for status update since the request context may be cancelled
-	err := rg.updateReportStatus(req.ReportSnapshot, storage.ReportStatus_FAILURE)
-
-	if err != nil {
-		log.Errorf("Error changing report status to FAILURE for report config '%s', report ID '%s': %s",
-			req.ReportSnapshot.GetName(), req.ReportSnapshot.GetReportId(), err)
-	}
+	LogAndUpsertError(ctx, reportGenCtx, rg.reportSnapshotStore, reportErr, req)
 }
 
 func selectSchema() *walker.Schema {
@@ -554,9 +755,13 @@ func getSelectsWatchedImages() []*v1.QuerySelect {
 		search.NewQuerySelect(search.CVSS).Proto(),
 		search.NewQuerySelect(search.NVDCVSS).Proto(),
 		search.NewQuerySelect(search.FirstImageOccurrenceTimestamp).Proto(),
+		search.NewQuerySelect(search.ImageCreatedTime).Proto(),
 		search.NewQuerySelect(search.EPSSProbablity).Proto(),
+		search.NewQuerySelect(search.CisaKev).Proto(),
+		search.NewQuerySelect(search.KnownRansomwareCampaign).Proto(),
 		search.NewQuerySelect(search.AdvisoryName).Proto(),
 		search.NewQuerySelect(search.AdvisoryLink).Proto(),
+		search.NewQuerySelect(search.CVEOrigin).Proto(),
 	}
 	return ret
 }
@@ -574,12 +779,16 @@ func getSelectsDeployedImages() []*v1.QuerySelect {
 		search.NewQuerySelect(search.CVSS).Proto(),
 		search.NewQuerySelect(search.NVDCVSS).Proto(),
 		search.NewQuerySelect(search.FirstImageOccurrenceTimestamp).Proto(),
+		search.NewQuerySelect(search.ImageCreatedTime).Proto(),
 		search.NewQuerySelect(search.Cluster).Proto(),
 		search.NewQuerySelect(search.Namespace).Proto(),
 		search.NewQuerySelect(search.DeploymentName).Proto(),
 		search.NewQuerySelect(search.EPSSProbablity).Proto(),
+		search.NewQuerySelect(search.CisaKev).Proto(),
+		search.NewQuerySelect(search.KnownRansomwareCampaign).Proto(),
 		search.NewQuerySelect(search.AdvisoryName).Proto(),
 		search.NewQuerySelect(search.AdvisoryLink).Proto(),
+		search.NewQuerySelect(search.CVEOrigin).Proto(),
 	}
 	return ret
 }
diff --git a/central/reports/scheduler/v2/reportgenerator/report_gen_impl_flat_data_model_test.go b/central/reports/scheduler/v2/reportgenerator/report_gen_impl_flat_data_model_test.go
index 2ddad1551afb2..b45f5ff05d5d3 100644
--- a/central/reports/scheduler/v2/reportgenerator/report_gen_impl_flat_data_model_test.go
+++ b/central/reports/scheduler/v2/reportgenerator/report_gen_impl_flat_data_model_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/graph-gophers/graphql-go"
 	blobDS "github.com/stackrox/rox/central/blob/datastore"
 	clusterDSMocks "github.com/stackrox/rox/central/cluster/datastore/mocks"
 	"github.com/stackrox/rox/central/graphql/resolvers"
@@ -73,10 +72,9 @@ func (s *NewDataModelEnhancedReportingTestSuite) SetupSuite() {
 
 	// TODO(ROX-30117): Remove conditional when FlattenImageData feature flag is removed.
 	var resolver *resolvers.Resolver
-	var schema *graphql.Schema
 	if features.FlattenImageData.Enabled() {
 		imgV2DataStore := resolvers.CreateTestImageV2Datastore(s.T(), s.testDB, mockCtrl)
-		resolver, schema = resolvers.SetupTestResolver(s.T(),
+		resolver, _ = resolvers.SetupTestResolver(s.T(),
 			imagesView.NewImageView(s.testDB.DB),
 			imgV2DataStore,
 			resolvers.CreateTestImageComponentV2Datastore(s.T(), s.testDB, mockCtrl),
@@ -86,7 +84,7 @@ func (s *NewDataModelEnhancedReportingTestSuite) SetupSuite() {
 		)
 	} else {
 		imageDataStore := resolvers.CreateTestImageDatastore(s.T(), s.testDB, mockCtrl)
-		resolver, schema = resolvers.SetupTestResolver(s.T(),
+		resolver, _ = resolvers.SetupTestResolver(s.T(),
 			imagesView.NewImageView(s.testDB.DB),
 			imageDataStore,
 			resolvers.CreateTestImageComponentV2Datastore(s.T(), s.testDB, mockCtrl),
@@ -165,7 +163,7 @@ func (s *NewDataModelEnhancedReportingTestSuite) SetupSuite() {
 
 	s.reportGenerator = newReportGeneratorImpl(s.testDB, nil, resolver.DeploymentDataStore,
 		s.watchedImageDatastore, collectionQueryResolver, nil, blobStore, s.clusterDatastore,
-		s.namespaceDatastore, resolver.ImageCVEV2DataStore, schema)
+		s.namespaceDatastore, resolver.ImageCVEV2DataStore)
 }
 func (s *NewDataModelEnhancedReportingTestSuite) upsertManyWatchedImages(images []*storage.Image) {
 	for _, img := range images {
diff --git a/central/reports/scheduler/v2/reportgenerator/report_gen_memory_bench_test.go b/central/reports/scheduler/v2/reportgenerator/report_gen_memory_bench_test.go
new file mode 100644
index 0000000000000..3ddb8a21990c6
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/report_gen_memory_bench_test.go
@@ -0,0 +1,308 @@
+//go:build sql_integration
+
+package reportgenerator
+
+import (
+	"context"
+	"runtime"
+	"testing"
+	"time"
+
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	clusterDSMocks "github.com/stackrox/rox/central/cluster/datastore/mocks"
+	"github.com/stackrox/rox/central/graphql/resolvers"
+	"github.com/stackrox/rox/central/graphql/resolvers/loaders"
+	namespaceDS "github.com/stackrox/rox/central/namespace/datastore"
+	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
+	collectionPostgres "github.com/stackrox/rox/central/resourcecollection/datastore/store/postgres"
+	deploymentsView "github.com/stackrox/rox/central/views/deployments"
+	imagesView "github.com/stackrox/rox/central/views/images"
+	watchedImageDS "github.com/stackrox/rox/central/watchedimage/datastore"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
+	imageUtils "github.com/stackrox/rox/pkg/images/utils"
+	"github.com/stackrox/rox/pkg/postgres"
+	"github.com/stackrox/rox/pkg/postgres/pgtest"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+// memoryBenchSuite holds shared test infrastructure for the memory benchmarks.
+type memoryBenchSuite struct {
+	b          *testing.B
+	ctx        context.Context
+	testDB     *pgtest.TestPostgres
+	rg         *reportGeneratorImpl
+	collection *storage.ResourceCollection
+	snap       *storage.ReportSnapshot
+	rowCount   int
+}
+
+func setupMemoryBench(b *testing.B, numNamespacesPerCluster, numDeploymentsPerNamespace, numWatchedImages int) *memoryBenchSuite {
+	b.Helper()
+
+	ctx := loaders.WithLoaderContext(sac.WithAllAccess(context.Background()))
+	mockCtrl := gomock.NewController(b)
+	testDB := pgtest.ForT(b)
+
+	watchedImageDatastore := watchedImageDS.GetTestPostgresDataStore(b, testDB.DB)
+
+	var resolver *resolvers.Resolver
+	if features.FlattenImageData.Enabled() {
+		imgV2DataStore := resolvers.CreateTestImageV2Datastore(b, testDB, mockCtrl)
+		resolver, _ = resolvers.SetupTestResolver(b,
+			imagesView.NewImageView(testDB.DB),
+			imgV2DataStore,
+			resolvers.CreateTestImageComponentV2Datastore(b, testDB, mockCtrl),
+			resolvers.CreateTestImageCVEV2Datastore(b, testDB),
+			resolvers.CreateTestDeploymentDatastoreWithImageV2(b, testDB, mockCtrl, imgV2DataStore),
+			deploymentsView.NewDeploymentView(testDB.DB),
+		)
+	} else {
+		imageDataStore := resolvers.CreateTestImageDatastore(b, testDB, mockCtrl)
+		resolver, _ = resolvers.SetupTestResolver(b,
+			imagesView.NewImageView(testDB.DB),
+			imageDataStore,
+			resolvers.CreateTestImageComponentV2Datastore(b, testDB, mockCtrl),
+			resolvers.CreateTestImageCVEV2Datastore(b, testDB),
+			resolvers.CreateTestDeploymentDatastore(b, testDB, mockCtrl, imageDataStore),
+			deploymentsView.NewDeploymentView(testDB.DB),
+		)
+	}
+
+	collectionStore := collectionPostgres.New(testDB)
+	_, collectionQueryResolver, err := collectionDS.New(collectionStore)
+	require.NoError(b, err)
+
+	clusterDatastore := clusterDSMocks.NewMockDataStore(mockCtrl)
+	nsDatastore, err := namespaceDS.GetTestPostgresDataStore(b, testDB.DB)
+	require.NoError(b, err)
+
+	blobStore := blobDS.NewTestDatastore(b, testDB.DB)
+	reportSnapshotStore := reportSnapshotDS.GetTestPostgresDataStore(b, testDB.DB)
+
+	rg := newReportGeneratorImpl(testDB, reportSnapshotStore, resolver.DeploymentDataStore,
+		watchedImageDatastore, collectionQueryResolver, nil, blobStore, clusterDatastore,
+		nsDatastore, resolver.ImageCVEV2DataStore)
+
+	// pgtest limits all pools to pool_max_conns=1 which is too restrictive for
+	// report generation. Use a shared pool with enough connections.
+	multiConnCfg := testDB.DB.Config().Copy()
+	multiConnCfg.Config.MaxConns = 4
+	multiConnPool, err := postgres.New(context.Background(), multiConnCfg)
+	require.NoError(b, err)
+	b.Cleanup(func() { multiConnPool.Close() })
+	rg.db = multiConnPool
+	rg.blobStore = blobDS.NewTestDatastore(b, multiConnPool)
+
+	clusters := []*storage.Cluster{
+		{Id: uuid.NewV4().String(), Name: "c1"},
+		{Id: uuid.NewV4().String(), Name: "c2"},
+	}
+	namespaces := testNamespaces(clusters, numNamespacesPerCluster)
+	for _, ns := range namespaces {
+		require.NoError(b, nsDatastore.AddNamespace(ctx, ns))
+	}
+
+	deployments, images := testDeploymentsWithImages(namespaces, numDeploymentsPerNamespace)
+	if features.FlattenImageData.Enabled() {
+		for _, img := range images {
+			require.NoError(b, resolver.ImageV2DataStore.UpsertImage(ctx, imageUtils.ConvertToV2(img)))
+		}
+	} else {
+		for _, img := range images {
+			require.NoError(b, resolver.ImageDataStore.UpsertImage(ctx, img))
+		}
+	}
+	for _, dep := range deployments {
+		require.NoError(b, resolver.DeploymentDataStore.UpsertDeployment(ctx, dep))
+	}
+
+	watchedImages := testWatchedImages(numWatchedImages)
+	if features.FlattenImageData.Enabled() {
+		for _, img := range watchedImages {
+			require.NoError(b, resolver.ImageV2DataStore.UpsertImage(ctx, imageUtils.ConvertToV2(img)))
+		}
+	} else {
+		for _, img := range watchedImages {
+			require.NoError(b, resolver.ImageDataStore.UpsertImage(ctx, img))
+		}
+	}
+	for _, img := range watchedImages {
+		require.NoError(b, watchedImageDatastore.UpsertWatchedImage(ctx, img.GetName().GetFullName()))
+	}
+
+	clusterDatastore.EXPECT().GetClusters(gomock.Any()).Return(clusters, nil).AnyTimes()
+
+	collection := testCollection("col_bench", "", "", "")
+	imageTypes := []storage.VulnerabilityReportFilters_ImageType{
+		storage.VulnerabilityReportFilters_DEPLOYED,
+		storage.VulnerabilityReportFilters_WATCHED,
+	}
+	snap := testReportSnapshot(collection.GetId(), storage.VulnerabilityReportFilters_BOTH, allSeverities(), imageTypes, nil)
+	// updateReportStatus upserts the snapshot into report_snapshots. That table has a FK to
+	// report_configurations, so the parent config row must exist first.
+	reportConfigStore := reportConfigDS.GetTestPostgresDataStore(b, testDB.DB)
+	_, err = reportConfigStore.AddReportConfiguration(ctx, &storage.ReportConfiguration{
+		Id:   snap.GetReportConfigurationId(),
+		Name: "bench-report-config",
+		Type: storage.ReportConfiguration_VULNERABILITY,
+	})
+	require.NoError(b, err)
+	// updateReportStatus also requires a non-empty ReportId.
+	snap.ReportId = uuid.NewV4().String()
+
+	// Each image has 2 CVEs, so:
+	//   deployed rows = 2 clusters * numNamespacesPerCluster * numDeploymentsPerNamespace * 2
+	//   watched rows  = numWatchedImages * 2
+	expectedRows := 2*numNamespacesPerCluster*numDeploymentsPerNamespace*2 + numWatchedImages*2
+
+	return &memoryBenchSuite{
+		b:          b,
+		ctx:        ctx,
+		testDB:     testDB,
+		rg:         rg,
+		collection: collection,
+		snap:       snap,
+		rowCount:   expectedRows,
+	}
+}
+
+func forceGC() {
+	runtime.GC()
+	runtime.GC()
+}
+
+func heapAllocBytes() uint64 {
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+	return m.HeapAlloc
+}
+
+// BenchmarkMemoryComparison runs InMemory and Transaction paths side-by-side for easy comparison.
+// Use: go test -tags sql_integration -bench BenchmarkMemoryComparison -benchtime 3x -v
+func BenchmarkMemoryComparison(b *testing.B) {
+	s := setupMemoryBench(b, 10, 50, 500)
+	if !features.FlattenImageData.Enabled() {
+		b.Skip("benchmark requires FlattenImageData (image v2 model) to be enabled")
+	}
+
+	b.Run("InMemory", func(b *testing.B) {
+		b.ReportAllocs()
+		for i := 0; i < b.N; i++ {
+			iterCtx := loaders.WithLoaderContext(sac.WithAllAccess(context.Background()))
+			forceGC()
+			before := heapAllocBytes()
+
+			reportData, err := s.rg.getReportDataSQF(iterCtx, s.snap, s.collection, time.Time{})
+			require.NoError(b, err)
+
+			zippedCSV, err := GenerateCSV(reportData.CVEResponses, s.snap.GetName())
+			require.NoError(b, err)
+
+			after := heapAllocBytes()
+			b.ReportMetric(float64(after-before), "heap-delta-bytes")
+
+			err = s.rg.saveReportData(iterCtx, s.snap.GetReportConfigurationId(), s.snap.GetReportId(), zippedCSV)
+			require.NoError(b, err)
+		}
+	})
+
+	s.snap.ReportStatus.ReportNotificationMethod = storage.ReportStatus_DOWNLOAD
+	b.Run("Transaction", func(b *testing.B) {
+		b.ReportAllocs()
+		for i := 0; i < b.N; i++ {
+			iterCtx := loaders.WithLoaderContext(sac.WithAllAccess(context.Background()))
+			forceGC()
+			before := heapAllocBytes()
+
+			err := s.rg.generateReportTransaction(iterCtx, &ReportRequest{
+				ReportSnapshot: s.snap,
+				Collection:     s.collection,
+				DataStartTime:  time.Time{},
+			})
+			require.NoError(b, err)
+
+			after := heapAllocBytes()
+			b.ReportMetric(float64(after-before), "heap-delta-bytes")
+		}
+	})
+}
+
+// BenchmarkMemoryAtScale uses larger data volumes to amplify the difference.
+// 2 clusters * 20 namespaces * 100 deployments * 2 CVEs = 8000 deployed rows
+// + 1000 watched images * 2 CVEs = 2000 watched rows = 10000 total rows.
+func BenchmarkMemoryAtScale(b *testing.B) {
+	if !features.FlattenImageData.Enabled() {
+		b.Skip("benchmark requires FlattenImageData (image v2 model) to be enabled")
+	}
+	s := setupMemoryBench(b, 20, 100, 1000)
+
+	s.snap.ReportStatus.ReportNotificationMethod = storage.ReportStatus_DOWNLOAD
+	b.Run("Transaction", func(b *testing.B) {
+		b.ReportAllocs()
+		for i := 0; i < b.N; i++ {
+			iterCtx := loaders.WithLoaderContext(sac.WithAllAccess(context.Background()))
+			forceGC()
+			before := heapAllocBytes()
+
+			err := s.rg.generateReportTransaction(iterCtx, &ReportRequest{
+				ReportSnapshot: s.snap,
+				Collection:     s.collection,
+				DataStartTime:  time.Time{},
+			})
+			require.NoError(b, err)
+
+			after := heapAllocBytes()
+			b.ReportMetric(float64(after-before), "heap-delta-bytes")
+		}
+	})
+}
+
+// BenchmarkReportDuration measures time for InMemory vs Transaction report generation.
+// The built-in ns/op from testing.B captures this automatically, but this benchmark also reports
+// explicit millisecond metrics for easier comparison.
+// Use: go test -tags sql_integration -bench BenchmarkReportDuration -benchtime 3x -v
+func BenchmarkReportDuration(b *testing.B) {
+	s := setupMemoryBench(b, 10, 50, 500)
+	if !features.FlattenImageData.Enabled() {
+		b.Skip("benchmark requires FlattenImageData (image v2 model) to be enabled")
+	}
+
+	b.Run("InMemory", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			iterCtx := loaders.WithLoaderContext(sac.WithAllAccess(context.Background()))
+
+			start := time.Now()
+			reportData, err := s.rg.getReportDataSQF(iterCtx, s.snap, s.collection, time.Time{})
+			require.NoError(b, err)
+
+			zippedCSV, err := GenerateCSV(reportData.CVEResponses, s.snap.GetName())
+			require.NoError(b, err)
+
+			err = s.rg.saveReportData(iterCtx, s.snap.GetReportConfigurationId(), s.snap.GetReportId(), zippedCSV)
+			require.NoError(b, err)
+			b.ReportMetric(float64(time.Since(start).Milliseconds()), "ms/report")
+		}
+	})
+
+	s.snap.ReportStatus.ReportNotificationMethod = storage.ReportStatus_DOWNLOAD
+	b.Run("Transaction", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			iterCtx := loaders.WithLoaderContext(sac.WithAllAccess(context.Background()))
+
+			start := time.Now()
+			err := s.rg.generateReportTransaction(iterCtx, &ReportRequest{
+				ReportSnapshot: s.snap,
+				Collection:     s.collection,
+				DataStartTime:  time.Time{},
+			})
+			require.NoError(b, err)
+			b.ReportMetric(float64(time.Since(start).Milliseconds()), "ms/report")
+		}
+	})
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/report_gen_transaction_integration_test.go b/central/reports/scheduler/v2/reportgenerator/report_gen_transaction_integration_test.go
new file mode 100644
index 0000000000000..d34af5f597329
--- /dev/null
+++ b/central/reports/scheduler/v2/reportgenerator/report_gen_transaction_integration_test.go
@@ -0,0 +1,304 @@
+//go:build sql_integration
+
+package reportgenerator
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"encoding/csv"
+	"io"
+	"slices"
+	"time"
+
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	"github.com/stackrox/rox/central/reports/common"
+	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/postgres"
+	"github.com/stackrox/rox/pkg/uuid"
+)
+
+// CSV column indices for the fixed prefix that precedes any feature-flag-gated
+// columns (see csvHeader in csv_gen.go). Columns after EPSS can shift depending
+// on enabled features, so look those up with colOf instead of hardcoding them.
+const (
+	colCluster     = 0
+	colNamespace   = 1
+	colDeployment  = 2
+	colImage       = 3
+	colComponent   = 4
+	colCompVersion = 5
+	colCVE         = 6
+	colFixable     = 7
+	colFixedBy     = 8
+	colSeverity    = 9
+	colCVSS        = 10
+	colNVDCVSS     = 11
+	colEPSS        = 12
+)
+
+// colOf returns the index of the named column in the current CSV layout, which
+// depends on which feature-flag-gated columns formatCol includes.
+func colOf(name string) int {
+	return slices.Index(formatCol(), name)
+}
+
+// collectColumn extracts a single column from all rows.
+func collectColumn(rows [][]string, col int) []string {
+	out := make([]string, len(rows))
+	for i, row := range rows {
+		out[i] = row[col]
+	}
+	return out
+}
+
+// setupTransactionDeps creates a multi-connection pool and the datastores
+// required by generateReportTransaction. The returned reportGeneratorImpl
+// is a shallow copy of s.reportGenerator with db, blobStore, and
+// reportSnapshotStore replaced.
+func (s *NewDataModelEnhancedReportingTestSuite) setupTransactionDeps() (
+	rg *reportGeneratorImpl,
+	blobStore blobDS.Datastore,
+	configStore reportConfigDS.DataStore,
+) {
+	s.T().Helper()
+
+	// generateReportTransaction runs cursor reads, CVE lookups, and blob
+	// store writes all within a single transaction (1 connection) on a
+	// single goroutine, so no concurrent tx access occurs.
+	poolCfg := s.testDB.DB.Config().Copy()
+	poolCfg.Config.MaxConns = 1
+	pool, err := postgres.New(context.Background(), poolCfg)
+	s.Require().NoError(err)
+	s.T().Cleanup(func() { pool.Close() })
+
+	blobStore = blobDS.NewTestDatastore(s.T(), pool)
+	snapStore := reportSnapshotDS.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+	configStore = reportConfigDS.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+
+	rgCopy := *s.reportGenerator
+	rgCopy.db = pool
+	rgCopy.blobStore = blobStore
+	rgCopy.reportSnapshotStore = snapStore
+	return &rgCopy, blobStore, configStore
+}
+
+// prepareSnapshot creates a report snapshot with a backing report configuration
+// (FK constraint) and sets the notification method to DOWNLOAD so the streaming
+// path is exercised.
+func (s *NewDataModelEnhancedReportingTestSuite) prepareSnapshot(
+	configStore reportConfigDS.DataStore,
+	collectionID string,
+	fixability storage.VulnerabilityReportFilters_Fixability,
+	severities []storage.VulnerabilitySeverity,
+	imageTypes []storage.VulnerabilityReportFilters_ImageType,
+) *storage.ReportSnapshot {
+	s.T().Helper()
+
+	snap := testReportSnapshot(collectionID, fixability, severities, imageTypes, nil)
+	configID := uuid.NewV4().String()
+	snap.ReportConfigurationId = configID
+	snap.ReportId = uuid.NewV4().String()
+	snap.ReportStatus.ReportNotificationMethod = storage.ReportStatus_DOWNLOAD
+
+	_, err := configStore.AddReportConfiguration(s.ctx, &storage.ReportConfiguration{
+		Id:   configID,
+		Name: "txn-test-config",
+		Type: storage.ReportConfiguration_VULNERABILITY,
+	})
+	s.Require().NoError(err)
+	return snap
+}
+
+// readBlobCSV fetches a zipped CSV from blob store, decompresses it, and returns
+// the parsed CSV rows (including the header row).
+func (s *NewDataModelEnhancedReportingTestSuite) readBlobCSV(
+	blobStore blobDS.Datastore,
+	configID, reportID string,
+) [][]string {
+	s.T().Helper()
+
+	blobPath := common.GetReportBlobPath(configID, reportID)
+	var buf bytes.Buffer
+	_, found, err := blobStore.Get(reportGenCtx, blobPath, &buf)
+	s.Require().NoError(err)
+	s.Require().True(found, "blob not found at %s", blobPath)
+
+	zipReader, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	s.Require().NoError(err)
+	s.Require().Len(zipReader.File, 1, "expected exactly one entry in the ZIP archive")
+
+	rc, err := zipReader.File[0].Open()
+	s.Require().NoError(err)
+	defer func() { _ = rc.Close() }()
+
+	csvBytes, err := io.ReadAll(rc)
+	s.Require().NoError(err)
+
+	r := csv.NewReader(bytes.NewReader(csvBytes))
+	r.FieldsPerRecord = -1
+	rows, err := r.ReadAll()
+	s.Require().NoError(err)
+	return rows
+}
+
+// ---------------------------------------------------------------------------
+// Tests for generateReportTransaction
+// ---------------------------------------------------------------------------
+
+// TestGenerateReportTransaction_AllDeployedImages verifies the full pipeline:
+// cursor reads in a single transaction → batched CSV → ZIP → blob store.
+//
+// Test data: 4 deployments × 2 CVEs = 8 rows, plus header.
+func (s *NewDataModelEnhancedReportingTestSuite) TestGenerateReportTransaction_AllDeployedImages() {
+	rg, blobStore, configStore := s.setupTransactionDeps()
+	snap := s.prepareSnapshot(configStore, "col1",
+		storage.VulnerabilityReportFilters_BOTH, allSeverities(),
+		[]storage.VulnerabilityReportFilters_ImageType{storage.VulnerabilityReportFilters_DEPLOYED})
+
+	err := rg.generateReportTransaction(s.ctx, &ReportRequest{
+		ReportSnapshot: snap,
+		Collection:     testCollection("col1", "", "", ""),
+		DataStartTime:  time.Time{},
+	})
+	s.Require().NoError(err)
+
+	rows := s.readBlobCSV(blobStore, snap.GetReportConfigurationId(), snap.GetReportId())
+	s.Require().Len(rows, 9, "1 header + 8 data rows")
+	s.Equal(formatCol(), rows[0])
+
+	dataRows := rows[1:]
+	s.ElementsMatch([]string{
+		"CVE-fixable_critical-c1_ns1_dep0_img_comp", "CVE-nonFixable_low-c1_ns1_dep0_img_comp",
+		"CVE-fixable_critical-c1_ns2_dep0_img_comp", "CVE-nonFixable_low-c1_ns2_dep0_img_comp",
+		"CVE-fixable_critical-c2_ns1_dep0_img_comp", "CVE-nonFixable_low-c2_ns1_dep0_img_comp",
+		"CVE-fixable_critical-c2_ns2_dep0_img_comp", "CVE-nonFixable_low-c2_ns2_dep0_img_comp",
+	}, collectColumn(dataRows, colCVE))
+}
+
+// TestGenerateReportTransaction_FixableOnlyFilter verifies that the fixable
+// filter is applied through the transactional pipeline.
+func (s *NewDataModelEnhancedReportingTestSuite) TestGenerateReportTransaction_FixableOnlyFilter() {
+	rg, blobStore, configStore := s.setupTransactionDeps()
+	snap := s.prepareSnapshot(configStore, "col1",
+		storage.VulnerabilityReportFilters_FIXABLE, allSeverities(),
+		[]storage.VulnerabilityReportFilters_ImageType{storage.VulnerabilityReportFilters_DEPLOYED})
+
+	err := rg.generateReportTransaction(s.ctx, &ReportRequest{
+		ReportSnapshot: snap,
+		Collection:     testCollection("col1", "", "", ""),
+		DataStartTime:  time.Time{},
+	})
+	s.Require().NoError(err)
+
+	rows := s.readBlobCSV(blobStore, snap.GetReportConfigurationId(), snap.GetReportId())
+	s.Require().Len(rows, 5, "1 header + 4 fixable rows")
+
+	for _, row := range rows[1:] {
+		s.Equal("true", row[colFixable])
+		s.Equal("CRITICAL", row[colSeverity])
+	}
+}
+
+// TestGenerateReportTransaction_DeployedAndWatched verifies that both deployed
+// and watched image queries are executed within the same transaction.
+//
+// Test data: 4 deployed CVEs + 4 watched CVEs (2 watched images × 2 CVEs) = 8 data rows.
+func (s *NewDataModelEnhancedReportingTestSuite) TestGenerateReportTransaction_DeployedAndWatched() {
+	rg, blobStore, configStore := s.setupTransactionDeps()
+	snap := s.prepareSnapshot(configStore, "col1",
+		storage.VulnerabilityReportFilters_BOTH, allSeverities(),
+		[]storage.VulnerabilityReportFilters_ImageType{
+			storage.VulnerabilityReportFilters_DEPLOYED,
+			storage.VulnerabilityReportFilters_WATCHED,
+		})
+
+	err := rg.generateReportTransaction(s.ctx, &ReportRequest{
+		ReportSnapshot: snap,
+		Collection:     testCollection("col1", "", "", ""),
+		DataStartTime:  time.Time{},
+	})
+	s.Require().NoError(err)
+
+	rows := s.readBlobCSV(blobStore, snap.GetReportConfigurationId(), snap.GetReportId())
+	// 8 deployed (4 deps × 2 CVEs) + 4 watched (2 images × 2 CVEs) + 1 header = 13
+	s.Require().Len(rows, 13, "1 header + 8 deployed + 4 watched")
+}
+
+// TestGenerateReportTransaction_EmptyResult verifies that a query matching
+// no data produces a valid ZIP with a CSV containing only the header row.
+func (s *NewDataModelEnhancedReportingTestSuite) TestGenerateReportTransaction_EmptyResult() {
+	rg, blobStore, configStore := s.setupTransactionDeps()
+	snap := s.prepareSnapshot(configStore, "col1",
+		storage.VulnerabilityReportFilters_BOTH, allSeverities(),
+		[]storage.VulnerabilityReportFilters_ImageType{storage.VulnerabilityReportFilters_DEPLOYED})
+
+	err := rg.generateReportTransaction(s.ctx, &ReportRequest{
+		ReportSnapshot: snap,
+		Collection:     testCollection("col1", "nonexistent-cluster", "", ""),
+		DataStartTime:  time.Time{},
+	})
+	s.Require().NoError(err)
+
+	rows := s.readBlobCSV(blobStore, snap.GetReportConfigurationId(), snap.GetReportId())
+	s.Require().Len(rows, 1, "only header row for empty result")
+	s.Equal(formatCol(), rows[0])
+}
+
+// TestGenerateReportTransaction_CSVFieldValues spot-checks individual CSV field
+// values for a single known row to verify end-to-end correctness.
+func (s *NewDataModelEnhancedReportingTestSuite) TestGenerateReportTransaction_CSVFieldValues() {
+	rg, blobStore, configStore := s.setupTransactionDeps()
+	snap := s.prepareSnapshot(configStore, "col1",
+		storage.VulnerabilityReportFilters_FIXABLE,
+		[]storage.VulnerabilitySeverity{storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY},
+		[]storage.VulnerabilityReportFilters_ImageType{storage.VulnerabilityReportFilters_DEPLOYED})
+
+	err := rg.generateReportTransaction(s.ctx, &ReportRequest{
+		ReportSnapshot: snap,
+		Collection:     testCollection("col1", "c1", "ns1", "c1_ns1_dep0"),
+		DataStartTime:  time.Time{},
+	})
+	s.Require().NoError(err)
+
+	rows := s.readBlobCSV(blobStore, snap.GetReportConfigurationId(), snap.GetReportId())
+	s.Require().Len(rows, 2, "1 header + 1 data row")
+
+	row := rows[1]
+	s.Equal("c1", row[colCluster])
+	s.Equal("ns1", row[colNamespace])
+	s.Equal("c1_ns1_dep0", row[colDeployment])
+	s.Equal("c1_ns1_dep0_img", row[colImage])
+	s.Equal("c1_ns1_dep0_img_comp", row[colComponent])
+	s.Equal("1.0", row[colCompVersion])
+	s.Equal("CVE-fixable_critical-c1_ns1_dep0_img_comp", row[colCVE])
+	s.Equal("true", row[colFixable])
+	s.Equal("1.1", row[colFixedBy])
+	s.Equal("CRITICAL", row[colSeverity])
+	s.Equal("9.00", row[colCVSS])
+	s.Equal("10.00", row[colNVDCVSS])
+	s.Equal("70.000", row[colEPSS])
+	s.NotEqual("Not Available", row[colOf("Discovered At")])
+	s.Equal("RHSA-2025-CVE-fixable", row[colOf("Advisory Name")])
+	s.Equal("test-rhsa-link", row[colOf("Advisory Link")])
+}
+
+// TestGenerateReportTransaction_ReportStatusUpdated verifies that the report
+// snapshot status is set to GENERATED after a successful run.
+func (s *NewDataModelEnhancedReportingTestSuite) TestGenerateReportTransaction_ReportStatusUpdated() {
+	rg, _, configStore := s.setupTransactionDeps()
+	snap := s.prepareSnapshot(configStore, "col1",
+		storage.VulnerabilityReportFilters_BOTH, allSeverities(),
+		[]storage.VulnerabilityReportFilters_ImageType{storage.VulnerabilityReportFilters_DEPLOYED})
+
+	err := rg.generateReportTransaction(s.ctx, &ReportRequest{
+		ReportSnapshot: snap,
+		Collection:     testCollection("col1", "", "", ""),
+		DataStartTime:  time.Time{},
+	})
+	s.Require().NoError(err)
+	s.Equal(storage.ReportStatus_GENERATED, snap.GetReportStatus().GetRunState())
+	s.NotNil(snap.GetReportStatus().GetCompletedAt())
+}
diff --git a/central/reports/scheduler/v2/reportgenerator/report_gen_view_based_test.go b/central/reports/scheduler/v2/reportgenerator/report_gen_view_based_test.go
index da2701f4d16e3..ffee70a669748 100644
--- a/central/reports/scheduler/v2/reportgenerator/report_gen_view_based_test.go
+++ b/central/reports/scheduler/v2/reportgenerator/report_gen_view_based_test.go
@@ -91,7 +91,7 @@ func (s *ViewBasedReportingTestSuite) SetupTest() {
 
 	s.reportGenerator = newReportGeneratorImpl(s.testDB, nil, s.resolver.DeploymentDataStore,
 		s.watchedImageDatastore, nil, nil, s.blobStore, s.clusterDatastore,
-		s.namespaceDatastore, s.resolver.ImageCVEV2DataStore, nil)
+		s.namespaceDatastore, s.resolver.ImageCVEV2DataStore)
 }
 
 func (s *ViewBasedReportingTestSuite) TearDownTest() {
diff --git a/central/reports/scheduler/v2/reportgenerator/singleton.go b/central/reports/scheduler/v2/reportgenerator/singleton.go
index 8584149ead221..3bb242c54d343 100644
--- a/central/reports/scheduler/v2/reportgenerator/singleton.go
+++ b/central/reports/scheduler/v2/reportgenerator/singleton.go
@@ -1,20 +1,17 @@
 package reportgenerator
 
 import (
-	"github.com/graph-gophers/graphql-go"
 	blobDS "github.com/stackrox/rox/central/blob/datastore"
 	clusterDS "github.com/stackrox/rox/central/cluster/datastore"
 	imageCVE2DS "github.com/stackrox/rox/central/cve/image/v2/datastore"
 	deploymentDS "github.com/stackrox/rox/central/deployment/datastore"
 	"github.com/stackrox/rox/central/globaldb"
-	"github.com/stackrox/rox/central/graphql/resolvers"
 	namespaceDS "github.com/stackrox/rox/central/namespace/datastore"
 	notifierProcessor "github.com/stackrox/rox/central/notifier/processor"
 	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
 	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
 	watchedImageDS "github.com/stackrox/rox/central/watchedimage/datastore"
 	"github.com/stackrox/rox/pkg/sync"
-	"github.com/stackrox/rox/pkg/utils"
 )
 
 var (
@@ -24,8 +21,6 @@ var (
 
 func initialize() {
 	_, collectionQueryRes := collectionDS.Singleton()
-	schema, err := graphql.ParseSchema(resolvers.Schema(), resolvers.New())
-	utils.CrashOnError(err)
 	rg = New(globaldb.GetPostgres(),
 		reportSnapshotDS.Singleton(),
 		deploymentDS.Singleton(),
@@ -36,7 +31,6 @@ func initialize() {
 		clusterDS.Singleton(),
 		namespaceDS.Singleton(),
 		imageCVE2DS.Singleton(),
-		schema,
 	)
 }
 
diff --git a/central/reports/scheduler/v2/reportgenerator/types.go b/central/reports/scheduler/v2/reportgenerator/types.go
index 248b4669a995e..2a1c5b2493859 100644
--- a/central/reports/scheduler/v2/reportgenerator/types.go
+++ b/central/reports/scheduler/v2/reportgenerator/types.go
@@ -31,23 +31,27 @@ type reportEmailSubjectFormat struct {
 
 // ImageCVEQueryResponse contains the fields of report query response
 type ImageCVEQueryResponse struct {
-	Cluster           *string                        `db:"cluster"`
-	Namespace         *string                        `db:"namespace"`
-	Deployment        *string                        `db:"deployment"`
-	Image             *string                        `db:"image"`
-	Component         *string                        `db:"component"`
-	ComponentVersion  *string                        `db:"component_version"`
-	CVEID             *string                        `db:"cve_id"`
-	CVE               *string                        `db:"cve"`
-	Fixable           *bool                          `db:"fixable"`
-	FixedByVersion    *string                        `db:"fixed_by"`
-	Severity          *storage.VulnerabilitySeverity `db:"severity"`
-	CVSS              *float64                       `db:"cvss"`
-	NVDCVSS           *float64                       `db:"nvd_cvss"`
-	EPSSProbability   *float64                       `db:"epss_probability"`
-	DiscoveredAtImage *time.Time                     `db:"first_image_occurrence_timestamp"`
-	AdvisoryName      *string                        `db:"advisory_name"`
-	AdvisoryLink      *string                        `db:"advisory_link"`
+	Cluster                 *string                        `db:"cluster"`
+	Namespace               *string                        `db:"namespace"`
+	Deployment              *string                        `db:"deployment"`
+	Image                   *string                        `db:"image"`
+	Component               *string                        `db:"component"`
+	ComponentVersion        *string                        `db:"component_version"`
+	CVEID                   *string                        `db:"cve_id"`
+	CVE                     *string                        `db:"cve"`
+	Fixable                 *bool                          `db:"fixable"`
+	FixedByVersion          *string                        `db:"fixed_by"`
+	Severity                *storage.VulnerabilitySeverity `db:"severity"`
+	CVSS                    *float64                       `db:"cvss"`
+	NVDCVSS                 *float64                       `db:"nvd_cvss"`
+	EPSSProbability         *float64                       `db:"epss_probability"`
+	CisaKev                 *bool                          `db:"cisa_kev"`
+	KnownRansomwareCampaign *bool                          `db:"known_ransomware_campaign"`
+	DiscoveredAtImage       *time.Time                     `db:"first_image_occurrence_timestamp"`
+	ImageCreatedAt          *time.Time                     `db:"image_created_time"`
+	AdvisoryName            *string                        `db:"advisory_name"`
+	AdvisoryLink            *string                        `db:"advisory_link"`
+	Origin                  *storage.VulnOrigin            `db:"cve_origin"`
 
 	Link string
 }
@@ -136,6 +140,13 @@ func (res *ImageCVEQueryResponse) GetCVSS() float64 {
 	return *res.CVSS
 }
 
+func (res *ImageCVEQueryResponse) GetOrigin() storage.VulnOrigin {
+	if res.Origin == nil {
+		return storage.VulnOrigin_VULN_ORIGIN_OTHER
+	}
+	return *res.Origin
+}
+
 func (res *ImageCVEQueryResponse) GetNVDCVSS() float64 {
 	if res.NVDCVSS == nil {
 		return 0.0
@@ -147,6 +158,14 @@ func (res *ImageCVEQueryResponse) GetEPSSProbability() *float64 {
 	return res.EPSSProbability
 }
 
+func (res *ImageCVEQueryResponse) GetCisaKev() *bool {
+	return res.CisaKev
+}
+
+func (res *ImageCVEQueryResponse) GetKnownRansomwareCampaign() *bool {
+	return res.KnownRansomwareCampaign
+}
+
 func (res *ImageCVEQueryResponse) GetAdvisoryName() string {
 	if res.AdvisoryName == nil {
 		return "Not Available"
@@ -168,6 +187,13 @@ func (res *ImageCVEQueryResponse) GetDiscoveredAtImage() string {
 	return res.DiscoveredAtImage.Format("January 02, 2006")
 }
 
+func (res *ImageCVEQueryResponse) GetImageCreatedAt() string {
+	if res.ImageCreatedAt == nil {
+		return "Not Available"
+	}
+	return res.ImageCreatedAt.Format("2006-01-02")
+}
+
 // ReportQueryParts contains the parts used to build the report query
 type ReportQueryParts struct {
 	Schema     *walker.Schema
diff --git a/central/reports/scheduler/v2/reportgenerator/validate.go b/central/reports/scheduler/v2/reportgenerator/validate.go
index bd5de5f06c746..bec14d35abd0c 100644
--- a/central/reports/scheduler/v2/reportgenerator/validate.go
+++ b/central/reports/scheduler/v2/reportgenerator/validate.go
@@ -2,6 +2,7 @@ package reportgenerator
 
 import (
 	"github.com/pkg/errors"
+	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/errorhelpers"
 )
 
@@ -19,10 +20,15 @@ func ValidateReportRequest(request *ReportRequest) error {
 	} else if request.ReportSnapshot.GetReportStatus() == nil {
 		errorList.AddError(errors.New("Report request does not have a valid report snapshot with report status"))
 	}
-	// only check resource scope is non nil if report snapshot is for config based vuln reports
+	// only check resource scope is non nil if report snapshot is for config based reports
 	if request.ReportSnapshot.GetVulnReportFilters() != nil && request.ReportSnapshot.GetResourceScope() == nil {
 		errorList.AddError(errors.New("Report request does not have a valid non-nil resource scope."))
 	}
+	if request.ReportSnapshot.GetNodeVulnReportFilters() != nil &&
+		request.ReportSnapshot.GetReportStatus().GetReportRequestType() != storage.ReportStatus_VIEW_BASED &&
+		request.ReportSnapshot.GetResourceScope() == nil {
+		errorList.AddError(errors.New("Report request does not have a valid non-nil resource scope."))
+	}
 
 	return errorList.ToError()
 }
diff --git a/central/reports/scheduler/v2/reportqueue/report_queue.go b/central/reports/scheduler/v2/reportqueue/report_queue.go
new file mode 100644
index 0000000000000..e94cebe26ba1e
--- /dev/null
+++ b/central/reports/scheduler/v2/reportqueue/report_queue.go
@@ -0,0 +1,114 @@
+package reportqueue
+
+import (
+	"context"
+
+	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/queue"
+	"github.com/stackrox/rox/pkg/set"
+	"github.com/stackrox/rox/pkg/sync"
+)
+
+// ReportQueue is a thread-safe FIFO queue of report requests. It tracks which
+// report configurations are currently running so that at most one report per
+// config executes at a time, and stores cancel functions for running reports
+// to support user-initiated cancellation.
+type ReportQueue struct {
+	mu                sync.Mutex
+	queue             *queue.Queue[*reportGen.ReportRequest]
+	runningConfigs    set.StringSet
+	jobIDToCancelFunc map[string]context.CancelCauseFunc
+}
+
+// New creates a new empty ReportQueue.
+func New() *ReportQueue {
+	return &ReportQueue{
+		queue:             queue.NewQueue[*reportGen.ReportRequest](),
+		runningConfigs:    set.NewStringSet(),
+		jobIDToCancelFunc: make(map[string]context.CancelCauseFunc),
+	}
+}
+
+// Enqueue adds a report request to the back of the queue.
+// The underlying queue is internally synchronized, so no additional locking is needed.
+func (q *ReportQueue) Enqueue(req *reportGen.ReportRequest) {
+	q.queue.Push(req)
+}
+
+// Dequeue removes and returns the first runnable report request from the queue.
+// VIEW_BASED reports are always runnable. Config-based reports are runnable only
+// if their config ID is not in the running set. Returns nil if no runnable
+// request is found. For non-VIEW_BASED reports, the config ID is added to the
+// running set upon dequeue.
+func (q *ReportQueue) Dequeue() *reportGen.ReportRequest {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	req, ok := q.queue.PullWithPred(func(req *reportGen.ReportRequest) bool {
+		if req.ReportSnapshot.GetReportStatus().GetReportRequestType() == storage.ReportStatus_VIEW_BASED {
+			return true
+		}
+		return !q.runningConfigs.Contains(req.ReportSnapshot.GetReportConfigurationId())
+	})
+	if !ok {
+		return nil
+	}
+	if req.ReportSnapshot.GetReportStatus().GetReportRequestType() != storage.ReportStatus_VIEW_BASED {
+		q.runningConfigs.Add(req.ReportSnapshot.GetReportConfigurationId())
+	}
+	return req
+}
+
+// Remove removes a queued (not yet running) request by report snapshot ID.
+// Returns the removed request, or nil if not found.
+// The underlying queue is internally synchronized, so no additional locking is needed.
+func (q *ReportQueue) Remove(reportID string) *reportGen.ReportRequest {
+	req, _ := q.queue.PullWithPred(func(req *reportGen.ReportRequest) bool {
+		return req.ReportSnapshot.GetReportId() == reportID
+	})
+	return req
+}
+
+// MarkReportDoneForConfig removes a config ID from the running set, allowing
+// another report for the same config to be dequeued.
+func (q *ReportQueue) MarkReportDoneForConfig(configID string) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	q.runningConfigs.Remove(configID)
+}
+
+// AddCancelFunc stores a cancel function for a running report, keyed by report ID.
+func (q *ReportQueue) AddCancelFunc(reportID string, cancel context.CancelCauseFunc) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	q.jobIDToCancelFunc[reportID] = cancel
+}
+
+// RemoveCancelFunc removes the cancel function for the given report ID.
+func (q *ReportQueue) RemoveCancelFunc(reportID string) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	delete(q.jobIDToCancelFunc, reportID)
+}
+
+// TryCancel calls the cancel function for the given report ID with
+// ErrUserCancelled as the cause. Returns true if a cancel function was found
+// and invoked.
+func (q *ReportQueue) TryCancel(reportID string) bool {
+	cancel := concurrency.WithLock1(&q.mu, func() context.CancelCauseFunc {
+		return q.jobIDToCancelFunc[reportID]
+	})
+	if cancel == nil {
+		return false
+	}
+	cancel(reportGen.ErrUserCancelled)
+	return true
+}
+
+// Len returns the number of items in the queue.
+// The underlying queue is internally synchronized, so no additional locking is needed.
+func (q *ReportQueue) Len() int {
+	return q.queue.Len()
+}
diff --git a/central/reports/scheduler/v2/reportqueue/report_queue_test.go b/central/reports/scheduler/v2/reportqueue/report_queue_test.go
new file mode 100644
index 0000000000000..73ead9e751a86
--- /dev/null
+++ b/central/reports/scheduler/v2/reportqueue/report_queue_test.go
@@ -0,0 +1,182 @@
+package reportqueue
+
+import (
+	"context"
+	"testing"
+
+	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func makeRequest(reportID, configID string, requestType storage.ReportStatus_RunMethod) *reportGen.ReportRequest {
+	return &reportGen.ReportRequest{
+		ReportSnapshot: &storage.ReportSnapshot{
+			ReportId:              reportID,
+			ReportConfigurationId: configID,
+			ReportStatus: &storage.ReportStatus{
+				ReportRequestType: requestType,
+			},
+		},
+	}
+}
+
+func TestEnqueueDequeueFIFO(t *testing.T) {
+	q := New()
+
+	req1 := makeRequest("r1", "c1", storage.ReportStatus_ON_DEMAND)
+	req2 := makeRequest("r2", "c2", storage.ReportStatus_ON_DEMAND)
+	req3 := makeRequest("r3", "c3", storage.ReportStatus_SCHEDULED)
+
+	q.Enqueue(req1)
+	q.Enqueue(req2)
+	q.Enqueue(req3)
+	assert.Equal(t, 3, q.Len())
+
+	got := q.Dequeue()
+	assert.Equal(t, "r1", got.ReportSnapshot.GetReportId())
+	got = q.Dequeue()
+	assert.Equal(t, "r2", got.ReportSnapshot.GetReportId())
+	got = q.Dequeue()
+	assert.Equal(t, "r3", got.ReportSnapshot.GetReportId())
+
+	assert.Nil(t, q.Dequeue())
+	assert.Equal(t, 0, q.Len())
+}
+
+func TestDequeueSkipsRunningConfig(t *testing.T) {
+	q := New()
+
+	req1 := makeRequest("r1", "c1", storage.ReportStatus_ON_DEMAND)
+	req2 := makeRequest("r2", "c1", storage.ReportStatus_ON_DEMAND)
+	req3 := makeRequest("r3", "c2", storage.ReportStatus_ON_DEMAND)
+
+	q.Enqueue(req1)
+	q.Enqueue(req2)
+	q.Enqueue(req3)
+
+	// Dequeue r1 → c1 is now in runningConfigs
+	got := q.Dequeue()
+	assert.Equal(t, "r1", got.ReportSnapshot.GetReportId())
+
+	// r2 is for c1 (running), should be skipped; r3 (c2) is returned
+	got = q.Dequeue()
+	assert.Equal(t, "r3", got.ReportSnapshot.GetReportId())
+
+	// r2 still blocked
+	assert.Nil(t, q.Dequeue())
+	assert.Equal(t, 1, q.Len())
+}
+
+func TestDequeueViewBasedAlwaysRunnable(t *testing.T) {
+	q := New()
+
+	req1 := makeRequest("r1", "c1", storage.ReportStatus_ON_DEMAND)
+	reqView := makeRequest("r-view", "", storage.ReportStatus_VIEW_BASED)
+
+	q.Enqueue(req1)
+	q.Enqueue(reqView)
+
+	// Dequeue r1 → c1 in runningConfigs
+	got := q.Dequeue()
+	assert.Equal(t, "r1", got.ReportSnapshot.GetReportId())
+
+	// VIEW_BASED always passes regardless of runningConfigs
+	got = q.Dequeue()
+	require.NotNil(t, got)
+	assert.Equal(t, "r-view", got.ReportSnapshot.GetReportId())
+}
+
+func TestMarkReportDoneForConfigUnblocks(t *testing.T) {
+	q := New()
+
+	req1 := makeRequest("r1", "c1", storage.ReportStatus_ON_DEMAND)
+	req2 := makeRequest("r2", "c1", storage.ReportStatus_SCHEDULED)
+
+	q.Enqueue(req1)
+	q.Enqueue(req2)
+
+	got := q.Dequeue()
+	assert.Equal(t, "r1", got.ReportSnapshot.GetReportId())
+
+	// r2 blocked because c1 is running
+	assert.Nil(t, q.Dequeue())
+
+	q.MarkReportDoneForConfig("c1")
+
+	// Now r2 should be dequeued
+	got = q.Dequeue()
+	require.NotNil(t, got)
+	assert.Equal(t, "r2", got.ReportSnapshot.GetReportId())
+}
+
+func TestRemoveFromQueue(t *testing.T) {
+	q := New()
+
+	req1 := makeRequest("r1", "c1", storage.ReportStatus_ON_DEMAND)
+	req2 := makeRequest("r2", "c2", storage.ReportStatus_ON_DEMAND)
+
+	q.Enqueue(req1)
+	q.Enqueue(req2)
+
+	removed := q.Remove("r1")
+	require.NotNil(t, removed)
+	assert.Equal(t, "r1", removed.ReportSnapshot.GetReportId())
+	assert.Equal(t, 1, q.Len())
+
+	// Removing non-existent returns nil
+	assert.Nil(t, q.Remove("nonexistent"))
+	assert.Equal(t, 1, q.Len())
+}
+
+func TestAddCancelFuncAndTryCancel(t *testing.T) {
+	q := New()
+
+	var capturedCause error
+	ctx, cancel := context.WithCancelCause(context.Background())
+	defer cancel(nil)
+
+	q.AddCancelFunc("r1", cancel)
+
+	cancelled := q.TryCancel("r1")
+	assert.True(t, cancelled)
+
+	capturedCause = context.Cause(ctx)
+	assert.ErrorIs(t, capturedCause, reportGen.ErrUserCancelled)
+}
+
+func TestTryCancelReturnsFalseForUnknown(t *testing.T) {
+	q := New()
+	assert.False(t, q.TryCancel("nonexistent"))
+}
+
+func TestRemoveCancelFunc(t *testing.T) {
+	q := New()
+
+	_, cancel := context.WithCancelCause(context.Background())
+
+	q.AddCancelFunc("r1", cancel)
+	q.RemoveCancelFunc("r1")
+
+	// After removal, TryCancel should return false
+	assert.False(t, q.TryCancel("r1"))
+}
+
+func TestViewBasedNotAddedToRunningConfigs(t *testing.T) {
+	q := New()
+
+	reqView1 := makeRequest("r-view-1", "", storage.ReportStatus_VIEW_BASED)
+	reqView2 := makeRequest("r-view-2", "", storage.ReportStatus_VIEW_BASED)
+
+	q.Enqueue(reqView1)
+	q.Enqueue(reqView2)
+
+	got := q.Dequeue()
+	assert.Equal(t, "r-view-1", got.ReportSnapshot.GetReportId())
+
+	// Second VIEW_BASED should also dequeue without being blocked
+	got = q.Dequeue()
+	require.NotNil(t, got)
+	assert.Equal(t, "r-view-2", got.ReportSnapshot.GetReportId())
+}
diff --git a/central/reports/scheduler/v2/scheduler.go b/central/reports/scheduler/v2/scheduler.go
index 266cb90cba578..682a264747d6a 100644
--- a/central/reports/scheduler/v2/scheduler.go
+++ b/central/reports/scheduler/v2/scheduler.go
@@ -16,6 +16,8 @@ type Scheduler interface {
 	UpsertReportSchedule(reportConfig *storage.ReportConfiguration) error
 	// RemoveReportSchedule removes the given report configuration from scheduled execution.
 	RemoveReportSchedule(reportConfigID string)
+	// GetScheduledConfigIDs returns the IDs of all report configurations that have active schedules.
+	GetScheduledConfigIDs() []string
 
 	// CanSubmitReportRequest returns true if the given user can submit an on-demand report request for the given report configuration.
 	CanSubmitReportRequest(user *storage.SlimUser, reportConfig *storage.ReportConfiguration) (bool, error)
diff --git a/central/reports/scheduler/v2/scheduler_impl.go b/central/reports/scheduler/v2/scheduler_impl.go
index d68256d5fd6ac..b418608d39d40 100644
--- a/central/reports/scheduler/v2/scheduler_impl.go
+++ b/central/reports/scheduler/v2/scheduler_impl.go
@@ -1,18 +1,16 @@
 package v2
 
 import (
-	"container/list"
 	"context"
 	"sync/atomic"
 	"time"
 
-	"github.com/graph-gophers/graphql-go"
 	"github.com/pkg/errors"
-	"github.com/stackrox/rox/central/graphql/resolvers"
 	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
 	"github.com/stackrox/rox/central/reports/common"
 	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
 	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	"github.com/stackrox/rox/central/reports/scheduler/v2/reportqueue"
 	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
 	"github.com/stackrox/rox/central/reports/validation"
 	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
@@ -21,13 +19,13 @@ import (
 	"github.com/stackrox/rox/pkg/dblock"
 	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/postgres"
 	"github.com/stackrox/rox/pkg/protocompat"
 	"github.com/stackrox/rox/pkg/protoconv/schedule"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/search"
-	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/sync"
 	"golang.org/x/sync/semaphore"
 	"gopkg.in/robfig/cron.v2"
@@ -39,6 +37,14 @@ var (
 	scheduledCtx = sac.WithAllAccess(context.Background())
 )
 
+// queueGeneratorBinding pairs a report job queue with the generator that processes
+// jobs from that queue. E.g., image CVE report job queue <-> image CVE report
+// generator, node CVE report job queue <-> node CVE report generator.
+type queueGeneratorBinding struct {
+	queue     *reportqueue.ReportQueue
+	generator reportGen.ReportGenerator
+}
+
 type scheduler struct {
 	// Used to map reportConfigs to their cron jobs. This is only used for scheduled reports, On-demand reports are directly added to reportsQueue
 	reportConfigToEntryIDs map[string]cron.EntryID
@@ -47,21 +53,19 @@ type scheduler struct {
 	reportSnapshotStore   reportSnapshotDS.DataStore
 	collectionDatastore   collectionDS.DataStore
 	notifierDatastore     notifierDS.DataStore
-	reportGenerator       reportGen.ReportGenerator
 	validator             *validation.Validator
 
-	reportRequestsQueue *list.List
+	// Ordered list of queue-generator bindings. The main loop round-robins through
+	// these when selecting the next report to run.
+	queues       []queueGeneratorBinding
+	nextQueueIdx int
+	// Maps report type to its queue for routing submissions.
+	queueByType map[storage.ReportSnapshot_ReportType]*reportqueue.ReportQueue
 
-	// Use to signal the scheduler to find and run a new report if a routine is available
-	// This signal is triggered when a new request is added to reportsQueue. It is also triggered when a report completes
-	// execution to inform the scheduler that a routine is free. The signal is reset when there is no report to run.
+	// Signals the scheduler to find and run a new report. Triggered when a new
+	// request is enqueued or when a report completes. Reset when no runnable report
+	// is found across any queue.
 	readyForReports concurrency.Signal
-	// Stores config IDs for which a report is currently running. Used to make sure only one report per config runs at a time.
-	runningReportConfigs set.StringSet
-	// Stores cancel functions for running reports, keyed by report ID.
-	// Used to cancel in-flight database queries and blob store writes when a user cancels a PREPARING report.
-	runningReportCancels map[string]context.CancelCauseFunc
-	Schema               *graphql.Schema
 
 	/* Concurrency and synchronization related fields */
 	// isStarted will make sure only one scheduling routine runs for an instance of scheduler
@@ -69,13 +73,10 @@ type scheduler struct {
 	// isStopped will prevent scheduler from being re-started once it is stopped
 	isStopped atomic.Bool
 
-	/* Concurrency and synchronization related fields */
 	stopper concurrency.Stopper
 
 	// Use to synchronize access to reportConfigToEntryIDs map
 	cronJobsLock sync.Mutex
-	// Use to synchronize access to reportsQueue, runningReportConfigs, and runningReportCancels
-	schedulerLock sync.Mutex
 	// Use to lock any database tables if needed to prevent race conditions
 	dbLock sync.Mutex
 	// NOTE: Lock only one mutex at a time. Do not lock another mutex when one is already held.
@@ -89,35 +90,45 @@ type scheduler struct {
 // New instantiates a new cron scheduler and supports adding and removing report requests
 func New(reportConfigDatastore reportConfigDS.DataStore, reportSnapshotStore reportSnapshotDS.DataStore,
 	collectionDatastore collectionDS.DataStore, notifierDatastore notifierDS.DataStore,
-	reportGenerator reportGen.ReportGenerator, validator *validation.Validator) Scheduler {
+	imageReportGenerator reportGen.ReportGenerator, nodeReportGenerator reportGen.ReportGenerator,
+	validator *validation.Validator) Scheduler {
 
 	cronScheduler := cron.New()
 	cronScheduler.Start()
-	ourSchema, err := graphql.ParseSchema(resolvers.Schema(), resolvers.New())
-	if err != nil {
-		panic(err)
-	}
 	return newSchedulerImpl(reportConfigDatastore, reportSnapshotStore, collectionDatastore, notifierDatastore,
-		reportGenerator, validator, cronScheduler, ourSchema)
+		imageReportGenerator, nodeReportGenerator, validator, cronScheduler)
 }
 
 func newSchedulerImpl(reportConfigDatastore reportConfigDS.DataStore, reportSnapshotStore reportSnapshotDS.DataStore,
 	collectionDatastore collectionDS.DataStore, notifierDatastore notifierDS.DataStore,
-	reportGenerator reportGen.ReportGenerator, validator *validation.Validator, cronScheduler *cron.Cron,
-	schema *graphql.Schema) *scheduler {
+	imageReportGenerator reportGen.ReportGenerator, nodeReportGenerator reportGen.ReportGenerator,
+	validator *validation.Validator, cronScheduler *cron.Cron) *scheduler {
+
+	imageQueue := reportqueue.New()
+	queues := []queueGeneratorBinding{
+		{queue: imageQueue, generator: imageReportGenerator},
+	}
+	queueByType := map[storage.ReportSnapshot_ReportType]*reportqueue.ReportQueue{
+		storage.ReportSnapshot_VULNERABILITY: imageQueue,
+	}
+
+	if features.NodeVulnerabilityReports.Enabled() && nodeReportGenerator != nil {
+		nodeQueue := reportqueue.New()
+		queues = append(queues, queueGeneratorBinding{queue: nodeQueue, generator: nodeReportGenerator})
+		queueByType[storage.ReportSnapshot_NODE_VULNERABILITY] = nodeQueue
+	}
+
 	s := &scheduler{
 		reportConfigToEntryIDs: make(map[string]cron.EntryID),
 		reportConfigDatastore:  reportConfigDatastore,
 		reportSnapshotStore:    reportSnapshotStore,
 		collectionDatastore:    collectionDatastore,
 		notifierDatastore:      notifierDatastore,
-		reportGenerator:        reportGenerator,
 		validator:              validator,
-		reportRequestsQueue:    list.New(),
+		queues:                 queues,
+		nextQueueIdx:           0,
+		queueByType:            queueByType,
 		readyForReports:        concurrency.NewSignal(),
-		runningReportConfigs:   set.NewStringSet(),
-		runningReportCancels:   make(map[string]context.CancelCauseFunc),
-		Schema:                 schema,
 		stopper:                concurrency.NewStopper(),
 		cron:                   cronScheduler,
 		concurrencySema:        semaphore.NewWeighted(int64(env.ReportExecutionMaxConcurrency.IntegerSetting())),
@@ -186,8 +197,8 @@ func (s *scheduler) runReports() {
 		case <-s.stopper.Flow().StopRequested():
 			return
 		case <-s.readyForReports.Done():
-			reportRequest := s.selectNextRunnableReport()
-			if reportRequest == nil {
+			req, q, gen := s.selectNextJobRoundRobin()
+			if req == nil {
 				s.readyForReports.Reset()
 				continue
 			}
@@ -195,72 +206,37 @@ func (s *scheduler) runReports() {
 				log.Errorf("Error acquiring semaphore to run new report: %v", err)
 				continue
 			}
-			log.Infof("Executing report '%s' at %v", reportRequest.ReportSnapshot.GetName(), time.Now().Format(time.RFC822))
-			go s.runSingleReport(reportRequest)
+			log.Infof("Executing report '%s' at %v", req.ReportSnapshot.GetName(), time.Now().Format(time.RFC822))
+			go s.runSingleReport(q, gen, req)
 		}
 	}
 }
 
-func (s *scheduler) selectNextRunnableReport() *reportGen.ReportRequest {
-	s.schedulerLock.Lock()
-	defer s.schedulerLock.Unlock()
-
-	request := findAndRemoveFromQueue(s.reportRequestsQueue, func(req *reportGen.ReportRequest) bool {
-		if req.ReportSnapshot.GetReportStatus().GetReportRequestType() == storage.ReportStatus_VIEW_BASED {
-			return true
+func (s *scheduler) selectNextJobRoundRobin() (*reportGen.ReportRequest, *reportqueue.ReportQueue, reportGen.ReportGenerator) {
+	n := len(s.queues)
+	for i := range n {
+		idx := (s.nextQueueIdx + i) % n
+		qb := s.queues[idx]
+		if req := qb.queue.Dequeue(); req != nil {
+			s.nextQueueIdx = (idx + 1) % n
+			return req, qb.queue, qb.generator
 		}
-		return !s.runningReportConfigs.Contains(req.ReportSnapshot.GetReportConfigurationId())
-	})
-	if request == nil {
-		return nil
-	}
-	if request.ReportSnapshot.GetVulnReportFilters() != nil {
-		s.runningReportConfigs.Add(request.ReportSnapshot.GetReportConfigurationId())
 	}
-	return request
+	return nil, nil, nil
 }
 
-func (s *scheduler) runSingleReport(req *reportGen.ReportRequest) {
+func (s *scheduler) runSingleReport(q *reportqueue.ReportQueue, gen reportGen.ReportGenerator, req *reportGen.ReportRequest) {
 	defer s.readyForReports.Signal()
 	defer s.concurrencySema.Release(1)
-	defer s.removeFromRunningReportConfigs(req.ReportSnapshot.GetReportConfigurationId())
+	defer q.MarkReportDoneForConfig(req.ReportSnapshot.GetReportConfigurationId())
 
 	reportID := req.ReportSnapshot.GetReportId()
 	ctx, cancel := context.WithCancelCause(context.Background())
-	s.addRunningReportCancel(reportID, cancel)
+	q.AddCancelFunc(reportID, cancel)
 	defer cancel(nil)
-	defer s.removeRunningReportCancel(reportID)
+	defer q.RemoveCancelFunc(reportID)
 
-	s.reportGenerator.ProcessReportRequest(ctx, req)
-}
-
-func (s *scheduler) removeFromRunningReportConfigs(configID string) {
-	s.schedulerLock.Lock()
-	defer s.schedulerLock.Unlock()
-	s.runningReportConfigs.Remove(configID)
-}
-
-func (s *scheduler) addRunningReportCancel(reportID string, cancel context.CancelCauseFunc) {
-	s.schedulerLock.Lock()
-	defer s.schedulerLock.Unlock()
-	s.runningReportCancels[reportID] = cancel
-}
-
-func (s *scheduler) removeRunningReportCancel(reportID string) {
-	s.schedulerLock.Lock()
-	defer s.schedulerLock.Unlock()
-	delete(s.runningReportCancels, reportID)
-}
-
-func (s *scheduler) tryCancelRunningReport(reportID string) bool {
-	cancel := concurrency.WithLock1(&s.schedulerLock, func() context.CancelCauseFunc {
-		return s.runningReportCancels[reportID]
-	})
-	if cancel == nil {
-		return false
-	}
-	cancel(reportGen.ErrUserCancelled)
-	return true
+	gen.ProcessReportRequest(ctx, req)
 }
 
 // UpsertReportSchedule adds/updates the schedule at which reports for the given report config are executed.
@@ -298,6 +274,17 @@ func (s *scheduler) RemoveReportSchedule(reportConfigID string) {
 	}
 }
 
+func (s *scheduler) GetScheduledConfigIDs() []string {
+	s.cronJobsLock.Lock()
+	defer s.cronJobsLock.Unlock()
+
+	ids := make([]string, 0, len(s.reportConfigToEntryIDs))
+	for id := range s.reportConfigToEntryIDs {
+		ids = append(ids, id)
+	}
+	return ids
+}
+
 /* Functions to add/remove report jobs from queue */
 
 // CancelReportRequest cancels a report request. If the report is waiting in queue, it is removed
@@ -305,31 +292,29 @@ func (s *scheduler) RemoveReportSchedule(reportConfigID string) {
 // being prepared, its context is cancelled, which propagates cancellation to in-flight database
 // queries and blob store writes.
 func (s *scheduler) CancelReportRequest(ctx context.Context, reportID string) (bool, error) {
-	req := s.tryRemoveFromRequestQueue(reportID)
-	if req != nil {
-		req.ReportSnapshot.ReportStatus.ErrorMsg = reportGen.ErrUserCancelled.Error()
-		req.ReportSnapshot.ReportStatus.CompletedAt = protocompat.TimestampNow()
-		req.ReportSnapshot.ReportStatus.RunState = storage.ReportStatus_FAILURE
-		if err := s.reportSnapshotStore.UpdateReportSnapshot(ctx, req.ReportSnapshot); err != nil {
-			return false, errors.Wrapf(err, "Error updating report snapshot to FAILURE for report ID '%s'", reportID)
+	for _, qb := range s.queues {
+		req := qb.queue.Remove(reportID)
+		if req != nil {
+			req.ReportSnapshot.ReportStatus.ErrorMsg = reportGen.ErrUserCancelled.Error()
+			req.ReportSnapshot.ReportStatus.CompletedAt = protocompat.TimestampNow()
+			req.ReportSnapshot.ReportStatus.RunState = storage.ReportStatus_FAILURE
+			if err := s.reportSnapshotStore.UpdateReportSnapshot(ctx, req.ReportSnapshot); err != nil {
+				return false, errors.Wrapf(err, "Error updating report snapshot to FAILURE for report ID '%s'", reportID)
+			}
+			return true, nil
 		}
-		return true, nil
 	}
-	return s.tryCancelRunningReport(reportID), nil
-}
-
-// Returns the removed ReportRequest if found, nil otherwise
-func (s *scheduler) tryRemoveFromRequestQueue(reportID string) *reportGen.ReportRequest {
-	s.schedulerLock.Lock()
-	defer s.schedulerLock.Unlock()
-
-	return findAndRemoveFromQueue(s.reportRequestsQueue, func(req *reportGen.ReportRequest) bool {
-		return req.ReportSnapshot.GetReportId() == reportID
-	})
+	for _, qb := range s.queues {
+		if qb.queue.TryCancel(reportID) {
+			return true, nil
+		}
+	}
+	return false, nil
 }
 
 func (s *scheduler) CanSubmitReportRequest(user *storage.SlimUser, reportConfig *storage.ReportConfiguration) (bool, error) {
-	return s.doesUserHavePendingReport(reportConfig.GetId(), user.GetId())
+	return s.doesUserHavePendingReport(reportConfig.GetId(), user.GetId(),
+		storage.ReportSnapshot_ReportType(reportConfig.GetType()))
 }
 
 // SubmitReportRequest submits a report execution request. The report request can be either for an on demand report or a scheduled report.
@@ -341,6 +326,11 @@ func (s *scheduler) SubmitReportRequest(ctx context.Context, request *reportGen.
 		return "", err
 	}
 
+	q := s.queueForSnapshot(request.ReportSnapshot)
+	if q == nil {
+		return "", errors.New("node vulnerability reports are not enabled")
+	}
+
 	request.ReportSnapshot.ReportStatus.RunState = storage.ReportStatus_WAITING
 	request.ReportSnapshot.ReportStatus.QueuedAt = protocompat.TimestampNow()
 	request.ReportSnapshot.ReportId, err = s.validateAndPersistSnapshot(ctx, request.ReportSnapshot, reSubmission)
@@ -348,16 +338,16 @@ func (s *scheduler) SubmitReportRequest(ctx context.Context, request *reportGen.
 		return "", err
 	}
 
-	s.appendToReportsQueue(request)
+	if s.isStarted.Load() {
+		q.Enqueue(request)
+		s.readyForReports.Signal()
+	}
 
 	return request.ReportSnapshot.GetReportId(), nil
 }
 
-func (s *scheduler) appendToReportsQueue(req *reportGen.ReportRequest) {
-	s.schedulerLock.Lock()
-	defer s.schedulerLock.Unlock()
-	s.reportRequestsQueue.PushBack(req)
-	s.readyForReports.Signal()
+func (s *scheduler) queueForSnapshot(snap *storage.ReportSnapshot) *reportqueue.ReportQueue {
+	return s.queueByType[snap.GetType()]
 }
 
 func (s *scheduler) reportClosure(reportConfig *storage.ReportConfiguration) func() {
@@ -441,8 +431,12 @@ func (s *scheduler) queuePendingReports() {
 }
 
 func (s *scheduler) queueScheduledReports() {
+	reportTypes := []string{storage.ReportConfiguration_VULNERABILITY.String()}
+	if features.NodeVulnerabilityReports.Enabled() {
+		reportTypes = append(reportTypes, storage.ReportConfiguration_NODE_VULNERABILITY.String())
+	}
 	query := search.NewQueryBuilder().
-		AddExactMatches(search.ReportType, storage.ReportConfiguration_VULNERABILITY.String()).
+		AddExactMatches(search.ReportType, reportTypes...).
 		ProtoQuery()
 	reportConfigs, err := s.reportConfigDatastore.GetReportConfigurations(scheduledCtx, query)
 	if err != nil {
@@ -468,8 +462,12 @@ func (s *scheduler) recoverMissedSchedules() {
 		return
 	}
 
+	reportTypes := []string{storage.ReportConfiguration_VULNERABILITY.String()}
+	if features.NodeVulnerabilityReports.Enabled() {
+		reportTypes = append(reportTypes, storage.ReportConfiguration_NODE_VULNERABILITY.String())
+	}
 	query := search.NewQueryBuilder().
-		AddExactMatches(search.ReportType, storage.ReportConfiguration_VULNERABILITY.String()).
+		AddExactMatches(search.ReportType, reportTypes...).
 		ProtoQuery()
 	reportConfigs, err := s.reportConfigDatastore.GetReportConfigurations(scheduledCtx, query)
 	if err != nil {
@@ -575,28 +573,6 @@ func findPreviousFireTime(cronSchedule cron.Schedule, now time.Time) time.Time {
 	return previousFire
 }
 
-/* Utility Functions */
-
-// findAndRemoveFromQueue will find the first element that matches the given predicate and returns ReportRequest from that element
-// Elements with values that are not of type *reportGen.ReportRequest will be skipped.
-// Note: This function does not lock the queue, so any locks to prevent race conditions must be taken by the caller.
-func findAndRemoveFromQueue(reportRequestsQueue *list.List, pred func(req *reportGen.ReportRequest) bool) *reportGen.ReportRequest {
-	var toRemove *list.Element
-	cur := reportRequestsQueue.Front()
-	for cur != nil {
-		req, ok := cur.Value.(*reportGen.ReportRequest)
-		if ok && pred(req) {
-			toRemove = cur
-			break
-		}
-		cur = cur.Next()
-	}
-	if toRemove == nil {
-		return nil
-	}
-	return reportRequestsQueue.Remove(toRemove).(*reportGen.ReportRequest)
-}
-
 // Validate report snapshot and store it to db if validation succeeds.
 // Will return report_id if successful.
 // Validation will check if the user requesting the report doesn't already have a pending report for the same config
@@ -605,8 +581,11 @@ func (s *scheduler) validateAndPersistSnapshot(ctx context.Context, snapshot *st
 	defer s.dbLock.Unlock()
 	var err error
 	if !reSubmission {
-		if snapshot.GetVulnReportFilters() != nil && snapshot.GetReportStatus().GetReportRequestType() == storage.ReportStatus_ON_DEMAND {
-			userHasAnotherReport, err := s.doesUserHavePendingReport(snapshot.GetReportConfigurationId(), snapshot.GetRequester().GetId())
+		requestType := snapshot.GetReportStatus().GetReportRequestType()
+		reportType := snapshot.GetType()
+
+		if requestType == storage.ReportStatus_ON_DEMAND {
+			userHasAnotherReport, err := s.doesUserHavePendingReport(snapshot.GetReportConfigurationId(), snapshot.GetRequester().GetId(), reportType)
 			if err != nil {
 				return "", err
 			}
@@ -616,9 +595,8 @@ func (s *scheduler) validateAndPersistSnapshot(ctx context.Context, snapshot *st
 			}
 		}
 
-		// if user has an existing view based report job then dont queue a new one
-		if snapshot.GetViewBasedVulnReportFilters() != nil {
-			userHasAnotherReport, err := s.doesUserHaveViewBasedPendingReport(snapshot.GetRequester().GetId())
+		if requestType == storage.ReportStatus_VIEW_BASED {
+			userHasAnotherReport, err := s.doesUserHaveViewBasedPendingReport(snapshot.GetRequester().GetId(), reportType)
 			if err != nil {
 				return "", err
 			}
@@ -627,11 +605,11 @@ func (s *scheduler) validateAndPersistSnapshot(ctx context.Context, snapshot *st
 			}
 		}
 
-		// View-based reports are authorized at the gRPC layer with only Image+Deployment
-		// view permissions (no WorkflowAdministration write required). The snapshot datastore
-		// requires WorkflowAdministration write, so we elevate to a privileged context here.
+		// View-based reports are authorized at the gRPC layer with only view permissions
+		// (no WorkflowAdministration write required). The snapshot datastore requires
+		// WorkflowAdministration write, so we elevate to a privileged context here.
 		persistCtx := ctx
-		if snapshot.GetViewBasedVulnReportFilters() != nil {
+		if requestType == storage.ReportStatus_VIEW_BASED {
 			persistCtx = sac.WithAllAccess(ctx)
 		}
 		snapshot.ReportId, err = s.reportSnapshotStore.AddReportSnapshot(persistCtx, snapshot)
@@ -645,27 +623,26 @@ func (s *scheduler) validateAndPersistSnapshot(ctx context.Context, snapshot *st
 	return snapshot.GetReportId(), nil
 }
 
-func (s *scheduler) doesUserHaveViewBasedPendingReport(userID string) (bool, error) {
+func (s *scheduler) doesUserHaveViewBasedPendingReport(userID string, reportType storage.ReportSnapshot_ReportType) (bool, error) {
 	query := search.NewQueryBuilder().
 		AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).
 		AddExactMatches(search.ReportRequestType, storage.ReportStatus_VIEW_BASED.String()).
 		AddExactMatches(search.UserID, userID).
+		AddExactMatches(search.ReportType, reportType.String()).
 		ProtoQuery()
 	runningReports, err := s.reportSnapshotStore.Count(scheduledCtx, query)
 	if err != nil {
 		return false, err
 	}
-	if runningReports > 0 {
-		return true, nil
-	}
-	return false, nil
+	return runningReports > 0, nil
 }
 
-func (s *scheduler) doesUserHavePendingReport(configID string, userID string) (bool, error) {
+func (s *scheduler) doesUserHavePendingReport(configID string, userID string, reportType storage.ReportSnapshot_ReportType) (bool, error) {
 	query := search.NewQueryBuilder().
 		AddExactMatches(search.ReportConfigID, configID).
 		AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).
 		AddExactMatches(search.ReportRequestType, storage.ReportStatus_ON_DEMAND.String()).
+		AddExactMatches(search.ReportType, reportType.String()).
 		ProtoQuery()
 	runningReports, err := s.reportSnapshotStore.SearchReportSnapshots(scheduledCtx, query)
 	if err != nil {
diff --git a/central/reports/scheduler/v2/scheduler_impl_test.go b/central/reports/scheduler/v2/scheduler_impl_test.go
index 9afaf3d9aa369..0eb70524f3ee5 100644
--- a/central/reports/scheduler/v2/scheduler_impl_test.go
+++ b/central/reports/scheduler/v2/scheduler_impl_test.go
@@ -154,7 +154,7 @@ func TestQueueScheduledReportsSkipsEmptyResourceScope(t *testing.T) {
 	cronScheduler.Start()
 	defer cronScheduler.Stop()
 
-	s := newSchedulerImpl(mockReportConfigDS, nil, nil, nil, nil, nil, cronScheduler, nil)
+	s := newSchedulerImpl(mockReportConfigDS, nil, nil, nil, nil, nil, nil, cronScheduler)
 	s.queueScheduledReports()
 
 	// Only the two valid configs should have been scheduled
@@ -165,54 +165,6 @@ func TestQueueScheduledReportsSkipsEmptyResourceScope(t *testing.T) {
 	assert.NotContains(t, s.reportConfigToEntryIDs, "config-nil-scope")
 }
 
-func TestCancelRunningReportCancelsContext(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mockReportGen := reportGenMocks.NewMockReportGenerator(ctrl)
-
-	cronScheduler := cron.New()
-	cronScheduler.Start()
-	defer cronScheduler.Stop()
-
-	s := newSchedulerImpl(nil, nil, nil, nil, mockReportGen, nil, cronScheduler, nil)
-
-	started := make(chan struct{})
-	done := make(chan struct{})
-	var capturedCtx context.Context
-
-	mockReportGen.EXPECT().ProcessReportRequest(gomock.Any(), gomock.Any()).DoAndReturn(
-		func(ctx context.Context, req *reportGen.ReportRequest) {
-			capturedCtx = ctx
-			close(started)
-			<-done
-		},
-	)
-
-	req := &reportGen.ReportRequest{
-		ReportSnapshot: &storage.ReportSnapshot{
-			ReportId:              "test-report-id",
-			ReportConfigurationId: "test-config-id",
-			ReportStatus: &storage.ReportStatus{
-				RunState: storage.ReportStatus_WAITING,
-			},
-		},
-	}
-
-	// Acquire the semaphore since runSingleReport releases it
-	err := s.concurrencySema.Acquire(context.Background(), 1)
-	assert.NoError(t, err)
-
-	go s.runSingleReport(req)
-	<-started
-
-	cancelled := s.tryCancelRunningReport("test-report-id")
-	assert.True(t, cancelled)
-
-	assert.Error(t, capturedCtx.Err())
-	assert.ErrorIs(t, context.Cause(capturedCtx), reportGen.ErrUserCancelled)
-
-	close(done)
-}
-
 func TestCancelReportRequestCancelsRunningReport(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	mockReportGen := reportGenMocks.NewMockReportGenerator(ctrl)
@@ -221,7 +173,8 @@ func TestCancelReportRequestCancelsRunningReport(t *testing.T) {
 	cronScheduler.Start()
 	defer cronScheduler.Stop()
 
-	s := newSchedulerImpl(nil, nil, nil, nil, mockReportGen, nil, cronScheduler, nil)
+	s := newSchedulerImpl(nil, nil, nil, nil, mockReportGen, nil, nil, cronScheduler)
+	imageQueue := s.queueByType[storage.ReportSnapshot_VULNERABILITY]
 
 	started := make(chan struct{})
 	done := make(chan struct{})
@@ -239,6 +192,7 @@ func TestCancelReportRequestCancelsRunningReport(t *testing.T) {
 		ReportSnapshot: &storage.ReportSnapshot{
 			ReportId:              "running-report-id",
 			ReportConfigurationId: "test-config-id",
+			Type:                  storage.ReportSnapshot_VULNERABILITY,
 			ReportStatus: &storage.ReportStatus{
 				RunState: storage.ReportStatus_WAITING,
 			},
@@ -249,7 +203,7 @@ func TestCancelReportRequestCancelsRunningReport(t *testing.T) {
 	err := s.concurrencySema.Acquire(context.Background(), 1)
 	assert.NoError(t, err)
 
-	go s.runSingleReport(req)
+	go s.runSingleReport(imageQueue, mockReportGen, req)
 	<-started
 
 	// Report is not in queue (it's running), so CancelReportRequest should cancel the running context
@@ -268,7 +222,7 @@ func TestCancelReportRequestReturnsFalseForUnknownReport(t *testing.T) {
 	cronScheduler.Start()
 	defer cronScheduler.Stop()
 
-	s := newSchedulerImpl(nil, nil, nil, nil, nil, nil, cronScheduler, nil)
+	s := newSchedulerImpl(nil, nil, nil, nil, nil, nil, nil, cronScheduler)
 
 	cancelled, err := s.CancelReportRequest(context.Background(), "nonexistent-id")
 	assert.NoError(t, err)
@@ -337,10 +291,11 @@ func TestQueuePendingReports(t *testing.T) {
 	cronScheduler.Start()
 	defer cronScheduler.Stop()
 
-	s := newSchedulerImpl(mockReportConfigDS, mockSnapshotStore, mockCollectionDS, nil, nil, nil, cronScheduler, nil)
+	s := newSchedulerImpl(mockReportConfigDS, mockSnapshotStore, mockCollectionDS, nil, nil, nil, nil, cronScheduler)
+	s.isStarted.Store(true)
 	s.queuePendingReports()
 
-	assert.Equal(t, 2, s.reportRequestsQueue.Len())
+	assert.Equal(t, 2, s.queues[0].queue.Len())
 }
 
 func TestCancelReportRequestUpdatesWaitingReportToFailure(t *testing.T) {
@@ -351,19 +306,21 @@ func TestCancelReportRequestUpdatesWaitingReportToFailure(t *testing.T) {
 	cronScheduler.Start()
 	defer cronScheduler.Stop()
 
-	s := newSchedulerImpl(nil, mockSnapshotStore, nil, nil, nil, nil, cronScheduler, nil)
+	s := newSchedulerImpl(nil, mockSnapshotStore, nil, nil, nil, nil, nil, cronScheduler)
+	imageQueue := s.queueByType[storage.ReportSnapshot_VULNERABILITY]
 
 	req := &reportGen.ReportRequest{
 		ReportSnapshot: &storage.ReportSnapshot{
 			ReportId:              "waiting-report-id",
 			ReportConfigurationId: "test-config-id",
 			Name:                  "test-report",
+			Type:                  storage.ReportSnapshot_VULNERABILITY,
 			ReportStatus: &storage.ReportStatus{
 				RunState: storage.ReportStatus_WAITING,
 			},
 		},
 	}
-	s.reportRequestsQueue.PushBack(req)
+	imageQueue.Enqueue(req)
 
 	mockSnapshotStore.EXPECT().UpdateReportSnapshot(gomock.Any(), gomock.Any()).
 		DoAndReturn(func(_ context.Context, snap *storage.ReportSnapshot) error {
@@ -376,5 +333,5 @@ func TestCancelReportRequestUpdatesWaitingReportToFailure(t *testing.T) {
 	cancelled, err := s.CancelReportRequest(context.Background(), "waiting-report-id")
 	assert.NoError(t, err)
 	assert.True(t, cancelled)
-	assert.Equal(t, 0, s.reportRequestsQueue.Len())
+	assert.Equal(t, 0, imageQueue.Len())
 }
diff --git a/central/reports/scheduler/v2/singleton.go b/central/reports/scheduler/v2/singleton.go
index 8d1788568e943..bafe399d2806e 100644
--- a/central/reports/scheduler/v2/singleton.go
+++ b/central/reports/scheduler/v2/singleton.go
@@ -4,6 +4,7 @@ import (
 	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
 	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
 	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	nodeReportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator/node"
 	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
 	"github.com/stackrox/rox/central/reports/validation"
 	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
@@ -24,6 +25,7 @@ func initialize() {
 		collectionDatastore,
 		notifierDS.Singleton(),
 		reportGen.Singleton(),
+		nodeReportGen.Singleton(),
 		validation.Singleton(),
 	)
 }
diff --git a/central/reports/service/v2/convert.go b/central/reports/service/v2/convert.go
index ced98185678bf..9c25a59fe7c3d 100644
--- a/central/reports/service/v2/convert.go
+++ b/central/reports/service/v2/convert.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/pkg/errors"
+	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
 	"github.com/stackrox/rox/central/reports/common"
 	apiV2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/generated/storage"
@@ -56,7 +57,7 @@ func (s *serviceImpl) convertV2ReportConfigurationToProto(config *apiV2.ReportCo
 		Name:          config.GetName(),
 		Description:   config.GetDescription(),
 		Type:          storage.ReportConfiguration_ReportType(config.GetType()),
-		Schedule:      s.convertV2ScheduleToProto(config.GetSchedule()),
+		Schedule:      ConvertV2ScheduleToProto(config.GetSchedule()),
 		ResourceScope: s.convertV2ResourceScopeToProto(config.GetResourceScope()),
 		Creator:       creator,
 		Version:       2,
@@ -69,7 +70,7 @@ func (s *serviceImpl) convertV2ReportConfigurationToProto(config *apiV2.ReportCo
 	}
 
 	for _, notifier := range config.GetNotifiers() {
-		ret.Notifiers = append(ret.Notifiers, s.convertV2NotifierConfigToProto(notifier))
+		ret.Notifiers = append(ret.Notifiers, ConvertV2NotifierConfigToProto(notifier))
 	}
 
 	return ret
@@ -199,7 +200,8 @@ func v2MatchTypeToStorage(m apiV2.MatchType) storage.MatchType {
 	}
 }
 
-func (s *serviceImpl) convertV2NotifierConfigToProto(notifier *apiV2.NotifierConfiguration) *storage.NotifierConfiguration {
+// ConvertV2NotifierConfigToProto converts apiV2.NotifierConfiguration to storage.NotifierConfiguration.
+func ConvertV2NotifierConfigToProto(notifier *apiV2.NotifierConfiguration) *storage.NotifierConfiguration {
 	if notifier == nil {
 		return nil
 	}
@@ -222,8 +224,8 @@ func (s *serviceImpl) convertV2NotifierConfigToProto(notifier *apiV2.NotifierCon
 	return ret
 }
 
-// convertV2ScheduleToProto converts v2.ReportSchedule to storage.Schedule. Does not validate v2.ReportSchedule
-func (s *serviceImpl) convertV2ScheduleToProto(schedule *apiV2.ReportSchedule) *storage.Schedule {
+// ConvertV2ScheduleToProto converts v2.ReportSchedule to storage.Schedule. Does not validate v2.ReportSchedule.
+func ConvertV2ScheduleToProto(schedule *apiV2.ReportSchedule) *storage.Schedule {
 	if schedule == nil {
 		return nil
 	}
@@ -266,7 +268,7 @@ func (s *serviceImpl) convertProtoReportConfigurationToV2(config *storage.Report
 		Name:          config.GetName(),
 		Description:   config.GetDescription(),
 		Type:          apiV2.ReportConfiguration_ReportType(config.GetType()),
-		Schedule:      s.convertProtoScheduleToV2(config.GetSchedule()),
+		Schedule:      ConvertProtoScheduleToV2(config.GetSchedule()),
 		ResourceScope: resourceScope,
 	}
 
@@ -285,11 +287,13 @@ func (s *serviceImpl) convertProtoReportConfigurationToV2(config *storage.Report
 	}
 
 	for _, notifier := range config.GetNotifiers() {
-		converted, err := s.convertProtoNotifierConfigToV2(notifier)
+		converted, err := ConvertProtoNotifierConfigToV2(s.notifierDatastore, notifier)
 		if err != nil {
 			return nil, err
 		}
-		ret.Notifiers = append(ret.Notifiers, converted)
+		if converted != nil {
+			ret.Notifiers = append(ret.Notifiers, converted)
+		}
 	}
 
 	return ret, nil
@@ -430,8 +434,8 @@ func storageMatchTypeToV2(m storage.MatchType) apiV2.MatchType {
 	}
 }
 
-// convertProtoNotifierConfigToV2 converts storage.NotifierConfiguration to apiV2.NotifierConfiguration
-func (s *serviceImpl) convertProtoNotifierConfigToV2(notifierConfig *storage.NotifierConfiguration) (*apiV2.NotifierConfiguration, error) {
+// ConvertProtoNotifierConfigToV2 converts storage.NotifierConfiguration to apiV2.NotifierConfiguration.
+func ConvertProtoNotifierConfigToV2(ds notifierDS.DataStore, notifierConfig *storage.NotifierConfiguration) (*apiV2.NotifierConfiguration, error) {
 	if notifierConfig == nil {
 		return nil, nil
 	}
@@ -440,7 +444,7 @@ func (s *serviceImpl) convertProtoNotifierConfigToV2(notifierConfig *storage.Not
 		return nil, nil
 	}
 
-	notifier, found, err := s.notifierDatastore.GetNotifier(allAccessCtx, notifierConfig.GetId())
+	notifier, found, err := ds.GetNotifier(allAccessCtx, notifierConfig.GetId())
 	if err != nil {
 		return nil, err
 	}
@@ -461,8 +465,8 @@ func (s *serviceImpl) convertProtoNotifierConfigToV2(notifierConfig *storage.Not
 	}, nil
 }
 
-// convertProtoScheduleToV2 converts storage.Schedule to v2.ReportSchedule. Does not validate storage.Schedule
-func (s *serviceImpl) convertProtoScheduleToV2(schedule *storage.Schedule) *apiV2.ReportSchedule {
+// ConvertProtoScheduleToV2 converts storage.Schedule to v2.ReportSchedule
+func ConvertProtoScheduleToV2(schedule *storage.Schedule) *apiV2.ReportSchedule {
 	if schedule == nil {
 		return nil
 	}
@@ -510,13 +514,15 @@ func (s *serviceImpl) convertProtoReportCollectiontoV2(collection *storage.Colle
 	}
 }
 
-// convertProtoNotifierSnapshotToV2 converts notifiersnapshot proto to v2
-func (s *serviceImpl) convertProtoNotifierSnapshotToV2(notifierSnapshot *storage.NotifierSnapshot) *apiV2.NotifierConfiguration {
+// ConvertProtoNotifierSnapshotToV2 converts storage.NotifierSnapshot to apiV2.NotifierConfiguration.
+func ConvertProtoNotifierSnapshotToV2(notifierSnapshot *storage.NotifierSnapshot) *apiV2.NotifierConfiguration {
 	if notifierSnapshot == nil {
 		return nil
 	}
 	if notifierSnapshot.GetEmailConfig() == nil {
-		return &apiV2.NotifierConfiguration{}
+		return &apiV2.NotifierConfiguration{
+			NotifierName: notifierSnapshot.GetNotifierName(),
+		}
 	}
 
 	return &apiV2.NotifierConfiguration{
@@ -586,26 +592,31 @@ func (s *serviceImpl) convertProtoReportSnapshotstoV2(snapshots []*storage.Repor
 				return nil, err
 			}
 		}
+		parentDir := snapshot.GetReportConfigurationId()
+		if snapshot.GetViewBasedVulnReportFilters() != nil {
+			parentDir = "view-based-report"
+		}
 		snapshotv2 := &apiV2.ReportSnapshot{
 			ReportStatus:       s.convertPrototoV2Reportstatus(snapshot.GetReportStatus()),
 			ReportConfigId:     snapshot.GetReportConfigurationId(),
 			ReportJobId:        snapshot.GetReportId(),
 			Name:               snapshot.GetName(),
 			Description:        snapshot.GetDescription(),
+			Type:               apiV2.ReportSnapshot_ReportType(snapshot.GetType()),
 			CollectionSnapshot: s.convertProtoReportCollectiontoV2(snapshot.GetCollection()),
 			User: &apiV2.SlimUser{
 				Id:   snapshot.GetRequester().GetId(),
 				Name: snapshot.GetRequester().GetName(),
 			},
-			Schedule: s.convertProtoScheduleToV2(snapshot.GetSchedule()),
+			Schedule:            ConvertProtoScheduleToV2(snapshot.GetSchedule()),
+			ResourceScope:       resourceScope,
+			IsDownloadAvailable: blobNames.Contains(common.GetReportBlobPath(parentDir, snapshot.GetReportId())),
 			Filter: &apiV2.ReportSnapshot_VulnReportFilters{
 				VulnReportFilters: s.convertProtoVulnReportFiltersToV2(snapshot.GetVulnReportFilters()),
 			},
-			ResourceScope:       resourceScope,
-			IsDownloadAvailable: blobNames.Contains(common.GetReportBlobPath(snapshot.GetReportConfigurationId(), snapshot.GetReportId())),
 		}
 		for _, notifier := range snapshot.GetNotifiers() {
-			converted := s.convertProtoNotifierSnapshotToV2(notifier)
+			converted := ConvertProtoNotifierSnapshotToV2(notifier)
 			if converted != nil {
 				snapshotv2.Notifiers = append(snapshotv2.Notifiers, converted)
 			}
@@ -620,7 +631,7 @@ func (s *serviceImpl) getExistingBlobNames(snapshots []*storage.ReportSnapshot)
 	blobNames := make([]string, 0)
 	for _, snap := range snapshots {
 		status := snap.GetReportStatus()
-		if status.GetReportNotificationMethod() == storage.ReportStatus_DOWNLOAD {
+		if status != nil && status.GetReportNotificationMethod() == storage.ReportStatus_DOWNLOAD {
 			if status.GetRunState() == storage.ReportStatus_GENERATED ||
 				status.GetRunState() == storage.ReportStatus_DELIVERED {
 				parentDir := snap.GetReportConfigurationId()
diff --git a/central/reports/service/v2/convert_test.go b/central/reports/service/v2/convert_test.go
index 1e8d673c59b1f..d362061f463ab 100644
--- a/central/reports/service/v2/convert_test.go
+++ b/central/reports/service/v2/convert_test.go
@@ -479,7 +479,7 @@ func (s *typeConversionTestSuite) TestConvertProtoScheduleToV2() {
 
 	for _, c := range cases {
 		s.T().Run(c.testname, func(t *testing.T) {
-			converted := s.service.convertProtoScheduleToV2(c.schedule)
+			converted := ConvertProtoScheduleToV2(c.schedule)
 			protoassert.Equal(t, c.result, converted)
 		})
 	}
@@ -515,7 +515,7 @@ func (s *typeConversionTestSuite) TestConvertSchedulePreservesTime() {
 				Hour:         c.hour,
 				Minute:       c.minute,
 			}
-			converted := s.service.convertV2ScheduleToProto(v2Schedule)
+			converted := ConvertV2ScheduleToProto(v2Schedule)
 			assert.Equal(t, c.hour, converted.GetHour())
 			assert.Equal(t, c.minute, converted.GetMinute())
 			assert.Equal(t, storage.Schedule_DAILY, converted.GetIntervalType())
@@ -527,7 +527,7 @@ func (s *typeConversionTestSuite) TestConvertSchedulePreservesTime() {
 				Hour:         c.hour,
 				Minute:       c.minute,
 			}
-			converted := s.service.convertProtoScheduleToV2(storageSchedule)
+			converted := ConvertProtoScheduleToV2(storageSchedule)
 			assert.Equal(t, c.hour, converted.GetHour())
 			assert.Equal(t, c.minute, converted.GetMinute())
 			assert.Equal(t, apiV2.ReportSchedule_DAILY, converted.GetIntervalType())
@@ -542,8 +542,8 @@ func (s *typeConversionTestSuite) TestConvertSchedulePreservesTime() {
 					DaysOfWeek: &apiV2.ReportSchedule_DaysOfWeek{Days: []int32{1}},
 				},
 			}
-			storage := s.service.convertV2ScheduleToProto(v2Schedule)
-			roundTripped := s.service.convertProtoScheduleToV2(storage)
+			storage := ConvertV2ScheduleToProto(v2Schedule)
+			roundTripped := ConvertProtoScheduleToV2(storage)
 			assert.Equal(t, c.hour, roundTripped.GetHour())
 			assert.Equal(t, c.minute, roundTripped.GetMinute())
 		})
@@ -580,7 +580,7 @@ func (s *typeConversionTestSuite) TestConvertV2ScheduleToProto() {
 
 	for _, c := range cases {
 		s.T().Run(c.testname, func(t *testing.T) {
-			converted := s.service.convertV2ScheduleToProto(c.schedule)
+			converted := ConvertV2ScheduleToProto(c.schedule)
 			protoassert.Equal(t, c.result, converted)
 		})
 	}
@@ -647,3 +647,120 @@ func newScheduleV2(minute int32, hour int32, weekdays []int32, daysOfMonth []int
 	}
 	return &sched
 }
+
+func TestEnumConversions(t *testing.T) {
+	t.Run("v2EntityTypeToStorage", func(t *testing.T) {
+		tests := map[string]struct {
+			input    apiV2.ScopeEntity
+			expected storage.EntityType
+		}{
+			"deployment": {apiV2.ScopeEntity_SCOPE_ENTITY_DEPLOYMENT, storage.EntityType_ENTITY_TYPE_DEPLOYMENT},
+			"namespace":  {apiV2.ScopeEntity_SCOPE_ENTITY_NAMESPACE, storage.EntityType_ENTITY_TYPE_NAMESPACE},
+			"cluster":    {apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER, storage.EntityType_ENTITY_TYPE_CLUSTER},
+			"unset":      {apiV2.ScopeEntity_SCOPE_ENTITY_UNSET, storage.EntityType_ENTITY_TYPE_UNSET},
+			"unknown":    {apiV2.ScopeEntity(999), storage.EntityType_ENTITY_TYPE_UNSET},
+		}
+		for name, tc := range tests {
+			t.Run(name, func(t *testing.T) {
+				result := v2EntityTypeToStorage(tc.input)
+				assert.Equal(t, tc.expected, result)
+			})
+		}
+	})
+
+	t.Run("v2EntityFieldToStorage", func(t *testing.T) {
+		tests := map[string]struct {
+			input    apiV2.ScopeField
+			expected storage.EntityField
+		}{
+			"id":         {apiV2.ScopeField_FIELD_ID, storage.EntityField_FIELD_ID},
+			"name":       {apiV2.ScopeField_FIELD_NAME, storage.EntityField_FIELD_NAME},
+			"label":      {apiV2.ScopeField_FIELD_LABEL, storage.EntityField_FIELD_LABEL},
+			"annotation": {apiV2.ScopeField_FIELD_ANNOTATION, storage.EntityField_FIELD_ANNOTATION},
+			"unset":      {apiV2.ScopeField_FIELD_UNSET, storage.EntityField_FIELD_UNSET},
+			"unknown":    {apiV2.ScopeField(999), storage.EntityField_FIELD_UNSET},
+		}
+		for name, tc := range tests {
+			t.Run(name, func(t *testing.T) {
+				result := v2EntityFieldToStorage(tc.input)
+				assert.Equal(t, tc.expected, result)
+			})
+		}
+	})
+
+	t.Run("storageEntityTypeToV2", func(t *testing.T) {
+		tests := map[string]struct {
+			input    storage.EntityType
+			expected apiV2.ScopeEntity
+		}{
+			"deployment": {storage.EntityType_ENTITY_TYPE_DEPLOYMENT, apiV2.ScopeEntity_SCOPE_ENTITY_DEPLOYMENT},
+			"namespace":  {storage.EntityType_ENTITY_TYPE_NAMESPACE, apiV2.ScopeEntity_SCOPE_ENTITY_NAMESPACE},
+			"cluster":    {storage.EntityType_ENTITY_TYPE_CLUSTER, apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER},
+			"unset":      {storage.EntityType_ENTITY_TYPE_UNSET, apiV2.ScopeEntity_SCOPE_ENTITY_UNSET},
+			"unknown":    {storage.EntityType(999), apiV2.ScopeEntity_SCOPE_ENTITY_UNSET},
+		}
+		for name, tc := range tests {
+			t.Run(name, func(t *testing.T) {
+				result := storageEntityTypeToV2(tc.input)
+				assert.Equal(t, tc.expected, result)
+			})
+		}
+	})
+
+	t.Run("storageEntityFieldToV2", func(t *testing.T) {
+		tests := map[string]struct {
+			input    storage.EntityField
+			expected apiV2.ScopeField
+		}{
+			"id":         {storage.EntityField_FIELD_ID, apiV2.ScopeField_FIELD_ID},
+			"name":       {storage.EntityField_FIELD_NAME, apiV2.ScopeField_FIELD_NAME},
+			"label":      {storage.EntityField_FIELD_LABEL, apiV2.ScopeField_FIELD_LABEL},
+			"annotation": {storage.EntityField_FIELD_ANNOTATION, apiV2.ScopeField_FIELD_ANNOTATION},
+			"unset":      {storage.EntityField_FIELD_UNSET, apiV2.ScopeField_FIELD_UNSET},
+			"unknown":    {storage.EntityField(999), apiV2.ScopeField_FIELD_UNSET},
+		}
+		for name, tc := range tests {
+			t.Run(name, func(t *testing.T) {
+				result := storageEntityFieldToV2(tc.input)
+				assert.Equal(t, tc.expected, result)
+			})
+		}
+	})
+}
+
+func TestConvertProtoNotifierSnapshotToV2(t *testing.T) {
+	t.Run("nil snapshot", func(t *testing.T) {
+		result := ConvertProtoNotifierSnapshotToV2(nil)
+		assert.Nil(t, result)
+	})
+
+	t.Run("snapshot without email config", func(t *testing.T) {
+		snapshot := &storage.NotifierSnapshot{
+			NotifierName: "test-notifier",
+		}
+		result := ConvertProtoNotifierSnapshotToV2(snapshot)
+		assert.NotNil(t, result)
+		assert.Equal(t, "test-notifier", result.GetNotifierName())
+	})
+
+	t.Run("snapshot with email config", func(t *testing.T) {
+		snapshot := &storage.NotifierSnapshot{
+			NotifierName: "test-notifier",
+			NotifierConfig: &storage.NotifierSnapshot_EmailConfig{
+				EmailConfig: &storage.EmailNotifierConfiguration{
+					NotifierId:    "notifier-1",
+					MailingLists:  []string{"user@example.com"},
+					CustomSubject: "Test Subject",
+					CustomBody:    "Test Body",
+				},
+			},
+		}
+		result := ConvertProtoNotifierSnapshotToV2(snapshot)
+		assert.NotNil(t, result)
+		assert.Equal(t, "test-notifier", result.GetNotifierName())
+		assert.Equal(t, "notifier-1", result.GetEmailConfig().GetNotifierId())
+		assert.Equal(t, []string{"user@example.com"}, result.GetEmailConfig().GetMailingLists())
+		assert.Equal(t, "Test Subject", result.GetEmailConfig().GetCustomSubject())
+		assert.Equal(t, "Test Body", result.GetEmailConfig().GetCustomBody())
+	})
+}
diff --git a/central/reports/service/v2/download.go b/central/reports/service/v2/download.go
index 78644c66c95d6..8d974ec6e1cfc 100644
--- a/central/reports/service/v2/download.go
+++ b/central/reports/service/v2/download.go
@@ -34,17 +34,27 @@ func parseJobID(r *http.Request) (id string, err error) {
 	return
 }
 
-// NewDownloadHandler is an HTTP handler for downloading reports
+// NewDownloadHandler is an HTTP handler for downloading image vulnerability reports.
 func NewDownloadHandler() http.HandlerFunc {
+	return newTypedDownloadHandler(storage.ReportSnapshot_VULNERABILITY)
+}
+
+// NewNodeDownloadHandler is an HTTP handler for downloading node vulnerability reports.
+func NewNodeDownloadHandler() http.HandlerFunc {
+	return newTypedDownloadHandler(storage.ReportSnapshot_NODE_VULNERABILITY)
+}
+
+func newTypedDownloadHandler(expectedType storage.ReportSnapshot_ReportType) http.HandlerFunc {
 	snapshotStore := snapshotDataStore.Singleton()
 	blobStore := blobDS.Singleton()
-	handler := &downloadHandler{snapshotStore: snapshotStore, blobStore: blobStore}
+	handler := &downloadHandler{snapshotStore: snapshotStore, blobStore: blobStore, expectedType: expectedType}
 	return handler.handle
 }
 
 type downloadHandler struct {
 	snapshotStore snapshotDataStore.DataStore
 	blobStore     blobDS.Datastore
+	expectedType  storage.ReportSnapshot_ReportType
 }
 
 func (h *downloadHandler) handle(w http.ResponseWriter, r *http.Request) {
@@ -77,6 +87,12 @@ func (h *downloadHandler) handle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if rep.GetType() != h.expectedType {
+		httputil.WriteGRPCStyleError(w, codes.InvalidArgument,
+			errors.Errorf("report job %q is not a %s report; use the matching download endpoint", id, h.expectedType))
+		return
+	}
+
 	if slimUser.GetId() != rep.GetRequester().GetId() {
 		httputil.WriteGRPCStyleError(w, codes.PermissionDenied,
 			errors.Errorf("Report cannot be downloaded by a user %q who did not request the report.", slimUser.GetId()))
@@ -110,7 +126,8 @@ func (h *downloadHandler) handle(w http.ResponseWriter, r *http.Request) {
 	)
 
 	parentDir := rep.GetReportConfigurationId()
-	if rep.GetViewBasedVulnReportFilters() != nil {
+	// View-based report blobs are stored under "view-based-report" dir, not under a dir named after reportConfigID.
+	if status.GetReportRequestType() == storage.ReportStatus_VIEW_BASED {
 		parentDir = "view-based-report"
 	}
 	_, exists, err := h.blobStore.Get(ctx, common.GetReportBlobPath(parentDir, id), buf)
diff --git a/central/reports/service/v2/download_test.go b/central/reports/service/v2/download_test.go
index 3e41d17c36fb0..005e6c4710644 100644
--- a/central/reports/service/v2/download_test.go
+++ b/central/reports/service/v2/download_test.go
@@ -44,6 +44,7 @@ func (s *handlerTestSuite) SetupSuite() {
 	s.handler = &downloadHandler{
 		snapshotStore: s.reportSnapshotDataStore,
 		blobStore:     s.blobStore,
+		expectedType:  storage.ReportSnapshot_VULNERABILITY,
 	}
 }
 
@@ -116,6 +117,18 @@ func (s *handlerTestSuite) TestDownloadReport() {
 			},
 			statusCode: http.StatusBadRequest,
 		},
+		{
+			desc: "Node vulnerability snapshot is rejected",
+			id:   reportSnapshot.GetReportId(),
+			ctx:  userContext,
+			mockGen: func() {
+				snap := reportSnapshot.CloneVT()
+				snap.Type = storage.ReportSnapshot_NODE_VULNERABILITY
+				s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportSnapshot.GetReportId()).
+					Return(snap, true, nil).Times(1)
+			},
+			statusCode: http.StatusBadRequest,
+		},
 		{
 			desc: "Report is not ready yet",
 			id:   reportSnapshot.GetReportId(),
@@ -201,6 +214,23 @@ func (s *handlerTestSuite) TestDownloadReport() {
 	}
 }
 
+func (s *handlerTestSuite) TestDownloadNodeReport_RejectsImageType() {
+	orig := s.handler.expectedType
+	s.handler.expectedType = storage.ReportSnapshot_NODE_VULNERABILITY
+	defer func() { s.handler.expectedType = orig }()
+
+	reportSnapshot := fixtures.GetReportSnapshot()
+	reportSnapshot.ReportId = uuid.NewV4().String()
+	reportSnapshot.ReportStatus.RunState = storage.ReportStatus_GENERATED
+	reportSnapshot.ReportStatus.ReportNotificationMethod = storage.ReportStatus_DOWNLOAD
+	userContext := s.getContextForUser(reportSnapshot.GetRequester())
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportSnapshot.GetReportId()).
+		Return(reportSnapshot, true, nil).Times(1)
+
+	s.downloadAndVerify(userContext, reportSnapshot.GetReportId(), http.StatusBadRequest, nil)
+}
+
 func (s *handlerTestSuite) downloadAndVerify(ctx context.Context, id string, code int, expectData []byte) {
 	req, _ := http.NewRequest(http.MethodGet, fmt.Sprintf("https://example.com/api/reports/jobs/download?id=%s", id), nil)
 	req = req.WithContext(ctx)
diff --git a/central/reports/service/v2/node/convert.go b/central/reports/service/v2/node/convert.go
new file mode 100644
index 0000000000000..00e8671837ee7
--- /dev/null
+++ b/central/reports/service/v2/node/convert.go
@@ -0,0 +1,373 @@
+package node
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/central/reports/common"
+	v2 "github.com/stackrox/rox/central/reports/service/v2"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/set"
+)
+
+var (
+	storageRunStateToV2 = map[storage.ReportStatus_RunState]apiV2.ReportStatus_RunState{
+		storage.ReportStatus_WAITING:   apiV2.ReportStatus_WAITING,
+		storage.ReportStatus_PREPARING: apiV2.ReportStatus_PREPARING,
+		storage.ReportStatus_GENERATED: apiV2.ReportStatus_GENERATED,
+		storage.ReportStatus_DELIVERED: apiV2.ReportStatus_DELIVERED,
+		storage.ReportStatus_FAILURE:   apiV2.ReportStatus_FAILURE,
+	}
+
+	// Use this context only to populate notifier names and IsDownloadAvailable fields in converted responses
+	allAccessCtx = sac.WithAllAccess(context.Background())
+)
+
+// convertV2ReportConfigurationToProto converts v2.ReportConfiguration to storage.ReportConfiguration for node reports
+func (s *serviceImpl) convertV2ReportConfigurationToProto(config *apiV2.ReportConfiguration, creator *storage.SlimUser,
+	accessScopeRules []*storage.SimpleAccessScope_Rules) (*storage.ReportConfiguration, error) {
+	if config == nil {
+		return nil, nil
+	}
+
+	resourceScope, err := s.convertV2ResourceScopeToProto(config.GetResourceScope())
+	if err != nil {
+		return nil, err
+	}
+
+	ret := &storage.ReportConfiguration{
+		Id:            config.GetId(),
+		Name:          config.GetName(),
+		Description:   config.GetDescription(),
+		Type:          storage.ReportConfiguration_NODE_VULNERABILITY,
+		Schedule:      v2.ConvertV2ScheduleToProto(config.GetSchedule()),
+		ResourceScope: resourceScope,
+		Creator:       creator,
+		Version:       2,
+	}
+
+	if config.GetNodeVulnReportFilters() != nil {
+		ret.Filter = &storage.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: convertV2NodeReportFiltersToProto(config.GetNodeVulnReportFilters(), accessScopeRules),
+		}
+	}
+
+	for _, notifier := range config.GetNotifiers() {
+		ret.Notifiers = append(ret.Notifiers, v2.ConvertV2NotifierConfigToProto(notifier))
+	}
+
+	return ret, nil
+}
+
+func convertV2NodeReportFiltersToProto(filters *apiV2.NodeVulnerabilityReportFilters,
+	accessScopeRules []*storage.SimpleAccessScope_Rules) *storage.NodeVulnerabilityReportFilters {
+	if filters == nil {
+		return nil
+	}
+
+	ret := &storage.NodeVulnerabilityReportFilters{
+		AccessScopeRules: accessScopeRules,
+		Query:            filters.GetQuery(),
+	}
+
+	switch filters.GetCvesSince().(type) {
+	case *apiV2.NodeVulnerabilityReportFilters_AllVuln:
+		ret.CvesSince = &storage.NodeVulnerabilityReportFilters_AllVuln{
+			AllVuln: filters.GetAllVuln(),
+		}
+	}
+
+	return ret
+}
+
+func (s *serviceImpl) convertV2ResourceScopeToProto(scope *apiV2.ResourceScope) (*storage.ResourceScope, error) {
+	if scope == nil {
+		return nil, nil
+	}
+
+	ret := &storage.ResourceScope{}
+	switch ref := scope.GetScopeReference().(type) {
+	case *apiV2.ResourceScope_EntityScope:
+		ret.ScopeReference = &storage.ResourceScope_EntityScope{
+			EntityScope: convertV2EntityScopeToStorage(ref.EntityScope),
+		}
+	case nil:
+		return nil, errors.New("resource scope reference is required")
+	default:
+		return nil, errors.Errorf("unsupported resource scope type: %T", ref)
+	}
+	return ret, nil
+}
+
+func convertV2EntityScopeToStorage(es *apiV2.EntityScope) *storage.EntityScope {
+	if es == nil {
+		return nil
+	}
+	rules := make([]*storage.EntityScopeRule, 0, len(es.GetRules()))
+	for _, rule := range es.GetRules() {
+		sr := &storage.EntityScopeRule{
+			Entity: v2EntityTypeToStorage(rule.GetEntity()),
+			Field:  v2EntityFieldToStorage(rule.GetField()),
+		}
+		for _, rv := range rule.GetValues() {
+			sr.Values = append(sr.Values, &storage.RuleValue{
+				Value:     rv.GetValue(),
+				MatchType: v2MatchTypeToStorage(rv.GetMatchType()),
+			})
+		}
+		rules = append(rules, sr)
+	}
+	return &storage.EntityScope{Rules: rules}
+}
+
+func v2EntityTypeToStorage(e apiV2.ScopeEntity) storage.EntityType {
+	switch e {
+	case apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER:
+		return storage.EntityType_ENTITY_TYPE_CLUSTER
+	default:
+		return storage.EntityType_ENTITY_TYPE_UNSET
+	}
+}
+
+func v2EntityFieldToStorage(f apiV2.ScopeField) storage.EntityField {
+	switch f {
+	case apiV2.ScopeField_FIELD_ID:
+		return storage.EntityField_FIELD_ID
+	case apiV2.ScopeField_FIELD_NAME:
+		return storage.EntityField_FIELD_NAME
+	case apiV2.ScopeField_FIELD_LABEL:
+		return storage.EntityField_FIELD_LABEL
+	default:
+		return storage.EntityField_FIELD_UNSET
+	}
+}
+
+func v2MatchTypeToStorage(m apiV2.MatchType) storage.MatchType {
+	switch m {
+	case apiV2.MatchType_REGEX:
+		return storage.MatchType_REGEX
+	default:
+		return storage.MatchType_EXACT
+	}
+}
+
+// Proto to V2 conversions
+
+func (s *serviceImpl) convertProtoReportConfigurationToV2(config *storage.ReportConfiguration) (*apiV2.ReportConfiguration, error) {
+	if config == nil {
+		return nil, nil
+	}
+
+	resourceScope := convertProtoResourceScopeToV2(config.GetResourceScope())
+
+	ret := &apiV2.ReportConfiguration{
+		Id:            config.GetId(),
+		Name:          config.GetName(),
+		Description:   config.GetDescription(),
+		Type:          apiV2.ReportConfiguration_NODE_VULNERABILITY,
+		Schedule:      v2.ConvertProtoScheduleToV2(config.GetSchedule()),
+		ResourceScope: resourceScope,
+	}
+
+	if config.GetNodeVulnReportFilters() != nil {
+		ret.Filter = &apiV2.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: convertProtoNodeReportFiltersToV2(config.GetNodeVulnReportFilters()),
+		}
+	}
+
+	for _, notifier := range config.GetNotifiers() {
+		converted, err := v2.ConvertProtoNotifierConfigToV2(s.notifierDatastore, notifier)
+		if err != nil {
+			return nil, err
+		}
+		if converted != nil {
+			ret.Notifiers = append(ret.Notifiers, converted)
+		}
+	}
+
+	return ret, nil
+}
+
+func convertProtoNodeReportFiltersToV2(filters *storage.NodeVulnerabilityReportFilters) *apiV2.NodeVulnerabilityReportFilters {
+	if filters == nil {
+		return nil
+	}
+
+	ret := &apiV2.NodeVulnerabilityReportFilters{
+		Query: filters.GetQuery(),
+	}
+
+	switch filters.GetCvesSince().(type) {
+	case *storage.NodeVulnerabilityReportFilters_AllVuln:
+		ret.CvesSince = &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+			AllVuln: filters.GetAllVuln(),
+		}
+	}
+
+	return ret
+}
+
+func convertProtoResourceScopeToV2(scope *storage.ResourceScope) *apiV2.ResourceScope {
+	if scope == nil {
+		return nil
+	}
+
+	ret := &apiV2.ResourceScope{}
+	if ref, ok := scope.GetScopeReference().(*storage.ResourceScope_EntityScope); ok {
+		ret.ScopeReference = &apiV2.ResourceScope_EntityScope{EntityScope: convertStorageEntityScopeToV2(ref.EntityScope)}
+	}
+	return ret
+}
+
+func convertStorageEntityScopeToV2(es *storage.EntityScope) *apiV2.EntityScope {
+	if es == nil {
+		return nil
+	}
+	rules := make([]*apiV2.EntityScopeRule, 0, len(es.GetRules()))
+	for _, rule := range es.GetRules() {
+		sr := &apiV2.EntityScopeRule{
+			Entity: storageEntityTypeToV2(rule.GetEntity()),
+			Field:  storageEntityFieldToV2(rule.GetField()),
+		}
+		for _, rv := range rule.GetValues() {
+			sr.Values = append(sr.Values, &apiV2.RuleValue{
+				Value:     rv.GetValue(),
+				MatchType: storageMatchTypeToV2(rv.GetMatchType()),
+			})
+		}
+		rules = append(rules, sr)
+	}
+	return &apiV2.EntityScope{Rules: rules}
+}
+
+func storageEntityTypeToV2(e storage.EntityType) apiV2.ScopeEntity {
+	switch e {
+	case storage.EntityType_ENTITY_TYPE_CLUSTER:
+		return apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER
+	default:
+		return apiV2.ScopeEntity_SCOPE_ENTITY_UNSET
+	}
+}
+
+func storageEntityFieldToV2(f storage.EntityField) apiV2.ScopeField {
+	switch f {
+	case storage.EntityField_FIELD_ID:
+		return apiV2.ScopeField_FIELD_ID
+	case storage.EntityField_FIELD_NAME:
+		return apiV2.ScopeField_FIELD_NAME
+	case storage.EntityField_FIELD_LABEL:
+		return apiV2.ScopeField_FIELD_LABEL
+	default:
+		return apiV2.ScopeField_FIELD_UNSET
+	}
+}
+
+func storageMatchTypeToV2(m storage.MatchType) apiV2.MatchType {
+	switch m {
+	case storage.MatchType_REGEX:
+		return apiV2.MatchType_REGEX
+	default:
+		return apiV2.MatchType_EXACT
+	}
+}
+
+// reportBlobParentDir returns the blob directory for a snapshot. View-based
+// report blobs are stored under "view-based-report", not under a report config ID.
+func reportBlobParentDir(snapshot *storage.ReportSnapshot) string {
+	if snapshot.GetReportStatus().GetReportRequestType() == storage.ReportStatus_VIEW_BASED {
+		return "view-based-report"
+	}
+	return snapshot.GetReportConfigurationId()
+}
+
+func isDownloadAvailable(blobNames set.FrozenStringSet, snapshot *storage.ReportSnapshot) bool {
+	return blobNames.Contains(common.GetReportBlobPath(reportBlobParentDir(snapshot), snapshot.GetReportId()))
+}
+
+func (s *serviceImpl) convertProtoReportSnapshotToV2(snapshot *storage.ReportSnapshot, blobNames set.FrozenStringSet) (*apiV2.ReportSnapshot, error) {
+	if snapshot == nil {
+		return nil, nil
+	}
+
+	resourceScope := convertProtoResourceScopeToV2(snapshot.GetResourceScope())
+
+	ret := &apiV2.ReportSnapshot{
+		ReportStatus:   convertPrototoV2Reportstatus(snapshot.GetReportStatus()),
+		ReportConfigId: snapshot.GetReportConfigurationId(),
+		ReportJobId:    snapshot.GetReportId(),
+		Name:           snapshot.GetName(),
+		Description:    snapshot.GetDescription(),
+		AreaOfConcern:  snapshot.GetAreaOfConcern(),
+		Type:           apiV2.ReportSnapshot_NODE_VULNERABILITY,
+		User: &apiV2.SlimUser{
+			Id:   snapshot.GetRequester().GetId(),
+			Name: snapshot.GetRequester().GetName(),
+		},
+		Schedule:            v2.ConvertProtoScheduleToV2(snapshot.GetSchedule()),
+		ResourceScope:       resourceScope,
+		IsDownloadAvailable: isDownloadAvailable(blobNames, snapshot),
+	}
+
+	if snapshot.GetNodeVulnReportFilters() != nil {
+		ret.Filter = &apiV2.ReportSnapshot_NodeVulnReportFilters{
+			NodeVulnReportFilters: convertProtoNodeReportFiltersToV2(snapshot.GetNodeVulnReportFilters()),
+		}
+	}
+
+	for _, notifier := range snapshot.GetNotifiers() {
+		converted := v2.ConvertProtoNotifierSnapshotToV2(notifier)
+		if converted != nil {
+			ret.Notifiers = append(ret.Notifiers, converted)
+		}
+	}
+
+	return ret, nil
+}
+
+func convertPrototoV2Reportstatus(status *storage.ReportStatus) *apiV2.ReportStatus {
+	if status == nil {
+		return nil
+	}
+
+	ret := &apiV2.ReportStatus{
+		ReportNotificationMethod: apiV2.NotificationMethod(status.GetReportNotificationMethod()),
+		ReportRequestType:        apiV2.ReportStatus_ReportMethod(status.GetReportRequestType()),
+		RunState:                 storageRunStateToV2[status.GetRunState()],
+		ErrorMsg:                 status.GetErrorMsg(),
+		CompletedAt:              status.GetCompletedAt(),
+	}
+
+	return ret
+}
+
+func (s *serviceImpl) getExistingBlobNames(snapshots []*storage.ReportSnapshot) (set.FrozenStringSet, error) {
+	if len(snapshots) == 0 {
+		return set.NewFrozenStringSet(), nil
+	}
+
+	blobNames := make([]string, 0, len(snapshots))
+	for _, snapshot := range snapshots {
+		status := snapshot.GetReportStatus()
+		if status.GetReportNotificationMethod() == storage.ReportStatus_DOWNLOAD {
+			if status.GetRunState() == storage.ReportStatus_GENERATED ||
+				status.GetRunState() == storage.ReportStatus_DELIVERED {
+				blobNames = append(blobNames, common.GetReportBlobPath(reportBlobParentDir(snapshot), snapshot.GetReportId()))
+			}
+		}
+	}
+
+	if len(blobNames) == 0 {
+		return set.NewFrozenStringSet(), nil
+	}
+
+	query := search.NewQueryBuilder().AddExactMatches(search.BlobName, blobNames...).ProtoQuery()
+	results, err := s.blobStore.Search(allAccessCtx, query)
+	if err != nil {
+		return set.NewFrozenStringSet(), errors.Wrap(err, "failed to search for report blobs")
+	}
+
+	return search.ResultsToIDSet(results).Freeze(), nil
+}
diff --git a/central/reports/service/v2/node/convert_test.go b/central/reports/service/v2/node/convert_test.go
new file mode 100644
index 0000000000000..e5401b88c7875
--- /dev/null
+++ b/central/reports/service/v2/node/convert_test.go
@@ -0,0 +1,859 @@
+package node
+
+import (
+	"testing"
+
+	blobDSMocks "github.com/stackrox/rox/central/blob/datastore/mocks"
+	notifierDSMocks "github.com/stackrox/rox/central/notifier/datastore/mocks"
+	"github.com/stackrox/rox/central/reports/common"
+	reportConfigDSMocks "github.com/stackrox/rox/central/reports/config/datastore/mocks"
+	schedulerMocks "github.com/stackrox/rox/central/reports/scheduler/v2/mocks"
+	v2 "github.com/stackrox/rox/central/reports/service/v2"
+	reportSnapshotDSMocks "github.com/stackrox/rox/central/reports/snapshot/datastore/mocks"
+	"github.com/stackrox/rox/central/reports/validation"
+	collectionDSMocks "github.com/stackrox/rox/central/resourcecollection/datastore/mocks"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/protoassert"
+	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/set"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/mock/gomock"
+)
+
+func TestConversions(t *testing.T) {
+	suite.Run(t, new(ConversionTestSuite))
+}
+
+type ConversionTestSuite struct {
+	suite.Suite
+	mockCtrl *gomock.Controller
+	service  *serviceImpl
+}
+
+func (s *ConversionTestSuite) SetupTest() {
+	s.mockCtrl = gomock.NewController(s.T())
+	reportConfigDataStore := reportConfigDSMocks.NewMockDataStore(s.mockCtrl)
+	reportSnapshotDataStore := reportSnapshotDSMocks.NewMockDataStore(s.mockCtrl)
+	collectionDataStore := collectionDSMocks.NewMockDataStore(s.mockCtrl)
+	notifierDataStore := notifierDSMocks.NewMockDataStore(s.mockCtrl)
+	blobStore := blobDSMocks.NewMockDatastore(s.mockCtrl)
+	scheduler := schedulerMocks.NewMockScheduler(s.mockCtrl)
+	validator := validation.New(reportConfigDataStore, reportSnapshotDataStore, collectionDataStore, notifierDataStore)
+
+	s.service = &serviceImpl{
+		reportConfigStore: reportConfigDataStore,
+		snapshotDatastore: reportSnapshotDataStore,
+		notifierDatastore: notifierDataStore,
+		scheduler:         scheduler,
+		blobStore:         blobStore,
+		validator:         validator,
+	}
+}
+
+func (s *ConversionTestSuite) TearDownTest() {
+	s.mockCtrl.Finish()
+}
+
+func (s *ConversionTestSuite) TestScheduleConversions() {
+	testCases := []struct {
+		name       string
+		v2Schedule *apiV2.ReportSchedule
+	}{
+		{
+			name: "Daily schedule",
+			v2Schedule: &apiV2.ReportSchedule{
+				IntervalType: apiV2.ReportSchedule_DAILY,
+				Hour:         14,
+				Minute:       30,
+			},
+		},
+		{
+			name: "Weekly schedule",
+			v2Schedule: &apiV2.ReportSchedule{
+				IntervalType: apiV2.ReportSchedule_WEEKLY,
+				Hour:         9,
+				Minute:       0,
+				Interval: &apiV2.ReportSchedule_DaysOfWeek_{
+					DaysOfWeek: &apiV2.ReportSchedule_DaysOfWeek{
+						Days: []int32{1, 3, 5},
+					},
+				},
+			},
+		},
+		{
+			name: "Monthly schedule",
+			v2Schedule: &apiV2.ReportSchedule{
+				IntervalType: apiV2.ReportSchedule_MONTHLY,
+				Hour:         10,
+				Minute:       15,
+				Interval: &apiV2.ReportSchedule_DaysOfMonth_{
+					DaysOfMonth: &apiV2.ReportSchedule_DaysOfMonth{
+						Days: []int32{1, 15},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		s.Run(tc.name, func() {
+			protoSchedule := v2.ConvertV2ScheduleToProto(tc.v2Schedule)
+			assert.NotNil(s.T(), protoSchedule)
+			assert.Equal(s.T(), tc.v2Schedule.GetHour(), protoSchedule.GetHour())
+			assert.Equal(s.T(), tc.v2Schedule.GetMinute(), protoSchedule.GetMinute())
+
+			v2Schedule := v2.ConvertProtoScheduleToV2(protoSchedule)
+			assert.NotNil(s.T(), v2Schedule)
+			assert.Equal(s.T(), tc.v2Schedule.GetIntervalType(), v2Schedule.GetIntervalType())
+			assert.Equal(s.T(), tc.v2Schedule.GetHour(), v2Schedule.GetHour())
+			assert.Equal(s.T(), tc.v2Schedule.GetMinute(), v2Schedule.GetMinute())
+
+			if tc.v2Schedule.GetDaysOfWeek() != nil {
+				assert.Equal(s.T(), tc.v2Schedule.GetDaysOfWeek().GetDays(), v2Schedule.GetDaysOfWeek().GetDays())
+			}
+			if tc.v2Schedule.GetDaysOfMonth() != nil {
+				assert.Equal(s.T(), tc.v2Schedule.GetDaysOfMonth().GetDays(), v2Schedule.GetDaysOfMonth().GetDays())
+			}
+		})
+	}
+}
+
+func (s *ConversionTestSuite) TestNotifierConversions() {
+	v2Notifier := &apiV2.NotifierConfiguration{
+		NotifierConfig: &apiV2.NotifierConfiguration_EmailConfig{
+			EmailConfig: &apiV2.EmailNotifierConfiguration{
+				NotifierId:    "notifier-123",
+				MailingLists:  []string{"test@example.com", "team@example.com"},
+				CustomSubject: "Custom Subject",
+				CustomBody:    "Custom Body",
+			},
+		},
+	}
+
+	protoNotifier := v2.ConvertV2NotifierConfigToProto(v2Notifier)
+	assert.NotNil(s.T(), protoNotifier)
+	assert.Equal(s.T(), "notifier-123", protoNotifier.GetId())
+	assert.Equal(s.T(), "Custom Subject", protoNotifier.GetEmailConfig().GetCustomSubject())
+
+	// Mock GetNotifier for the conversion back
+	notifierDataStore := s.service.notifierDatastore.(*notifierDSMocks.MockDataStore)
+	notifierDataStore.EXPECT().GetNotifier(gomock.Any(), "notifier-123").Return(&storage.Notifier{
+		Id:   "notifier-123",
+		Name: "Test Notifier",
+	}, true, nil).Times(1)
+
+	v2NotifierBack, err := v2.ConvertProtoNotifierConfigToV2(s.service.notifierDatastore, protoNotifier)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), v2NotifierBack)
+	assert.Equal(s.T(), "Test Notifier", v2NotifierBack.GetNotifierName())
+	assert.Equal(s.T(), v2Notifier.GetEmailConfig().GetNotifierId(), v2NotifierBack.GetEmailConfig().GetNotifierId())
+	assert.Equal(s.T(), v2Notifier.GetEmailConfig().GetMailingLists(), v2NotifierBack.GetEmailConfig().GetMailingLists())
+}
+
+func (s *ConversionTestSuite) TestNotifierSnapshotConversion() {
+	protoSnapshot := &storage.NotifierSnapshot{
+		NotifierName: "Email Notifier",
+		NotifierConfig: &storage.NotifierSnapshot_EmailConfig{
+			EmailConfig: &storage.EmailNotifierConfiguration{
+				NotifierId:    "notifier-456",
+				MailingLists:  []string{"alerts@example.com"},
+				CustomSubject: "Snapshot Subject",
+				CustomBody:    "Snapshot Body",
+			},
+		},
+	}
+
+	v2Config := v2.ConvertProtoNotifierSnapshotToV2(protoSnapshot)
+	assert.NotNil(s.T(), v2Config)
+	assert.Equal(s.T(), "Email Notifier", v2Config.GetNotifierName())
+	assert.Equal(s.T(), "notifier-456", v2Config.GetEmailConfig().GetNotifierId())
+	assert.Equal(s.T(), "Snapshot Subject", v2Config.GetEmailConfig().GetCustomSubject())
+	assert.Equal(s.T(), []string{"alerts@example.com"}, v2Config.GetEmailConfig().GetMailingLists())
+}
+
+func (s *ConversionTestSuite) TestEntityScopeConversions() {
+	testCases := []struct {
+		name       string
+		entityType apiV2.ScopeEntity
+		field      apiV2.ScopeField
+		matchType  apiV2.MatchType
+	}{
+		{
+			name:       "Cluster ID exact match",
+			entityType: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:      apiV2.ScopeField_FIELD_ID,
+			matchType:  apiV2.MatchType_EXACT,
+		},
+		{
+			name:       "Cluster name regex match",
+			entityType: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:      apiV2.ScopeField_FIELD_NAME,
+			matchType:  apiV2.MatchType_REGEX,
+		},
+		{
+			name:       "Cluster label exact match",
+			entityType: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:      apiV2.ScopeField_FIELD_LABEL,
+			matchType:  apiV2.MatchType_EXACT,
+		},
+	}
+
+	for _, tc := range testCases {
+		s.Run(tc.name, func() {
+			storageType := v2EntityTypeToStorage(tc.entityType)
+			v2Type := storageEntityTypeToV2(storageType)
+			assert.Equal(s.T(), tc.entityType, v2Type)
+
+			storageField := v2EntityFieldToStorage(tc.field)
+			v2Field := storageEntityFieldToV2(storageField)
+			assert.Equal(s.T(), tc.field, v2Field)
+
+			storageMatch := v2MatchTypeToStorage(tc.matchType)
+			v2Match := storageMatchTypeToV2(storageMatch)
+			assert.Equal(s.T(), tc.matchType, v2Match)
+		})
+	}
+}
+
+func (s *ConversionTestSuite) TestReportStatusConversion() {
+	testCases := map[string]struct {
+		requestType storage.ReportStatus_RunMethod
+		want        apiV2.ReportStatus_ReportMethod
+	}{
+		"on-demand": {
+			requestType: storage.ReportStatus_ON_DEMAND,
+			want:        apiV2.ReportStatus_ON_DEMAND,
+		},
+		"scheduled": {
+			requestType: storage.ReportStatus_SCHEDULED,
+			want:        apiV2.ReportStatus_SCHEDULED,
+		},
+		"view-based": {
+			requestType: storage.ReportStatus_VIEW_BASED,
+			want:        apiV2.ReportStatus_ReportMethod(storage.ReportStatus_VIEW_BASED),
+		},
+	}
+
+	for name, tc := range testCases {
+		s.Run(name, func() {
+			protoStatus := &storage.ReportStatus{
+				RunState:                 storage.ReportStatus_GENERATED,
+				ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+				ReportRequestType:        tc.requestType,
+				ErrorMsg:                 "test error",
+			}
+
+			v2Status := convertPrototoV2Reportstatus(protoStatus)
+			assert.NotNil(s.T(), v2Status)
+			assert.Equal(s.T(), apiV2.ReportStatus_GENERATED, v2Status.GetRunState())
+			assert.Equal(s.T(), apiV2.NotificationMethod_DOWNLOAD, v2Status.GetReportNotificationMethod())
+			assert.Equal(s.T(), "test error", v2Status.GetErrorMsg())
+			assert.Equal(s.T(), tc.want, v2Status.GetReportRequestType())
+		})
+	}
+}
+
+func (s *ConversionTestSuite) TestNodeFiltersConversion() {
+	v2Filters := &apiV2.NodeVulnerabilityReportFilters{
+		Query: "Cluster:prod",
+		CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+			AllVuln: true,
+		},
+	}
+
+	accessScopeRules := []*storage.SimpleAccessScope_Rules{
+		{
+			IncludedClusters: []string{"cluster-1"},
+		},
+	}
+
+	protoFilters := convertV2NodeReportFiltersToProto(v2Filters, accessScopeRules)
+	assert.NotNil(s.T(), protoFilters)
+	assert.Equal(s.T(), "Cluster:prod", protoFilters.GetQuery())
+	assert.True(s.T(), protoFilters.GetAllVuln())
+	protoassert.SlicesEqual(s.T(), accessScopeRules, protoFilters.GetAccessScopeRules())
+
+	v2FiltersBack := convertProtoNodeReportFiltersToV2(protoFilters)
+	assert.NotNil(s.T(), v2FiltersBack)
+	assert.Equal(s.T(), v2Filters.GetQuery(), v2FiltersBack.GetQuery())
+	assert.True(s.T(), v2FiltersBack.GetAllVuln())
+}
+
+func (s *ConversionTestSuite) TestReportConfigurationRoundTrip() {
+	creator := &storage.SlimUser{
+		Id:   "user-123",
+		Name: "Test User",
+	}
+
+	accessScopeRules := []*storage.SimpleAccessScope_Rules{
+		{
+			IncludedClusters: []string{"cluster-1", "cluster-2"},
+		},
+	}
+
+	v2Config := &apiV2.ReportConfiguration{
+		Id:          "config-123",
+		Name:        "Node Report",
+		Description: "Test node vulnerability report",
+		Type:        apiV2.ReportConfiguration_NODE_VULNERABILITY,
+		ResourceScope: &apiV2.ResourceScope{
+			ScopeReference: &apiV2.ResourceScope_EntityScope{
+				EntityScope: &apiV2.EntityScope{
+					Rules: []*apiV2.EntityScopeRule{
+						{
+							Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+							Field:  apiV2.ScopeField_FIELD_ID,
+							Values: []*apiV2.RuleValue{
+								{
+									Value:     "cluster-1",
+									MatchType: apiV2.MatchType_EXACT,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Filter: &apiV2.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+				Query: "Cluster:prod",
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+		Schedule: &apiV2.ReportSchedule{
+			IntervalType: apiV2.ReportSchedule_WEEKLY,
+			Hour:         9,
+			Minute:       0,
+			Interval: &apiV2.ReportSchedule_DaysOfWeek_{
+				DaysOfWeek: &apiV2.ReportSchedule_DaysOfWeek{
+					Days: []int32{1, 3, 5},
+				},
+			},
+		},
+		Notifiers: []*apiV2.NotifierConfiguration{
+			{
+				NotifierConfig: &apiV2.NotifierConfiguration_EmailConfig{
+					EmailConfig: &apiV2.EmailNotifierConfiguration{
+						NotifierId:   "email-1",
+						MailingLists: []string{"team@example.com"},
+					},
+				},
+			},
+		},
+	}
+
+	protoConfig, err := s.service.convertV2ReportConfigurationToProto(v2Config, creator, accessScopeRules)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), protoConfig)
+	assert.Equal(s.T(), v2Config.GetId(), protoConfig.GetId())
+	assert.Equal(s.T(), v2Config.GetName(), protoConfig.GetName())
+	assert.Equal(s.T(), storage.ReportConfiguration_NODE_VULNERABILITY, protoConfig.GetType())
+	protoassert.Equal(s.T(), creator, protoConfig.GetCreator())
+
+	// Mock GetNotifier for the conversion back
+	notifierDataStore := s.service.notifierDatastore.(*notifierDSMocks.MockDataStore)
+	notifierDataStore.EXPECT().GetNotifier(gomock.Any(), "email-1").Return(&storage.Notifier{
+		Id:   "email-1",
+		Name: "Email Notifier",
+	}, true, nil).Times(1)
+
+	v2ConfigBack, err := s.service.convertProtoReportConfigurationToV2(protoConfig)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), v2ConfigBack)
+	assert.Equal(s.T(), v2Config.GetId(), v2ConfigBack.GetId())
+	assert.Equal(s.T(), v2Config.GetName(), v2ConfigBack.GetName())
+	assert.Equal(s.T(), apiV2.ReportConfiguration_NODE_VULNERABILITY, v2ConfigBack.GetType())
+	assert.Len(s.T(), v2ConfigBack.GetNotifiers(), 1)
+	assert.Equal(s.T(), "Email Notifier", v2ConfigBack.GetNotifiers()[0].GetNotifierName())
+}
+
+func (s *ConversionTestSuite) TestNilConversions() {
+	assert.Nil(s.T(), v2.ConvertV2ScheduleToProto(nil))
+	assert.Nil(s.T(), v2.ConvertProtoScheduleToV2(nil))
+	assert.Nil(s.T(), v2.ConvertV2NotifierConfigToProto(nil))
+
+	result, err := v2.ConvertProtoNotifierConfigToV2(s.service.notifierDatastore, nil)
+	assert.NoError(s.T(), err)
+	assert.Nil(s.T(), result)
+
+	assert.Nil(s.T(), v2.ConvertProtoNotifierSnapshotToV2(nil))
+	assert.Nil(s.T(), convertPrototoV2Reportstatus(nil))
+	assert.Nil(s.T(), convertV2NodeReportFiltersToProto(nil, nil))
+	assert.Nil(s.T(), convertProtoNodeReportFiltersToV2(nil))
+}
+
+func (s *ConversionTestSuite) TestEntityTypeEdgeCases() {
+	assert.Equal(s.T(), storage.EntityType_ENTITY_TYPE_UNSET, v2EntityTypeToStorage(apiV2.ScopeEntity_SCOPE_ENTITY_UNSET))
+	assert.Equal(s.T(), apiV2.ScopeEntity_SCOPE_ENTITY_UNSET, storageEntityTypeToV2(storage.EntityType_ENTITY_TYPE_UNSET))
+
+	assert.Equal(s.T(), storage.EntityField_FIELD_UNSET, v2EntityFieldToStorage(apiV2.ScopeField_FIELD_UNSET))
+	assert.Equal(s.T(), apiV2.ScopeField_FIELD_UNSET, storageEntityFieldToV2(storage.EntityField_FIELD_UNSET))
+
+	assert.Equal(s.T(), storage.MatchType_EXACT, v2MatchTypeToStorage(apiV2.MatchType_EXACT))
+	assert.Equal(s.T(), apiV2.MatchType_EXACT, storageMatchTypeToV2(storage.MatchType_EXACT))
+}
+
+func (s *ConversionTestSuite) TestConvertProtoReportSnapshotToV2() {
+	configID := "test-config"
+	reportID := "test-report"
+
+	snapshot := &storage.ReportSnapshot{
+		ReportConfigurationId: configID,
+		ReportId:              reportID,
+		Name:                  "Test Report",
+		Description:           "Test description",
+		AreaOfConcern:         "User Workloads",
+		Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+		Requester: &storage.SlimUser{
+			Id:   "user-1",
+			Name: "Test User",
+		},
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+		},
+		ResourceScope: &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: &storage.EntityScope{},
+			},
+		},
+		Filter: &storage.ReportSnapshot_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query: "test",
+			},
+		},
+	}
+
+	blobStore := s.service.blobStore.(*blobDSMocks.MockDatastore)
+	blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return(nil, nil).AnyTimes()
+
+	result, err := s.service.convertProtoReportSnapshotToV2(snapshot, set.NewFrozenStringSet())
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), result)
+	assert.Equal(s.T(), reportID, result.GetReportJobId())
+	assert.Equal(s.T(), configID, result.GetReportConfigId())
+	assert.Equal(s.T(), "Test Report", result.GetName())
+	assert.Equal(s.T(), "Test description", result.GetDescription())
+	assert.Equal(s.T(), "User Workloads", result.GetAreaOfConcern())
+	assert.False(s.T(), result.GetIsDownloadAvailable())
+}
+
+func (s *ConversionTestSuite) TestReportSnapshotDownloadAvailable() {
+	configID := "test-config"
+	reportID := "test-report"
+
+	testCases := map[string]struct {
+		snapshot  *storage.ReportSnapshot
+		blobNames set.FrozenStringSet
+		available bool
+	}{
+		"config-based with matching blob": {
+			snapshot: &storage.ReportSnapshot{
+				ReportConfigurationId: configID,
+				ReportId:              reportID,
+				ReportStatus: &storage.ReportStatus{
+					RunState:                 storage.ReportStatus_GENERATED,
+					ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+				},
+			},
+			blobNames: set.NewFrozenStringSet(common.GetReportBlobPath(configID, reportID)),
+			available: true,
+		},
+		"view-based with matching blob": {
+			snapshot: &storage.ReportSnapshot{
+				ReportId: reportID,
+				ReportStatus: &storage.ReportStatus{
+					RunState:                 storage.ReportStatus_GENERATED,
+					ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+					ReportRequestType:        storage.ReportStatus_VIEW_BASED,
+				},
+			},
+			blobNames: set.NewFrozenStringSet(common.GetReportBlobPath("view-based-report", reportID)),
+			available: true,
+		},
+		"view-based without blob": {
+			snapshot: &storage.ReportSnapshot{
+				ReportId: reportID,
+				ReportStatus: &storage.ReportStatus{
+					RunState:                 storage.ReportStatus_GENERATED,
+					ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+					ReportRequestType:        storage.ReportStatus_VIEW_BASED,
+				},
+			},
+			blobNames: set.NewFrozenStringSet(),
+			available: false,
+		},
+		"view-based does not match config-id blob path": {
+			snapshot: &storage.ReportSnapshot{
+				ReportConfigurationId: configID,
+				ReportId:              reportID,
+				ReportStatus: &storage.ReportStatus{
+					RunState:                 storage.ReportStatus_GENERATED,
+					ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+					ReportRequestType:        storage.ReportStatus_VIEW_BASED,
+				},
+			},
+			blobNames: set.NewFrozenStringSet(common.GetReportBlobPath(configID, reportID)),
+			available: false,
+		},
+	}
+
+	for name, tc := range testCases {
+		s.Run(name, func() {
+			result, err := s.service.convertProtoReportSnapshotToV2(tc.snapshot, tc.blobNames)
+			assert.NoError(s.T(), err)
+			assert.Equal(s.T(), tc.available, result.GetIsDownloadAvailable())
+		})
+	}
+}
+
+func (s *ConversionTestSuite) TestRunStateConversions() {
+	assert.Equal(s.T(), apiV2.ReportStatus_WAITING, storageRunStateToV2[storage.ReportStatus_WAITING])
+	assert.Equal(s.T(), apiV2.ReportStatus_PREPARING, storageRunStateToV2[storage.ReportStatus_PREPARING])
+	assert.Equal(s.T(), apiV2.ReportStatus_GENERATED, storageRunStateToV2[storage.ReportStatus_GENERATED])
+	assert.Equal(s.T(), apiV2.ReportStatus_DELIVERED, storageRunStateToV2[storage.ReportStatus_DELIVERED])
+	assert.Equal(s.T(), apiV2.ReportStatus_FAILURE, storageRunStateToV2[storage.ReportStatus_FAILURE])
+}
+
+func (s *ConversionTestSuite) TestResourceScopeConversions() {
+	v2Scope := &apiV2.ResourceScope{
+		ScopeReference: &apiV2.ResourceScope_EntityScope{
+			EntityScope: &apiV2.EntityScope{
+				Rules: []*apiV2.EntityScopeRule{
+					{
+						Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+						Field:  apiV2.ScopeField_FIELD_NAME,
+						Values: []*apiV2.RuleValue{
+							{
+								Value:     "prod-cluster",
+								MatchType: apiV2.MatchType_REGEX,
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	protoScope, err := s.service.convertV2ResourceScopeToProto(v2Scope)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), protoScope)
+
+	v2ScopeBack := convertProtoResourceScopeToV2(protoScope)
+	assert.NotNil(s.T(), v2ScopeBack)
+	assert.NotNil(s.T(), v2ScopeBack.GetEntityScope())
+	assert.Len(s.T(), v2ScopeBack.GetEntityScope().GetRules(), 1)
+}
+
+func (s *ConversionTestSuite) TestEmptyResourceScope() {
+	result, err := s.service.convertV2ResourceScopeToProto(nil)
+	assert.NoError(s.T(), err)
+	assert.Nil(s.T(), result)
+
+	v2Result := convertProtoResourceScopeToV2(nil)
+	assert.Nil(s.T(), v2Result)
+}
+
+func (s *ConversionTestSuite) TestReportConfigurationWithoutNotifiers() {
+	creator := &storage.SlimUser{
+		Id:   "user-123",
+		Name: "Test User",
+	}
+
+	v2Config := &apiV2.ReportConfiguration{
+		Id:          "config-no-notifiers",
+		Name:        "Node Report No Notifiers",
+		Description: "Test without notifiers",
+		Type:        apiV2.ReportConfiguration_NODE_VULNERABILITY,
+		ResourceScope: &apiV2.ResourceScope{
+			ScopeReference: &apiV2.ResourceScope_EntityScope{
+				EntityScope: &apiV2.EntityScope{
+					Rules: []*apiV2.EntityScopeRule{
+						{
+							Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+							Field:  apiV2.ScopeField_FIELD_ID,
+							Values: []*apiV2.RuleValue{
+								{
+									Value:     "cluster-1",
+									MatchType: apiV2.MatchType_EXACT,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Filter: &apiV2.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+				Query: "Cluster:prod",
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+		Notifiers: nil,
+	}
+
+	protoConfig, err := s.service.convertV2ReportConfigurationToProto(v2Config, creator, nil)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), protoConfig)
+	assert.Empty(s.T(), protoConfig.GetNotifiers())
+}
+
+func (s *ConversionTestSuite) TestProtoReportConfigurationToV2() {
+	protoConfig := &storage.ReportConfiguration{
+		Id:          "config-proto",
+		Name:        "Proto Config",
+		Description: "Test proto to v2",
+		Type:        storage.ReportConfiguration_NODE_VULNERABILITY,
+		ResourceScope: &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: &storage.EntityScope{
+					Rules: []*storage.EntityScopeRule{
+						{
+							Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+							Field:  storage.EntityField_FIELD_ID,
+							Values: []*storage.RuleValue{
+								{
+									Value:     "cluster-1",
+									MatchType: storage.MatchType_EXACT,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query: "test query",
+				CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+		Notifiers: []*storage.NotifierConfiguration{
+			{
+				Ref: &storage.NotifierConfiguration_Id{
+					Id: "notifier-1",
+				},
+				NotifierConfig: &storage.NotifierConfiguration_EmailConfig{
+					EmailConfig: &storage.EmailNotifierConfiguration{
+						NotifierId:   "notifier-1",
+						MailingLists: []string{"team@example.com"},
+					},
+				},
+			},
+		},
+	}
+
+	// Mock GetNotifier for the conversion
+	notifierDataStore := s.service.notifierDatastore.(*notifierDSMocks.MockDataStore)
+	notifierDataStore.EXPECT().GetNotifier(gomock.Any(), "notifier-1").Return(&storage.Notifier{
+		Id:   "notifier-1",
+		Name: "Notifier 1",
+	}, true, nil).Times(1)
+
+	v2Config, err := s.service.convertProtoReportConfigurationToV2(protoConfig)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), v2Config)
+	assert.Equal(s.T(), "config-proto", v2Config.GetId())
+	assert.Equal(s.T(), "Proto Config", v2Config.GetName())
+	assert.Equal(s.T(), apiV2.ReportConfiguration_NODE_VULNERABILITY, v2Config.GetType())
+	assert.Len(s.T(), v2Config.GetNotifiers(), 1)
+	assert.Equal(s.T(), "Notifier 1", v2Config.GetNotifiers()[0].GetNotifierName())
+}
+
+func (s *ConversionTestSuite) TestProtoReportConfigurationToV2_SkipsNotifierWithoutEmail() {
+	protoConfig := &storage.ReportConfiguration{
+		Id:   "config-proto",
+		Name: "Proto Config",
+		Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		Notifiers: []*storage.NotifierConfiguration{
+			{
+				Ref: &storage.NotifierConfiguration_Id{Id: "notifier-1"},
+			},
+		},
+	}
+
+	v2Config, err := s.service.convertProtoReportConfigurationToV2(protoConfig)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), v2Config)
+	assert.Empty(s.T(), v2Config.GetNotifiers())
+}
+
+func (s *ConversionTestSuite) TestGetExistingBlobNames_NotDownloadMethod() {
+	snapshot := &storage.ReportSnapshot{
+		ReportConfigurationId: "config-1",
+		ReportId:              "report-1",
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_EMAIL,
+		},
+	}
+
+	result, err := s.service.getExistingBlobNames([]*storage.ReportSnapshot{snapshot})
+	assert.NoError(s.T(), err)
+	assert.Equal(s.T(), 0, result.Cardinality())
+}
+
+func (s *ConversionTestSuite) TestGetExistingBlobNames_WrongRunState() {
+	testCases := []struct {
+		name     string
+		runState storage.ReportStatus_RunState
+	}{
+		{"Waiting", storage.ReportStatus_WAITING},
+		{"Preparing", storage.ReportStatus_PREPARING},
+		{"Failure", storage.ReportStatus_FAILURE},
+	}
+
+	for _, tc := range testCases {
+		s.Run(tc.name, func() {
+			snapshot := &storage.ReportSnapshot{
+				ReportConfigurationId: "config-1",
+				ReportId:              "report-1",
+				ReportStatus: &storage.ReportStatus{
+					RunState:                 tc.runState,
+					ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+				},
+			}
+
+			result, err := s.service.getExistingBlobNames([]*storage.ReportSnapshot{snapshot})
+			assert.NoError(s.T(), err)
+			assert.Equal(s.T(), 0, result.Cardinality())
+		})
+	}
+}
+
+func (s *ConversionTestSuite) TestGetExistingBlobNames_BlobSearchError() {
+	snapshot := &storage.ReportSnapshot{
+		ReportConfigurationId: "config-1",
+		ReportId:              "report-1",
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+		},
+	}
+
+	blobStore := s.service.blobStore.(*blobDSMocks.MockDatastore)
+	blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return(nil, assert.AnError).Times(1)
+
+	result, err := s.service.getExistingBlobNames([]*storage.ReportSnapshot{snapshot})
+	assert.Error(s.T(), err)
+	assert.Equal(s.T(), 0, result.Cardinality())
+}
+
+func (s *ConversionTestSuite) TestGetExistingBlobNames_NoBlobFound() {
+	snapshot := &storage.ReportSnapshot{
+		ReportConfigurationId: "config-1",
+		ReportId:              "report-1",
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+		},
+	}
+
+	blobStore := s.service.blobStore.(*blobDSMocks.MockDatastore)
+	blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{}, nil).Times(1)
+
+	result, err := s.service.getExistingBlobNames([]*storage.ReportSnapshot{snapshot})
+	assert.NoError(s.T(), err)
+	assert.Equal(s.T(), 0, result.Cardinality())
+}
+
+func (s *ConversionTestSuite) TestGetExistingBlobNames_BlobFound() {
+	testCases := []struct {
+		name     string
+		runState storage.ReportStatus_RunState
+	}{
+		{"Generated state", storage.ReportStatus_GENERATED},
+		{"Delivered state", storage.ReportStatus_DELIVERED},
+	}
+
+	for _, tc := range testCases {
+		s.Run(tc.name, func() {
+			snapshot := &storage.ReportSnapshot{
+				ReportConfigurationId: "config-1",
+				ReportId:              "report-1",
+				ReportStatus: &storage.ReportStatus{
+					RunState:                 tc.runState,
+					ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+				},
+			}
+
+			blobStore := s.service.blobStore.(*blobDSMocks.MockDatastore)
+			blobStore.EXPECT().Search(allAccessCtx, gomock.Any()).Return([]search.Result{
+				{ID: common.GetReportBlobPath("config-1", "report-1")},
+			}, nil).Times(1)
+
+			result, err := s.service.getExistingBlobNames([]*storage.ReportSnapshot{snapshot})
+			assert.NoError(s.T(), err)
+			assert.True(s.T(), result.Contains(common.GetReportBlobPath("config-1", "report-1")))
+		})
+	}
+}
+
+func (s *ConversionTestSuite) TestGetExistingBlobNames_ViewBased() {
+	snapshot := &storage.ReportSnapshot{
+		ReportId: "report-1",
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+			ReportRequestType:        storage.ReportStatus_VIEW_BASED,
+		},
+	}
+
+	blobStore := s.service.blobStore.(*blobDSMocks.MockDatastore)
+	blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{
+		{ID: common.GetReportBlobPath("view-based-report", "report-1")},
+	}, nil).Times(1)
+
+	result, err := s.service.getExistingBlobNames([]*storage.ReportSnapshot{snapshot})
+	assert.NoError(s.T(), err)
+	assert.True(s.T(), result.Contains(common.GetReportBlobPath("view-based-report", "report-1")))
+}
+
+func (s *ConversionTestSuite) TestReportBlobParentDir() {
+	testCases := map[string]struct {
+		snapshot *storage.ReportSnapshot
+		want     string
+	}{
+		"config-based on-demand": {
+			snapshot: &storage.ReportSnapshot{
+				ReportConfigurationId: "config-1",
+				ReportStatus: &storage.ReportStatus{
+					ReportRequestType: storage.ReportStatus_ON_DEMAND,
+				},
+			},
+			want: "config-1",
+		},
+		"config-based scheduled": {
+			snapshot: &storage.ReportSnapshot{
+				ReportConfigurationId: "config-1",
+				ReportStatus: &storage.ReportStatus{
+					ReportRequestType: storage.ReportStatus_SCHEDULED,
+				},
+			},
+			want: "config-1",
+		},
+		"view-based uses shared blob directory": {
+			snapshot: &storage.ReportSnapshot{
+				ReportConfigurationId: "config-1",
+				ReportStatus: &storage.ReportStatus{
+					ReportRequestType: storage.ReportStatus_VIEW_BASED,
+				},
+			},
+			want: "view-based-report",
+		},
+	}
+
+	for name, tc := range testCases {
+		s.Run(name, func() {
+			assert.Equal(s.T(), tc.want, reportBlobParentDir(tc.snapshot))
+		})
+	}
+}
diff --git a/central/reports/service/v2/node/service.go b/central/reports/service/v2/node/service.go
new file mode 100644
index 0000000000000..ddffe2c64c06c
--- /dev/null
+++ b/central/reports/service/v2/node/service.go
@@ -0,0 +1,38 @@
+package node
+
+import (
+	"context"
+
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
+	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
+	schedulerV2 "github.com/stackrox/rox/central/reports/scheduler/v2"
+	snapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	"github.com/stackrox/rox/central/reports/validation"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/pkg/grpc"
+	"github.com/stackrox/rox/pkg/postgres"
+)
+
+// Service provides the interface to the gRPC service for node vulnerability reports.
+type Service interface {
+	grpc.APIService
+
+	AuthFuncOverride(ctx context.Context, fullMethodName string) (context.Context, error)
+	apiV2.NodeReportServiceServer
+}
+
+// New returns a new instance of the node report service.
+func New(reportConfigStore reportConfigDS.DataStore, snapshotDatastore snapshotDS.DataStore,
+	notifierDatastore notifierDS.DataStore, scheduler schedulerV2.Scheduler, blobStore blobDS.Datastore,
+	validator *validation.Validator, db postgres.DB) Service {
+	return &serviceImpl{
+		reportConfigStore: reportConfigStore,
+		snapshotDatastore: snapshotDatastore,
+		notifierDatastore: notifierDatastore,
+		scheduler:         scheduler,
+		blobStore:         blobStore,
+		validator:         validator,
+		db:                db,
+	}
+}
diff --git a/central/reports/service/v2/node/service_impl.go b/central/reports/service/v2/node/service_impl.go
new file mode 100644
index 0000000000000..57e12d15e4b77
--- /dev/null
+++ b/central/reports/service/v2/node/service_impl.go
@@ -0,0 +1,617 @@
+package node
+
+import (
+	"context"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/pkg/errors"
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
+	"github.com/stackrox/rox/central/reports/common"
+	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
+	schedulerV2 "github.com/stackrox/rox/central/reports/scheduler/v2"
+	reportsv2 "github.com/stackrox/rox/central/reports/service/v2"
+	snapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	"github.com/stackrox/rox/central/reports/validation"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stackrox/rox/pkg/grpc/authn"
+	"github.com/stackrox/rox/pkg/grpc/authz"
+	"github.com/stackrox/rox/pkg/grpc/authz/perrpc"
+	"github.com/stackrox/rox/pkg/grpc/authz/user"
+	"github.com/stackrox/rox/pkg/postgres"
+	pgNotify "github.com/stackrox/rox/pkg/postgres/notify"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/resources"
+	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/search/paginated"
+	"github.com/stackrox/rox/pkg/stringutils"
+	"google.golang.org/grpc"
+)
+
+const (
+	maxPaginationLimit = 1000
+)
+
+var (
+	workflowSAC = sac.ForResource(resources.WorkflowAdministration)
+
+	authorizer = perrpc.FromMap(map[authz.Authorizer][]string{
+		user.With(permissions.View(resources.WorkflowAdministration), permissions.View(resources.Node), permissions.View(resources.Cluster)): {
+			apiV2.NodeReportService_ListNodeReportConfigurations_FullMethodName,
+			apiV2.NodeReportService_GetNodeReportConfiguration_FullMethodName,
+			apiV2.NodeReportService_CountNodeReportConfigurations_FullMethodName,
+			apiV2.NodeReportService_GetNodeReportHistory_FullMethodName,
+			apiV2.NodeReportService_GetMyNodeReportHistory_FullMethodName,
+		},
+		user.With(permissions.Modify(resources.WorkflowAdministration), permissions.View(resources.Integration), permissions.View(resources.Node), permissions.View(resources.Cluster)): {
+			apiV2.NodeReportService_PostNodeReportConfiguration_FullMethodName,
+			apiV2.NodeReportService_UpdateNodeReportConfiguration_FullMethodName,
+		},
+		user.With(permissions.Modify(resources.WorkflowAdministration), permissions.View(resources.Node), permissions.View(resources.Cluster)): {
+			apiV2.NodeReportService_DeleteNodeReportConfiguration_FullMethodName,
+			apiV2.NodeReportService_RunNodeReport_FullMethodName,
+		},
+		// Cancel/Delete job match the image service: View is enough for the requester's own job.
+		// Modify(WorkflowAdministration) is checked in-handler when cancelling another user's job.
+		// Design table listed Modify(WorkflowAdministration) on those RPCs; image-parity won in review.
+		// GetNodeReportStatus uses the same View(Node)+View(Cluster) set so view-based users can poll jobs.
+		user.With(permissions.View(resources.Node), permissions.View(resources.Cluster)): {
+			apiV2.NodeReportService_GetNodeReportStatus_FullMethodName,
+			apiV2.NodeReportService_GetViewBasedNodeReportHistory_FullMethodName,
+			apiV2.NodeReportService_GetViewBasedMyNodeReportHistory_FullMethodName,
+			apiV2.NodeReportService_PostViewBasedNodeReport_FullMethodName,
+			apiV2.NodeReportService_DeleteNodeReport_FullMethodName,
+			apiV2.NodeReportService_CancelNodeReport_FullMethodName,
+		},
+	})
+)
+
+type serviceImpl struct {
+	apiV2.UnimplementedNodeReportServiceServer
+	reportConfigStore reportConfigDS.DataStore
+	snapshotDatastore snapshotDS.DataStore
+	notifierDatastore notifierDS.DataStore
+	scheduler         schedulerV2.Scheduler
+	blobStore         blobDS.Datastore
+	validator         *validation.Validator
+	db                postgres.DB
+}
+
+func (s *serviceImpl) RegisterServiceServer(grpcServer *grpc.Server) {
+	apiV2.RegisterNodeReportServiceServer(grpcServer, s)
+}
+
+func (s *serviceImpl) RegisterServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return apiV2.RegisterNodeReportServiceHandler(ctx, mux, conn)
+}
+
+func (s *serviceImpl) AuthFuncOverride(ctx context.Context, fullMethodName string) (context.Context, error) {
+	return ctx, authorizer.Authorized(ctx, fullMethodName)
+}
+
+func (s *serviceImpl) PostNodeReportConfiguration(ctx context.Context, request *apiV2.ReportConfiguration) (*apiV2.ReportConfiguration, error) {
+	creatorID, err := identityFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if request.GetType() != apiV2.ReportConfiguration_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedBy("report type must be NODE_VULNERABILITY")
+	}
+
+	if err := s.validator.ValidateReportConfiguration(request); err != nil {
+		return nil, errors.Wrap(err, "validating report configuration")
+	}
+
+	creator := &storage.SlimUser{
+		Id:   creatorID.UID(),
+		Name: stringutils.FirstNonEmpty(creatorID.FullName(), creatorID.FriendlyName()),
+	}
+
+	protoReportConfig, err := s.convertV2ReportConfigurationToProto(request, creator, common.ExtractAccessScopeRules(creatorID))
+	if err != nil {
+		return nil, errors.Wrap(err, "converting report configuration")
+	}
+
+	id, err := s.reportConfigStore.AddReportConfiguration(ctx, protoReportConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	createdReportConfig, exists, err := s.reportConfigStore.GetReportConfiguration(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errox.NotFound.CausedByf("report configuration with id '%s' was created but could not be read back", id)
+	}
+
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportsv2.NotifyWithRetry(ctx, s.db, pgNotify.ReportConfigChanged, id)
+	} else if err := s.scheduler.UpsertReportSchedule(createdReportConfig); err != nil {
+		return nil, err
+	}
+
+	resp, err := s.convertProtoReportConfigurationToV2(createdReportConfig)
+	if err != nil {
+		return nil, errors.Wrap(err, "report config created, but encountered error generating the response")
+	}
+	return resp, nil
+}
+
+func (s *serviceImpl) UpdateNodeReportConfiguration(ctx context.Context, request *apiV2.ReportConfiguration) (*apiV2.Empty, error) {
+	if request.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("report configuration id is required")
+	}
+
+	if request.GetType() != apiV2.ReportConfiguration_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedBy("report type must be NODE_VULNERABILITY")
+	}
+
+	if err := s.validator.ValidateReportConfiguration(request); err != nil {
+		return nil, errors.Wrap(err, "validating report configuration")
+	}
+
+	currentConfig, exists, err := s.reportConfigStore.GetReportConfiguration(ctx, request.GetId())
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errox.NotFound.CausedByf("report configuration with id '%s' does not exist", request.GetId())
+	}
+
+	if currentConfig.GetType() != storage.ReportConfiguration_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedByf("report configuration '%s' is not a node vulnerability report", request.GetId())
+	}
+
+	query := search.NewQueryBuilder().AddExactMatches(search.ReportConfigID, request.GetId()).AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).ProtoQuery()
+	reportSnapshots, err := s.snapshotDatastore.SearchReportSnapshots(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	slimUser, err := userFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, reportSnapshot := range reportSnapshots {
+		if slimUser.GetId() == reportSnapshot.GetRequester().GetId() {
+			return nil, errox.InvalidArgs.CausedBy("user has a report job running for this configuration")
+		}
+	}
+
+	var accessScopeRules []*storage.SimpleAccessScope_Rules
+	if filters := currentConfig.GetNodeVulnReportFilters(); filters != nil {
+		accessScopeRules = filters.GetAccessScopeRules()
+	}
+	updatedConfig, err := s.convertV2ReportConfigurationToProto(request, currentConfig.GetCreator(), accessScopeRules)
+	if err != nil {
+		return nil, errors.Wrap(err, "converting report configuration")
+	}
+
+	err = s.reportConfigStore.UpdateReportConfiguration(ctx, updatedConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportsv2.NotifyWithRetry(ctx, s.db, pgNotify.ReportConfigChanged, updatedConfig.GetId())
+	} else if err := s.scheduler.UpsertReportSchedule(updatedConfig); err != nil {
+		return nil, err
+	}
+	return &apiV2.Empty{}, nil
+}
+
+func (s *serviceImpl) ListNodeReportConfigurations(ctx context.Context, query *apiV2.RawQuery) (*apiV2.ListReportConfigurationsResponse, error) {
+	parsedQuery, err := search.ParseQuery(query.GetQuery(), search.MatchAllIfEmpty())
+	if err != nil {
+		return nil, errox.InvalidArgs.CausedBy(err.Error())
+	}
+
+	// Filter for NODE_VULNERABILITY type
+	parsedQuery = search.ConjunctionQuery(
+		parsedQuery,
+		search.NewQueryBuilder().AddExactMatches(search.ReportType, storage.ReportConfiguration_NODE_VULNERABILITY.String()).ProtoQuery(),
+	)
+
+	paginated.FillPaginationV2(parsedQuery, query.GetPagination(), maxPaginationLimit)
+
+	reportConfigs, err := s.reportConfigStore.GetReportConfigurations(ctx, parsedQuery)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to retrieve report configurations")
+	}
+	v2Configs := make([]*apiV2.ReportConfiguration, 0, len(reportConfigs))
+
+	for _, config := range reportConfigs {
+		converted, err := s.convertProtoReportConfigurationToV2(config)
+		if err != nil {
+			return nil, errors.Wrapf(err, "error converting storage report configuration with id %s to response", config.GetId())
+		}
+		v2Configs = append(v2Configs, converted)
+	}
+	return &apiV2.ListReportConfigurationsResponse{ReportConfigs: v2Configs}, nil
+}
+
+func (s *serviceImpl) GetNodeReportConfiguration(ctx context.Context, req *apiV2.ResourceByID) (*apiV2.ReportConfiguration, error) {
+	if req.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("report configuration id is required")
+	}
+	config, exists, err := s.reportConfigStore.GetReportConfiguration(ctx, req.GetId())
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errox.NotFound.CausedByf("report configuration with id '%s' does not exist", req.GetId())
+	}
+
+	if config.GetType() != storage.ReportConfiguration_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedByf("report configuration '%s' is not a node vulnerability report", req.GetId())
+	}
+
+	if !common.HasValidResourceScope(config.GetResourceScope()) {
+		return nil, errox.InvalidArgs.CausedByf("report configuration '%s' has an empty resource scope (no entity scope)", req.GetId())
+	}
+
+	converted, err := s.convertProtoReportConfigurationToV2(config)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error converting storage report configuration with id %s to response", config.GetId())
+	}
+	return converted, nil
+}
+
+func (s *serviceImpl) CountNodeReportConfigurations(ctx context.Context, request *apiV2.RawQuery) (*apiV2.CountReportConfigurationsResponse, error) {
+	parsedQuery, err := search.ParseQuery(request.GetQuery(), search.MatchAllIfEmpty())
+	if err != nil {
+		return nil, errox.InvalidArgs.CausedBy(err.Error())
+	}
+
+	// Filter for NODE_VULNERABILITY type
+	parsedQuery = search.ConjunctionQuery(
+		parsedQuery,
+		search.NewQueryBuilder().AddExactMatches(search.ReportType, storage.ReportConfiguration_NODE_VULNERABILITY.String()).ProtoQuery(),
+	)
+
+	numReportConfigs, err := s.reportConfigStore.Count(ctx, parsedQuery)
+	if err != nil {
+		return nil, err
+	}
+	return &apiV2.CountReportConfigurationsResponse{Count: int32(numReportConfigs)}, nil
+}
+
+func (s *serviceImpl) DeleteNodeReportConfiguration(ctx context.Context, id *apiV2.ResourceByID) (*apiV2.Empty, error) {
+	if id.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("report configuration id is required for deletion")
+	}
+	config, found, err := s.reportConfigStore.GetReportConfiguration(ctx, id.GetId())
+	if err != nil {
+		return nil, errors.Wrap(err, "error finding report config")
+	}
+	if !found {
+		return nil, errox.NotFound.CausedByf("report config ID '%s' not found", id.GetId())
+	}
+
+	if config.GetType() != storage.ReportConfiguration_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedByf("report configuration '%s' is not a node vulnerability report", id.GetId())
+	}
+
+	query := search.NewQueryBuilder().AddExactMatches(search.ReportConfigID, id.GetId()).AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).ProtoQuery()
+	reportSnapshots, err := s.snapshotDatastore.SearchReportSnapshots(ctx, query)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to search for active report snapshots")
+	}
+	if len(reportSnapshots) > 0 {
+		return nil, errox.InvalidArgs.CausedByf("report config ID '%s' has job in preparing or waiting state", id.GetId())
+	}
+
+	if err := s.reportConfigStore.RemoveReportConfiguration(ctx, id.GetId()); err != nil {
+		return nil, err
+	}
+
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportsv2.NotifyWithRetry(ctx, s.db, pgNotify.ReportConfigChanged, id.GetId())
+	} else {
+		s.scheduler.RemoveReportSchedule(id.GetId())
+	}
+	return &apiV2.Empty{}, nil
+}
+
+func (s *serviceImpl) RunNodeReport(ctx context.Context, req *apiV2.RunReportRequest) (*apiV2.RunReportResponse, error) {
+	if req.GetReportConfigId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("report configuration id is required")
+	}
+
+	config, exists, err := s.reportConfigStore.GetReportConfiguration(ctx, req.GetReportConfigId())
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errox.NotFound.CausedByf("report configuration with id '%s' does not exist", req.GetReportConfigId())
+	}
+
+	if config.GetType() != storage.ReportConfiguration_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedByf("report configuration '%s' is not a node vulnerability report", req.GetReportConfigId())
+	}
+
+	requesterID, err := identityFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	reportRequest, err := s.validator.ValidateAndGenerateReportRequest(
+		req.GetReportConfigId(),
+		storage.ReportStatus_NotificationMethod(req.GetReportNotificationMethod()),
+		storage.ReportStatus_ON_DEMAND,
+		requesterID,
+	)
+	if err != nil {
+		return nil, errors.Wrap(err, "error validating report request")
+	}
+
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportID, err := reportsv2.PersistSnapshotAndNotify(ctx, s.validator, s.db, reportRequest, pgNotify.ReportRequestSubmitted)
+		if err != nil {
+			return nil, err
+		}
+		return &apiV2.RunReportResponse{ReportConfigId: req.GetReportConfigId(), ReportId: reportID}, nil
+	}
+
+	reportID, err := s.scheduler.SubmitReportRequest(ctx, reportRequest, false)
+	if err != nil {
+		return nil, errox.ServerError.CausedByf("scheduler error: %s", err)
+	}
+
+	return &apiV2.RunReportResponse{ReportConfigId: req.GetReportConfigId(), ReportId: reportID}, nil
+}
+
+// getReportHistory is a helper that fetches report snapshots with user filtering
+func (s *serviceImpl) getReportHistory(ctx context.Context, queryBuilder *search.QueryBuilder, pagination *apiV2.Pagination, query string, userID string) (*apiV2.ReportHistoryResponse, error) {
+	parsedQuery, err := search.ParseQuery(query, search.MatchAllIfEmpty())
+	if err != nil {
+		return nil, errox.InvalidArgs.CausedBy(err.Error())
+	}
+
+	baseQuery := queryBuilder.ProtoQuery()
+	if userID != "" {
+		if err := reportsv2.VerifyNoUserSearchLabels(parsedQuery); err != nil {
+			return nil, errox.InvalidArgs.CausedBy(err.Error())
+		}
+		userIDQuery := search.NewQueryBuilder().AddExactMatches(search.UserID, userID).ProtoQuery()
+		baseQuery = search.ConjunctionQuery(baseQuery, userIDQuery)
+	}
+
+	conjunctionQuery := search.ConjunctionQuery(baseQuery, parsedQuery)
+	paginated.FillPaginationV2(conjunctionQuery, pagination, maxPaginationLimit)
+
+	results, err := s.snapshotDatastore.SearchReportSnapshots(ctx, conjunctionQuery)
+	if err != nil {
+		return nil, err
+	}
+
+	blobNames, err := s.getExistingBlobNames(results)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to check blob availability")
+	}
+
+	v2Snapshots := make([]*apiV2.ReportSnapshot, 0, len(results))
+	for _, snapshot := range results {
+		converted, err := s.convertProtoReportSnapshotToV2(snapshot, blobNames)
+		if err != nil {
+			return nil, errors.Wrapf(err, "error converting snapshot with id %s", snapshot.GetReportId())
+		}
+		v2Snapshots = append(v2Snapshots, converted)
+	}
+
+	return &apiV2.ReportHistoryResponse{ReportSnapshots: v2Snapshots}, nil
+}
+
+func (s *serviceImpl) GetNodeReportHistory(ctx context.Context, req *apiV2.GetReportHistoryRequest) (*apiV2.ReportHistoryResponse, error) {
+	if req == nil || req.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("empty request or id")
+	}
+
+	queryBuilder := search.NewQueryBuilder().
+		AddExactMatches(search.ReportConfigID, req.GetId()).
+		AddExactMatches(search.ReportType, storage.ReportSnapshot_NODE_VULNERABILITY.String())
+	return s.getReportHistory(ctx, queryBuilder, req.GetReportParamQuery().GetPagination(), req.GetReportParamQuery().GetQuery(), "")
+}
+
+func (s *serviceImpl) GetMyNodeReportHistory(ctx context.Context, req *apiV2.GetReportHistoryRequest) (*apiV2.ReportHistoryResponse, error) {
+	if req == nil || req.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("empty request or id")
+	}
+
+	slimUser, err := userFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	queryBuilder := search.NewQueryBuilder().
+		AddExactMatches(search.ReportConfigID, req.GetId()).
+		AddExactMatches(search.ReportType, storage.ReportSnapshot_NODE_VULNERABILITY.String())
+	return s.getReportHistory(ctx, queryBuilder, req.GetReportParamQuery().GetPagination(), req.GetReportParamQuery().GetQuery(), slimUser.GetId())
+}
+
+func (s *serviceImpl) GetNodeReportStatus(ctx context.Context, req *apiV2.ResourceByID) (*apiV2.ReportStatusResponse, error) {
+	if req == nil || req.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("empty request or id")
+	}
+	rep, found, err := s.snapshotDatastore.Get(ctx, req.GetId())
+	if err != nil {
+		return nil, err
+	}
+	if !found {
+		return nil, errox.NotFound.CausedByf("report snapshot not found for job id %s", req.GetId())
+	}
+	if rep.GetType() != storage.ReportSnapshot_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedByf("report snapshot '%s' is not a node vulnerability report", req.GetId())
+	}
+	status := convertPrototoV2Reportstatus(rep.GetReportStatus())
+	return &apiV2.ReportStatusResponse{Status: status}, nil
+}
+
+func (s *serviceImpl) CancelNodeReport(ctx context.Context, req *apiV2.ResourceByID) (*apiV2.Empty, error) {
+	if req == nil || req.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("empty request or id")
+	}
+	snapshot, found, err := s.snapshotDatastore.Get(ctx, req.GetId())
+	if err != nil {
+		return nil, err
+	}
+	if !found {
+		return nil, errox.NotFound.CausedByf("report snapshot not found for id %s", req.GetId())
+	}
+
+	if snapshot.GetType() != storage.ReportSnapshot_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedByf("report snapshot '%s' is not a node vulnerability report", req.GetId())
+	}
+
+	slimUser, err := userFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if slimUser.GetId() != snapshot.GetRequester().GetId() {
+		if err := sac.VerifyAuthzOK(workflowSAC.WriteAllowed(ctx)); err != nil {
+			return nil, errors.Wrap(err, "user can only cancel a job created by the user unless they have Modify(WorkflowAdministration) permission")
+		}
+	}
+
+	reportStatus := snapshot.GetReportStatus()
+	if reportStatus.GetRunState() != storage.ReportStatus_WAITING && reportStatus.GetRunState() != storage.ReportStatus_PREPARING {
+		return nil, errox.InvalidArgs.CausedBy("cannot cancel a job that is not in WAITING or PREPARING state")
+	}
+
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportsv2.NotifyWithRetry(ctx, s.db, pgNotify.ReportRequestCancelled, req.GetId())
+		return &apiV2.Empty{}, nil
+	}
+
+	cancelled, err := s.scheduler.CancelReportRequest(ctx, req.GetId())
+	if err != nil {
+		return nil, err
+	}
+	if !cancelled {
+		return nil, errors.Errorf("failed to cancel report job %s", req.GetId())
+	}
+
+	return &apiV2.Empty{}, nil
+}
+
+func (s *serviceImpl) DeleteNodeReport(ctx context.Context, req *apiV2.DeleteReportRequest) (*apiV2.Empty, error) {
+	if req == nil || req.GetId() == "" {
+		return nil, errox.InvalidArgs.CausedBy("empty request or id")
+	}
+	snapshot, found, err := s.snapshotDatastore.Get(ctx, req.GetId())
+	if err != nil {
+		return nil, err
+	}
+	if !found {
+		return nil, errox.NotFound.CausedByf("report snapshot not found for id %s", req.GetId())
+	}
+
+	if snapshot.GetType() != storage.ReportSnapshot_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedByf("report snapshot '%s' is not a node vulnerability report", req.GetId())
+	}
+
+	slimUser, err := userFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if slimUser.GetId() != snapshot.GetRequester().GetId() {
+		return nil, errox.NotAuthorized.CausedBy("report cannot be deleted by a user who did not request the report")
+	}
+
+	status := snapshot.GetReportStatus()
+	if status.GetReportNotificationMethod() != storage.ReportStatus_DOWNLOAD {
+		return nil, errox.InvalidArgs.CausedByf("report job id %q did not generate a downloadable report and hence no report to delete", req.GetId())
+	}
+	switch status.GetRunState() {
+	case storage.ReportStatus_FAILURE:
+		return nil, errox.InvalidArgs.CausedByf("report job %q has failed and no downloadable report to delete", req.GetId())
+	case storage.ReportStatus_PREPARING, storage.ReportStatus_WAITING:
+		return nil, errox.InvalidArgs.CausedByf("report job %q is still running. Please cancel it or wait for its completion", req.GetId())
+	}
+
+	blobPath := common.GetReportBlobPath(reportBlobParentDir(snapshot), snapshot.GetReportId())
+	blobCtx := sac.WithGlobalAccessScopeChecker(ctx,
+		sac.AllowFixedScopes(
+			sac.AccessModeScopeKeys(storage.Access_READ_WRITE_ACCESS),
+			sac.ResourceScopeKeys(resources.Administration),
+		),
+	)
+	if err := s.blobStore.Delete(blobCtx, blobPath); err != nil {
+		return nil, errox.InvariantViolation.CausedByf("failed to delete downloadable report %q", req.GetId())
+	}
+
+	return &apiV2.Empty{}, nil
+}
+
+func (s *serviceImpl) PostViewBasedNodeReport(ctx context.Context, req *apiV2.ReportRequestViewBased) (*apiV2.RunReportResponseViewBased, error) {
+	if req.GetType() != apiV2.ReportRequestViewBased_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.CausedBy("report type must be NODE_VULNERABILITY")
+	}
+
+	requesterID, err := identityFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	reportRequest, err := s.validator.ValidateAndGenerateViewBasedReportRequest(req, requesterID)
+	if err != nil {
+		return nil, errors.Wrap(err, "error validating view-based report request")
+	}
+
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportID, err := reportsv2.PersistSnapshotAndNotify(ctx, s.validator, s.db, reportRequest, pgNotify.ReportRequestSubmitted)
+		if err != nil {
+			return nil, err
+		}
+		return &apiV2.RunReportResponseViewBased{ReportID: reportID, RequestName: reportRequest.ReportSnapshot.GetName()}, nil
+	}
+
+	reportID, err := s.scheduler.SubmitReportRequest(ctx, reportRequest, false)
+	if err != nil {
+		return nil, errox.ServerError.CausedByf("scheduler error: %s", err)
+	}
+
+	return &apiV2.RunReportResponseViewBased{ReportID: reportID, RequestName: reportRequest.ReportSnapshot.GetName()}, nil
+}
+
+func (s *serviceImpl) GetViewBasedNodeReportHistory(ctx context.Context, req *apiV2.GetViewBasedReportHistoryRequest) (*apiV2.ReportHistoryResponse, error) {
+	queryBuilder := search.NewQueryBuilder().
+		AddExactMatches(search.ReportType, storage.ReportSnapshot_NODE_VULNERABILITY.String()).
+		AddExactMatches(search.ReportRequestType, storage.ReportStatus_VIEW_BASED.String())
+	return s.getReportHistory(reportsv2.SnapshotReadContext(ctx), queryBuilder, req.GetReportParamQuery().GetPagination(), req.GetReportParamQuery().GetQuery(), "")
+}
+
+func (s *serviceImpl) GetViewBasedMyNodeReportHistory(ctx context.Context, req *apiV2.GetViewBasedReportHistoryRequest) (*apiV2.ReportHistoryResponse, error) {
+	slimUser, err := userFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	queryBuilder := search.NewQueryBuilder().
+		AddExactMatches(search.ReportType, storage.ReportSnapshot_NODE_VULNERABILITY.String()).
+		AddExactMatches(search.ReportRequestType, storage.ReportStatus_VIEW_BASED.String())
+	return s.getReportHistory(reportsv2.SnapshotReadContext(ctx), queryBuilder, req.GetReportParamQuery().GetPagination(), req.GetReportParamQuery().GetQuery(), slimUser.GetId())
+}
+
+func identityFromContext(ctx context.Context) (authn.Identity, error) {
+	id := authn.IdentityFromContextOrNil(ctx)
+	if id == nil {
+		return nil, errox.NoCredentials.New("could not determine user identity from provided context")
+	}
+	return id, nil
+}
+
+func userFromContext(ctx context.Context) (*storage.SlimUser, error) {
+	slimUser := authn.UserFromContext(ctx)
+	if slimUser == nil {
+		return nil, errox.NoCredentials.New("could not determine user identity from provided context")
+	}
+	return slimUser, nil
+}
+
+var _ Service = (*serviceImpl)(nil)
diff --git a/central/reports/service/v2/node/service_impl_test.go b/central/reports/service/v2/node/service_impl_test.go
new file mode 100644
index 0000000000000..8de5b2e97c062
--- /dev/null
+++ b/central/reports/service/v2/node/service_impl_test.go
@@ -0,0 +1,1396 @@
+package node
+
+import (
+	"context"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgconn"
+	blobDSMocks "github.com/stackrox/rox/central/blob/datastore/mocks"
+	notifierDSMocks "github.com/stackrox/rox/central/notifier/datastore/mocks"
+	"github.com/stackrox/rox/central/reports/common"
+	reportConfigDSMocks "github.com/stackrox/rox/central/reports/config/datastore/mocks"
+	schedulerMocks "github.com/stackrox/rox/central/reports/scheduler/v2/mocks"
+	reportSnapshotDSMocks "github.com/stackrox/rox/central/reports/snapshot/datastore/mocks"
+	"github.com/stackrox/rox/central/reports/validation"
+	collectionDSMocks "github.com/stackrox/rox/central/resourcecollection/datastore/mocks"
+	v1 "github.com/stackrox/rox/generated/api/v1"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/auth/permissions"
+	permissionsMocks "github.com/stackrox/rox/pkg/auth/permissions/mocks"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stackrox/rox/pkg/grpc/authn"
+	mockIdentity "github.com/stackrox/rox/pkg/grpc/authn/mocks"
+	"github.com/stackrox/rox/pkg/grpc/testutils"
+	"github.com/stackrox/rox/pkg/notifiers"
+	postgresMocks "github.com/stackrox/rox/pkg/postgres/mocks"
+	pgNotify "github.com/stackrox/rox/pkg/postgres/notify"
+	"github.com/stackrox/rox/pkg/protoassert"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/resources"
+	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/mock/gomock"
+)
+
+func TestNodeReportService(t *testing.T) {
+	suite.Run(t, new(NodeReportServiceTestSuite))
+}
+
+type NodeReportServiceTestSuite struct {
+	suite.Suite
+	mockCtrl *gomock.Controller
+
+	ctx                     context.Context
+	reportConfigDataStore   *reportConfigDSMocks.MockDataStore
+	reportSnapshotDataStore *reportSnapshotDSMocks.MockDataStore
+	collectionDataStore     *collectionDSMocks.MockDataStore
+	notifierDataStore       *notifierDSMocks.MockDataStore
+	blobStore               *blobDSMocks.MockDatastore
+	scheduler               *schedulerMocks.MockScheduler
+	db                      *postgresMocks.MockDB
+	service                 Service
+}
+
+func (s *NodeReportServiceTestSuite) SetupTest() {
+	s.mockCtrl = gomock.NewController(s.T())
+	s.ctx = sac.WithAllAccess(context.Background())
+	s.reportConfigDataStore = reportConfigDSMocks.NewMockDataStore(s.mockCtrl)
+	s.reportSnapshotDataStore = reportSnapshotDSMocks.NewMockDataStore(s.mockCtrl)
+	s.collectionDataStore = collectionDSMocks.NewMockDataStore(s.mockCtrl)
+	s.notifierDataStore = notifierDSMocks.NewMockDataStore(s.mockCtrl)
+	s.blobStore = blobDSMocks.NewMockDatastore(s.mockCtrl)
+	s.scheduler = schedulerMocks.NewMockScheduler(s.mockCtrl)
+	s.db = postgresMocks.NewMockDB(s.mockCtrl)
+	validator := validation.New(s.reportConfigDataStore, s.reportSnapshotDataStore, s.collectionDataStore, s.notifierDataStore)
+	s.service = New(s.reportConfigDataStore, s.reportSnapshotDataStore, s.notifierDataStore, s.scheduler, s.blobStore, validator, s.db)
+}
+
+func (s *NodeReportServiceTestSuite) TearDownSuite() {
+	s.mockCtrl.Finish()
+}
+
+func (s *NodeReportServiceTestSuite) TearDownTest() {
+	s.mockCtrl.Finish()
+}
+
+func (s *NodeReportServiceTestSuite) getContextForUser(user *storage.SlimUser) context.Context {
+	mockID := mockIdentity.NewMockIdentity(s.mockCtrl)
+	mockID.EXPECT().UID().Return(user.GetId()).AnyTimes()
+	mockID.EXPECT().FullName().Return(user.GetName()).AnyTimes()
+	mockID.EXPECT().FriendlyName().Return(user.GetName()).AnyTimes()
+	mockRole := permissionsMocks.NewMockResolvedRole(s.mockCtrl)
+	mockRole.EXPECT().GetAccessScope().Return(&storage.SimpleAccessScope{
+		Rules: &storage.SimpleAccessScope_Rules{
+			IncludedClusters: []string{"cluster-1"},
+		},
+	}).AnyTimes()
+	mockID.EXPECT().Roles().Return([]permissions.ResolvedRole{mockRole}).AnyTimes()
+	return authn.ContextWithIdentity(s.ctx, mockID, s.T())
+}
+
+func (s *NodeReportServiceTestSuite) getValidNodeReportConfig() *apiV2.ReportConfiguration {
+	return &apiV2.ReportConfiguration{
+		Id:          uuid.NewV4().String(),
+		Name:        "test node report",
+		Description: "test description",
+		Type:        apiV2.ReportConfiguration_NODE_VULNERABILITY,
+		ResourceScope: &apiV2.ResourceScope{
+			ScopeReference: &apiV2.ResourceScope_EntityScope{
+				EntityScope: &apiV2.EntityScope{
+					Rules: []*apiV2.EntityScopeRule{
+						{
+							Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+							Field:  apiV2.ScopeField_FIELD_NAME,
+							Values: []*apiV2.RuleValue{
+								{
+									Value:     "cluster-1",
+									MatchType: apiV2.MatchType_EXACT,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Filter: &apiV2.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+				Query: "Cluster:cluster-1",
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+		Notifiers: []*apiV2.NotifierConfiguration{
+			{
+				NotifierConfig: &apiV2.NotifierConfiguration_EmailConfig{
+					EmailConfig: &apiV2.EmailNotifierConfiguration{
+						NotifierId:   "email-notifier-id",
+						MailingLists: []string{"test@example.com"},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (s *NodeReportServiceTestSuite) TestPostNodeReportConfiguration() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+
+	accessScope := &storage.SimpleAccessScope{
+		Rules: &storage.SimpleAccessScope_Rules{
+			IncludedClusters: []string{"cluster-1"},
+		},
+	}
+
+	requestConfig := s.getValidNodeReportConfig()
+	mockID := mockIdentity.NewMockIdentity(s.mockCtrl)
+	ctx := authn.ContextWithIdentity(s.ctx, mockID, s.T())
+
+	mockID.EXPECT().UID().Return(creator.GetId()).AnyTimes()
+	mockID.EXPECT().FullName().Return(creator.GetName()).AnyTimes()
+	mockID.EXPECT().FriendlyName().Return(creator.GetName()).AnyTimes()
+
+	mockRole := permissionsMocks.NewMockResolvedRole(s.mockCtrl)
+	mockRole.EXPECT().GetAccessScope().Return(accessScope).Times(1)
+	mockID.EXPECT().Roles().Return([]permissions.ResolvedRole{mockRole}).Times(1)
+
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), "email-notifier-id").
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
+
+	s.reportConfigDataStore.EXPECT().AddReportConfiguration(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ context.Context, cfg *storage.ReportConfiguration) (string, error) {
+			s.Equal(storage.ReportConfiguration_NODE_VULNERABILITY, cfg.GetType())
+			protoassert.Equal(s.T(), creator, cfg.GetCreator())
+			s.NotNil(cfg.GetNodeVulnReportFilters())
+			return cfg.GetId(), nil
+		}).Times(1)
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), requestConfig.GetId()).
+		DoAndReturn(func(_ context.Context, _ string) (*storage.ReportConfiguration, bool, error) {
+			return &storage.ReportConfiguration{
+				Id:          requestConfig.GetId(),
+				Name:        requestConfig.GetName(),
+				Description: requestConfig.GetDescription(),
+				Type:        storage.ReportConfiguration_NODE_VULNERABILITY,
+				Creator:     creator,
+				Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+					NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+						Query: "Cluster:cluster-1",
+						CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{
+							AllVuln: true,
+						},
+					},
+				},
+			}, true, nil
+		}).Times(1)
+
+	s.scheduler.EXPECT().UpsertReportSchedule(gomock.Any()).Return(nil).Times(1)
+
+	result, err := s.service.PostNodeReportConfiguration(ctx, requestConfig)
+	s.NoError(err)
+	s.Equal(requestConfig.GetId(), result.GetId())
+	s.Equal(apiV2.ReportConfiguration_NODE_VULNERABILITY, result.GetType())
+}
+
+func (s *NodeReportServiceTestSuite) TestPostNodeReportConfiguration_GetAfterCreateMissing() {
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	requestConfig := s.getValidNodeReportConfig()
+	ctx := s.getContextForUser(creator)
+
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), "email-notifier-id").
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().AddReportConfiguration(gomock.Any(), gomock.Any()).
+		Return(requestConfig.GetId(), nil).Times(1)
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), requestConfig.GetId()).
+		Return(nil, false, nil).Times(1)
+
+	result, err := s.service.PostNodeReportConfiguration(ctx, requestConfig)
+	s.Error(err)
+	s.Nil(result)
+}
+
+func (s *NodeReportServiceTestSuite) TestPostNodeReportConfiguration_ValidationError() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	invalidConfig := s.getValidNodeReportConfig()
+	invalidConfig.Filter = &apiV2.ReportConfiguration_NodeVulnReportFilters{
+		NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+			Query:     "Cluster:cluster-1",
+			CvesSince: nil,
+		},
+	}
+
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), "email-notifier-id").
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
+
+	_, err := s.service.PostNodeReportConfiguration(ctx, invalidConfig)
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestGetNodeReportConfiguration() {
+	protoReportConfig := &storage.ReportConfiguration{
+		Id:          "test-id",
+		Name:        "test node report",
+		Description: "test description",
+		Type:        storage.ReportConfiguration_NODE_VULNERABILITY,
+		ResourceScope: &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: &storage.EntityScope{
+					Rules: []*storage.EntityScopeRule{
+						{
+							Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+							Field:  storage.EntityField_FIELD_ID,
+							Values: []*storage.RuleValue{
+								{
+									Value:     "cluster-1",
+									MatchType: storage.MatchType_EXACT,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query: "Cluster:cluster-1",
+				CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+	}
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "test-id").
+		Return(protoReportConfig, true, nil).Times(1)
+
+	result, err := s.service.GetNodeReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "test-id"})
+	s.NoError(err)
+	s.Equal("test-id", result.GetId())
+	s.Equal(apiV2.ReportConfiguration_NODE_VULNERABILITY, result.GetType())
+}
+
+func (s *NodeReportServiceTestSuite) TestGetNodeReportConfiguration_NotFound() {
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "nonexistent").
+		Return(nil, false, nil).Times(1)
+
+	_, err := s.service.GetNodeReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "nonexistent"})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestDeleteNodeReportConfiguration() {
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "test-id").
+		Return(&storage.ReportConfiguration{
+			Id:   "test-id",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		}, true, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return([]*storage.ReportSnapshot{}, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().RemoveReportConfiguration(gomock.Any(), "test-id").
+		Return(nil).Times(1)
+	s.scheduler.EXPECT().RemoveReportSchedule("test-id").Times(1)
+
+	_, err := s.service.DeleteNodeReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "test-id"})
+	s.NoError(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestDeleteNodeReportConfiguration_HasRunningJob() {
+	runningSnapshot := &storage.ReportSnapshot{
+		ReportId: "test-report-id",
+		ReportStatus: &storage.ReportStatus{
+			RunState: storage.ReportStatus_PREPARING,
+		},
+	}
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "test-id").
+		Return(&storage.ReportConfiguration{
+			Id:   "test-id",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		}, true, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return([]*storage.ReportSnapshot{runningSnapshot}, nil).Times(1)
+
+	resp, err := s.service.DeleteNodeReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "test-id"})
+	s.Error(err)
+	s.Nil(resp)
+}
+
+func (s *NodeReportServiceTestSuite) TestRunNodeReport() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	configID := "test-config-id"
+	protoReportConfig := &storage.ReportConfiguration{
+		Id:          configID,
+		Name:        "test node report",
+		Description: "test description",
+		Type:        storage.ReportConfiguration_NODE_VULNERABILITY,
+		Creator:     creator,
+		ResourceScope: &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: &storage.EntityScope{
+					Rules: []*storage.EntityScopeRule{
+						{
+							Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+							Field:  storage.EntityField_FIELD_ID,
+							Values: []*storage.RuleValue{
+								{
+									Value:     "cluster-1",
+									MatchType: storage.MatchType_EXACT,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query: "Cluster:cluster-1",
+				CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+		Notifiers: []*storage.NotifierConfiguration{
+			{
+				NotifierConfig: &storage.NotifierConfiguration_EmailConfig{
+					EmailConfig: &storage.EmailNotifierConfiguration{
+						NotifierId:   "email-notifier-id",
+						MailingLists: []string{"test@example.com"},
+					},
+				},
+			},
+		},
+	}
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), configID).
+		Return(protoReportConfig, true, nil).AnyTimes()
+
+	s.notifierDataStore.EXPECT().GetManyNotifiers(gomock.Any(), gomock.Any()).
+		Return([]*storage.Notifier{
+			{
+				Id:   "email-notifier-id",
+				Name: "Email Notifier",
+				Type: "email",
+			},
+		}, nil).AnyTimes()
+
+	s.scheduler.EXPECT().SubmitReportRequest(gomock.Any(), gomock.Any(), false).
+		DoAndReturn(func(_ context.Context, reportReq interface{}, _ bool) (string, error) {
+			return "on-demand-report-id", nil
+		}).Times(1)
+
+	result, err := s.service.RunNodeReport(ctx, &apiV2.RunReportRequest{
+		ReportConfigId: configID,
+	})
+	s.NoError(err)
+	s.Equal(configID, result.GetReportConfigId())
+	s.Equal("on-demand-report-id", result.GetReportId())
+}
+
+func (s *NodeReportServiceTestSuite) TestCancelNodeReport() {
+	reportID := "test-report-id"
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	snapshot := &storage.ReportSnapshot{
+		ReportId:              reportID,
+		ReportConfigurationId: "test-config-id",
+		Requester:             creator,
+		ReportStatus: &storage.ReportStatus{
+			RunState: storage.ReportStatus_PREPARING,
+		},
+		Type: storage.ReportSnapshot_NODE_VULNERABILITY,
+	}
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportID).
+		Return(snapshot, true, nil).Times(1)
+
+	s.scheduler.EXPECT().CancelReportRequest(gomock.Any(), reportID).
+		Return(false, nil).Times(1)
+
+	_, err := s.service.CancelNodeReport(ctx, &apiV2.ResourceByID{Id: reportID})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestDeleteNodeReport() {
+	reportID := "test-report-id"
+	configID := "test-config-id"
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	snapshot := &storage.ReportSnapshot{
+		ReportId:              reportID,
+		ReportConfigurationId: configID,
+		Requester:             creator,
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+		},
+		Type: storage.ReportSnapshot_NODE_VULNERABILITY,
+	}
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportID).
+		Return(snapshot, true, nil).Times(1)
+
+	blobPath := common.GetReportBlobPath(configID, reportID)
+	s.blobStore.EXPECT().Delete(gomock.Any(), blobPath).Return(nil).Times(1)
+
+	_, err := s.service.DeleteNodeReport(ctx, &apiV2.DeleteReportRequest{
+		Id: reportID,
+	})
+	s.NoError(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestPostViewBasedNodeReport() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+
+	req := &apiV2.ReportRequestViewBased{
+		Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+		Filter: &apiV2.ReportRequestViewBased_NodeVulnReportFilters{
+			NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+				Query: "Cluster:cluster-1",
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+	}
+
+	mockRole := permissionsMocks.NewMockResolvedRole(s.mockCtrl)
+	mockID := mockIdentity.NewMockIdentity(s.mockCtrl)
+	mockID.EXPECT().UID().Return(creator.GetId()).AnyTimes()
+	mockID.EXPECT().FullName().Return(creator.GetName()).AnyTimes()
+	mockID.EXPECT().FriendlyName().Return(creator.GetName()).AnyTimes()
+	mockID.EXPECT().Roles().Return([]permissions.ResolvedRole{mockRole}).AnyTimes()
+	mockRole.EXPECT().GetAccessScope().Return(&storage.SimpleAccessScope{
+		Rules: &storage.SimpleAccessScope_Rules{
+			IncludedClusters: []string{"cluster-1"},
+		},
+	}).AnyTimes()
+
+	ctxWithIdentity := authn.ContextWithIdentity(s.ctx, mockID, s.T())
+
+	s.scheduler.EXPECT().SubmitReportRequest(gomock.Any(), gomock.Any(), false).
+		DoAndReturn(func(_ context.Context, reportReq interface{}, _ bool) (string, error) {
+			return "view-based-report-id", nil
+		}).Times(1)
+
+	result, err := s.service.PostViewBasedNodeReport(ctxWithIdentity, req)
+	s.NoError(err)
+	s.NotEmpty(result.GetReportID())
+	s.Equal("view-based-report-id", result.GetReportID())
+}
+
+func (s *NodeReportServiceTestSuite) TestListNodeReportConfigurations() {
+	protoReportConfigs := []*storage.ReportConfiguration{
+		{
+			Id:   "config-1",
+			Name: "Node Report 1",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		},
+		{
+			Id:   "config-2",
+			Name: "Node Report 2",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		},
+	}
+
+	s.reportConfigDataStore.EXPECT().GetReportConfigurations(gomock.Any(), gomock.Any()).
+		Return(protoReportConfigs, nil).Times(1)
+
+	result, err := s.service.ListNodeReportConfigurations(s.ctx, &apiV2.RawQuery{Query: ""})
+	s.NoError(err)
+	s.Len(result.GetReportConfigs(), 2)
+	assert.Equal(s.T(), apiV2.ReportConfiguration_NODE_VULNERABILITY, result.GetReportConfigs()[0].GetType())
+}
+
+func (s *NodeReportServiceTestSuite) TestCountNodeReportConfigurations() {
+	s.reportConfigDataStore.EXPECT().Count(gomock.Any(), gomock.Any()).
+		Return(5, nil).Times(1)
+
+	result, err := s.service.CountNodeReportConfigurations(s.ctx, &apiV2.RawQuery{Query: ""})
+	s.NoError(err)
+	s.Equal(int32(5), result.GetCount())
+}
+
+func (s *NodeReportServiceTestSuite) TestGetMyNodeReportHistory() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	configID := "test-config-id"
+	// Query-time filtering: only return creator's snapshot
+	snapshots := []*storage.ReportSnapshot{
+		{
+			ReportId:              "report-1",
+			ReportConfigurationId: configID,
+			Name:                  "Report 1",
+			Requester:             creator,
+			Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+		},
+	}
+
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return(snapshots, nil).Times(1)
+
+	s.blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{}, nil).AnyTimes()
+
+	result, err := s.service.GetMyNodeReportHistory(ctx, &apiV2.GetReportHistoryRequest{
+		Id: configID,
+		ReportParamQuery: &apiV2.RawQuery{
+			Query: "",
+		},
+	})
+	s.NoError(err)
+	s.Len(result.GetReportSnapshots(), 1)
+	s.Equal(creator.GetId(), result.GetReportSnapshots()[0].GetUser().GetId())
+}
+
+func (s *NodeReportServiceTestSuite) TestUpdateNodeReportConfiguration() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+
+	accessScope := &storage.SimpleAccessScope{
+		Rules: &storage.SimpleAccessScope_Rules{
+			IncludedClusters: []string{"cluster-1"},
+		},
+	}
+
+	updateConfig := s.getValidNodeReportConfig()
+	updateConfig.Name = "Updated Node Report"
+
+	mockID := mockIdentity.NewMockIdentity(s.mockCtrl)
+	ctx := authn.ContextWithIdentity(s.ctx, mockID, s.T())
+
+	mockID.EXPECT().UID().Return(creator.GetId()).AnyTimes()
+	mockID.EXPECT().FullName().Return(creator.GetName()).AnyTimes()
+	mockID.EXPECT().FriendlyName().Return(creator.GetName()).AnyTimes()
+
+	mockRole := permissionsMocks.NewMockResolvedRole(s.mockCtrl)
+	mockRole.EXPECT().GetAccessScope().Return(accessScope).AnyTimes()
+	mockID.EXPECT().Roles().Return([]permissions.ResolvedRole{mockRole}).AnyTimes()
+
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), "email-notifier-id").
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
+
+	existingConfig := &storage.ReportConfiguration{
+		Id:      updateConfig.GetId(),
+		Name:    "Old Name",
+		Type:    storage.ReportConfiguration_NODE_VULNERABILITY,
+		Creator: creator,
+		ResourceScope: &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: &storage.EntityScope{
+					Rules: []*storage.EntityScopeRule{
+						{
+							Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+							Field:  storage.EntityField_FIELD_ID,
+							Values: []*storage.RuleValue{
+								{
+									Value:     "cluster-1",
+									MatchType: storage.MatchType_EXACT,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query: "Cluster:cluster-1",
+				CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+		},
+	}
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), updateConfig.GetId()).
+		Return(existingConfig, true, nil).Times(1)
+
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return([]*storage.ReportSnapshot{}, nil).Times(1)
+
+	s.reportConfigDataStore.EXPECT().UpdateReportConfiguration(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ context.Context, cfg *storage.ReportConfiguration) error {
+			s.Equal("Updated Node Report", cfg.GetName())
+			return nil
+		}).Times(1)
+
+	s.scheduler.EXPECT().UpsertReportSchedule(gomock.Any()).Return(nil).Times(1)
+
+	result, err := s.service.UpdateNodeReportConfiguration(ctx, updateConfig)
+	s.NoError(err)
+	s.NotNil(result)
+}
+
+func (s *NodeReportServiceTestSuite) TestGetNodeReportHistory() {
+	configID := "test-config-id"
+	snapshots := []*storage.ReportSnapshot{
+		{
+			ReportId:              "report-1",
+			ReportConfigurationId: configID,
+			Name:                  "Report 1",
+			Requester:             &storage.SlimUser{Id: "uid", Name: "name"},
+			Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+			ResourceScope: &storage.ResourceScope{
+				ScopeReference: &storage.ResourceScope_EntityScope{
+					EntityScope: &storage.EntityScope{},
+				},
+			},
+		},
+	}
+
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return(snapshots, nil).Times(1)
+
+	s.blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{}, nil).AnyTimes()
+
+	result, err := s.service.GetNodeReportHistory(s.ctx, &apiV2.GetReportHistoryRequest{
+		Id: configID,
+		ReportParamQuery: &apiV2.RawQuery{
+			Query: "",
+		},
+	})
+	s.NoError(err)
+	s.Len(result.GetReportSnapshots(), 1)
+	s.Equal("report-1", result.GetReportSnapshots()[0].GetReportJobId())
+}
+
+func (s *NodeReportServiceTestSuite) TestGetNodeReportStatus() {
+	reportID := "test-report-id"
+	snapshot := &storage.ReportSnapshot{
+		ReportId: reportID,
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+		},
+		Type: storage.ReportSnapshot_NODE_VULNERABILITY,
+	}
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportID).
+		Return(snapshot, true, nil).Times(1)
+
+	result, err := s.service.GetNodeReportStatus(s.ctx, &apiV2.ResourceByID{Id: reportID})
+	s.NoError(err)
+	s.NotNil(result.GetStatus())
+	s.Equal(apiV2.ReportStatus_GENERATED, result.GetStatus().GetRunState())
+}
+
+func (s *NodeReportServiceTestSuite) TestGetViewBasedNodeReportHistory() {
+	snapshots := []*storage.ReportSnapshot{
+		{
+			ReportId:              "view-report-1",
+			ReportConfigurationId: "",
+			Name:                  "View Report 1",
+			Requester:             &storage.SlimUser{Id: "uid", Name: "name"},
+			Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+			ResourceScope: &storage.ResourceScope{
+				ScopeReference: &storage.ResourceScope_EntityScope{
+					EntityScope: &storage.EntityScope{},
+				},
+			},
+		},
+	}
+
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return(snapshots, nil).Times(1)
+
+	s.blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{}, nil).AnyTimes()
+
+	result, err := s.service.GetViewBasedNodeReportHistory(s.ctx, &apiV2.GetViewBasedReportHistoryRequest{
+		ReportParamQuery: &apiV2.RawQuery{
+			Query: "",
+		},
+	})
+	s.NoError(err)
+	s.Len(result.GetReportSnapshots(), 1)
+}
+
+func (s *NodeReportServiceTestSuite) TestGetViewBasedMyNodeReportHistory() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	// Query-time filtering: only return creator's snapshot
+	snapshots := []*storage.ReportSnapshot{
+		{
+			ReportId:              "view-report-1",
+			ReportConfigurationId: "",
+			Name:                  "View Report 1",
+			Requester:             creator,
+			Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+			ResourceScope: &storage.ResourceScope{
+				ScopeReference: &storage.ResourceScope_EntityScope{
+					EntityScope: &storage.EntityScope{},
+				},
+			},
+		},
+	}
+
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return(snapshots, nil).Times(1)
+
+	s.blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{}, nil).AnyTimes()
+
+	result, err := s.service.GetViewBasedMyNodeReportHistory(ctx, &apiV2.GetViewBasedReportHistoryRequest{
+		ReportParamQuery: &apiV2.RawQuery{
+			Query: "",
+		},
+	})
+	s.NoError(err)
+	s.Len(result.GetReportSnapshots(), 1)
+	s.Equal(creator.GetId(), result.GetReportSnapshots()[0].GetUser().GetId())
+}
+
+func (s *NodeReportServiceTestSuite) TestGetNodeReportConfiguration_InvalidType() {
+	protoReportConfig := &storage.ReportConfiguration{
+		Id:   "test-id",
+		Type: storage.ReportConfiguration_VULNERABILITY,
+	}
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "test-id").
+		Return(protoReportConfig, true, nil).Times(1)
+
+	_, err := s.service.GetNodeReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "test-id"})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestDeleteNodeReportConfiguration_WrongType() {
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "test-id").
+		Return(&storage.ReportConfiguration{
+			Id:   "test-id",
+			Type: storage.ReportConfiguration_VULNERABILITY,
+		}, true, nil).Times(1)
+
+	_, err := s.service.DeleteNodeReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "test-id"})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestRunNodeReport_WrongType() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "config-id").
+		Return(&storage.ReportConfiguration{
+			Id:   "config-id",
+			Type: storage.ReportConfiguration_VULNERABILITY,
+		}, true, nil).Times(1)
+
+	_, err := s.service.RunNodeReport(ctx, &apiV2.RunReportRequest{
+		ReportConfigId: "config-id",
+	})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestUpdateNodeReportConfiguration_WrongType() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	wrongConfig := s.getValidNodeReportConfig()
+	wrongConfig.Type = apiV2.ReportConfiguration_VULNERABILITY
+
+	_, err := s.service.UpdateNodeReportConfiguration(ctx, wrongConfig)
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestPostNodeReportConfiguration_WrongType() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	wrongConfig := s.getValidNodeReportConfig()
+	wrongConfig.Type = apiV2.ReportConfiguration_VULNERABILITY
+
+	_, err := s.service.PostNodeReportConfiguration(ctx, wrongConfig)
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestPostNodeReportConfiguration_RequiresIdentity() {
+	_, err := s.service.PostNodeReportConfiguration(s.ctx, s.getValidNodeReportConfig())
+	s.Error(err)
+	s.ErrorIs(err, errox.NoCredentials)
+}
+
+func (s *NodeReportServiceTestSuite) TestCancelNodeReport_NotFound() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), "nonexistent").
+		Return(nil, false, nil).Times(1)
+
+	_, err := s.service.CancelNodeReport(ctx, &apiV2.ResourceByID{Id: "nonexistent"})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestGetNodeReportStatus_NotFound() {
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), "nonexistent").
+		Return(nil, false, nil).Times(1)
+
+	_, err := s.service.GetNodeReportStatus(s.ctx, &apiV2.ResourceByID{Id: "nonexistent"})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestCancelNodeReport_WrongState() {
+	reportID := "test-report-id"
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	snapshot := &storage.ReportSnapshot{
+		ReportId:              reportID,
+		ReportConfigurationId: "test-config-id",
+		Requester:             creator,
+		ReportStatus: &storage.ReportStatus{
+			RunState: storage.ReportStatus_DELIVERED,
+		},
+		Type: storage.ReportSnapshot_NODE_VULNERABILITY,
+	}
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportID).
+		Return(snapshot, true, nil).Times(1)
+
+	_, err := s.service.CancelNodeReport(ctx, &apiV2.ResourceByID{Id: reportID})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestCancelNodeReport_WrongType() {
+	reportID := "test-report-id"
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	snapshot := &storage.ReportSnapshot{
+		ReportId:              reportID,
+		ReportConfigurationId: "test-config-id",
+		Requester:             creator,
+		ReportStatus: &storage.ReportStatus{
+			RunState: storage.ReportStatus_PREPARING,
+		},
+		Type: storage.ReportSnapshot_VULNERABILITY,
+	}
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportID).
+		Return(snapshot, true, nil).Times(1)
+
+	_, err := s.service.CancelNodeReport(ctx, &apiV2.ResourceByID{Id: reportID})
+	s.Error(err)
+	s.Contains(err.Error(), "not a node vulnerability report")
+}
+
+func (s *NodeReportServiceTestSuite) TestPostViewBasedNodeReport_WrongType() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	req := &apiV2.ReportRequestViewBased{
+		Type: apiV2.ReportRequestViewBased_VULNERABILITY,
+	}
+
+	_, err := s.service.PostViewBasedNodeReport(ctx, req)
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestDeleteNodeReport_NotFound() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), "nonexistent").
+		Return(nil, false, nil).Times(1)
+
+	_, err := s.service.DeleteNodeReport(ctx, &apiV2.DeleteReportRequest{
+		Id: "nonexistent",
+	})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestDeleteNodeReport_WrongType() {
+	reportID := "test-report-id"
+	configID := "test-config-id"
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	snapshot := &storage.ReportSnapshot{
+		ReportId:              reportID,
+		ReportConfigurationId: configID,
+		Requester:             creator,
+		ReportStatus: &storage.ReportStatus{
+			RunState:                 storage.ReportStatus_GENERATED,
+			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+		},
+		Type: storage.ReportSnapshot_VULNERABILITY,
+	}
+
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportID).
+		Return(snapshot, true, nil).Times(1)
+
+	_, err := s.service.DeleteNodeReport(ctx, &apiV2.DeleteReportRequest{
+		Id: reportID,
+	})
+	s.Error(err)
+	s.Contains(err.Error(), "not a node vulnerability report")
+}
+
+func (s *NodeReportServiceTestSuite) TestUpdateNodeReportConfiguration_NotFound() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	updateConfig := s.getValidNodeReportConfig()
+
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), "email-notifier-id").
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), updateConfig.GetId()).
+		Return(nil, false, nil).Times(1)
+
+	_, err := s.service.UpdateNodeReportConfiguration(ctx, updateConfig)
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestRunNodeReport_ConfigNotFound() {
+	creator := &storage.SlimUser{
+		Id:   "uid",
+		Name: "name",
+	}
+	ctx := s.getContextForUser(creator)
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "nonexistent").
+		Return(nil, false, nil).Times(1)
+
+	_, err := s.service.RunNodeReport(ctx, &apiV2.RunReportRequest{
+		ReportConfigId: "nonexistent",
+	})
+	s.Error(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestRunNodeReport_NoIdentity() {
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "test-config-id").
+		Return(&storage.ReportConfiguration{
+			Id:   "test-config-id",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		}, true, nil).Times(1)
+
+	_, err := s.service.RunNodeReport(s.ctx, &apiV2.RunReportRequest{
+		ReportConfigId: "test-config-id",
+	})
+	s.Error(err)
+	s.Contains(err.Error(), "user identity")
+}
+
+func (s *NodeReportServiceTestSuite) TestGetNodeReportStatus_WrongType() {
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), "report-id").
+		Return(&storage.ReportSnapshot{
+			ReportId: "report-id",
+			Type:     storage.ReportSnapshot_VULNERABILITY,
+		}, true, nil).Times(1)
+
+	_, err := s.service.GetNodeReportStatus(s.ctx, &apiV2.ResourceByID{Id: "report-id"})
+	s.Error(err)
+	s.Contains(err.Error(), "not a node vulnerability report")
+}
+
+func (s *NodeReportServiceTestSuite) TestGetMyNodeReportHistory_UsesUserID() {
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	snapshots := []*storage.ReportSnapshot{
+		{
+			ReportId:              "report-1",
+			ReportConfigurationId: "test-config-id",
+			Requester:             creator,
+			Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+		},
+	}
+
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ context.Context, q *v1.Query) ([]*storage.ReportSnapshot, error) {
+			var foundUserID bool
+			search.ApplyFnToAllBaseQueries(q, func(bq *v1.BaseQuery) {
+				mfQ, ok := bq.GetQuery().(*v1.BaseQuery_MatchFieldQuery)
+				if !ok {
+					return
+				}
+				s.NotEqual("Requester User ID", mfQ.MatchFieldQuery.GetField())
+				if mfQ.MatchFieldQuery.GetField() == search.UserID.String() {
+					foundUserID = true
+					s.Contains(mfQ.MatchFieldQuery.GetValue(), "uid")
+				}
+			})
+			s.True(foundUserID)
+			return snapshots, nil
+		}).Times(1)
+	s.blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{}, nil).AnyTimes()
+
+	result, err := s.service.GetMyNodeReportHistory(ctx, &apiV2.GetReportHistoryRequest{
+		Id: "test-config-id",
+		ReportParamQuery: &apiV2.RawQuery{
+			Query: "",
+		},
+	})
+	s.NoError(err)
+	s.Len(result.GetReportSnapshots(), 1)
+}
+
+func (s *NodeReportServiceTestSuite) TestGetViewBasedNodeReportHistory_ElevatesWorkflowAdministrationRead() {
+	limitedCtx := sac.WithGlobalAccessScopeChecker(context.Background(),
+		sac.AllowFixedScopes(
+			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
+			sac.ResourceScopeKeys(resources.Node, resources.Cluster),
+		),
+	)
+	snapshots := []*storage.ReportSnapshot{
+		{
+			ReportId: "view-report-1",
+			Type:     storage.ReportSnapshot_NODE_VULNERABILITY,
+			ReportStatus: &storage.ReportStatus{
+				ReportRequestType: storage.ReportStatus_VIEW_BASED,
+			},
+		},
+	}
+
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(ctx context.Context, _ *v1.Query) ([]*storage.ReportSnapshot, error) {
+			allowed, err := sac.ForResource(resources.WorkflowAdministration).ReadAllowed(ctx)
+			s.NoError(err)
+			s.True(allowed)
+			return snapshots, nil
+		}).Times(1)
+	s.blobStore.EXPECT().Search(gomock.Any(), gomock.Any()).Return([]search.Result{}, nil).AnyTimes()
+
+	result, err := s.service.GetViewBasedNodeReportHistory(limitedCtx, &apiV2.GetViewBasedReportHistoryRequest{
+		ReportParamQuery: &apiV2.RawQuery{Query: ""},
+	})
+	s.NoError(err)
+	s.Len(result.GetReportSnapshots(), 1)
+}
+
+func (s *NodeReportServiceTestSuite) TestAuthz() {
+	svc := serviceImpl{snapshotDatastore: s.reportSnapshotDataStore}
+	testutils.AssertAuthzWorks(s.T(), &svc)
+}
+
+func (s *NodeReportServiceTestSuite) TestAuthzPermissions() {
+	svc := &serviceImpl{}
+
+	ctxWithPerms := func(perms map[string]storage.Access) context.Context {
+		mockID := mockIdentity.NewMockIdentity(s.mockCtrl)
+		mockID.EXPECT().Permissions().Return(perms).AnyTimes()
+		return authn.ContextWithIdentity(context.Background(), mockID, s.T())
+	}
+
+	viewNodeCluster := map[string]storage.Access{
+		"Node":    storage.Access_READ_ACCESS,
+		"Cluster": storage.Access_READ_ACCESS,
+	}
+	viewWorkflow := map[string]storage.Access{
+		"WorkflowAdministration": storage.Access_READ_ACCESS,
+		"Node":                   storage.Access_READ_ACCESS,
+		"Cluster":                storage.Access_READ_ACCESS,
+	}
+	modifyWorkflow := map[string]storage.Access{
+		"WorkflowAdministration": storage.Access_READ_WRITE_ACCESS,
+		"Node":                   storage.Access_READ_ACCESS,
+		"Cluster":                storage.Access_READ_ACCESS,
+	}
+	nodeOnly := map[string]storage.Access{
+		"Node": storage.Access_READ_ACCESS,
+	}
+
+	testCases := map[string]struct {
+		method       string
+		allowedPerms map[string]storage.Access
+		deniedPerms  map[string]storage.Access
+	}{
+		"GetNodeReportStatus allowed with View Node+Cluster, denied without Cluster": {
+			method:       apiV2.NodeReportService_GetNodeReportStatus_FullMethodName,
+			allowedPerms: viewNodeCluster,
+			deniedPerms:  nodeOnly,
+		},
+		"CancelNodeReport allowed with View Node+Cluster, denied without Cluster": {
+			method:       apiV2.NodeReportService_CancelNodeReport_FullMethodName,
+			allowedPerms: viewNodeCluster,
+			deniedPerms:  nodeOnly,
+		},
+		"DeleteNodeReport allowed with View Node+Cluster, denied without Cluster": {
+			method:       apiV2.NodeReportService_DeleteNodeReport_FullMethodName,
+			allowedPerms: viewNodeCluster,
+			deniedPerms:  nodeOnly,
+		},
+		"PostViewBasedNodeReport allowed with View Node+Cluster, denied without Cluster": {
+			method:       apiV2.NodeReportService_PostViewBasedNodeReport_FullMethodName,
+			allowedPerms: viewNodeCluster,
+			deniedPerms:  nodeOnly,
+		},
+		"ListNodeReportConfigurations requires View WorkflowAdministration": {
+			method:       apiV2.NodeReportService_ListNodeReportConfigurations_FullMethodName,
+			allowedPerms: viewWorkflow,
+			deniedPerms:  viewNodeCluster,
+		},
+		"RunNodeReport requires Modify WorkflowAdministration": {
+			method:       apiV2.NodeReportService_RunNodeReport_FullMethodName,
+			allowedPerms: modifyWorkflow,
+			deniedPerms:  viewNodeCluster,
+		},
+	}
+
+	for name, tc := range testCases {
+		s.T().Run(name, func(t *testing.T) {
+			_, err := svc.AuthFuncOverride(ctxWithPerms(tc.allowedPerms), tc.method)
+			assert.NoError(t, err, "should be allowed with sufficient permissions")
+
+			_, err = svc.AuthFuncOverride(ctxWithPerms(tc.deniedPerms), tc.method)
+			assert.Error(t, err, "should be denied with insufficient permissions")
+		})
+	}
+}
+
+func (s *NodeReportServiceTestSuite) expectNotify(ctx context.Context, channel, payload string) {
+	s.db.EXPECT().Exec(ctx, "SELECT pg_notify($1, $2)", channel, payload).
+		Return(pgconn.NewCommandTag("SELECT 1"), nil).Times(1)
+}
+
+func (s *NodeReportServiceTestSuite) TestPostNodeReportConfigurationWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	accessScope := &storage.SimpleAccessScope{
+		Rules: &storage.SimpleAccessScope_Rules{IncludedClusters: []string{"cluster-1"}},
+	}
+	requestConfig := s.getValidNodeReportConfig()
+	mockID := mockIdentity.NewMockIdentity(s.mockCtrl)
+	ctx := authn.ContextWithIdentity(s.ctx, mockID, s.T())
+	mockID.EXPECT().UID().Return(creator.GetId()).AnyTimes()
+	mockID.EXPECT().FullName().Return(creator.GetName()).AnyTimes()
+	mockID.EXPECT().FriendlyName().Return(creator.GetName()).AnyTimes()
+	mockRole := permissionsMocks.NewMockResolvedRole(s.mockCtrl)
+	mockRole.EXPECT().GetAccessScope().Return(accessScope).Times(1)
+	mockID.EXPECT().Roles().Return([]permissions.ResolvedRole{mockRole}).Times(1)
+
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), "email-notifier-id").
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().AddReportConfiguration(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ context.Context, cfg *storage.ReportConfiguration) (string, error) {
+			return cfg.GetId(), nil
+		}).Times(1)
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), requestConfig.GetId()).
+		Return(&storage.ReportConfiguration{
+			Id:      requestConfig.GetId(),
+			Name:    requestConfig.GetName(),
+			Type:    storage.ReportConfiguration_NODE_VULNERABILITY,
+			Creator: creator,
+			Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+				NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+					Query:     "Cluster:cluster-1",
+					CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{AllVuln: true},
+				},
+			},
+		}, true, nil).Times(1)
+	s.expectNotify(ctx, pgNotify.ReportConfigChanged, requestConfig.GetId())
+
+	result, err := s.service.PostNodeReportConfiguration(ctx, requestConfig)
+	s.NoError(err)
+	s.Equal(requestConfig.GetId(), result.GetId())
+}
+
+func (s *NodeReportServiceTestSuite) TestUpdateNodeReportConfigurationWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	updateConfig := s.getValidNodeReportConfig()
+	ctx := s.getContextForUser(creator)
+
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), "email-notifier-id").
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), updateConfig.GetId()).
+		Return(&storage.ReportConfiguration{
+			Id:      updateConfig.GetId(),
+			Name:    "Old Name",
+			Type:    storage.ReportConfiguration_NODE_VULNERABILITY,
+			Creator: creator,
+			Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+				NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+					Query:     "Cluster:cluster-1",
+					CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{AllVuln: true},
+				},
+			},
+		}, true, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return([]*storage.ReportSnapshot{}, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().UpdateReportConfiguration(gomock.Any(), gomock.Any()).Return(nil).Times(1)
+	s.expectNotify(ctx, pgNotify.ReportConfigChanged, updateConfig.GetId())
+
+	_, err := s.service.UpdateNodeReportConfiguration(ctx, updateConfig)
+	s.NoError(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestDeleteNodeReportConfigurationWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "test-id").
+		Return(&storage.ReportConfiguration{
+			Id:   "test-id",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		}, true, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return([]*storage.ReportSnapshot{}, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().RemoveReportConfiguration(gomock.Any(), "test-id").
+		Return(nil).Times(1)
+	s.expectNotify(s.ctx, pgNotify.ReportConfigChanged, "test-id")
+
+	_, err := s.service.DeleteNodeReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "test-id"})
+	s.NoError(err)
+}
+
+func (s *NodeReportServiceTestSuite) TestRunNodeReportWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	configID := "test-config-id"
+	protoReportConfig := &storage.ReportConfiguration{
+		Id:      configID,
+		Name:    "test node report",
+		Type:    storage.ReportConfiguration_NODE_VULNERABILITY,
+		Creator: creator,
+		ResourceScope: &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: &storage.EntityScope{
+					Rules: []*storage.EntityScopeRule{
+						{
+							Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+							Field:  storage.EntityField_FIELD_ID,
+							Values: []*storage.RuleValue{{Value: "cluster-1", MatchType: storage.MatchType_EXACT}},
+						},
+					},
+				},
+			},
+		},
+		Filter: &storage.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query:     "Cluster:cluster-1",
+				CvesSince: &storage.NodeVulnerabilityReportFilters_AllVuln{AllVuln: true},
+			},
+		},
+	}
+
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), configID).
+		Return(protoReportConfig, true, nil).AnyTimes()
+	s.notifierDataStore.EXPECT().GetManyNotifiers(gomock.Any(), gomock.Any()).
+		Return(nil, nil).AnyTimes()
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		Return([]*storage.ReportSnapshot{}, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().AddReportSnapshot(gomock.Any(), gomock.Any()).
+		Return("on-demand-report-id", nil).Times(1)
+	s.db.EXPECT().Exec(gomock.Any(), "SELECT pg_notify($1, $2)", pgNotify.ReportRequestSubmitted, "on-demand-report-id").
+		Return(pgconn.NewCommandTag("SELECT 1"), nil).Times(1)
+
+	result, err := s.service.RunNodeReport(ctx, &apiV2.RunReportRequest{
+		ReportConfigId:           configID,
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.NoError(err)
+	s.Equal("on-demand-report-id", result.GetReportId())
+}
+
+func (s *NodeReportServiceTestSuite) TestPostViewBasedNodeReportWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	req := &apiV2.ReportRequestViewBased{
+		Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+		Filter: &apiV2.ReportRequestViewBased_NodeVulnReportFilters{
+			NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+				Query:     "Cluster:cluster-1",
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{AllVuln: true},
+			},
+		},
+	}
+
+	s.reportSnapshotDataStore.EXPECT().Count(gomock.Any(), gomock.Any()).
+		Return(0, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().AddReportSnapshot(gomock.Any(), gomock.Any()).
+		Return("view-based-report-id", nil).Times(1)
+	s.db.EXPECT().Exec(gomock.Any(), "SELECT pg_notify($1, $2)", pgNotify.ReportRequestSubmitted, "view-based-report-id").
+		Return(pgconn.NewCommandTag("SELECT 1"), nil).Times(1)
+
+	result, err := s.service.PostViewBasedNodeReport(ctx, req)
+	s.NoError(err)
+	s.Equal("view-based-report-id", result.GetReportID())
+}
+
+func (s *NodeReportServiceTestSuite) TestCancelNodeReportWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	reportID := "test-report-id"
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), reportID).
+		Return(&storage.ReportSnapshot{
+			ReportId:  reportID,
+			Requester: creator,
+			ReportStatus: &storage.ReportStatus{
+				RunState: storage.ReportStatus_PREPARING,
+			},
+			Type: storage.ReportSnapshot_NODE_VULNERABILITY,
+		}, true, nil).Times(1)
+	s.expectNotify(ctx, pgNotify.ReportRequestCancelled, reportID)
+
+	_, err := s.service.CancelNodeReport(ctx, &apiV2.ResourceByID{Id: reportID})
+	s.NoError(err)
+}
diff --git a/central/reports/service/v2/node/singleton.go b/central/reports/service/v2/node/singleton.go
new file mode 100644
index 0000000000000..a3d0abe2cbafd
--- /dev/null
+++ b/central/reports/service/v2/node/singleton.go
@@ -0,0 +1,33 @@
+package node
+
+import (
+	blobDS "github.com/stackrox/rox/central/blob/datastore"
+	"github.com/stackrox/rox/central/globaldb"
+	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
+	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
+	schedulerV2 "github.com/stackrox/rox/central/reports/scheduler/v2"
+	snapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	"github.com/stackrox/rox/central/reports/validation"
+	"github.com/stackrox/rox/pkg/sync"
+)
+
+var (
+	once sync.Once
+	svc  Service
+)
+
+// Singleton returns the singleton instance of the node report service.
+func Singleton() Service {
+	once.Do(func() {
+		svc = New(
+			reportConfigDS.Singleton(),
+			snapshotDS.Singleton(),
+			notifierDS.Singleton(),
+			schedulerV2.Singleton(),
+			blobDS.Singleton(),
+			validation.Singleton(),
+			globaldb.GetPostgres(),
+		)
+	})
+	return svc
+}
diff --git a/central/reports/service/v2/service.go b/central/reports/service/v2/service.go
index 6ef015e4d6adf..2e9625112eb65 100644
--- a/central/reports/service/v2/service.go
+++ b/central/reports/service/v2/service.go
@@ -12,6 +12,7 @@ import (
 	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
 	apiV2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/pkg/grpc"
+	"github.com/stackrox/rox/pkg/postgres"
 )
 
 // Service provides the interface to the gRPC service for reports.
@@ -25,7 +26,8 @@ type Service interface {
 // New returns a new instance of the service.
 func New(reportConfigStore reportConfigDS.DataStore, snapshotDatastore snapshotDS.DataStore,
 	collectionDatastore collectionDS.DataStore, notifierDatastore notifierDS.DataStore,
-	scheduler schedulerV2.Scheduler, blobStore blobDS.Datastore, validator *validation.Validator) Service {
+	scheduler schedulerV2.Scheduler, blobStore blobDS.Datastore, validator *validation.Validator,
+	db postgres.DB) Service {
 	return &serviceImpl{
 		reportConfigStore:   reportConfigStore,
 		snapshotDatastore:   snapshotDatastore,
@@ -34,5 +36,6 @@ func New(reportConfigStore reportConfigDS.DataStore, snapshotDatastore snapshotD
 		scheduler:           scheduler,
 		blobStore:           blobStore,
 		validator:           validator,
+		db:                  db,
 	}
 }
diff --git a/central/reports/service/v2/service_impl.go b/central/reports/service/v2/service_impl.go
index 2996bd27844d9..d4e3def92eb8f 100644
--- a/central/reports/service/v2/service_impl.go
+++ b/central/reports/service/v2/service_impl.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stackrox/rox/central/reports/common"
 	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
 	schedulerV2 "github.com/stackrox/rox/central/reports/scheduler/v2"
+	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
 	snapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
 	"github.com/stackrox/rox/central/reports/validation"
 	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
@@ -17,12 +18,16 @@ import (
 	apiV2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/grpc/authn"
 	"github.com/stackrox/rox/pkg/grpc/authz"
 	"github.com/stackrox/rox/pkg/grpc/authz/perrpc"
 	"github.com/stackrox/rox/pkg/grpc/authz/user"
+	"github.com/stackrox/rox/pkg/postgres"
+	pgNotify "github.com/stackrox/rox/pkg/postgres/notify"
+	"github.com/stackrox/rox/pkg/retry"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/sac/resources"
 	"github.com/stackrox/rox/pkg/search"
@@ -83,6 +88,7 @@ type serviceImpl struct {
 	scheduler           schedulerV2.Scheduler
 	blobStore           blobDS.Datastore
 	validator           *validation.Validator
+	db                  postgres.DB
 }
 
 func (s *serviceImpl) RegisterServiceServer(grpcServer *grpc.Server) {
@@ -103,6 +109,10 @@ func (s *serviceImpl) PostReportConfiguration(ctx context.Context, request *apiV
 		return nil, errors.New("Could not determine user identity from provided context")
 	}
 
+	if request.GetType() == apiV2.ReportConfiguration_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.New("node vulnerability reports must be created via the node report service")
+	}
+
 	if err := s.validator.ValidateReportConfiguration(request); err != nil {
 		return nil, errors.Wrap(err, "Validating report configuration")
 	}
@@ -124,8 +134,9 @@ func (s *serviceImpl) PostReportConfiguration(ctx context.Context, request *apiV
 		return nil, err
 	}
 
-	err = s.scheduler.UpsertReportSchedule(createdReportConfig)
-	if err != nil {
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		notifyWithRetry(ctx, s.db, pgNotify.ReportConfigChanged, id)
+	} else if err := s.scheduler.UpsertReportSchedule(createdReportConfig); err != nil {
 		return nil, err
 	}
 
@@ -151,6 +162,9 @@ func (s *serviceImpl) UpdateReportConfiguration(ctx context.Context, request *ap
 	if !exists {
 		return nil, errors.Wrapf(errox.NotFound, "report configuration with id '%s' does not exist", request.GetId())
 	}
+	if err := rejectNodeReportConfiguration(currentConfig); err != nil {
+		return nil, err
+	}
 
 	query := search.NewQueryBuilder().AddExactMatches(search.ReportConfigID, request.GetId()).AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).ProtoQuery()
 	reportSnapshots, err := s.snapshotDatastore.SearchReportSnapshots(ctx, query)
@@ -164,16 +178,17 @@ func (s *serviceImpl) UpdateReportConfiguration(ctx context.Context, request *ap
 		}
 	}
 
-	updatedConfig := s.convertV2ReportConfigurationToProto(request, currentConfig.GetCreator(),
-		currentConfig.GetVulnReportFilters().GetAccessScopeRules())
+	accessScopeRules := currentConfig.GetVulnReportFilters().GetAccessScopeRules()
+	updatedConfig := s.convertV2ReportConfigurationToProto(request, currentConfig.GetCreator(), accessScopeRules)
 
 	err = s.reportConfigStore.UpdateReportConfiguration(ctx, updatedConfig)
 	if err != nil {
 		return nil, err
 	}
 
-	err = s.scheduler.UpsertReportSchedule(updatedConfig)
-	if err != nil {
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		notifyWithRetry(ctx, s.db, pgNotify.ReportConfigChanged, updatedConfig.GetId())
+	} else if err := s.scheduler.UpsertReportSchedule(updatedConfig); err != nil {
 		return nil, err
 	}
 	return &apiV2.Empty{}, nil
@@ -185,6 +200,10 @@ func (s *serviceImpl) ListReportConfigurations(ctx context.Context, query *apiV2
 	if err != nil {
 		return nil, errors.Wrap(errox.InvalidArgs, err.Error())
 	}
+	parsedQuery = search.ConjunctionQuery(
+		parsedQuery,
+		search.NewQueryBuilder().AddExactMatches(search.ReportType, storage.ReportConfiguration_VULNERABILITY.String()).ProtoQuery(),
+	)
 	// Fill in pagination.
 	paginated.FillPaginationV2(parsedQuery, query.GetPagination(), maxPaginationLimit)
 
@@ -215,6 +234,9 @@ func (s *serviceImpl) GetReportConfiguration(ctx context.Context, req *apiV2.Res
 	if !exists {
 		return nil, errors.Wrapf(errox.NotFound, "report configuration with id '%s' does not exist", req.GetId())
 	}
+	if err := rejectNodeReportConfiguration(config); err != nil {
+		return nil, err
+	}
 	// Remove report configs with empty scope. This can happen after downgrade to a version that has less scoping methods and doesn't support the new scoping method.
 	if !common.HasValidResourceScope(config.GetResourceScope()) {
 		return nil, errors.Wrapf(errox.InvalidArgs,
@@ -233,6 +255,10 @@ func (s *serviceImpl) CountReportConfigurations(ctx context.Context, request *ap
 	if err != nil {
 		return nil, errors.Wrap(errox.InvalidArgs, err.Error())
 	}
+	parsedQuery = search.ConjunctionQuery(
+		parsedQuery,
+		search.NewQueryBuilder().AddExactMatches(search.ReportType, storage.ReportConfiguration_VULNERABILITY.String()).ProtoQuery(),
+	)
 	numReportConfigs, err := s.reportConfigStore.Count(ctx, parsedQuery)
 	if err != nil {
 		return nil, err
@@ -244,13 +270,16 @@ func (s *serviceImpl) DeleteReportConfiguration(ctx context.Context, id *apiV2.R
 	if id.GetId() == "" {
 		return nil, errors.Wrap(errox.InvalidArgs, "Report configuration id is required for deletion")
 	}
-	_, found, err := s.reportConfigStore.GetReportConfiguration(ctx, id.GetId())
+	config, found, err := s.reportConfigStore.GetReportConfiguration(ctx, id.GetId())
 	if err != nil {
 		return nil, errors.Wrap(err, "Error finding report config")
 	}
 	if !found {
 		return nil, errors.Wrapf(errox.NotFound, "Report config ID '%s' not found", id.GetId())
 	}
+	if err := rejectNodeReportConfiguration(config); err != nil {
+		return nil, err
+	}
 	query := search.NewQueryBuilder().AddExactMatches(search.ReportConfigID, id.GetId()).AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).ProtoQuery()
 	reportSnapshots, _ := s.snapshotDatastore.SearchReportSnapshots(ctx, query)
 	if len(reportSnapshots) > 0 {
@@ -261,7 +290,11 @@ func (s *serviceImpl) DeleteReportConfiguration(ctx context.Context, id *apiV2.R
 		return nil, err
 	}
 
-	s.scheduler.RemoveReportSchedule(id.GetId())
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		notifyWithRetry(ctx, s.db, pgNotify.ReportConfigChanged, id.GetId())
+	} else {
+		s.scheduler.RemoveReportSchedule(id.GetId())
+	}
 	return &apiV2.Empty{}, nil
 }
 
@@ -276,6 +309,9 @@ func (s *serviceImpl) GetReportStatus(ctx context.Context, req *apiV2.ResourceBy
 	if !found {
 		return nil, errors.Wrapf(errox.NotFound, "Report snapshot not found for job id %s", req.GetId())
 	}
+	if err := rejectNodeReportSnapshot(rep); err != nil {
+		return nil, err
+	}
 	status := s.convertPrototoV2Reportstatus(rep.GetReportStatus())
 	return &apiV2.ReportStatusResponse{Status: status}, err
 }
@@ -290,7 +326,10 @@ func (s *serviceImpl) GetReportHistory(ctx context.Context, req *apiV2.GetReport
 	}
 
 	conjunctionQuery := search.ConjunctionQuery(
-		search.NewQueryBuilder().AddExactMatches(search.ReportConfigID, req.GetId()).ProtoQuery(),
+		search.NewQueryBuilder().
+			AddExactMatches(search.ReportConfigID, req.GetId()).
+			AddExactMatches(search.ReportType, storage.ReportSnapshot_VULNERABILITY.String()).
+			ProtoQuery(),
 		parsedQuery,
 	)
 	// Fill in pagination.
@@ -332,7 +371,9 @@ func (s *serviceImpl) GetMyReportHistory(ctx context.Context, req *apiV2.GetRepo
 	conjunctionQuery := search.ConjunctionQuery(
 		search.NewQueryBuilder().
 			AddExactMatches(search.ReportConfigID, req.GetId()).
-			AddExactMatches(search.UserID, slimUser.GetId()).ProtoQuery(),
+			AddExactMatches(search.UserID, slimUser.GetId()).
+			AddExactMatches(search.ReportType, storage.ReportSnapshot_VULNERABILITY.String()).
+			ProtoQuery(),
 		parsedQuery,
 	)
 
@@ -377,6 +418,20 @@ func (s *serviceImpl) RunReport(ctx context.Context, req *apiV2.RunReportRequest
 	if err != nil {
 		return nil, err
 	}
+	if reportReq.ReportSnapshot.GetType() == storage.ReportSnapshot_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.Newf("report configuration '%s' is a node vulnerability report; use the node report service", req.GetReportConfigId())
+	}
+
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportID, err := s.persistSnapshotAndNotify(ctx, reportReq, pgNotify.ReportRequestSubmitted)
+		if err != nil {
+			return nil, err
+		}
+		return &apiV2.RunReportResponse{
+			ReportConfigId: req.GetReportConfigId(),
+			ReportId:       reportID,
+		}, nil
+	}
 
 	reportID, err := s.scheduler.SubmitReportRequest(ctx, reportReq, false)
 	if err != nil {
@@ -403,6 +458,11 @@ func (s *serviceImpl) CancelReport(ctx context.Context, req *apiV2.ResourceByID)
 		return nil, err
 	}
 
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		notifyWithRetry(ctx, s.db, pgNotify.ReportRequestCancelled, req.GetId())
+		return &apiV2.Empty{}, nil
+	}
+
 	cancelled, err := s.scheduler.CancelReportRequest(ctx, req.GetId())
 	if err != nil {
 		return nil, err
@@ -433,6 +493,9 @@ func (s *serviceImpl) DeleteReport(ctx context.Context, req *apiV2.DeleteReportR
 	if !found {
 		return nil, errors.Wrapf(errox.NotFound, "Error finding report snapshot with job ID '%q'.", req.GetId())
 	}
+	if err := rejectNodeReportSnapshot(rep); err != nil {
+		return nil, err
+	}
 
 	if slimUser.GetId() != rep.GetRequester().GetId() {
 		return nil, errors.Wrap(errox.NotAuthorized, "Report cannot be deleted by a user who did not request the report.")
@@ -472,6 +535,9 @@ func (s *serviceImpl) PostViewBasedReport(ctx context.Context, req *apiV2.Report
 	if req == nil {
 		return nil, errors.Wrap(errox.InvalidArgs, "Empty Request Body")
 	}
+	if req.GetType() == apiV2.ReportRequestViewBased_NODE_VULNERABILITY {
+		return nil, errox.InvalidArgs.New("node vulnerability reports must be created via the node report service")
+	}
 
 	requesterID := authn.IdentityFromContextOrNil(ctx)
 	if requesterID == nil {
@@ -484,7 +550,14 @@ func (s *serviceImpl) PostViewBasedReport(ctx context.Context, req *apiV2.Report
 		return nil, err
 	}
 
-	// Submit to scheduler. view-based reports are always on-demand, not re-submissions.
+	if env.CentralWorkerEnabled.BooleanSetting() {
+		reportID, err := s.persistSnapshotAndNotify(ctx, reportReq, pgNotify.ReportRequestSubmitted)
+		if err != nil {
+			return nil, err
+		}
+		return &apiV2.RunReportResponseViewBased{ReportID: reportID, RequestName: reportReq.ReportSnapshot.GetName()}, nil
+	}
+
 	reportID, err := s.scheduler.SubmitReportRequest(ctx, reportReq, false)
 	if err != nil {
 		return nil, errors.Wrapf(errox.ServerError, "Scheduler error:%s", err)
@@ -507,7 +580,9 @@ func (s *serviceImpl) GetViewBasedReportHistory(ctx context.Context, req *apiV2.
 	conjunctionQuery := search.ConjunctionQuery(
 		search.NewQueryBuilder().AddExactMatches(
 			search.ReportRequestType,
-			storage.ReportStatus_VIEW_BASED.String()).ProtoQuery(),
+			storage.ReportStatus_VIEW_BASED.String()).
+			AddExactMatches(search.ReportType, storage.ReportSnapshot_VULNERABILITY.String()).
+			ProtoQuery(),
 		parsedQuery,
 	)
 	// Fill in pagination.
@@ -516,13 +591,7 @@ func (s *serviceImpl) GetViewBasedReportHistory(ctx context.Context, req *apiV2.
 	// View-based history endpoints are authorized with only Image+Deployment view.
 	// The snapshot datastore requires WorkflowAdministration read, so elevate the
 	// context to that single read scope instead of granting unrestricted access.
-	snapshotReadCtx := sac.WithGlobalAccessScopeChecker(ctx,
-		sac.AllowFixedScopes(
-			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
-			sac.ResourceScopeKeys(resources.WorkflowAdministration),
-		),
-	)
-	results, err := s.snapshotDatastore.SearchReportSnapshots(snapshotReadCtx, conjunctionQuery)
+	results, err := s.snapshotDatastore.SearchReportSnapshots(SnapshotReadContext(ctx), conjunctionQuery)
 	if err != nil {
 		return nil, err
 	}
@@ -561,6 +630,7 @@ func (s *serviceImpl) GetViewBasedMyReportHistory(ctx context.Context, req *apiV
 		search.NewQueryBuilder().
 			AddExactMatches(search.UserID, slimUser.GetId()).
 			AddExactMatches(search.ReportRequestType, storage.ReportStatus_VIEW_BASED.String()).
+			AddExactMatches(search.ReportType, storage.ReportSnapshot_VULNERABILITY.String()).
 			ProtoQuery(),
 		parsedQuery,
 	)
@@ -572,13 +642,7 @@ func (s *serviceImpl) GetViewBasedMyReportHistory(ctx context.Context, req *apiV
 	// The snapshot datastore requires WorkflowAdministration read, so elevate the
 	// context to that single read scope. Results are already scoped to the requesting
 	// user via the UserID query filter above.
-	snapshotReadCtx := sac.WithGlobalAccessScopeChecker(ctx,
-		sac.AllowFixedScopes(
-			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
-			sac.ResourceScopeKeys(resources.WorkflowAdministration),
-		),
-	)
-	results, err := s.snapshotDatastore.SearchReportSnapshots(snapshotReadCtx, conjunctionQuery)
+	results, err := s.snapshotDatastore.SearchReportSnapshots(SnapshotReadContext(ctx), conjunctionQuery)
 	if err != nil {
 		return nil, err
 	}
@@ -593,6 +657,11 @@ func (s *serviceImpl) GetViewBasedMyReportHistory(ctx context.Context, req *apiV
 }
 
 func verifyNoUserSearchLabels(q *v1.Query) error {
+	return VerifyNoUserSearchLabels(q)
+}
+
+// VerifyNoUserSearchLabels rejects queries that filter on user identity fields.
+func VerifyNoUserSearchLabels(q *v1.Query) error {
 	unexpectedLabels := set.NewStringSet(search.UserID.String(), search.UserName.String())
 	var err error
 	search.ApplyFnToAllBaseQueries(q, func(bq *v1.BaseQuery) {
@@ -604,3 +673,62 @@ func verifyNoUserSearchLabels(q *v1.Query) error {
 	})
 	return err
 }
+
+func notifyWithRetry(ctx context.Context, db postgres.DB, channel, payload string) {
+	NotifyWithRetry(ctx, db, channel, payload)
+}
+
+// NotifyWithRetry sends a pg_notify on the given channel, retrying a few times on failure.
+// Failures are logged and not returned so that the originating RPC can still succeed.
+func NotifyWithRetry(ctx context.Context, db postgres.DB, channel, payload string) {
+	if db == nil {
+		return
+	}
+	err := retry.WithRetry(func() error {
+		return pgNotify.Notify(ctx, db, channel, payload)
+	}, retry.Tries(3), retry.BetweenAttempts(func(previousAttempt int) {
+		log.Errorf("pg_notify %s failed (attempt %d), retrying", channel, previousAttempt+1)
+	}))
+	if err != nil {
+		log.Errorf("pg_notify %s failed after retries: %v", channel, err)
+	}
+}
+
+func (s *serviceImpl) persistSnapshotAndNotify(ctx context.Context, reportReq *reportGen.ReportRequest, channel string) (string, error) {
+	return PersistSnapshotAndNotify(ctx, s.validator, s.db, reportReq, channel)
+}
+
+func rejectNodeReportSnapshot(snapshot *storage.ReportSnapshot) error {
+	if snapshot.GetType() == storage.ReportSnapshot_NODE_VULNERABILITY {
+		return errox.InvalidArgs.Newf("report job '%s' is a node vulnerability report; use the node report service", snapshot.GetReportId())
+	}
+	return nil
+}
+
+// SnapshotReadContext elevates the request context with WorkflowAdministration
+// read so view-based history RPCs can query the snapshot datastore.
+func SnapshotReadContext(ctx context.Context) context.Context {
+	return sac.WithGlobalAccessScopeChecker(ctx,
+		sac.AllowFixedScopes(
+			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
+			sac.ResourceScopeKeys(resources.WorkflowAdministration),
+		),
+	)
+}
+
+// PersistSnapshotAndNotify persists a WAITING snapshot and notifies the worker.
+func PersistSnapshotAndNotify(ctx context.Context, validator *validation.Validator, db postgres.DB, reportReq *reportGen.ReportRequest, channel string) (string, error) {
+	reportID, err := validator.PersistReportSnapshot(ctx, reportReq.ReportSnapshot)
+	if err != nil {
+		return "", err
+	}
+	NotifyWithRetry(ctx, db, channel, reportID)
+	return reportID, nil
+}
+
+func rejectNodeReportConfiguration(config *storage.ReportConfiguration) error {
+	if config.GetType() == storage.ReportConfiguration_NODE_VULNERABILITY {
+		return errox.InvalidArgs.Newf("report configuration '%s' is a node vulnerability report; use the node report service", config.GetId())
+	}
+	return nil
+}
diff --git a/central/reports/service/v2/service_impl_test.go b/central/reports/service/v2/service_impl_test.go
index 55bfdb6861d10..5f574ba81d094 100644
--- a/central/reports/service/v2/service_impl_test.go
+++ b/central/reports/service/v2/service_impl_test.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/jackc/pgx/v5/pgconn"
 	"github.com/pkg/errors"
 	blobDSMocks "github.com/stackrox/rox/central/blob/datastore/mocks"
 	notifierDSMocks "github.com/stackrox/rox/central/notifier/datastore/mocks"
@@ -25,6 +26,9 @@ import (
 	"github.com/stackrox/rox/pkg/grpc/authn"
 	mockIdentity "github.com/stackrox/rox/pkg/grpc/authn/mocks"
 	"github.com/stackrox/rox/pkg/grpc/testutils"
+	"github.com/stackrox/rox/pkg/notifiers"
+	postgresMocks "github.com/stackrox/rox/pkg/postgres/mocks"
+	pgNotify "github.com/stackrox/rox/pkg/postgres/notify"
 	"github.com/stackrox/rox/pkg/protoassert"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/search"
@@ -56,6 +60,7 @@ type ReportServiceTestSuite struct {
 	notifierDataStore       *notifierDSMocks.MockDataStore
 	blobStore               *blobDSMocks.MockDatastore
 	scheduler               *schedulerMocks.MockScheduler
+	db                      *postgresMocks.MockDB
 	service                 Service
 }
 
@@ -68,8 +73,9 @@ func (s *ReportServiceTestSuite) SetupTest() {
 	s.notifierDataStore = notifierDSMocks.NewMockDataStore(s.mockCtrl)
 	s.blobStore = blobDSMocks.NewMockDatastore(s.mockCtrl)
 	s.scheduler = schedulerMocks.NewMockScheduler(s.mockCtrl)
+	s.db = postgresMocks.NewMockDB(s.mockCtrl)
 	validator := validation.New(s.reportConfigDataStore, s.reportSnapshotDataStore, s.collectionDataStore, s.notifierDataStore)
-	s.service = New(s.reportConfigDataStore, s.reportSnapshotDataStore, s.collectionDataStore, s.notifierDataStore, s.scheduler, s.blobStore, validator)
+	s.service = New(s.reportConfigDataStore, s.reportSnapshotDataStore, s.collectionDataStore, s.notifierDataStore, s.scheduler, s.blobStore, validator, s.db)
 }
 
 func (s *ReportServiceTestSuite) TearDownSuite() {
@@ -134,6 +140,142 @@ func (s *ReportServiceTestSuite) TestCreateReportConfiguration() {
 	s.Error(err)
 }
 
+func (s *ReportServiceTestSuite) TestPostReportConfiguration_RejectsNodeType() {
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	_, err := s.service.PostReportConfiguration(ctx, &apiV2.ReportConfiguration{
+		Name: "node report",
+		Type: apiV2.ReportConfiguration_NODE_VULNERABILITY,
+	})
+	s.Error(err)
+	s.Contains(err.Error(), "node report service")
+}
+
+func (s *ReportServiceTestSuite) TestUpdateReportConfiguration_RejectsNodeType() {
+	protoReportConfig := &storage.ReportConfiguration{
+		Id:   "node-config",
+		Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+	}
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "node-config").
+		Return(protoReportConfig, true, nil).Times(1)
+	s.collectionDataStore.EXPECT().Exists(gomock.Any(), gomock.Any()).Return(true, nil).AnyTimes()
+	s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), gomock.Any()).
+		Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).AnyTimes()
+
+	requestConfig := fixtures.GetValidV2ReportConfigWithMultipleNotifiers()
+	requestConfig.Id = "node-config"
+	_, err := s.service.UpdateReportConfiguration(s.ctx, requestConfig)
+	s.Error(err)
+	s.Contains(err.Error(), "node report service")
+}
+
+func (s *ReportServiceTestSuite) TestGetReportConfiguration_RejectsNodeType() {
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "node-config").
+		Return(&storage.ReportConfiguration{
+			Id:   "node-config",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		}, true, nil).Times(1)
+
+	_, err := s.service.GetReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "node-config"})
+	s.Error(err)
+	s.Contains(err.Error(), "node report service")
+}
+
+func (s *ReportServiceTestSuite) TestDeleteReportConfiguration_RejectsNodeType() {
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "node-config").
+		Return(&storage.ReportConfiguration{
+			Id:   "node-config",
+			Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		}, true, nil).Times(1)
+
+	_, err := s.service.DeleteReportConfiguration(s.ctx, &apiV2.ResourceByID{Id: "node-config"})
+	s.Error(err)
+	s.Contains(err.Error(), "node report service")
+}
+
+func (s *ReportServiceTestSuite) TestRunReport_RejectsNodeType() {
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	nodeConfig := &storage.ReportConfiguration{
+		Id:   "node-config",
+		Name: "node report",
+		Type: storage.ReportConfiguration_NODE_VULNERABILITY,
+		ResourceScope: &storage.ResourceScope{
+			ScopeReference: &storage.ResourceScope_EntityScope{
+				EntityScope: &storage.EntityScope{
+					Rules: []*storage.EntityScopeRule{
+						{
+							Entity: storage.EntityType_ENTITY_TYPE_CLUSTER,
+							Field:  storage.EntityField_FIELD_ID,
+							Values: []*storage.RuleValue{{Value: "cluster-1", MatchType: storage.MatchType_EXACT}},
+						},
+					},
+				},
+			},
+		},
+	}
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), "node-config").
+		Return(nodeConfig, true, nil).Times(1)
+	s.notifierDataStore.EXPECT().GetManyNotifiers(gomock.Any(), gomock.Any()).Return(nil, nil).Times(1)
+
+	_, err := s.service.RunReport(ctx, &apiV2.RunReportRequest{
+		ReportConfigId:           "node-config",
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.Error(err)
+	s.Contains(err.Error(), "node report service")
+}
+
+func (s *ReportServiceTestSuite) TestPostViewBasedReport_RejectsNodeType() {
+	s.T().Setenv(features.VulnerabilityViewBasedReports.EnvVar(), "true")
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	_, err := s.service.PostViewBasedReport(ctx, &apiV2.ReportRequestViewBased{
+		Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+	})
+	s.Error(err)
+	s.Contains(err.Error(), "node report service")
+}
+
+func imageReportTypeQuery(base *v1.Query) *v1.Query {
+	return search.ConjunctionQuery(
+		base,
+		search.NewQueryBuilder().AddExactMatches(search.ReportType, storage.ReportConfiguration_VULNERABILITY.String()).ProtoQuery(),
+	)
+}
+
+func (s *ReportServiceTestSuite) TestCreateReportConfigurationWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	requestConfig := fixtures.GetValidV2ReportConfigWithMultipleNotifiers()
+	requestConfig.Notifiers = nil
+	requestConfig.Schedule = nil
+	s.mockCollectionStoreCalls(requestConfig, true, false, false)
+
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	identity := mockIdentity.NewMockIdentity(s.mockCtrl)
+	identity.EXPECT().UID().Return(creator.GetId()).AnyTimes()
+	identity.EXPECT().FullName().Return(creator.GetName()).AnyTimes()
+	identity.EXPECT().FriendlyName().Return(creator.GetName()).AnyTimes()
+	role := permissionsMocks.NewMockResolvedRole(s.mockCtrl)
+	role.EXPECT().GetAccessScope().Return(&storage.SimpleAccessScope{}).Times(1)
+	identity.EXPECT().Roles().Return([]permissions.ResolvedRole{role}).Times(1)
+	ctx := authn.ContextWithIdentity(s.ctx, identity, s.T())
+
+	storedConfig := fixtures.GetValidReportConfigWithMultipleNotifiersV2()
+	storedConfig.Notifiers = nil
+	storedConfig.Schedule = nil
+	storedConfig.Creator = creator
+	storedConfig.GetVulnReportFilters().AccessScopeRules = []*storage.SimpleAccessScope_Rules{{}}
+	s.reportConfigDataStore.EXPECT().AddReportConfiguration(ctx, storedConfig).Return(storedConfig.GetId(), nil).Times(1)
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(ctx, storedConfig.GetId()).Return(storedConfig, true, nil).Times(1)
+	s.db.EXPECT().Exec(ctx, "SELECT pg_notify($1, $2)", pgNotify.ReportConfigChanged, storedConfig.GetId()).
+		Return(pgconn.NewCommandTag("SELECT 1"), nil).Times(1)
+
+	_, err := s.service.PostReportConfiguration(ctx, requestConfig)
+	s.NoError(err)
+}
+
 func (s *ReportServiceTestSuite) TestUpdateReportConfigurationError() {
 
 	requester := &storage.SlimUser{
@@ -228,6 +370,30 @@ func (s *ReportServiceTestSuite) TestUpdateReportConfiguration() {
 	}
 }
 
+func (s *ReportServiceTestSuite) TestUpdateReportConfigurationWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	creator := &storage.SlimUser{Id: "uid", Name: "name"}
+	ctx := s.getContextForUser(creator)
+	requestConfig := fixtures.GetValidV2ReportConfigWithMultipleNotifiers()
+	requestConfig.Notifiers = nil
+	requestConfig.Schedule = nil
+	s.mockCollectionStoreCalls(requestConfig, true, false, true)
+
+	storedConfig := fixtures.GetValidReportConfigWithMultipleNotifiersV2()
+	storedConfig.Notifiers = nil
+	storedConfig.Schedule = nil
+	storedConfig.Creator = creator
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(ctx, storedConfig.GetId()).Return(storedConfig, true, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(ctx, gomock.Any()).Return([]*storage.ReportSnapshot{}, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().UpdateReportConfiguration(ctx, storedConfig).Return(nil).Times(1)
+	s.db.EXPECT().Exec(ctx, "SELECT pg_notify($1, $2)", pgNotify.ReportConfigChanged, storedConfig.GetId()).
+		Return(pgconn.NewCommandTag("SELECT 1"), nil).Times(1)
+
+	_, err := s.service.UpdateReportConfiguration(ctx, requestConfig)
+	s.NoError(err)
+}
+
 func (s *ReportServiceTestSuite) TestListReportConfigurations() {
 	allAccessContext := sac.WithAllAccess(context.Background())
 	testCases := []struct {
@@ -239,7 +405,7 @@ func (s *ReportServiceTestSuite) TestListReportConfigurations() {
 			desc:  "Empty query",
 			query: &apiV2.RawQuery{Query: ""},
 			expectedQ: func() *v1.Query {
-				query := search.EmptyQuery()
+				query := imageReportTypeQuery(search.EmptyQuery())
 				query.Pagination = &v1.QueryPagination{Limit: maxPaginationLimit}
 				return query
 			}(),
@@ -248,7 +414,7 @@ func (s *ReportServiceTestSuite) TestListReportConfigurations() {
 			desc:  "Query with search field",
 			query: &apiV2.RawQuery{Query: "Report Name:name"},
 			expectedQ: func() *v1.Query {
-				query := search.NewQueryBuilder().AddStrings(search.ReportName, "name").ProtoQuery()
+				query := imageReportTypeQuery(search.NewQueryBuilder().AddStrings(search.ReportName, "name").ProtoQuery())
 				query.Pagination = &v1.QueryPagination{Limit: maxPaginationLimit}
 				return query
 			}(),
@@ -260,7 +426,7 @@ func (s *ReportServiceTestSuite) TestListReportConfigurations() {
 				Pagination: &apiV2.Pagination{Limit: 25},
 			},
 			expectedQ: func() *v1.Query {
-				query := search.EmptyQuery()
+				query := imageReportTypeQuery(search.EmptyQuery())
 				query.Pagination = &v1.QueryPagination{Limit: 25}
 				return query
 			}(),
@@ -354,12 +520,12 @@ func (s *ReportServiceTestSuite) TestCountReportConfigurations() {
 		{
 			desc:      "Empty query",
 			query:     &apiV2.RawQuery{Query: ""},
-			expectedQ: search.NewQueryBuilder().ProtoQuery(),
+			expectedQ: imageReportTypeQuery(search.NewQueryBuilder().ProtoQuery()),
 		},
 		{
 			desc:      "Query with search field",
 			query:     &apiV2.RawQuery{Query: "Report Name:name"},
-			expectedQ: search.NewQueryBuilder().AddStrings(search.ReportName, "name").ProtoQuery(),
+			expectedQ: imageReportTypeQuery(search.NewQueryBuilder().AddStrings(search.ReportName, "name").ProtoQuery()),
 		},
 	}
 
@@ -408,6 +574,22 @@ func (s *ReportServiceTestSuite) TestDeleteReportConfiguration() {
 	}
 }
 
+func (s *ReportServiceTestSuite) TestDeleteReportConfigurationWithCentralWorker() {
+	s.T().Setenv(env.CentralWorkerEnabled.EnvVar(), "true")
+
+	const configID = "config-id"
+	ctx := sac.WithAllAccess(context.Background())
+	s.reportConfigDataStore.EXPECT().GetReportConfiguration(gomock.Any(), configID).
+		Return(fixtures.GetValidReportConfigWithMultipleNotifiersV2(), true, nil).Times(1)
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).Return([]*storage.ReportSnapshot{}, nil).Times(1)
+	s.reportConfigDataStore.EXPECT().RemoveReportConfiguration(ctx, configID).Return(nil).Times(1)
+	s.db.EXPECT().Exec(ctx, "SELECT pg_notify($1, $2)", pgNotify.ReportConfigChanged, configID).
+		Return(pgconn.NewCommandTag("SELECT 1"), nil).Times(1)
+
+	_, err := s.service.DeleteReportConfiguration(ctx, &apiV2.ResourceByID{Id: configID})
+	s.NoError(err)
+}
+
 func (s *ReportServiceTestSuite) upsertReportConfigTestCases(isUpdate bool) []upsertTestCase {
 	cases := []upsertTestCase{
 		{
@@ -670,11 +852,11 @@ func (s *ReportServiceTestSuite) upsertReportConfigTestCases(isUpdate bool) []up
 func (s *ReportServiceTestSuite) mockNotifierStoreCalls(reqNotifier *apiV2.NotifierConfiguration,
 	notifierIDExits, isValidationError, isUpdate bool) {
 	if notifierIDExits {
-		s.notifierDataStore.EXPECT().Exists(gomock.Any(), reqNotifier.GetEmailConfig().GetNotifierId()).
-			Return(true, nil).Times(1)
+		s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), reqNotifier.GetEmailConfig().GetNotifierId()).
+			Return(&storage.Notifier{Type: notifiers.EmailType}, true, nil).Times(1)
 	} else {
-		s.notifierDataStore.EXPECT().Exists(gomock.Any(), reqNotifier.GetEmailConfig().GetNotifierId()).
-			Return(false, nil).Times(1)
+		s.notifierDataStore.EXPECT().GetScrubbedNotifier(gomock.Any(), reqNotifier.GetEmailConfig().GetNotifierId()).
+			Return(nil, false, nil).Times(1)
 	}
 
 	if !isValidationError && !isUpdate {
@@ -732,6 +914,53 @@ func (s *ReportServiceTestSuite) TestGetReportStatus() {
 	assert.Equal(s.T(), repStatusResponse.GetStatus().GetErrorMsg(), status.GetErrorMsg())
 }
 
+func (s *ReportServiceTestSuite) TestGetReportStatus_RejectsNodeType() {
+	s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), "node-job").Return(&storage.ReportSnapshot{
+		ReportId:     "node-job",
+		Type:         storage.ReportSnapshot_NODE_VULNERABILITY,
+		ReportStatus: &storage.ReportStatus{},
+	}, true, nil)
+
+	_, err := s.service.GetReportStatus(s.ctx, &apiV2.ResourceByID{Id: "node-job"})
+	s.Error(err)
+	s.Contains(err.Error(), "node report service")
+}
+
+func (s *ReportServiceTestSuite) TestGetReportHistory_FiltersImageReportType() {
+	var captured *v1.Query
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ context.Context, q *v1.Query) ([]*storage.ReportSnapshot, error) {
+			captured = q
+			return nil, nil
+		})
+
+	_, err := s.service.GetReportHistory(s.ctx, &apiV2.GetReportHistoryRequest{
+		Id:               "test_report_config",
+		ReportParamQuery: &apiV2.RawQuery{Query: ""},
+	})
+	s.NoError(err)
+	s.True(queryHasFieldValue(captured, search.ReportType, storage.ReportSnapshot_VULNERABILITY.String()),
+		"history query must constrain ReportType to VULNERABILITY, got %s", captured)
+}
+
+func (s *ReportServiceTestSuite) TestGetMyReportHistory_FiltersImageReportType() {
+	user := &storage.SlimUser{Id: "user-a", Name: "user-a"}
+	var captured *v1.Query
+	s.reportSnapshotDataStore.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ context.Context, q *v1.Query) ([]*storage.ReportSnapshot, error) {
+			captured = q
+			return nil, nil
+		})
+
+	_, err := s.service.GetMyReportHistory(s.getContextForUser(user), &apiV2.GetReportHistoryRequest{
+		Id:               "test_report_config",
+		ReportParamQuery: &apiV2.RawQuery{Query: ""},
+	})
+	s.NoError(err)
+	s.True(queryHasFieldValue(captured, search.ReportType, storage.ReportSnapshot_VULNERABILITY.String()),
+		"my-history query must constrain ReportType to VULNERABILITY, got %s", captured)
+}
+
 func (s *ReportServiceTestSuite) TestGetReportHistory() {
 	reportSnapshot := &storage.ReportSnapshot{
 		ReportId:              "test_report",
@@ -1434,6 +1663,20 @@ func (s *ReportServiceTestSuite) TestDeleteReport() {
 			},
 			isError: false,
 		},
+		{
+			desc: "Node vulnerability snapshot is rejected",
+			req: &apiV2.DeleteReportRequest{
+				Id: reportSnapshot.GetReportId(),
+			},
+			ctx: userContext,
+			mockGen: func() {
+				snap := reportSnapshot.CloneVT()
+				snap.Type = storage.ReportSnapshot_NODE_VULNERABILITY
+				s.reportSnapshotDataStore.EXPECT().Get(gomock.Any(), snap.GetReportId()).
+					Return(snap, true, nil).Times(1)
+			},
+			isError: true,
+		},
 	}
 	for _, tc := range testCases {
 		s.T().Run(tc.desc, func(t *testing.T) {
@@ -1804,3 +2047,17 @@ func (s *ReportServiceTestSuite) getContextForUser(user *storage.SlimUser) conte
 
 	return authn.ContextWithIdentity(s.ctx, mockID, s.T())
 }
+
+func queryHasFieldValue(q *v1.Query, field search.FieldLabel, want string) bool {
+	found := false
+	search.ApplyFnToAllBaseQueries(q, func(bq *v1.BaseQuery) {
+		mfQ, ok := bq.GetQuery().(*v1.BaseQuery_MatchFieldQuery)
+		if !ok {
+			return
+		}
+		if mfQ.MatchFieldQuery.GetField() == field.String() && strings.Contains(mfQ.MatchFieldQuery.GetValue(), want) {
+			found = true
+		}
+	})
+	return found
+}
diff --git a/central/reports/service/v2/singleton.go b/central/reports/service/v2/singleton.go
index d9ab9b95d3f1b..45e900480243b 100644
--- a/central/reports/service/v2/singleton.go
+++ b/central/reports/service/v2/singleton.go
@@ -27,7 +27,7 @@ func initialize() {
 	}
 	collectionDatastore, _ := collectionDS.Singleton()
 	svc = New(reportConfigDS.Singleton(), snapshotDS.Singleton(), collectionDatastore, notifierDS.Singleton(), scheduler,
-		blobDS.Singleton(), validation.Singleton())
+		blobDS.Singleton(), validation.Singleton(), globaldb.GetPostgres())
 }
 
 // Singleton provides the instance of the service to register.
diff --git a/central/reports/snapshot/datastore/store/postgres/store.go b/central/reports/snapshot/datastore/store/postgres/store.go
index d019cc69b89cd..12fc029ac5500 100644
--- a/central/reports/snapshot/datastore/store/postgres/store.go
+++ b/central/reports/snapshot/datastore/store/postgres/store.go
@@ -104,6 +104,7 @@ func insertIntoReportSnapshots(batch *pgx.Batch, obj *storage.ReportSnapshot) er
 		pgutils.NilOrUUID(obj.GetReportId()),
 		pgutils.NilOrString(obj.GetReportConfigurationId()),
 		obj.GetName(),
+		obj.GetType(),
 		obj.GetReportStatus().GetRunState(),
 		protocompat.NilOrTime(obj.GetReportStatus().GetQueuedAt()),
 		protocompat.NilOrTime(obj.GetReportStatus().GetCompletedAt()),
@@ -115,7 +116,7 @@ func insertIntoReportSnapshots(batch *pgx.Batch, obj *storage.ReportSnapshot) er
 		serialized,
 	}
 
-	finalStr := "INSERT INTO report_snapshots (ReportId, ReportConfigurationId, Name, ReportStatus_RunState, ReportStatus_QueuedAt, ReportStatus_CompletedAt, ReportStatus_ReportRequestType, ReportStatus_ReportNotificationMethod, Requester_Id, Requester_Name, AreaOfConcern, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) ON CONFLICT(ReportId) DO UPDATE SET ReportId = EXCLUDED.ReportId, ReportConfigurationId = EXCLUDED.ReportConfigurationId, Name = EXCLUDED.Name, ReportStatus_RunState = EXCLUDED.ReportStatus_RunState, ReportStatus_QueuedAt = EXCLUDED.ReportStatus_QueuedAt, ReportStatus_CompletedAt = EXCLUDED.ReportStatus_CompletedAt, ReportStatus_ReportRequestType = EXCLUDED.ReportStatus_ReportRequestType, ReportStatus_ReportNotificationMethod = EXCLUDED.ReportStatus_ReportNotificationMethod, Requester_Id = EXCLUDED.Requester_Id, Requester_Name = EXCLUDED.Requester_Name, AreaOfConcern = EXCLUDED.AreaOfConcern, serialized = EXCLUDED.serialized"
+	finalStr := "INSERT INTO report_snapshots (ReportId, ReportConfigurationId, Name, Type, ReportStatus_RunState, ReportStatus_QueuedAt, ReportStatus_CompletedAt, ReportStatus_ReportRequestType, ReportStatus_ReportNotificationMethod, Requester_Id, Requester_Name, AreaOfConcern, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13) ON CONFLICT(ReportId) DO UPDATE SET ReportId = EXCLUDED.ReportId, ReportConfigurationId = EXCLUDED.ReportConfigurationId, Name = EXCLUDED.Name, Type = EXCLUDED.Type, ReportStatus_RunState = EXCLUDED.ReportStatus_RunState, ReportStatus_QueuedAt = EXCLUDED.ReportStatus_QueuedAt, ReportStatus_CompletedAt = EXCLUDED.ReportStatus_CompletedAt, ReportStatus_ReportRequestType = EXCLUDED.ReportStatus_ReportRequestType, ReportStatus_ReportNotificationMethod = EXCLUDED.ReportStatus_ReportNotificationMethod, Requester_Id = EXCLUDED.Requester_Id, Requester_Name = EXCLUDED.Requester_Name, AreaOfConcern = EXCLUDED.AreaOfConcern, serialized = EXCLUDED.serialized"
 	batch.Queue(finalStr, values...)
 
 	return nil
@@ -125,6 +126,7 @@ var copyColsReportSnapshots = []string{
 	"reportid",
 	"reportconfigurationid",
 	"name",
+	"type",
 	"reportstatus_runstate",
 	"reportstatus_queuedat",
 	"reportstatus_completedat",
@@ -170,6 +172,7 @@ func copyFromReportSnapshots(ctx context.Context, s pgSearch.Deleter, tx *postgr
 			pgutils.NilOrUUID(obj.GetReportId()),
 			pgutils.NilOrString(obj.GetReportConfigurationId()),
 			obj.GetName(),
+			obj.GetType(),
 			obj.GetReportStatus().GetRunState(),
 			protocompat.NilOrTime(obj.GetReportStatus().GetQueuedAt()),
 			protocompat.NilOrTime(obj.GetReportStatus().GetCompletedAt()),
diff --git a/central/reports/validation/entity_scope_boundary_test.go b/central/reports/validation/entity_scope_boundary_test.go
new file mode 100644
index 0000000000000..26ddadc18da91
--- /dev/null
+++ b/central/reports/validation/entity_scope_boundary_test.go
@@ -0,0 +1,63 @@
+package validation
+
+import (
+	"testing"
+
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateEntityScopeRejectsUnsupportedRulesAndValues(t *testing.T) {
+	tests := map[string]struct {
+		entity apiV2.ScopeEntity
+		field  apiV2.ScopeField
+		value  *apiV2.RuleValue
+	}{
+		"unsupported cluster ID": {
+			entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:  apiV2.ScopeField_FIELD_ID,
+			value:  &apiV2.RuleValue{Value: "cluster-id"},
+		},
+		"unknown entity": {
+			entity: apiV2.ScopeEntity(99),
+			field:  apiV2.ScopeField_FIELD_NAME,
+			value:  &apiV2.RuleValue{Value: "prod"},
+		},
+		"unknown field": {
+			entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:  apiV2.ScopeField(99),
+			value:  &apiV2.RuleValue{Value: "prod"},
+		},
+		"unknown match type": {
+			entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:  apiV2.ScopeField_FIELD_NAME,
+			value:  &apiV2.RuleValue{Value: "prod", MatchType: apiV2.MatchType(99)},
+		},
+		"nil value": {
+			entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:  apiV2.ScopeField_FIELD_NAME,
+		},
+		"empty scalar value": {
+			entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:  apiV2.ScopeField_FIELD_NAME,
+			value:  &apiV2.RuleValue{},
+		},
+		"invalid regex key": {
+			entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+			field:  apiV2.ScopeField_FIELD_LABEL,
+			value:  &apiV2.RuleValue{Value: "[=prod", MatchType: apiV2.MatchType_REGEX},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			err := validateEntityScope(&apiV2.EntityScope{Rules: []*apiV2.EntityScopeRule{{
+				Entity: tc.entity,
+				Field:  tc.field,
+				Values: []*apiV2.RuleValue{tc.value},
+			}}})
+			require.ErrorIs(t, err, errox.InvalidArgs)
+		})
+	}
+}
diff --git a/central/reports/validation/filter_enum_boundary_test.go b/central/reports/validation/filter_enum_boundary_test.go
new file mode 100644
index 0000000000000..b1e707cbbc4f6
--- /dev/null
+++ b/central/reports/validation/filter_enum_boundary_test.go
@@ -0,0 +1,55 @@
+package validation
+
+import (
+	"testing"
+
+	reportConfigDSMocks "github.com/stackrox/rox/central/reports/config/datastore/mocks"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestValidateAndGenerateReportRequestRejectsInvalidNotificationMethodBeforeLookup(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	validator := &Validator{reportConfigDatastore: reportConfigDSMocks.NewMockDataStore(ctrl)}
+
+	_, err := validator.ValidateAndGenerateReportRequest(
+		"config",
+		storage.ReportStatus_NotificationMethod(99),
+		storage.ReportStatus_ON_DEMAND,
+		nil,
+	)
+	require.ErrorIs(t, err, errox.InvalidArgs)
+}
+
+func TestValidateImageFiltersRejectsInvalidEnumsAndDates(t *testing.T) {
+	tests := map[string]*apiV2.VulnerabilityReportFilters{
+		"image type": {
+			ImageTypes: []apiV2.VulnerabilityReportFilters_ImageType{apiV2.VulnerabilityReportFilters_ImageType(99)},
+			CvesSince:  &apiV2.VulnerabilityReportFilters_AllVuln{AllVuln: true},
+		},
+		"fixability": {
+			ImageTypes: []apiV2.VulnerabilityReportFilters_ImageType{apiV2.VulnerabilityReportFilters_DEPLOYED},
+			Fixability: apiV2.VulnerabilityReportFilters_Fixability(99),
+			CvesSince:  &apiV2.VulnerabilityReportFilters_AllVuln{AllVuln: true},
+		},
+		"severity": {
+			ImageTypes: []apiV2.VulnerabilityReportFilters_ImageType{apiV2.VulnerabilityReportFilters_DEPLOYED},
+			Severities: []apiV2.VulnerabilityReportFilters_VulnerabilitySeverity{apiV2.VulnerabilityReportFilters_VulnerabilitySeverity(99)},
+			CvesSince:  &apiV2.VulnerabilityReportFilters_AllVuln{AllVuln: true},
+		},
+		"nil start date": {
+			ImageTypes: []apiV2.VulnerabilityReportFilters_ImageType{apiV2.VulnerabilityReportFilters_DEPLOYED},
+			CvesSince:  &apiV2.VulnerabilityReportFilters_SinceStartDate{},
+		},
+	}
+
+	for name, filters := range tests {
+		t.Run(name, func(t *testing.T) {
+			require.ErrorIs(t, (&Validator{}).validateImageFilters(filters), errox.InvalidArgs)
+		})
+	}
+}
diff --git a/central/reports/validation/notifier_type_boundary_test.go b/central/reports/validation/notifier_type_boundary_test.go
new file mode 100644
index 0000000000000..56825c94b2cd3
--- /dev/null
+++ b/central/reports/validation/notifier_type_boundary_test.go
@@ -0,0 +1,24 @@
+package validation
+
+import (
+	"testing"
+
+	notifierDSMocks "github.com/stackrox/rox/central/notifier/datastore/mocks"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestValidateEmailConfigRejectsNonEmailNotifier(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	notifierDS.EXPECT().GetScrubbedNotifier(gomock.Any(), "notifier").Return(&storage.Notifier{Type: "slack"}, true, nil)
+
+	err := (&Validator{notifierDatastore: notifierDS}).validateEmailConfig(&apiV2.EmailNotifierConfiguration{
+		NotifierId: "notifier", MailingLists: []string{"reader@example.com"},
+	})
+	require.ErrorIs(t, err, errox.InvalidArgs)
+}
diff --git a/central/reports/validation/schedule_boundary_test.go b/central/reports/validation/schedule_boundary_test.go
new file mode 100644
index 0000000000000..459d8a7ca4729
--- /dev/null
+++ b/central/reports/validation/schedule_boundary_test.go
@@ -0,0 +1,28 @@
+package validation
+
+import (
+	"testing"
+
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateScheduleRejectsInvalidBoundsAndIntervals(t *testing.T) {
+	tests := map[string]*apiV2.ReportSchedule{
+		"negative hour":   {IntervalType: apiV2.ReportSchedule_DAILY, Hour: -1},
+		"hour 24":         {IntervalType: apiV2.ReportSchedule_DAILY, Hour: 24},
+		"negative minute": {IntervalType: apiV2.ReportSchedule_DAILY, Minute: -1},
+		"minute 60":       {IntervalType: apiV2.ReportSchedule_DAILY, Minute: 60},
+		"unknown interval": {
+			IntervalType: apiV2.ReportSchedule_IntervalType(99),
+		},
+	}
+
+	for name, schedule := range tests {
+		t.Run(name, func(t *testing.T) {
+			err := (&Validator{}).validateSchedule(&apiV2.ReportConfiguration{Schedule: schedule})
+			require.ErrorIs(t, err, errox.InvalidArgs)
+		})
+	}
+}
diff --git a/central/reports/validation/validate.go b/central/reports/validation/validate.go
index ef1d5e89f1987..4c00f9431d603 100644
--- a/central/reports/validation/validate.go
+++ b/central/reports/validation/validate.go
@@ -23,6 +23,8 @@ import (
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/grpc/authn"
+	"github.com/stackrox/rox/pkg/notifiers"
+	"github.com/stackrox/rox/pkg/protocompat"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/search"
 	"github.com/stackrox/rox/pkg/set"
@@ -58,7 +60,7 @@ func New(reportConfigDatastore reportConfigDS.DataStore, reportSnapshotDatastore
 // ValidateReportConfiguration validates the given report configuration object
 func (v *Validator) ValidateReportConfiguration(config *apiV2.ReportConfiguration) error {
 	if config.GetName() == "" {
-		return errors.Wrap(errox.InvalidArgs, "Report configuration name is empty")
+		return errox.InvalidArgs.New("Report configuration name is empty")
 	}
 
 	if err := v.validateSchedule(config); err != nil {
@@ -82,29 +84,35 @@ func (v *Validator) validateSchedule(config *apiV2.ReportConfiguration) error {
 	if schedule == nil {
 		return nil
 	}
+	if schedule.GetHour() < 0 || schedule.GetHour() > 23 {
+		return errox.InvalidArgs.New("schedule hour must be within 0-23")
+	}
+	if schedule.GetMinute() < 0 || schedule.GetMinute() > 59 {
+		return errox.InvalidArgs.New("schedule minute must be within 0-59")
+	}
 	switch schedule.GetIntervalType() {
-	case apiV2.ReportSchedule_UNSET:
-		return errors.Wrap(errox.InvalidArgs, "Report configuration schedule must be one of DAILY, WEEKLY, or MONTHLY")
+	default:
+		return errox.InvalidArgs.New("report configuration schedule must be one of DAILY, WEEKLY, or MONTHLY")
 	case apiV2.ReportSchedule_DAILY:
 		if schedule.GetDaysOfWeek() != nil || schedule.GetDaysOfMonth() != nil {
-			return errors.Wrap(errox.InvalidArgs, "Daily schedule must not specify days of week or days of month")
+			return errox.InvalidArgs.New("daily schedule must not specify days of week or days of month")
 		}
 	case apiV2.ReportSchedule_WEEKLY:
 		if schedule.GetDaysOfWeek() == nil || len(schedule.GetDaysOfWeek().GetDays()) == 0 {
-			return errors.Wrap(errox.InvalidArgs, "Report configuration must specify days of week for weekly schedule")
+			return errox.InvalidArgs.New("report configuration must specify days of week for weekly schedule")
 		}
 		for _, day := range schedule.GetDaysOfWeek().GetDays() {
 			if day < 0 || day > 6 {
-				return errors.Wrap(errox.InvalidArgs, "Invalid schedule: Days of the week can be Sunday (0) - Saturday(6)")
+				return errox.InvalidArgs.New("invalid schedule: days of the week can be Sunday (0) - Saturday(6)")
 			}
 		}
 	case apiV2.ReportSchedule_MONTHLY:
 		if schedule.GetDaysOfMonth() == nil || len(schedule.GetDaysOfMonth().GetDays()) == 0 {
-			return errors.Wrap(errox.InvalidArgs, "Report configuration must specify days of the month for monthly schedule")
+			return errox.InvalidArgs.New("report configuration must specify days of the month for monthly schedule")
 		}
 		for _, day := range schedule.GetDaysOfMonth().GetDays() {
 			if day != 1 && day != 15 {
-				return errors.Wrap(errox.InvalidArgs, "Reports can be sent out only 1st or 15th day of the month")
+				return errox.InvalidArgs.New("reports can be sent out only 1st or 15th day of the month")
 			}
 		}
 	}
@@ -115,13 +123,13 @@ func (v *Validator) validateNotifiers(config *apiV2.ReportConfiguration) error {
 	notifiers := config.GetNotifiers()
 	if len(notifiers) == 0 {
 		if config.GetSchedule() != nil {
-			return errors.Wrap(errox.InvalidArgs, "Report configurations with a schedule must specify a notifier.")
+			return errox.InvalidArgs.New("report configurations with a schedule must specify a notifier")
 		}
 		return nil
 	}
 	for _, notifier := range notifiers {
 		if notifier.GetEmailConfig() == nil {
-			return errors.Wrap(errox.InvalidArgs, "Notifier must specify an email notifier configuration")
+			return errox.InvalidArgs.New("notifier must specify an email notifier configuration")
 		}
 		if err := v.validateEmailConfig(notifier.GetEmailConfig()); err != nil {
 			return err
@@ -132,24 +140,24 @@ func (v *Validator) validateNotifiers(config *apiV2.ReportConfiguration) error {
 
 func (v *Validator) validateEmailConfig(emailConfig *apiV2.EmailNotifierConfiguration) error {
 	if emailConfig.GetNotifierId() == "" {
-		return errors.Wrap(errox.InvalidArgs, "Report configuration must specify a valid email notifier")
+		return errox.InvalidArgs.New("report configuration must specify a valid email notifier")
 	}
 	if len(emailConfig.GetMailingLists()) == 0 {
-		return errors.Wrap(errox.InvalidArgs, "Report configuration must specify at least one email recipient to send the report to")
+		return errox.InvalidArgs.New("report configuration must specify at least one email recipient to send the report to")
 	}
 	subjectMaxLen := env.ReportCustomEmailSubjectMaxLen.IntegerSetting()
 	if len(emailConfig.GetCustomSubject()) > subjectMaxLen {
-		return errors.Wrapf(errox.InvalidArgs, "Custom email subject must be fewer than %d characters", subjectMaxLen)
+		return errox.InvalidArgs.Newf("custom email subject must be fewer than %d characters", subjectMaxLen)
 	}
 	bodyMaxLen := env.ReportCustomEmailBodyMaxLen.IntegerSetting()
 	if len(emailConfig.GetCustomBody()) > bodyMaxLen {
-		return errors.Wrapf(errox.InvalidArgs, "Custom email body must be fewer than than %d characters", bodyMaxLen)
+		return errox.InvalidArgs.Newf("custom email body must be fewer than %d characters", bodyMaxLen)
 	}
 
 	errorList := errorhelpers.NewErrorList("Invalid email addresses in mailing list: ")
 	for _, addr := range emailConfig.GetMailingLists() {
 		if _, err := mail.ParseAddress(addr); err != nil {
-			errorList.AddError(errors.Wrapf(errox.InvalidArgs, "Invalid email recipient address: %s", addr))
+			errorList.AddError(errox.InvalidArgs.Newf("invalid email recipient address: %s", addr))
 		}
 	}
 	if !errorList.Empty() {
@@ -157,37 +165,70 @@ func (v *Validator) validateEmailConfig(emailConfig *apiV2.EmailNotifierConfigur
 	}
 
 	// Use allAccessCtx since report creator/updater might not have permissions for integrationSAC
-	exists, err := v.notifierDatastore.Exists(allAccessCtx, emailConfig.GetNotifierId())
+	notifier, exists, err := v.notifierDatastore.GetScrubbedNotifier(allAccessCtx, emailConfig.GetNotifierId())
 	if err != nil {
 		return errors.Errorf("Error looking up attached notifier, Notifier ID: %s, Error: %s", emailConfig.GetNotifierId(), err)
 	}
 	if !exists {
 		return errors.Wrapf(errox.NotFound, "Notifier with ID %s not found.", emailConfig.GetNotifierId())
 	}
+	if notifier.GetType() != notifiers.EmailType && notifier.GetType() != notifiers.ACSCSEmailType {
+		return errox.InvalidArgs.New("report configuration requires an email notifier")
+	}
 	return nil
 }
 
 func (v *Validator) validateResourceScope(config *apiV2.ReportConfiguration) error {
 	scope := config.GetResourceScope()
 	if scope == nil {
-		return errors.Wrap(errox.InvalidArgs, "Report configuration must specify a valid resource scope")
+		return errox.InvalidArgs.New("report configuration must specify a valid resource scope")
 	}
+
+	// Nodes are cluster-level resources without namespace hierarchy
+	if config.GetType() == apiV2.ReportConfiguration_NODE_VULNERABILITY {
+		return v.validateNodeResourceScope(scope)
+	}
+
 	switch ref := scope.GetScopeReference().(type) {
 	case *apiV2.ResourceScope_CollectionScope:
 		return v.validateCollectionScope(ref.CollectionScope)
 	case *apiV2.ResourceScope_EntityScope:
 		if !features.VulnerabilityReportsEnhancedFiltering.Enabled() {
-			return errors.Wrap(errox.InvalidArgs, "Report configuration must specify a valid collection as resource scope")
+			return errox.InvalidArgs.New("report configuration must specify a valid collection as resource scope")
 		}
 		return validateEntityScope(ref.EntityScope)
 	default:
-		return errors.Wrap(errox.InvalidArgs, "Report configuration must specify a valid resource scope")
+		return errox.InvalidArgs.New("report configuration must specify a valid resource scope")
 	}
 }
 
+func (v *Validator) validateNodeResourceScope(scope *apiV2.ResourceScope) error {
+	entityScope, ok := scope.GetScopeReference().(*apiV2.ResourceScope_EntityScope)
+	if !ok {
+		return errox.InvalidArgs.New("node vulnerability reports must use entity scope (cluster-based scoping only)")
+	}
+
+	if entityScope.EntityScope == nil {
+		return errox.InvalidArgs.New("entity scope cannot be nil")
+	}
+
+	if err := validateEntityScope(entityScope.EntityScope); err != nil {
+		return err
+	}
+
+	// Nodes exist at cluster scope only - unlike deployments, they have no namespace association
+	for _, rule := range entityScope.EntityScope.GetRules() {
+		if rule.GetEntity() != apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER {
+			return errox.InvalidArgs.Newf("node vulnerability reports only support cluster-level scoping, got: %s", rule.GetEntity())
+		}
+	}
+
+	return nil
+}
+
 func (v *Validator) validateCollectionScope(collectionRef *apiV2.CollectionReference) error {
 	if collectionRef == nil || collectionRef.GetCollectionId() == "" {
-		return errors.Wrap(errox.InvalidArgs, "Report configuration must specify a valid collection ID")
+		return errox.InvalidArgs.New("report configuration must specify a valid collection ID")
 	}
 	collectionID := collectionRef.GetCollectionId()
 	// Use allAccessCtx since report creator/updater might not have permissions for workflowAdministrationSAC
@@ -210,7 +251,7 @@ func (v *Validator) validateCollectionScope(collectionRef *apiV2.CollectionRefer
 // 5. a rule has no values, or a label rule contains values that are not in `key=value` format.
 func validateEntityScope(es *apiV2.EntityScope) error {
 	if es == nil {
-		return errors.Wrap(errox.InvalidArgs, "Report configuration must specify a valid resource scope: either a collection scope with a valid collection ID or a non-nil entity scope")
+		return errox.InvalidArgs.New("report configuration must specify a valid resource scope: either a collection scope with a valid collection ID or a non-nil entity scope")
 	}
 	type entityFieldKey struct {
 		entity apiV2.ScopeEntity
@@ -218,44 +259,59 @@ func validateEntityScope(es *apiV2.EntityScope) error {
 	}
 	seen := set.NewSet[entityFieldKey]()
 	for _, rule := range es.GetRules() {
-		if rule.GetEntity() == apiV2.ScopeEntity_SCOPE_ENTITY_UNSET {
-			return errors.Wrapf(errox.InvalidArgs, "Unexpected entity scope rule: %s", rule.GetEntity())
+		switch rule.GetEntity() {
+		case apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER, apiV2.ScopeEntity_SCOPE_ENTITY_NAMESPACE, apiV2.ScopeEntity_SCOPE_ENTITY_DEPLOYMENT:
+		default:
+			return errox.InvalidArgs.Newf("unexpected entity scope rule: %s", rule.GetEntity())
 		}
 		if rule.GetField() == apiV2.ScopeField_FIELD_UNSET {
-			return errors.Wrapf(errox.InvalidArgs, "Unexpected entity in scope rule for %s with an unset field", rule.GetEntity())
+			return errox.InvalidArgs.Newf("unexpected entity in scope rule for %s with an unset field", rule.GetEntity())
+		}
+		switch rule.GetField() {
+		case apiV2.ScopeField_FIELD_NAME, apiV2.ScopeField_FIELD_LABEL, apiV2.ScopeField_FIELD_ANNOTATION:
+		default:
+			return errox.InvalidArgs.Newf("unsupported field %s for entity scope", rule.GetField())
 		}
 		// Cluster annotation is not indexed and therefore unsupported.
 		if rule.GetEntity() == apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER && rule.GetField() == apiV2.ScopeField_FIELD_ANNOTATION {
-			return errors.Wrap(errox.InvalidArgs, "Annotation field is not supported for cluster entity scope rules")
+			return errox.InvalidArgs.New("annotation field is not supported for cluster entity scope rules")
 		}
 		key := entityFieldKey{entity: rule.GetEntity(), field: rule.GetField()}
 		if !seen.Add(key) {
-			return errors.Wrapf(errox.InvalidArgs,
-				"One rule per (entity, field) pair in entity scope rules is expected. Duplicate (entity, field) pair found: entity=%v field=%v. ", rule.GetEntity(), rule.GetField())
+			return errox.InvalidArgs.Newf(
+				"one rule per (entity, field) pair in entity scope rules is expected; duplicate (entity, field) pair found: entity=%v field=%v", rule.GetEntity(), rule.GetField())
 		}
 		if len(rule.GetValues()) == 0 {
-			return errors.Wrapf(errox.InvalidArgs,
+			return errox.InvalidArgs.Newf(
 				"provide at least one matching value for entity=%v field=%v rule", rule.GetEntity(), rule.GetField())
 		}
 		isMapField := rule.GetField() == apiV2.ScopeField_FIELD_LABEL || rule.GetField() == apiV2.ScopeField_FIELD_ANNOTATION
 		for _, rv := range rule.GetValues() {
 			valOfValue := rv.GetValue()
+			if valOfValue == "" {
+				return errox.InvalidArgs.New("entity scope rule values must not be empty")
+			}
+			if rv.GetMatchType() != apiV2.MatchType_EXACT && rv.GetMatchType() != apiV2.MatchType_REGEX {
+				return errox.InvalidArgs.Newf("unsupported match type %s", rv.GetMatchType())
+			}
 			if isMapField {
 				mapKey, mapValue, found := strings.Cut(valOfValue, "=")
 				if !found {
-					return errors.Wrapf(errox.InvalidArgs, "%v values must be in 'key=value' format", rule.GetField())
+					return errox.InvalidArgs.Newf("%v values must be in 'key=value' format", rule.GetField())
 				}
 				// Check the key for a Kubernetes qualified name.
 				if rv.GetMatchType() == apiV2.MatchType_EXACT {
 					if errs := k8sValidation.IsLabelKey(mapKey); len(errs) > 0 {
-						return errors.Wrapf(errox.InvalidArgs, "invalid %v key %q: %s", rule.GetField(), mapKey, strings.Join(errs, "; "))
+						return errox.InvalidArgs.Newf("invalid %v key %q: %s", rule.GetField(), mapKey, strings.Join(errs, "; "))
 					}
+				} else if _, err := regexp.Compile(mapKey); err != nil {
+					return errox.InvalidArgs.CausedByf("invalid regex key %q: %v", mapKey, err)
 				}
 				valOfValue = mapValue
 			}
 			if rv.GetMatchType() == apiV2.MatchType_REGEX {
 				if _, err := regexp.Compile(valOfValue); err != nil {
-					return errors.Wrapf(errox.InvalidArgs, "invalid regex %q: %v", valOfValue, err)
+					return errox.InvalidArgs.CausedByf("invalid regex %q: %v", valOfValue, err)
 				}
 			}
 		}
@@ -264,30 +320,85 @@ func validateEntityScope(es *apiV2.EntityScope) error {
 }
 
 func (v *Validator) validateReportFilters(config *apiV2.ReportConfiguration) error {
-	filters := config.GetVulnReportFilters()
+	switch config.GetType() {
+	case apiV2.ReportConfiguration_VULNERABILITY:
+		return v.validateImageFilters(config.GetVulnReportFilters())
+	case apiV2.ReportConfiguration_NODE_VULNERABILITY:
+		return v.validateNodeFilters(config.GetNodeVulnReportFilters())
+	default:
+		return errox.InvalidArgs.New("unsupported report type")
+	}
+}
+
+func (v *Validator) validateImageFilters(filters *apiV2.VulnerabilityReportFilters) error {
 	if filters == nil {
-		return errors.Wrap(errox.InvalidArgs, "Report configuration must include Vulnerability report filters")
+		return errox.InvalidArgs.New("report configuration must include vulnerability report filters")
 	}
 
 	if len(filters.GetImageTypes()) == 0 {
-		return errors.Wrap(errox.InvalidArgs, "Vulnerability report filters should specify which image types to scan for CVEs. "+
-			"The valid options are 'DEPLOYED' and 'WATCHED'.")
+		return errox.InvalidArgs.New("vulnerability report filters should specify which image types to scan for CVEs; " +
+			"the valid options are 'DEPLOYED' and 'WATCHED'")
+	}
+	for _, imageType := range filters.GetImageTypes() {
+		if _, ok := apiV2.VulnerabilityReportFilters_ImageType_name[int32(imageType)]; !ok {
+			return errox.InvalidArgs.Newf("unsupported image type %d", imageType)
+		}
+	}
+	if _, ok := apiV2.VulnerabilityReportFilters_Fixability_name[int32(filters.GetFixability())]; !ok {
+		return errox.InvalidArgs.Newf("unsupported fixability %d", filters.GetFixability())
+	}
+	for _, severity := range filters.GetSeverities() {
+		if _, ok := apiV2.VulnerabilityReportFilters_VulnerabilitySeverity_name[int32(severity)]; !ok {
+			return errox.InvalidArgs.Newf("unsupported severity %d", severity)
+		}
+	}
+	if since, ok := filters.GetCvesSince().(*apiV2.VulnerabilityReportFilters_SinceStartDate); ok {
+		if since.SinceStartDate == nil || since.SinceStartDate.CheckValid() != nil {
+			return errox.InvalidArgs.New("invalid CVE start date")
+		}
 	}
 
 	if filters.GetCvesSince() == nil {
-		return errors.Wrap(errox.InvalidArgs, "Vulnerability report filters must specify how far back in time to look for CVEs. "+
-			"The valid options are 'sinceLastSentScheduledReport', 'allVuln', and 'startDate'")
+		return errox.InvalidArgs.New("vulnerability report filters must specify how far back in time to look for CVEs; " +
+			"the valid options are 'sinceLastSentScheduledReport', 'allVuln', and 'startDate'")
 	}
 	if features.VulnerabilityReportsEnhancedFiltering.Enabled() {
 		if q := filters.GetQuery(); q != "" {
 			if _, err := search.ParseQuery(q); err != nil {
-				return errors.Wrapf(errox.InvalidArgs, "Invalid query in vulnerability report filters: %s", err)
+				return errox.InvalidArgs.CausedByf("invalid query in vulnerability report filters: %v", err)
 			}
 		}
 	}
 	return nil
 }
 
+func (v *Validator) validateNodeFilters(filters *apiV2.NodeVulnerabilityReportFilters) error {
+	if filters == nil {
+		return errox.InvalidArgs.New("node vulnerability report filters cannot be nil")
+	}
+
+	// TODO: Add support for since_last_sent_scheduled_report and since_start_date filters
+	// once FirstNodeOccurrence timestamp is available in the data model
+	if filters.GetCvesSince() == nil {
+		return errox.InvalidArgs.New("node vulnerability report filters must specify CVE time filter")
+	}
+
+	switch filters.GetCvesSince().(type) {
+	case *apiV2.NodeVulnerabilityReportFilters_AllVuln:
+		// Valid - this is the supported type
+	default:
+		return errox.InvalidArgs.New("only all vulnerabilities filter is currently supported for node reports (since_last_sent and since_start_date require FirstNodeOccurrence timestamp)")
+	}
+
+	if q := filters.GetQuery(); q != "" {
+		if _, err := search.ParseQuery(q); err != nil {
+			return errox.InvalidArgs.CausedByf("invalid query in node vulnerability report filters: %v", err)
+		}
+	}
+
+	return nil
+}
+
 // ValidateAndGenerateReportRequest validates the report configuration for which report is requested and generates a report request
 func (v *Validator) ValidateAndGenerateReportRequest(
 	configID string,
@@ -295,6 +406,9 @@ func (v *Validator) ValidateAndGenerateReportRequest(
 	requestType storage.ReportStatus_RunMethod,
 	requesterID authn.Identity,
 ) (*reportGen.ReportRequest, error) {
+	if notificationMethod != storage.ReportStatus_EMAIL && notificationMethod != storage.ReportStatus_DOWNLOAD {
+		return nil, errox.InvalidArgs.Newf("unsupported notification method %d", notificationMethod)
+	}
 	config, found, err := v.reportConfigDatastore.GetReportConfiguration(allAccessCtx, configID)
 	if err != nil {
 		return nil, errors.Wrapf(err, "Error finding report configuration %s", configID)
@@ -304,14 +418,14 @@ func (v *Validator) ValidateAndGenerateReportRequest(
 	}
 	// Verify ResourceScope is non-nil
 	if !common.HasValidResourceScope(config.GetResourceScope()) {
-		return nil, errors.Wrapf(errox.InvalidArgs,
-			"Report configuration '%s' has an empty resource scope (no collection ID or entity scope)",
+		return nil, errox.InvalidArgs.Newf(
+			"report configuration '%s' has an empty resource scope (no collection ID or entity scope)",
 			configID)
 	}
 
 	if notificationMethod == storage.ReportStatus_EMAIL && len(config.GetNotifiers()) == 0 {
-		return nil, errors.Wrap(errox.InvalidArgs,
-			"Email request sent for a report configuration that does not have any email notifiers configured")
+		return nil, errox.InvalidArgs.New(
+			"email request sent for a report configuration that does not have any email notifiers configured")
 	}
 
 	var collection *storage.ResourceCollection
@@ -354,6 +468,9 @@ func (v *Validator) ValidateCancelReportRequest(reportID string, requester *stor
 	if !found {
 		return errors.Wrapf(errox.NotFound, "Report snapshot with job ID '%s' does not exist", reportID)
 	}
+	if snapshot.GetType() == storage.ReportSnapshot_NODE_VULNERABILITY {
+		return errox.InvalidArgs.Newf("report job '%s' is a node vulnerability report; use the node report service", reportID)
+	}
 
 	switch snapshot.GetReportStatus().GetRunState() {
 	case storage.ReportStatus_WAITING, storage.ReportStatus_PREPARING:
@@ -367,6 +484,79 @@ func (v *Validator) ValidateCancelReportRequest(reportID string, requester *stor
 	return nil
 }
 
+// PersistReportSnapshot validates that the user does not already have a pending
+// report for the same config, sets the snapshot to WAITING, and persists it to
+// the database. Returns the report ID.
+func (v *Validator) PersistReportSnapshot(ctx context.Context, snapshot *storage.ReportSnapshot) (string, error) {
+	reportType := snapshot.GetType()
+	requestType := snapshot.GetReportStatus().GetReportRequestType()
+
+	if requestType == storage.ReportStatus_ON_DEMAND {
+		hasPending, err := v.doesUserHavePendingReport(snapshot.GetReportConfigurationId(), snapshot.GetRequester().GetId(), reportType)
+		if err != nil {
+			return "", err
+		}
+		if hasPending {
+			return "", errors.Wrapf(errox.AlreadyExists, "User already has a report running for config ID '%s'",
+				snapshot.GetReportConfigurationId())
+		}
+	}
+
+	if requestType == storage.ReportStatus_VIEW_BASED {
+		hasPending, err := v.doesUserHaveViewBasedPendingReport(snapshot.GetRequester().GetId(), reportType)
+		if err != nil {
+			return "", err
+		}
+		if hasPending {
+			return "", errors.New("User already has a view based report queued")
+		}
+		// View-based reports are authorized at the gRPC layer with only view permissions.
+		// The snapshot datastore requires WorkflowAdministration write.
+		ctx = sac.WithAllAccess(ctx)
+	}
+
+	snapshot.ReportStatus.RunState = storage.ReportStatus_WAITING
+	snapshot.ReportStatus.QueuedAt = protocompat.TimestampNow()
+	reportID, err := v.snapshotDatastore.AddReportSnapshot(ctx, snapshot)
+	if err != nil {
+		return "", err
+	}
+	return reportID, nil
+}
+
+func (v *Validator) doesUserHavePendingReport(configID string, userID string, reportType storage.ReportSnapshot_ReportType) (bool, error) {
+	query := search.NewQueryBuilder().
+		AddExactMatches(search.ReportConfigID, configID).
+		AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).
+		AddExactMatches(search.ReportRequestType, storage.ReportStatus_ON_DEMAND.String()).
+		AddExactMatches(search.ReportType, reportType.String()).
+		ProtoQuery()
+	snapshots, err := v.snapshotDatastore.SearchReportSnapshots(allAccessCtx, query)
+	if err != nil {
+		return false, err
+	}
+	for _, snap := range snapshots {
+		if snap.GetRequester().GetId() == userID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (v *Validator) doesUserHaveViewBasedPendingReport(userID string, reportType storage.ReportSnapshot_ReportType) (bool, error) {
+	query := search.NewQueryBuilder().
+		AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String(), storage.ReportStatus_PREPARING.String()).
+		AddExactMatches(search.ReportRequestType, storage.ReportStatus_VIEW_BASED.String()).
+		AddExactMatches(search.UserID, userID).
+		AddExactMatches(search.ReportType, reportType.String()).
+		ProtoQuery()
+	count, err := v.snapshotDatastore.Count(allAccessCtx, query)
+	if err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}
+
 func collectionSnapshot(collection *storage.ResourceCollection) *storage.CollectionSnapshot {
 	if collection == nil {
 		return nil
@@ -385,13 +575,33 @@ func generateReportSnapshot(
 	requestType storage.ReportStatus_RunMethod,
 	requesterID authn.Identity,
 ) *storage.ReportSnapshot {
+	var requester *storage.SlimUser
+	switch requestType {
+	case storage.ReportStatus_ON_DEMAND:
+		requester = &storage.SlimUser{
+			Id:   requesterID.UID(),
+			Name: stringutils.FirstNonEmpty(requesterID.FullName(), requesterID.FriendlyName()),
+		}
+	case storage.ReportStatus_SCHEDULED:
+		requester = config.GetCreator()
+	}
+
+	var snapshotType storage.ReportSnapshot_ReportType
+	switch config.GetType() {
+	case storage.ReportConfiguration_VULNERABILITY:
+		snapshotType = storage.ReportSnapshot_VULNERABILITY
+	case storage.ReportConfiguration_NODE_VULNERABILITY:
+		snapshotType = storage.ReportSnapshot_NODE_VULNERABILITY
+	}
+
 	snapshot := &storage.ReportSnapshot{
 		ReportConfigurationId: config.GetId(),
 		Name:                  config.GetName(),
 		Description:           config.GetDescription(),
-		Type:                  storage.ReportSnapshot_VULNERABILITY,
+		Type:                  snapshotType,
 		Collection:            collectionSnapshot(collection),
 		Schedule:              config.GetSchedule(),
+		Requester:             requester,
 		ReportStatus: &storage.ReportStatus{
 			RunState:                 storage.ReportStatus_WAITING,
 			ReportRequestType:        requestType,
@@ -399,25 +609,33 @@ func generateReportSnapshot(
 		},
 	}
 
-	if features.VulnerabilityReportsEnhancedFiltering.Enabled() {
+	if features.VulnerabilityReportsEnhancedFiltering.Enabled() || config.GetType() == storage.ReportConfiguration_NODE_VULNERABILITY {
 		snapshot.ResourceScope = config.GetResourceScope().CloneVT()
 	}
 
-	reportFilters := config.GetVulnReportFilters().CloneVT()
-	var requester *storage.SlimUser
-	switch requestType {
-	case storage.ReportStatus_ON_DEMAND:
-		reportFilters.AccessScopeRules = common.ExtractAccessScopeRules(requesterID)
-		requester = &storage.SlimUser{
-			Id:   requesterID.UID(),
-			Name: stringutils.FirstNonEmpty(requesterID.FullName(), requesterID.FriendlyName()),
+	switch config.GetType() {
+	case storage.ReportConfiguration_VULNERABILITY:
+		reportFilters := config.GetVulnReportFilters()
+		if reportFilters != nil {
+			reportFilters = reportFilters.CloneVT()
+			if requestType == storage.ReportStatus_ON_DEMAND {
+				reportFilters.AccessScopeRules = common.ExtractAccessScopeRules(requesterID)
+			}
+			snapshot.Filter = &storage.ReportSnapshot_VulnReportFilters{
+				VulnReportFilters: reportFilters,
+			}
+		}
+	case storage.ReportConfiguration_NODE_VULNERABILITY:
+		nodeFilters := config.GetNodeVulnReportFilters()
+		if nodeFilters != nil {
+			nodeFilters = nodeFilters.CloneVT()
+			if requestType == storage.ReportStatus_ON_DEMAND {
+				nodeFilters.AccessScopeRules = common.ExtractAccessScopeRules(requesterID)
+			}
+			snapshot.Filter = &storage.ReportSnapshot_NodeVulnReportFilters{
+				NodeVulnReportFilters: nodeFilters,
+			}
 		}
-	case storage.ReportStatus_SCHEDULED:
-		requester = config.GetCreator()
-	}
-	snapshot.Requester = requester
-	snapshot.Filter = &storage.ReportSnapshot_VulnReportFilters{
-		VulnReportFilters: reportFilters,
 	}
 
 	notifierSnaps := make([]*storage.NotifierSnapshot, 0, len(config.GetNotifiers()))
@@ -473,44 +691,97 @@ func (v *Validator) ValidateAndGenerateViewBasedReportRequest(
 	requesterID authn.Identity,
 ) (*reportGen.ReportRequest, error) {
 	if req == nil {
-		return nil, errors.Wrap(errox.InvalidArgs, "Empty request")
-	}
-
-	// Currently only vulnerability view-based reports are supported.
-	if req.GetType() != apiV2.ReportRequestViewBased_VULNERABILITY {
-		return nil, errors.Wrap(errox.InvalidArgs, "unsupported report type")
-	}
-
-	// Validate filters.
-	vbFilters := req.GetViewBasedVulnReportFilters()
-	if vbFilters == nil {
-		return nil, errors.Wrap(errox.InvalidArgs, "view-based vulnerability report filters must be provided")
+		return nil, errox.InvalidArgs.New("empty request")
 	}
 
-	// Convert API filters to storage filters.
-	storageFilters := &storage.ViewBasedVulnerabilityReportFilters{
-		Query:            vbFilters.GetQuery(),
-		AccessScopeRules: common.ExtractAccessScopeRules(requesterID),
-	}
 	requester := &storage.SlimUser{
 		Id:   requesterID.UID(),
 		Name: stringutils.FirstNonEmpty(requesterID.FullName(), requesterID.FriendlyName()),
 	}
 
-	// Build report snapshot.
-	snapshot := &storage.ReportSnapshot{
-		Name:          generateViewBasedRequestName(requester),
-		Type:          storage.ReportSnapshot_VULNERABILITY,
-		AreaOfConcern: req.GetAreaOfConcern(),
-		ReportStatus: &storage.ReportStatus{
-			RunState:                 storage.ReportStatus_WAITING,
-			ReportRequestType:        storage.ReportStatus_VIEW_BASED,
-			ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
-		},
-		Filter: &storage.ReportSnapshot_ViewBasedVulnReportFilters{
-			ViewBasedVulnReportFilters: storageFilters,
-		},
-		Requester: requester,
+	var snapshot *storage.ReportSnapshot
+
+	switch req.GetType() {
+	case apiV2.ReportRequestViewBased_VULNERABILITY:
+		// Validate filters.
+		vbFilters := req.GetViewBasedVulnReportFilters()
+		if vbFilters == nil {
+			return nil, errox.InvalidArgs.New("view-based vulnerability report filters must be provided")
+		}
+
+		// Convert API filters to storage filters.
+		storageFilters := &storage.ViewBasedVulnerabilityReportFilters{
+			Query:            vbFilters.GetQuery(),
+			AccessScopeRules: common.ExtractAccessScopeRules(requesterID),
+		}
+
+		// Build report snapshot.
+		snapshot = &storage.ReportSnapshot{
+			Name:          generateViewBasedRequestName(requester),
+			Type:          storage.ReportSnapshot_VULNERABILITY,
+			AreaOfConcern: req.GetAreaOfConcern(),
+			ReportStatus: &storage.ReportStatus{
+				RunState:                 storage.ReportStatus_WAITING,
+				ReportRequestType:        storage.ReportStatus_VIEW_BASED,
+				ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+			},
+			Filter: &storage.ReportSnapshot_ViewBasedVulnReportFilters{
+				ViewBasedVulnReportFilters: storageFilters,
+			},
+			Requester: requester,
+		}
+
+	case apiV2.ReportRequestViewBased_NODE_VULNERABILITY:
+		// Validate filters.
+		nodeFilters := req.GetNodeVulnReportFilters()
+		if nodeFilters == nil {
+			return nil, errox.InvalidArgs.New("node vulnerability report filters must be provided")
+		}
+
+		// Node vulnerability view based reports should default to allVuln in CVEs since time filter if not provided.
+		if nodeFilters.GetCvesSince() == nil {
+			nodeFilters.CvesSince = &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+				AllVuln: true,
+			}
+		}
+
+		if err := v.validateNodeFilters(nodeFilters); err != nil {
+			return nil, err
+		}
+
+		// Convert API filters to storage filters.
+		storageFilters := &storage.NodeVulnerabilityReportFilters{
+			Query:            nodeFilters.GetQuery(),
+			AccessScopeRules: common.ExtractAccessScopeRules(requesterID),
+		}
+
+		switch nodeFilters.GetCvesSince().(type) {
+		case *apiV2.NodeVulnerabilityReportFilters_AllVuln:
+			storageFilters.CvesSince = &storage.NodeVulnerabilityReportFilters_AllVuln{
+				AllVuln: nodeFilters.GetAllVuln(),
+			}
+		default:
+			return nil, errox.InvalidArgs.New("unsupported CVE time filter for node vulnerability reports")
+		}
+
+		// Build report snapshot.
+		snapshot = &storage.ReportSnapshot{
+			Name:          generateViewBasedRequestName(requester),
+			Type:          storage.ReportSnapshot_NODE_VULNERABILITY,
+			AreaOfConcern: req.GetAreaOfConcern(),
+			ReportStatus: &storage.ReportStatus{
+				RunState:                 storage.ReportStatus_WAITING,
+				ReportRequestType:        storage.ReportStatus_VIEW_BASED,
+				ReportNotificationMethod: storage.ReportStatus_DOWNLOAD,
+			},
+			Filter: &storage.ReportSnapshot_NodeVulnReportFilters{
+				NodeVulnReportFilters: storageFilters,
+			},
+			Requester: requester,
+		}
+
+	default:
+		return nil, errox.InvalidArgs.New("unsupported report type")
 	}
 
 	return &reportGen.ReportRequest{
diff --git a/central/reports/validation/validate_comprehensive_test.go b/central/reports/validation/validate_comprehensive_test.go
new file mode 100644
index 0000000000000..809b8c9a66be6
--- /dev/null
+++ b/central/reports/validation/validate_comprehensive_test.go
@@ -0,0 +1,861 @@
+package validation
+
+import (
+	"context"
+	"testing"
+
+	notifierDSMocks "github.com/stackrox/rox/central/notifier/datastore/mocks"
+	reportConfigDSMocks "github.com/stackrox/rox/central/reports/config/datastore/mocks"
+	snapshotDSMocks "github.com/stackrox/rox/central/reports/snapshot/datastore/mocks"
+	collectionDSMocks "github.com/stackrox/rox/central/resourcecollection/datastore/mocks"
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
+	authnMocks "github.com/stackrox/rox/pkg/grpc/authn/mocks"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/resources"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestValidateReportConfiguration(t *testing.T) {
+	t.Setenv(features.VulnerabilityReportsEnhancedFiltering.EnvVar(), "true")
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	tests := map[string]struct {
+		config      *apiV2.ReportConfiguration
+		setupMocks  func()
+		expectError bool
+		errContains string
+	}{
+		"empty name fails": {
+			config: &apiV2.ReportConfiguration{
+				Name: "",
+			},
+			setupMocks:  func() {},
+			expectError: true,
+			errContains: "name is empty",
+		},
+		"scheduled report without notifiers fails": {
+			config: &apiV2.ReportConfiguration{
+				Name: "Test Report",
+				Schedule: &apiV2.ReportSchedule{
+					IntervalType: apiV2.ReportSchedule_DAILY,
+					Hour:         9,
+					Minute:       0,
+				},
+			},
+			setupMocks:  func() {},
+			expectError: true,
+			errContains: "must specify a notifier",
+		},
+		"missing resource scope fails": {
+			config: &apiV2.ReportConfiguration{
+				Name: "Test Report",
+			},
+			setupMocks:  func() {},
+			expectError: true,
+			errContains: "must specify a valid resource scope",
+		},
+		"valid node report with entity scope": {
+			config: &apiV2.ReportConfiguration{
+				Name: "Node Report",
+				Type: apiV2.ReportConfiguration_NODE_VULNERABILITY,
+				ResourceScope: &apiV2.ResourceScope{
+					ScopeReference: &apiV2.ResourceScope_EntityScope{
+						EntityScope: &apiV2.EntityScope{
+							Rules: []*apiV2.EntityScopeRule{
+								{
+									Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+									Field:  apiV2.ScopeField_FIELD_NAME,
+									Values: []*apiV2.RuleValue{
+										{Value: "prod", MatchType: apiV2.MatchType_EXACT},
+									},
+								},
+							},
+						},
+					},
+				},
+				Filter: &apiV2.ReportConfiguration_NodeVulnReportFilters{
+					NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+						CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+							AllVuln: true,
+						},
+					},
+				},
+			},
+			setupMocks:  func() {},
+			expectError: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			tc.setupMocks()
+			err := validator.ValidateReportConfiguration(tc.config)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateNotifiers(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	tests := map[string]struct {
+		config      *apiV2.ReportConfiguration
+		setupMocks  func()
+		expectError bool
+		errContains string
+	}{
+		"no notifiers without schedule is valid": {
+			config: &apiV2.ReportConfiguration{
+				Notifiers: nil,
+				Schedule:  nil,
+			},
+			setupMocks:  func() {},
+			expectError: false,
+		},
+		"notifier without email config fails": {
+			config: &apiV2.ReportConfiguration{
+				Notifiers: []*apiV2.NotifierConfiguration{
+					{},
+				},
+			},
+			setupMocks:  func() {},
+			expectError: true,
+			errContains: "must specify an email notifier configuration",
+		},
+		"valid notifier": {
+			config: &apiV2.ReportConfiguration{
+				Notifiers: []*apiV2.NotifierConfiguration{
+					{
+						NotifierConfig: &apiV2.NotifierConfiguration_EmailConfig{
+							EmailConfig: &apiV2.EmailNotifierConfiguration{
+								NotifierId:   "notifier-1",
+								MailingLists: []string{"user@example.com"},
+							},
+						},
+					},
+				},
+			},
+			setupMocks: func() {
+				notifierDS.EXPECT().GetScrubbedNotifier(gomock.Any(), "notifier-1").Return(&storage.Notifier{Type: "email"}, true, nil)
+			},
+			expectError: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			tc.setupMocks()
+			err := validator.validateNotifiers(tc.config)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateEmailConfig(t *testing.T) {
+	tests := map[string]struct {
+		emailConfig *apiV2.EmailNotifierConfiguration
+		setupMocks  func(*notifierDSMocks.MockDataStore)
+		expectError bool
+		errContains string
+	}{
+		"empty notifier ID fails": {
+			emailConfig: &apiV2.EmailNotifierConfiguration{
+				NotifierId:   "",
+				MailingLists: []string{"user@example.com"},
+			},
+			setupMocks:  func(notifierDS *notifierDSMocks.MockDataStore) {},
+			expectError: true,
+			errContains: "must specify a valid email notifier",
+		},
+		"empty mailing list fails": {
+			emailConfig: &apiV2.EmailNotifierConfiguration{
+				NotifierId:   "notifier-1",
+				MailingLists: []string{},
+			},
+			setupMocks:  func(notifierDS *notifierDSMocks.MockDataStore) {},
+			expectError: true,
+			errContains: "must specify at least one email recipient",
+		},
+		"invalid email address fails": {
+			emailConfig: &apiV2.EmailNotifierConfiguration{
+				NotifierId:   "notifier-1",
+				MailingLists: []string{"invalid-email"},
+			},
+			setupMocks:  func(notifierDS *notifierDSMocks.MockDataStore) {},
+			expectError: true,
+			errContains: "invalid email recipient address",
+		},
+		"notifier not found fails": {
+			emailConfig: &apiV2.EmailNotifierConfiguration{
+				NotifierId:   "missing-notifier",
+				MailingLists: []string{"user@example.com"},
+			},
+			setupMocks: func(notifierDS *notifierDSMocks.MockDataStore) {
+				notifierDS.EXPECT().GetScrubbedNotifier(gomock.Any(), "missing-notifier").Return(nil, false, nil)
+			},
+			expectError: true,
+			errContains: "not found",
+		},
+		"valid email config": {
+			emailConfig: &apiV2.EmailNotifierConfiguration{
+				NotifierId:    "notifier-1",
+				MailingLists:  []string{"user@example.com", "admin@example.com"},
+				CustomSubject: "Test Report",
+				CustomBody:    "Report body",
+			},
+			setupMocks: func(notifierDS *notifierDSMocks.MockDataStore) {
+				notifierDS.EXPECT().GetScrubbedNotifier(gomock.Any(), "notifier-1").Return(&storage.Notifier{Type: "email"}, true, nil)
+			},
+			expectError: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			// Create fresh mocks for each subtest to avoid mock conflicts
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
+
+			notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+			collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+			reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+			snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+			validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+			tc.setupMocks(notifierDS)
+			err := validator.validateEmailConfig(tc.emailConfig)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateNodeResourceScope(t *testing.T) {
+	t.Setenv(features.VulnerabilityReportsEnhancedFiltering.EnvVar(), "true")
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	tests := map[string]struct {
+		scope       *apiV2.ResourceScope
+		expectError bool
+		errContains string
+	}{
+		"collection scope not allowed for nodes": {
+			scope: &apiV2.ResourceScope{
+				ScopeReference: &apiV2.ResourceScope_CollectionScope{
+					CollectionScope: &apiV2.CollectionReference{
+						CollectionId: "collection-1",
+					},
+				},
+			},
+			expectError: true,
+			errContains: "must use entity scope",
+		},
+		"nil entity scope fails": {
+			scope: &apiV2.ResourceScope{
+				ScopeReference: &apiV2.ResourceScope_EntityScope{
+					EntityScope: nil,
+				},
+			},
+			expectError: true,
+			errContains: "cannot be nil",
+		},
+		"namespace scope not allowed for nodes": {
+			scope: &apiV2.ResourceScope{
+				ScopeReference: &apiV2.ResourceScope_EntityScope{
+					EntityScope: &apiV2.EntityScope{
+						Rules: []*apiV2.EntityScopeRule{
+							{
+								Entity: apiV2.ScopeEntity_SCOPE_ENTITY_NAMESPACE,
+								Field:  apiV2.ScopeField_FIELD_NAME,
+								Values: []*apiV2.RuleValue{
+									{Value: "default", MatchType: apiV2.MatchType_EXACT},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectError: true,
+			errContains: "only support cluster-level scoping",
+		},
+		"valid cluster scope": {
+			scope: &apiV2.ResourceScope{
+				ScopeReference: &apiV2.ResourceScope_EntityScope{
+					EntityScope: &apiV2.EntityScope{
+						Rules: []*apiV2.EntityScopeRule{
+							{
+								Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+								Field:  apiV2.ScopeField_FIELD_NAME,
+								Values: []*apiV2.RuleValue{
+									{Value: "prod", MatchType: apiV2.MatchType_EXACT},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectError: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			err := validator.validateNodeResourceScope(tc.scope)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateCollectionScope(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	tests := map[string]struct {
+		collectionRef *apiV2.CollectionReference
+		setupMocks    func()
+		expectError   bool
+		errContains   string
+	}{
+		"nil collection reference fails": {
+			collectionRef: nil,
+			setupMocks:    func() {},
+			expectError:   true,
+			errContains:   "must specify a valid collection ID",
+		},
+		"empty collection ID fails": {
+			collectionRef: &apiV2.CollectionReference{
+				CollectionId: "",
+			},
+			setupMocks:  func() {},
+			expectError: true,
+			errContains: "must specify a valid collection ID",
+		},
+		"collection not found fails": {
+			collectionRef: &apiV2.CollectionReference{
+				CollectionId: "missing-collection",
+			},
+			setupMocks: func() {
+				collectionDS.EXPECT().Exists(gomock.Any(), "missing-collection").Return(false, nil)
+			},
+			expectError: true,
+			errContains: "not found",
+		},
+		"valid collection": {
+			collectionRef: &apiV2.CollectionReference{
+				CollectionId: "collection-1",
+			},
+			setupMocks: func() {
+				collectionDS.EXPECT().Exists(gomock.Any(), "collection-1").Return(true, nil)
+			},
+			expectError: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			tc.setupMocks()
+			err := validator.validateCollectionScope(tc.collectionRef)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateNodeFilters(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	tests := map[string]struct {
+		filters     *apiV2.NodeVulnerabilityReportFilters
+		expectError bool
+		errContains string
+	}{
+		"nil filters fail": {
+			filters:     nil,
+			expectError: true,
+			errContains: "cannot be nil",
+		},
+		"missing CVE time filter fails": {
+			filters: &apiV2.NodeVulnerabilityReportFilters{
+				CvesSince: nil,
+			},
+			expectError: true,
+			errContains: "must specify CVE time filter",
+		},
+		"valid all vulnerabilities filter": {
+			filters: &apiV2.NodeVulnerabilityReportFilters{
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+			},
+			expectError: false,
+		},
+		"valid filter with query": {
+			filters: &apiV2.NodeVulnerabilityReportFilters{
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+				Query: "Cluster:prod",
+			},
+			expectError: false,
+		},
+		"invalid query fails": {
+			filters: &apiV2.NodeVulnerabilityReportFilters{
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+					AllVuln: true,
+				},
+				Query: "invalid query syntax [",
+			},
+			expectError: true,
+			errContains: "invalid query",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			err := validator.validateNodeFilters(tc.filters)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateResourceScope(t *testing.T) {
+	t.Setenv(features.VulnerabilityReportsEnhancedFiltering.EnvVar(), "true")
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	tests := map[string]struct {
+		config      *apiV2.ReportConfiguration
+		setupMocks  func()
+		expectError bool
+		errContains string
+	}{
+		"nil scope fails": {
+			config: &apiV2.ReportConfiguration{
+				Type:          apiV2.ReportConfiguration_VULNERABILITY,
+				ResourceScope: nil,
+			},
+			setupMocks:  func() {},
+			expectError: true,
+			errContains: "must specify a valid resource scope",
+		},
+		"valid collection scope for vulnerability report": {
+			config: &apiV2.ReportConfiguration{
+				Type: apiV2.ReportConfiguration_VULNERABILITY,
+				ResourceScope: &apiV2.ResourceScope{
+					ScopeReference: &apiV2.ResourceScope_CollectionScope{
+						CollectionScope: &apiV2.CollectionReference{
+							CollectionId: "collection-1",
+						},
+					},
+				},
+			},
+			setupMocks: func() {
+				collectionDS.EXPECT().Exists(gomock.Any(), "collection-1").Return(true, nil)
+			},
+			expectError: false,
+		},
+		"valid entity scope for vulnerability report": {
+			config: &apiV2.ReportConfiguration{
+				Type: apiV2.ReportConfiguration_VULNERABILITY,
+				ResourceScope: &apiV2.ResourceScope{
+					ScopeReference: &apiV2.ResourceScope_EntityScope{
+						EntityScope: &apiV2.EntityScope{
+							Rules: []*apiV2.EntityScopeRule{
+								{
+									Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+									Field:  apiV2.ScopeField_FIELD_NAME,
+									Values: []*apiV2.RuleValue{
+										{Value: "prod", MatchType: apiV2.MatchType_EXACT},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			setupMocks:  func() {},
+			expectError: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			tc.setupMocks()
+			err := validator.validateResourceScope(tc.config)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateCancelReportRequest(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	tests := map[string]struct {
+		reportID    string
+		setupMocks  func()
+		expectError bool
+		errContains string
+	}{
+		"snapshot not found": {
+			reportID: "missing-report",
+			setupMocks: func() {
+				snapshotDS.EXPECT().Get(gomock.Any(), "missing-report").Return(nil, false, nil)
+			},
+			expectError: true,
+			errContains: "not found",
+		},
+		"node vulnerability snapshot is rejected": {
+			reportID: "node-job",
+			setupMocks: func() {
+				snapshotDS.EXPECT().Get(gomock.Any(), "node-job").Return(&storage.ReportSnapshot{
+					ReportId: "node-job",
+					Type:     storage.ReportSnapshot_NODE_VULNERABILITY,
+					ReportStatus: &storage.ReportStatus{
+						RunState: storage.ReportStatus_WAITING,
+					},
+					Requester: &storage.SlimUser{Id: "user-1"},
+				}, true, nil)
+			},
+			expectError: true,
+			errContains: "node report service",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			tc.setupMocks()
+			requester := &storage.SlimUser{
+				Id:   "user-1",
+				Name: "Test User",
+			}
+			err := validator.ValidateCancelReportRequest(tc.reportID, requester)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestPersistReportSnapshot_NodeOnDemandPending(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+	validator := New(reportConfigDSMocks.NewMockDataStore(ctrl), snapshotDS, collectionDSMocks.NewMockDataStore(ctrl), notifierDSMocks.NewMockDataStore(ctrl))
+
+	pending := &storage.ReportSnapshot{
+		ReportConfigurationId: "cfg",
+		Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+		Requester:             &storage.SlimUser{Id: "u1"},
+	}
+	snapshotDS.EXPECT().SearchReportSnapshots(gomock.Any(), gomock.Any()).Return([]*storage.ReportSnapshot{pending}, nil)
+
+	_, err := validator.PersistReportSnapshot(t.Context(), nodeOnDemandSnapshot("cfg", "u1"))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "already has a report running")
+}
+
+func TestPersistReportSnapshot_NodeViewBasedPending(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+	validator := New(reportConfigDSMocks.NewMockDataStore(ctrl), snapshotDS, collectionDSMocks.NewMockDataStore(ctrl), notifierDSMocks.NewMockDataStore(ctrl))
+
+	snapshotDS.EXPECT().Count(gomock.Any(), gomock.Any()).Return(1, nil)
+
+	_, err := validator.PersistReportSnapshot(t.Context(), nodeViewBasedSnapshot("u1"))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "view based report queued")
+}
+
+func TestPersistReportSnapshot_NodeViewBasedElevatesSAC(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+	validator := New(reportConfigDSMocks.NewMockDataStore(ctrl), snapshotDS, collectionDSMocks.NewMockDataStore(ctrl), notifierDSMocks.NewMockDataStore(ctrl))
+
+	snapshotDS.EXPECT().Count(gomock.Any(), gomock.Any()).Return(0, nil)
+	snapshotDS.EXPECT().AddReportSnapshot(gomock.Any(), gomock.Any()).DoAndReturn(
+		func(ctx context.Context, _ *storage.ReportSnapshot) (string, error) {
+			ok, err := sac.ForResource(resources.WorkflowAdministration).WriteAllowed(ctx)
+			require.NoError(t, err)
+			assert.True(t, ok)
+			return "report-id", nil
+		})
+
+	id, err := validator.PersistReportSnapshot(sac.WithNoAccess(t.Context()), nodeViewBasedSnapshot("u1"))
+	require.NoError(t, err)
+	assert.Equal(t, "report-id", id)
+}
+
+func nodeOnDemandSnapshot(configID, userID string) *storage.ReportSnapshot {
+	return &storage.ReportSnapshot{
+		ReportConfigurationId: configID,
+		Type:                  storage.ReportSnapshot_NODE_VULNERABILITY,
+		Requester:             &storage.SlimUser{Id: userID},
+		Filter: &storage.ReportSnapshot_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query: "Cluster:c1",
+			},
+		},
+		ReportStatus: &storage.ReportStatus{
+			ReportRequestType: storage.ReportStatus_ON_DEMAND,
+		},
+	}
+}
+
+func nodeViewBasedSnapshot(userID string) *storage.ReportSnapshot {
+	return &storage.ReportSnapshot{
+		Type:      storage.ReportSnapshot_NODE_VULNERABILITY,
+		Requester: &storage.SlimUser{Id: userID},
+		Filter: &storage.ReportSnapshot_NodeVulnReportFilters{
+			NodeVulnReportFilters: &storage.NodeVulnerabilityReportFilters{
+				Query: "Cluster:c1",
+			},
+		},
+		ReportStatus: &storage.ReportStatus{
+			ReportRequestType: storage.ReportStatus_VIEW_BASED,
+		},
+	}
+}
+
+func TestValidateAndGenerateViewBasedReportRequest(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	notifierDS := notifierDSMocks.NewMockDataStore(ctrl)
+	collectionDS := collectionDSMocks.NewMockDataStore(ctrl)
+	reportConfigDS := reportConfigDSMocks.NewMockDataStore(ctrl)
+	snapshotDS := snapshotDSMocks.NewMockDataStore(ctrl)
+
+	validator := New(reportConfigDS, snapshotDS, collectionDS, notifierDS)
+
+	identity := authnMocks.NewMockIdentity(ctrl)
+	identity.EXPECT().UID().Return("user-1").AnyTimes()
+	identity.EXPECT().FullName().Return("John Doe").AnyTimes()
+	identity.EXPECT().FriendlyName().Return("jdoe").AnyTimes()
+	identity.EXPECT().Roles().Return(nil).AnyTimes()
+
+	tests := map[string]struct {
+		req         *apiV2.ReportRequestViewBased
+		expectError bool
+		errContains string
+		// verify runs on the generated snapshot when no error is expected.
+		verify func(t *testing.T, snapshot *storage.ReportSnapshot)
+	}{
+		"nil request fails": {
+			req:         nil,
+			expectError: true,
+			errContains: "empty request",
+		},
+		"unsupported report type fails": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_ReportType(-1),
+			},
+			expectError: true,
+			errContains: "unsupported report type",
+		},
+		"vulnerability report without filters fails": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_VULNERABILITY,
+			},
+			expectError: true,
+			errContains: "view-based vulnerability report filters must be provided",
+		},
+		"vulnerability report with filters succeeds": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_VULNERABILITY,
+				Filter: &apiV2.ReportRequestViewBased_ViewBasedVulnReportFilters{
+					ViewBasedVulnReportFilters: &apiV2.ViewBasedVulnerabilityReportFilters{
+						Query: "Cluster:prod",
+					},
+				},
+				AreaOfConcern: "User Workloads",
+			},
+			verify: func(t *testing.T, snapshot *storage.ReportSnapshot) {
+				assert.Equal(t, storage.ReportSnapshot_VULNERABILITY, snapshot.GetType())
+				assert.Equal(t, "User Workloads", snapshot.GetAreaOfConcern())
+				assert.Equal(t, "Cluster:prod", snapshot.GetViewBasedVulnReportFilters().GetQuery())
+			},
+		},
+		"node report without filters fails": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+			},
+			expectError: true,
+			errContains: "node vulnerability report filters must be provided",
+		},
+		"node report without CVE time filter defaults to all vulnerabilities": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+				Filter: &apiV2.ReportRequestViewBased_NodeVulnReportFilters{
+					NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+						Query: "Cluster:prod",
+					},
+				},
+			},
+			verify: func(t *testing.T, snapshot *storage.ReportSnapshot) {
+				filters := snapshot.GetNodeVulnReportFilters()
+				assert.Equal(t, "Cluster:prod", filters.GetQuery())
+				assert.True(t, filters.GetAllVuln())
+			},
+		},
+		"node report with explicit all vulnerabilities filter is preserved": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+				Filter: &apiV2.ReportRequestViewBased_NodeVulnReportFilters{
+					NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+						CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+							AllVuln: true,
+						},
+					},
+				},
+			},
+			verify: func(t *testing.T, snapshot *storage.ReportSnapshot) {
+				assert.True(t, snapshot.GetNodeVulnReportFilters().GetAllVuln())
+			},
+		},
+		"node report with all vulnerabilities set to false is not overridden": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+				Filter: &apiV2.ReportRequestViewBased_NodeVulnReportFilters{
+					NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+						CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{
+							AllVuln: false,
+						},
+					},
+				},
+			},
+			verify: func(t *testing.T, snapshot *storage.ReportSnapshot) {
+				assert.False(t, snapshot.GetNodeVulnReportFilters().GetAllVuln())
+			},
+		},
+		"node report with invalid query fails": {
+			req: &apiV2.ReportRequestViewBased{
+				Type: apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+				Filter: &apiV2.ReportRequestViewBased_NodeVulnReportFilters{
+					NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+						Query: "invalid query syntax [",
+					},
+				},
+			},
+			expectError: true,
+			errContains: "invalid query",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			result, err := validator.ValidateAndGenerateViewBasedReportRequest(tc.req, identity)
+			if tc.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+				assert.Nil(t, result)
+				return
+			}
+			require.NoError(t, err)
+			require.NotNil(t, result)
+
+			snapshot := result.ReportSnapshot
+			require.NotNil(t, snapshot)
+			assert.Equal(t, storage.ReportStatus_WAITING, snapshot.GetReportStatus().GetRunState())
+			assert.Equal(t, storage.ReportStatus_VIEW_BASED, snapshot.GetReportStatus().GetReportRequestType())
+			assert.Equal(t, storage.ReportStatus_DOWNLOAD, snapshot.GetReportStatus().GetReportNotificationMethod())
+			assert.Equal(t, "user-1", snapshot.GetRequester().GetId())
+			assert.Equal(t, "John Doe", snapshot.GetRequester().GetName())
+			assert.NotEmpty(t, snapshot.GetName())
+			tc.verify(t, snapshot)
+		})
+	}
+}
diff --git a/central/reports/validation/validate_test.go b/central/reports/validation/validate_test.go
index 1c0d8aa065a97..da51f83371d26 100644
--- a/central/reports/validation/validate_test.go
+++ b/central/reports/validation/validate_test.go
@@ -52,6 +52,12 @@ func TestValidateEntityScope(t *testing.T) {
 			),
 			expectError: false,
 		},
+		"label key with empty value is valid": {
+			scope: makeEntityScope(
+				makeRule(apiV2.ScopeEntity_SCOPE_ENTITY_NAMESPACE, apiV2.ScopeField_FIELD_LABEL, exactValue("required=")),
+			),
+			expectError: false,
+		},
 		"valid multiple rules different entities": {
 			scope: makeEntityScope(
 				makeRule(apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER, apiV2.ScopeField_FIELD_NAME, exactValue("prod")),
@@ -64,7 +70,7 @@ func TestValidateEntityScope(t *testing.T) {
 				makeRule(apiV2.ScopeEntity_SCOPE_ENTITY_UNSET, apiV2.ScopeField_FIELD_NAME, exactValue("x")),
 			),
 			expectError: true,
-			errContains: "Unexpected entity scope rule:",
+			errContains: "unexpected entity scope rule:",
 		},
 		"unset field": {
 			scope: makeEntityScope(
@@ -79,7 +85,7 @@ func TestValidateEntityScope(t *testing.T) {
 				makeRule(apiV2.ScopeEntity_SCOPE_ENTITY_DEPLOYMENT, apiV2.ScopeField_FIELD_NAME, exactValue("b")),
 			),
 			expectError: true,
-			errContains: "Duplicate",
+			errContains: "duplicate",
 		},
 		"no values in rule": {
 			scope: makeEntityScope(
@@ -126,7 +132,7 @@ func TestValidateEntityScope(t *testing.T) {
 				makeRule(apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER, apiV2.ScopeField_FIELD_ANNOTATION, exactValue("k=v")),
 			),
 			expectError: true,
-			errContains: "Annotation",
+			errContains: "annotation",
 		},
 		"annotation value missing equals sign": {
 			scope: makeEntityScope(
@@ -214,7 +220,7 @@ func TestValidateSchedule(t *testing.T) {
 				},
 			},
 			expectError: true,
-			errContains: "Daily schedule must not specify",
+			errContains: "daily schedule must not specify",
 		},
 		{
 			testname: "Daily schedule with days_of_month is invalid",
@@ -229,7 +235,7 @@ func TestValidateSchedule(t *testing.T) {
 				},
 			},
 			expectError: true,
-			errContains: "Daily schedule must not specify",
+			errContains: "daily schedule must not specify",
 		},
 		{
 			testname: "Valid weekly schedule",
@@ -293,6 +299,7 @@ func TestValidateReportFiltersQuery(t *testing.T) {
 	v := &Validator{}
 	baseFilters := func(query string) *apiV2.ReportConfiguration {
 		return &apiV2.ReportConfiguration{
+			Type: apiV2.ReportConfiguration_VULNERABILITY,
 			Filter: &apiV2.ReportConfiguration_VulnReportFilters{
 				VulnReportFilters: &apiV2.VulnerabilityReportFilters{
 					ImageTypes: []apiV2.VulnerabilityReportFilters_ImageType{apiV2.VulnerabilityReportFilters_DEPLOYED},
@@ -319,7 +326,7 @@ func TestValidateReportFiltersQuery(t *testing.T) {
 			err := v.validateReportFilters(baseFilters(tc.query))
 			if tc.expectError {
 				assert.Error(t, err)
-				assert.Contains(t, err.Error(), "Invalid query")
+				assert.Contains(t, err.Error(), "invalid query")
 			} else {
 				assert.NoError(t, err)
 			}
diff --git a/central/risk/multipliers/deployment/process_baseline_violations.go b/central/risk/multipliers/deployment/process_baseline_violations.go
index 095cb9344c1b2..06907a8a2d170 100644
--- a/central/risk/multipliers/deployment/process_baseline_violations.go
+++ b/central/risk/multipliers/deployment/process_baseline_violations.go
@@ -13,7 +13,9 @@ import (
 )
 
 const (
-	processBaselineHeading = `Suspicious Process Executions`
+	// ProcessBaselineHeading is the risk result name for process baseline violations.
+	// Exported for use in risk data sanitization.
+	ProcessBaselineHeading = `Suspicious Process Executions`
 
 	processBaselineSaturation = 10
 	processBaselineValue      = 4
@@ -56,7 +58,9 @@ func NewProcessBaselines(evaluator evaluator.Evaluator) Multiplier {
 	}
 }
 
-func formatProcess(process *views.ProcessIndicatorRiskView) string {
+// FormatProcess formats a process indicator into a human-readable message for risk factors.
+// Exported for use in tests to ensure sanitization regex stays in sync with format changes.
+func FormatProcess(process *views.ProcessIndicatorRiskView) string {
 	sb := strings.Builder{}
 	sb.Grow(128)
 	sb.WriteString("Detected execution of suspicious process ")
@@ -82,13 +86,13 @@ func (p *processBaselineMultiplier) Score(_ context.Context, deployment *storage
 
 	scorer := newScorer()
 	riskResult := &storage.Risk_Result{
-		Name: processBaselineHeading,
+		Name: ProcessBaselineHeading,
 	}
 
 	for _, process := range violatingProcesses {
 		scorer.addProcess()
 		riskResult.Factors = append(riskResult.Factors, &storage.Risk_Result_Factor{
-			Message: formatProcess(process),
+			Message: FormatProcess(process),
 		})
 	}
 
diff --git a/central/risk/multipliers/deployment/process_baseline_violations_test.go b/central/risk/multipliers/deployment/process_baseline_violations_test.go
index 1d47bdec6db7d..f5cede11106e1 100644
--- a/central/risk/multipliers/deployment/process_baseline_violations_test.go
+++ b/central/risk/multipliers/deployment/process_baseline_violations_test.go
@@ -44,7 +44,7 @@ func TestProcessBaselines(t *testing.T) {
 				},
 			},
 			expected: &storage.Risk_Result{
-				Name:  processBaselineHeading,
+				Name:  ProcessBaselineHeading,
 				Score: 1.6,
 				Factors: []*storage.Risk_Result_Factor{
 					{Message: "Detected execution of suspicious process \"apt-get\" with args \"install nmap\" in container containerName"},
@@ -66,7 +66,7 @@ func TestProcessBaselines(t *testing.T) {
 				},
 			},
 			expected: &storage.Risk_Result{
-				Name:  processBaselineHeading,
+				Name:  ProcessBaselineHeading,
 				Score: 2.14,
 				Factors: []*storage.Risk_Result_Factor{
 					{Message: "Detected execution of suspicious process \"apt-get\" with args \"install nmap\" in container containerName"},
diff --git a/central/risk/multipliers/image/vulnerabilities.go b/central/risk/multipliers/image/vulnerabilities.go
index f99dd7a3abb90..b37950fd5bfee 100644
--- a/central/risk/multipliers/image/vulnerabilities.go
+++ b/central/risk/multipliers/image/vulnerabilities.go
@@ -8,6 +8,7 @@ import (
 	"github.com/stackrox/rox/central/risk/scorer/vulns"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/scancomponent"
+	"github.com/stackrox/rox/pkg/set"
 )
 
 const (
@@ -21,7 +22,7 @@ const (
 // vulnerabilitiesMultiplier is a scorer for the vulnerabilities in an image
 type vulnerabilitiesMultiplier struct{}
 
-// NewVulnerabilities provides a multiplier that scores the data based on the CVSS scores and number of CVEs
+// NewVulnerabilities provides a multiplier that scores known-severity vulnerability findings across image components.
 func NewVulnerabilities() Multiplier {
 	return &vulnerabilitiesMultiplier{}
 }
@@ -43,8 +44,8 @@ func (c *vulnerabilitiesMultiplier) Score(_ context.Context, image *storage.Imag
 		Name: VulnerabilitiesHeading,
 		Factors: []*storage.Risk_Result_Factor{
 			{
-				Message: fmt.Sprintf("Image %q contains %d CVEs with severities ranging between %s and %s",
-					image.GetName().GetFullName(), num, min.Severity, max.Severity),
+				Message: fmt.Sprintf("Image %q contains %d distinct CVEs with severities ranging between %s and %s",
+					image.GetName().GetFullName(), countDistinctCVEs(imgComponents), min.Severity, max.Severity),
 			},
 		},
 		Score: score,
@@ -68,10 +69,23 @@ func (c *vulnerabilitiesMultiplier) ScoreV2(_ context.Context, image *storage.Im
 		Name: VulnerabilitiesHeading,
 		Factors: []*storage.Risk_Result_Factor{
 			{
-				Message: fmt.Sprintf("Image %q contains %d CVEs with severities ranging between %s and %s",
-					image.GetName().GetFullName(), num, min.Severity, max.Severity),
+				Message: fmt.Sprintf("Image %q contains %d distinct CVEs with severities ranging between %s and %s",
+					image.GetName().GetFullName(), countDistinctCVEs(imgComponents), min.Severity, max.Severity),
 			},
 		},
 		Score: score,
 	}
 }
+
+// countDistinctCVEs includes unknown-severity findings, which do not affect the risk score.
+func countDistinctCVEs(components []*storage.EmbeddedImageScanComponent) int {
+	cves := set.NewStringSet()
+	for _, component := range components {
+		for _, vuln := range component.GetVulns() {
+			if cve := vuln.GetCve(); cve != "" {
+				cves.Add(cve)
+			}
+		}
+	}
+	return cves.Cardinality()
+}
diff --git a/central/risk/multipliers/image/vulnerabilities_test.go b/central/risk/multipliers/image/vulnerabilities_test.go
index 959ac3af49969..5a7460316dda3 100644
--- a/central/risk/multipliers/image/vulnerabilities_test.go
+++ b/central/risk/multipliers/image/vulnerabilities_test.go
@@ -18,6 +18,7 @@ func TestVulnerabilitiesScore(t *testing.T) {
 	images := multipliers.GetMockImages()
 	result := mult.Score(ctx, images[0])
 	assert.Equal(t, float32(1.59025), result.GetScore())
+	assert.Equal(t, "Image \"docker.io/library/nginx:1.10\" contains 2 distinct CVEs with severities ranging between Low and Critical", result.GetFactors()[0].GetMessage())
 
 	// Changing CVSS score should not affect result.
 	images[0].GetScan().GetComponents()[0].GetVulns()[0].Cvss = 0
@@ -27,7 +28,14 @@ func TestVulnerabilitiesScore(t *testing.T) {
 	result = mult.Score(ctx, images[0])
 	assert.Equal(t, float32(1.59025), result.GetScore())
 
-	// Set both severity to unknown and then there should be a nil RiskResult
+	// Unknown-severity CVEs are displayed, but do not contribute to the score.
+	images[0].GetScan().GetComponents()[0].Vulns = append(images[0].GetScan().GetComponents()[0].GetVulns(),
+		&storage.EmbeddedVulnerability{Cve: "CVE-2019-0003", Severity: storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY})
+	result = mult.Score(ctx, images[0])
+	assert.Equal(t, float32(1.59025), result.GetScore())
+	assert.Equal(t, "Image \"docker.io/library/nginx:1.10\" contains 3 distinct CVEs with severities ranging between Low and Critical", result.GetFactors()[0].GetMessage())
+
+	// Only unknown-severity vulnerabilities remain, so there is no risk result.
 	images[0].GetScan().GetComponents()[0].GetVulns()[0].Severity = storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY
 	images[0].GetScan().GetComponents()[0].GetVulns()[1].Severity = storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY
 	images[0].GetScan().GetComponents()[1].GetVulns()[0].Severity = storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY
@@ -44,6 +52,7 @@ func TestVulnerabilitiesScoreV2(t *testing.T) {
 	images := multipliers.GetMockImagesV2()
 	result := mult.ScoreV2(ctx, images[0])
 	assert.Equal(t, float32(1.59025), result.GetScore())
+	assert.Equal(t, "Image \"docker.io/library/nginx:1.10\" contains 2 distinct CVEs with severities ranging between Low and Critical", result.GetFactors()[0].GetMessage())
 
 	// Changing CVSS score should not affect result.
 	images[0].GetScan().GetComponents()[0].GetVulns()[0].Cvss = 0
@@ -53,7 +62,14 @@ func TestVulnerabilitiesScoreV2(t *testing.T) {
 	result = mult.ScoreV2(ctx, images[0])
 	assert.Equal(t, float32(1.59025), result.GetScore())
 
-	// Set both severity to unknown and then there should be a nil RiskResult
+	// Unknown-severity CVEs are displayed, but do not contribute to the score.
+	images[0].GetScan().GetComponents()[0].Vulns = append(images[0].GetScan().GetComponents()[0].GetVulns(),
+		&storage.EmbeddedVulnerability{Cve: "CVE-2019-0003", Severity: storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY})
+	result = mult.ScoreV2(ctx, images[0])
+	assert.Equal(t, float32(1.59025), result.GetScore())
+	assert.Equal(t, "Image \"docker.io/library/nginx:1.10\" contains 3 distinct CVEs with severities ranging between Low and Critical", result.GetFactors()[0].GetMessage())
+
+	// Only unknown-severity vulnerabilities remain, so there is no risk result.
 	images[0].GetScan().GetComponents()[0].GetVulns()[0].Severity = storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY
 	images[0].GetScan().GetComponents()[0].GetVulns()[1].Severity = storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY
 	images[0].GetScan().GetComponents()[1].GetVulns()[0].Severity = storage.VulnerabilitySeverity_UNKNOWN_VULNERABILITY_SEVERITY
diff --git a/central/risk/scorer/deployment/scorer_test.go b/central/risk/scorer/deployment/scorer_test.go
index 59a5838e41802..faf919428da8e 100644
--- a/central/risk/scorer/deployment/scorer_test.go
+++ b/central/risk/scorer/deployment/scorer_test.go
@@ -62,7 +62,7 @@ func TestScore(t *testing.T) {
 		{
 			Name: imageMultiplier.VulnerabilitiesHeading,
 			Factors: []*storage.Risk_Result_Factor{
-				{Message: "Image \"docker.io/library/nginx:1.10\" contains 3 CVEs with severities ranging between Moderate and Critical"},
+				{Message: "Image \"docker.io/library/nginx:1.10\" contains 3 distinct CVEs with severities ranging between Moderate and Critical"},
 			},
 			Score: 1.5535,
 		},
diff --git a/central/risk/scorer/image/scorer_test.go b/central/risk/scorer/image/scorer_test.go
index c89e474ce1f2c..902014711f510 100644
--- a/central/risk/scorer/image/scorer_test.go
+++ b/central/risk/scorer/image/scorer_test.go
@@ -28,7 +28,7 @@ func TestScore(t *testing.T) {
 		{
 			Name: imageMultiplier.VulnerabilitiesHeading,
 			Factors: []*storage.Risk_Result_Factor{
-				{Message: "Image \"docker.io/library/nginx:1.10\" contains 3 CVEs with severities ranging between Moderate and Critical"},
+				{Message: "Image \"docker.io/library/nginx:1.10\" contains 3 distinct CVEs with severities ranging between Moderate and Critical"},
 			},
 			Score: 1.5535,
 		},
@@ -67,7 +67,7 @@ func TestScoreV2(t *testing.T) {
 		{
 			Name: imageMultiplier.VulnerabilitiesHeading,
 			Factors: []*storage.Risk_Result_Factor{
-				{Message: "Image \"docker.io/library/nginx:1.10\" contains 3 CVEs with severities ranging between Moderate and Critical"},
+				{Message: "Image \"docker.io/library/nginx:1.10\" contains 3 distinct CVEs with severities ranging between Moderate and Critical"},
 			},
 			Score: 1.5535,
 		},
diff --git a/central/scanner/handler.go b/central/scanner/handler.go
index 9890f5209aeed..9728df49a6a08 100644
--- a/central/scanner/handler.go
+++ b/central/scanner/handler.go
@@ -93,8 +93,6 @@ func generateFilesForScannerV1(params *apiparams.Scanner, clusterType storage.Cl
 		ClusterType: clusterType,
 		K8sConfig: &renderer.K8sConfig{
 			CommonConfig: renderer.CommonConfig{
-				ScannerImage:     stringutils.OrDefault(params.ScannerImage, flavor.ScannerImage()),
-				ScannerDBImage:   stringutils.OrDefault(params.ScannerDBImage, flavor.ScannerDBImage()),
 				ScannerV4Image:   stringutils.OrDefault(params.ScannerV4Image, flavor.ScannerV4Image()),
 				ScannerV4DBImage: stringutils.OrDefault(params.ScannerV4DBImage, flavor.ScannerV4DBImage()),
 			},
diff --git a/central/search/category.go b/central/search/category.go
index 97ee74cf890e4..418f0eb32a2ce 100644
--- a/central/search/category.go
+++ b/central/search/category.go
@@ -2,13 +2,19 @@ package search
 
 import (
 	v1 "github.com/stackrox/rox/generated/api/v1"
-	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/set"
 )
 
 // GetGlobalSearchCategories returns a set of search categories
 func GetGlobalSearchCategories() set.Set[v1.SearchCategory] {
 	// globalSearchCategories is exposed for e2e options test
+	//
+	// IMAGES_V2 is intentionally omitted. With FlattenImageData enabled, IMAGES is
+	// already routed to the imagesV2 store (see central/search/service), so adding
+	// IMAGES_V2 here would run the same image search twice and return every image
+	// twice (both labeled IMAGES). IMAGES remains the public category used by the UI
+	// and API clients; IMAGES_V2 is the internal storage/schema category and is still
+	// searchable when requested explicitly.
 	globalSearchCategories := set.NewSet(
 		v1.SearchCategory_ALERTS,
 		v1.SearchCategory_CLUSTERS,
@@ -25,8 +31,5 @@ func GetGlobalSearchCategories() set.Set[v1.SearchCategory] {
 		v1.SearchCategory_IMAGE_INTEGRATIONS,
 		v1.SearchCategory_POLICY_CATEGORIES,
 	)
-	if features.FlattenImageData.Enabled() {
-		globalSearchCategories.Add(v1.SearchCategory_IMAGES_V2)
-	}
 	return globalSearchCategories
 }
diff --git a/central/search/service/service_impl_test.go b/central/search/service/service_impl_test.go
index 38a54393161eb..025e495188e3c 100644
--- a/central/search/service/service_impl_test.go
+++ b/central/search/service/service_impl_test.go
@@ -52,6 +52,15 @@ func TestSearchCategoryToOptionsMultiMap(t *testing.T) {
 	}
 }
 
+// TestPoliciesCategoryAutocompleteFieldPath verifies that the POLICIES multimap resolves "Category"
+// to the PolicyCategoryName field path so autocomplete works via the policy_categories join.
+func TestPoliciesCategoryAutocompleteFieldPath(t *testing.T) {
+	policiesMultimap := categoryToOptionsMultimap[v1.SearchCategory_POLICIES]
+	fields := policiesMultimap.GetAll(search.Category.String())
+	assert.Len(t, fields, 1, `POLICIES multimap must have exactly one field for the "Category" key`)
+	assert.Equal(t, "policycategory.name", fields[0].GetFieldPath())
+}
+
 func TestGetSearchFuncs_FlattenImageDataRoutesImageSearch(t *testing.T) {
 	ctx := context.Background()
 	q := &v1.Query{}
diff --git a/central/securedclustercertgen/certificates.go b/central/securedclustercertgen/certificates.go
index 750f0ef15754b..0ad193df79a4e 100644
--- a/central/securedclustercertgen/certificates.go
+++ b/central/securedclustercertgen/certificates.go
@@ -21,6 +21,8 @@ var (
 // secretDataMap represents data stored as part of a secret.
 type secretDataMap = map[string][]byte
 
+// TODO(ROX-36705): Remove Scanner V2 certs once 4.11 goes out of support.
+// Older Secured Clusters may still run Scanner V2 and need these certificates.
 var scannerV2ServiceTypes = set.NewFrozenSet[storage.ServiceType](storage.ServiceType_SCANNER_SERVICE, storage.ServiceType_SCANNER_DB_SERVICE)
 var scannerV4ServiceTypes = set.NewFrozenSet[storage.ServiceType](storage.ServiceType_SCANNER_V4_INDEXER_SERVICE, storage.ServiceType_SCANNER_V4_DB_SERVICE)
 var localScannerServiceTypes = scannerV2ServiceTypes.Union(scannerV4ServiceTypes)
diff --git a/central/sensor/service/connection/connection_impl.go b/central/sensor/service/connection/connection_impl.go
index 5be9321a48f0f..b59fdec096b88 100644
--- a/central/sensor/service/connection/connection_impl.go
+++ b/central/sensor/service/connection/connection_impl.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"math"
+	"slices"
 
 	"github.com/pkg/errors"
 	compScanSetting "github.com/stackrox/rox/central/complianceoperator/v2/scanconfigurations/datastore"
@@ -544,6 +545,13 @@ func (c *sensorConnection) getPolicySyncMsgFromPolicies(policies []*storage.Poli
 		// Otherwise, sensor supports the same version or newer as central
 	}
 
+	// Remove exclude_by_kind exclusions before syncing to a Sensor that
+	// lacks WorkloadKindExclusionCap. Sensor forwards this same list to
+	// the admission controller, so AC evaluates the same copy.
+	if !c.HasCapability(centralsensor.WorkloadKindExclusionCap) {
+		policies = stripExcludeByKindExclusions(policies)
+	}
+
 	return &central.MsgToSensor{
 		Msg: &central.MsgToSensor_PolicySync{
 			PolicySync: &central.PolicySync{
@@ -553,6 +561,32 @@ func (c *sensorConnection) getPolicySyncMsgFromPolicies(policies []*storage.Poli
 	}, nil
 }
 
+// stripExcludeByKindExclusions returns a copy of policies with every exclusion
+// that sets exclude_by_kind removed. Stored policies are not mutated. An old
+// Sensor compiles an exclude_by_kind item as an unconstrained exclusion (nil
+// name and nil scope match every workload). Sensor does not evaluate image
+// exclusions, so an image+kind item with only the kind matcher removed is that
+// same unconstrained exclusion and is removed entirely. An exclusion with no
+// kind matcher is kept, including an image combined with a deployment name or
+// scope.
+func stripExcludeByKindExclusions(policies []*storage.Policy) []*storage.Policy {
+	out := make([]*storage.Policy, 0, len(policies))
+	for _, p := range policies {
+		if !slices.ContainsFunc(p.GetExclusions(), exclusionSetsExcludeByKind) {
+			out = append(out, p)
+			continue
+		}
+		cloned := p.CloneVT()
+		cloned.Exclusions = slices.DeleteFunc(cloned.GetExclusions(), exclusionSetsExcludeByKind)
+		out = append(out, cloned)
+	}
+	return out
+}
+
+func exclusionSetsExcludeByKind(e *storage.Exclusion) bool {
+	return e.GetExcludeByKind() != nil
+}
+
 func (c *sensorConnection) getNetworkBaselineSyncMsg(ctx context.Context) (*central.MsgToSensor, error) {
 	var networkBaselines []*storage.NetworkBaseline
 	walkFn := func() error {
diff --git a/central/sensor/service/connection/connection_test.go b/central/sensor/service/connection/connection_test.go
index a8fd0d52fd2fc..eaf8523107feb 100644
--- a/central/sensor/service/connection/connection_test.go
+++ b/central/sensor/service/connection/connection_test.go
@@ -365,6 +365,102 @@ func (s *testSuite) TestGetPolicySyncMsgFromPoliciesDoesntDowngradeInvalidVersio
 	s.Equal(policyversion.CurrentVersion().String(), policySync.GetPolicies()[0].GetPolicyVersion())
 }
 
+func (s *testSuite) TestGetPolicySyncMsgFromPoliciesStripsExcludeByKind() {
+	kindExclusion := &storage.Exclusion{
+		Name: "skip-cronjobs",
+		Matcher: &storage.Exclusion_ExcludeByKind_{
+			ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+				Kinds: []storage.Exclusion_WorkloadKind{storage.Exclusion_CRON_JOB},
+			},
+		},
+	}
+	nameExclusion := &storage.Exclusion{
+		Name: "skip-web",
+		Matcher: &storage.Exclusion_Deployment_{
+			Deployment: &storage.Exclusion_Deployment{Name: "web"},
+		},
+	}
+	imageExclusion := &storage.Exclusion{
+		Name:  "skip-image",
+		Image: &storage.Exclusion_Image{Name: "stackrox.io"},
+	}
+	imageAndKindExclusion := &storage.Exclusion{
+		Name:  "skip-image-and-jobs",
+		Image: &storage.Exclusion_Image{Name: "example.io"},
+		Matcher: &storage.Exclusion_ExcludeByKind_{
+			ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+				Kinds: []storage.Exclusion_WorkloadKind{storage.Exclusion_JOB},
+			},
+		},
+	}
+	imageAndDeploymentExclusion := &storage.Exclusion{
+		Name:  "skip-image-and-web",
+		Image: &storage.Exclusion_Image{Name: "nginx"},
+		Matcher: &storage.Exclusion_Deployment_{
+			Deployment: &storage.Exclusion_Deployment{Name: "web-image"},
+		},
+	}
+	policy := &storage.Policy{
+		Name: "test-policy",
+		Exclusions: []*storage.Exclusion{
+			kindExclusion,
+			nameExclusion,
+			imageExclusion,
+			imageAndKindExclusion,
+			imageAndDeploymentExclusion,
+		},
+	}
+
+	s.Run("without capability strips kind items and keeps others", func() {
+		original := policy.CloneVT()
+		msg, err := (&sensorConnection{}).getPolicySyncMsgFromPolicies([]*storage.Policy{policy})
+		s.Require().NoError(err)
+
+		synced := msg.GetPolicySync().GetPolicies()
+		s.Require().Len(synced, 1)
+		got := synced[0].GetExclusions()
+		s.Require().Len(got, 3)
+		s.Equal("skip-web", got[0].GetName())
+		s.Equal("web", got[0].GetDeployment().GetName())
+		s.Equal("skip-image", got[1].GetName())
+		s.Equal("stackrox.io", got[1].GetImage().GetName())
+		s.Equal("skip-image-and-web", got[2].GetName())
+		s.Equal("nginx", got[2].GetImage().GetName())
+		s.Equal("web-image", got[2].GetDeployment().GetName())
+		protoassert.Equal(s.T(), original, policy)
+	})
+
+	s.Run("with capability keeps kind items", func() {
+		conn := &sensorConnection{
+			capabilities: set.NewSet(centralsensor.WorkloadKindExclusionCap),
+		}
+		msg, err := conn.getPolicySyncMsgFromPolicies([]*storage.Policy{policy})
+		s.Require().NoError(err)
+
+		got := msg.GetPolicySync().GetPolicies()[0].GetExclusions()
+		s.Require().Len(got, 5)
+		s.NotNil(got[0].GetExcludeByKind())
+		s.NotNil(got[3].GetExcludeByKind())
+		s.Equal(storage.Exclusion_JOB, got[3].GetExcludeByKind().GetKinds()[0])
+		s.Equal("example.io", got[3].GetImage().GetName())
+		s.Equal("web-image", got[4].GetDeployment().GetName())
+	})
+
+	s.Run("later capable sensor still sees original kind items", func() {
+		// PreparePoliciesAndBroadcast reuses the same slice across connections.
+		input := []*storage.Policy{policy}
+		_, err := (&sensorConnection{}).getPolicySyncMsgFromPolicies(input)
+		s.Require().NoError(err)
+
+		capable := &sensorConnection{
+			capabilities: set.NewSet(centralsensor.WorkloadKindExclusionCap),
+		}
+		msg, err := capable.getPolicySyncMsgFromPolicies(input)
+		s.Require().NoError(err)
+		s.NotNil(msg.GetPolicySync().GetPolicies()[0].GetExclusions()[0].GetExcludeByKind())
+	})
+}
+
 func (s *testSuite) TestSendsAuditLogSyncMessageIfEnabledOnRun() {
 	ctx := context.Background()
 	clusterID := "this-cluster"
diff --git a/central/sensor/service/pipeline/clustermetrics/pipeline.go b/central/sensor/service/pipeline/clustermetrics/pipeline.go
index 2e7f9e258140d..6051a4fc326ad 100644
--- a/central/sensor/service/pipeline/clustermetrics/pipeline.go
+++ b/central/sensor/service/pipeline/clustermetrics/pipeline.go
@@ -79,7 +79,7 @@ func (p *pipelineImpl) Run(
 	ctx context.Context,
 	clusterID string,
 	msg *central.MsgFromSensor,
-	_ common.MessageInjector,
+	injector common.MessageInjector,
 ) error {
 	clusterMetrics := msg.GetClusterMetrics()
 	p.metricsStore.Set(clusterID, clusterMetrics)
@@ -93,7 +93,7 @@ func (p *pipelineImpl) Run(
 		logging.GetRateLimitedLogger().Warn(
 			"Error while trying to update secured units usage: ", err.Error())
 	}
-	go clusterTelemetry.UpdateSecuredClusterIdentity(ctx, clusterID, clusterMetrics)
+	go clusterTelemetry.UpdateSecuredClusterIdentity(ctx, clusterID, clusterMetrics, hasVMTelemetryCap(injector))
 	return nil
 }
 
@@ -101,3 +101,9 @@ func (p *pipelineImpl) OnFinish(clusterID string) {
 	p.metricsStore.Set(clusterID, &central.ClusterMetrics{})
 	p.telemetryMetrics.DeleteClusterMetrics(clusterID)
 }
+
+// hasVMTelemetryCap is true when the Sensor advertised VirtualMachineTelemetryCap.
+// A nil injector is treated as no capability.
+func hasVMTelemetryCap(injector common.MessageInjector) bool {
+	return injector != nil && injector.HasCapability(centralsensor.VirtualMachineTelemetryCap)
+}
diff --git a/central/sensor/service/pipeline/clustermetrics/pipeline_test.go b/central/sensor/service/pipeline/clustermetrics/pipeline_test.go
index d6c8e2e62a941..2e7708398dcaa 100644
--- a/central/sensor/service/pipeline/clustermetrics/pipeline_test.go
+++ b/central/sensor/service/pipeline/clustermetrics/pipeline_test.go
@@ -6,9 +6,12 @@ import (
 
 	usageMocks "github.com/stackrox/rox/central/administration/usage/datastore/securedunits/mocks"
 	telemetryMocks "github.com/stackrox/rox/central/metrics/telemetry/mocks"
+	"github.com/stackrox/rox/central/sensor/service/common"
 	metricsMocks "github.com/stackrox/rox/central/sensor/service/pipeline/clustermetrics/mocks"
 	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/centralsensor"
+	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/fixtures"
 	"github.com/stretchr/testify/suite"
 	"go.uber.org/mock/gomock"
@@ -70,3 +73,58 @@ func (suite *PipelineTestSuite) TestClusterMetricsResetOnPipelineFinish() {
 
 	suite.pipeline.OnFinish(clusterID)
 }
+
+func (suite *PipelineTestSuite) TestClusterMetricsMessageFromSensor_QueriesVMTelemetryCap() {
+	tests := map[string]struct {
+		caps map[centralsensor.SensorCapability]bool
+	}{
+		"should query VirtualMachineTelemetryCap when Sensor advertises it": {
+			caps: map[centralsensor.SensorCapability]bool{
+				centralsensor.VirtualMachineTelemetryCap: true,
+			},
+		},
+		"should query VirtualMachineTelemetryCap when Sensor lacks it": {
+			caps: map[centralsensor.SensorCapability]bool{},
+		},
+	}
+	for name, tc := range tests {
+		suite.Run(name, func() {
+			clusterID := fixtures.GetDeployment().GetClusterId()
+			expectedMetrics := &central.ClusterMetrics{NodeCount: 1, CpuCapacity: 10}
+
+			suite.metricsStore.EXPECT().Set(clusterID, expectedMetrics)
+			suite.telemetryMetrics.EXPECT().SetClusterMetrics(clusterID, expectedMetrics)
+			suite.usageStore.EXPECT().UpdateUsage(gomock.Any(), clusterID, &storage.SecuredUnits{
+				NumNodes:    expectedMetrics.GetNodeCount(),
+				NumCpuUnits: expectedMetrics.GetCpuCapacity(),
+			}).Return(nil)
+
+			injector := &fakeInjector{caps: tc.caps}
+			err := suite.pipeline.Run(suite.T().Context(), clusterID, &central.MsgFromSensor{
+				Msg: &central.MsgFromSensor_ClusterMetrics{
+					ClusterMetrics: expectedMetrics,
+				},
+			}, injector)
+			suite.NoError(err)
+			suite.Equal([]centralsensor.SensorCapability{centralsensor.VirtualMachineTelemetryCap}, injector.queried)
+		})
+	}
+}
+
+var _ common.MessageInjector = (*fakeInjector)(nil)
+
+type fakeInjector struct {
+	caps    map[centralsensor.SensorCapability]bool
+	queried []centralsensor.SensorCapability
+}
+
+func (f *fakeInjector) HasCapability(cap centralsensor.SensorCapability) bool {
+	f.queried = append(f.queried, cap)
+	return f.caps[cap]
+}
+
+func (f *fakeInjector) InjectMessage(concurrency.Waitable, *central.MsgToSensor) error {
+	return nil
+}
+
+func (f *fakeInjector) InjectMessageIntoQueue(*central.MsgFromSensor) {}
diff --git a/central/sensor/service/pipeline/nodeindex/pipeline.go b/central/sensor/service/pipeline/nodeindex/pipeline.go
index 03c1b2b6c686c..dc032fe4cbf36 100644
--- a/central/sensor/service/pipeline/nodeindex/pipeline.go
+++ b/central/sensor/service/pipeline/nodeindex/pipeline.go
@@ -2,9 +2,11 @@ package nodeindex
 
 import (
 	"context"
+	"time"
 
 	"github.com/pkg/errors"
 	clusterDataStore "github.com/stackrox/rox/central/cluster/datastore"
+	"github.com/stackrox/rox/central/cluster/lifecycle"
 	"github.com/stackrox/rox/central/enrichment"
 	countMetrics "github.com/stackrox/rox/central/metrics"
 	nodeDatastore "github.com/stackrox/rox/central/node/datastore"
@@ -19,6 +21,7 @@ import (
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/metrics"
 	"github.com/stackrox/rox/pkg/nodes/enricher"
+	"github.com/stackrox/rox/pkg/protocompat"
 )
 
 var (
@@ -115,17 +118,59 @@ func (p *pipelineImpl) Run(ctx context.Context, _ string, msg *central.MsgFromSe
 	}
 	log.Infof("Scanned index report and found %d components for node %s",
 		len(node.GetScan().GetComponents()), nodeDatastore.NodeString(node))
+	incomingScanTime := node.GetScan().GetScanTime()
 
 	// Update the whole node in the database with the new and previous information.
-	err = p.riskManager.CalculateRiskAndUpsertNode(node)
+	err = p.upsertNodeIfClusterActive(ctx, node)
 	if err != nil {
 		return errors.Wrapf(err, "failed calculating risk and upserting node %s", nodeDatastore.NodeString(node))
 	}
 
+	// The store may have rejected this scan as not newer than what's already persisted, in which case it
+	// rewrites node.Scan in place to the previously stored one before returning - see isUpdated() in
+	// central/node/datastore/store/postgres/store.go. Comparing scan times here, on the same object we just
+	// tried to upsert, tells us definitively whether the fresh scan we just processed actually landed.
+	persistedScanTime := node.GetScan().GetScanTime()
+	switch cmp := protocompat.CompareTimestamps(incomingScanTime, persistedScanTime); {
+	case cmp > 0:
+		// The store kept a scan_time older than the one we just processed. isUpdated() only rejects scans
+		// that are not strictly newer than the stored one, so a fresh scan should have been accepted here;
+		// a persisted scan older than the processed one means the fresh scan was silently dropped, which the
+		// freshness guard should never do.
+		log.Warnf("Persisted scan_time for node %s is older than the freshly processed scan_time: "+
+			"processed=%s persisted=%s. The store kept an older scan than the one just processed, which the "+
+			"freshness guard should have accepted - possible scan regression.",
+			nodeDatastore.NodeString(node),
+			protocompat.ConvertTimestampToString(incomingScanTime, time.RFC3339Nano),
+			protocompat.ConvertTimestampToString(persistedScanTime, time.RFC3339Nano))
+	case cmp < 0:
+		// The store kept a scan_time newer than the one we just processed - the expected shape of an
+		// isUpdated() rejection, where node.Scan was rewritten back to the newer stored scan.
+		log.Warnf("Persisted scan_time for node %s does not match the freshly processed scan_time: "+
+			"processed=%s persisted=%s. The store rejected this scan as not newer than the stored one.",
+			nodeDatastore.NodeString(node),
+			protocompat.ConvertTimestampToString(incomingScanTime, time.RFC3339Nano),
+			protocompat.ConvertTimestampToString(persistedScanTime, time.RFC3339Nano))
+	}
+
 	sendComplianceAck(ctx, node, injector)
 	return nil
 }
 
+func (p *pipelineImpl) upsertNodeIfClusterActive(ctx context.Context, node *storage.Node) error {
+	active, release := lifecycle.Singleton().Enter(node.GetClusterId())
+	if !active {
+		return nil
+	}
+	defer release()
+
+	_, exists, err := p.clusterStore.GetClusterName(ctx, node.GetClusterId())
+	if err != nil || !exists {
+		return err
+	}
+	return p.riskManager.CalculateRiskAndUpsertNode(node)
+}
+
 func sendComplianceAck(ctx context.Context, node *storage.Node, injector common.MessageInjector) {
 	if injector == nil {
 		return
diff --git a/central/sensor/service/pipeline/nodeindex/pipeline_test.go b/central/sensor/service/pipeline/nodeindex/pipeline_test.go
index 5ea4a302e2ec8..7d98420ce86bc 100644
--- a/central/sensor/service/pipeline/nodeindex/pipeline_test.go
+++ b/central/sensor/service/pipeline/nodeindex/pipeline_test.go
@@ -2,8 +2,10 @@ package nodeindex
 
 import (
 	"testing"
+	"time"
 
 	clusterDatastoreMocks "github.com/stackrox/rox/central/cluster/datastore/mocks"
+	"github.com/stackrox/rox/central/cluster/lifecycle"
 	nodeDatastoreMocks "github.com/stackrox/rox/central/node/datastore/mocks"
 	riskManagerMocks "github.com/stackrox/rox/central/risk/manager/mocks"
 	"github.com/stackrox/rox/generated/internalapi/central"
@@ -12,13 +14,117 @@ import (
 	"github.com/stackrox/rox/pkg/centralsensor"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/features"
+	"github.com/stackrox/rox/pkg/logging"
 	nodesEnricherMocks "github.com/stackrox/rox/pkg/nodes/enricher/mocks"
 	"github.com/stackrox/rox/pkg/protoassert"
+	"github.com/stackrox/rox/pkg/protocompat"
 	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
 )
 
+const (
+	scanRejectedWarnSnippet   = "rejected this scan as not newer than the stored one"
+	scanRegressionWarnSnippet = "possible scan regression"
+)
+
+func swapObservedLogger(t *testing.T) *observer.ObservedLogs {
+	core, logs := observer.New(zap.WarnLevel)
+	orig := log
+	log = &logging.LoggerImpl{InnerLogger: zap.New(core).Sugar()}
+	t.Cleanup(func() { log = orig })
+	return logs
+}
+
+// TestPipelineWarnsWhenPersistedScanTimeRegresses validates the post-upsert diagnostic: after the upsert,
+// the pipeline compares the scan_time it processed against what the store actually kept (the store rewrites
+// node.Scan in place when it rejects a scan as not-newer) and warns on a mismatch.
+func TestPipelineWarnsWhenPersistedScanTimeRegresses(t *testing.T) {
+	t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
+	t.Setenv(features.ScannerV4.EnvVar(), "true")
+
+	processed := time.Now()
+
+	cases := map[string]struct {
+		// persistedScanTime is what the store leaves on node.Scan after the upsert returns.
+		persistedScanTime time.Time
+		// expectSnippet is the warning we expect to see; empty means no warning at all.
+		expectSnippet string
+	}{
+		// A genuine isUpdated() rejection keeps a scan strictly newer than the one we just processed.
+		"warns (rejection) when the store kept a newer scan": {
+			persistedScanTime: processed.Add(time.Hour),
+			expectSnippet:     scanRejectedWarnSnippet,
+		},
+		// The store kept an older scan than the fresh one - a scan the freshness guard should have accepted.
+		"warns (regression) when the store kept an older scan": {
+			persistedScanTime: processed.Add(-time.Hour),
+			expectSnippet:     scanRegressionWarnSnippet,
+		},
+		"silent when the fresh scan was accepted": {
+			persistedScanTime: processed,
+			expectSnippet:     "",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			logs := swapObservedLogger(t)
+			node := &storage.Node{Id: "1", Name: "node-name", ClusterId: "cluster-id"}
+
+			ctrl := gomock.NewController(t)
+			clusterStore := clusterDatastoreMocks.NewMockDataStore(ctrl)
+			nodeDatastore := nodeDatastoreMocks.NewMockDataStore(ctrl)
+			riskManager := riskManagerMocks.NewMockManager(ctrl)
+			enricher := nodesEnricherMocks.NewMockNodeEnricher(ctrl)
+
+			gomock.InOrder(
+				nodeDatastore.EXPECT().GetNode(gomock.Any(), gomock.Eq(node.GetId())).Times(1).Return(node, true, nil),
+				// Enrichment stamps a fresh scan_time, as the real enricher does with TimestampNow().
+				enricher.EXPECT().EnrichNodeWithVulnerabilities(gomock.Any(), nil, gomock.Any()).Times(1).
+					DoAndReturn(func(n *storage.Node, _ *storage.NodeInventory, _ *v4.IndexReport) error {
+						n.Scan = &storage.NodeScan{ScanTime: protocompat.ConvertTimeToTimestampOrNil(&processed)}
+						return nil
+					}),
+				// Upsert rewrites node.Scan in place to whatever was persisted (mimics isUpdated()).
+				riskManager.EXPECT().CalculateRiskAndUpsertNode(gomock.Any()).Times(1).
+					DoAndReturn(func(n *storage.Node) error {
+						n.Scan.ScanTime = protocompat.ConvertTimeToTimestampOrNil(&tc.persistedScanTime)
+						return nil
+					}),
+			)
+			clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Eq(node.GetClusterId())).Return("", true, nil)
+
+			p := &pipelineImpl{
+				clusterStore:  clusterStore,
+				nodeDatastore: nodeDatastore,
+				riskManager:   riskManager,
+				enricher:      enricher,
+			}
+
+			err := p.Run(t.Context(), node.GetClusterId(), createMsg(mockIndexReport), nil)
+			require.NoError(t, err)
+
+			rejections := logs.FilterMessageSnippet(scanRejectedWarnSnippet).All()
+			regressions := logs.FilterMessageSnippet(scanRegressionWarnSnippet).All()
+			switch tc.expectSnippet {
+			case scanRejectedWarnSnippet:
+				assert.Len(t, rejections, 1)
+				assert.Empty(t, regressions)
+			case scanRegressionWarnSnippet:
+				assert.Len(t, regressions, 1)
+				assert.Empty(t, rejections)
+			default:
+				assert.Empty(t, rejections)
+				assert.Empty(t, regressions)
+			}
+		})
+	}
+}
+
 func TestPipelineWithEmptyIndex(t *testing.T) {
 	t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
 	t.Setenv(features.ScannerV4.EnvVar(), "true")
@@ -55,6 +161,7 @@ func TestPipelineEnrichesAndUpserts(t *testing.T) {
 	}
 	ctrl := gomock.NewController(t)
 	clusterStore := clusterDatastoreMocks.NewMockDataStore(ctrl)
+	clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 	nodeDatastore := nodeDatastoreMocks.NewMockDataStore(ctrl)
 	nodeDatastore.EXPECT().GetNode(gomock.Any(), gomock.Eq("1")).Times(2).Return(&node, true, nil)
 	riskManager := riskManagerMocks.NewMockManager(ctrl)
@@ -81,12 +188,34 @@ func TestPipelineEnrichesAndUpserts(t *testing.T) {
 	}
 }
 
+func TestPipelineSkipsUpsertAfterClusterDeletionBegins(t *testing.T) {
+	t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
+	t.Setenv(features.ScannerV4.EnvVar(), "true")
+
+	ctrl := gomock.NewController(t)
+	node := &storage.Node{Id: "1", Name: "node-name", ClusterId: "cluster-id"}
+	nodeDatastore := nodeDatastoreMocks.NewMockDataStore(ctrl)
+	nodeDatastore.EXPECT().GetNode(gomock.Any(), gomock.Eq(node.GetId())).Return(node, true, nil)
+	enricher := nodesEnricherMocks.NewMockNodeEnricher(ctrl)
+	enricher.EXPECT().EnrichNodeWithVulnerabilities(gomock.Any(), nil, gomock.Any()).Return(nil)
+
+	releaseDeletion := lifecycle.Singleton().BeginDeletion(node.GetClusterId())
+	defer releaseDeletion()
+
+	p := &pipelineImpl{
+		nodeDatastore: nodeDatastore,
+		enricher:      enricher,
+	}
+	require.NoError(t, p.Run(t.Context(), node.GetClusterId(), createMsg(mockIndexReport), nil))
+}
+
 func TestPipelineSendsSensorAndLegacyACKs(t *testing.T) {
 	t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
 	t.Setenv(features.ScannerV4.EnvVar(), "true")
 
 	ctrl := gomock.NewController(t)
 	clusterStore := clusterDatastoreMocks.NewMockDataStore(ctrl)
+	clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 	nodeDatastore := nodeDatastoreMocks.NewMockDataStore(ctrl)
 	riskManager := riskManagerMocks.NewMockManager(ctrl)
 	enricher := nodesEnricherMocks.NewMockNodeEnricher(ctrl)
@@ -143,6 +272,7 @@ func TestPipelineSkipsSensorACKWhenCapabilityMissing(t *testing.T) {
 
 	ctrl := gomock.NewController(t)
 	clusterStore := clusterDatastoreMocks.NewMockDataStore(ctrl)
+	clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 	nodeDatastore := nodeDatastoreMocks.NewMockDataStore(ctrl)
 	riskManager := riskManagerMocks.NewMockManager(ctrl)
 	enricher := nodesEnricherMocks.NewMockNodeEnricher(ctrl)
diff --git a/central/sensor/service/pipeline/nodeindex/three_pipelines_test.go b/central/sensor/service/pipeline/nodeindex/three_pipelines_test.go
index f57672c774c86..069ed968a6fbf 100644
--- a/central/sensor/service/pipeline/nodeindex/three_pipelines_test.go
+++ b/central/sensor/service/pipeline/nodeindex/three_pipelines_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/stackrox/rox/pkg/scancomponent"
 	"github.com/stackrox/rox/pkg/scanners"
 	"github.com/stackrox/rox/pkg/scanners/types"
+	"github.com/stackrox/rox/pkg/testutils"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
@@ -140,13 +141,12 @@ func Test_ThreePipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocksAndEnv: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, false)
 				t.Setenv(features.ScannerV4.EnvVar(), "true")
 				t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
 				gomock.InOrder(
-					// node arrives
+					// node arrives: non-RHCOS with LegacyScanner off upserts UNSUPPORTED and skips Clairify
 					m.clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Eq(clusterID)).Times(1).Return(clusterID, true, nil),
-					m.cveDatastore.EXPECT().EnrichNodeWithSuppressedCVEs(gomock.Any()).Times(1).Return(),
-					m.riskStorage.EXPECT().UpsertRisk(gomock.Any(), gomock.Any()).MinTimes(1).Return(nil),
 					m.nodeDatastore.EXPECT().UpsertNode(gomock.Any(), gomock.Any()).Times(1).Return(nil),
 					// node index arrives
 					m.nodeDatastore.EXPECT().GetNode(gomock.Any(), gomock.Eq(nodeID)).Times(1).Return(nodeWithScore, true, nil),
@@ -175,6 +175,7 @@ func Test_ThreePipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocksAndEnv: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				t.Setenv(features.ScannerV4.EnvVar(), "true")
 				t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
 				gomock.InOrder(
@@ -211,6 +212,7 @@ func Test_ThreePipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocksAndEnv: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				t.Setenv(features.ScannerV4.EnvVar(), "true")
 				t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
 				gomock.InOrder(
@@ -244,6 +246,7 @@ func Test_ThreePipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocksAndEnv: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				t.Setenv(features.ScannerV4.EnvVar(), "false")
 				t.Setenv(features.NodeIndexEnabled.EnvVar(), "false")
 				gomock.InOrder(
@@ -269,6 +272,7 @@ func Test_ThreePipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocksAndEnv: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				t.Setenv(features.ScannerV4.EnvVar(), "true")
 				t.Setenv(features.NodeIndexEnabled.EnvVar(), "true")
 				gomock.InOrder(
@@ -356,6 +360,7 @@ func Test_ThreePipelines_Run(t *testing.T) {
 			if tt.setUpMocksAndEnv != nil {
 				tt.setUpMocksAndEnv(t, tt.mocks)
 			}
+			tt.mocks.clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 			pNode := nodes.NewPipeline(tt.mocks.clusterStore, tt.mocks.nodeDatastore, tt.enricher, tt.riskManager)
 			pNodeInv := nodeinventory.NewPipeline(tt.mocks.clusterStore, tt.mocks.nodeDatastore, tt.enricher, tt.riskManager)
 			pNodeIdx := newPipeline(tt.mocks.clusterStore, tt.mocks.nodeDatastore, tt.enricher, tt.riskManager)
diff --git a/central/sensor/service/pipeline/nodeinventory/pipeline.go b/central/sensor/service/pipeline/nodeinventory/pipeline.go
index cc03d75aaa2d4..f9cfff63913f0 100644
--- a/central/sensor/service/pipeline/nodeinventory/pipeline.go
+++ b/central/sensor/service/pipeline/nodeinventory/pipeline.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/pkg/errors"
 	clusterDataStore "github.com/stackrox/rox/central/cluster/datastore"
+	"github.com/stackrox/rox/central/cluster/lifecycle"
 	"github.com/stackrox/rox/central/enrichment"
 	countMetrics "github.com/stackrox/rox/central/metrics"
 	nodeDatastore "github.com/stackrox/rox/central/node/datastore"
@@ -115,7 +116,7 @@ func (p *pipelineImpl) Run(ctx context.Context, _ string, msg *central.MsgFromSe
 		len(node.GetScan().GetComponents()))
 
 	// Update the whole node in the database with the new and previous information.
-	err = p.riskManager.CalculateRiskAndUpsertNode(node)
+	err = p.calculateRiskAndUpsertNodeIfClusterActive(ctx, node)
 	if err != nil {
 		log.Error(err)
 		return err
@@ -125,6 +126,20 @@ func (p *pipelineImpl) Run(ctx context.Context, _ string, msg *central.MsgFromSe
 	return nil
 }
 
+func (p *pipelineImpl) calculateRiskAndUpsertNodeIfClusterActive(ctx context.Context, node *storage.Node) error {
+	active, release := lifecycle.Singleton().Enter(node.GetClusterId())
+	if !active {
+		return nil
+	}
+	defer release()
+
+	_, exists, err := p.clusterStore.GetClusterName(ctx, node.GetClusterId())
+	if err != nil || !exists {
+		return err
+	}
+	return p.riskManager.CalculateRiskAndUpsertNode(node)
+}
+
 // shouldDiscardMsg returns true if the pipeline should discard an incoming message or false if it should keep processing it.
 func shouldDiscardMsg(node *storage.Node) bool {
 	// In a mixed environment, there might be v2-only clusters, so there is no Scanner v4 scan available for that cluster.
diff --git a/central/sensor/service/pipeline/nodeinventory/pipeline_test.go b/central/sensor/service/pipeline/nodeinventory/pipeline_test.go
index d8741d4c24c88..a6e70ea76acfc 100644
--- a/central/sensor/service/pipeline/nodeinventory/pipeline_test.go
+++ b/central/sensor/service/pipeline/nodeinventory/pipeline_test.go
@@ -83,6 +83,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 		{
 			name: "when event action is CREATE_RESOURCE then do not ignore event",
 			setUp: func(t *testing.T, a *args, m *mocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				node := storage.Node{
 					Id: "test node id",
 				}
@@ -103,6 +104,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 				{Action: central.NodeInventoryACK_ACK},
 			},
 			setUp: func(t *testing.T, a *args, m *mocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				node := storage.Node{
 					Id: "test node id",
 				}
@@ -118,6 +120,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 		{
 			name: "when injector is nil then handle normally and don't panic",
 			setUp: func(t *testing.T, a *args, m *mocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				node := storage.Node{
 					Id: "test node id",
 				}
@@ -134,6 +137,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 			name:                "when event has inventory for unknown node then no ACK should be sent",
 			wantInjectorContain: []*central.NodeInventoryACK{},
 			setUp: func(t *testing.T, a *args, m *mocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				a.msg = createMsg("node1")
 				a.injector = &recordingInjector{}
 				gomock.InOrder(
@@ -146,6 +150,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 			wantInjectorContain: []*central.NodeInventoryACK{},
 			wantErr:             "fetching error from DB",
 			setUp: func(t *testing.T, a *args, m *mocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				a.msg = createMsg("node1")
 				a.injector = &recordingInjector{}
 				gomock.InOrder(
@@ -166,6 +171,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 			if tt.setUp != nil {
 				tt.setUp(t, &tt.args, &tt.mocks)
 			}
+			tt.mocks.clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 			p := &pipelineImpl{
 				clusterStore:  tt.mocks.clusterStore,
 				nodeDatastore: tt.mocks.nodeDatastore,
@@ -188,8 +194,10 @@ func Test_pipelineImpl_Run(t *testing.T) {
 }
 
 func Test_pipelineImpl_Run_SendsSensorAndLegacyACKs(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 	ctrl := gomock.NewController(t)
 	clusterStore := clusterDatastoreMocks.NewMockDataStore(ctrl)
+	clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 	nodeDatastore := nodeDatastoreMocks.NewMockDataStore(ctrl)
 	riskManager := riskManagerMocks.NewMockManager(ctrl)
 	enricher := nodesEnricherMocks.NewMockNodeEnricher(ctrl)
@@ -254,8 +262,10 @@ func Test_pipelineImpl_Run_SendsSensorAndLegacyACKs(t *testing.T) {
 }
 
 func Test_pipelineImpl_Run_SkipsSensorACKWhenCapabilityMissing(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 	ctrl := gomock.NewController(t)
 	clusterStore := clusterDatastoreMocks.NewMockDataStore(ctrl)
+	clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 	nodeDatastore := nodeDatastoreMocks.NewMockDataStore(ctrl)
 	riskManager := riskManagerMocks.NewMockManager(ctrl)
 	enricher := nodesEnricherMocks.NewMockNodeEnricher(ctrl)
diff --git a/central/sensor/service/pipeline/nodeinventory/two_pipelines_test.go b/central/sensor/service/pipeline/nodeinventory/two_pipelines_test.go
index 566793f840382..9f8b72efd5fa8 100644
--- a/central/sensor/service/pipeline/nodeinventory/two_pipelines_test.go
+++ b/central/sensor/service/pipeline/nodeinventory/two_pipelines_test.go
@@ -21,11 +21,13 @@ import (
 	"github.com/stackrox/rox/generated/internalapi/central"
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/metrics"
 	nodeEnricher "github.com/stackrox/rox/pkg/nodes/enricher"
 	"github.com/stackrox/rox/pkg/scancomponent"
 	"github.com/stackrox/rox/pkg/scanners"
 	"github.com/stackrox/rox/pkg/scanners/types"
+	"github.com/stackrox/rox/pkg/testutils"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
@@ -105,6 +107,7 @@ func Test_TwoPipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocks: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				m.nodeDatastore.EXPECT().GetNode(gomock.Any(), gomock.Eq(nodeID)).MinTimes(1).Return(nil, false, nil)
 			},
 			wantNodeExists:        false,
@@ -122,6 +125,7 @@ func Test_TwoPipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocks: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				gomock.InOrder(
 					// node arrives
 					m.clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Eq(clusterID)).Times(1).Return(clusterID, true, nil),
@@ -154,6 +158,7 @@ func Test_TwoPipelines_Run(t *testing.T) {
 				},
 			},
 			setUpMocks: func(t *testing.T, m *usedMocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				gomock.InOrder(
 					// node inventory arrives
 					m.nodeDatastore.EXPECT().GetNode(gomock.Any(), gomock.Eq(nodeID)).Return(nil, false, nil),
@@ -225,6 +230,7 @@ func Test_TwoPipelines_Run(t *testing.T) {
 			if tt.setUpMocks != nil {
 				tt.setUpMocks(t, tt.mocks)
 			}
+			tt.mocks.clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("", true, nil)
 			pNode := nodes.NewPipeline(tt.mocks.clusterStore, tt.mocks.nodeDatastore, tt.enricher, tt.riskManager)
 			pNodeInv := NewPipeline(tt.mocks.clusterStore, tt.mocks.nodeDatastore, tt.enricher, tt.riskManager)
 
diff --git a/central/sensor/service/pipeline/nodes/pipeline.go b/central/sensor/service/pipeline/nodes/pipeline.go
index a59efc0c8cb7f..9bf5a7e053ab4 100644
--- a/central/sensor/service/pipeline/nodes/pipeline.go
+++ b/central/sensor/service/pipeline/nodes/pipeline.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/pkg/errors"
 	clusterDataStore "github.com/stackrox/rox/central/cluster/datastore"
+	"github.com/stackrox/rox/central/cluster/lifecycle"
 	"github.com/stackrox/rox/central/enrichment"
 	countMetrics "github.com/stackrox/rox/central/metrics"
 	nodeDatastore "github.com/stackrox/rox/central/node/datastore"
@@ -103,14 +104,13 @@ func (p *pipelineImpl) Run(ctx context.Context, clusterID string, msg *central.M
 
 	// ROX-22002: Remove invalid null characters in annotations
 	stringutils.SanitizeMapValues(node.GetAnnotations())
-
 	if enricher.SupportsNodeScanning(node) {
 		// If supports node scanning, this pipeline should only update the node's
 		// metadata. We call upsert without scan. Upsert will read scan information from
 		// the database before writing. This is safe because NodeInventory and Node
 		// pipelines never run concurrently by the Sensor Event worker queues.
 		node.Scan = nil
-		if err := p.nodeDatastore.UpsertNode(ctx, node); err != nil {
+		if err := p.upsertNodeIfClusterActive(ctx, clusterID, node); err != nil {
 			err = errors.Wrapf(err, "upserting node %s", nodeDatastore.NodeString(node))
 			log.Error(err)
 			return err
@@ -125,7 +125,7 @@ func (p *pipelineImpl) Run(ctx context.Context, clusterID string, msg *central.M
 			ScanTime: protocompat.TimestampNow(),
 			Notes:    []storage.NodeScan_Note{storage.NodeScan_UNSUPPORTED},
 		}
-		if err := p.nodeDatastore.UpsertNode(ctx, node); err != nil {
+		if err := p.upsertNodeIfClusterActive(ctx, clusterID, node); err != nil {
 			err = errors.Wrapf(err, "upserting node %s", nodeDatastore.NodeString(node))
 			log.Error(err)
 			return err
@@ -139,7 +139,7 @@ func (p *pipelineImpl) Run(ctx context.Context, clusterID string, msg *central.M
 			"risk information will not be updated): %v", nodeDatastore.NodeString(node), err)
 	}
 
-	if err := p.riskManager.CalculateRiskAndUpsertNode(node); err != nil {
+	if err := p.calculateRiskAndUpsertNodeIfClusterActive(ctx, clusterID, node); err != nil {
 		log.Error(err)
 		return err
 	}
@@ -147,4 +147,30 @@ func (p *pipelineImpl) Run(ctx context.Context, clusterID string, msg *central.M
 	return nil
 }
 
+func (p *pipelineImpl) upsertNodeIfClusterActive(ctx context.Context, clusterID string, node *storage.Node) error {
+	return p.withActiveCluster(ctx, clusterID, func() error {
+		return p.nodeDatastore.UpsertNode(ctx, node)
+	})
+}
+
+func (p *pipelineImpl) calculateRiskAndUpsertNodeIfClusterActive(ctx context.Context, clusterID string, node *storage.Node) error {
+	return p.withActiveCluster(ctx, clusterID, func() error {
+		return p.riskManager.CalculateRiskAndUpsertNode(node)
+	})
+}
+
+func (p *pipelineImpl) withActiveCluster(ctx context.Context, clusterID string, write func() error) error {
+	active, release := lifecycle.Singleton().Enter(clusterID)
+	if !active {
+		return nil
+	}
+	defer release()
+
+	_, exists, err := p.clusterStore.GetClusterName(ctx, clusterID)
+	if err != nil || !exists {
+		return err
+	}
+	return write()
+}
+
 func (p *pipelineImpl) OnFinish(_ string) {}
diff --git a/central/sensor/service/pipeline/nodes/pipeline_test.go b/central/sensor/service/pipeline/nodes/pipeline_test.go
index d9f1dfb13b602..c673578f9288b 100644
--- a/central/sensor/service/pipeline/nodes/pipeline_test.go
+++ b/central/sensor/service/pipeline/nodes/pipeline_test.go
@@ -77,6 +77,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 		{
 			name: "when node is not full host scanned then enrich and upsert with risk",
 			setUp: func(t *testing.T, a *args, m *mocks) {
+				testutils.MustUpdateFeature(t, features.LegacyScanner, true)
 				a.msg = createMsg("Something that is not RHCOS")
 				a.clusterID = "test cluster id"
 				gomock.InOrder(
@@ -132,6 +133,7 @@ func Test_pipelineImpl_Run(t *testing.T) {
 			if tt.setUp != nil {
 				tt.setUp(t, &tt.args, &tt.mocks)
 			}
+			tt.mocks.clusterStore.EXPECT().GetClusterName(gomock.Any(), gomock.Any()).AnyTimes().Return("test cluster name", true, nil)
 			p := &pipelineImpl{
 				clusterStore:  tt.mocks.clusterStore,
 				nodeDatastore: tt.mocks.nodeDatastore,
diff --git a/central/sensor/service/pipeline/virtualmachineindex/pipeline.go b/central/sensor/service/pipeline/virtualmachineindex/pipeline.go
index 51d4b8524ffb2..e11ebef4f189d 100644
--- a/central/sensor/service/pipeline/virtualmachineindex/pipeline.go
+++ b/central/sensor/service/pipeline/virtualmachineindex/pipeline.go
@@ -64,7 +64,12 @@ type pipelineImpl struct {
 
 func (p *pipelineImpl) OnFinish(string) {}
 
+// Capabilities omits VirtualMachinesSupported when ROX_VIRTUAL_MACHINES is
+// off so Sensor treats this Central like a pre-VM build.
 func (p *pipelineImpl) Capabilities() []centralsensor.CentralCapability {
+	if !features.VirtualMachines.Enabled() {
+		return nil
+	}
 	return []centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported}
 }
 
@@ -205,6 +210,8 @@ func (p *pipelineImpl) storeV2Scan(ctx context.Context, clusterID string, vm *st
 	return nil
 }
 
+// lookupGuestOS returns facts["guestOS"] so scan identity stays on the KubeVirt
+// family name rather than the versioned display string in guest_os.
 func (p *pipelineImpl) lookupGuestOS(ctx context.Context, vmID string) string {
 	if features.VirtualMachinesEnhancedDataModel.Enabled() {
 		vm, found, err := p.virtualMachineV2Store.GetVirtualMachine(ctx, vmID)
@@ -215,7 +222,7 @@ func (p *pipelineImpl) lookupGuestOS(ctx context.Context, vmID string) string {
 		if !found {
 			return ""
 		}
-		return vm.GetGuestOs()
+		return vm.GetFacts()[pkgVM.GuestOSKey]
 	}
 	vm, found, err := p.virtualMachineStore.GetVirtualMachine(ctx, vmID)
 	if err != nil {
diff --git a/central/sensor/service/pipeline/virtualmachineindex/pipeline_test.go b/central/sensor/service/pipeline/virtualmachineindex/pipeline_test.go
index b5f79480458d9..e5bfdbca75e8c 100644
--- a/central/sensor/service/pipeline/virtualmachineindex/pipeline_test.go
+++ b/central/sensor/service/pipeline/virtualmachineindex/pipeline_test.go
@@ -2,6 +2,7 @@ package virtualmachineindex
 
 import (
 	"context"
+	"strconv"
 	"testing"
 
 	"github.com/pkg/errors"
@@ -158,8 +159,25 @@ func (suite *PipelineTestSuite) TestRun_UpdateScanError() {
 }
 
 func (suite *PipelineTestSuite) TestCapabilities() {
-	capabilities := suite.pipeline.Capabilities()
-	suite.Contains(capabilities, centralsensor.CentralCapability(centralsensor.VirtualMachinesSupported))
+	cases := map[string]struct {
+		enabled bool
+		want    []centralsensor.CentralCapability
+	}{
+		"flag on advertises VirtualMachinesSupported": {
+			enabled: true,
+			want:    []centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported},
+		},
+		"flag off advertises nothing": {
+			enabled: false,
+			want:    nil,
+		},
+	}
+	for name, tc := range cases {
+		suite.Run(name, func() {
+			suite.T().Setenv(features.VirtualMachines.EnvVar(), strconv.FormatBool(tc.enabled))
+			suite.Equal(tc.want, suite.pipeline.Capabilities())
+		})
+	}
 }
 
 func (suite *PipelineTestSuite) TestOnFinish() {
@@ -873,9 +891,21 @@ func TestLookupGuestOS(t *testing.T) {
 		},
 		"v2 guest OS populates scan": {
 			v2Enabled: true,
-			v2VM:      &storage.VirtualMachineV2{GuestOs: "Red Hat Enterprise Linux 9"},
-			v2Found:   true,
-			wantOS:    "Red Hat Enterprise Linux 9",
+			v2VM: &storage.VirtualMachineV2{
+				GuestOs: "Red Hat Enterprise Linux 9",
+				Facts:   map[string]string{pkgVM.GuestOSKey: "Red Hat Enterprise Linux 9"},
+			},
+			v2Found: true,
+			wantOS:  "Red Hat Enterprise Linux 9",
+		},
+		"v2 stamps scan from informer fact not display column": {
+			v2Enabled: true,
+			v2VM: &storage.VirtualMachineV2{
+				GuestOs: "Red Hat Enterprise Linux 9.2",
+				Facts:   map[string]string{pkgVM.GuestOSKey: "Red Hat Enterprise Linux"},
+			},
+			v2Found: true,
+			wantOS:  "Red Hat Enterprise Linux",
 		},
 		"v1 VM not found leaves scan OS empty": {
 			v1Found: false,
@@ -895,9 +925,12 @@ func TestLookupGuestOS(t *testing.T) {
 		},
 		"v2 unknown guest OS leaves scan OS empty": {
 			v2Enabled: true,
-			v2VM:      &storage.VirtualMachineV2{GuestOs: pkgVM.UnknownGuestOS},
-			v2Found:   true,
-			wantOS:    "",
+			v2VM: &storage.VirtualMachineV2{
+				GuestOs: pkgVM.UnknownGuestOS,
+				Facts:   map[string]string{pkgVM.GuestOSKey: pkgVM.UnknownGuestOS},
+			},
+			v2Found: true,
+			wantOS:  "",
 		},
 		"v1 store error leaves scan OS empty": {
 			v1Err:  errors.New("db error"),
diff --git a/central/sensor/service/pipeline/virtualmachines/pipeline.go b/central/sensor/service/pipeline/virtualmachines/pipeline.go
index 400a1506c1de2..3418898057a11 100644
--- a/central/sensor/service/pipeline/virtualmachines/pipeline.go
+++ b/central/sensor/service/pipeline/virtualmachines/pipeline.go
@@ -52,7 +52,12 @@ type pipelineImpl struct {
 
 func (p *pipelineImpl) OnFinish(_ string) {}
 
+// Capabilities omits VirtualMachinesSupported when ROX_VIRTUAL_MACHINES is
+// off so Sensor treats this Central like a pre-VM build.
 func (p *pipelineImpl) Capabilities() []centralsensor.CentralCapability {
+	if !features.VirtualMachines.Enabled() {
+		return nil
+	}
 	return []centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported}
 }
 
@@ -61,6 +66,10 @@ func (p *pipelineImpl) Match(msg *central.MsgFromSensor) bool {
 }
 
 func (p *pipelineImpl) Reconcile(ctx context.Context, clusterID string, storeMap *reconciliation.StoreMap) error {
+	if !features.VirtualMachines.Enabled() {
+		// An empty Sensor snapshot would otherwise delete every VM row for the cluster.
+		return nil
+	}
 	if features.VirtualMachinesEnhancedDataModel.Enabled() {
 		return p.reconcileV2(ctx, clusterID, storeMap)
 	}
@@ -102,6 +111,11 @@ func (p *pipelineImpl) reconcileV2(ctx context.Context, clusterID string, storeM
 func (p *pipelineImpl) Run(ctx context.Context, clusterID string, msg *central.MsgFromSensor, _ common.MessageInjector) error {
 	defer countMetrics.IncrementResourceProcessedCounter(pipeline.ActionToOperation(msg.GetEvent().GetAction()), metrics.VirtualMachine)
 
+	if !features.VirtualMachines.Enabled() {
+		// Returning nil avoids Sensor retries; the rows stay untouched.
+		return nil
+	}
+
 	event := msg.GetEvent()
 	virtualMachine := event.GetVirtualMachine()
 	if virtualMachine == nil {
diff --git a/central/sensor/service/pipeline/virtualmachines/pipeline_test.go b/central/sensor/service/pipeline/virtualmachines/pipeline_test.go
index f263cc97abd0a..98edf66f1dba2 100644
--- a/central/sensor/service/pipeline/virtualmachines/pipeline_test.go
+++ b/central/sensor/service/pipeline/virtualmachines/pipeline_test.go
@@ -1,6 +1,7 @@
 package virtualmachines
 
 import (
+	"strconv"
 	"testing"
 
 	clusterDSMocks "github.com/stackrox/rox/central/cluster/datastore/mocks"
@@ -24,11 +25,25 @@ import (
 
 func TestCapabilities(t *testing.T) {
 	pipeline := &pipelineImpl{}
-	assert.ElementsMatch(
-		t,
-		[]centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported},
-		pipeline.Capabilities(),
-	)
+	cases := map[string]struct {
+		enabled bool
+		want    []centralsensor.CentralCapability
+	}{
+		"flag on advertises VirtualMachinesSupported": {
+			enabled: true,
+			want:    []centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported},
+		},
+		"flag off advertises nothing": {
+			enabled: false,
+			want:    nil,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(features.VirtualMachines.EnvVar(), strconv.FormatBool(tc.enabled))
+			assert.Equal(t, tc.want, pipeline.Capabilities())
+		})
+	}
 }
 
 func TestMatch(t *testing.T) {
@@ -285,6 +300,62 @@ func TestPipelineReconcile(t *testing.T) {
 	}
 }
 
+func TestPipelineRun_FeatureDisabledDoesNotWrite(t *testing.T) {
+	t.Setenv(features.VirtualMachines.EnvVar(), "false")
+	testClusterID := fixtureconsts.Cluster1
+	upsertTestVM := &virtualMachineV1.VirtualMachine{
+		Id:        uuid.NewTestUUID(1).String(),
+		Namespace: "test-namespace",
+		Name:      "test-virtual-machine",
+		ClusterId: testClusterID,
+	}
+	msgs := map[string]*central.MsgFromSensor{
+		"create": getVirtualMachineAdditionMessage(upsertTestVM),
+		"remove": getVirtualMachineRemovalMessage("removed_vm_id"),
+	}
+	models := map[string]bool{
+		"v1": false,
+		"v2": true,
+	}
+	for model, enhanced := range models {
+		t.Run(model, func(t *testing.T) {
+			t.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), strconv.FormatBool(enhanced))
+			for name, msg := range msgs {
+				t.Run(name, func(t *testing.T) {
+					mockCtrl := gomock.NewController(t)
+					pipeline := newPipeline(
+						clusterDSMocks.NewMockDataStore(mockCtrl),
+						virtualMachineDSMocks.NewMockDataStore(mockCtrl),
+						virtualMachineV2DSMocks.NewMockDataStore(mockCtrl),
+					)
+					assert.NoError(t, pipeline.Run(t.Context(), testClusterID, msg, nil))
+				})
+			}
+		})
+	}
+}
+
+func TestPipelineReconcile_FeatureDisabledDoesNotDelete(t *testing.T) {
+	t.Setenv(features.VirtualMachines.EnvVar(), "false")
+	testClusterID := fixtureconsts.Cluster1
+	cases := map[string]bool{
+		"v1": false,
+		"v2": true,
+	}
+	for name, enhanced := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), strconv.FormatBool(enhanced))
+			mockCtrl := gomock.NewController(t)
+			pipeline := newPipeline(
+				nil,
+				virtualMachineDSMocks.NewMockDataStore(mockCtrl),
+				virtualMachineV2DSMocks.NewMockDataStore(mockCtrl),
+			)
+			assert.NoError(t, pipeline.Reconcile(t.Context(), testClusterID, reconciliation.NewStoreMap()))
+		})
+	}
+}
+
 func TestPipelineRunV2(t *testing.T) {
 	t.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), "true")
 	testClusterID := fixtureconsts.Cluster1
diff --git a/central/signatureintegration/datastore/key_bundle.go b/central/signatureintegration/datastore/key_bundle.go
index 1f896f4d2f4dc..1a1d22e7417e8 100644
--- a/central/signatureintegration/datastore/key_bundle.go
+++ b/central/signatureintegration/datastore/key_bundle.go
@@ -2,8 +2,6 @@ package datastore
 
 import (
 	"context"
-	"os"
-	"path/filepath"
 	"strings"
 
 	"github.com/stackrox/rox/central/signatureintegration/store"
@@ -15,25 +13,6 @@ import (
 
 var redHatKeyBundlePath = signatures.RedHatKeyBundlePath()
 
-// ensureKeyBundleDirectory creates the directory where the watcher and
-// downloader expect to find bundle.json.
-func ensureKeyBundleDirectory() {
-	dir := filepath.Dir(redHatKeyBundlePath)
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		log.Warnf("Failed to create key bundle directory %q: %v", dir, err)
-	}
-}
-
-// writeExampleBundle writes bundle.example.json so offline-mode customers can
-// see the expected format without consulting docs.
-func writeExampleBundle() {
-	dir := filepath.Dir(redHatKeyBundlePath)
-	examplePath := filepath.Join(dir, "bundle.example.json")
-	if err := os.WriteFile(examplePath, signatures.DefaultBundleJSON(), 0600); err != nil {
-		log.Warnf("Failed to write example bundle to %q: %v", examplePath, err)
-	}
-}
-
 func keyBundleHandler(siStore store.SignatureIntegrationStore) filewatcher.Handler {
 	return func(data []byte) error {
 		bundle, err := signatures.ParseKeyBundle(data)
diff --git a/central/signatureintegration/datastore/singleton.go b/central/signatureintegration/datastore/singleton.go
index 6a4a5946478ff..df754ee696b46 100644
--- a/central/signatureintegration/datastore/singleton.go
+++ b/central/signatureintegration/datastore/singleton.go
@@ -71,7 +71,7 @@ func startKeyBundleUpdater() {
 
 	rawURL := env.RedHatSigningKeyBundleURL.Setting()
 	if rawURL == "" {
-		log.Info("ROX_REDHAT_SIGNING_KEY_BUNDLE_URL not set, key bundle updater will not start")
+		log.Info("ROX_REDHAT_SIGNING_KEY_BUNDLE_URL is empty, key bundle updater will not start")
 		return
 	}
 	bundleURL := urlfmt.FormatURL(rawURL, urlfmt.HTTPS, urlfmt.HonorInputSlash)
@@ -104,8 +104,6 @@ func Singleton() DataStore {
 	once.Do(func() {
 		storage := pgStore.New(globaldb.GetPostgres())
 		seedRedHatDefaultSignatureIntegration(storage) // must run before watcher; bundle file takes precedence on first tick
-		ensureKeyBundleDirectory()
-		writeExampleBundle()
 		instance = New(storage, policyDataStore.Singleton())
 		startKeyBundleWatcher(storage)
 		startKeyBundleUpdater()
diff --git a/central/signatureintegration/datastore/singleton_test.go b/central/signatureintegration/datastore/singleton_test.go
index f2e30835c06cb..9cde281672c82 100644
--- a/central/signatureintegration/datastore/singleton_test.go
+++ b/central/signatureintegration/datastore/singleton_test.go
@@ -1,15 +1,12 @@
 package datastore
 
 import (
-	"os"
-	"path/filepath"
 	"testing"
 
 	storeMocks "github.com/stackrox/rox/central/signatureintegration/store/mocks"
 	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/signatures"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
 )
 
@@ -34,34 +31,6 @@ func TestSeedSubsequentStartup(t *testing.T) {
 	seedRedHatDefaultSignatureIntegration(mockStore)
 }
 
-func TestEnsureKeyBundleDirectory(t *testing.T) {
-	dir := t.TempDir()
-	old := redHatKeyBundlePath
-	redHatKeyBundlePath = filepath.Join(dir, "subdir", "bundle.json")
-	t.Cleanup(func() { redHatKeyBundlePath = old })
-
-	ensureKeyBundleDirectory()
-
-	_, err := os.Stat(filepath.Join(dir, "subdir"))
-	require.NoError(t, err, "directory should be created")
-}
-
-func TestWriteExampleBundle(t *testing.T) {
-	dir := t.TempDir()
-	old := redHatKeyBundlePath
-	redHatKeyBundlePath = filepath.Join(dir, "bundle.json")
-	t.Cleanup(func() { redHatKeyBundlePath = old })
-
-	writeExampleBundle()
-
-	data, err := os.ReadFile(filepath.Join(dir, "bundle.example.json"))
-	require.NoError(t, err, "example bundle should be written")
-
-	bundle, err := signatures.ParseKeyBundle(data)
-	require.NoError(t, err, "example bundle must be valid")
-	assert.NotEmpty(t, bundle.CosignKeys, "example bundle must contain cosign keys")
-}
-
 func TestStartKeyBundleUpdaterOfflineMode(t *testing.T) {
 	t.Setenv(env.OfflineModeEnv.EnvVar(), "true")
 	t.Setenv(env.RedHatSigningKeyBundleURL.EnvVar(), "https://example.com/keys.json")
diff --git a/central/splunk/violations_test.go b/central/splunk/violations_test.go
index a5c7baa7fd128..6a6397caddd3a 100644
--- a/central/splunk/violations_test.go
+++ b/central/splunk/violations_test.go
@@ -53,19 +53,17 @@ var (
 			},
 			LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_BUILD, storage.LifecycleStage_DEPLOY},
 			Exclusions: []*storage.Exclusion{{
-				Name: "Don't alert on kube-system namespace",
-				Deployment: &storage.Exclusion_Deployment{
+				Name: "Don't alert on kube-system namespace", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
 					Scope: &storage.Scope{
 						Namespace: "kube-system",
 					},
-				},
+				}},
 			}, {
-				Name: "Don't alert on istio-system namespace",
-				Deployment: &storage.Exclusion_Deployment{
+				Name: "Don't alert on istio-system namespace", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
 					Scope: &storage.Scope{
 						Namespace: "istio-system",
 					},
-				},
+				}},
 			}},
 			Severity:           storage.Severity_LOW_SEVERITY,
 			SORTName:           "90-Day Image Age",
diff --git a/central/tlsconfig/openshift_tls.go b/central/tlsconfig/openshift_tls.go
index 1fbb703e21039..8e35aa9bfe869 100644
--- a/central/tlsconfig/openshift_tls.go
+++ b/central/tlsconfig/openshift_tls.go
@@ -16,6 +16,9 @@ func OpenShiftTLSConfigured() bool {
 		return false
 	}
 	exists, err := fileutils.Exists(env.OpenShiftTLSCertDir.Setting())
+	if err != nil {
+		log.Warnf("Cannot check OpenShift TLS certificate directory %s: %v", env.OpenShiftTLSCertDir.Setting(), err)
+	}
 	return exists && err == nil
 }
 
diff --git a/central/views/imagecve/view_test.go b/central/views/imagecve/view_test.go
index 763c76025f315..242d64f29703f 100644
--- a/central/views/imagecve/view_test.go
+++ b/central/views/imagecve/view_test.go
@@ -1263,6 +1263,63 @@ func standardizeImages(images ...*storage.Image) {
 	}
 }
 
+// TestImageCVECountFiltering verifies that "Image CVE Count > 0" doesn't drop any
+// CVEs from ImageCVEView results when the underlying data is healthy (see ROX-36389
+// for background on this field, including a case where it isn't).
+func (s *ImageCVEViewTestSuite) TestImageCVECountFiltering() {
+	if !features.FlattenImageData.Enabled() {
+		s.T().Skip("Image CVE Count only maps to images_v2.ScanStats.CveCount when FlattenImageData is enabled")
+	}
+
+	ctx := s.suiteCtx
+
+	imageV2Store := imageV2DS.GetTestPostgresDataStore(s.T(), s.testDB.DB)
+	zeroCveImage := &storage.ImageV2{
+		Id:     imageUtils.NewImageV2ID(&storage.ImageName{Registry: "reg-zero", FullName: "reg-zero"}, "sha-zero"),
+		Digest: "sha-zero",
+		Name:   &storage.ImageName{Registry: "reg-zero", FullName: "reg-zero"},
+		Scan: &storage.ImageScan{
+			OperatingSystem: "zero-os",
+			Components:      []*storage.EmbeddedImageScanComponent{},
+		},
+	}
+	s.Require().NoError(imageV2Store.UpsertImage(ctx, zeroCveImage))
+	actualZeroCve, found, err := imageV2Store.GetImage(ctx, zeroCveImage.GetId())
+	s.Require().NoError(err)
+	s.Require().True(found)
+	s.Require().Equal(int32(0), actualZeroCve.GetScanStats().GetCveCount())
+
+	noFilterQuery := search.EmptyQuery()
+	filteredQuery := search.NewQueryBuilder().AddStrings(search.ImageCVECount, ">0").ProtoQuery()
+
+	noFilterCount, err := s.cveView.Count(ctx, noFilterQuery)
+	s.Require().NoError(err)
+	filteredCount, err := s.cveView.Count(ctx, filteredQuery)
+	s.Require().NoError(err)
+
+	s.T().Logf("ImageCVEView.Count() with no filter: %d; with 'Image CVE Count > 0': %d", noFilterCount, filteredCount)
+
+	s.Equal(noFilterCount, filteredCount,
+		"expected 'Image CVE Count > 0' to be a no-op on the CVE count")
+
+	noFilterResults, err := s.cveView.Get(ctx, noFilterQuery, views.ReadOptions{})
+	s.Require().NoError(err)
+	filteredResults, err := s.cveView.Get(ctx, filteredQuery, views.ReadOptions{})
+	s.Require().NoError(err)
+
+	getCVESet := func(results []CveCore) []string {
+		ids := make([]string, 0, len(results))
+		for _, r := range results {
+			ids = append(ids, r.GetCVE())
+		}
+		slices.Sort(ids)
+		return ids
+	}
+
+	s.Equal(getCVESet(noFilterResults), getCVESet(filteredResults),
+		"expected the exact same set of CVEs to be returned with and without the 'Image CVE Count > 0' filter")
+}
+
 func TestImageCVEUnknownSeverity(t *testing.T) {
 	ctx := sac.WithAllAccess(context.Background())
 	testDB := pgtest.ForT(t)
diff --git a/central/views/images/view_test.go b/central/views/images/view_test.go
index b4a8410acbdeb..741970fec5c1e 100644
--- a/central/views/images/view_test.go
+++ b/central/views/images/view_test.go
@@ -85,6 +85,8 @@ type ImageViewTestSuite struct {
 	testImagesMap   map[string]*storage.Image
 	testImagesV2Map map[string]*storage.ImageV2
 	scopeToImageIDs map[string]set.StringSet
+	// zeroCveImageID is used by TestImageCVECountFiltering.
+	zeroCveImageID string
 }
 
 func (s *ImageViewTestSuite) SetupSuite() {
@@ -114,6 +116,15 @@ func (s *ImageViewTestSuite) SetupSuite() {
 			s.testImagesV2Map[actual.GetId()] = image
 		}
 
+		// For TestImageCVECountFiltering.
+		zeroCveImageV2 := utils.ConvertToV2(zeroCveTestImage())
+		s.Require().NoError(imageStore.UpsertImage(ctx, zeroCveImageV2))
+		actualZeroCve, found, err := imageStore.GetImage(ctx, zeroCveImageV2.GetId())
+		s.Require().NoError(err)
+		s.Require().True(found)
+		s.zeroCveImageID = actualZeroCve.GetId()
+		s.testImagesV2Map[s.zeroCveImageID] = zeroCveImageV2
+
 		s.imagesView = NewImageView(s.testDB.DB)
 
 		deployments := []*storage.Deployment{
@@ -167,6 +178,15 @@ func (s *ImageViewTestSuite) SetupSuite() {
 			s.testImagesMap[actual.GetId()] = actual
 		}
 
+		// For TestImageCVECountFiltering.
+		zeroCveImage := zeroCveTestImage()
+		s.Require().NoError(imageStore.UpsertImage(ctx, zeroCveImage))
+		actualZeroCve, found, err := imageStore.GetImage(ctx, zeroCveImage.GetId())
+		s.Require().NoError(err)
+		s.Require().True(found)
+		s.zeroCveImageID = actualZeroCve.GetId()
+		s.testImagesMap[s.zeroCveImageID] = actualZeroCve
+
 		s.imagesView = NewImageView(s.testDB.DB)
 
 		deployments := []*storage.Deployment{
@@ -486,6 +506,24 @@ func (s *ImageViewTestSuite) TestGetImagesCore() {
 	}
 }
 
+// TestImageCVECountFiltering verifies that "Image CVE Count > 0" excludes zero-CVE
+// images from ImageView results (see ROX-36389 for background on this field).
+func (s *ImageViewTestSuite) TestImageCVECountFiltering() {
+	ctx := sac.WithAllAccess(context.Background())
+
+	query := search.NewQueryBuilder().AddStrings(search.ImageCVECount, ">0").ProtoQuery()
+	cores, err := s.imagesView.Get(ctx, query)
+	s.Require().NoError(err)
+
+	ids := make([]string, 0, len(cores))
+	for _, c := range cores {
+		ids = append(ids, c.GetImageID())
+	}
+
+	s.NotContains(ids, s.zeroCveImageID, "expected the 0-CVE image to be excluded by 'Image CVE Count > 0'")
+	s.NotEmpty(ids, "expected images with CVEs to still be returned")
+}
+
 func (s *ImageViewTestSuite) compileExpected(filter *filterImpl, less lessFunc, hasVulnFilters, hasSortBySeverityCounts bool) []ImageCore {
 	expected := make([]*imageResponse, 0)
 	if features.FlattenImageData.Enabled() {
@@ -814,3 +852,20 @@ func testImages() []*storage.Image {
 	}
 	return []*storage.Image{img1, img2, img3, img4}
 }
+
+func zeroCveTestImage() *storage.Image {
+	return &storage.Image{
+		Id: "sha5",
+		Name: &storage.ImageName{
+			Registry: "reg5",
+			Remote:   "img5",
+			Tag:      "tag5",
+			FullName: "reg5/img5:tag5",
+		},
+		RiskScore: 1,
+		Scan: &storage.ImageScan{
+			OperatingSystem: "os5",
+			Components:      []*storage.EmbeddedImageScanComponent{},
+		},
+	}
+}
diff --git a/central/views/vmcve/db_response.go b/central/views/vmcve/db_response.go
index 76ebcf0f9bd7c..60570311ab830 100644
--- a/central/views/vmcve/db_response.go
+++ b/central/views/vmcve/db_response.go
@@ -121,6 +121,31 @@ func (r *resourceCountByFixability) GetFixable() int {
 	return r.fixable
 }
 
+type cveForVMResponse struct {
+	CVE                    string     `db:"cve"`
+	MaxSeverity            int32      `db:"severity_max"`
+	FixableCount           int        `db:"fixable_count"`
+	MaxCVSS                float32    `db:"cvss_max"`
+	MaxNVDCVSS             float32    `db:"nvd_cvss_max"`
+	EPSSProbabilityMax     *float32   `db:"epss_probability_max"`
+	AffectedComponentCount int        `db:"component_id_count"`
+	Published              *time.Time `db:"cve_published_on_min"`
+}
+
+func (r *cveForVMResponse) GetCVE() string                 { return r.CVE }
+func (r *cveForVMResponse) GetMaxSeverity() int32          { return r.MaxSeverity }
+func (r *cveForVMResponse) GetIsFixable() bool             { return r.FixableCount > 0 }
+func (r *cveForVMResponse) GetMaxCVSS() float32            { return r.MaxCVSS }
+func (r *cveForVMResponse) GetMaxNVDCVSS() float32         { return r.MaxNVDCVSS }
+func (r *cveForVMResponse) GetAffectedComponentCount() int { return r.AffectedComponentCount }
+func (r *cveForVMResponse) GetPublishDate() *time.Time     { return r.Published }
+func (r *cveForVMResponse) GetEPSSProbability() float32 {
+	if r.EPSSProbabilityMax == nil {
+		return 0
+	}
+	return *r.EPSSProbabilityMax
+}
+
 type cveComponentResponse struct {
 	ComponentName    string `db:"component"`
 	ComponentVersion string `db:"component_version"`
diff --git a/central/views/vmcve/mocks/types.go b/central/views/vmcve/mocks/types.go
index 035a11df50a7c..f370a8f81b349 100644
--- a/central/views/vmcve/mocks/types.go
+++ b/central/views/vmcve/mocks/types.go
@@ -17,6 +17,7 @@ import (
 	common "github.com/stackrox/rox/central/views/common"
 	vmcve "github.com/stackrox/rox/central/views/vmcve"
 	v1 "github.com/stackrox/rox/generated/api/v1"
+	search "github.com/stackrox/rox/pkg/search"
 	gomock "go.uber.org/mock/gomock"
 )
 
@@ -305,18 +306,18 @@ func (mr *MockCveViewMockRecorder) CountAffectedVMs(ctx, q any) *gomock.Call {
 }
 
 // CountBySeverity mocks base method.
-func (m *MockCveView) CountBySeverity(ctx context.Context, q *v1.Query) (common.ResourceCountByCVESeverity, error) {
+func (m *MockCveView) CountBySeverity(ctx context.Context, q *v1.Query, countOn search.FieldLabel) (common.ResourceCountByCVESeverity, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountBySeverity", ctx, q)
+	ret := m.ctrl.Call(m, "CountBySeverity", ctx, q, countOn)
 	ret0, _ := ret[0].(common.ResourceCountByCVESeverity)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // CountBySeverity indicates an expected call of CountBySeverity.
-func (mr *MockCveViewMockRecorder) CountBySeverity(ctx, q any) *gomock.Call {
+func (mr *MockCveViewMockRecorder) CountBySeverity(ctx, q, countOn any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountBySeverity", reflect.TypeOf((*MockCveView)(nil).CountBySeverity), ctx, q)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountBySeverity", reflect.TypeOf((*MockCveView)(nil).CountBySeverity), ctx, q, countOn)
 }
 
 // CountBySeverityPerVM mocks base method.
@@ -379,6 +380,21 @@ func (mr *MockCveViewMockRecorder) GetCVEComponents(ctx, q any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCVEComponents", reflect.TypeOf((*MockCveView)(nil).GetCVEComponents), ctx, q)
 }
 
+// GetCVEsForVM mocks base method.
+func (m *MockCveView) GetCVEsForVM(ctx context.Context, q *v1.Query) ([]vmcve.CVEForVMCore, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetCVEsForVM", ctx, q)
+	ret0, _ := ret[0].([]vmcve.CVEForVMCore)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetCVEsForVM indicates an expected call of GetCVEsForVM.
+func (mr *MockCveViewMockRecorder) GetCVEsForVM(ctx, q any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCVEsForVM", reflect.TypeOf((*MockCveView)(nil).GetCVEsForVM), ctx, q)
+}
+
 // GetVMIDs mocks base method.
 func (m *MockCveView) GetVMIDs(ctx context.Context, q *v1.Query) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -394,6 +410,142 @@ func (mr *MockCveViewMockRecorder) GetVMIDs(ctx, q any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetVMIDs", reflect.TypeOf((*MockCveView)(nil).GetVMIDs), ctx, q)
 }
 
+// MockCVEForVMCore is a mock of CVEForVMCore interface.
+type MockCVEForVMCore struct {
+	ctrl     *gomock.Controller
+	recorder *MockCVEForVMCoreMockRecorder
+	isgomock struct{}
+}
+
+// MockCVEForVMCoreMockRecorder is the mock recorder for MockCVEForVMCore.
+type MockCVEForVMCoreMockRecorder struct {
+	mock *MockCVEForVMCore
+}
+
+// NewMockCVEForVMCore creates a new mock instance.
+func NewMockCVEForVMCore(ctrl *gomock.Controller) *MockCVEForVMCore {
+	mock := &MockCVEForVMCore{ctrl: ctrl}
+	mock.recorder = &MockCVEForVMCoreMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockCVEForVMCore) EXPECT() *MockCVEForVMCoreMockRecorder {
+	return m.recorder
+}
+
+// GetAffectedComponentCount mocks base method.
+func (m *MockCVEForVMCore) GetAffectedComponentCount() int {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAffectedComponentCount")
+	ret0, _ := ret[0].(int)
+	return ret0
+}
+
+// GetAffectedComponentCount indicates an expected call of GetAffectedComponentCount.
+func (mr *MockCVEForVMCoreMockRecorder) GetAffectedComponentCount() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAffectedComponentCount", reflect.TypeOf((*MockCVEForVMCore)(nil).GetAffectedComponentCount))
+}
+
+// GetCVE mocks base method.
+func (m *MockCVEForVMCore) GetCVE() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetCVE")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// GetCVE indicates an expected call of GetCVE.
+func (mr *MockCVEForVMCoreMockRecorder) GetCVE() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCVE", reflect.TypeOf((*MockCVEForVMCore)(nil).GetCVE))
+}
+
+// GetEPSSProbability mocks base method.
+func (m *MockCVEForVMCore) GetEPSSProbability() float32 {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetEPSSProbability")
+	ret0, _ := ret[0].(float32)
+	return ret0
+}
+
+// GetEPSSProbability indicates an expected call of GetEPSSProbability.
+func (mr *MockCVEForVMCoreMockRecorder) GetEPSSProbability() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEPSSProbability", reflect.TypeOf((*MockCVEForVMCore)(nil).GetEPSSProbability))
+}
+
+// GetIsFixable mocks base method.
+func (m *MockCVEForVMCore) GetIsFixable() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetIsFixable")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// GetIsFixable indicates an expected call of GetIsFixable.
+func (mr *MockCVEForVMCoreMockRecorder) GetIsFixable() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetIsFixable", reflect.TypeOf((*MockCVEForVMCore)(nil).GetIsFixable))
+}
+
+// GetMaxCVSS mocks base method.
+func (m *MockCVEForVMCore) GetMaxCVSS() float32 {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetMaxCVSS")
+	ret0, _ := ret[0].(float32)
+	return ret0
+}
+
+// GetMaxCVSS indicates an expected call of GetMaxCVSS.
+func (mr *MockCVEForVMCoreMockRecorder) GetMaxCVSS() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetMaxCVSS", reflect.TypeOf((*MockCVEForVMCore)(nil).GetMaxCVSS))
+}
+
+// GetMaxNVDCVSS mocks base method.
+func (m *MockCVEForVMCore) GetMaxNVDCVSS() float32 {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetMaxNVDCVSS")
+	ret0, _ := ret[0].(float32)
+	return ret0
+}
+
+// GetMaxNVDCVSS indicates an expected call of GetMaxNVDCVSS.
+func (mr *MockCVEForVMCoreMockRecorder) GetMaxNVDCVSS() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetMaxNVDCVSS", reflect.TypeOf((*MockCVEForVMCore)(nil).GetMaxNVDCVSS))
+}
+
+// GetMaxSeverity mocks base method.
+func (m *MockCVEForVMCore) GetMaxSeverity() int32 {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetMaxSeverity")
+	ret0, _ := ret[0].(int32)
+	return ret0
+}
+
+// GetMaxSeverity indicates an expected call of GetMaxSeverity.
+func (mr *MockCVEForVMCoreMockRecorder) GetMaxSeverity() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetMaxSeverity", reflect.TypeOf((*MockCVEForVMCore)(nil).GetMaxSeverity))
+}
+
+// GetPublishDate mocks base method.
+func (m *MockCVEForVMCore) GetPublishDate() *time.Time {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPublishDate")
+	ret0, _ := ret[0].(*time.Time)
+	return ret0
+}
+
+// GetPublishDate indicates an expected call of GetPublishDate.
+func (mr *MockCVEForVMCoreMockRecorder) GetPublishDate() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPublishDate", reflect.TypeOf((*MockCVEForVMCore)(nil).GetPublishDate))
+}
+
 // MockVMSeverityCounts is a mock of VMSeverityCounts interface.
 type MockVMSeverityCounts struct {
 	ctrl     *gomock.Controller
diff --git a/central/views/vmcve/types.go b/central/views/vmcve/types.go
index 9df0b1e249b57..a789ffed3d4bb 100644
--- a/central/views/vmcve/types.go
+++ b/central/views/vmcve/types.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/stackrox/rox/central/views/common"
 	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/pkg/search"
 )
 
 // CveCore is an interface to get VM CVE properties.
@@ -40,13 +41,26 @@ type CVEComponentCore interface {
 //go:generate mockgen-wrapper
 type CveView interface {
 	Count(ctx context.Context, q *v1.Query) (int, error)
-	CountBySeverity(ctx context.Context, q *v1.Query) (common.ResourceCountByCVESeverity, error)
+	CountBySeverity(ctx context.Context, q *v1.Query, countOn search.FieldLabel) (common.ResourceCountByCVESeverity, error)
 	Get(ctx context.Context, q *v1.Query) ([]CveCore, error)
 	GetVMIDs(ctx context.Context, q *v1.Query) ([]string, error)
 	GetCVEComponents(ctx context.Context, q *v1.Query) ([]CVEComponentCore, error)
 	CountBySeverityPerVM(ctx context.Context, q *v1.Query) ([]VMSeverityCounts, error)
 	GetAffectedVMs(ctx context.Context, q *v1.Query) ([]AffectedVMCore, error)
 	CountAffectedVMs(ctx context.Context, q *v1.Query) (int, error)
+	GetCVEsForVM(ctx context.Context, q *v1.Query) ([]CVEForVMCore, error)
+}
+
+// CVEForVMCore provides per-CVE aggregation scoped to a single VM.
+type CVEForVMCore interface {
+	GetCVE() string
+	GetMaxSeverity() int32
+	GetIsFixable() bool
+	GetMaxCVSS() float32
+	GetMaxNVDCVSS() float32
+	GetEPSSProbability() float32
+	GetAffectedComponentCount() int
+	GetPublishDate() *time.Time
 }
 
 // VMSeverityCounts provides per-VM severity counts.
diff --git a/central/views/vmcve/view_impl.go b/central/views/vmcve/view_impl.go
index 9a7bb24521a9f..b159fcafcd330 100644
--- a/central/views/vmcve/view_impl.go
+++ b/central/views/vmcve/view_impl.go
@@ -35,7 +35,7 @@ func (v *vmCVECoreViewImpl) Count(ctx context.Context, q *v1.Query) (int, error)
 	return pgSearch.RunDistinctCountForSchema(queryCtx, v.db, v.schema, q, search.CVE)
 }
 
-func (v *vmCVECoreViewImpl) CountBySeverity(ctx context.Context, q *v1.Query) (common.ResourceCountByCVESeverity, error) {
+func (v *vmCVECoreViewImpl) CountBySeverity(ctx context.Context, q *v1.Query, countOn search.FieldLabel) (common.ResourceCountByCVESeverity, error) {
 	if err := common.ValidateQuery(q); err != nil {
 		return nil, err
 	}
@@ -43,7 +43,7 @@ func (v *vmCVECoreViewImpl) CountBySeverity(ctx context.Context, q *v1.Query) (c
 	queryCtx, cancel := contextutil.ContextWithTimeoutIfNotExists(ctx, queryTimeout)
 	defer cancel()
 
-	result, err := pgSearch.RunSelectOneForSchema[resourceCountByVMCVESeverity](queryCtx, v.db, v.schema, common.WithCountBySeverityAndFixabilityQuery(q, search.VirtualMachineID))
+	result, err := pgSearch.RunSelectOneForSchema[resourceCountByVMCVESeverity](queryCtx, v.db, v.schema, common.WithCountBySeverityAndFixabilityQuery(q, countOn))
 	if err != nil {
 		return nil, err
 	}
@@ -119,7 +119,7 @@ func (v *vmCVECoreViewImpl) CountBySeverityPerVM(ctx context.Context, q *v1.Quer
 		return nil, err
 	}
 
-	cloned := common.WithCountBySeverityAndFixabilityQuery(q, search.VirtualMachineID)
+	cloned := common.WithCountBySeverityAndFixabilityQuery(q, search.CVE)
 	cloned.Selects = append([]*v1.QuerySelect{
 		search.NewQuerySelect(search.VirtualMachineID).Proto(),
 	}, cloned.GetSelects()...)
@@ -192,6 +192,44 @@ func (v *vmCVECoreViewImpl) GetAffectedVMs(ctx context.Context, q *v1.Query) ([]
 	return ret, nil
 }
 
+func (v *vmCVECoreViewImpl) GetCVEsForVM(ctx context.Context, q *v1.Query) ([]CVEForVMCore, error) {
+	if err := common.ValidateQuery(q); err != nil {
+		return nil, err
+	}
+
+	cloned := q.CloneVT()
+	cloned = common.UpdateSortAggs(cloned)
+	cloned.Selects = []*v1.QuerySelect{
+		search.NewQuerySelect(search.CVE).Proto(),
+		search.NewQuerySelect(search.Severity).AggrFunc(aggregatefunc.Max).Proto(),
+		search.NewQuerySelect(search.Fixable).AggrFunc(aggregatefunc.Count).
+			Filter("fixable_count",
+				search.NewQueryBuilder().AddBools(search.Fixable, true).ProtoQuery(),
+			).Proto(),
+		search.NewQuerySelect(search.CVSS).AggrFunc(aggregatefunc.Max).Proto(),
+		search.NewQuerySelect(search.NVDCVSS).AggrFunc(aggregatefunc.Max).Proto(),
+		search.NewQuerySelect(search.EPSSProbablity).AggrFunc(aggregatefunc.Max).Proto(),
+		search.NewQuerySelect(search.ComponentID).AggrFunc(aggregatefunc.Count).Distinct().Proto(),
+		search.NewQuerySelect(search.CVEPublishedOn).AggrFunc(aggregatefunc.Min).Proto(),
+	}
+	cloned.GroupBy = &v1.QueryGroupBy{
+		Fields: []string{search.CVE.String()},
+	}
+
+	queryCtx, cancel := contextutil.ContextWithTimeoutIfNotExists(ctx, queryTimeout)
+	defer cancel()
+
+	var ret []CVEForVMCore
+	err := pgSearch.RunSelectRequestForSchemaFn[cveForVMResponse](queryCtx, v.db, v.schema, cloned, func(r *cveForVMResponse) error {
+		ret = append(ret, r)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return ret, nil
+}
+
 func (v *vmCVECoreViewImpl) GetCVEComponents(ctx context.Context, q *v1.Query) ([]CVEComponentCore, error) {
 	cloned := q.CloneVT()
 	cloned.Selects = []*v1.QuerySelect{
diff --git a/central/virtualmachine/cve/v2/datastore/store/postgres/store.go b/central/virtualmachine/cve/v2/datastore/store/postgres/store.go
index 8c9c4877e2b2f..9a817e4e199b1 100644
--- a/central/virtualmachine/cve/v2/datastore/store/postgres/store.go
+++ b/central/virtualmachine/cve/v2/datastore/store/postgres/store.go
@@ -109,6 +109,7 @@ func insertIntoVirtualMachineCvev2(batch *pgx.Batch, obj *storage.VirtualMachine
 		protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 		obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 		obj.GetCveBaseInfo().GetCisaKev(),
+		obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 		obj.GetPreferredCvss(),
 		obj.GetSeverity(),
 		obj.GetImpactScore(),
@@ -121,7 +122,7 @@ func insertIntoVirtualMachineCvev2(batch *pgx.Batch, obj *storage.VirtualMachine
 		serialized,
 	}
 
-	finalStr := "INSERT INTO virtual_machine_cvev2 (Id, VmV2Id, VmComponentId, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, PreferredCvss, Severity, ImpactScore, Nvdcvss, IsFixable, FixedBy, EpssProbability, Advisory_Name, Advisory_Link, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, VmV2Id = EXCLUDED.VmV2Id, VmComponentId = EXCLUDED.VmComponentId, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, PreferredCvss = EXCLUDED.PreferredCvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, EpssProbability = EXCLUDED.EpssProbability, Advisory_Name = EXCLUDED.Advisory_Name, Advisory_Link = EXCLUDED.Advisory_Link, serialized = EXCLUDED.serialized"
+	finalStr := "INSERT INTO virtual_machine_cvev2 (Id, VmV2Id, VmComponentId, CveBaseInfo_Cve, CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign, PreferredCvss, Severity, ImpactScore, Nvdcvss, IsFixable, FixedBy, EpssProbability, Advisory_Name, Advisory_Link, serialized) VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19) ON CONFLICT(Id) DO UPDATE SET Id = EXCLUDED.Id, VmV2Id = EXCLUDED.VmV2Id, VmComponentId = EXCLUDED.VmComponentId, CveBaseInfo_Cve = EXCLUDED.CveBaseInfo_Cve, CveBaseInfo_PublishedOn = EXCLUDED.CveBaseInfo_PublishedOn, CveBaseInfo_CreatedAt = EXCLUDED.CveBaseInfo_CreatedAt, CveBaseInfo_Epss_EpssProbability = EXCLUDED.CveBaseInfo_Epss_EpssProbability, CveBaseInfo_CisaKev = EXCLUDED.CveBaseInfo_CisaKev, CveBaseInfo_KnownRansomwareCampaign = EXCLUDED.CveBaseInfo_KnownRansomwareCampaign, PreferredCvss = EXCLUDED.PreferredCvss, Severity = EXCLUDED.Severity, ImpactScore = EXCLUDED.ImpactScore, Nvdcvss = EXCLUDED.Nvdcvss, IsFixable = EXCLUDED.IsFixable, FixedBy = EXCLUDED.FixedBy, EpssProbability = EXCLUDED.EpssProbability, Advisory_Name = EXCLUDED.Advisory_Name, Advisory_Link = EXCLUDED.Advisory_Link, serialized = EXCLUDED.serialized"
 	batch.Queue(finalStr, values...)
 
 	return nil
@@ -136,6 +137,7 @@ var copyColsVirtualMachineCvev2 = []string{
 	"cvebaseinfo_createdat",
 	"cvebaseinfo_epss_epssprobability",
 	"cvebaseinfo_cisakev",
+	"cvebaseinfo_knownransomwarecampaign",
 	"preferredcvss",
 	"severity",
 	"impactscore",
@@ -187,6 +189,7 @@ func copyFromVirtualMachineCvev2(ctx context.Context, s pgSearch.Deleter, tx *po
 			protocompat.NilOrTime(obj.GetCveBaseInfo().GetCreatedAt()),
 			obj.GetCveBaseInfo().GetEpss().GetEpssProbability(),
 			obj.GetCveBaseInfo().GetCisaKev(),
+			obj.GetCveBaseInfo().GetKnownRansomwareCampaign(),
 			obj.GetPreferredCvss(),
 			obj.GetSeverity(),
 			obj.GetImpactScore(),
diff --git a/central/virtualmachine/datastore/datastore_test_constructors.go b/central/virtualmachine/datastore/datastore_test_constructors.go
new file mode 100644
index 0000000000000..903e13a949d3f
--- /dev/null
+++ b/central/virtualmachine/datastore/datastore_test_constructors.go
@@ -0,0 +1,13 @@
+package datastore
+
+import (
+	"testing"
+
+	pgStore "github.com/stackrox/rox/central/virtualmachine/datastore/internal/store/postgres"
+	"github.com/stackrox/rox/pkg/postgres"
+)
+
+// GetTestPostgresDataStore provides a datastore connected to postgres for testing purposes.
+func GetTestPostgresDataStore(_ testing.TB, pool postgres.DB) DataStore {
+	return newDatastoreImpl(pgStore.New(pool))
+}
diff --git a/central/virtualmachine/datastore/telemetry.go b/central/virtualmachine/datastore/telemetry.go
index 04bc665791488..777124c8f6e53 100644
--- a/central/virtualmachine/datastore/telemetry.go
+++ b/central/virtualmachine/datastore/telemetry.go
@@ -4,14 +4,17 @@ import (
 	"context"
 	"time"
 
+	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/protocompat"
 	"github.com/stackrox/rox/pkg/sac"
 	"github.com/stackrox/rox/pkg/sac/resources"
+	"github.com/stackrox/rox/pkg/search"
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/telemetry/phonehome"
+	"github.com/stackrox/rox/pkg/timestamp"
 )
 
 const (
@@ -35,8 +38,8 @@ var (
 // 2. Total number of virtual machines
 // 3. Number of VMs with active agents (received IndexReport within last 24 hours)
 //
-// When the ROX_VIRTUAL_MACHINES feature flag is disabled, this function returns
-// an empty map without performing any database queries, ensuring no performance impact.
+// When ROX_VIRTUAL_MACHINES is off, or the enhanced data model is on (GatherV2
+// owns these metric names), Gather returns an empty map and does not query storage.
 func Gather(ds DataStore) phonehome.GatherFunc {
 	return gatherWithTime(ds, time.Now)
 }
@@ -44,8 +47,7 @@ func Gather(ds DataStore) phonehome.GatherFunc {
 // gatherWithTime allows injecting a time function for deterministic testing.
 func gatherWithTime(ds DataStore, nowFunc func() time.Time) phonehome.GatherFunc {
 	return func(ctx context.Context) (map[string]any, error) {
-		// Early return if virtual machines feature is disabled - zero performance impact
-		if !features.VirtualMachines.Enabled() {
+		if !features.VirtualMachines.Enabled() || features.VirtualMachinesEnhancedDataModel.Enabled() {
 			return map[string]any{}, nil
 		}
 
@@ -101,3 +103,71 @@ func gatherWithTime(ds DataStore, nowFunc func() time.Time) phonehome.GatherFunc
 		return props, nil
 	}
 }
+
+// vmV2Walker is the subset of the VM V2 datastore this gatherer needs.
+type vmV2Walker interface {
+	Walk(ctx context.Context, fn func(vm *storage.VirtualMachineV2) error) error
+}
+
+// scanV2Counter is the subset of the scan V2 datastore this gatherer needs.
+type scanV2Counter interface {
+	Count(ctx context.Context, q *v1.Query) (int, error)
+}
+
+// GatherV2 returns a gatherer that queries the V2 VM and scan datastores.
+func GatherV2(vmV2DS vmV2Walker, scanV2DS scanV2Counter) phonehome.GatherFunc {
+	return gatherV2WithTime(vmV2DS, scanV2DS, time.Now)
+}
+
+func gatherV2WithTime(vmV2DS vmV2Walker, scanV2DS scanV2Counter, nowFunc func() time.Time) phonehome.GatherFunc {
+	return func(ctx context.Context) (map[string]any, error) {
+		if !features.VirtualMachines.Enabled() || !features.VirtualMachinesEnhancedDataModel.Enabled() {
+			return map[string]any{}, nil
+		}
+
+		ctx = sac.WithGlobalAccessScopeChecker(ctx,
+			sac.AllowFixedScopes(
+				sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
+				sac.ResourceScopeKeys(resources.VirtualMachine),
+			),
+		)
+
+		clusterIDsWithRunningVMs := set.NewStringSet()
+		totalVMs := 0
+
+		err := vmV2DS.Walk(ctx, func(vm *storage.VirtualMachineV2) error {
+			totalVMs++
+			if vm.GetState() == storage.VirtualMachineV2_RUNNING {
+				clusterID := vm.GetClusterId()
+				if clusterID == "" {
+					log.Debugf("Virtual machine V2 %s has empty cluster_id", vm.GetId())
+				} else {
+					clusterIDsWithRunningVMs.Add(clusterID)
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		now := nowFunc()
+		cutoff := now.Add(-activeVMAgentMaxAgeLimitTelemetry)
+		q := search.NewQueryBuilder().
+			AddTimeRangeField(search.VirtualMachineScanTime, cutoff, timestamp.InfiniteFuture.GoTime()).
+			ProtoQuery()
+
+		vmsWithActiveAgents, err := scanV2DS.Count(ctx, q)
+		if err != nil {
+			return nil, err
+		}
+
+		props := map[string]any{
+			metricClustersWithVMs:     clusterIDsWithRunningVMs.Cardinality(),
+			metricTotalVMs:            totalVMs,
+			metricVMsWithActiveAgents: vmsWithActiveAgents,
+		}
+		log.Debugf("Virtual machines V2 telemetry update: %v", props)
+		return props, nil
+	}
+}
diff --git a/central/virtualmachine/datastore/telemetry_test.go b/central/virtualmachine/datastore/telemetry_test.go
index f730df2af01e7..0d8f01b6861a2 100644
--- a/central/virtualmachine/datastore/telemetry_test.go
+++ b/central/virtualmachine/datastore/telemetry_test.go
@@ -2,6 +2,9 @@ package datastore
 
 import (
 	"context"
+	"errors"
+	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -10,6 +13,8 @@ import (
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/protocompat"
 	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/timestamp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -20,9 +25,10 @@ var (
 	arbitraryNowFunc = func() time.Time { return arbitraryNow }
 )
 
+// TestVirtualMachineTelemetry covers the v1 gatherer, which only runs when the enhanced data model is off.
 func TestVirtualMachineTelemetry(t *testing.T) {
-	// Ensure feature flag is enabled for these tests
 	t.Setenv(features.VirtualMachines.EnvVar(), "true")
+	t.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), "false")
 
 	tests := map[string]struct {
 		vms                            []*storage.VirtualMachine
@@ -181,29 +187,42 @@ func TestVirtualMachineTelemetry(t *testing.T) {
 	}
 }
 
-func TestVirtualMachineTelemetryWithFeatureFlagDisabled(t *testing.T) {
-	// Disable the feature flag using t.Setenv for automatic cleanup
-	t.Setenv(features.VirtualMachines.EnvVar(), "false")
-
-	ctx := sac.WithAllAccess(context.Background())
-
-	// Create a mock datastore with VMs (which should NOT be queried)
-	ds := &mockDataStore{
-		vms: []*storage.VirtualMachine{
-			{Id: "vm1", ClusterId: "cluster1", Name: "test-vm", State: storage.VirtualMachine_RUNNING, Scan: createScanWithAge(1 * time.Hour)},
-			{Id: "vm2", ClusterId: "cluster2", Name: "test-vm2", State: storage.VirtualMachine_RUNNING, Scan: createScanWithAge(1 * time.Hour)},
+func TestVirtualMachineTelemetrySkipGather(t *testing.T) {
+	tests := map[string]struct {
+		virtualMachinesEnabled bool
+		enhancedDataModel      bool
+	}{
+		"should return empty map when virtual machines flag is disabled": {
+			virtualMachinesEnabled: false,
+			enhancedDataModel:      false,
+		},
+		"should return empty map when enhanced data model is enabled": {
+			virtualMachinesEnabled: true,
+			enhancedDataModel:      true,
 		},
 	}
 
-	gatherer := gatherWithTime(ds, arbitraryNowFunc)
-	props, err := gatherer(ctx)
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(features.VirtualMachines.EnvVar(), strconv.FormatBool(tc.virtualMachinesEnabled))
+			t.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), strconv.FormatBool(tc.enhancedDataModel))
 
-	require.NoError(t, err)
-	require.NotNil(t, props)
+			ctx := sac.WithAllAccess(context.Background())
+			ds := &mockDataStore{
+				vms: []*storage.VirtualMachine{
+					{Id: "vm1", ClusterId: "cluster1", Name: "test-vm", State: storage.VirtualMachine_RUNNING, Scan: createScanWithAge(1 * time.Hour)},
+				},
+			}
 
-	// When feature flag is disabled, should return empty map
-	// No database query should have been performed
-	assert.Empty(t, props, "Should return empty map when feature flag is disabled")
+			gatherer := gatherWithTime(ds, arbitraryNowFunc)
+			props, err := gatherer(ctx)
+
+			require.NoError(t, err)
+			require.NotNil(t, props)
+			assert.Empty(t, props)
+			assert.False(t, ds.walked)
+		})
+	}
 }
 
 // createScanWithAge creates a scan with a timestamp at the specified duration before arbitraryNow.
@@ -216,8 +235,9 @@ func createScanWithAge(age time.Duration) *storage.VirtualMachineScan {
 }
 
 type mockDataStore struct {
-	vms []*storage.VirtualMachine
-	err error
+	vms    []*storage.VirtualMachine
+	err    error
+	walked bool
 }
 
 func (m *mockDataStore) CountVirtualMachines(ctx context.Context, query *v1.Query) (int, error) {
@@ -252,6 +272,7 @@ func (m *mockDataStore) SearchRawVirtualMachines(ctx context.Context, query *v1.
 }
 
 func (m *mockDataStore) Walk(ctx context.Context, fn func(vm *storage.VirtualMachine) error) error {
+	m.walked = true
 	if m.err != nil {
 		return m.err
 	}
@@ -262,3 +283,190 @@ func (m *mockDataStore) Walk(ctx context.Context, fn func(vm *storage.VirtualMac
 	}
 	return nil
 }
+
+// --- V2 mock types ---
+
+type mockVMV2DataStore struct {
+	vms []*storage.VirtualMachineV2
+	err error
+}
+
+func (m *mockVMV2DataStore) Walk(_ context.Context, fn func(vm *storage.VirtualMachineV2) error) error {
+	if m.err != nil {
+		return m.err
+	}
+	for _, vm := range m.vms {
+		if err := fn(vm); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type mockScanV2DataStore struct {
+	count     int
+	err       error
+	lastQuery *v1.Query
+}
+
+func (m *mockScanV2DataStore) Count(_ context.Context, q *v1.Query) (int, error) {
+	m.lastQuery = q
+	return m.count, m.err
+}
+
+func TestVirtualMachineTelemetryV2(t *testing.T) {
+	t.Setenv(features.VirtualMachines.EnvVar(), "true")
+	t.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), "true")
+
+	tests := map[string]struct {
+		vms                            []*storage.VirtualMachineV2
+		scanCount                      int
+		expectedClustersWithRunningVMs int
+		expectedTotalVMs               int
+		expectedVMsWithActiveAgents    int
+	}{
+		"should return zero for all metrics when no V2 VMs exist": {
+			vms:                            nil,
+			scanCount:                      0,
+			expectedClustersWithRunningVMs: 0,
+			expectedTotalVMs:               0,
+			expectedVMsWithActiveAgents:    0,
+		},
+		"should count single cluster with one running V2 VM and one recent scan": {
+			vms: []*storage.VirtualMachineV2{
+				{Id: "vm1", ClusterId: "cluster1", Name: "test-vm", State: storage.VirtualMachineV2_RUNNING},
+			},
+			scanCount:                      1,
+			expectedClustersWithRunningVMs: 1,
+			expectedTotalVMs:               1,
+			expectedVMsWithActiveAgents:    1,
+		},
+		"should count total V2 VMs including stopped ones": {
+			vms: []*storage.VirtualMachineV2{
+				{Id: "vm1", ClusterId: "cluster1", Name: "vm-1", State: storage.VirtualMachineV2_RUNNING},
+				{Id: "vm2", ClusterId: "cluster1", Name: "vm-2", State: storage.VirtualMachineV2_STOPPED},
+				{Id: "vm3", ClusterId: "cluster2", Name: "vm-3", State: storage.VirtualMachineV2_UNKNOWN},
+			},
+			scanCount:                      0,
+			expectedClustersWithRunningVMs: 1,
+			expectedTotalVMs:               3,
+			expectedVMsWithActiveAgents:    0,
+		},
+		"should count multiple distinct clusters with running V2 VMs": {
+			vms: []*storage.VirtualMachineV2{
+				{Id: "vm1", ClusterId: "cluster1", Name: "vm-1", State: storage.VirtualMachineV2_RUNNING},
+				{Id: "vm2", ClusterId: "cluster2", Name: "vm-2", State: storage.VirtualMachineV2_RUNNING},
+				{Id: "vm3", ClusterId: "cluster3", Name: "vm-3", State: storage.VirtualMachineV2_RUNNING},
+			},
+			scanCount:                      2,
+			expectedClustersWithRunningVMs: 3,
+			expectedTotalVMs:               3,
+			expectedVMsWithActiveAgents:    2,
+		},
+		"should exclude V2 VMs with empty cluster id from cluster count": {
+			vms: []*storage.VirtualMachineV2{
+				{Id: "vm1", ClusterId: "cluster1", Name: "vm-1", State: storage.VirtualMachineV2_RUNNING},
+				{Id: "vm2", ClusterId: "", Name: "vm-orphan", State: storage.VirtualMachineV2_RUNNING},
+			},
+			scanCount:                      1,
+			expectedClustersWithRunningVMs: 1,
+			expectedTotalVMs:               2,
+			expectedVMsWithActiveAgents:    1,
+		},
+		"should handle V2 VM with no scan row yet (never scanned)": {
+			vms: []*storage.VirtualMachineV2{
+				{Id: "vm1", ClusterId: "cluster1", Name: "vm-1", State: storage.VirtualMachineV2_RUNNING},
+				{Id: "vm2", ClusterId: "cluster1", Name: "vm-2", State: storage.VirtualMachineV2_RUNNING},
+			},
+			scanCount:                      0,
+			expectedClustersWithRunningVMs: 1,
+			expectedTotalVMs:               2,
+			expectedVMsWithActiveAgents:    0,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			ctx := sac.WithAllAccess(context.Background())
+
+			vmV2DS := &mockVMV2DataStore{vms: tc.vms}
+			scanV2DS := &mockScanV2DataStore{count: tc.scanCount}
+
+			gatherer := gatherV2WithTime(vmV2DS, scanV2DS, arbitraryNowFunc)
+			props, err := gatherer(ctx)
+
+			require.NoError(t, err)
+			require.NotNil(t, props)
+			assert.Equal(t, tc.expectedClustersWithRunningVMs, props[metricClustersWithVMs])
+			assert.Equal(t, tc.expectedTotalVMs, props[metricTotalVMs])
+			assert.Equal(t, tc.expectedVMsWithActiveAgents, props[metricVMsWithActiveAgents])
+			assertActiveAgentScanQuery(t, scanV2DS.lastQuery)
+		})
+	}
+}
+
+func TestVirtualMachineTelemetryV2Errors(t *testing.T) {
+	t.Setenv(features.VirtualMachines.EnvVar(), "true")
+	t.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), "true")
+
+	walkErr := errors.New("walk failed")
+	countErr := errors.New("count failed")
+
+	tests := map[string]struct {
+		walkErr  error
+		countErr error
+		wantErr  error
+	}{
+		"should return Walk error and nil props": {
+			walkErr: walkErr,
+			wantErr: walkErr,
+		},
+		"should return Count error and nil props": {
+			countErr: countErr,
+			wantErr:  countErr,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			ctx := sac.WithAllAccess(context.Background())
+			vmV2DS := &mockVMV2DataStore{
+				vms: []*storage.VirtualMachineV2{
+					{Id: "vm1", ClusterId: "cluster1", Name: "vm-1", State: storage.VirtualMachineV2_RUNNING},
+				},
+				err: tc.walkErr,
+			}
+			scanV2DS := &mockScanV2DataStore{count: 1, err: tc.countErr}
+
+			props, err := gatherV2WithTime(vmV2DS, scanV2DS, arbitraryNowFunc)(ctx)
+
+			require.ErrorIs(t, err, tc.wantErr)
+			assert.Nil(t, props)
+			if tc.walkErr != nil {
+				assert.Nil(t, scanV2DS.lastQuery)
+				return
+			}
+			assertActiveAgentScanQuery(t, scanV2DS.lastQuery)
+		})
+	}
+}
+
+func assertActiveAgentScanQuery(t *testing.T, q *v1.Query) {
+	t.Helper()
+	require.NotNil(t, q)
+	mfq := q.GetBaseQuery().GetMatchFieldQuery()
+	require.NotNil(t, mfq)
+	assert.Equal(t, search.VirtualMachineScanTime.String(), mfq.GetField())
+
+	value, ok := strings.CutPrefix(mfq.GetValue(), search.TimeRangePrefix)
+	require.True(t, ok)
+	fromStr, toStr, ok := strings.Cut(value, "-")
+	require.True(t, ok)
+	from, err := strconv.ParseInt(fromStr, 10, 64)
+	require.NoError(t, err)
+	to, err := strconv.ParseInt(toStr, 10, 64)
+	require.NoError(t, err)
+
+	assert.Equal(t, arbitraryNow.Add(-activeVMAgentMaxAgeLimitTelemetry).UnixMilli(), from)
+	assert.Equal(t, timestamp.InfiniteFuture.GoTime().UnixMilli(), to)
+}
diff --git a/central/virtualmachine/v2/datastore/datastore.go b/central/virtualmachine/v2/datastore/datastore.go
index f3f57ce59c660..296e00c821dfd 100644
--- a/central/virtualmachine/v2/datastore/datastore.go
+++ b/central/virtualmachine/v2/datastore/datastore.go
@@ -18,6 +18,8 @@ type DataStore interface {
 
 	// GetVirtualMachine returns the VM with the given ID.
 	GetVirtualMachine(ctx context.Context, id string) (*storage.VirtualMachineV2, bool, error)
+	// GetVirtualMachineWithLatestScan returns the VM and its latest scan together.
+	GetVirtualMachineWithLatestScan(ctx context.Context, id string) (*common.VMWithLatestScan, bool, error)
 	// GetManyVirtualMachines returns the VMs with the given IDs.
 	GetManyVirtualMachines(ctx context.Context, ids []string) ([]*storage.VirtualMachineV2, []int, error)
 
@@ -32,7 +34,8 @@ type DataStore interface {
 
 	// UpsertScan upserts scan data (scan, components, CVEs) for a VM.
 	// Hash-based change detection avoids unnecessary writes. CVE created_at
-	// timestamps are preserved across scan replacements.
+	// timestamps are preserved across scan replacements. Also stamps
+	// last_agent_contact: this is the scrape-derived path.
 	UpsertScan(ctx context.Context, vmID string, parts common.VMScanParts) error
 
 	// DeleteVirtualMachines removes VMs and all associated data (FK cascade).
diff --git a/central/virtualmachine/v2/datastore/datastore_impl.go b/central/virtualmachine/v2/datastore/datastore_impl.go
index b0f091070620b..d3ef7fdff5509 100644
--- a/central/virtualmachine/v2/datastore/datastore_impl.go
+++ b/central/virtualmachine/v2/datastore/datastore_impl.go
@@ -47,6 +47,11 @@ func (ds *datastoreImpl) GetManyVirtualMachines(ctx context.Context, ids []strin
 	return ds.store.GetMany(ctx, ids)
 }
 
+func (ds *datastoreImpl) GetVirtualMachineWithLatestScan(ctx context.Context, id string) (*common.VMWithLatestScan, bool, error) {
+	defer metrics.SetDatastoreFunctionDuration(time.Now(), "VirtualMachineV2", "GetVirtualMachineWithLatestScan")
+	return ds.store.GetWithLatestScan(ctx, id)
+}
+
 func (ds *datastoreImpl) EnsureVirtualMachineExists(ctx context.Context, vmID string, clusterID string) error {
 	defer metrics.SetDatastoreFunctionDuration(time.Now(), "VirtualMachineV2", "EnsureVirtualMachineExists")
 
diff --git a/central/virtualmachine/v2/datastore/datastore_test_constructors.go b/central/virtualmachine/v2/datastore/datastore_test_constructors.go
new file mode 100644
index 0000000000000..5aef488adee23
--- /dev/null
+++ b/central/virtualmachine/v2/datastore/datastore_test_constructors.go
@@ -0,0 +1,14 @@
+package datastore
+
+import (
+	"testing"
+
+	pgStore "github.com/stackrox/rox/central/virtualmachine/v2/datastore/store/postgres"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/postgres"
+)
+
+// GetTestPostgresDataStore provides a datastore connected to postgres for testing purposes.
+func GetTestPostgresDataStore(_ testing.TB, pool postgres.DB) DataStore {
+	return newDatastoreImpl(pgStore.New(pool, concurrency.NewKeyFence()))
+}
diff --git a/central/virtualmachine/v2/datastore/mocks/datastore.go b/central/virtualmachine/v2/datastore/mocks/datastore.go
index 57be91ac410ed..d2bddff113c49 100644
--- a/central/virtualmachine/v2/datastore/mocks/datastore.go
+++ b/central/virtualmachine/v2/datastore/mocks/datastore.go
@@ -124,6 +124,22 @@ func (mr *MockDataStoreMockRecorder) GetVirtualMachine(ctx, id any) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetVirtualMachine", reflect.TypeOf((*MockDataStore)(nil).GetVirtualMachine), ctx, id)
 }
 
+// GetVirtualMachineWithLatestScan mocks base method.
+func (m *MockDataStore) GetVirtualMachineWithLatestScan(ctx context.Context, id string) (*common.VMWithLatestScan, bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetVirtualMachineWithLatestScan", ctx, id)
+	ret0, _ := ret[0].(*common.VMWithLatestScan)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetVirtualMachineWithLatestScan indicates an expected call of GetVirtualMachineWithLatestScan.
+func (mr *MockDataStoreMockRecorder) GetVirtualMachineWithLatestScan(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetVirtualMachineWithLatestScan", reflect.TypeOf((*MockDataStore)(nil).GetVirtualMachineWithLatestScan), ctx, id)
+}
+
 // Search mocks base method.
 func (m *MockDataStore) Search(ctx context.Context, query *v1.Query) ([]search.Result, error) {
 	m.ctrl.T.Helper()
diff --git a/central/virtualmachine/v2/datastore/store/common/parts.go b/central/virtualmachine/v2/datastore/store/common/parts.go
index 75ca8e978a2a7..f36d2761b65fd 100644
--- a/central/virtualmachine/v2/datastore/store/common/parts.go
+++ b/central/virtualmachine/v2/datastore/store/common/parts.go
@@ -2,6 +2,13 @@ package common
 
 import "github.com/stackrox/rox/generated/storage"
 
+// VMWithLatestScan contains VM metadata and its latest scan from one database snapshot.
+// Scan is nil when the VM has not been scanned.
+type VMWithLatestScan struct {
+	VM   *storage.VirtualMachineV2
+	Scan *storage.VirtualMachineScanV2
+}
+
 // VMScanParts groups the scan, components, and CVEs that together represent
 // a single VM scan result. UpsertScan consumes this structure.
 type VMScanParts struct {
diff --git a/central/virtualmachine/v2/datastore/store/mocks/store.go b/central/virtualmachine/v2/datastore/store/mocks/store.go
index 2c2e21dd692cc..8230b9540a9de 100644
--- a/central/virtualmachine/v2/datastore/store/mocks/store.go
+++ b/central/virtualmachine/v2/datastore/store/mocks/store.go
@@ -133,6 +133,22 @@ func (mr *MockStoreMockRecorder) GetMany(ctx, ids any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetMany", reflect.TypeOf((*MockStore)(nil).GetMany), ctx, ids)
 }
 
+// GetWithLatestScan mocks base method.
+func (m *MockStore) GetWithLatestScan(ctx context.Context, id string) (*common.VMWithLatestScan, bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetWithLatestScan", ctx, id)
+	ret0, _ := ret[0].(*common.VMWithLatestScan)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetWithLatestScan indicates an expected call of GetWithLatestScan.
+func (mr *MockStoreMockRecorder) GetWithLatestScan(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWithLatestScan", reflect.TypeOf((*MockStore)(nil).GetWithLatestScan), ctx, id)
+}
+
 // Search mocks base method.
 func (m *MockStore) Search(ctx context.Context, q *v1.Query) ([]search.Result, error) {
 	m.ctrl.T.Helper()
diff --git a/central/virtualmachine/v2/datastore/store/postgres/get_vm_bench_test.go b/central/virtualmachine/v2/datastore/store/postgres/get_vm_bench_test.go
new file mode 100644
index 0000000000000..af78f48867913
--- /dev/null
+++ b/central/virtualmachine/v2/datastore/store/postgres/get_vm_bench_test.go
@@ -0,0 +1,64 @@
+//go:build sql_integration
+
+package postgres
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/features"
+	"github.com/stackrox/rox/pkg/postgres/pgtest"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+// BenchmarkGetVM measures the joined VM and latest-scan lookup.
+// Only VM metadata and scans are seeded; the lookup does not read components or CVEs.
+func BenchmarkGetVM(b *testing.B) {
+	b.Setenv(features.VirtualMachinesEnhancedDataModel.EnvVar(), "true")
+	ctx := sac.WithAllAccess(context.Background())
+	testDB := pgtest.ForT(b)
+	vmStore := New(testDB.DB, concurrency.NewKeyFence()).(*storeImpl)
+	for _, vmCount := range []int{1000, 3000} {
+		b.Run(fmt.Sprintf("VMs%d", vmCount), func(b *testing.B) {
+			_, err := testDB.Exec(ctx, "TRUNCATE virtual_machine_v2 CASCADE")
+			require.NoError(b, err)
+			ids := make([]string, vmCount)
+			clusterID := uuid.NewV4().String()
+			tx, err := testDB.Begin(ctx)
+			require.NoError(b, err)
+			defer func() { _ = tx.Rollback(ctx) }()
+			for i := range ids {
+				ids[i] = uuid.NewV4().String()
+				require.NoError(b, vmStore.insertVM(ctx, tx, &storage.VirtualMachineV2{
+					Id: ids[i], Name: fmt.Sprintf("vm-%d", i), Namespace: "default",
+					ClusterId: clusterID, ClusterName: "test-cluster", GuestOs: "rhel:9",
+					State: storage.VirtualMachineV2_RUNNING, LastUpdated: timestamppb.Now(),
+				}))
+				require.NoError(b, vmStore.insertScan(ctx, tx, &storage.VirtualMachineScanV2{
+					Id: uuid.NewV7().String(), VmV2Id: ids[i], ScanOs: "rhel:9",
+					ScanTime: timestamppb.Now(), TopCvss: 9.8,
+				}))
+			}
+			require.NoError(b, tx.Commit(ctx))
+			_, err = testDB.Exec(ctx, "ANALYZE virtual_machine_v2, virtual_machine_scan_v2")
+			require.NoError(b, err)
+			b.Run("JoinedQuery", func(b *testing.B) {
+				b.ReportAllocs()
+				i := 0
+				for b.Loop() {
+					result, found, err := vmStore.GetWithLatestScan(ctx, ids[i%len(ids)])
+					i++
+					require.NoError(b, err)
+					require.True(b, found)
+					require.NotNil(b, result.Scan)
+				}
+			})
+		})
+	}
+}
diff --git a/central/virtualmachine/v2/datastore/store/postgres/store.go b/central/virtualmachine/v2/datastore/store/postgres/store.go
index 01661dac8d97d..b42d8871aebbc 100644
--- a/central/virtualmachine/v2/datastore/store/postgres/store.go
+++ b/central/virtualmachine/v2/datastore/store/postgres/store.go
@@ -13,12 +13,16 @@ import (
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/contextutil"
+	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/errox"
 	ops "github.com/stackrox/rox/pkg/metrics"
 	"github.com/stackrox/rox/pkg/postgres"
 	"github.com/stackrox/rox/pkg/postgres/pgutils"
 	pkgSchema "github.com/stackrox/rox/pkg/postgres/schema"
 	"github.com/stackrox/rox/pkg/protocompat"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/resources"
 	"github.com/stackrox/rox/pkg/search"
 	pgSearch "github.com/stackrox/rox/pkg/search/postgres"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -32,10 +36,17 @@ const (
 
 	getVMStmt   = "SELECT serialized FROM " + vmTable + " WHERE Id = $1"
 	getScanStmt = "SELECT serialized FROM " + scanTable + " WHERE VmV2Id = $1"
+
+	// VM facts, notes, and VSOCK CID, plus scan notes, require the serialized blobs.
+	// LATERAL selects the newest UUIDv7 scan ID; LEFT JOIN retains VMs without scans.
+	getVMWithLatestScanStmt = "SELECT vm.serialized, scan.serialized FROM " + vmTable + " AS vm" +
+		" LEFT JOIN LATERAL (SELECT serialized FROM " + scanTable +
+		" WHERE VmV2Id = vm.Id ORDER BY Id DESC LIMIT 1) AS scan ON true WHERE vm.Id = $1"
 )
 
 var (
 	schema = pkgSchema.VirtualMachineV2Schema
+	vmSAC  = sac.ForResource(resources.VirtualMachine)
 )
 
 // New returns a new Store instance using the provided sql instance.
@@ -69,8 +80,8 @@ func (s *storeImpl) EnsureExists(ctx context.Context, vmID, clusterID string) er
 		}
 
 		const stmt = "INSERT INTO " + vmTable +
-			" (Id, Name, Namespace, ClusterId, ClusterName, GuestOs, State, LastUpdated, serialized)" +
-			" VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9)" +
+			" (Id, Name, Namespace, ClusterId, ClusterName, GuestOs, State, LastUpdated, LastAgentContact, serialized)" +
+			" VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)" +
 			" ON CONFLICT(Id) DO NOTHING"
 
 		_, err := s.db.Exec(ctx, stmt,
@@ -82,6 +93,7 @@ func (s *storeImpl) EnsureExists(ctx context.Context, vmID, clusterID string) er
 			vm.GetGuestOs(),
 			vm.GetState(),
 			protocompat.NilOrTime(vm.GetLastUpdated()),
+			protocompat.NilOrTime(vm.GetLastAgentContact()),
 			serialized,
 		)
 		return err
@@ -126,6 +138,11 @@ func (s *storeImpl) upsertVM(ctx context.Context, vm *storage.VirtualMachineV2)
 			return err
 		}
 
+		// Sensor informer upserts never carry last_agent_contact; keep the scrape stamp.
+		if existingVM != nil && vm.GetLastAgentContact() == nil {
+			vm.LastAgentContact = existingVM.GetLastAgentContact()
+		}
+
 		if existingVM != nil && existingVM.GetHash() == hash {
 			// Unchanged: timestamp-only update. Preserve the existing hash.
 			vm.Hash = hash
@@ -174,17 +191,19 @@ func (s *storeImpl) insertVM(ctx context.Context, tx *postgres.Tx, vm *storage.V
 		vm.GetGuestOs(),
 		vm.GetState(),
 		protocompat.NilOrTime(vm.GetLastUpdated()),
+		protocompat.NilOrTime(vm.GetLastAgentContact()),
 		serialized,
 	}
 
 	const stmt = "INSERT INTO " + vmTable +
-		" (Id, Name, Namespace, ClusterId, ClusterName, GuestOs, State, LastUpdated, serialized)" +
-		" VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9)" +
+		" (Id, Name, Namespace, ClusterId, ClusterName, GuestOs, State, LastUpdated, LastAgentContact, serialized)" +
+		" VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)" +
 		" ON CONFLICT(Id) DO UPDATE SET" +
 		" Id = EXCLUDED.Id, Name = EXCLUDED.Name, Namespace = EXCLUDED.Namespace," +
 		" ClusterId = EXCLUDED.ClusterId, ClusterName = EXCLUDED.ClusterName," +
 		" GuestOs = EXCLUDED.GuestOs, State = EXCLUDED.State," +
-		" LastUpdated = EXCLUDED.LastUpdated, serialized = EXCLUDED.serialized"
+		" LastUpdated = EXCLUDED.LastUpdated, LastAgentContact = EXCLUDED.LastAgentContact," +
+		" serialized = EXCLUDED.serialized"
 	_, err = tx.Exec(ctx, stmt, values...)
 	return err
 }
@@ -200,8 +219,8 @@ func (s *storeImpl) updateVMTimestamp(ctx context.Context, tx *postgres.Tx, vm *
 		return err
 	}
 
-	const stmt = "UPDATE " + vmTable + " SET LastUpdated = $2, serialized = $3 WHERE Id = $1"
-	_, err = tx.Exec(ctx, stmt, id, protocompat.NilOrTime(vm.GetLastUpdated()), serialized)
+	const stmt = "UPDATE " + vmTable + " SET LastUpdated = $2, LastAgentContact = $3, serialized = $4 WHERE Id = $1"
+	_, err = tx.Exec(ctx, stmt, id, protocompat.NilOrTime(vm.GetLastUpdated()), protocompat.NilOrTime(vm.GetLastAgentContact()), serialized)
 	return err
 }
 
@@ -313,7 +332,10 @@ func (s *storeImpl) touchVMLastUpdated(ctx context.Context, tx *postgres.Tx, vmI
 	if existingVM == nil {
 		return errox.NotFound.Newf("VM %s not found", vmID)
 	}
-	existingVM.LastUpdated = protocompat.ConvertTimeToTimestampOrNil(&t)
+	ts := protocompat.ConvertTimeToTimestampOrNil(&t)
+	existingVM.LastUpdated = ts
+	// UpsertScan is the scrape-derived path (index-report SYNC), so last contact moves with last_updated.
+	existingVM.LastAgentContact = ts
 	return s.updateVMTimestamp(ctx, tx, existingVM)
 }
 
@@ -688,6 +710,44 @@ func (s *storeImpl) Get(ctx context.Context, id string) (*storage.VirtualMachine
 	})
 }
 
+// GetWithLatestScan reads the VM and its latest scan in one snapshot.
+func (s *storeImpl) GetWithLatestScan(ctx context.Context, id string) (*common.VMWithLatestScan, bool, error) {
+	defer metrics.SetPostgresOperationDurationTime(time.Now(), ops.Get, "VirtualMachineV2WithLatestScan")
+	queryCtx, cancel := contextutil.ContextWithTimeoutIfNotExists(ctx, env.PostgresVMStatementTimeout.DurationSetting())
+	defer cancel()
+	return pgutils.Retry3(queryCtx, func() (*common.VMWithLatestScan, bool, error) {
+		var db postgres.Queryable = s.db
+		if tx, exists := postgres.TxFromContext(queryCtx); exists {
+			db = tx
+		}
+		var vmBytes, scanBytes []byte
+		err := db.QueryRow(queryCtx, getVMWithLatestScanStmt, pgutils.NilOrUUID(id)).Scan(&vmBytes, &scanBytes)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, false, nil
+		}
+		if err != nil {
+			return nil, false, errors.Wrap(err, "reading VM and latest scan")
+		}
+		vm := &storage.VirtualMachineV2{}
+		if err := vm.UnmarshalVT(vmBytes); err != nil {
+			return nil, false, errors.Wrap(err, "decoding VM")
+		}
+		// Match the scope filtering of Get: inaccessible VMs are not found, and
+		// neither their metadata nor their scan is returned to the caller.
+		if allowed, err := vmSAC.ReadAllowed(queryCtx, sac.ClusterScopeKey(vm.GetClusterId()), sac.NamespaceScopeKey(vm.GetNamespace())); err != nil || !allowed {
+			return nil, false, err
+		}
+		result := &common.VMWithLatestScan{VM: vm}
+		if scanBytes != nil {
+			result.Scan = &storage.VirtualMachineScanV2{}
+			if err := result.Scan.UnmarshalVT(scanBytes); err != nil {
+				return nil, false, errors.Wrap(err, "decoding latest VM scan")
+			}
+		}
+		return result, true, nil
+	})
+}
+
 func (s *storeImpl) GetMany(ctx context.Context, ids []string) ([]*storage.VirtualMachineV2, []int, error) {
 	defer metrics.SetPostgresOperationDurationTime(time.Now(), ops.GetMany, "VirtualMachineV2")
 
diff --git a/central/virtualmachine/v2/datastore/store/postgres/store_test.go b/central/virtualmachine/v2/datastore/store/postgres/store_test.go
index 911d1d0238d68..a62422a05fe48 100644
--- a/central/virtualmachine/v2/datastore/store/postgres/store_test.go
+++ b/central/virtualmachine/v2/datastore/store/postgres/store_test.go
@@ -4,6 +4,7 @@ package postgres
 
 import (
 	"context"
+	"slices"
 	"testing"
 	"time"
 
@@ -16,6 +17,7 @@ import (
 	"github.com/stackrox/rox/pkg/postgres/pgutils"
 	"github.com/stackrox/rox/pkg/protoassert"
 	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/resources"
 	"github.com/stackrox/rox/pkg/search"
 	"github.com/stackrox/rox/pkg/uuid"
 	"github.com/stretchr/testify/suite"
@@ -48,6 +50,117 @@ func (s *VMStoreTestSuite) SetupTest() {
 	s.store = New(s.testDB.DB, concurrency.NewKeyFence()).(*storeImpl)
 }
 
+func (s *VMStoreTestSuite) TestGetWithLatestScan_MissingVM() {
+	result, found, err := s.store.GetWithLatestScan(s.ctx, uuid.NewV4().String())
+	s.Require().NoError(err)
+	s.False(found)
+	s.Nil(result)
+}
+
+func (s *VMStoreTestSuite) TestGetWithLatestScan_NoScan() {
+	vm := s.newVM()
+	vm.Facts = map[string]string{"agentVersion": "1.0"}
+	s.Require().NoError(s.store.UpsertVM(s.ctx, vm))
+	expected, found, err := s.store.Get(s.ctx, vm.GetId())
+	s.Require().NoError(err)
+	s.Require().True(found)
+	result, found, err := s.store.GetWithLatestScan(s.ctx, vm.GetId())
+	s.Require().NoError(err)
+	s.Require().True(found)
+	protoassert.Equal(s.T(), expected, result.VM)
+	s.Nil(result.Scan)
+}
+
+func (s *VMStoreTestSuite) TestGetWithLatestScan_UsesScanID() {
+	vm := s.newVM()
+	s.Require().NoError(s.store.UpsertVM(s.ctx, vm))
+	expected, found, err := s.store.Get(s.ctx, vm.GetId())
+	s.Require().NoError(err)
+	s.Require().True(found)
+	ids := []string{uuid.NewV7().String(), uuid.NewV7().String()}
+	slices.Sort(ids)
+	old := &storage.VirtualMachineScanV2{
+		Id: ids[0], VmV2Id: vm.GetId(), ScanTime: timestamppb.Now(),
+	}
+	latest := &storage.VirtualMachineScanV2{
+		Id: ids[1], VmV2Id: vm.GetId(), ScanOs: "rhel:9", TopCvss: 9.8,
+		ScanTime: timestamppb.New(time.Now().Add(-time.Hour)),
+		Notes:    []storage.VirtualMachineScanV2_Note{storage.VirtualMachineScanV2_OS_UNKNOWN},
+	}
+	tx, err := s.testDB.Begin(s.ctx)
+	s.Require().NoError(err)
+	defer func() { _ = tx.Rollback(s.ctx) }()
+	s.Require().NoError(s.store.insertScan(s.ctx, tx, old))
+	s.Require().NoError(s.store.insertScan(s.ctx, tx, latest))
+	s.Require().NoError(tx.Commit(s.ctx))
+	result, found, err := s.store.GetWithLatestScan(s.ctx, vm.GetId())
+	s.Require().NoError(err)
+	s.Require().True(found)
+	protoassert.Equal(s.T(), expected, result.VM)
+	protoassert.Equal(s.T(), latest, result.Scan)
+}
+
+func (s *VMStoreTestSuite) TestGetWithLatestScan_ScopedAccess() {
+	vm := s.newVM()
+	s.Require().NoError(s.store.UpsertVM(s.ctx, vm))
+	s.Require().NoError(s.store.UpsertScan(s.ctx, vm.GetId(), s.newScanParts(vm.GetId())))
+	allowedScope := func(cluster, namespace string) context.Context {
+		return sac.WithGlobalAccessScopeChecker(context.Background(), sac.AllowFixedScopes(
+			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
+			sac.ResourceScopeKeys(resources.VirtualMachine),
+			sac.ClusterScopeKeys(cluster),
+			sac.NamespaceScopeKeys(namespace),
+		))
+	}
+	tests := map[string]struct {
+		ctx   context.Context
+		found bool
+	}{
+		"all access":          {ctx: s.ctx, found: true},
+		"own namespace":       {ctx: allowedScope(vm.GetClusterId(), vm.GetNamespace()), found: true},
+		"different namespace": {ctx: allowedScope(vm.GetClusterId(), "other")},
+		"different cluster":   {ctx: allowedScope(uuid.NewV4().String(), vm.GetNamespace())},
+		"no access":           {ctx: sac.WithNoAccess(context.Background())},
+	}
+	for name, tt := range tests {
+		s.Run(name, func() {
+			result, found, err := s.store.GetWithLatestScan(tt.ctx, vm.GetId())
+			s.Require().NoError(err)
+			s.Equal(tt.found, found)
+			if tt.found {
+				s.NotNil(result.VM)
+				s.NotNil(result.Scan)
+			} else {
+				s.Nil(result, "VM metadata and scan must both be hidden")
+			}
+			_, oldFound, err := s.store.Get(tt.ctx, vm.GetId())
+			s.Require().NoError(err)
+			s.Equal(oldFound, found, "joined read must match existing Get scope filtering")
+		})
+	}
+}
+
+func (s *VMStoreTestSuite) TestGetWithLatestScan_TransactionContext() {
+	vm := s.newVM()
+	scan := s.newScanParts(vm.GetId()).Scan
+	tx, txCtx, err := s.store.begin(s.ctx)
+	s.Require().NoError(err)
+	defer func() { _ = tx.Rollback(s.ctx) }()
+	s.Require().NoError(s.store.insertVM(txCtx, tx, vm))
+	s.Require().NoError(s.store.insertScan(txCtx, tx, scan))
+
+	result, found, err := s.store.GetWithLatestScan(txCtx, vm.GetId())
+	s.Require().NoError(err)
+	s.Require().True(found)
+	protoassert.Equal(s.T(), vm, result.VM)
+	protoassert.Equal(s.T(), scan, result.Scan)
+
+	s.Require().NoError(tx.Rollback(s.ctx))
+	_, found, err = s.store.GetWithLatestScan(s.ctx, vm.GetId())
+	s.Require().NoError(err)
+	s.False(found, "uncommitted VM must only be visible through the transaction context")
+}
+
 func (s *VMStoreTestSuite) newVM() *storage.VirtualMachineV2 {
 	return &storage.VirtualMachineV2{
 		Id:          uuid.NewV4().String(),
@@ -177,6 +290,60 @@ func (s *VMStoreTestSuite) TestUpsertVM_Changed() {
 	s.NotEqual(firstGet.GetHash(), secondGet.GetHash(), "hash should change when data changes")
 }
 
+func (s *VMStoreTestSuite) TestUpsertScan_StampsLastAgentContact() {
+	vm := s.newVM()
+	s.NoError(s.store.UpsertVM(s.ctx, vm))
+
+	beforeScan, _, err := s.store.Get(s.ctx, vm.GetId())
+	s.NoError(err)
+	s.Nil(beforeScan.GetLastAgentContact())
+
+	parts := s.newScanParts(vm.GetId())
+	before := time.Now()
+	s.NoError(s.store.UpsertScan(s.ctx, vm.GetId(), parts))
+	after := time.Now()
+
+	afterScan, _, err := s.store.Get(s.ctx, vm.GetId())
+	s.NoError(err)
+	s.Require().NotNil(afterScan.GetLastAgentContact())
+	contact := afterScan.GetLastAgentContact().AsTime()
+	s.False(contact.Before(before), "LastAgentContact %v is before UpsertScan started at %v", contact, before)
+	s.False(contact.After(after), "LastAgentContact %v is after UpsertScan finished at %v", contact, after)
+}
+
+func (s *VMStoreTestSuite) TestUpsertVM_PreservesLastAgentContactWhenInformerOmitsIt() {
+	for name, mutate := range map[string]func(*storage.VirtualMachineV2){
+		"unchanged upsert": func(*storage.VirtualMachineV2) {},
+		"changed upsert": func(informerUpdate *storage.VirtualMachineV2) {
+			informerUpdate.State = storage.VirtualMachineV2_STOPPED
+		},
+	} {
+		s.Run(name, func() {
+			vm := s.newVM()
+			s.NoError(s.store.UpsertVM(s.ctx, vm))
+
+			parts := s.newScanParts(vm.GetId())
+			s.NoError(s.store.UpsertScan(s.ctx, vm.GetId(), parts))
+
+			afterScan, _, err := s.store.Get(s.ctx, vm.GetId())
+			s.NoError(err)
+			s.Require().NotNil(afterScan.GetLastAgentContact())
+			contact := afterScan.GetLastAgentContact().AsTime()
+
+			informerUpdate := vm.CloneVT()
+			informerUpdate.LastUpdated = nil
+			informerUpdate.Hash = 0
+			informerUpdate.LastAgentContact = nil
+			mutate(informerUpdate)
+			s.NoError(s.store.UpsertVM(s.ctx, informerUpdate))
+
+			got, _, err := s.store.Get(s.ctx, vm.GetId())
+			s.NoError(err)
+			s.Equal(contact, got.GetLastAgentContact().AsTime())
+		})
+	}
+}
+
 // endregion UpsertVM tests
 
 // region UpsertScan tests
diff --git a/central/virtualmachine/v2/datastore/store/store.go b/central/virtualmachine/v2/datastore/store/store.go
index 6246f0affd48f..08b3ac8d05729 100644
--- a/central/virtualmachine/v2/datastore/store/store.go
+++ b/central/virtualmachine/v2/datastore/store/store.go
@@ -27,7 +27,8 @@ type Store interface {
 	// UpsertScan upserts scan data (scan, components, CVEs) for a VM.
 	// Hash-comparison determines whether a full replace or scan_time-only
 	// update is performed. CVE created_at timestamps are preserved across
-	// delete/re-insert cycles.
+	// delete/re-insert cycles. Also stamps last_agent_contact: this is the
+	// scrape-derived path.
 	// NOTE: Mutates parts in-place (Scan.ScanTime, Scan.Hash, CVE CreatedAt).
 	UpsertScan(ctx context.Context, vmID string, parts common.VMScanParts) error
 
@@ -42,6 +43,8 @@ type Store interface {
 	Search(ctx context.Context, q *v1.Query) ([]search.Result, error)
 	// Get returns the VM with the given ID.
 	Get(ctx context.Context, id string) (*storage.VirtualMachineV2, bool, error)
+	// GetWithLatestScan returns a VM and its latest scan in one query.
+	GetWithLatestScan(ctx context.Context, id string) (*common.VMWithLatestScan, bool, error)
 	// GetMany returns the VMs with the given IDs.
 	GetMany(ctx context.Context, ids []string) ([]*storage.VirtualMachineV2, []int, error)
 
diff --git a/central/virtualmachine/v2/service/service_impl.go b/central/virtualmachine/v2/service/service_impl.go
index 2e85582e4366e..855bdc9d4db8c 100644
--- a/central/virtualmachine/v2/service/service_impl.go
+++ b/central/virtualmachine/v2/service/service_impl.go
@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"slices"
+	"time"
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/pkg/errors"
@@ -13,10 +14,10 @@ import (
 	cveDS "github.com/stackrox/rox/central/virtualmachine/cve/v2/datastore"
 	scanDS "github.com/stackrox/rox/central/virtualmachine/scan/v2/datastore"
 	vmDS "github.com/stackrox/rox/central/virtualmachine/v2/datastore"
-	v1 "github.com/stackrox/rox/generated/api/v1"
 	v2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/grpc/authz"
 	"github.com/stackrox/rox/pkg/grpc/authz/perrpc"
 	"github.com/stackrox/rox/pkg/grpc/authz/user"
@@ -28,6 +29,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 const (
@@ -104,6 +106,11 @@ func (s *serviceImpl) ListVMs(ctx context.Context, request *v2.ListVMsRequest) (
 		vmIDs = append(vmIDs, vm.GetId())
 	}
 
+	scanTimeByVM, err := s.latestScanTimeByVM(ctx, vmIDs)
+	if err != nil {
+		return nil, err
+	}
+
 	// Fetch per-VM CVE severity counts via SQL GROUP BY.
 	vmFilter := search.NewQueryBuilder().AddExactMatches(search.VirtualMachineID, vmIDs...).ProtoQuery()
 	severityRows, err := s.cveView.CountBySeverityPerVM(ctx, vmFilter)
@@ -132,6 +139,7 @@ func (s *serviceImpl) ListVMs(ctx context.Context, request *v2.ListVMsRequest) (
 			item.CveSeverityCounts = &v2.VulnCountBySeverity{}
 		}
 		item.ComponentScanCount = componentCountsByVM[vm.GetId()]
+		item.ScanTime = scanTimeByVM[vm.GetId()]
 		items = append(items, item)
 	}
 
@@ -210,6 +218,32 @@ func (s *serviceImpl) GetVMDashboardCounts(ctx context.Context, request *v2.VMDa
 	}, nil
 }
 
+// latestScanTimeByVM returns the latest scan timestamp per VM. Scan IDs are
+// UUIDv7, so the greatest ID is the latest scan (same rule as GetVM).
+func (s *serviceImpl) latestScanTimeByVM(ctx context.Context, vmIDs []string) (map[string]*timestamppb.Timestamp, error) {
+	result := make(map[string]*timestamppb.Timestamp, len(vmIDs))
+	if len(vmIDs) == 0 {
+		return result, nil
+	}
+
+	q := search.NewQueryBuilder().AddExactMatches(search.VirtualMachineID, vmIDs...).ProtoQuery()
+	scans, err := s.scanDS.SearchRawVMScans(ctx, q)
+	if err != nil {
+		return nil, err
+	}
+
+	latestID := make(map[string]string, len(scans))
+	for _, scan := range scans {
+		vmID := scan.GetVmV2Id()
+		if prevID, ok := latestID[vmID]; ok && scan.GetId() <= prevID {
+			continue
+		}
+		latestID[vmID] = scan.GetId()
+		result[vmID] = scan.GetScanTime()
+	}
+	return result, nil
+}
+
 // batchComponentScanCounts fetches all components for the given VM IDs in one query
 // and counts total vs scanned per VM in memory. The component Notes field is not
 // search-indexed, so SQL-level aggregation of scanned vs unscanned is not possible.
@@ -303,7 +337,7 @@ func (s *serviceImpl) GetVMVulnSummary(ctx context.Context, request *v2.GetVMVul
 		vmFilter = search.ConjunctionQuery(vmFilter, additionalQuery)
 	}
 
-	severityCounts, err := s.cveView.CountBySeverity(ctx, vmFilter)
+	severityCounts, err := s.cveView.CountBySeverity(ctx, vmFilter, search.CVE)
 	if err != nil {
 		return nil, err
 	}
@@ -339,19 +373,50 @@ func (s *serviceImpl) ListVMCVEsByVM(ctx context.Context, request *v2.ListVMCVEs
 
 	countQuery := searchQuery.CloneVT()
 	countQuery.Pagination = nil
-	totalCount, err := s.cveDS.Count(ctx, countQuery)
+	totalCount, err := s.cveView.Count(ctx, countQuery)
 	if err != nil {
 		return nil, err
 	}
 
-	cves, err := s.cveDS.SearchRawVMCVEs(ctx, searchQuery)
+	cves, err := s.cveView.GetCVEsForVM(ctx, searchQuery)
+	if err != nil {
+		return nil, err
+	}
+
+	// Fetch one raw storage row per CVE for metadata not available through
+	// the view (summary, link). These are stored in the serialized blob.
+	cveIDs := make([]string, 0, len(cves))
+	for _, cve := range cves {
+		cveIDs = append(cveIDs, cve.GetCVE())
+	}
+	metadataByID, err := s.fetchCVEMetadata(ctx, request.GetVmId(), cveIDs)
 	if err != nil {
 		return nil, err
 	}
 
 	items := make([]*v2.VMCVERow, 0, len(cves))
 	for _, cve := range cves {
-		items = append(items, storagetov2.VirtualMachineCVEV2ToRow(cve))
+		row := &v2.VMCVERow{
+			Cve:                    cve.GetCVE(),
+			Severity:               v2.VulnerabilitySeverity(cve.GetMaxSeverity()),
+			IsFixable:              cve.GetIsFixable(),
+			Cvss:                   cve.GetMaxCVSS(),
+			NvdCvss:                cve.GetMaxNVDCVSS(),
+			EpssProbability:        cve.GetEPSSProbability(),
+			AffectedComponentCount: int32(cve.GetAffectedComponentCount()),
+			PublishedOn:            protocompat.ConvertTimeToTimestampOrNil(cve.GetPublishDate()),
+		}
+		if meta, ok := metadataByID[cve.GetCVE()]; ok {
+			row.Summary = meta.GetCveBaseInfo().GetSummary()
+			row.Link = meta.GetCveBaseInfo().GetLink()
+			if adv := meta.GetAdvisory(); adv != nil && adv.GetName() != "" {
+				row.Advisory = &v2.Advisory{
+					Name: adv.GetName(),
+					Link: adv.GetLink(),
+				}
+			}
+		}
+		items = append(items, row)
 	}
 
 	return &v2.ListVMCVEsByVMResponse{
@@ -360,6 +425,30 @@ func (s *serviceImpl) ListVMCVEsByVM(ctx context.Context, request *v2.ListVMCVEs
 	}, nil
 }
 
+// fetchCVEMetadata fetches one raw storage row per CVE for metadata fields
+// (summary, link) that aren't available through the SQL view.
+func (s *serviceImpl) fetchCVEMetadata(ctx context.Context, vmID string, cveIDs []string) (map[string]*storage.VirtualMachineCVEV2, error) {
+	if len(cveIDs) == 0 {
+		return nil, nil
+	}
+	q := search.ConjunctionQuery(
+		search.NewQueryBuilder().AddExactMatches(search.VirtualMachineID, vmID).ProtoQuery(),
+		search.NewQueryBuilder().AddExactMatches(search.CVE, cveIDs...).ProtoQuery(),
+	)
+	rows, err := s.cveDS.SearchRawVMCVEs(ctx, q)
+	if err != nil {
+		return nil, err
+	}
+	result := make(map[string]*storage.VirtualMachineCVEV2, len(cveIDs))
+	for _, row := range rows {
+		cveID := row.GetCveBaseInfo().GetCve()
+		if _, exists := result[cveID]; !exists {
+			result[cveID] = row
+		}
+	}
+	return result, nil
+}
+
 // GetVMCVEComponents returns components affected by a specific CVE on a specific VM.
 func (s *serviceImpl) GetVMCVEComponents(ctx context.Context, request *v2.GetVMCVEComponentsRequest) (*v2.GetVMCVEComponentsResponse, error) {
 	if request.GetVmId() == "" || request.GetCveId() == "" {
@@ -486,7 +575,7 @@ func (s *serviceImpl) GetVMCVEDetail(ctx context.Context, request *v2.GetVMCVEDe
 		viewFilter = search.ConjunctionQuery(viewFilter, additionalQuery)
 	}
 
-	severityCounts, err := s.cveView.CountBySeverity(ctx, viewFilter)
+	severityCounts, err := s.cveView.CountBySeverity(ctx, viewFilter, search.VirtualMachineID)
 	if err != nil {
 		return nil, err
 	}
@@ -547,8 +636,8 @@ func (s *serviceImpl) ListVMCVEAffectedVMs(ctx context.Context, request *v2.List
 		searchQuery,
 		search.NewQueryBuilder().AddExactMatches(search.CVE, request.GetCveId()).ProtoQuery(),
 	)
-	searchQuery = common.UpdateSortAggs(searchQuery)
 	paginated.FillPaginationV2(searchQuery, request.GetQuery().GetPagination(), defaultPageSize)
+	searchQuery = common.UpdateSortAggs(searchQuery)
 
 	countQuery := searchQuery.CloneVT()
 	countQuery.Pagination = nil
@@ -590,7 +679,7 @@ func (s *serviceImpl) GetVM(ctx context.Context, request *v2.GetVMRequest) (*v2.
 		return nil, status.Errorf(codes.InvalidArgument, "id must be a valid UUID (got: %q)", request.GetId())
 	}
 
-	vm, exists, err := s.vmDS.GetVirtualMachine(ctx, request.GetId())
+	vmWithScan, exists, err := s.vmDS.GetVirtualMachineWithLatestScan(ctx, request.GetId())
 	if err != nil {
 		return nil, err
 	}
@@ -598,24 +687,15 @@ func (s *serviceImpl) GetVM(ctx context.Context, request *v2.GetVMRequest) (*v2.
 		return nil, status.Errorf(codes.NotFound, "virtual machine %q not found", request.GetId())
 	}
 
+	vm := vmWithScan.VM
 	detail := storagetov2.VirtualMachineV2ToDetail(vm)
+	detail.AgentStatus = storagetov2.AgentStatusFromLastContact(
+		vm.GetLastAgentContact(),
+		time.Now(),
+		env.VirtualMachinesAgentStaleAfter.DurationSetting(),
+	)
 
-	// Get the latest scan for this VM. Scan IDs are UUIDv7 (time-sortable),
-	// so sorting by the primary key is equivalent to sorting by time and avoids
-	// a separate index scan.
-	scanQuery := search.NewQueryBuilder().AddExactMatches(search.VirtualMachineID, request.GetId()).ProtoQuery()
-	scanQuery.Pagination = &v1.QueryPagination{
-		Limit: 1,
-		SortOptions: []*v1.QuerySortOption{
-			{Field: search.VirtualMachineScanID.String(), Reversed: true},
-		},
-	}
-	scans, err := s.scanDS.SearchRawVMScans(ctx, scanQuery)
-	if err != nil {
-		return nil, err
-	}
-	if len(scans) > 0 {
-		scan := scans[0]
+	if scan := vmWithScan.Scan; scan != nil {
 		scanNotes := make([]v2.VMScanNote, 0, len(scan.GetNotes()))
 		for _, n := range scan.GetNotes() {
 			scanNotes = append(scanNotes, storagetov2.ConvertScanNote(n))
diff --git a/central/virtualmachine/v2/service/service_impl_test.go b/central/virtualmachine/v2/service/service_impl_test.go
index 593de8bf1f0a4..1dd1ae8eb09ea 100644
--- a/central/virtualmachine/v2/service/service_impl_test.go
+++ b/central/virtualmachine/v2/service/service_impl_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"testing"
+	"time"
 
 	"github.com/stackrox/rox/central/convert/storagetov2"
 	commonViews "github.com/stackrox/rox/central/views/common"
@@ -13,16 +14,39 @@ import (
 	cveDSMocks "github.com/stackrox/rox/central/virtualmachine/cve/v2/datastore/mocks"
 	scanDSMocks "github.com/stackrox/rox/central/virtualmachine/scan/v2/datastore/mocks"
 	vmDSMocks "github.com/stackrox/rox/central/virtualmachine/v2/datastore/mocks"
+	"github.com/stackrox/rox/central/virtualmachine/v2/datastore/store/common"
 	v2 "github.com/stackrox/rox/generated/api/v2"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/fixtures/fixtureconsts"
 	"github.com/stackrox/rox/pkg/grpc/testutils"
 	"github.com/stackrox/rox/pkg/protoassert"
+	"github.com/stackrox/rox/pkg/search"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
+type testCVEForVM struct {
+	cve             string
+	maxSeverity     int32
+	isFixable       bool
+	maxCVSS         float32
+	maxNVDCVSS      float32
+	epssProbability float32
+	componentCount  int
+	publishDate     *time.Time
+}
+
+func (t *testCVEForVM) GetCVE() string                 { return t.cve }
+func (t *testCVEForVM) GetMaxSeverity() int32          { return t.maxSeverity }
+func (t *testCVEForVM) GetIsFixable() bool             { return t.isFixable }
+func (t *testCVEForVM) GetMaxCVSS() float32            { return t.maxCVSS }
+func (t *testCVEForVM) GetMaxNVDCVSS() float32         { return t.maxNVDCVSS }
+func (t *testCVEForVM) GetEPSSProbability() float32    { return t.epssProbability }
+func (t *testCVEForVM) GetAffectedComponentCount() int { return t.componentCount }
+func (t *testCVEForVM) GetPublishDate() *time.Time     { return t.publishDate }
+
 func TestAuthz(t *testing.T) {
 	testutils.AssertAuthzWorks(t, &serviceImpl{})
 }
@@ -134,7 +158,7 @@ func TestGetVMVulnSummary(t *testing.T) {
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
 				mockVM.EXPECT().CountVirtualMachines(ctx, gomock.Any()).Return(1, nil)
-				mockView.EXPECT().CountBySeverity(ctx, gomock.Any()).Return(&commonViews.ResourceCountByImageCVESeverity{
+				mockView.EXPECT().CountBySeverity(ctx, gomock.Any(), search.CVE).Return(&commonViews.ResourceCountByImageCVESeverity{
 					CriticalSeverityCount:         2,
 					FixableCriticalSeverityCount:  1,
 					ImportantSeverityCount:        3,
@@ -189,7 +213,7 @@ func TestGetVMVulnSummary(t *testing.T) {
 func TestListVMCVEsByVM(t *testing.T) {
 	ctx := context.Background()
 
-	cve1 := &storage.VirtualMachineCVEV2{
+	cve1Raw := &storage.VirtualMachineCVEV2{
 		Id:            "cve-uuid-1",
 		VmV2Id:        "vm-1",
 		VmComponentId: "comp-1",
@@ -204,6 +228,14 @@ func TestListVMCVEsByVM(t *testing.T) {
 		EpssProbability: 0.5,
 	}
 
+	cve1View := &testCVEForVM{
+		cve:            "CVE-2024-1234",
+		maxSeverity:    int32(storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY),
+		isFixable:      true,
+		maxCVSS:        7.5,
+		componentCount: 3,
+	}
+
 	tests := map[string]struct {
 		request       *v2.ListVMCVEsByVMRequest
 		setupMock     func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView)
@@ -231,8 +263,9 @@ func TestListVMCVEsByVM(t *testing.T) {
 				VmId: fixtureconsts.VirtualMachine1,
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
-				mockCVE.EXPECT().Count(ctx, gomock.Any()).Return(1, nil)
-				mockCVE.EXPECT().SearchRawVMCVEs(ctx, gomock.Any()).Return([]*storage.VirtualMachineCVEV2{cve1}, nil)
+				mockView.EXPECT().Count(ctx, gomock.Any()).Return(1, nil)
+				mockView.EXPECT().GetCVEsForVM(ctx, gomock.Any()).Return([]vmcve.CVEForVMCore{cve1View}, nil)
+				mockCVE.EXPECT().SearchRawVMCVEs(ctx, gomock.Any()).Return([]*storage.VirtualMachineCVEV2{cve1Raw}, nil)
 			},
 			expectedCount: 1,
 		},
@@ -274,6 +307,9 @@ func TestListVMCVEsByVM(t *testing.T) {
 					assert.Equal(t, v2.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY, row.GetSeverity())
 					assert.True(t, row.GetIsFixable())
 					assert.Equal(t, float32(7.5), row.GetCvss())
+					assert.Equal(t, int32(3), row.GetAffectedComponentCount())
+					assert.Equal(t, "test vuln 1", row.GetSummary())
+					assert.Equal(t, "https://example.com/1", row.GetLink())
 				}
 			}
 		})
@@ -541,7 +577,7 @@ func TestGetVMCVEDetail(t *testing.T) {
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
 				mockCVE.EXPECT().SearchRawVMCVEs(ctx, gomock.Any()).Return([]*storage.VirtualMachineCVEV2{cve1}, nil)
-				mockView.EXPECT().CountBySeverity(ctx, gomock.Any()).Return(&commonViews.ResourceCountByImageCVESeverity{
+				mockView.EXPECT().CountBySeverity(ctx, gomock.Any(), search.VirtualMachineID).Return(&commonViews.ResourceCountByImageCVESeverity{
 					CriticalSeverityCount: 2,
 				}, nil)
 				mockView.EXPECT().GetVMIDs(ctx, gomock.Any()).Return([]string{"vm-1"}, nil)
@@ -558,7 +594,7 @@ func TestGetVMCVEDetail(t *testing.T) {
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
 				mockCVE.EXPECT().SearchRawVMCVEs(ctx, gomock.Any()).Return([]*storage.VirtualMachineCVEV2{cve1}, nil)
-				mockView.EXPECT().CountBySeverity(ctx, gomock.Any()).Return(&commonViews.ResourceCountByImageCVESeverity{
+				mockView.EXPECT().CountBySeverity(ctx, gomock.Any(), search.VirtualMachineID).Return(&commonViews.ResourceCountByImageCVESeverity{
 					CriticalSeverityCount: 2,
 				}, nil)
 				mockView.EXPECT().GetVMIDs(ctx, gomock.Any()).Return([]string{"vm-1"}, nil)
@@ -583,7 +619,7 @@ func TestGetVMCVEDetail(t *testing.T) {
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
 				mockCVE.EXPECT().SearchRawVMCVEs(ctx, gomock.Any()).Return([]*storage.VirtualMachineCVEV2{cve1}, nil)
-				mockView.EXPECT().CountBySeverity(ctx, gomock.Any()).Return(&commonViews.ResourceCountByImageCVESeverity{}, nil)
+				mockView.EXPECT().CountBySeverity(ctx, gomock.Any(), search.VirtualMachineID).Return(&commonViews.ResourceCountByImageCVESeverity{}, nil)
 				mockView.EXPECT().GetVMIDs(ctx, gomock.Any()).Return(nil, nil)
 				mockVM.EXPECT().CountVirtualMachines(ctx, gomock.Any()).Return(5, nil)
 			},
@@ -687,7 +723,7 @@ func TestGetVM(t *testing.T) {
 				Id: testVMID,
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
-				mockVM.EXPECT().GetVirtualMachine(ctx, testVMID).Return(nil, false, nil)
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(nil, false, nil)
 			},
 			expectedError: "not found",
 		},
@@ -696,8 +732,7 @@ func TestGetVM(t *testing.T) {
 				Id: testVMID,
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
-				mockVM.EXPECT().GetVirtualMachine(ctx, testVMID).Return(vm1, true, nil)
-				mockScan.EXPECT().SearchRawVMScans(ctx, gomock.Any()).Return([]*storage.VirtualMachineScanV2{scan1}, nil)
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(&common.VMWithLatestScan{VM: vm1, Scan: scan1}, true, nil)
 			},
 			expectedResult: func() *v2.VMDetail {
 				detail := storagetov2.VirtualMachineV2ToDetail(vm1)
@@ -715,27 +750,100 @@ func TestGetVM(t *testing.T) {
 				Id: testVMID,
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
-				mockVM.EXPECT().GetVirtualMachine(ctx, testVMID).Return(vm1, true, nil)
-				mockScan.EXPECT().SearchRawVMScans(ctx, gomock.Any()).Return(nil, nil)
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(&common.VMWithLatestScan{VM: vm1}, true, nil)
 			},
 			expectedResult: storagetov2.VirtualMachineV2ToDetail(vm1),
 		},
+		"never scraped stays unknown with vsock cid and agent version": {
+			request: &v2.GetVMRequest{
+				Id: testVMID,
+			},
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+				neverScraped := &storage.VirtualMachineV2{
+					Id:       testVMID,
+					Name:     "test-vm-1",
+					State:    storage.VirtualMachineV2_RUNNING,
+					VsockCid: 42,
+					Facts:    map[string]string{"agentVersion": "5.0.x-174-g6b7ccc2192"},
+				}
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(&common.VMWithLatestScan{VM: neverScraped}, true, nil)
+			},
+			expectedResult: func() *v2.VMDetail {
+				detail := storagetov2.VirtualMachineV2ToDetail(&storage.VirtualMachineV2{
+					Id:       testVMID,
+					Name:     "test-vm-1",
+					State:    storage.VirtualMachineV2_RUNNING,
+					VsockCid: 42,
+					Facts:    map[string]string{"agentVersion": "5.0.x-174-g6b7ccc2192"},
+				})
+				detail.AgentStatus = v2.AgentStatus_AGENT_STATUS_UNKNOWN
+				return detail
+			}(),
+		},
+		"fresh scrape is active": {
+			request: &v2.GetVMRequest{
+				Id: testVMID,
+			},
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+				fresh := vm1.CloneVT()
+				fresh.LastAgentContact = timestamppb.New(time.Now().Add(-time.Hour))
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(&common.VMWithLatestScan{VM: fresh}, true, nil)
+			},
+			expectedResult: func() *v2.VMDetail {
+				detail := storagetov2.VirtualMachineV2ToDetail(vm1)
+				detail.AgentStatus = v2.AgentStatus_AGENT_STATUS_ACTIVE
+				return detail
+			}(),
+		},
+		"activation status does not affect agent status": {
+			request: &v2.GetVMRequest{
+				Id: testVMID,
+			},
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+				fresh := vm1.CloneVT()
+				fresh.Facts = map[string]string{"activationStatus": "inactive"}
+				fresh.LastAgentContact = timestamppb.New(time.Now().Add(-time.Hour))
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(&common.VMWithLatestScan{VM: fresh}, true, nil)
+			},
+			expectedResult: func() *v2.VMDetail {
+				detail := storagetov2.VirtualMachineV2ToDetail(vm1)
+				detail.Facts = map[string]string{"activationStatus": "inactive"}
+				detail.AgentStatus = v2.AgentStatus_AGENT_STATUS_ACTIVE
+				return detail
+			}(),
+		},
+		"stale scrape is inactive even when agent version is still set": {
+			request: &v2.GetVMRequest{
+				Id: testVMID,
+			},
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+				stale := vm1.CloneVT()
+				stale.Facts = map[string]string{"agentVersion": "5.0.x-174-g6b7ccc2192"}
+				stale.LastAgentContact = timestamppb.New(time.Now().Add(-13 * time.Hour))
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(&common.VMWithLatestScan{VM: stale}, true, nil)
+			},
+			expectedResult: func() *v2.VMDetail {
+				detail := storagetov2.VirtualMachineV2ToDetail(vm1)
+				detail.Facts = map[string]string{"agentVersion": "5.0.x-174-g6b7ccc2192"}
+				detail.AgentStatus = v2.AgentStatus_AGENT_STATUS_INACTIVE
+				return detail
+			}(),
+		},
 		"datastore error": {
 			request: &v2.GetVMRequest{
 				Id: testVMID,
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
-				mockVM.EXPECT().GetVirtualMachine(ctx, testVMID).Return(nil, false, errors.New("db error"))
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(nil, false, errors.New("db error"))
 			},
 			expectedError: "db error",
 		},
-		"scan search error": {
+		"scan decoding error": {
 			request: &v2.GetVMRequest{
 				Id: testVMID,
 			},
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
-				mockVM.EXPECT().GetVirtualMachine(ctx, testVMID).Return(vm1, true, nil)
-				mockScan.EXPECT().SearchRawVMScans(ctx, gomock.Any()).Return(nil, errors.New("scan error"))
+				mockVM.EXPECT().GetVirtualMachineWithLatestScan(ctx, testVMID).Return(nil, false, errors.New("scan error"))
 			},
 			expectedError: "scan error",
 		},
@@ -793,8 +901,9 @@ func TestListVMs(t *testing.T) {
 		Notes: []storage.VirtualMachineComponentV2_Note{storage.VirtualMachineComponentV2_UNSCANNED},
 	}
 
+	scanTime := timestamppb.New(time.Date(2025, time.April, 15, 10, 30, 0, 0, time.UTC))
 	scan1 := &storage.VirtualMachineScanV2{
-		Id: "scan-1", VmV2Id: "vm-1",
+		Id: "scan-1", VmV2Id: "vm-1", ScanTime: scanTime,
 	}
 
 	tests := map[string]struct {
@@ -814,6 +923,7 @@ func TestListVMs(t *testing.T) {
 				}).AnyTimes()
 				mockView.EXPECT().CountBySeverityPerVM(ctx, gomock.Any()).Return([]vmcve.VMSeverityCounts{sevCounts}, nil)
 				mockComp.EXPECT().SearchRawVMComponents(ctx, gomock.Any()).Return([]*storage.VirtualMachineComponentV2{comp1, compUnscanned}, nil)
+				mockScan.EXPECT().SearchRawVMScans(ctx, gomock.Any()).Return([]*storage.VirtualMachineScanV2{scan1}, nil)
 				mockScan.EXPECT().GetBatch(ctx, gomock.Any()).Return([]*storage.VirtualMachineScanV2{scan1}, nil)
 			},
 			expectedCount: 1,
@@ -824,6 +934,8 @@ func TestListVMs(t *testing.T) {
 				assert.Equal(t, int32(1), item.GetCveSeverityCounts().GetCritical().GetFixable())
 				assert.Equal(t, int32(2), item.GetComponentScanCount().GetTotal())
 				assert.Equal(t, int32(1), item.GetComponentScanCount().GetScanned())
+				require.NotNil(t, item.GetScanTime())
+				assert.Equal(t, scanTime.AsTime(), item.GetScanTime().AsTime())
 			},
 		},
 		"empty list": {
@@ -833,6 +945,36 @@ func TestListVMs(t *testing.T) {
 			},
 			expectedCount: 0,
 		},
+		"should use scan time from the greatest scan ID": {
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+				// Greatest UUIDv7 ID sits in the middle with the earliest ScanTime
+				// so first-row, last-row, and max-timestamp picks fail.
+				lowID := &storage.VirtualMachineScanV2{
+					Id: "01800000-0000-7000-8000-000000000001", VmV2Id: "vm-1",
+					ScanTime: timestamppb.New(time.Date(2025, time.April, 16, 12, 0, 0, 0, time.UTC)),
+				}
+				winID := &storage.VirtualMachineScanV2{
+					Id: "01900000-0000-7000-8000-000000000003", VmV2Id: "vm-1",
+					ScanTime: timestamppb.New(time.Date(2025, time.April, 14, 8, 0, 0, 0, time.UTC)),
+				}
+				midID := &storage.VirtualMachineScanV2{
+					Id: "01880000-0000-7000-8000-000000000002", VmV2Id: "vm-1",
+					ScanTime: timestamppb.New(time.Date(2025, time.April, 15, 10, 30, 0, 0, time.UTC)),
+				}
+				mockVM.EXPECT().CountVirtualMachines(ctx, gomock.Any()).Return(1, nil)
+				mockVM.EXPECT().SearchRawVirtualMachines(ctx, gomock.Any()).Return([]*storage.VirtualMachineV2{vm1}, nil)
+				mockView.EXPECT().CountBySeverityPerVM(ctx, gomock.Any()).Return(nil, nil)
+				mockComp.EXPECT().SearchRawVMComponents(ctx, gomock.Any()).Return(nil, nil)
+				mockScan.EXPECT().SearchRawVMScans(ctx, gomock.Any()).Return([]*storage.VirtualMachineScanV2{lowID, winID, midID}, nil)
+				mockScan.EXPECT().GetBatch(ctx, gomock.Any()).Return(nil, nil)
+			},
+			expectedCount: 1,
+			checkResult: func(t *testing.T, resp *v2.ListVMsResponse) {
+				require.Len(t, resp.GetVms(), 1)
+				require.NotNil(t, resp.GetVms()[0].GetScanTime())
+				assert.Equal(t, time.Date(2025, time.April, 14, 8, 0, 0, 0, time.UTC), resp.GetVms()[0].GetScanTime().AsTime())
+			},
+		},
 		"vm count error": {
 			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
 				mockVM.EXPECT().CountVirtualMachines(ctx, gomock.Any()).Return(0, errors.New("count error"))
diff --git a/central/worker/main.go b/central/worker/main.go
index f6a26fbacbd5a..0818932478d55 100644
--- a/central/worker/main.go
+++ b/central/worker/main.go
@@ -10,20 +10,25 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/stackrox/rox/central/globaldb"
+	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
+	notifierProcessor "github.com/stackrox/rox/central/notifier/processor"
+	_ "github.com/stackrox/rox/central/notifiers/all"
+	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
+	vulnReportV2Scheduler "github.com/stackrox/rox/central/reports/scheduler/v2"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
 	"github.com/stackrox/rox/central/version"
 	vStore "github.com/stackrox/rox/central/version/store"
+	"github.com/stackrox/rox/pkg/dblock"
 	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/logging"
 	pkgMetrics "github.com/stackrox/rox/pkg/metrics"
-	"github.com/stackrox/rox/pkg/postgres"
-	"github.com/stackrox/rox/pkg/postgres/pgconfig"
 	"github.com/stackrox/rox/pkg/premain"
 	"github.com/stackrox/rox/pkg/retry"
 )
 
 const (
-	dbOpenRetries             = 10
-	dbTimeBetweenRetries      = 10 * time.Second
 	healthAddr                = ":8082"
 	defaultWorkerPoolMaxConns = 20
 )
@@ -41,61 +46,78 @@ func main() {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	db := initDB(ctx)
-	defer db.Close()
+	poolVal := workerPoolSize.IntegerSetting()
+	if poolVal < 1 || poolVal > math.MaxInt32 {
+		log.Fatalf("ROX_WORKER_DB_POOL_MAX_CONNS must be between 1 and %d, got %d", math.MaxInt32, poolVal)
+	}
+	globaldb.InitializePostgresWithPoolSize(ctx, int32(poolVal))
+	log.Infof("DB pool initialized with max_conns=%d", poolVal)
 
-	ensureDBCurrent(db)
+	waitForMigrations(ctx)
 
 	startHealthServer()
 
 	go startMetricsServer()
 
+	scheduler := vulnReportV2Scheduler.Singleton()
+	scheduler.Start(globaldb.GetPostgres())
+	log.Infof("Vulnerability report scheduler started")
+
+	collectionDatastore, _ := collectionDS.Singleton()
+	rl := newReportListener(
+		globaldb.GetPostgres(),
+		scheduler,
+		reportConfigDS.Singleton(),
+		reportSnapshotDS.Singleton(),
+		collectionDatastore,
+		notifierDS.Singleton(),
+		notifierProcessor.Singleton(),
+	)
+	rl.start(ctx)
+	log.Infof("Report LISTEN/NOTIFY listener started")
+
 	log.Infof("central-worker is ready")
 
 	waitForTerminationSignal()
 
 	log.Infof("central-worker shutting down")
+
+	scheduler.Stop()
+
+	globaldb.Close()
 }
 
-func initDB(ctx context.Context) postgres.DB {
-	_, dbConfig, err := pgconfig.GetPostgresConfig()
-	if err != nil {
-		log.Fatalf("Could not parse postgres config: %v", err)
-	}
+func waitForMigrations(ctx context.Context) {
+	versionStore := vStore.NewPostgres(globaldb.GetPostgres())
+	err := retry.WithRetry(func() error {
+		acquired, release, err := dblock.TryAcquireAdvisoryLock(ctx, globaldb.GetPostgres(), dblock.MigrationLockID)
+		if err != nil {
+			return retry.MakeRetryable(err)
+		}
+		if !acquired {
+			return retry.MakeRetryable(errMigratorRunning)
+		}
+		defer release()
 
-	if !pgconfig.IsExternalDatabase() {
-		activeDB := pgconfig.GetActiveDB()
-		dbConfig.ConnConfig.Database = activeDB
+		if err := version.Ensure(versionStore); err != nil {
+			return retry.MakeRetryable(err)
+		}
+		return nil
+	}, retry.Tries(30), retry.BetweenAttempts(func(attempt int) {
+		log.Infof("Migrations not yet complete, waiting (attempt %d)...", attempt+1)
+		time.Sleep(10 * time.Second)
+	}))
+	if err != nil {
+		log.Fatalf("Timed out waiting for migrations to complete: %v", err)
 	}
+	log.Infof("Migrations complete, proceeding with startup")
+}
 
-	poolVal := workerPoolSize.IntegerSetting()
-	if poolVal < 1 || poolVal > math.MaxInt32 {
-		log.Fatalf("ROX_WORKER_DB_POOL_MAX_CONNS must be between 1 and %d, got %d", math.MaxInt32, poolVal)
-	}
-	dbConfig.MaxConns = int32(poolVal)
-
-	var db postgres.DB
-	if err := retry.WithRetry(func() error {
-		db, err = postgres.New(ctx, dbConfig)
-		return err
-	}, retry.Tries(dbOpenRetries), retry.BetweenAttempts(func(attempt int) {
-		time.Sleep(dbTimeBetweenRetries)
-	}), retry.OnFailedAttempts(func(err error) {
-		log.Errorf("open database: %v", err)
-	})); err != nil {
-		log.Fatalf("Timed out trying to open database: %v", err)
-	}
+var errMigratorRunning = retryableError("migrator is still running")
 
-	return db
-}
+type retryableError string
 
-func ensureDBCurrent(db postgres.DB) {
-	versionStore := vStore.NewPostgres(db)
-	if err := version.Ensure(versionStore); err != nil {
-		log.Fatalf("DB version check failed. Migrations may not be complete: %v", err)
-	}
-	log.Infof("DB version verified")
-}
+func (e retryableError) Error() string { return string(e) }
 
 func startHealthServer() {
 	mux := http.NewServeMux()
diff --git a/central/worker/report_listener.go b/central/worker/report_listener.go
new file mode 100644
index 0000000000000..2b2310a7a6359
--- /dev/null
+++ b/central/worker/report_listener.go
@@ -0,0 +1,240 @@
+package main
+
+import (
+	"context"
+	"time"
+
+	notifierDS "github.com/stackrox/rox/central/notifier/datastore"
+	"github.com/stackrox/rox/central/reports/common"
+	reportConfigDS "github.com/stackrox/rox/central/reports/config/datastore"
+	schedulerV2 "github.com/stackrox/rox/central/reports/scheduler/v2"
+	reportGen "github.com/stackrox/rox/central/reports/scheduler/v2/reportgenerator"
+	reportSnapshotDS "github.com/stackrox/rox/central/reports/snapshot/datastore"
+	collectionDS "github.com/stackrox/rox/central/resourcecollection/datastore"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/notifier"
+	pkgNotifiers "github.com/stackrox/rox/pkg/notifiers"
+	"github.com/stackrox/rox/pkg/postgres"
+	pgNotify "github.com/stackrox/rox/pkg/postgres/notify"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/search"
+	"github.com/stackrox/rox/pkg/set"
+	"github.com/stackrox/rox/pkg/sync"
+)
+
+var listenerCtx = sac.WithAllAccess(context.Background())
+
+type reportListener struct {
+	db                  postgres.DB
+	scheduler           schedulerV2.Scheduler
+	reportConfigStore   reportConfigDS.DataStore
+	snapshotStore       reportSnapshotDS.DataStore
+	collectionDatastore collectionDS.DataStore
+	notifierStore       notifierDS.DataStore
+	notifierProcessor   notifier.Processor
+	knownMu             sync.Mutex
+	knownReportIDs      set.StringSet
+}
+
+func newReportListener(
+	db postgres.DB,
+	scheduler schedulerV2.Scheduler,
+	reportConfigStore reportConfigDS.DataStore,
+	snapshotStore reportSnapshotDS.DataStore,
+	collectionDatastore collectionDS.DataStore,
+	notifierStore notifierDS.DataStore,
+	notifierProcessor notifier.Processor,
+) *reportListener {
+	return &reportListener{
+		db:                  db,
+		scheduler:           scheduler,
+		reportConfigStore:   reportConfigStore,
+		snapshotStore:       snapshotStore,
+		collectionDatastore: collectionDatastore,
+		notifierStore:       notifierStore,
+		notifierProcessor:   notifierProcessor,
+		knownReportIDs:      set.NewStringSet(),
+	}
+}
+
+func (r *reportListener) start(ctx context.Context) {
+	listener := pgNotify.NewListener(r.db, r.handleNotification,
+		pgNotify.NotifierChanged,
+		pgNotify.ReportConfigChanged,
+		pgNotify.ReportRequestSubmitted,
+		pgNotify.ReportRequestCancelled,
+	)
+	go listener.Listen(ctx)
+	go r.periodicResync(ctx)
+}
+
+func (r *reportListener) handleNotification(channel, payload string) {
+	switch channel {
+	case pgNotify.NotifierChanged:
+		r.handleNotifierChanged(payload)
+	case pgNotify.ReportConfigChanged:
+		r.handleConfigChanged(payload)
+	case pgNotify.ReportRequestSubmitted:
+		r.handleRequestSubmitted(payload)
+	case pgNotify.ReportRequestCancelled:
+		r.handleRequestCancelled(payload)
+	}
+}
+
+func (r *reportListener) handleNotifierChanged(notifierID string) {
+	protoNotifier, exists, err := r.notifierStore.GetNotifier(listenerCtx, notifierID)
+	if err != nil {
+		log.Errorf("Failed to load notifier %s: %v", notifierID, err)
+		return
+	}
+	if !exists {
+		r.notifierProcessor.RemoveNotifier(listenerCtx, notifierID)
+		return
+	}
+	n, err := pkgNotifiers.CreateNotifier(protoNotifier)
+	if err != nil {
+		log.Errorf("Failed to create notifier %s: %v", notifierID, err)
+		return
+	}
+	r.notifierProcessor.UpdateNotifier(listenerCtx, n)
+}
+
+func (r *reportListener) handleConfigChanged(configID string) {
+	config, exists, err := r.reportConfigStore.GetReportConfiguration(listenerCtx, configID)
+	if err != nil {
+		log.Errorf("Failed to load report config %s: %v", configID, err)
+		return
+	}
+	if !exists {
+		r.scheduler.RemoveReportSchedule(configID)
+		return
+	}
+	if config.GetSchedule() != nil {
+		if err := r.scheduler.UpsertReportSchedule(config); err != nil {
+			log.Errorf("Failed to upsert schedule for config %s: %v", configID, err)
+		}
+	} else {
+		r.scheduler.RemoveReportSchedule(configID)
+	}
+}
+
+func (r *reportListener) handleRequestSubmitted(snapshotID string) {
+	snap, exists, err := r.snapshotStore.Get(listenerCtx, snapshotID)
+	if err != nil || !exists {
+		log.Errorf("Failed to load report snapshot %s: exists=%v err=%v", snapshotID, exists, err)
+		return
+	}
+	if snap.GetReportStatus().GetRunState() != storage.ReportStatus_WAITING {
+		return
+	}
+
+	var collection *storage.ResourceCollection
+	if snap.GetCollection().GetId() != "" {
+		collection, exists, err = r.collectionDatastore.Get(listenerCtx, snap.GetCollection().GetId())
+		if err != nil || !exists {
+			log.Errorf("Failed to load collection for snapshot %s: %v", snapshotID, err)
+			return
+		}
+	}
+
+	req := &reportGen.ReportRequest{
+		ReportSnapshot: snap,
+		Collection:     collection,
+	}
+	r.submitIfNew(snapshotID, req)
+}
+
+func (r *reportListener) handleRequestCancelled(snapshotID string) {
+	if _, err := r.scheduler.CancelReportRequest(listenerCtx, snapshotID); err != nil {
+		log.Errorf("Failed to cancel report request %s: %v", snapshotID, err)
+	}
+}
+
+func (r *reportListener) periodicResync(ctx context.Context) {
+	ticker := time.NewTicker(time.Duration(env.CentralWorkerResyncIntervalMins.IntegerSetting()) * time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			r.resyncConfigs()
+			r.resyncPendingRequests()
+		}
+	}
+}
+
+func (r *reportListener) resyncConfigs() {
+	query := search.NewQueryBuilder().
+		AddExactMatches(search.ReportType,
+			storage.ReportConfiguration_VULNERABILITY.String(),
+			storage.ReportConfiguration_NODE_VULNERABILITY.String(),
+		).
+		ProtoQuery()
+	configs, err := r.reportConfigStore.GetReportConfigurations(listenerCtx, query)
+	if err != nil {
+		log.Errorf("Error resyncing report configs: %v", err)
+		return
+	}
+
+	activeConfigIDs := set.NewStringSet()
+	for _, rc := range configs {
+		if rc.GetSchedule() != nil && common.HasValidResourceScope(rc.GetResourceScope()) {
+			activeConfigIDs.Add(rc.GetId())
+			if err := r.scheduler.UpsertReportSchedule(rc); err != nil {
+				log.Errorf("Error resyncing schedule for config %s: %v", rc.GetId(), err)
+			}
+		}
+	}
+
+	for _, id := range r.scheduler.GetScheduledConfigIDs() {
+		if !activeConfigIDs.Contains(id) {
+			r.scheduler.RemoveReportSchedule(id)
+		}
+	}
+}
+
+func (r *reportListener) resyncPendingRequests() {
+	query := search.NewQueryBuilder().
+		AddExactMatches(search.ReportState, storage.ReportStatus_WAITING.String()).
+		WithPagination(search.NewPagination().AddSortOption(search.NewSortOption(search.ReportQueuedTime))).
+		ProtoQuery()
+	snapshots, err := r.snapshotStore.SearchReportSnapshots(listenerCtx, query)
+	if err != nil {
+		log.Errorf("Error resyncing pending report requests: %v", err)
+		return
+	}
+
+	for _, snap := range snapshots {
+		var collection *storage.ResourceCollection
+		if collID := snap.GetCollection().GetId(); collID != "" {
+			var exists bool
+			collection, exists, err = r.collectionDatastore.Get(listenerCtx, collID)
+			if err != nil || !exists {
+				log.Errorf("Error loading collection for pending snapshot %s: %v", snap.GetReportId(), err)
+				continue
+			}
+		}
+
+		req := &reportGen.ReportRequest{
+			ReportSnapshot: snap,
+			Collection:     collection,
+		}
+		r.submitIfNew(snap.GetReportId(), req)
+	}
+}
+
+func (r *reportListener) submitIfNew(reportID string, req *reportGen.ReportRequest) {
+	r.knownMu.Lock()
+	defer r.knownMu.Unlock()
+
+	if r.knownReportIDs.Contains(reportID) {
+		return
+	}
+	if _, err := r.scheduler.SubmitReportRequest(listenerCtx, req, true); err != nil {
+		log.Errorf("Failed to submit report request %s: %v", reportID, err)
+		return
+	}
+	r.knownReportIDs.Add(reportID)
+}
diff --git a/compliance/cmd/compliance/main.go b/compliance/cmd/compliance/main.go
index 64180efb53a13..5f9811ac51c5a 100644
--- a/compliance/cmd/compliance/main.go
+++ b/compliance/cmd/compliance/main.go
@@ -31,7 +31,9 @@ func main() {
 	cfg := index.DefaultNodeIndexerConfig()
 
 	scanner := inventory.NewNodeInventoryComponentScanner(np)
-	scanner.Connect(env.NodeScanningEndpoint.Setting())
+	if env.NodeInventoryContainerEnabled.BooleanSetting() {
+		scanner.Connect(env.NodeScanningEndpoint.Setting())
+	}
 	cachedNodeIndexer := index.NewCachingNodeIndexer(cfg, env.NodeIndexCacheDuration.DurationSetting(), env.NodeIndexCachePath.Setting())
 
 	ctx, cancel := context.WithCancel(context.Background())
diff --git a/compliance/node/index/indexer.go b/compliance/node/index/indexer.go
index b783fc9c5b8cc..673e44b5a256a 100644
--- a/compliance/node/index/indexer.go
+++ b/compliance/node/index/indexer.go
@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -39,8 +40,6 @@ import (
 const (
 	layerMediaType = "application/vnd.claircore.filesystem"
 
-	rhcosPackageDB = "sqlite:usr/share/rpm"
-
 	// scannerDefinitionsRouteInSensor should be in sync with `scannerDefinitionsRoute` in sensor/sensor.go
 	// Direct import is prohibited by import rules
 	scannerDefinitionsRouteInSensor = "/scanner/definitions"
@@ -50,6 +49,16 @@ const (
 var (
 	log = logging.LoggerForModule()
 
+	// rhcosPackageDBs are Claircore PackageDB names for RHCOS RPM databases.
+	// RHEL 8 uses Berkeley DB; RHEL 9+ uses SQLite. ostree reports the same RPMs
+	// under usr/share/rpm and usr/lib/sysimage/rpm-ostree-base-db.
+	rhcosPackageDBs = []string{
+		"sqlite:usr/share/rpm",
+		"sqlite:usr/lib/sysimage/rpm",
+		"bdb:usr/share/rpm",
+		"bdb:usr/lib/sysimage/rpm-ostree-base-db",
+	}
+
 	// layerDigest is a dummy digest solely meant as a workaround to use Claircore.
 	// Claircore indexing requires layers to have a digest, which is not stored,
 	// so we use a fake one for all nodes.
@@ -118,11 +127,9 @@ type NodeIndexerConfig struct {
 	Repo2CPEMappingFile string
 	// Timeout controls the timeout for any remote API calls.
 	Timeout time.Duration
-	// PackageDBFilter removes irrelevant packages. For node scanning, we are
-	// currently only interested in the RHCOS RPM database.
-	// Filters out all packages whose packageDB does not match the filter.
-	// Empty string corresponds to no filtering.
-	PackageDBFilter string
+	// PackageDBFilter keeps RHCOS RPM databases and drops other package DBs
+	// Claircore finds under the host index mount. Empty means no filtering.
+	PackageDBFilter []string
 }
 
 // DefaultNodeIndexerConfig provides the default configuration for a node indexer.
@@ -134,7 +141,7 @@ func DefaultNodeIndexerConfig() NodeIndexerConfig {
 		Client:             nil,
 		Repo2CPEMappingURL: buildMappingURL(),
 		Timeout:            10 * time.Second,
-		PackageDBFilter:    rhcosPackageDB,
+		PackageDBFilter:    rhcosPackageDBs,
 	}
 }
 
@@ -273,23 +280,14 @@ func runRepositoryScanner(ctx context.Context, cfg NodeIndexerConfig, l *clairco
 	return repos, nil
 }
 
-func runPackageScanner(ctx context.Context, packageDBFilter string, layer *claircore.Layer) ([]*claircore.Package, error) {
+func runPackageScanner(ctx context.Context, packageDBFilter []string, layer *claircore.Layer) ([]*claircore.Package, error) {
 	scanner := rhel.PackageScanner{}
 	pkgs, err := scanner.Scan(ctx, layer)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to invoke RHEL scanner")
 	}
 
-	// Filter out packages in which we are not interested.
-	filtered := pkgs
-	if packageDBFilter != "" {
-		filtered = pkgs[:0]
-		for _, pkg := range pkgs {
-			if pkg.PackageDB == packageDBFilter {
-				filtered = append(filtered, pkg)
-			}
-		}
-	}
+	filtered := filterPackages(pkgs, packageDBFilter)
 	for i, p := range filtered {
 		p.ID = strconv.Itoa(i)
 	}
@@ -297,6 +295,33 @@ func runPackageScanner(ctx context.Context, packageDBFilter string, layer *clair
 	return filtered, nil
 }
 
+// filterPackages keeps packages whose PackageDB is in packageDBFilter.
+// ostree nodes expose the same RPMs in two PackageDBs, so duplicates
+// collapse to one per name/version/arch/kind.
+func filterPackages(pkgs []*claircore.Package, packageDBFilter []string) []*claircore.Package {
+	if len(packageDBFilter) == 0 {
+		return pkgs
+	}
+	type ident struct {
+		name, version, arch string
+		kind                types.PackageKind
+	}
+	out := make([]*claircore.Package, 0, len(pkgs))
+	seen := make(map[ident]struct{}, len(pkgs))
+	for _, pkg := range pkgs {
+		if !slices.Contains(packageDBFilter, pkg.PackageDB) {
+			continue
+		}
+		id := ident{pkg.Name, pkg.Version, pkg.Arch, pkg.Kind}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		out = append(out, pkg)
+	}
+	return out
+}
+
 func runCoalescer(ctx context.Context, layerDigest claircore.Digest, repos []*claircore.Repository, pkgs []*claircore.Package) (*claircore.IndexReport, error) {
 	la := &ccindexer.LayerArtifacts{
 		Hash:  layerDigest,
diff --git a/compliance/node/index/indexer_test.go b/compliance/node/index/indexer_test.go
index 148dbdf20c91a..2adcbebe7807e 100644
--- a/compliance/node/index/indexer_test.go
+++ b/compliance/node/index/indexer_test.go
@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -164,7 +165,7 @@ func (s *nodeIndexerSuite) TestRunRepositoryScannerAnyPath() {
 func (s *nodeIndexerSuite) TestRunPackageScanner() {
 	layer := s.mustCreateLayer("testdata")
 
-	packages, err := runPackageScanner(context.Background(), rhcosPackageDB, layer)
+	packages, err := runPackageScanner(context.Background(), rhcosPackageDBs, layer)
 	s.NoError(err)
 
 	s.Len(packages, 106)
@@ -173,7 +174,7 @@ func (s *nodeIndexerSuite) TestRunPackageScanner() {
 func (s *nodeIndexerSuite) TestRunPackageScannerWithUnmatchedFilter() {
 	layer := s.mustCreateLayer("testdata")
 
-	packages, err := runPackageScanner(context.Background(), "invalidPackageDB", layer)
+	packages, err := runPackageScanner(context.Background(), []string{"invalidPackageDB"}, layer)
 	s.NoError(err)
 
 	// All packages are filtered out.
@@ -183,13 +184,92 @@ func (s *nodeIndexerSuite) TestRunPackageScannerWithUnmatchedFilter() {
 func (s *nodeIndexerSuite) TestRunPackageScannerAnyPath() {
 	layer := s.mustCreateLayer(s.T().TempDir())
 
-	packages, err := runPackageScanner(context.Background(), rhcosPackageDB, layer)
+	packages, err := runPackageScanner(context.Background(), rhcosPackageDBs, layer)
 	s.NoError(err)
 
 	// The scanner must not error out, but produce 0 results
 	s.Len(packages, 0)
 }
 
+func (s *nodeIndexerSuite) TestRHCOSPackageDBs() {
+	tests := map[string]bool{
+		"sqlite:usr/share/rpm":                    true,
+		"sqlite:usr/lib/sysimage/rpm":             true,
+		"bdb:usr/share/rpm":                       true,
+		"bdb:usr/lib/sysimage/rpm-ostree-base-db": true,
+		"sqlite:var/lib/rpm":                      false,
+	}
+	for db, want := range tests {
+		s.Run(db, func() {
+			s.Equal(want, slices.Contains(rhcosPackageDBs, db))
+		})
+	}
+}
+
+func (s *nodeIndexerSuite) TestFilterPackages() {
+	pkg := func(db, name, version string) *claircore.Package {
+		return &claircore.Package{
+			PackageDB: db,
+			Name:      name,
+			Version:   version,
+			Arch:      "x86_64",
+			Kind:      types.BinaryPackage,
+		}
+	}
+	share := "bdb:usr/share/rpm"
+	ostree := "bdb:usr/lib/sysimage/rpm-ostree-base-db"
+	filter := []string{share, ostree}
+
+	tests := map[string]struct {
+		pkgs   []*claircore.Package
+		filter []string
+		want   int
+	}{
+		"empty filter keeps all": {
+			pkgs:   []*claircore.Package{pkg(share, "bash", "1"), pkg("other", "zsh", "1")},
+			filter: nil,
+			want:   2,
+		},
+		"unmatched PackageDB dropped": {
+			pkgs:   []*claircore.Package{pkg("sqlite:var/lib/rpm", "bash", "1")},
+			filter: filter,
+			want:   0,
+		},
+		"ostree duplicate PackageDBs collapse": {
+			pkgs: []*claircore.Package{
+				pkg(share, "bash", "5.0"),
+				pkg(ostree, "bash", "5.0"),
+			},
+			filter: filter,
+			want:   1,
+		},
+		"distinct NEVRAs kept": {
+			pkgs: []*claircore.Package{
+				pkg(share, "bash", "5.0"),
+				pkg(share, "coreutils", "8.0"),
+			},
+			filter: filter,
+			want:   2,
+		},
+	}
+	for name, tc := range tests {
+		s.Run(name, func() {
+			s.Len(filterPackages(tc.pkgs, tc.filter), tc.want)
+		})
+	}
+
+	s.Run("does not alias input backing array", func() {
+		a := pkg(share, "bash", "5.0")
+		b := pkg(ostree, "bash", "5.0")
+		in := []*claircore.Package{a, b}
+		got := filterPackages(in, filter)
+		s.Len(got, 1)
+		s.Same(a, in[0])
+		s.Same(b, in[1])
+		s.Len(in, 2)
+	})
+}
+
 func (s *nodeIndexerSuite) TestBuildMappingURL() {
 	tcs := map[string]struct {
 		sensorEndpointSetting     string
@@ -285,7 +365,7 @@ func (s *nodeIndexerSuite) TestIndexerE2E() {
 		cfg := DefaultNodeIndexerConfig()
 		cfg.HostPath = "testdata"
 		cfg.Repo2CPEMappingURL = server.URL
-		cfg.PackageDBFilter = rhcosPackageDB
+		cfg.PackageDBFilter = rhcosPackageDBs
 
 		report, err := NewNodeIndexer(cfg).IndexNode(context.Background())
 		s.NoError(err)
@@ -304,7 +384,7 @@ func (s *nodeIndexerSuite) TestIndexerE2E() {
 		s.Equal(buildMappingURL(), cfg.Repo2CPEMappingURL)
 		s.Nil(cfg.Client)
 		cfg.HostPath = "testdata"
-		cfg.PackageDBFilter = rhcosPackageDB
+		cfg.PackageDBFilter = rhcosPackageDBs
 
 		report, err := NewNodeIndexer(cfg).IndexNode(context.Background())
 		s.NoError(err)
@@ -324,7 +404,7 @@ func (s *nodeIndexerSuite) TestIndexerE2ESeparateOSReleasePath() {
 	cfg.OSReleasePath = "testdata-rhcos"
 	cfg.Repo2CPEMappingURL = server.URL
 	cfg.Client = server.Client()
-	cfg.PackageDBFilter = rhcosPackageDB
+	cfg.PackageDBFilter = rhcosPackageDBs
 	indexer := NewNodeIndexer(cfg)
 
 	report, err := indexer.IndexNode(context.Background())
@@ -354,7 +434,7 @@ func (s *nodeIndexerSuite) TestIndexerE2ENoPath() {
 	cfg.Client = server.Client()
 	cfg.HostPath = "doesnotexist"
 	cfg.Repo2CPEMappingURL = server.URL
-	cfg.PackageDBFilter = rhcosPackageDB
+	cfg.PackageDBFilter = rhcosPackageDBs
 	indexer := NewNodeIndexer(cfg)
 
 	report, err := indexer.IndexNode(context.Background())
diff --git a/compliance/virtualmachines/roxagent/README.md b/compliance/virtualmachines/roxagent/README.md
index f76efe476d689..4dafcb651f3dd 100644
--- a/compliance/virtualmachines/roxagent/README.md
+++ b/compliance/virtualmachines/roxagent/README.md
@@ -8,10 +8,10 @@ The sources live under `compliance/` because the agent reuses the Scanner V4 nod
 
 ## What it does
 
-1. Fetches the repository-to-CPE mapping file (required before the first scan).
-2. Scans the VM for installed packages and caches the index report with a generation counter.
-3. Listens on a VSOCK port with mandatory mTLS.
-4. On each Sensor connection, handles a framed `VMServiceRequest` / `VMServiceResponse` (for example `get_report`).
+1. Listens on a VSOCK port with mandatory mTLS. Startup does not wait for a mapping or a first scan.
+2. Obtains a repository-to-CPE mapping (Sensor push over VSOCK by default, or a download URL). Until one is ready, GetReport returns `MAPPING_REQUIRED` and no scan runs.
+3. Scans the VM for installed packages and caches the index report with a content-hash token.
+4. On each Sensor connection, handles a framed `VMServiceRequest` / `VMServiceResponse` (for example `get_report` and `sync_repo_cpe_mapping`).
 5. Periodically rescans and atomically swaps the cached report.
 
 ## Usage
@@ -29,19 +29,20 @@ sudo ./roxagent serve --port 818 --host-path / --rescan-interval 4h
 |------|---------|-------|
 | `--port` | `818` | VSOCK listen port |
 | `--host-path` | `/` | Root filesystem path for package indexing |
-| `--repo-cpe-url` | Red Hat security data URL | Repository-to-CPE mapping download URL |
+| `--repo-cpe-url` | empty (Sensor-managed) | Mapping download URL. Empty means Sensor pushes the mapping over VSOCK. |
+| `--repo-cpe-bundled-path` | empty | Optional seed mapping file for Sensor-managed agents. Ignored when `--repo-cpe-url` is set. |
 | `--rescan-interval` | `4h` | Must be between `5m` and `168h` (7d) |
 | `--ca-fetch-timeout` | `10s` | Timeout for one KubeVirt CA fetch over VSOCK |
 | `--conn-deadline` | `30s` | Max time for one connection's TLS handshake plus request/response (`5s`-`5m`) |
 
 ## How it works
 
-1. **Mapping file:** On startup the agent downloads the repository-to-CPE mapping into a local cache and blocks until that succeeds. Every scan reads from that file. If a later refresh fails, the agent keeps the last good cache and continues scanning.
+1. **Mapping file:** Every scan reads a local cache file kept fresh by a mapping provider. With `--repo-cpe-url` empty (the default), Sensor pushes the mapping over VSOCK via `sync_repo_cpe_mapping`. `--repo-cpe-bundled-path` is an optional seed for that Sensor-managed path when there is no cache yet. With a URL set, the agent downloads in the background and never accepts a Sensor push or a bundled seed: a URL that never succeeds stays not-ready rather than looking configured. A failed later URL refresh keeps the last-good cache from a previous successful fetch of that URL.
 
-   The default `--repo-cpe-url` is `https://security.access.redhat.com/data/metrics/repository-to-cpe.json`, so the VM needs outbound HTTPS to that host (or a proxy that can reach it). On isolated networks, host a copy of `repository-to-cpe.json` somewhere the VM can reach and point `--repo-cpe-url` at that URL.
-2. **Initial scan:** Indexes `--host-path`, stores the report and discovered VM facts in an in-memory cache, then starts the VSOCK server and the rescan loop.
-3. **Serving reports:** Sensor connects and the agent serves the cached report. If Sensor already has the current generation, the agent omits the payload.
-4. **Rescan:** On `--rescan-interval`, re-indexes the rpm/dnf database and swaps the cache, bumping the generation.
+   A URL-backed agent needs outbound HTTPS to that host (or a proxy). Isolated networks either rely on Sensor (optionally with a bundled seed), or host a copy of `repository-to-cpe.json` the VM can reach and pass `--repo-cpe-url`.
+2. **Listen first:** VSOCK comes up immediately. The first scan runs when a mapping is ready (cached from a previous run, a bundled seed, a successful URL fetch, or a Sensor push), not at process start.
+3. **Serving reports:** Sensor connects and the agent serves the cached report. If Sensor already has the current content-hash token, the agent omits the payload. Sensor can still force a full report by sending an empty token (first request, NACK retry, or the 4h refresh). With no mapping yet, the response is `MAPPING_REQUIRED`.
+4. **Rescan:** On `--rescan-interval`, or sooner when the mapping changes, re-indexes the rpm/dnf database and swaps the cache. The token stays the same when the report and facts are unchanged.
 
 ### TLS (mandatory)
 
diff --git a/compliance/virtualmachines/roxagent/cmd/cmd.go b/compliance/virtualmachines/roxagent/cmd/cmd.go
index 63b598d014e80..ded5aa003db5e 100644
--- a/compliance/virtualmachines/roxagent/cmd/cmd.go
+++ b/compliance/virtualmachines/roxagent/cmd/cmd.go
@@ -9,8 +9,6 @@ import (
 
 var log = logging.LoggerForModule()
 
-const repoToCPEMappingURL = "https://security.access.redhat.com/data/metrics/repository-to-cpe.json"
-
 func RootCmd(ctx context.Context) *cobra.Command {
 	cmd := cobra.Command{
 		Use:          "agent",
diff --git a/compliance/virtualmachines/roxagent/cmd/mapping_downloader.go b/compliance/virtualmachines/roxagent/cmd/mapping_downloader.go
deleted file mode 100644
index 08c978327464c..0000000000000
--- a/compliance/virtualmachines/roxagent/cmd/mapping_downloader.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package cmd
-
-import (
-	"time"
-
-	"github.com/stackrox/rox/pkg/filedownloader"
-)
-
-const (
-	mappingFetchRetryMax     = 3 // RetryMax: 1 initial + 3 retries = 4 attempts.
-	mappingFetchRetryWaitMin = 5 * time.Second
-	// Must cover retryablehttp backoff plus request time. With WaitMin=5s and
-	// retryablehttp's default WaitMax=30s, waits are 5+10+20=35s; leave
-	// headroom for four HTTP attempts on a multi-MB mapping file.
-	mappingClientTimeout   = 2 * time.Minute
-	mappingRefreshInterval = time.Hour
-)
-
-// newMappingDownloader builds the filedownloader.Downloader that keeps the
-// repository-to-CPE mapping file at cachePath fresh. scan() only reads the
-// local file, so a flaky mapping endpoint never blocks a scan directly.
-// onComplete is invoked after every fetch attempt (the mandatory initial
-// one and every later periodic refresh); the caller decides what that
-// means for logging.
-func newMappingDownloader(url, cachePath string, onComplete func(err error, duration time.Duration)) *filedownloader.Downloader {
-	return filedownloader.New(url, cachePath, mappingRefreshInterval,
-		filedownloader.WithRequestTimeout(mappingClientTimeout),
-		filedownloader.WithRetryMax(mappingFetchRetryMax),
-		filedownloader.WithRetryWaitMin(mappingFetchRetryWaitMin),
-		filedownloader.WithOnComplete(onComplete),
-	)
-}
diff --git a/compliance/virtualmachines/roxagent/cmd/rescanner.go b/compliance/virtualmachines/roxagent/cmd/rescanner.go
index e4597a312f4aa..98af9a7281b77 100644
--- a/compliance/virtualmachines/roxagent/cmd/rescanner.go
+++ b/compliance/virtualmachines/roxagent/cmd/rescanner.go
@@ -2,6 +2,8 @@ package cmd
 
 import (
 	"context"
+	"fmt"
+	"sync/atomic"
 	"time"
 
 	"github.com/stackrox/rox/compliance/virtualmachines/roxagent/vsockserver"
@@ -20,39 +22,54 @@ const (
 // the VM filesystem and publishing results to cache, independent of how the
 // cached report is served over VSOCK. Kept separate from Server/CARefresher
 // wiring in runServe so its retry/backoff policy is easier to reason about
-// and test on its own. Scanning does not make a network call; the downloader
-// built by newMappingDownloader keeps the mapping file fresh independently,
-// on its own schedule, so only the schedule for the next rescan attempt is
-// retried here, not the scan itself.
+// and test on its own. Scanning does not make a network call; provider
+// keeps the mapping file fresh independently, on its own schedule, so only
+// the schedule for the next rescan attempt is retried here, not the scan
+// itself.
 type rescanner struct {
-	cache           *vsockserver.ReportCache
-	hostPath        string
-	mappingFilePath string
-	interval        time.Duration
+	cache    *vsockserver.ReportCache
+	hostPath string
+	provider vsockserver.MappingProvider
+	interval time.Duration
 
 	// scanFn defaults to the package scan function; tests override it to
 	// inject failures. factsFn defaults to the package discoverFacts
 	// function; tests override it to avoid exercising the real
 	// filesystem, since discoverFacts otherwise reads real host paths
 	// (e.g. hostPath="" resolves to "/etc/pki/entitlement" et al., not a
-	// no-op). newDelay defaults to time.After (a one-shot timer); tests
-	// substitute a function returning a manually driven channel for
-	// precise control over Run's loop.
-	scanFn   func(ctx context.Context, hostPath, mappingFilePath string) (*v4.IndexReport, error)
-	factsFn  func(hostPath string) map[string]string
-	newDelay func(d time.Duration) <-chan time.Time
+	// no-op).
+	scanFn  func(ctx context.Context, hostPath, mappingFilePath string) (*v4.IndexReport, error)
+	factsFn func(hostPath string) map[string]string
+
+	// timer is the next scan deadline. OnMappingChanged Reset(0) fires it
+	// immediately; a Reset(0) during scanOnce is received on the next
+	// select because t.C is unbuffered (Go 1.23+). Nil after Run returns
+	// so a later Reset is a no-op.
+	timer atomic.Pointer[time.Timer]
+}
+
+func newRescanner(cache *vsockserver.ReportCache, hostPath string, provider vsockserver.MappingProvider, interval time.Duration) *rescanner {
+	r := &rescanner{
+		cache:    cache,
+		hostPath: hostPath,
+		provider: provider,
+		interval: interval,
+		scanFn:   scan,
+		factsFn:  discoverFacts,
+	}
+	r.timer.Store(time.NewTimer(interval))
+	return r
 }
 
-func newRescanner(cache *vsockserver.ReportCache, hostPath, mappingFilePath string, interval time.Duration) *rescanner {
-	return &rescanner{
-		cache:           cache,
-		hostPath:        hostPath,
-		mappingFilePath: mappingFilePath,
-		interval:        interval,
-		scanFn:          scan,
-		factsFn:         discoverFacts,
-		newDelay:        time.After,
+// OnMappingChanged is the updater's onChange callback: it schedules an
+// immediate scan attempt.
+func (r *rescanner) OnMappingChanged() {
+	t := r.timer.Load()
+	if t == nil {
+		return
 	}
+	t.Reset(0)
+	log.Info("Mapping changed, scheduling immediate rescan")
 }
 
 // Run rescans every r.interval, publishing each successful result to cache.
@@ -61,33 +78,70 @@ func newRescanner(cache *vsockserver.ReportCache, hostPath, mappingFilePath stri
 // and r.interval itself, so a retry is never slower than just waiting for
 // the next scheduled rescan would be. Blocks until ctx is cancelled.
 func (r *rescanner) Run(ctx context.Context) {
+	t := r.timer.Load()
+	defer func() {
+		r.timer.Store(nil)
+		t.Stop()
+	}()
+
 	backoff := rescanRetryBaseBackoff
-	delay := r.newDelay(r.interval)
 	for {
 		select {
 		case <-ctx.Done():
 			return
-		case <-delay:
-			log.Info("Starting rescan")
-			report, err := r.scanFn(ctx, r.hostPath, r.mappingFilePath)
-			if err != nil {
+		case <-t.C:
+			// Schedule the default next scan before scanOnce so a
+			// mapping change during the scan (Reset(0)) is not
+			// overwritten by the post-scan Reset.
+			t.Reset(r.interval)
+			if err := r.scanOnce(ctx); err != nil {
 				retryIn := min(backoff, r.interval)
 				log.Errorf("Rescan failed: %v; trying again in %v", err, retryIn)
 				backoff = min(backoff*2, rescanRetryMaxBackoff)
-				delay = r.newDelay(retryIn)
+				t.Reset(retryIn)
 				continue
 			}
-			r.cache.SetReport(report, r.factsFn(r.hostPath))
-			log.Infof("Rescan complete, report updated. Num packages: %d", len(report.GetContents().GetPackages()))
 			backoff = rescanRetryBaseBackoff
-			delay = r.newDelay(r.interval)
 		}
 	}
 }
 
+// scanOnce keeps the mapping file unchanged while this scan reads it, then
+// applies any pending Sync so a follow-up scan can use the new mapping.
+func (r *rescanner) scanOnce(ctx context.Context) error {
+	if !r.provider.Ready() {
+		log.Info("Skipping rescan: repository-to-CPE mapping not yet available")
+		return nil
+	}
+
+	gate, hasGate := r.provider.(vsockserver.ScanBusyGate)
+	if hasGate {
+		gate.MarkScanBusy()
+		defer gate.MarkScanIdleAndApplyPending()
+	}
+
+	path, err := r.provider.Path()
+	if err != nil {
+		return fmt.Errorf("resolving mapping file path: %w", err)
+	}
+
+	// Snapshot the hash before scanFn: a URL-backed provider has no busy
+	// gate, so a background fetch can replace the live mapping mid-scan.
+	mappingHash := r.provider.Hash()
+	log.Infof("Starting rescan (mapping hash=%s)", mappingHash)
+	report, err := r.scanFn(ctx, r.hostPath, path)
+	if err != nil {
+		return err
+	}
+
+	r.cache.SetReport(report, r.factsFn(r.hostPath), mappingHash)
+	log.Infof("Rescan complete, report updated (token=%s, packages=%d)", r.cache.Token(), len(report.GetContents().GetPackages()))
+	return nil
+}
+
 // runAsync starts Run in a goroutine and returns a channel that is closed
-// when Run returns. Callers that cancel ctx should wait on stopped before
-// tearing down anything Run still observes (e.g. an injected tick channel).
+// when Run returns. Callers that cancel ctx should wait on stopped so
+// assertions do not race Run's last scanOnce.
 func (r *rescanner) runAsync(ctx context.Context) (stopped <-chan struct{}) {
 	return startRun(ctx, r.Run)
 }
diff --git a/compliance/virtualmachines/roxagent/cmd/rescanner_test.go b/compliance/virtualmachines/roxagent/cmd/rescanner_test.go
index f65b28ead8f0e..4839d828e207f 100644
--- a/compliance/virtualmachines/roxagent/cmd/rescanner_test.go
+++ b/compliance/virtualmachines/roxagent/cmd/rescanner_test.go
@@ -3,73 +3,79 @@ package cmd
 import (
 	"context"
 	"errors"
+	"net"
 	"testing"
 	"testing/synctest"
 	"time"
 
 	"github.com/stackrox/rox/compliance/virtualmachines/roxagent/vsockserver"
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/sync"
+	"github.com/stackrox/rox/pkg/vsockframing"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 )
 
-// testRescanner returns a rescanner with a long default interval so tests
-// that don't care about the periodic loop never trigger it by accident.
-// factsFn is stubbed out so Run never exercises the real discoverFacts,
-// which - unlike scanFn - has no test-friendly no-op input; hostPath=""
-// resolves to real absolute host paths (e.g. "/etc/pki/entitlement"), not
-// a safe default.
-func testRescanner() *rescanner {
-	r := newRescanner(&vsockserver.ReportCache{}, "", "", time.Hour)
-	r.factsFn = func(string) map[string]string { return nil }
-	return r
-}
-
-// fakeTicker is a newDelay func driven manually by a test: fire triggers a
-// delay expiry, and lastReset reports the duration most recently requested via
-// newDelay, letting tests assert on scheduling decisions directly instead of
-// on elapsed time. Pair with synctest.Wait after fire to block until the
-// loop under test has processed the tick and settled back into waiting for
-// the next one.
-type fakeTicker struct {
-	tick chan time.Time
-
-	mu     sync.Mutex
-	resets []time.Duration
+// fakeProvider is a vsockserver.MappingProvider test double for rescanner
+// tests; UpdatePath/Bytes are unused by rescanner and always zero.
+type fakeProvider struct {
+	ready   bool
+	path    string
+	pathErr error
+	hash    string
 }
 
-func newFakeTicker() *fakeTicker {
-	return &fakeTicker{tick: make(chan time.Time, 1)}
+func (f *fakeProvider) Ready() bool  { return f.ready }
+func (f *fakeProvider) Hash() string { return f.hash }
+func (f *fakeProvider) UpdatePath() pb.RepoCPEMappingUpdatePath {
+	return pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED
 }
+func (f *fakeProvider) Bytes() ([]byte, error) { return nil, errors.New("not implemented") }
+func (f *fakeProvider) Path() (string, error)  { return f.path, f.pathErr }
 
-func (f *fakeTicker) close() { close(f.tick) }
+var _ vsockserver.MappingProvider = (*fakeProvider)(nil)
 
-// newDelay has the same signature as time.After, so it's directly assignable
-// to a rescanner's newDelay field.
-func (f *fakeTicker) newDelay(d time.Duration) <-chan time.Time {
-	concurrency.WithLock(&f.mu, func() { f.resets = append(f.resets, d) })
-	return f.tick
+// fakeGatedProvider adds ScanBusyGate call tracking on top of fakeProvider,
+// mirroring SensorUpdater (gated) as opposed to URLUpdater (ungated) so
+// tests can verify scanOnce only invokes the gate for providers that
+// implement it.
+type fakeGatedProvider struct {
+	fakeProvider
+	busyCalls int
+	idleCalls int
 }
 
-func (f *fakeTicker) fire() { f.tick <- time.Time{} }
+func (f *fakeGatedProvider) MarkScanBusy()                { f.busyCalls++ }
+func (f *fakeGatedProvider) MarkScanIdleAndApplyPending() { f.idleCalls++ }
 
-func (f *fakeTicker) lastReset() time.Duration {
-	return concurrency.WithLock1(&f.mu, func() time.Duration {
-		if len(f.resets) == 0 {
-			return 0
-		}
-		return f.resets[len(f.resets)-1]
-	})
+var (
+	_ vsockserver.MappingProvider = (*fakeGatedProvider)(nil)
+	_ vsockserver.ScanBusyGate    = (*fakeGatedProvider)(nil)
+)
+
+// testRescanner returns a rescanner with a long default interval so tests
+// that don't care about the periodic loop never trigger it by accident.
+// factsFn is stubbed out so Run never exercises the real discoverFacts,
+// which - unlike scanFn - has no test-friendly no-op input; hostPath=""
+// resolves to real absolute host paths (e.g. "/etc/pki/entitlement"), not
+// a safe default. provider defaults to always-ready when nil, so existing
+// tests that don't care about readiness are unaffected.
+func testRescanner(provider vsockserver.MappingProvider) *rescanner {
+	if provider == nil {
+		provider = &fakeProvider{ready: true}
+	}
+	r := newRescanner(&vsockserver.ReportCache{}, "", provider, time.Hour)
+	r.factsFn = func(string) map[string]string { return nil }
+	return r
 }
 
 func TestRescanner_Run(t *testing.T) {
 	t.Run("should publish to cache on each tick", func(t *testing.T) {
 		synctest.Test(t, func(t *testing.T) {
-			r := testRescanner()
-			ticker := newFakeTicker()
-			defer ticker.close()
-			r.newDelay = ticker.newDelay
+			r := testRescanner(nil)
 			var mu sync.Mutex
 			var calls int
 			r.scanFn = func(_ context.Context, _, _ string) (*v4.IndexReport, error) {
@@ -81,19 +87,17 @@ func TestRescanner_Run(t *testing.T) {
 
 			ctx, cancel := context.WithCancel(t.Context())
 			stopped := r.runAsync(ctx)
-			// Stop Run before close(tick): a closed tick chan would make
-			// select fire continuously with zero values.
 			defer func() {
 				cancel()
 				<-stopped
 			}()
-			synctest.Wait() // Run is blocked waiting for the first tick
+			synctest.Wait()
 
-			ticker.fire()
+			time.Sleep(r.interval)
 			synctest.Wait()
 			assert.Equal(t, 1, concurrency.WithLock1(&mu, func() int { return calls }))
 
-			ticker.fire()
+			time.Sleep(r.interval)
 			synctest.Wait()
 			assert.Equal(t, 2, concurrency.WithLock1(&mu, func() int { return calls }), "should rescan again on the next tick")
 		})
@@ -101,10 +105,7 @@ func TestRescanner_Run(t *testing.T) {
 
 	t.Run("should retry sooner than the full interval after a failed rescan", func(t *testing.T) {
 		synctest.Test(t, func(t *testing.T) {
-			r := testRescanner()
-			ticker := newFakeTicker()
-			defer ticker.close()
-			r.newDelay = ticker.newDelay
+			r := testRescanner(nil)
 			var mu sync.Mutex
 			var calls int
 			r.scanFn = func(_ context.Context, _, _ string) (*v4.IndexReport, error) {
@@ -123,26 +124,25 @@ func TestRescanner_Run(t *testing.T) {
 				cancel()
 				<-stopped
 			}()
-			synctest.Wait() // Run is blocked waiting for the first tick
-
-			ticker.fire()
 			synctest.Wait()
 
-			assert.Equal(t, rescanRetryBaseBackoff, ticker.lastReset(),
-				"a failed rescan should be rescheduled after rescanRetryBaseBackoff, not r.interval")
+			time.Sleep(r.interval)
+			synctest.Wait()
 			assert.Equal(t, 1, concurrency.WithLock1(&mu, func() int { return calls }))
 
-			ticker.fire() // the rescheduled retry firing
+			time.Sleep(rescanRetryBaseBackoff)
 			synctest.Wait()
-
 			assert.Equal(t, 2, concurrency.WithLock1(&mu, func() int { return calls }), "the failed rescan was never retried")
-			assert.Equal(t, r.interval, ticker.lastReset(), "a successful rescan should reschedule after the full interval, resetting backoff")
+
+			time.Sleep(rescanRetryBaseBackoff)
+			synctest.Wait()
+			assert.Equal(t, 2, concurrency.WithLock1(&mu, func() int { return calls }), "a successful rescan should wait the full interval, not keep the retry backoff")
 		})
 	})
 
 	t.Run("should stop promptly when the context is cancelled", func(t *testing.T) {
 		synctest.Test(t, func(t *testing.T) {
-			r := testRescanner()
+			r := testRescanner(nil)
 
 			ctx, cancel := context.WithCancel(t.Context())
 			stopped := r.runAsync(ctx)
@@ -153,6 +153,180 @@ func TestRescanner_Run(t *testing.T) {
 			// fails the test on deadlock automatically.
 			cancel()
 			<-stopped
+			// Updaters can still fire onChange after Run has returned.
+			r.OnMappingChanged()
 		})
 	})
+
+	t.Run("a periodic tick is a no-op when the mapping is not yet ready", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			r := testRescanner(&fakeProvider{ready: false})
+			var calls int
+			r.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+				calls++
+				return &v4.IndexReport{}, nil
+			}
+
+			ctx, cancel := context.WithCancel(t.Context())
+			stopped := r.runAsync(ctx)
+			defer func() {
+				cancel()
+				<-stopped
+			}()
+			synctest.Wait()
+
+			time.Sleep(r.interval)
+			synctest.Wait()
+
+			assert.Zero(t, calls, "scanFn must not be called while the mapping provider isn't ready")
+		})
+	})
+
+	t.Run("OnMappingChanged triggers an immediate scan attempt", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			r := testRescanner(&fakeProvider{ready: true})
+			var calls int
+			r.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+				calls++
+				return &v4.IndexReport{}, nil
+			}
+
+			ctx, cancel := context.WithCancel(t.Context())
+			stopped := r.runAsync(ctx)
+			defer func() {
+				cancel()
+				<-stopped
+			}()
+			synctest.Wait()
+
+			r.OnMappingChanged()
+			synctest.Wait()
+
+			assert.Equal(t, 1, calls, "OnMappingChanged should trigger a scan without waiting for the next tick")
+		})
+	})
+
+	t.Run("OnMappingChanged failure retries at backoff not the full interval", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			r := testRescanner(nil)
+			var mu sync.Mutex
+			var calls int
+			r.scanFn = func(_ context.Context, _, _ string) (*v4.IndexReport, error) {
+				return concurrency.WithLock2(&mu, func() (*v4.IndexReport, error) {
+					calls++
+					if calls == 1 {
+						return nil, errors.New("transient scan error")
+					}
+					return &v4.IndexReport{HashId: "ok"}, nil
+				})
+			}
+
+			ctx, cancel := context.WithCancel(t.Context())
+			stopped := r.runAsync(ctx)
+			defer func() {
+				cancel()
+				<-stopped
+			}()
+			synctest.Wait()
+
+			r.OnMappingChanged()
+			synctest.Wait()
+			assert.Equal(t, 1, concurrency.WithLock1(&mu, func() int { return calls }), "OnMappingChanged should trigger a scan immediately")
+
+			time.Sleep(rescanRetryBaseBackoff)
+			synctest.Wait()
+			assert.Equal(t, 2, concurrency.WithLock1(&mu, func() int { return calls }), "a failed mapping-triggered scan should retry after the backoff")
+
+			time.Sleep(rescanRetryBaseBackoff)
+			synctest.Wait()
+			assert.Equal(t, 2, concurrency.WithLock1(&mu, func() int { return calls }), "a successful retry should wait the full interval")
+		})
+	})
+
+	t.Run("a failed scan clears busy via idle-and-apply-pending", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			provider := &fakeGatedProvider{fakeProvider: fakeProvider{ready: true}}
+			r := testRescanner(provider)
+			r.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+				return nil, errors.New("scan failed")
+			}
+
+			ctx, cancel := context.WithCancel(t.Context())
+			stopped := r.runAsync(ctx)
+			defer func() {
+				cancel()
+				<-stopped
+			}()
+			synctest.Wait()
+
+			time.Sleep(r.interval)
+			synctest.Wait()
+
+			assert.Equal(t, 1, provider.busyCalls)
+			assert.Equal(t, 1, provider.idleCalls, "a failed scan must not leave a Sync stuck behind busy forever")
+		})
+	})
+
+	t.Run("a successful scan clears busy without waiting for GetReport", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			provider := &fakeGatedProvider{fakeProvider: fakeProvider{ready: true}}
+			r := testRescanner(provider)
+			r.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+				return &v4.IndexReport{HashId: "ok"}, nil
+			}
+
+			ctx, cancel := context.WithCancel(t.Context())
+			stopped := r.runAsync(ctx)
+			defer func() {
+				cancel()
+				<-stopped
+			}()
+			synctest.Wait()
+
+			time.Sleep(r.interval)
+			synctest.Wait()
+
+			assert.Equal(t, 1, provider.busyCalls)
+			assert.Equal(t, 1, provider.idleCalls, "a successful scan must apply a deferred Sync itself; GetReport can be hours away")
+		})
+	})
+}
+
+// TestScanOnce_StoresHashFromBeforeTheScan covers a URL refresh that
+// replaces the live mapping while scanFn runs: SetReport must keep the
+// hash from before the scan.
+func TestScanOnce_StoresHashFromBeforeTheScan(t *testing.T) {
+	const hashAtScan = "hash-at-scan-start"
+	provider := &fakeProvider{ready: true, hash: hashAtScan}
+	r := testRescanner(provider)
+	r.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+		provider.hash = "hash-after-url-refresh"
+		return &v4.IndexReport{HashId: "ok"}, nil
+	}
+
+	require.NoError(t, r.scanOnce(t.Context()))
+	assert.Equal(t, "hash-after-url-refresh", provider.Hash(), "the live mapping may have moved on")
+	assert.Equal(t, hashAtScan, mappingHashFromCache(t, r.cache, provider))
+}
+
+func mappingHashFromCache(t *testing.T, cache *vsockserver.ReportCache, provider vsockserver.MappingProvider) string {
+	t.Helper()
+	handler := vsockserver.NewHandler(cache, "test", provider, nil)
+	clientConn, serverConn := net.Pipe()
+	go handler.HandleConn(serverConn)
+
+	req, err := proto.Marshal(&pb.VMServiceRequest{
+		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{}},
+	})
+	require.NoError(t, err)
+	require.NoError(t, vsockframing.WriteFrame(clientConn, req))
+
+	respData, err := vsockframing.ReadFrame(clientConn, 10<<20)
+	require.NoError(t, err)
+	_ = clientConn.Close()
+
+	var resp pb.VMServiceResponse
+	require.NoError(t, proto.Unmarshal(respData, &resp))
+	require.NotNil(t, resp.GetGetReport())
+	return resp.GetMeta().GetRepoCpeMappingHash()
 }
diff --git a/compliance/virtualmachines/roxagent/cmd/sdnotify.go b/compliance/virtualmachines/roxagent/cmd/sdnotify.go
new file mode 100644
index 0000000000000..9ad3a4df5bfc2
--- /dev/null
+++ b/compliance/virtualmachines/roxagent/cmd/sdnotify.go
@@ -0,0 +1,20 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/coreos/go-systemd/v22/daemon"
+)
+
+// notifySystemdReady sends READY=1 on NOTIFY_SOCKET when set (Type=notify /
+// Quadlet Notify=true). No-op when unset so bare `roxagent serve` still works.
+func notifySystemdReady() error {
+	sent, err := daemon.SdNotify(false, daemon.SdNotifyReady)
+	if err != nil {
+		return fmt.Errorf("sd_notify READY=1: %w", err)
+	}
+	if sent {
+		log.Info("Signaled systemd readiness (READY=1)")
+	}
+	return nil
+}
diff --git a/compliance/virtualmachines/roxagent/cmd/sdnotify_test.go b/compliance/virtualmachines/roxagent/cmd/sdnotify_test.go
new file mode 100644
index 0000000000000..f3cae0a4c2a23
--- /dev/null
+++ b/compliance/virtualmachines/roxagent/cmd/sdnotify_test.go
@@ -0,0 +1,46 @@
+package cmd
+
+import (
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestNotifySystemdReady_NoSocketIsNoop covers running without systemd
+// (NOTIFY_SOCKET unset): readiness notify must not error.
+func TestNotifySystemdReady_NoSocketIsNoop(t *testing.T) {
+	t.Setenv("NOTIFY_SOCKET", "")
+	require.NoError(t, notifySystemdReady())
+}
+
+// TestNotifySystemdReady_WritesReady covers the sd_notify protocol against a
+// fake NOTIFY_SOCKET: READY=1 must be written as a unixgram datagram.
+func TestNotifySystemdReady_WritesReady(t *testing.T) {
+	// Prefer a short path under /tmp: macOS AF_UNIX sun_path is small, and
+	// t.TempDir() paths are often too long to bind.
+	f, err := os.CreateTemp("", "rox-sdn-*.sock")
+	require.NoError(t, err)
+	sockPath := f.Name()
+	require.NoError(t, f.Close())
+	require.NoError(t, os.Remove(sockPath))
+	t.Cleanup(func() { _ = os.Remove(sockPath) })
+
+	addr := &net.UnixAddr{Name: sockPath, Net: "unixgram"}
+	ln, err := net.ListenUnixgram("unixgram", addr)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	t.Setenv("NOTIFY_SOCKET", sockPath)
+
+	require.NoError(t, notifySystemdReady())
+
+	_ = ln.SetReadDeadline(time.Now().Add(2 * time.Second))
+	buf := make([]byte, 64)
+	n, _, err := ln.ReadFromUnix(buf)
+	require.NoError(t, err)
+	assert.Equal(t, "READY=1", string(buf[:n]))
+}
diff --git a/compliance/virtualmachines/roxagent/cmd/serve.go b/compliance/virtualmachines/roxagent/cmd/serve.go
index c84c4f115f2af..61871ed0cf39b 100644
--- a/compliance/virtualmachines/roxagent/cmd/serve.go
+++ b/compliance/virtualmachines/roxagent/cmd/serve.go
@@ -66,7 +66,10 @@ func ServeCmd(ctx context.Context) *cobra.Command {
 	}
 	cmd.Flags().Uint32Var(&cfg.port, "port", 818, "VSOCK port to listen on")
 	cmd.Flags().StringVar(&cfg.hostPath, "host-path", "/", "Root filesystem path for indexing")
-	cmd.Flags().StringVar(&cfg.repoCPEURL, "repo-cpe-url", repoToCPEMappingURL, "Repository to CPE mapping URL")
+	cmd.Flags().StringVar(&cfg.repoCPEURL, "repo-cpe-url", "",
+		"Repository to CPE mapping URL. Empty (default) means Sensor pushes the mapping over VSOCK instead.")
+	cmd.Flags().StringVar(&cfg.repoCPEBundledPath, "repo-cpe-bundled-path", "",
+		"Optional seed mapping file for Sensor-managed agents. Ignored when --repo-cpe-url is set.")
 	cmd.Flags().DurationVar(&cfg.rescanInterval, "rescan-interval", 4*time.Hour,
 		fmt.Sprintf("Interval between rescans (range %v-%v)", minRescanInterval, maxRescanInterval))
 	cmd.Flags().DurationVar(&cfg.caFetchTimeout, "ca-fetch-timeout", 10*time.Second,
@@ -82,12 +85,13 @@ func ServeCmd(ctx context.Context) *cobra.Command {
 
 // serveConfig holds runServe's inputs, validated together by validate.
 type serveConfig struct {
-	port           uint32
-	hostPath       string
-	repoCPEURL     string
-	rescanInterval time.Duration
-	caFetchTimeout time.Duration
-	connDeadline   time.Duration
+	port               uint32
+	hostPath           string
+	repoCPEURL         string
+	repoCPEBundledPath string
+	rescanInterval     time.Duration
+	caFetchTimeout     time.Duration
+	connDeadline       time.Duration
 }
 
 func (c serveConfig) validate() error {
@@ -103,33 +107,38 @@ func (c serveConfig) validate() error {
 	return nil
 }
 
+// newRescannerAndProvider builds the rescanner and its mapping provider.
+// OnMappingChanged does not read provider, so passing it to the
+// provider's constructor before provider is assigned below is safe.
+func newRescannerAndProvider(cache *vsockserver.ReportCache, cfg serveConfig) (vmRescanner *rescanner, provider vsockserver.MappingProvider, updater vsockserver.MappingUpdater, urlUpdater *vsockserver.URLUpdater) {
+	vmRescanner = newRescanner(cache, cfg.hostPath, nil, cfg.rescanInterval)
+
+	if cfg.repoCPEURL != "" {
+		urlUpdater = vsockserver.NewURLUpdater(cfg.repoCPEURL, mappingCachePath, vmRescanner.OnMappingChanged)
+		provider = urlUpdater
+	} else {
+		sensorUpdater := vsockserver.NewSensorUpdater(mappingCachePath, cfg.repoCPEBundledPath, vmRescanner.OnMappingChanged)
+		provider, updater = sensorUpdater, sensorUpdater
+	}
+	vmRescanner.provider = provider
+
+	return vmRescanner, provider, updater, urlUpdater
+}
+
 func runServe(ctx context.Context, cfg serveConfig) error {
 	if err := cfg.validate(); err != nil {
 		return err
 	}
 
-	// The mapping file must exist locally before the first scan can run:
-	// scan() never fetches it itself, so this initial fetch is mandatory.
-	// If it fails, startup fails rather than running a scan against no data.
-	// Start(ctx, true) blocks until that fetch completes, then keeps
-	// refreshing the file in the background.
-	mappingDownloader := newMappingDownloader(cfg.repoCPEURL, mappingCachePath,
-		logMappingDownloadResult(cfg.repoCPEURL, mappingCachePath))
-	if err := mappingDownloader.Start(ctx, true); err != nil {
-		return fmt.Errorf("initial repository-to-CPE mapping fetch: %w", err)
-	}
+	// serveCtx lets early-return paths (systemd notify failure after listen)
+	// stop Serve instead of leaking the accept loop until process exit.
+	serveCtx, cancelServe := context.WithCancel(ctx)
+	defer cancelServe()
 
 	cache := &vsockserver.ReportCache{}
-	vmRescanner := newRescanner(cache, cfg.hostPath, mappingCachePath, cfg.rescanInterval)
+	vmRescanner, provider, updater, urlUpdater := newRescannerAndProvider(cache, cfg)
 
-	report, err := scan(ctx, cfg.hostPath, mappingCachePath)
-	if err != nil {
-		return fmt.Errorf("initial scan: %w", err)
-	}
-	cache.SetReport(report, discoverFacts(cfg.hostPath))
-	log.Infof("Initial scan complete, report cached. Num packages: %d", len(report.GetContents().GetPackages()))
-
-	handler := vsockserver.NewHandler(cache, agentVersion)
+	handler := vsockserver.NewHandler(cache, agentVersion, provider, updater)
 
 	// TLS is mandatory: sensor always dials with TLS, so a plaintext agent is
 	// unreachable. The KubeVirt CA (served by virt-handler on CID 2, port 1)
@@ -154,44 +163,41 @@ func runServe(ctx context.Context, cfg serveConfig) error {
 	}
 	log.Infof("Listening on VSOCK port %d (pull mode)", cfg.port)
 
+	if urlUpdater != nil {
+		if err := urlUpdater.Start(serveCtx); err != nil {
+			return fmt.Errorf("starting repository-to-CPE mapping downloader: %w", err)
+		}
+		defer urlUpdater.Stop()
+	}
+
 	var wg sync.WaitGroup
-	wg.Go(func() { srv.Serve(ctx, ln) })
-	wg.Go(func() { vmRescanner.Run(ctx) })
+	wg.Go(func() { srv.Serve(serveCtx, ln) })
+	wg.Go(func() { vmRescanner.Run(serveCtx) })
+
+	// Report systemd readiness once VSOCK is up.
+	if err := notifySystemdReady(); err != nil {
+		// Exiting, as systemd would kill this service anyway after TimeoutStartSec.
+		cancelServe()
+		wg.Wait()
+		return err
+	}
 
-	<-ctx.Done()
+	<-serveCtx.Done()
 	// Wait for Serve's graceful drain (in-flight connections) and the
 	// rescan loop to finish before returning, so the process doesn't exit
-	// mid-drain or mid-scan. mappingDownloader.Stop waits for its own
-	// background refresh loop the same way, once ctx is already done.
+	// mid-drain or mid-scan.
 	wg.Wait()
-	mappingDownloader.Stop()
 	return nil
 }
 
-// logMappingDownloadResult logs a repository-to-CPE mapping download outcome and status of the local mapping file.
-func logMappingDownloadResult(url, cachePath string) func(err error, duration time.Duration) {
-	return func(err error, duration time.Duration) {
-		if err == nil {
-			log.Infof("Repository-to-CPE mapping file downloaded from %s in %s", url, duration)
-			return
-		}
-		if _, statErr := os.Stat(cachePath); statErr == nil {
-			log.Warnf("Repository-to-CPE mapping download failed after %s, scans keep using the previously cached file: %v", duration, err)
-			return
-		}
-		log.Errorf("Repository-to-CPE mapping download failed after %s, no cached file available: %v", duration, err)
-	}
-}
-
 // scan indexes the VM filesystem at hostPath, consulting the
 // repository-to-CPE mapping data cached at mappingFilePath.
-// The mapping downloader keeps mappingFilePath fresh independently.
+// The mapping provider keeps mappingFilePath fresh independently.
 func scan(ctx context.Context, hostPath, mappingFilePath string) (*v4.IndexReport, error) {
 	cfg := index.NodeIndexerConfig{
 		HostPath:            hostPath,
 		Client:              &http.Client{Transport: proxy.RoundTripper()},
 		Repo2CPEMappingFile: mappingFilePath,
-		PackageDBFilter:     "",
 	}
 	return index.NewNodeIndexer(cfg).IndexNode(ctx)
 }
diff --git a/compliance/virtualmachines/roxagent/cmd/serve_test.go b/compliance/virtualmachines/roxagent/cmd/serve_test.go
index 3a56e35a4bbdf..5585594363f96 100644
--- a/compliance/virtualmachines/roxagent/cmd/serve_test.go
+++ b/compliance/virtualmachines/roxagent/cmd/serve_test.go
@@ -1,14 +1,381 @@
 package cmd
 
 import (
+	"context"
 	"crypto/x509"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/stackrox/rox/compliance/virtualmachines/roxagent/vsockserver"
+	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/sync"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// validMappingJSON is the minimal content cpemapping.ValidateMapping accepts.
+// otherValidMappingJSON is a distinct valid payload for tests that need two
+// different hashes (e.g. deferred-apply across a simulated scan).
+const (
+	validMappingJSON      = `{"data":{}}`
+	otherValidMappingJSON = `{"data":{"rhel-9-server-rpms":{"cpes":["cpe:/o:redhat:enterprise_linux:9"]}}}`
+)
+
+// waitTimeout/waitTick bound assert.Eventually polling for background
+// effects of a real (non-fake-clock) mapping update, e.g. onChange firing.
+const (
+	waitTimeout = 2 * time.Second
+	waitTick    = 10 * time.Millisecond
+)
+
+// withMappingCachePath points the package-level mappingCachePath at a fresh
+// file under a per-test temp dir, so tests never share state through it or
+// touch the real hardcoded path, and restores it afterward.
+func withMappingCachePath(t *testing.T) string {
+	t.Helper()
+	original := mappingCachePath
+	path := filepath.Join(t.TempDir(), "cache.json")
+	mappingCachePath = path
+	t.Cleanup(func() { mappingCachePath = original })
+	return path
+}
+
+// registerSensorPersistDrain waits for SensorUpdater's fire-and-forget cache
+// writes before t.TempDir() cleanup, so AtomicWriteFile's sibling .tmp files
+// cannot race directory removal.
+func registerSensorPersistDrain(t *testing.T, updater vsockserver.MappingUpdater) {
+	t.Helper()
+	u, ok := updater.(*vsockserver.SensorUpdater)
+	require.True(t, ok, "registerSensorPersistDrain requires a *SensorUpdater")
+	t.Cleanup(u.WaitPersist)
+}
+
+func TestNewRescannerAndProvider_URLSelection(t *testing.T) {
+	withMappingCachePath(t)
+
+	tests := map[string]struct {
+		repoCPEURL     string
+		wantUpdatePath pb.RepoCPEMappingUpdatePath
+		wantUpdaterNil bool
+		wantURLUpdater bool
+	}{
+		"empty repo-cpe-url selects the Sensor-managed path": {
+			repoCPEURL:     "",
+			wantUpdatePath: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR,
+			wantUpdaterNil: false,
+			wantURLUpdater: false,
+		},
+		"non-empty repo-cpe-url selects the URL-managed path": {
+			repoCPEURL:     "https://example.invalid/repo-to-cpe.json",
+			wantUpdatePath: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL,
+			wantUpdaterNil: true,
+			wantURLUpdater: true,
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			cfg := serveConfig{repoCPEURL: tt.repoCPEURL}
+			_, provider, updater, urlUpdater := newRescannerAndProvider(&vsockserver.ReportCache{}, cfg)
+
+			assert.Equal(t, tt.wantUpdatePath, provider.UpdatePath())
+			assert.Equal(t, tt.wantUpdaterNil, updater == nil)
+			assert.Equal(t, tt.wantURLUpdater, urlUpdater != nil)
+		})
+	}
+}
+
+// TestNewRescannerAndProvider_NoMappingStaysIdle covers agent startup with
+// no mapping file present yet: the provider must report not-Ready instead
+// of treating a missing file as a fetch error, so runServe never attempts
+// a scan before a mapping actually arrives.
+func TestNewRescannerAndProvider_NoMappingStaysIdle(t *testing.T) {
+	for name, repoCPEURL := range map[string]string{"Sensor-managed": "", "URL-managed": "https://example.invalid/repo-to-cpe.json"} {
+		t.Run(name, func(t *testing.T) {
+			withMappingCachePath(t)
+			vmRescanner, provider, _, _ := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{repoCPEURL: repoCPEURL})
+
+			assert.False(t, provider.Ready(), "no cached mapping file must leave the provider not-Ready, not erroring")
+
+			var scanCalls int
+			vmRescanner.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+				scanCalls++
+				return &v4.IndexReport{}, nil
+			}
+			require.NoError(t, vmRescanner.scanOnce(t.Context()))
+			assert.Zero(t, scanCalls, "a not-Ready provider must never trigger a disk scan")
+		})
+	}
+}
+
+// TestNewRescannerAndProvider_CallbackWiredAfterConstruction pins down the
+// construction order: the rescanner's provider field is only assigned
+// after the provider itself is built, but OnMappingChanged - already bound
+// to the rescanner - must be safe to call throughout, and the assignment
+// must have actually taken effect by the time construction returns.
+func TestNewRescannerAndProvider_CallbackWiredAfterConstruction(t *testing.T) {
+	withMappingCachePath(t)
+	vmRescanner, provider, _, _ := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{})
+
+	assert.Same(t, provider, vmRescanner.provider, "the rescanner must observe the same provider instance constructed alongside it")
+	assert.NotPanics(t, vmRescanner.OnMappingChanged)
+}
+
+// TestNewRescannerAndProvider_SyncKicksFirstScan simulates a Sensor-pushed
+// mapping arriving (without any real VSOCK connection) and checks it
+// triggers an immediate scan attempt via the onChange wiring.
+// Runs on the real clock (not synctest): SensorUpdater.Update's fire-and-
+// forget cache-persistence goroutine is real background I/O outside the
+// rescanner's own fake-clock-driven loop.
+func TestNewRescannerAndProvider_SyncKicksFirstScan(t *testing.T) {
+	cachePath := withMappingCachePath(t)
+	vmRescanner, provider, updater, _ := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{rescanInterval: time.Hour})
+	require.False(t, provider.Ready())
+	require.NotNil(t, updater, "Sensor path must produce a non-nil updater")
+	registerSensorPersistDrain(t, updater)
+
+	var mu sync.Mutex
+	var calls int
+	vmRescanner.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+		concurrency.WithLock(&mu, func() { calls++ })
+		return &v4.IndexReport{}, nil
+	}
+	vmRescanner.factsFn = func(string) map[string]string { return nil }
+
+	ctx, cancel := context.WithCancel(t.Context())
+	stopped := vmRescanner.runAsync(ctx)
+	defer func() {
+		cancel()
+		<-stopped
+	}()
+
+	updated, err := updater.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	require.True(t, updated)
+
+	assert.Eventually(t, func() bool {
+		return concurrency.WithLock1(&mu, func() int { return calls }) == 1
+	}, waitTimeout, waitTick, "a Sync-style mapping update should kick an immediate scan attempt")
+
+	// SensorUpdater.Update persists to disk via a fire-and-forget goroutine
+	// (see vsockserver.SensorUpdater.persistAndNotify), so the on-disk
+	// content lands independently of, and possibly after, the scan kick
+	// asserted above.
+	assert.Eventually(t, func() bool {
+		content, err := os.ReadFile(cachePath)
+		return err == nil && string(content) == validMappingJSON
+	}, waitTimeout, waitTick, "a synced mapping should also land in the on-disk cache")
+}
+
+// TestNewRescannerAndProvider_BundledPathSeedsSensor covers cmd passing
+// --repo-cpe-bundled-path through to NewSensorUpdater: a seed file is
+// enough to become Ready and trigger the first scan, without a Sensor push.
+func TestNewRescannerAndProvider_BundledPathSeedsSensor(t *testing.T) {
+	withMappingCachePath(t)
+	bundledPath := filepath.Join(t.TempDir(), "bundled.json")
+	require.NoError(t, os.WriteFile(bundledPath, []byte(validMappingJSON), 0o600))
+
+	vmRescanner, provider, updater, urlUpdater := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{
+		repoCPEBundledPath: bundledPath,
+		rescanInterval:     time.Hour,
+	})
+	require.True(t, provider.Ready(), "a Sensor-managed seed file must bootstrap the provider Ready")
+	require.NotNil(t, updater)
+	require.Nil(t, urlUpdater)
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), provider.Hash())
+
+	var mu sync.Mutex
+	var calls int
+	vmRescanner.scanFn = func(context.Context, string, string) (*v4.IndexReport, error) {
+		concurrency.WithLock(&mu, func() { calls++ })
+		return &v4.IndexReport{}, nil
+	}
+	vmRescanner.factsFn = func(string) map[string]string { return nil }
+
+	ctx, cancel := context.WithCancel(t.Context())
+	stopped := vmRescanner.runAsync(ctx)
+	defer func() {
+		cancel()
+		<-stopped
+	}()
+
+	assert.Eventually(t, func() bool {
+		return concurrency.WithLock1(&mu, func() int { return calls }) == 1
+	}, waitTimeout, waitTick, "bootstrapping from the bundled seed should kick an immediate scan attempt")
+}
+
+// TestNewRescannerAndProvider_URLIgnoresBundledPath covers URL-managed
+// plus --repo-cpe-bundled-path: the seed is Sensor-only, so a URL that
+// has never succeeded stays not-ready instead of looking configured.
+func TestNewRescannerAndProvider_URLIgnoresBundledPath(t *testing.T) {
+	withMappingCachePath(t)
+	bundledPath := filepath.Join(t.TempDir(), "bundled.json")
+	require.NoError(t, os.WriteFile(bundledPath, []byte(validMappingJSON), 0o600))
+
+	_, provider, updater, urlUpdater := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{
+		repoCPEURL:         "https://example.invalid/repo-to-cpe.json",
+		repoCPEBundledPath: bundledPath,
+	})
+	require.NotNil(t, urlUpdater)
+	require.Nil(t, updater)
+	assert.False(t, provider.Ready(), "URL-managed must not seed from --repo-cpe-bundled-path")
+	assert.Equal(t, pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL, provider.UpdatePath())
+}
+
+// TestNewRescannerAndProvider_URLNeverSucceeds_StaysNotSensorManaged covers
+// a configured --repo-cpe-url that never produces a usable mapping: the
+// update path must stay URL, with no fallback to Sensor, even once the
+// downloader has actually attempted and failed a fetch. Log-level (ERROR
+// vs WARN) is not asserted here: the codebase has no lightweight log-
+// capture convention (see report), and URLUpdater.onDownloadComplete only
+// ever logs WARN today regardless of whether a mapping was ever
+// successfully fetched — see the task report for this gap.
+func TestNewRescannerAndProvider_URLNeverSucceeds_StaysNotSensorManaged(t *testing.T) {
+	withMappingCachePath(t)
+
+	var requests atomic.Int64
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		requests.Add(1)
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	_, provider, updater, urlUpdater := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{repoCPEURL: srv.URL})
+	require.Nil(t, updater)
+	require.NotNil(t, urlUpdater)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	require.NoError(t, urlUpdater.Start(ctx))
+	defer func() {
+		cancel()
+		urlUpdater.Stop()
+	}()
+
+	assert.Eventually(t, func() bool { return requests.Load() > 0 }, waitTimeout, waitTick,
+		"the downloader should have attempted at least one fetch against the configured URL")
+
+	assert.False(t, provider.Ready(), "a URL that never succeeds must never make the provider Ready")
+	assert.Equal(t, pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL, provider.UpdatePath(),
+		"a failing URL must not fall back to Sensor management")
+}
+
+// TestNewRescannerAndProvider_RestartSwitchesUpdatePath simulates an
+// operator adding or removing --repo-cpe-url between two agent restarts
+// that share the same on-disk mappingCachePath. Per the design, the
+// update path is re-derived purely from cfg.repoCPEURL on every restart,
+// never persisted; this table only pins that re-derivation, not whether
+// the previous updater's cached bytes get re-read (see report: cmd wires
+// both updaters to the same mappingCachePath file, so unlike the design's
+// "own cache file" wording, content bootstrapped by one updater is in
+// fact visible to the other after a switch).
+func TestNewRescannerAndProvider_RestartSwitchesUpdatePath(t *testing.T) {
+	tests := map[string]struct {
+		firstURL  string
+		secondURL string
+		wantFirst pb.RepoCPEMappingUpdatePath
+		wantAfter pb.RepoCPEMappingUpdatePath
+	}{
+		"adding --repo-cpe-url switches Sensor-managed to URL-managed": {
+			firstURL:  "",
+			secondURL: "https://example.invalid/repo-to-cpe.json",
+			wantFirst: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR,
+			wantAfter: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL,
+		},
+		"removing --repo-cpe-url switches URL-managed to Sensor-managed": {
+			firstURL:  "https://example.invalid/repo-to-cpe.json",
+			secondURL: "",
+			wantFirst: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL,
+			wantAfter: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR,
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			withMappingCachePath(t)
+
+			_, firstProvider, _, _ := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{repoCPEURL: tt.firstURL})
+			require.Equal(t, tt.wantFirst, firstProvider.UpdatePath())
+
+			_, secondProvider, _, _ := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{repoCPEURL: tt.secondURL})
+			assert.Equal(t, tt.wantAfter, secondProvider.UpdatePath(),
+				"a fresh restart must re-derive the update path from the current --repo-cpe-url, not remember the prior one")
+		})
+	}
+}
+
+// TestNewRescannerAndProvider_SensorSync_DefersUnderScanThenApplies covers
+// the cmd-level wiring for deferred apply: SensorUpdater's own deferred-
+// apply logic is unit-tested in vsockserver/sensor_updater_test.go, so this
+// only checks that newRescannerAndProvider's returned updater/provider
+// pair exposes that behavior end-to-end through the ScanBusyGate interface.
+func TestNewRescannerAndProvider_SensorSync_DefersUnderScanThenApplies(t *testing.T) {
+	cachePath := withMappingCachePath(t)
+	require.NoError(t, os.WriteFile(cachePath, []byte(validMappingJSON), 0o600))
+
+	_, provider, updater, _ := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{})
+	require.True(t, provider.Ready(), "a pre-seeded Sensor cache must bootstrap the provider Ready")
+	require.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), provider.Hash())
+	registerSensorPersistDrain(t, updater)
+
+	gate, ok := updater.(vsockserver.ScanBusyGate)
+	require.True(t, ok, "the Sensor updater must implement ScanBusyGate")
+	gate.MarkScanBusy()
+
+	updated, err := updater.Update([]byte(otherValidMappingJSON))
+	require.NoError(t, err)
+	require.True(t, updated)
+
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), provider.Hash(),
+		"the active mapping must stay the bootstrapped content while a scan is in flight")
+
+	gate.MarkScanIdleAndApplyPending()
+
+	assert.Equal(t, cpemapping.HashMapping([]byte(otherValidMappingJSON)), provider.Hash(),
+		"the pending mapping should apply once the scan is marked idle")
+
+	// MarkScanIdleAndApplyPending's persist is also fire-and-forget; wait
+	// for it so the background write can't still be touching cachePath's
+	// directory when t.TempDir() cleans it up.
+	assert.Eventually(t, func() bool {
+		content, err := os.ReadFile(cachePath)
+		return err == nil && string(content) == otherValidMappingJSON
+	}, waitTimeout, waitTick, "the applied mapping should also land in the on-disk cache")
+}
+
+// TestNewRescannerAndProvider_SensorUpdate_InvalidContentKeepsLastGood
+// covers the cmd-level wiring only; SensorUpdater's own validation
+// behavior is unit-tested in vsockserver/sensor_updater_test.go.
+func TestNewRescannerAndProvider_SensorUpdate_InvalidContentKeepsLastGood(t *testing.T) {
+	cachePath := withMappingCachePath(t)
+	_, provider, updater, _ := newRescannerAndProvider(&vsockserver.ReportCache{}, serveConfig{})
+	registerSensorPersistDrain(t, updater)
+
+	updated, err := updater.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	require.True(t, updated)
+	wantHash := provider.Hash()
+	// Drain the first Update's fire-and-forget persist before the test ends,
+	// so its background write can't still be touching cachePath's directory
+	// when t.TempDir() cleans it up.
+	assert.Eventually(t, func() bool {
+		content, err := os.ReadFile(cachePath)
+		return err == nil && string(content) == validMappingJSON
+	}, waitTimeout, waitTick, "the initial valid mapping should land in the on-disk cache")
+
+	updated, err = updater.Update([]byte(`{not valid json`))
+	assert.Error(t, err)
+	assert.False(t, updated)
+	assert.Equal(t, wantHash, provider.Hash(), "invalid content must not replace the last-known-good mapping")
+}
+
 // validServeConfig returns a serveConfig that passes validate(), so each
 // test case in TestRunServe_ValidatesFlags only needs to override the one
 // field it's exercising.
diff --git a/compliance/virtualmachines/roxagent/quadlet/README.md b/compliance/virtualmachines/roxagent/quadlet/README.md
index e7244020f54c7..9f12e3469a8b4 100644
--- a/compliance/virtualmachines/roxagent/quadlet/README.md
+++ b/compliance/virtualmachines/roxagent/quadlet/README.md
@@ -6,6 +6,8 @@ Run roxagent on RHEL VMs with Podman Quadlet: a systemd-managed container that s
 
 [Podman Quadlet](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html) turns `roxagent.container` into a systemd unit that runs `roxagent serve`. The agent scans installed packages, caches the report, and listens on a VSOCK port. Sensor dials in when it needs a report. The agent rescans on its own schedule (default: every 4 hours).
 
+`Notify=true` makes Podman pass systemd's notify socket into the container, so `systemctl status roxagent` becomes `active` only after the agent has bound the VSOCK listener (not merely when the container process starts). `TimeoutStartSec=600` covers a cold pull of the main image, which can exceed systemd's 90s default.
+
 ### Components
 
 | File | Description |
@@ -18,7 +20,7 @@ Run roxagent on RHEL VMs with Podman Quadlet: a systemd-managed container that s
 * RHEL 8, 9, or 10 VM running on KubeVirt with VSOCK enabled
 * Podman installed (`dnf install -y podman`)
 * StackRox deployed with VM scanning enabled (`ROX_VIRTUAL_MACHINES=true`)
-* Network access to pull the StackRox main image
+* Network access to pull the StackRox main image. For a private registry, see [Private Registries](#private-registries).
 
 ## Installation
 
@@ -113,6 +115,30 @@ Exec=serve --host-path /host --port 2048
 
 The port must match the StackRox Sensor configuration.
 
+### Private Registries
+
+Quadlet pulls the image as a systemd service. That pull does not use `/etc/containers/auth.json` unless you pass the path into Podman.
+
+RHEL 8 Quadlet (Podman 4.9) rejects `AuthFile=` in the `[Container]` section (`unsupported key 'AuthFile'`), so set a systemd environment variable instead.
+
+If the StackRox main image is in a private registry:
+
+1. Put registry credentials in `/etc/containers/auth.json`. Create that file with `sudo podman login` or by copying a Docker config JSON. Each registry entry needs an `auth` field (`base64(username:password)`); RHEL 8 Podman ignores username/password-only files.
+2. Add this line to the `[Service]` section of `roxagent.container`:
+
+```ini
+Environment=REGISTRY_AUTH_FILE=/etc/containers/auth.json
+```
+
+On Podman 5 and later you can set `AuthFile=/etc/containers/auth.json` in `[Container]` instead.
+
+3. Reload systemd and restart the unit:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl restart roxagent.service
+```
+
 ## Troubleshooting
 
 ### No Packages Found
@@ -140,6 +166,10 @@ ls -la /dev/vsock
 lsmod | grep vsock
 ```
 
+### Image Pull Unauthorized
+
+If `journalctl -u roxagent.service` reports `unauthorized` while pulling the main image, Quadlet is not using your registry credentials. Set `REGISTRY_AUTH_FILE` as described in [Private Registries](#private-registries). If `quadlet --dryrun` reports `unsupported key 'AuthFile'`, use the `[Service]` `Environment=` form, not `AuthFile=`.
+
 ### Container Fails to Start
 
 Check Quadlet generation:
diff --git a/compliance/virtualmachines/roxagent/quadlet/roxagent.container b/compliance/virtualmachines/roxagent/quadlet/roxagent.container
index 566ecd248c5a9..5492417eabb27 100644
--- a/compliance/virtualmachines/roxagent/quadlet/roxagent.container
+++ b/compliance/virtualmachines/roxagent/quadlet/roxagent.container
@@ -8,6 +8,8 @@ Image=quay.io/stackrox-io/main:latest
 Pull=newer
 Exec=serve --host-path /host
 Network=host
+# Pass NOTIFY_SOCKET into the container so roxagent can READY=1 after VSOCK listen.
+Notify=true
 
 # Privileged for vsock access
 # Use PodmanArgs for entrypoint (RHEL 8 Quadlet doesn't support Entrypoint key)
@@ -34,6 +36,8 @@ Volume=/usr/lib/sysimage/libdnf5:/host/usr/lib/sysimage/libdnf5:ro
 [Service]
 Restart=on-failure
 RestartSec=10s
+# First pull of the main image can take minutes; systemd's 90s default would kill Type=notify start.
+TimeoutStartSec=600
 
 [Install]
 WantedBy=multi-user.target
diff --git a/compliance/virtualmachines/roxagent/vsockserver/mapping.go b/compliance/virtualmachines/roxagent/vsockserver/mapping.go
new file mode 100644
index 0000000000000..eb59d5573fd6e
--- /dev/null
+++ b/compliance/virtualmachines/roxagent/vsockserver/mapping.go
@@ -0,0 +1,30 @@
+package vsockserver
+
+import (
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+)
+
+// MappingProvider supplies the current repository-to-CPE mapping regardless
+// of which updater (Sensor-backed or URL-backed) owns it in this process.
+type MappingProvider interface {
+	Ready() bool
+	Hash() string
+	UpdatePath() pb.RepoCPEMappingUpdatePath
+	Bytes() ([]byte, error)
+	// Path returns a file matching Bytes(). It may write that file if a
+	// background persist has not landed yet.
+	Path() (string, error)
+}
+
+// MappingUpdater accepts new mapping content pushed in over VSOCK. Only the
+// Sensor-backed updater implements this; a URL-backed agent's Handler keeps
+// its updater reference nil and rejects SyncRepoCPEMapping instead.
+type MappingUpdater interface {
+	Update(content []byte) (updated bool, err error)
+}
+
+// ScanBusyGate keeps a mapping Sync from replacing the file a scan is reading.
+type ScanBusyGate interface {
+	MarkScanBusy()
+	MarkScanIdleAndApplyPending()
+}
diff --git a/compliance/virtualmachines/roxagent/vsockserver/protocol.go b/compliance/virtualmachines/roxagent/vsockserver/protocol.go
index d6342f11b521b..8ef0d7919e6f1 100644
--- a/compliance/virtualmachines/roxagent/vsockserver/protocol.go
+++ b/compliance/virtualmachines/roxagent/vsockserver/protocol.go
@@ -6,27 +6,37 @@ import (
 	"fmt"
 	"maps"
 	"net"
+	"slices"
 	"sync/atomic"
 	"time"
 
+	"github.com/cespare/xxhash/v2"
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
 	"github.com/stackrox/rox/pkg/vsockframing"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
-const maxRequestSize = 1 << 20 // 1 MiB
+const (
+	// maxRequestSize must fit the largest message - a synced repo-to-CPE mapping (up to MaxMappingBytes) - plus envelope headroom.
+	maxRequestSize = cpemapping.MaxMappingBytes + 1<<20
+
+	methodGetReport          = "get_report"
+	methodSyncRepoCPEMapping = "sync_repo_cpe_mapping"
+)
 
 // reportSnapshot is an immutable point-in-time view of the cached report state.
 type reportSnapshot struct {
 	report      *v4.IndexReport
-	generation  uint32
+	token       string
 	generatedAt time.Time
 	facts       map[string]string
+	mappingHash string
 }
 
-// ReportCache holds the cached scan report with its generation counter.
+// ReportCache holds the cached scan report with its content-hash token.
 // Invariant: exactly one goroutine (the rescan loop) calls SetReport; multiple
 // HandleConn goroutines read via snap.Load(). This single-writer/multi-reader
 // pattern is safe with atomic.Pointer without CAS.
@@ -34,27 +44,59 @@ type ReportCache struct {
 	snap atomic.Pointer[reportSnapshot]
 }
 
-// SetReport atomically publishes a new report with updated facts in a single
-// store, incrementing the generation counter. Readers never observe a partial
-// (new report, stale facts) state.
+// Token returns the published content-hash, or empty before the first scan.
+func (c *ReportCache) Token() string {
+	if c == nil {
+		return ""
+	}
+	snap := c.snap.Load()
+	if snap == nil {
+		return ""
+	}
+	return snap.token
+}
+
+// SetReport atomically publishes a new report and facts. The token is an
+// XXH64 of that content, so identical rescans stay unchanged for Sensor.
+//
+// mappingHash is the repo-to-CPE mapping the scan used, so GetReport can send
+// it after a later Sync has already replaced the live mapping.
 //
 // r and facts are defensively copied so that a caller mutating its own copy
 // after this call (or reusing the same facts map across scans) can never
 // mutate the published, supposedly-immutable snapshot out from under
 // concurrent readers.
-func (c *ReportCache) SetReport(r *v4.IndexReport, facts map[string]string) {
-	var counter uint32
-	if old := c.snap.Load(); old != nil {
-		counter = old.generation
-	}
+func (c *ReportCache) SetReport(r *v4.IndexReport, facts map[string]string, mappingHash string) {
+	cloned := cloneIndexReport(r)
+	clonedFacts := cloneFacts(facts)
 	c.snap.Store(&reportSnapshot{
-		report:      cloneIndexReport(r),
-		generation:  counter + 1,
+		report:      cloned,
+		token:       reportToken(cloned, clonedFacts),
 		generatedAt: time.Now(),
-		facts:       cloneFacts(facts),
+		facts:       clonedFacts,
+		mappingHash: mappingHash,
 	})
 }
 
+// reportToken is XXH64 of the IndexReport and facts, as 16 lowercase hex
+// digits. Deterministic marshal keeps identical content stable across rescans.
+func reportToken(r *v4.IndexReport, facts map[string]string) string {
+	h := xxhash.New()
+	if r != nil {
+		b, err := proto.MarshalOptions{Deterministic: true}.Marshal(r)
+		if err == nil {
+			_, _ = h.Write(b)
+		}
+	}
+	for _, k := range slices.Sorted(maps.Keys(facts)) {
+		_, _ = h.Write([]byte(k))
+		_, _ = h.Write([]byte{0})
+		_, _ = h.Write([]byte(facts[k]))
+		_, _ = h.Write([]byte{0})
+	}
+	return fmt.Sprintf("%016x", h.Sum64())
+}
+
 // cloneIndexReport returns a deep copy of r, or nil if r is nil.
 func cloneIndexReport(r *v4.IndexReport) *v4.IndexReport {
 	if r == nil {
@@ -78,32 +120,14 @@ func cloneFacts(in map[string]string) map[string]string {
 type Handler struct {
 	cache        *ReportCache
 	agentVersion string
-	// epoch is seeded once per process lifetime and never persisted to VM
-	// disk. It lets Sensor (and this handler itself, via GetReportRequest's
-	// known_epoch) distinguish "this agent restarted" from "this agent's
-	// generation counter coincidentally reset to a value Sensor already has
-	// cached" without changing report_generation's own sequential,
-	// human-readable semantics.
-	epoch uint32
-}
-
-// NewHandler creates a protocol handler.
-func NewHandler(cache *ReportCache, agentVersion string) *Handler {
-	return &Handler{cache: cache, agentVersion: agentVersion, epoch: newEpoch()}
+	provider     MappingProvider
+	updater      MappingUpdater
 }
 
-// newEpoch derives a process-lifetime epoch value. Time-derived rather than
-// cryptographically random: epoch only needs to differ across restarts with
-// overwhelming probability, not resist an adversary. Seconds (not
-// nanoseconds) since the Unix epoch, so the value only wraps every ~136
-// years instead of every ~4.3 seconds when truncated to uint32. 0 is
-// reserved to mean "agent predates this field" (see ResponseMeta.epoch doc),
-// so it's excluded.
-func newEpoch() uint32 {
-	if e := uint32(time.Now().Unix()); e != 0 {
-		return e
-	}
-	return 1
+// NewHandler creates a protocol handler. updater is nil for URL-managed
+// agents, so SyncRepoCPEMapping is rejected with MAPPING_NOT_SENSOR_MANAGED.
+func NewHandler(cache *ReportCache, agentVersion string, provider MappingProvider, updater MappingUpdater) *Handler {
+	return &Handler{cache: cache, agentVersion: agentVersion, provider: provider, updater: updater}
 }
 
 // HandleConn reads a framed request from conn, processes it, writes a framed response, and closes conn.
@@ -141,6 +165,7 @@ func (h *Handler) HandleConn(conn net.Conn) {
 	}
 	if err := vsockframing.WriteFrame(conn, respData); err != nil {
 		log.Errorf("Writing response frame: %v", err)
+		return
 	}
 }
 
@@ -148,44 +173,38 @@ func (h *Handler) dispatch(req *pb.VMServiceRequest) *pb.VMServiceResponse {
 	switch req.GetMethod().(type) {
 	case *pb.VMServiceRequest_GetReport:
 		return h.handleGetReport(req.GetGetReport())
+	case *pb.VMServiceRequest_SyncRepoCpeMapping:
+		return h.handleSyncRepoCPEMapping(req.GetSyncRepoCpeMapping())
 	default:
 		return h.errorResponse(pb.ErrorCode_ERROR_CODE_UNKNOWN_METHOD, "unknown or unset method")
 	}
 }
 
 func (h *Handler) handleGetReport(req *pb.GetReportRequest) *pb.VMServiceResponse {
+	if !h.provider.Ready() {
+		log.Info("GetReport: no repo-to-CPE mapping available yet")
+		return h.errorResponse(pb.ErrorCode_ERROR_CODE_MAPPING_REQUIRED, "repository-to-CPE mapping not yet available")
+	}
+
 	snap := h.cache.snap.Load()
 	if snap == nil || snap.report == nil {
 		log.Info("GetReport: not ready (initial scan in progress)")
 		return h.errorResponseFromSnap(snap, pb.ErrorCode_ERROR_CODE_NOT_READY, "initial scan in progress, try again later")
 	}
 
-	// Strict equality (not >=) so that after an agent restart — when the generation
-	// counter resets to 1 — a sensor still holding a higher generation from the
-	// previous instance will receive the full report instead of a false "unchanged".
-	//
-	// known_epoch guards against the opposite false positive: a restarted agent
-	// whose reset generation coincidentally re-matches last_known_generation.
-	// 0 means Sensor doesn't know our epoch yet (first-ever request for this VM,
-	// or a Sensor build that predates the field), so fall back to generation-only
-	// comparison exactly as before this field existed.
-	generationMatches := req.GetLastKnownGeneration() == snap.generation
-	knownEpoch := req.GetKnownEpoch()
-	epochMatches := knownEpoch == 0 || knownEpoch == h.epoch
-	if generationMatches && epochMatches {
-		log.Infof("GetReport: unchanged (generation=%d, last_known_generation=%d)", snap.generation, req.GetLastKnownGeneration())
+	// Empty last_known_token forces a full report (first request or Sensor
+	// refresh). A matching token is identical content; any other value
+	// means the published report or facts changed.
+	if lastKnown := req.GetLastKnownToken(); lastKnown != "" && lastKnown == snap.token {
+		log.Infof("GetReport: unchanged (token=%s)", snap.token)
 		resp := h.newResponseFromSnap(snap)
 		resp.Result = &pb.VMServiceResponse_GetReport{
 			GetReport: &pb.GetReportResponse{Unchanged: true},
 		}
 		return resp
 	}
-	if generationMatches && !epochMatches {
-		log.Infof("GetReport: generation matches (%d) but epoch changed (known=%d, current=%d) — agent restarted, serving full report in this round trip",
-			snap.generation, knownEpoch, h.epoch)
-	}
 
-	log.Infof("GetReport: serving report (generation=%d, packages=%d)", snap.generation, len(snap.report.GetContents().GetPackages()))
+	log.Infof("GetReport: serving report (token=%s, packages=%d)", snap.token, len(snap.report.GetContents().GetPackages()))
 	resp := h.newResponseFromSnap(snap)
 	resp.Result = &pb.VMServiceResponse_GetReport{
 		GetReport: &pb.GetReportResponse{IndexReport: snap.report},
@@ -195,17 +214,25 @@ func (h *Handler) handleGetReport(req *pb.GetReportRequest) *pb.VMServiceRespons
 
 func (h *Handler) newResponseFromSnap(snap *reportSnapshot) *pb.VMServiceResponse {
 	var facts map[string]string
-	var gen uint32
+	var token string
+	mappingHash := h.provider.Hash()
 	if snap != nil {
 		facts = cloneFacts(snap.facts)
-		gen = snap.generation
+		token = snap.token
+		mappingHash = snap.mappingHash
+	}
+	updatePath := h.provider.UpdatePath()
+	methods := []string{methodGetReport}
+	if h.updater != nil {
+		methods = append(methods, methodSyncRepoCPEMapping)
 	}
 	meta := &pb.ResponseMeta{
-		AgentVersion:     h.agentVersion,
-		ReportGeneration: gen,
-		SupportedMethods: []string{"get_report"},
-		Facts:            facts,
-		Epoch:            h.epoch,
+		AgentVersion:             h.agentVersion,
+		ReportToken:              token,
+		SupportedMethods:         methods,
+		Facts:                    facts,
+		RepoCpeMappingHash:       new(mappingHash),
+		RepoCpeMappingUpdatePath: updatePath.Enum(),
 	}
 	if snap != nil && !snap.generatedAt.IsZero() {
 		meta.ReportGeneratedAt = timestamppb.New(snap.generatedAt)
@@ -213,6 +240,24 @@ func (h *Handler) newResponseFromSnap(snap *reportSnapshot) *pb.VMServiceRespons
 	return &pb.VMServiceResponse{Meta: meta}
 }
 
+// handleSyncRepoCPEMapping applies a Sensor-pushed mapping. URL-managed
+// agents (updater == nil) reject Sync outright; Update keeps the last-good
+// mapping on a validation failure.
+func (h *Handler) handleSyncRepoCPEMapping(req *pb.SyncRepoCPEMappingRequest) *pb.VMServiceResponse {
+	if h.updater == nil {
+		return h.errorResponse(pb.ErrorCode_ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED, "agent is URL-managed and does not accept pushed mappings")
+	}
+	updated, err := h.updater.Update(req.GetMapping())
+	if err != nil {
+		return h.errorResponse(pb.ErrorCode_ERROR_CODE_MALFORMED_REQUEST, fmt.Sprintf("invalid repository-to-CPE mapping: %v", err))
+	}
+	resp := h.newResponseFromSnap(h.cache.snap.Load())
+	resp.Result = &pb.VMServiceResponse_SyncRepoCpeMapping{
+		SyncRepoCpeMapping: &pb.SyncRepoCPEMappingResponse{Updated: updated},
+	}
+	return resp
+}
+
 func (h *Handler) errorResponse(code pb.ErrorCode, msg string) *pb.VMServiceResponse {
 	return h.errorResponseFromSnap(h.cache.snap.Load(), code, msg)
 }
diff --git a/compliance/virtualmachines/roxagent/vsockserver/protocol_test.go b/compliance/virtualmachines/roxagent/vsockserver/protocol_test.go
index 8b92f646015ee..1150d1dcf1894 100644
--- a/compliance/virtualmachines/roxagent/vsockserver/protocol_test.go
+++ b/compliance/virtualmachines/roxagent/vsockserver/protocol_test.go
@@ -1,17 +1,56 @@
 package vsockserver
 
 import (
+	"errors"
 	"net"
+	"path/filepath"
 	"testing"
 
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
 	"github.com/stackrox/rox/pkg/vsockframing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
 )
 
+// fakeMappingProvider is a MappingProvider test double whose Ready/Hash/
+// UpdatePath are directly settable; Bytes/Path are unused by the Handler
+// and always error.
+type fakeMappingProvider struct {
+	ready      bool
+	hash       string
+	updatePath pb.RepoCPEMappingUpdatePath
+}
+
+func (f *fakeMappingProvider) Ready() bool                             { return f.ready }
+func (f *fakeMappingProvider) Hash() string                            { return f.hash }
+func (f *fakeMappingProvider) UpdatePath() pb.RepoCPEMappingUpdatePath { return f.updatePath }
+func (f *fakeMappingProvider) Bytes() ([]byte, error)                  { return nil, errors.New("not implemented") }
+func (f *fakeMappingProvider) Path() (string, error)                   { return "", errors.New("not implemented") }
+
+var _ MappingProvider = (*fakeMappingProvider)(nil)
+
+// fakeMappingUpdater is a MappingUpdater test double that returns a fixed
+// (updated, err) pair and records the content it was called with.
+type fakeMappingUpdater struct {
+	updated bool
+	err     error
+	calls   [][]byte
+}
+
+func (f *fakeMappingUpdater) Update(content []byte) (bool, error) {
+	f.calls = append(f.calls, content)
+	return f.updated, f.err
+}
+
+var _ MappingUpdater = (*fakeMappingUpdater)(nil)
+
+// readyProvider is the default fakeMappingProvider for GetReport test
+// cases that aren't exercising mapping-readiness behavior itself.
+func readyProvider() *fakeMappingProvider { return &fakeMappingProvider{ready: true} }
+
 func sendAndReceive(t *testing.T, handler *Handler, req *pb.VMServiceRequest) *pb.VMServiceResponse {
 	t.Helper()
 	clientConn, serverConn := net.Pipe()
@@ -30,15 +69,21 @@ func sendAndReceive(t *testing.T, handler *Handler, req *pb.VMServiceRequest) *p
 	return &resp
 }
 
+func getReportRequest(requestID, lastKnownToken string) *pb.VMServiceRequest {
+	return &pb.VMServiceRequest{
+		Meta:   &pb.RequestMeta{RequestId: requestID},
+		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{LastKnownToken: lastKnownToken}},
+	}
+}
+
 func TestHandleRequest_GetReport(t *testing.T) {
 	cache := &ReportCache{}
-	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil)
+	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil, "mapping-hash")
+	provider := &fakeMappingProvider{ready: true, hash: "mapping-hash", updatePath: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR}
 
-	handler := NewHandler(cache, "test-1.0.0")
-	req := &pb.VMServiceRequest{
-		Meta:   &pb.RequestMeta{RequestId: "req-1", Capabilities: []string{"report_v1"}},
-		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{LastKnownGeneration: 0}},
-	}
+	handler := NewHandler(cache, "test-1.0.0", provider, nil)
+	req := getReportRequest("req-1", "")
+	req.Meta.Capabilities = []string{"report_v1"}
 
 	resp := sendAndReceive(t, handler, req)
 
@@ -49,137 +94,119 @@ func TestHandleRequest_GetReport(t *testing.T) {
 	meta := resp.GetMeta()
 	require.NotNil(t, meta)
 	assert.Equal(t, "test-1.0.0", meta.GetAgentVersion())
-	assert.Equal(t, uint32(1), meta.GetReportGeneration())
+	assert.NotEmpty(t, meta.GetReportToken())
 	assert.NotNil(t, meta.GetReportGeneratedAt())
-	assert.Contains(t, meta.GetSupportedMethods(), "get_report")
-	assert.NotZero(t, meta.GetEpoch(), "epoch should be seeded on handler creation")
+	assert.Contains(t, meta.GetSupportedMethods(), methodGetReport)
+	assert.NotContains(t, meta.GetSupportedMethods(), methodSyncRepoCPEMapping)
+	assert.Equal(t, "mapping-hash", meta.GetRepoCpeMappingHash())
+	assert.Equal(t, pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR, meta.GetRepoCpeMappingUpdatePath())
 }
 
-func TestHandleRequest_GetReport_Unchanged(t *testing.T) {
+func TestHandleRequest_GetReport_MappingHashStaysWithTheReport(t *testing.T) {
 	cache := &ReportCache{}
-	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil)
+	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil, "hash-at-scan")
+	provider := &fakeMappingProvider{ready: true, hash: "hash-after-later-sync"}
 
-	handler := NewHandler(cache, "test-1.0.0")
+	handler := NewHandler(cache, "test-1.0.0", provider, nil)
 	req := &pb.VMServiceRequest{
-		Meta:   &pb.RequestMeta{RequestId: "req-2"},
-		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{LastKnownGeneration: 1}},
+		Meta:   &pb.RequestMeta{RequestId: "req-snap-hash"},
+		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{}},
 	}
 
 	resp := sendAndReceive(t, handler, req)
 
-	assert.NotNil(t, resp.GetGetReport())
-	assert.True(t, resp.GetGetReport().GetUnchanged())
-	assert.Nil(t, resp.GetGetReport().GetIndexReport())
+	assert.Equal(t, "hash-at-scan", resp.GetMeta().GetRepoCpeMappingHash(),
+		"GetReport must send the hash the cached report was built with, not the mapping that landed after the scan")
 }
 
-func TestHandleRequest_GetReport_UnchangedWhenKnownEpochMatches(t *testing.T) {
+func TestHandleRequest_GetReport_Unchanged(t *testing.T) {
 	cache := &ReportCache{}
-	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil)
-
-	handler := NewHandler(cache, "test-1.0.0")
-	// Learn the handler's epoch from a first exchange (known_epoch=0, so
-	// Sensor has no cached epoch yet — falls back to generation-only).
-	firstResp := sendAndReceive(t, handler, &pb.VMServiceRequest{
-		Meta:   &pb.RequestMeta{RequestId: "req-learn-epoch"},
-		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{LastKnownGeneration: 0}},
-	})
-	epoch := firstResp.GetMeta().GetEpoch()
-	require.NotZero(t, epoch)
+	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil, "")
 
-	req := &pb.VMServiceRequest{
-		Meta: &pb.RequestMeta{RequestId: "req-epoch-match"},
-		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{
-			LastKnownGeneration: 1,
-			KnownEpoch:          epoch,
-		}},
-	}
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
+	first := sendAndReceive(t, handler, getReportRequest("req-learn-token", ""))
+	token := first.GetMeta().GetReportToken()
+	require.NotEmpty(t, token)
 
-	resp := sendAndReceive(t, handler, req)
+	resp := sendAndReceive(t, handler, getReportRequest("req-2", token))
 
 	assert.NotNil(t, resp.GetGetReport())
-	assert.True(t, resp.GetGetReport().GetUnchanged(), "matching generation and epoch should report unchanged")
+	assert.True(t, resp.GetGetReport().GetUnchanged())
 	assert.Nil(t, resp.GetGetReport().GetIndexReport())
+	assert.Equal(t, token, resp.GetMeta().GetReportToken())
 }
 
-// TestHandleRequest_GetReport_ServesFullReportOnKnownEpochMismatch covers
-// the case report_generation alone cannot distinguish: report_generation
-// resets to 1 on every roxagent restart, so a restarted agent can
-// coincidentally match a generation Sensor already has cached for a
-// previous instance. known_epoch lets the agent detect this itself, in a
-// single round trip, by comparing Sensor's last-seen epoch against its own
-// current one.
-func TestHandleRequest_GetReport_ServesFullReportOnKnownEpochMismatch(t *testing.T) {
+// TestHandleRequest_GetReport_TokenMismatch covers a Sensor-cached token
+// that does not match the agent's current content.
+func TestHandleRequest_GetReport_TokenMismatch(t *testing.T) {
 	cache := &ReportCache{}
-	cache.SetReport(&v4.IndexReport{HashId: "post-restart-hash"}, nil)
+	cache.SetReport(&v4.IndexReport{HashId: "post-restart-hash"}, nil, "")
 
-	handler := NewHandler(cache, "test-1.0.0")
-	req := &pb.VMServiceRequest{
-		Meta: &pb.RequestMeta{RequestId: "req-epoch-mismatch"},
-		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{
-			// Generation matches (both are 1), but Sensor's cached epoch is
-			// from a previous agent process instance.
-			LastKnownGeneration: 1,
-			KnownEpoch:          12345,
-		}},
-	}
-
-	resp := sendAndReceive(t, handler, req)
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
+	resp := sendAndReceive(t, handler, getReportRequest("req-mismatch", "stale-token"))
 
 	assert.NotNil(t, resp.GetGetReport())
-	assert.False(t, resp.GetGetReport().GetUnchanged(), "epoch mismatch must serve the full report despite matching generation")
+	assert.False(t, resp.GetGetReport().GetUnchanged())
 	require.NotNil(t, resp.GetGetReport().GetIndexReport())
 	assert.Equal(t, "post-restart-hash", resp.GetGetReport().GetIndexReport().GetHashId())
-	assert.NotEqual(t, uint32(12345), resp.GetMeta().GetEpoch(), "response should carry the agent's real current epoch")
+	assert.NotEmpty(t, resp.GetMeta().GetReportToken())
+	assert.NotEqual(t, "stale-token", resp.GetMeta().GetReportToken())
 }
 
-// TestHandleRequest_GetReport_UnchangedWhenKnownEpochZero pins down backward
-// compatibility: known_epoch=0 means Sensor has no epoch to compare (first
-// request for this VM, or a Sensor build that predates the field), so the
-// agent must fall back to generation-only comparison exactly as before this
-// field existed.
-func TestHandleRequest_GetReport_UnchangedWhenKnownEpochZero(t *testing.T) {
+// TestHandleRequest_GetReport_IdenticalRescanUnchanged covers a rescan
+// whose report and facts did not change: the token is stable, so Sensor
+// gets unchanged unless it sends an empty last_known_token.
+func TestHandleRequest_GetReport_IdenticalRescanUnchanged(t *testing.T) {
 	cache := &ReportCache{}
-	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil)
+	cache.SetReport(&v4.IndexReport{HashId: "same-hash"}, nil, "")
 
-	handler := NewHandler(cache, "test-1.0.0")
-	req := &pb.VMServiceRequest{
-		Meta: &pb.RequestMeta{RequestId: "req-epoch-zero"},
-		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{
-			LastKnownGeneration: 1,
-			KnownEpoch:          0,
-		}},
-	}
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
+	first := sendAndReceive(t, handler, getReportRequest("req-first-scan", ""))
+	token := first.GetMeta().GetReportToken()
+	require.NotEmpty(t, token)
 
-	resp := sendAndReceive(t, handler, req)
+	cache.SetReport(&v4.IndexReport{HashId: "same-hash"}, nil, "")
+	resp := sendAndReceive(t, handler, getReportRequest("req-after-rescan", token))
 
 	assert.NotNil(t, resp.GetGetReport())
-	assert.True(t, resp.GetGetReport().GetUnchanged(), "known_epoch=0 should fall back to generation-only comparison")
+	assert.True(t, resp.GetGetReport().GetUnchanged())
 	assert.Nil(t, resp.GetGetReport().GetIndexReport())
+	assert.Equal(t, token, resp.GetMeta().GetReportToken())
 }
 
-func TestHandleRequest_GetReport_GenerationRegression(t *testing.T) {
+// TestHandleRequest_GetReport_ContentChangeServesReport covers a rescan
+// whose content changed: the token changes and the full report is served.
+func TestHandleRequest_GetReport_ContentChangeServesReport(t *testing.T) {
 	cache := &ReportCache{}
-	cache.SetReport(&v4.IndexReport{HashId: "post-restart-hash"}, nil)
+	cache.SetReport(&v4.IndexReport{HashId: "before"}, nil, "")
 
-	handler := NewHandler(cache, "test-1.0.0")
-	req := &pb.VMServiceRequest{
-		Meta: &pb.RequestMeta{RequestId: "req-regression"},
-		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{
-			LastKnownGeneration: 5,
-		}},
-	}
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
+	first := sendAndReceive(t, handler, getReportRequest("req-before", ""))
+	token := first.GetMeta().GetReportToken()
+	require.NotEmpty(t, token)
 
-	resp := sendAndReceive(t, handler, req)
+	cache.SetReport(&v4.IndexReport{HashId: "after"}, nil, "")
+	resp := sendAndReceive(t, handler, getReportRequest("req-after", token))
 
 	assert.NotNil(t, resp.GetGetReport())
-	assert.False(t, resp.GetGetReport().GetUnchanged(), "agent restarted (gen=1 < requested=5), must serve full report")
-	assert.Equal(t, "post-restart-hash", resp.GetGetReport().GetIndexReport().GetHashId())
-	assert.Equal(t, uint32(1), resp.GetMeta().GetReportGeneration())
+	assert.False(t, resp.GetGetReport().GetUnchanged())
+	assert.Equal(t, "after", resp.GetGetReport().GetIndexReport().GetHashId())
+	assert.NotEmpty(t, resp.GetMeta().GetReportToken())
+	assert.NotEqual(t, token, resp.GetMeta().GetReportToken())
+}
+
+func TestReportToken(t *testing.T) {
+	report := &v4.IndexReport{HashId: "a"}
+	assert.Equal(t, reportToken(report, nil), reportToken(&v4.IndexReport{HashId: "a"}, map[string]string{}))
+	assert.NotEqual(t, reportToken(report, nil), reportToken(&v4.IndexReport{HashId: "b"}, nil))
+	assert.NotEqual(t, reportToken(report, nil), reportToken(report, map[string]string{"os": "rhel"}))
+	assert.Equal(t, reportToken(nil, nil), reportToken(nil, map[string]string{}))
+	assert.Len(t, reportToken(report, nil), 16)
 }
 
 func TestHandleRequest_NotReady(t *testing.T) {
 	cache := &ReportCache{}
-	handler := NewHandler(cache, "test-1.0.0")
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
 	req := &pb.VMServiceRequest{
 		Meta:   &pb.RequestMeta{RequestId: "req-3"},
 		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{}},
@@ -194,8 +221,8 @@ func TestHandleRequest_NotReady(t *testing.T) {
 
 func TestHandleRequest_UnknownMethod(t *testing.T) {
 	cache := &ReportCache{}
-	cache.SetReport(&v4.IndexReport{HashId: "x"}, nil)
-	handler := NewHandler(cache, "test-1.0.0")
+	cache.SetReport(&v4.IndexReport{HashId: "x"}, nil, "")
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
 
 	req := &pb.VMServiceRequest{
 		Meta: &pb.RequestMeta{RequestId: "req-4"},
@@ -208,3 +235,162 @@ func TestHandleRequest_UnknownMethod(t *testing.T) {
 	require.NotNil(t, resp.GetError())
 	assert.Equal(t, pb.ErrorCode_ERROR_CODE_UNKNOWN_METHOD, resp.GetError().GetCode())
 }
+
+func TestHandleRequest_GetReport_MappingRequired(t *testing.T) {
+	cache := &ReportCache{}
+	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil, "")
+	handler := NewHandler(cache, "test-1.0.0", &fakeMappingProvider{ready: false}, nil)
+
+	req := &pb.VMServiceRequest{
+		Meta:   &pb.RequestMeta{RequestId: "req-mapping-required"},
+		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{}},
+	}
+
+	resp := sendAndReceive(t, handler, req)
+
+	assert.Nil(t, resp.GetGetReport())
+	require.NotNil(t, resp.GetError())
+	assert.Equal(t, pb.ErrorCode_ERROR_CODE_MAPPING_REQUIRED, resp.GetError().GetCode())
+}
+
+// TestHandleRequest_MetadataAlwaysPresentOnError pins down that an empty
+// mapping hash is still an explicitly-present optional field, not a nil
+// one Sensor would have to special-case.
+func TestHandleRequest_MetadataAlwaysPresentOnError(t *testing.T) {
+	cache := &ReportCache{}
+	handler := NewHandler(cache, "test-1.0.0", &fakeMappingProvider{ready: false}, nil)
+
+	req := &pb.VMServiceRequest{
+		Meta:   &pb.RequestMeta{RequestId: "req-meta-on-error"},
+		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{}},
+	}
+
+	resp := sendAndReceive(t, handler, req)
+
+	require.NotNil(t, resp.GetError())
+	meta := resp.GetMeta()
+	require.NotNil(t, meta)
+	require.NotNil(t, meta.RepoCpeMappingHash, "hash must be present-but-empty, not nil")
+	assert.Empty(t, meta.GetRepoCpeMappingHash())
+	require.NotNil(t, meta.RepoCpeMappingUpdatePath)
+	assert.NotContains(t, meta.GetSupportedMethods(), methodSyncRepoCPEMapping)
+}
+
+func TestHandleRequest_SyncRepoCPEMapping(t *testing.T) {
+	tests := map[string]struct {
+		updater     *fakeMappingUpdater
+		wantCode    pb.ErrorCode
+		wantUpdated bool
+	}{
+		"new mapping content is applied": {
+			updater:     &fakeMappingUpdater{updated: true},
+			wantUpdated: true,
+		},
+		"unchanged mapping content is a no-op": {
+			updater:     &fakeMappingUpdater{updated: false},
+			wantUpdated: false,
+		},
+		"oversize or otherwise invalid content is rejected as malformed": {
+			updater:  &fakeMappingUpdater{err: errors.New("mapping size exceeds cap")},
+			wantCode: pb.ErrorCode_ERROR_CODE_MALFORMED_REQUEST,
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			cache := &ReportCache{}
+			handler := NewHandler(cache, "test-1.0.0", readyProvider(), tt.updater)
+			req := &pb.VMServiceRequest{
+				Meta:   &pb.RequestMeta{RequestId: "req-sync"},
+				Method: &pb.VMServiceRequest_SyncRepoCpeMapping{SyncRepoCpeMapping: &pb.SyncRepoCPEMappingRequest{Mapping: []byte("content")}},
+			}
+
+			resp := sendAndReceive(t, handler, req)
+
+			if tt.wantCode != pb.ErrorCode_ERROR_CODE_UNSPECIFIED {
+				require.NotNil(t, resp.GetError())
+				assert.Equal(t, tt.wantCode, resp.GetError().GetCode())
+				assert.Nil(t, resp.GetSyncRepoCpeMapping())
+				return
+			}
+			require.NotNil(t, resp.GetSyncRepoCpeMapping())
+			assert.Equal(t, tt.wantUpdated, resp.GetSyncRepoCpeMapping().GetUpdated())
+			assert.Contains(t, resp.GetMeta().GetSupportedMethods(), methodSyncRepoCPEMapping)
+			require.Len(t, tt.updater.calls, 1)
+			assert.Equal(t, []byte("content"), tt.updater.calls[0])
+		})
+	}
+}
+
+func TestHandleRequest_SyncRepoCPEMapping_NilUpdater_NotSensorManaged(t *testing.T) {
+	cache := &ReportCache{}
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
+	req := &pb.VMServiceRequest{
+		Meta:   &pb.RequestMeta{RequestId: "req-sync-url-managed"},
+		Method: &pb.VMServiceRequest_SyncRepoCpeMapping{SyncRepoCpeMapping: &pb.SyncRepoCPEMappingRequest{Mapping: []byte("content")}},
+	}
+
+	resp := sendAndReceive(t, handler, req)
+
+	assert.Nil(t, resp.GetSyncRepoCpeMapping())
+	require.NotNil(t, resp.GetError())
+	assert.Equal(t, pb.ErrorCode_ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED, resp.GetError().GetCode())
+}
+
+// TestHandleConn_GetReport_DoesNotApplyPending covers a rescan in flight
+// while Sensor still polls: GetReport must not apply a deferred Sync. The
+// scan itself applies pending when it returns.
+func TestHandleConn_GetReport_DoesNotApplyPending(t *testing.T) {
+	cache := &ReportCache{}
+	cachePath := filepath.Join(t.TempDir(), "cache.json")
+	u := NewSensorUpdater(cachePath, "", nil)
+	_, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	scanHash := u.Hash()
+	cache.SetReport(&v4.IndexReport{HashId: "gen-1"}, nil, scanHash)
+
+	handler := NewHandler(cache, "test-1.0.0", u, u)
+	u.MarkScanBusy()
+
+	getReportReq := &pb.VMServiceRequest{
+		Meta:   &pb.RequestMeta{RequestId: "req-during-scan"},
+		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{}},
+	}
+	resp := sendAndReceive(t, handler, getReportReq)
+	require.NotNil(t, resp.GetGetReport())
+
+	updated, err := u.Update([]byte(otherValidMappingJSON))
+	require.NoError(t, err)
+	require.True(t, updated)
+	assert.Equal(t, scanHash, u.Hash(), "GetReport must not apply a deferred Sync")
+
+	cache.SetReport(&v4.IndexReport{HashId: "gen-2"}, nil, scanHash)
+	resp = sendAndReceive(t, handler, getReportReq)
+	require.NotNil(t, resp.GetGetReport())
+	assert.Equal(t, scanHash, u.Hash(), "GetReport of a newer cached report must still not apply pending")
+	assert.Equal(t, scanHash, resp.GetMeta().GetRepoCpeMappingHash())
+
+	u.MarkScanIdleAndApplyPending()
+	assert.Equal(t, cpemapping.HashMapping([]byte(otherValidMappingJSON)), u.Hash())
+	waitForCacheContent(t, u, cachePath, otherValidMappingJSON)
+
+	resp = sendAndReceive(t, handler, getReportReq)
+	assert.Equal(t, scanHash, resp.GetMeta().GetRepoCpeMappingHash(),
+		"the cached report must still send the hash it was built with")
+}
+
+// TestHandleConn_UngatedProviderNeverPanics covers a URL-managed agent's
+// provider, which does not implement ScanBusyGate.
+func TestHandleConn_UngatedProviderNeverPanics(t *testing.T) {
+	cache := &ReportCache{}
+	cache.SetReport(&v4.IndexReport{HashId: "test-hash"}, nil, "")
+	handler := NewHandler(cache, "test-1.0.0", readyProvider(), nil)
+
+	req := &pb.VMServiceRequest{
+		Meta:   &pb.RequestMeta{RequestId: "req-ungated"},
+		Method: &pb.VMServiceRequest_GetReport{GetReport: &pb.GetReportRequest{}},
+	}
+
+	resp := sendAndReceive(t, handler, req)
+	assert.NotNil(t, resp.GetGetReport())
+}
diff --git a/compliance/virtualmachines/roxagent/vsockserver/sensor_updater.go b/compliance/virtualmachines/roxagent/vsockserver/sensor_updater.go
new file mode 100644
index 0000000000000..d3fc73c20b2f6
--- /dev/null
+++ b/compliance/virtualmachines/roxagent/vsockserver/sensor_updater.go
@@ -0,0 +1,232 @@
+package vsockserver
+
+import (
+	"bytes"
+	"errors"
+	"os"
+
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/filedownloader"
+	"github.com/stackrox/rox/pkg/sync"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
+)
+
+var (
+	_ MappingProvider = (*SensorUpdater)(nil)
+	_ MappingUpdater  = (*SensorUpdater)(nil)
+	_ ScanBusyGate    = (*SensorUpdater)(nil)
+)
+
+var errSensorMappingNotReady = errors.New("no repo-to-CPE mapping available yet")
+
+// SensorUpdater applies repo-to-CPE mappings pushed over VSOCK. A Sync
+// during a scan is deferred so it cannot replace the file that scan is
+// reading.
+type SensorUpdater struct {
+	active     []byte
+	activeHash string
+	cachePath  string
+	pending    []byte
+	busy       bool
+	onChange   func()
+	mu         sync.Mutex
+	// persistMu serializes cachePath writes. persistActive is the only
+	// acquirer; it takes persistMu, then mu, never the reverse.
+	persistMu sync.Mutex
+	// persistWG tracks persistAndNotify's background writes so tests can
+	// drain them before TempDir cleanup.
+	persistWG sync.WaitGroup
+}
+
+// NewSensorUpdater seeds active from cachePath, else bundledPath, else
+// stays empty until the first Update. Construct onChange's dependents
+// (e.g. the rescanner) first, since it may fire during this call.
+func NewSensorUpdater(cachePath, bundledPath string, onChange func()) *SensorUpdater {
+	u := &SensorUpdater{cachePath: cachePath, onChange: onChange}
+	if u.bootstrapFrom(cachePath) || u.bootstrapFrom(bundledPath) {
+		if onChange != nil {
+			onChange()
+		}
+	}
+	return u
+}
+
+// bootstrapFrom seeds active/activeHash from path if it decodes as a valid
+// mapping. A no-op for an empty path, so the optional bundled seed can be
+// skipped by passing "". Reports whether it seeded active.
+func (u *SensorUpdater) bootstrapFrom(path string) bool {
+	if path == "" {
+		return false
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		// First boot always misses cache; do not treat that as an error.
+		if !errors.Is(err, os.ErrNotExist) {
+			log.Warnf("Reading repo-to-CPE mapping at %q: %v", path, err)
+		}
+		return false
+	}
+	if err := cpemapping.ValidateMapping(content); err != nil {
+		log.Warnf("Ignoring invalid repo-to-CPE mapping at %q: %v", path, err)
+		return false
+	}
+	u.active = content
+	u.activeHash = cpemapping.HashMapping(content)
+	return true
+}
+
+// Ready reports whether a validated mapping is currently active.
+func (u *SensorUpdater) Ready() bool {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return len(u.active) > 0
+}
+
+// Hash returns the active mapping's content hash, or "" if not Ready.
+func (u *SensorUpdater) Hash() string {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.activeHash
+}
+
+// UpdatePath reports this updater's mapping source for ResponseMeta.
+func (u *SensorUpdater) UpdatePath() pb.RepoCPEMappingUpdatePath {
+	return pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR
+}
+
+// Bytes returns a copy of the active mapping content.
+func (u *SensorUpdater) Bytes() ([]byte, error) {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	if len(u.active) == 0 {
+		return nil, errSensorMappingNotReady
+	}
+	out := make([]byte, len(u.active))
+	copy(out, u.active)
+	return out, nil
+}
+
+// Path returns cachePath after (re-)writing it with the active mapping, so
+// callers always get a file whose content matches Bytes() even if the
+// fire-and-forget persistence from the last apply has not landed yet.
+func (u *SensorUpdater) Path() (string, error) {
+	return u.persistActive()
+}
+
+// Update applies content to active immediately, or stages it as pending
+// for MarkScanIdleAndApplyPending to promote later if a scan is in
+// flight (busy), so it never mutates active out from under that scan.
+func (u *SensorUpdater) Update(content []byte) (updated bool, err error) {
+	if err := cpemapping.ValidateMapping(content); err != nil {
+		return false, err
+	}
+	// MappingUpdater retains content in active/pending and in the async
+	// cache write; clone so a caller reusing the buffer cannot desync
+	// those from activeHash.
+	content = bytes.Clone(content)
+	hash := cpemapping.HashMapping(content)
+
+	updated, deferred := concurrency.WithLock2(&u.mu, func() (bool, bool) {
+		if hash == u.activeHash {
+			// The newest push matches active, so it supersedes whatever
+			// an earlier, now-stale push staged as pending.
+			u.pending = nil
+			return false, false
+		}
+		if bytes.Equal(content, u.pending) {
+			return false, false
+		}
+		if u.busy {
+			u.pending = content
+			return true, true
+		}
+		u.applyLocked(content, hash)
+		return true, false
+	})
+	if !updated {
+		log.Debugf("SyncRepoCPEMapping: mapping unchanged (hash=%s)", hash)
+		return false, nil
+	}
+	if deferred {
+		log.Infof("SyncRepoCPEMapping: deferring apply of mapping (hash=%s) until the in-flight scan finishes", hash)
+		return true, nil
+	}
+	log.Infof("SyncRepoCPEMapping: applied mapping (hash=%s)", hash)
+	u.persistAndNotify()
+	return true, nil
+}
+
+// MarkScanBusy sets busy=true so a mapping-Sync during this scan is saved into pending instead of replacing the mapping.
+// Replacing the mapping could cause race between the scan reading that mapping and the Sync writing it.
+func (u *SensorUpdater) MarkScanBusy() {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	u.busy = true
+}
+
+// MarkScanIdleAndApplyPending applies a mapping that arrived during the scan, now that the scan is no longer reading the file.
+func (u *SensorUpdater) MarkScanIdleAndApplyPending() {
+	pending := concurrency.WithLock1(&u.mu, func() []byte {
+		u.busy = false
+		pending := u.pending
+		if pending == nil {
+			return nil
+		}
+		u.pending = nil
+		u.applyLocked(pending, cpemapping.HashMapping(pending))
+		return pending
+	})
+	if pending != nil {
+		log.Infof("Applying deferred mapping (hash=%s)", cpemapping.HashMapping(pending))
+		u.persistAndNotify()
+	}
+}
+
+// applyLocked sets active/activeHash to content/hash. Caller must hold mu.
+func (u *SensorUpdater) applyLocked(content []byte, hash string) {
+	u.active = content
+	u.activeHash = hash
+}
+
+// persistAndNotify fires onChange now and persists cachePath in the
+// background. Path is the write barrier if the file is needed before
+// that goroutine finishes.
+func (u *SensorUpdater) persistAndNotify() {
+	u.persistWG.Go(func() {
+		if _, err := u.persistActive(); err != nil {
+			log.Warnf("Persisting repo-to-CPE mapping cache to %q: %v", u.cachePath, err)
+		}
+	})
+	if u.onChange != nil {
+		u.onChange()
+	}
+}
+
+// WaitPersist blocks until every persistAndNotify goroutine has finished
+// writing cachePath. Tests register it with t.Cleanup so TempDir removal
+// cannot race AtomicWriteFile's sibling .tmp files.
+func (u *SensorUpdater) WaitPersist() {
+	u.persistWG.Wait()
+}
+
+// persistActive writes a copy of the current active mapping to cachePath.
+// It takes persistMu, then mu, so a late persist cannot overwrite the
+// file with a superseded mapping.
+func (u *SensorUpdater) persistActive() (string, error) {
+	return concurrency.WithLock2(&u.persistMu, func() (string, error) {
+		active, cachePath := concurrency.WithLock2(&u.mu, func() ([]byte, string) {
+			if len(u.active) == 0 {
+				return nil, u.cachePath
+			}
+			return bytes.Clone(u.active), u.cachePath
+		})
+		if len(active) == 0 {
+			return "", errSensorMappingNotReady
+		}
+		if err := filedownloader.AtomicWriteFile(cachePath, active); err != nil {
+			return "", err
+		}
+		return cachePath, nil
+	})
+}
diff --git a/compliance/virtualmachines/roxagent/vsockserver/sensor_updater_test.go b/compliance/virtualmachines/roxagent/vsockserver/sensor_updater_test.go
new file mode 100644
index 0000000000000..c58a2e803f8c4
--- /dev/null
+++ b/compliance/virtualmachines/roxagent/vsockserver/sensor_updater_test.go
@@ -0,0 +1,310 @@
+package vsockserver
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const validMappingJSON = `{"data":{"rhel-8-server-rpms":{"cpes":["cpe:/o:redhat:enterprise_linux:8"]}}}`
+const otherValidMappingJSON = `{"data":{"rhel-9-server-rpms":{"cpes":["cpe:/o:redhat:enterprise_linux:9"]}}}`
+const invalidMappingJSON = `{not json`
+
+// onChangeCounter is a test double for a MappingProvider's onChange
+// callback that records how many times it fired.
+type onChangeCounter struct {
+	count int
+}
+
+func (c *onChangeCounter) fn() { c.count++ }
+
+func writeFile(t *testing.T, path, content string) {
+	t.Helper()
+	require.NoError(t, os.WriteFile(path, []byte(content), 0600))
+}
+
+func newSensorUpdater(t *testing.T, cachePath, bundledPath string, onChange func()) *SensorUpdater {
+	t.Helper()
+	u := NewSensorUpdater(cachePath, bundledPath, onChange)
+	t.Cleanup(u.WaitPersist)
+	return u
+}
+
+// waitForCacheContent drains persistAndNotify's background write, then
+// checks cachePath, so the assertion cannot race AtomicWriteFile.
+func waitForCacheContent(t *testing.T, u *SensorUpdater, cachePath, want string) {
+	t.Helper()
+	u.WaitPersist()
+	b, err := os.ReadFile(cachePath)
+	require.NoError(t, err)
+	assert.Equal(t, want, string(b), "expected %q to be persisted to %s", want, cachePath)
+}
+
+func TestNewSensorUpdater_EmptyStart_NotReady(t *testing.T) {
+	dir := t.TempDir()
+	counter := &onChangeCounter{}
+
+	u := newSensorUpdater(t, filepath.Join(dir, "cache.json"), "", counter.fn)
+
+	assert.False(t, u.Ready())
+	assert.Empty(t, u.Hash())
+	assert.Equal(t, 0, counter.count)
+
+	_, err := u.Bytes()
+	assert.Error(t, err)
+	_, err = u.Path()
+	assert.Error(t, err)
+}
+
+func TestNewSensorUpdater_BootstrapFromCache(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	writeFile(t, cachePath, validMappingJSON)
+	counter := &onChangeCounter{}
+
+	u := newSensorUpdater(t, cachePath, "", counter.fn)
+
+	require.True(t, u.Ready())
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	b, err := u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(b))
+	assert.Equal(t, 1, counter.count, "onChange should fire once for a valid bootstrap")
+}
+
+func TestNewSensorUpdater_BootstrapFromBundled_WhenNoCache(t *testing.T) {
+	dir := t.TempDir()
+	bundledPath := filepath.Join(dir, "bundled.json")
+	writeFile(t, bundledPath, validMappingJSON)
+	counter := &onChangeCounter{}
+
+	u := newSensorUpdater(t, filepath.Join(dir, "cache.json"), bundledPath, counter.fn)
+
+	require.True(t, u.Ready())
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	assert.Equal(t, 1, counter.count)
+}
+
+func TestNewSensorUpdater_CacheTakesPrecedenceOverBundled(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	bundledPath := filepath.Join(dir, "bundled.json")
+	writeFile(t, cachePath, validMappingJSON)
+	writeFile(t, bundledPath, otherValidMappingJSON)
+
+	u := newSensorUpdater(t, cachePath, bundledPath, func() {})
+
+	b, err := u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(b), "a valid cache must win over a valid bundled file")
+}
+
+func TestNewSensorUpdater_InvalidCacheFallsBackToBundled(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	bundledPath := filepath.Join(dir, "bundled.json")
+	writeFile(t, cachePath, invalidMappingJSON)
+	writeFile(t, bundledPath, validMappingJSON)
+
+	u := newSensorUpdater(t, cachePath, bundledPath, func() {})
+
+	require.True(t, u.Ready())
+	b, err := u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(b))
+}
+
+func TestNewSensorUpdater_InvalidCacheNoBundled_NotReady(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	writeFile(t, cachePath, invalidMappingJSON)
+	counter := &onChangeCounter{}
+
+	u := newSensorUpdater(t, cachePath, "", counter.fn)
+
+	assert.False(t, u.Ready())
+	assert.Equal(t, 0, counter.count)
+}
+
+func TestSensorUpdater_Update_OwnsContent(t *testing.T) {
+	cachePath := filepath.Join(t.TempDir(), "cache.json")
+	u := newSensorUpdater(t, cachePath, "", func() {})
+	content := []byte(validMappingJSON)
+
+	updated, err := u.Update(content)
+	require.NoError(t, err)
+	require.True(t, updated)
+	content[0] ^= 0xff
+
+	b, err := u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(b), "mutating the caller's buffer must not change the active mapping")
+	waitForCacheContent(t, u, cachePath, validMappingJSON)
+}
+
+func TestSensorUpdater_Path_WritesCurrentActive(t *testing.T) {
+	cachePath := filepath.Join(t.TempDir(), "cache.json")
+	u := newSensorUpdater(t, cachePath, "", func() {})
+	_, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	_, err = u.Update([]byte(otherValidMappingJSON))
+	require.NoError(t, err)
+
+	path, err := u.Path()
+	require.NoError(t, err)
+	onDisk, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, otherValidMappingJSON, string(onDisk),
+		"Path must persist the current active mapping, not an in-flight older write")
+	waitForCacheContent(t, u, cachePath, otherValidMappingJSON)
+}
+
+func TestSensorUpdater_Update_AppliesWhenIdle(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	counter := &onChangeCounter{}
+	u := newSensorUpdater(t, cachePath, "", counter.fn)
+
+	updated, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	assert.True(t, updated)
+	assert.True(t, u.Ready())
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	assert.Equal(t, 1, counter.count)
+	waitForCacheContent(t, u, cachePath, validMappingJSON)
+}
+
+func TestSensorUpdater_Update_NoOpWhenUnchanged(t *testing.T) {
+	cachePath := filepath.Join(t.TempDir(), "cache.json")
+	u := newSensorUpdater(t, cachePath, "", func() {})
+	_, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	waitForCacheContent(t, u, cachePath, validMappingJSON)
+
+	updated, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	assert.False(t, updated, "re-applying identical content must be a no-op")
+}
+
+func TestSensorUpdater_Update_RejectsInvalidKeepsLastGood(t *testing.T) {
+	cachePath := filepath.Join(t.TempDir(), "cache.json")
+	u := newSensorUpdater(t, cachePath, "", func() {})
+	_, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	wantHash := u.Hash()
+	waitForCacheContent(t, u, cachePath, validMappingJSON)
+
+	updated, err := u.Update([]byte(invalidMappingJSON))
+	assert.Error(t, err)
+	assert.False(t, updated)
+	assert.Equal(t, wantHash, u.Hash(), "invalid content must not replace the last-good mapping")
+}
+
+func TestSensorUpdater_Update_OversizeRejected(t *testing.T) {
+	u := newSensorUpdater(t, filepath.Join(t.TempDir(), "cache.json"), "", func() {})
+	oversized := make([]byte, cpemapping.MaxMappingBytes+1)
+
+	updated, err := u.Update(oversized)
+	assert.Error(t, err)
+	assert.False(t, updated)
+	assert.False(t, u.Ready())
+}
+
+func TestSensorUpdater_UpdateWhileBusy_DefersUntilIdle(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	counter := &onChangeCounter{}
+	u := newSensorUpdater(t, cachePath, "", counter.fn)
+	_, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	require.Equal(t, 1, counter.count)
+	idleHash := u.Hash()
+	idleBytes, err := u.Bytes()
+	require.NoError(t, err)
+
+	u.MarkScanBusy()
+
+	updated, err := u.Update([]byte(otherValidMappingJSON))
+	require.NoError(t, err)
+	assert.True(t, updated, "a genuinely new candidate is reported as updated even while deferred")
+
+	// While busy, active content (and therefore Hash/Bytes) must not change:
+	// an in-flight scan may still be reading these values.
+	assert.Equal(t, idleHash, u.Hash())
+	b, err := u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, idleBytes, b)
+	assert.Equal(t, 1, counter.count, "onChange must not fire for a deferred apply")
+
+	u.MarkScanIdleAndApplyPending()
+
+	assert.Equal(t, cpemapping.HashMapping([]byte(otherValidMappingJSON)), u.Hash())
+	b, err = u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, otherValidMappingJSON, string(b))
+	assert.Equal(t, 2, counter.count, "onChange must fire once the pending mapping is promoted")
+	waitForCacheContent(t, u, cachePath, otherValidMappingJSON)
+}
+
+func TestSensorUpdater_UpdateWhileBusy_SameAsPending_NoOp(t *testing.T) {
+	u := newSensorUpdater(t, filepath.Join(t.TempDir(), "cache.json"), "", func() {})
+	u.MarkScanBusy()
+
+	updated, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	assert.True(t, updated)
+
+	updated, err = u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	assert.False(t, updated, "re-staging identical pending content must be a no-op")
+}
+
+// TestSensorUpdater_UpdateWhileBusy_RevertToActive_ClearsStalePending covers
+// a revert push landing after a newer one was already staged: Sensor pushes
+// are ordered, so the newest push (matching active) must win, not the
+// earlier, now-stale pending content.
+func TestSensorUpdater_UpdateWhileBusy_RevertToActive_ClearsStalePending(t *testing.T) {
+	u := newSensorUpdater(t, filepath.Join(t.TempDir(), "cache.json"), "", func() {})
+	_, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	u.MarkScanBusy()
+
+	updated, err := u.Update([]byte(otherValidMappingJSON))
+	require.NoError(t, err)
+	require.True(t, updated)
+
+	updated, err = u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	assert.False(t, updated, "reverting to the already-active content is not itself an update")
+
+	u.MarkScanIdleAndApplyPending()
+
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash(),
+		"the newest push (matching active) must win over the stale pending mapping")
+}
+
+func TestSensorUpdater_MarkScanIdleAndApplyPending_NoPending_NoOp(t *testing.T) {
+	cachePath := filepath.Join(t.TempDir(), "cache.json")
+	counter := &onChangeCounter{}
+	u := newSensorUpdater(t, cachePath, "", counter.fn)
+	_, err := u.Update([]byte(validMappingJSON))
+	require.NoError(t, err)
+	require.Equal(t, 1, counter.count)
+	waitForCacheContent(t, u, cachePath, validMappingJSON)
+
+	u.MarkScanBusy()
+	u.MarkScanIdleAndApplyPending()
+
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	assert.Equal(t, 1, counter.count, "onChange must not fire when there is nothing pending to apply")
+}
+
+func TestSensorUpdater_UpdatePath_IsSensor(t *testing.T) {
+	u := newSensorUpdater(t, filepath.Join(t.TempDir(), "cache.json"), "", func() {})
+	assert.Equal(t, pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR, u.UpdatePath())
+}
diff --git a/compliance/virtualmachines/roxagent/vsockserver/server_test.go b/compliance/virtualmachines/roxagent/vsockserver/server_test.go
index 7cf5c2372eb9a..509a84362829a 100644
--- a/compliance/virtualmachines/roxagent/vsockserver/server_test.go
+++ b/compliance/virtualmachines/roxagent/vsockserver/server_test.go
@@ -19,7 +19,7 @@ import (
 // rejects a second connection with an ERROR_CODE_BUSY response while the first
 // is still being handled, and that cancelling the context drains gracefully.
 func TestServeAcceptLoop(t *testing.T) {
-	handler := NewHandler(&ReportCache{}, "test")
+	handler := NewHandler(&ReportCache{}, "test", readyProvider(), nil)
 	srv := NewServer(handler, nil)
 
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
@@ -77,7 +77,7 @@ func TestRejectConn(t *testing.T) {
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
 			synctest.Test(t, func(t *testing.T) {
-				handler := NewHandler(&ReportCache{}, "test")
+				handler := NewHandler(&ReportCache{}, "test", readyProvider(), nil)
 				srv := NewServer(handler, nil)
 
 				serverConn, clientConn := net.Pipe()
@@ -133,7 +133,7 @@ func TestRejectConn(t *testing.T) {
 // ERROR_CODE_BUSY. That is enough to prove Accept() kept running: a blocked
 // accept loop would never handshake the second peer or write BUSY.
 func TestServeAcceptLoop_StalledHandshakeDoesNotBlockOtherConnections(t *testing.T) {
-	handler := NewHandler(&ReportCache{}, "test")
+	handler := NewHandler(&ReportCache{}, "test", readyProvider(), nil)
 	srv := NewServer(handler, &tls.Config{Certificates: []tls.Certificate{testServerCert(t)}})
 
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
diff --git a/compliance/virtualmachines/roxagent/vsockserver/url_updater.go b/compliance/virtualmachines/roxagent/vsockserver/url_updater.go
new file mode 100644
index 0000000000000..3178bed180def
--- /dev/null
+++ b/compliance/virtualmachines/roxagent/vsockserver/url_updater.go
@@ -0,0 +1,174 @@
+package vsockserver
+
+import (
+	"context"
+	"errors"
+	"os"
+	"time"
+
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/filedownloader"
+	"github.com/stackrox/rox/pkg/sync"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
+)
+
+// Retry/refresh policy for the periodic mapping download. WaitMin=5s with
+// retryablehttp's default WaitMax=30s covers four HTTP attempts (5+10+20=35s)
+// within urlMappingClientTimeout.
+const (
+	urlMappingFetchRetryMax     = 3
+	urlMappingFetchRetryWaitMin = 5 * time.Second
+	urlMappingClientTimeout     = 2 * time.Minute
+	urlMappingRefreshInterval   = time.Hour
+	// urlMappingStagingSuffix names the path the downloader writes to.
+	// onDownloadComplete only promotes a staged download to cachePath
+	// once it passes validation, so a bad fetch can never corrupt the
+	// persisted last-good mapping.
+	urlMappingStagingSuffix = ".download"
+)
+
+var _ MappingProvider = (*URLUpdater)(nil)
+
+var errURLMappingNotReady = errors.New("no repo-to-CPE mapping available yet")
+
+// URLUpdater is the MappingProvider for an agent configured with a
+// mapping URL; this mapping source never accepts a Sensor-pushed Update.
+type URLUpdater struct {
+	downloader  *filedownloader.Downloader
+	cachePath   string
+	stagingPath string
+	active      []byte
+	activeHash  string
+	onChange    func()
+	mu          sync.Mutex
+}
+
+// NewURLUpdater seeds active from cachePath (last-good from a prior
+// successful download), else stays empty until the first fetch. Bundled
+// image content is not used: a never-working URL would look configured.
+func NewURLUpdater(url, cachePath string, onChange func()) *URLUpdater {
+	u := &URLUpdater{cachePath: cachePath, stagingPath: cachePath + urlMappingStagingSuffix, onChange: onChange}
+	if u.bootstrap() && onChange != nil {
+		onChange()
+	}
+	u.downloader = filedownloader.New(url, u.stagingPath, urlMappingRefreshInterval,
+		filedownloader.WithRequestTimeout(urlMappingClientTimeout),
+		filedownloader.WithRetryMax(urlMappingFetchRetryMax),
+		filedownloader.WithRetryWaitMin(urlMappingFetchRetryWaitMin),
+		filedownloader.WithOnComplete(u.onDownloadComplete),
+	)
+	return u
+}
+
+// bootstrap seeds active/activeHash from cachePath if it decodes as a
+// valid mapping. Reports whether it seeded active.
+func (u *URLUpdater) bootstrap() bool {
+	content, err := os.ReadFile(u.cachePath)
+	if err != nil {
+		// First boot always misses cache; do not treat that as an error.
+		if !errors.Is(err, os.ErrNotExist) {
+			log.Warnf("Reading repo-to-CPE mapping cache at %q: %v", u.cachePath, err)
+		}
+		return false
+	}
+	if err := cpemapping.ValidateMapping(content); err != nil {
+		log.Warnf("Ignoring invalid repo-to-CPE mapping cache at %q: %v", u.cachePath, err)
+		return false
+	}
+	u.active = content
+	u.activeHash = cpemapping.HashMapping(content)
+	return true
+}
+
+// Start begins the periodic download loop in the background; agent
+// startup never blocks on a successful fetch.
+func (u *URLUpdater) Start(ctx context.Context) error {
+	return u.downloader.Start(ctx, false)
+}
+
+// Stop signals the download loop to stop and blocks until it exits.
+func (u *URLUpdater) Stop() {
+	u.downloader.Stop()
+}
+
+// Ready reports whether a validated mapping is currently active.
+func (u *URLUpdater) Ready() bool {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return len(u.active) > 0
+}
+
+// Hash returns the active mapping's content hash, or "" if not Ready.
+func (u *URLUpdater) Hash() string {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.activeHash
+}
+
+// UpdatePath reports this updater's mapping source for ResponseMeta.
+func (u *URLUpdater) UpdatePath() pb.RepoCPEMappingUpdatePath {
+	return pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL
+}
+
+// Bytes returns a copy of the active mapping content.
+func (u *URLUpdater) Bytes() ([]byte, error) {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	if len(u.active) == 0 {
+		return nil, errURLMappingNotReady
+	}
+	out := make([]byte, len(u.active))
+	copy(out, u.active)
+	return out, nil
+}
+
+// Path returns cachePath. onDownloadComplete only sets active after a
+// validated download has been persisted there, so the file matches Bytes().
+func (u *URLUpdater) Path() (string, error) {
+	ready := concurrency.WithLock1(&u.mu, func() bool {
+		return len(u.active) > 0
+	})
+	if !ready {
+		return "", errURLMappingNotReady
+	}
+	return u.cachePath, nil
+}
+
+// onDownloadComplete applies a staged download only after it validates
+// and persists to cachePath, so Bytes() and Path() stay aligned and a
+// failed persist is retried on the next identical fetch.
+func (u *URLUpdater) onDownloadComplete(err error, _ time.Duration) {
+	if err != nil {
+		log.Warnf("Error downloading repo-to-CPE mapping: %v", err)
+		return
+	}
+	content, err := os.ReadFile(u.stagingPath)
+	if err != nil {
+		log.Warnf("Reading downloaded repo-to-CPE mapping at %q: %v", u.stagingPath, err)
+		return
+	}
+	if err := cpemapping.ValidateMapping(content); err != nil {
+		log.Warnf("Downloaded repo-to-CPE mapping failed validation, keeping last-good: %v", err)
+		return
+	}
+	hash := cpemapping.HashMapping(content)
+
+	alreadyActive := concurrency.WithLock1(&u.mu, func() bool {
+		return hash == u.activeHash
+	})
+	if alreadyActive {
+		return
+	}
+	if err := filedownloader.AtomicWriteFile(u.cachePath, content); err != nil {
+		log.Warnf("Persisting repo-to-CPE mapping cache to %q: %v", u.cachePath, err)
+		return
+	}
+	concurrency.WithLock(&u.mu, func() {
+		u.active = content
+		u.activeHash = hash
+	})
+	if u.onChange != nil {
+		u.onChange()
+	}
+}
diff --git a/compliance/virtualmachines/roxagent/vsockserver/url_updater_test.go b/compliance/virtualmachines/roxagent/vsockserver/url_updater_test.go
new file mode 100644
index 0000000000000..cabcff82cfbbc
--- /dev/null
+++ b/compliance/virtualmachines/roxagent/vsockserver/url_updater_test.go
@@ -0,0 +1,223 @@
+package vsockserver
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// dummyMappingURL is never dialed in these tests: NewURLUpdater's
+// constructor only builds the filedownloader.Downloader, and the actual
+// fetch is exercised indirectly via onDownloadComplete.
+const dummyMappingURL = "http://127.0.0.1:0/mapping.json"
+
+func TestNewURLUpdater_BootstrapFromCache(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	writeFile(t, cachePath, validMappingJSON)
+	counter := &onChangeCounter{}
+
+	u := NewURLUpdater(dummyMappingURL, cachePath, counter.fn)
+
+	require.True(t, u.Ready())
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	b, err := u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(b))
+	path, err := u.Path()
+	require.NoError(t, err)
+	assert.Equal(t, cachePath, path)
+	assert.Equal(t, 1, counter.count, "onChange should fire once for a valid bootstrap")
+}
+
+func TestNewURLUpdater_NotReadyWithoutCache(t *testing.T) {
+	dir := t.TempDir()
+	counter := &onChangeCounter{}
+
+	u := NewURLUpdater(dummyMappingURL, filepath.Join(dir, "cache.json"), counter.fn)
+
+	assert.False(t, u.Ready())
+	assert.Empty(t, u.Hash())
+	assert.Equal(t, 0, counter.count)
+	_, err := u.Bytes()
+	assert.Error(t, err)
+	_, err = u.Path()
+	assert.Error(t, err)
+}
+
+func TestNewURLUpdater_InvalidCacheStaysNotReady_NoBundledFallback(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	writeFile(t, cachePath, invalidMappingJSON)
+	counter := &onChangeCounter{}
+
+	// Cache is last-good from a successful URL fetch. An invalid cache
+	// must leave the updater not Ready, not seed from anything else.
+	u := NewURLUpdater(dummyMappingURL, cachePath, counter.fn)
+
+	assert.False(t, u.Ready())
+	assert.Equal(t, 0, counter.count)
+}
+
+func TestURLUpdater_UpdatePath_IsURL(t *testing.T) {
+	u := NewURLUpdater(dummyMappingURL, filepath.Join(t.TempDir(), "cache.json"), func() {})
+	assert.Equal(t, pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL, u.UpdatePath())
+}
+
+func TestURLUpdater_FailedDownload_StaysNotReady(t *testing.T) {
+	counter := &onChangeCounter{}
+	u := NewURLUpdater(dummyMappingURL, filepath.Join(t.TempDir(), "cache.json"), counter.fn)
+
+	u.onDownloadComplete(errors.New("connection refused"), 0)
+
+	assert.False(t, u.Ready())
+	assert.Equal(t, 0, counter.count)
+}
+
+func TestURLUpdater_FailedDownload_KeepsLastGood(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	writeFile(t, cachePath, validMappingJSON)
+	counter := &onChangeCounter{}
+	u := NewURLUpdater(dummyMappingURL, cachePath, counter.fn)
+	require.True(t, u.Ready())
+	require.Equal(t, 1, counter.count)
+
+	u.onDownloadComplete(errors.New("connection refused"), 0)
+
+	assert.True(t, u.Ready())
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	assert.Equal(t, 1, counter.count, "onChange must not re-fire when a failed refresh keeps the same content")
+}
+
+func TestURLUpdater_SuccessfulDownload_AppliesNewContent(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	counter := &onChangeCounter{}
+	u := NewURLUpdater(dummyMappingURL, cachePath, counter.fn)
+	require.False(t, u.Ready())
+
+	// Simulate what filedownloader's atomic write already did before
+	// invoking onComplete: the new content is on disk at stagingPath.
+	writeFile(t, u.stagingPath, validMappingJSON)
+	u.onDownloadComplete(nil, 0)
+
+	require.True(t, u.Ready())
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	b, err := u.Bytes()
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(b))
+	assert.Equal(t, 1, counter.count)
+
+	onDisk, err := os.ReadFile(cachePath)
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(onDisk), "a validated download must be promoted to cachePath")
+}
+
+// TestURLUpdater_PersistFailure_DoesNotActivate covers a validated
+// download whose cache promotion fails: active stays unchanged so Path()
+// still matches Bytes(), and a later identical fetch retries the persist.
+func TestURLUpdater_PersistFailure_DoesNotActivate(t *testing.T) {
+	dir := t.TempDir()
+	cacheDir := filepath.Join(dir, "cache")
+	require.NoError(t, os.Mkdir(cacheDir, 0700))
+	cachePath := filepath.Join(cacheDir, "cache.json")
+	counter := &onChangeCounter{}
+	u := NewURLUpdater(dummyMappingURL, cachePath, counter.fn)
+	writeFile(t, u.stagingPath, validMappingJSON)
+
+	require.NoError(t, os.Chmod(cacheDir, 0500))
+	t.Cleanup(func() { _ = os.Chmod(cacheDir, 0700) })
+
+	u.onDownloadComplete(nil, 0)
+
+	assert.False(t, u.Ready(), "a failed persist must not expose the new mapping as active")
+	assert.Equal(t, 0, counter.count)
+	_, err := os.Stat(cachePath)
+	assert.Error(t, err, "cachePath must not exist after a failed persist")
+
+	require.NoError(t, os.Chmod(cacheDir, 0700))
+	u.onDownloadComplete(nil, 0)
+
+	require.True(t, u.Ready(), "the next identical fetch must retry persist and then activate")
+	assert.Equal(t, 1, counter.count)
+	onDisk, err := os.ReadFile(cachePath)
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(onDisk))
+}
+
+func TestURLUpdater_PersistFailure_KeepsLastGoodThenRetries(t *testing.T) {
+	dir := t.TempDir()
+	cacheDir := filepath.Join(dir, "cache")
+	require.NoError(t, os.Mkdir(cacheDir, 0700))
+	cachePath := filepath.Join(cacheDir, "cache.json")
+	writeFile(t, cachePath, validMappingJSON)
+	counter := &onChangeCounter{}
+	u := NewURLUpdater(dummyMappingURL, cachePath, counter.fn)
+	require.Equal(t, 1, counter.count)
+	writeFile(t, u.stagingPath, otherValidMappingJSON)
+
+	require.NoError(t, os.Chmod(cacheDir, 0500))
+	t.Cleanup(func() { _ = os.Chmod(cacheDir, 0700) })
+
+	u.onDownloadComplete(nil, 0)
+
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash(),
+		"a failed persist must keep serving the last-good mapping")
+	assert.Equal(t, 1, counter.count)
+	onDisk, err := os.ReadFile(cachePath)
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(onDisk))
+
+	require.NoError(t, os.Chmod(cacheDir, 0700))
+	u.onDownloadComplete(nil, 0)
+
+	assert.Equal(t, cpemapping.HashMapping([]byte(otherValidMappingJSON)), u.Hash())
+	assert.Equal(t, 2, counter.count)
+	onDisk, err = os.ReadFile(cachePath)
+	require.NoError(t, err)
+	assert.Equal(t, otherValidMappingJSON, string(onDisk))
+}
+
+func TestURLUpdater_SuccessfulDownload_InvalidContentKeepsLastGood(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	writeFile(t, cachePath, validMappingJSON)
+	counter := &onChangeCounter{}
+	u := NewURLUpdater(dummyMappingURL, cachePath, counter.fn)
+	require.Equal(t, 1, counter.count)
+
+	writeFile(t, u.stagingPath, invalidMappingJSON)
+	u.onDownloadComplete(nil, 0)
+
+	assert.True(t, u.Ready())
+	assert.Equal(t, cpemapping.HashMapping([]byte(validMappingJSON)), u.Hash())
+	assert.Equal(t, 1, counter.count, "onChange must not fire when the refreshed content fails validation")
+}
+
+// TestURLUpdater_SuccessfulDownload_InvalidContentDoesNotCorruptCache covers
+// what TestURLUpdater_SuccessfulDownload_InvalidContentKeepsLastGood only
+// checks in memory: an invalid refresh must leave the persisted cachePath
+// itself untouched, since a restart bootstraps from that file, not memory.
+func TestURLUpdater_SuccessfulDownload_InvalidContentDoesNotCorruptCache(t *testing.T) {
+	dir := t.TempDir()
+	cachePath := filepath.Join(dir, "cache.json")
+	writeFile(t, cachePath, validMappingJSON)
+	u := NewURLUpdater(dummyMappingURL, cachePath, func() {})
+
+	writeFile(t, u.stagingPath, invalidMappingJSON)
+	u.onDownloadComplete(nil, 0)
+
+	onDisk, err := os.ReadFile(cachePath)
+	require.NoError(t, err)
+	assert.Equal(t, validMappingJSON, string(onDisk), "an invalid refresh must not overwrite the persisted last-good cache")
+
+	restarted := NewURLUpdater(dummyMappingURL, cachePath, func() {})
+	assert.True(t, restarted.Ready(), "a restart must still bootstrap from the untouched cache")
+}
diff --git a/config-controller/api/v1alpha1/policy_types.go b/config-controller/api/v1alpha1/policy_types.go
index c21b47a620ea6..3563ae52b0f4c 100644
--- a/config-controller/api/v1alpha1/policy_types.go
+++ b/config-controller/api/v1alpha1/policy_types.go
@@ -90,15 +90,29 @@ type SecurityPolicySpec struct {
 	MitreVectorsLocked bool `json:"mitreVectorsLocked,omitempty"`
 }
 
+// +kubebuilder:validation:AtMostOneOf=deployment;excludeByKind
 type Exclusion struct {
-	Name       string     `json:"name,omitempty"`
-	Deployment Deployment `json:"deployment,omitempty"`
+	Name string `json:"name,omitempty"`
+	// +optional
+	Deployment Deployment `json:"deployment,omitzero"`
 	Image      Image      `json:"image,omitempty"`
 	// +optional
+	// ExcludeByKind excludes all workloads of the selected Kubernetes kinds.
+	ExcludeByKind *ExcludeByKind `json:"excludeByKind,omitempty"`
+	// +optional
 	// +kubebuilder:validation:Format="date-time"
 	Expiration string `json:"expiration,omitempty"`
 }
 
+// +kubebuilder:validation:Enum=CRON_JOB;JOB
+type WorkloadKind string
+
+type ExcludeByKind struct {
+	// +kubebuilder:validation:MinItems=1
+	// Kinds is the list of Kubernetes workload kinds to exclude.
+	Kinds []WorkloadKind `json:"kinds"`
+}
+
 type Deployment struct {
 	Name  string `json:"name,omitempty"`
 	Scope Scope  `json:"scope,omitempty"`
@@ -152,10 +166,14 @@ type MitreAttackVectors struct {
 	Techniques []string `json:"techniques,omitempty"`
 }
 
+// ContainerType lists container kinds a policy may skip during evaluation.
 // +kubebuilder:validation:Enum=REGULAR;INIT
 type ContainerType string
 
+// EvaluationFilter pre-filters which entities a policy evaluates.
 type EvaluationFilter struct {
+	// SkipContainerTypes lists container kinds to skip during evaluation.
+	// +optional
 	SkipContainerTypes []ContainerType `json:"skipContainerTypes,omitempty"`
 }
 
@@ -296,14 +314,18 @@ func (p SecurityPolicySpec) ToProtobuf(caches map[CacheType]map[string]string) (
 			protoExclusion.Expiration = protoTS
 		}
 
+		if exclusion.Deployment != (Deployment{}) && exclusion.ExcludeByKind != nil {
+			return nil, errors.New("exclusion cannot set both 'deployment' and 'excludeByKind'")
+		}
+
 		if exclusion.Deployment != (Deployment{}) {
-			protoExclusion.Deployment = &storage.Exclusion_Deployment{
+			dep := &storage.Exclusion_Deployment{
 				Name: exclusion.Deployment.Name,
 			}
 
 			scope := exclusion.Deployment.Scope
 			if scope != (Scope{}) {
-				protoExclusion.Deployment.Scope = &storage.Scope{
+				dep.Scope = &storage.Scope{
 					Namespace: scope.Namespace,
 				}
 				if scope.Cluster != "" {
@@ -311,31 +333,53 @@ func (p SecurityPolicySpec) ToProtobuf(caches map[CacheType]map[string]string) (
 					if err != nil {
 						return nil, errors.New(fmt.Sprintf("Cluster '%s' does not exist", scope.Cluster))
 					}
-					protoExclusion.Deployment.Scope.Cluster = clusterID
+					dep.Scope.Cluster = clusterID
 				}
 			}
 
 			if scope.Label != (Label{}) {
-				protoExclusion.Deployment.Scope.Label = &storage.Scope_Label{
+				dep.Scope.Label = &storage.Scope_Label{
 					Key:   scope.Label.Key,
 					Value: scope.Label.Value,
 				}
 			}
 
 			if scope.ClusterLabel != (Label{}) {
-				protoExclusion.Deployment.Scope.ClusterLabel = &storage.Scope_Label{
+				dep.Scope.ClusterLabel = &storage.Scope_Label{
 					Key:   scope.ClusterLabel.Key,
 					Value: scope.ClusterLabel.Value,
 				}
 			}
 
 			if scope.NamespaceLabel != (Label{}) {
-				protoExclusion.Deployment.Scope.NamespaceLabel = &storage.Scope_Label{
+				dep.Scope.NamespaceLabel = &storage.Scope_Label{
 					Key:   scope.NamespaceLabel.Key,
 					Value: scope.NamespaceLabel.Value,
 				}
 			}
 
+			protoExclusion.Matcher = &storage.Exclusion_Deployment_{
+				Deployment: dep,
+			}
+		}
+
+		if exclusion.ExcludeByKind != nil {
+			if len(exclusion.ExcludeByKind.Kinds) == 0 {
+				return nil, errors.New("excludeByKind must specify at least one workload kind")
+			}
+			kinds := make([]storage.Exclusion_WorkloadKind, 0, len(exclusion.ExcludeByKind.Kinds))
+			for _, kind := range exclusion.ExcludeByKind.Kinds {
+				val, found := storage.Exclusion_WorkloadKind_value[string(kind)]
+				if !found || storage.Exclusion_WorkloadKind(val) == storage.Exclusion_WORKLOAD_KIND_UNSPECIFIED {
+					return nil, errors.Errorf("excludeByKind contains unknown workload kind %q", kind)
+				}
+				kinds = append(kinds, storage.Exclusion_WorkloadKind(val))
+			}
+			protoExclusion.Matcher = &storage.Exclusion_ExcludeByKind_{
+				ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+					Kinds: kinds,
+				},
+			}
 		}
 
 		proto.Exclusions = append(proto.Exclusions, &protoExclusion)
diff --git a/config-controller/api/v1alpha1/policy_types_test.go b/config-controller/api/v1alpha1/policy_types_test.go
index 2c69dabf34afd..2e95d9bb1e5a2 100644
--- a/config-controller/api/v1alpha1/policy_types_test.go
+++ b/config-controller/api/v1alpha1/policy_types_test.go
@@ -1,6 +1,7 @@
 package v1alpha1
 
 import (
+	"encoding/json"
 	"testing"
 
 	"github.com/stackrox/rox/generated/storage"
@@ -106,22 +107,24 @@ func TestToProtobuf(t *testing.T) {
 		Exclusions: []*storage.Exclusion{
 			{
 				Name: "Don't alert on deployment collector in namespace stackrox",
-				Deployment: &storage.Exclusion_Deployment{
-					Name: "collector",
-					Scope: &storage.Scope{
-						Namespace: "stackrox",
-						Cluster:   clusterID,
-						Label: &storage.Scope_Label{
-							Key:   "app",
-							Value: "collector",
-						},
-						ClusterLabel: &storage.Scope_Label{
-							Key:   "env",
-							Value: "dev",
-						},
-						NamespaceLabel: &storage.Scope_Label{
-							Key:   "team",
-							Value: "platform",
+				Matcher: &storage.Exclusion_Deployment_{
+					Deployment: &storage.Exclusion_Deployment{
+						Name: "collector",
+						Scope: &storage.Scope{
+							Namespace: "stackrox",
+							Cluster:   clusterID,
+							Label: &storage.Scope_Label{
+								Key:   "app",
+								Value: "collector",
+							},
+							ClusterLabel: &storage.Scope_Label{
+								Key:   "env",
+								Value: "dev",
+							},
+							NamespaceLabel: &storage.Scope_Label{
+								Key:   "team",
+								Value: "platform",
+							},
 						},
 					},
 				},
@@ -239,6 +242,14 @@ func TestToProtobufEvaluationFilter(t *testing.T) {
 			filter:        &EvaluationFilter{SkipContainerTypes: []ContainerType{"INIT"}},
 			expectedTypes: []storage.ContainerType{storage.ContainerType_INIT},
 		},
+		"skip regular containers": {
+			filter:        &EvaluationFilter{SkipContainerTypes: []ContainerType{"REGULAR"}},
+			expectedTypes: []storage.ContainerType{storage.ContainerType_REGULAR},
+		},
+		"skip both container types": {
+			filter:        &EvaluationFilter{SkipContainerTypes: []ContainerType{"REGULAR", "INIT"}},
+			expectedTypes: []storage.ContainerType{storage.ContainerType_REGULAR, storage.ContainerType_INIT},
+		},
 		"nil filter": {
 			filter:         nil,
 			expectNilProto: true,
@@ -279,3 +290,90 @@ func TestToProtobufEvaluationFilter(t *testing.T) {
 		})
 	}
 }
+
+func TestToProtobufRejectsDeploymentAndExcludeByKind(t *testing.T) {
+	spec := SecurityPolicySpec{
+		PolicyName:      "both-matchers",
+		Categories:      []string{"Security Best Practices"},
+		LifecycleStages: []LifecycleStage{"DEPLOY"},
+		Severity:        "LOW_SEVERITY",
+		Exclusions: []Exclusion{
+			{
+				Name: "invalid dual matcher",
+				Deployment: Deployment{
+					Name: "collector",
+				},
+				ExcludeByKind: &ExcludeByKind{
+					Kinds: []WorkloadKind{"JOB"},
+				},
+			},
+		},
+	}
+
+	_, err := spec.ToProtobuf(map[CacheType]map[string]string{
+		Notifier: {},
+		Cluster:  {},
+	})
+	assert.EqualError(t, err, "exclusion cannot set both 'deployment' and 'excludeByKind'")
+}
+
+func TestToProtobufExcludeByKind(t *testing.T) {
+	caches := map[CacheType]map[string]string{
+		Notifier: {},
+		Cluster:  {},
+	}
+	baseSpec := func(exclude *ExcludeByKind) SecurityPolicySpec {
+		return SecurityPolicySpec{
+			PolicyName:      "kind-exclusion",
+			Categories:      []string{"Security Best Practices"},
+			LifecycleStages: []LifecycleStage{"DEPLOY"},
+			Severity:        "LOW_SEVERITY",
+			Exclusions: []Exclusion{{
+				Name:          "by kind",
+				ExcludeByKind: exclude,
+			}},
+		}
+	}
+
+	t.Run("converts JOB and CRON_JOB", func(t *testing.T) {
+		proto, err := baseSpec(&ExcludeByKind{Kinds: []WorkloadKind{"JOB", "CRON_JOB"}}).ToProtobuf(caches)
+		assert.NoError(t, err)
+		assert.Equal(t, []storage.Exclusion_WorkloadKind{
+			storage.Exclusion_JOB,
+			storage.Exclusion_CRON_JOB,
+		}, proto.GetExclusions()[0].GetExcludeByKind().GetKinds())
+	})
+
+	t.Run("rejects empty kind list", func(t *testing.T) {
+		_, err := baseSpec(&ExcludeByKind{}).ToProtobuf(caches)
+		assert.EqualError(t, err, "excludeByKind must specify at least one workload kind")
+	})
+
+	t.Run("rejects unknown kind", func(t *testing.T) {
+		_, err := baseSpec(&ExcludeByKind{Kinds: []WorkloadKind{"CRONJOB"}}).ToProtobuf(caches)
+		assert.EqualError(t, err, `excludeByKind contains unknown workload kind "CRONJOB"`)
+	})
+
+	t.Run("rejects mixed valid and unknown kinds", func(t *testing.T) {
+		_, err := baseSpec(&ExcludeByKind{Kinds: []WorkloadKind{"JOB", "CRONJOB"}}).ToProtobuf(caches)
+		assert.EqualError(t, err, `excludeByKind contains unknown workload kind "CRONJOB"`)
+	})
+}
+
+func TestExclusionJSONOmitsZeroDeployment(t *testing.T) {
+	kindOnly, err := json.Marshal(Exclusion{
+		Name:          "skip jobs",
+		ExcludeByKind: &ExcludeByKind{Kinds: []WorkloadKind{"JOB"}},
+	})
+	assert.NoError(t, err)
+	assert.NotContains(t, string(kindOnly), `"deployment"`)
+	assert.Contains(t, string(kindOnly), `"excludeByKind"`)
+
+	withDeployment, err := json.Marshal(Exclusion{
+		Name:       "skip web",
+		Deployment: Deployment{Name: "web"},
+	})
+	assert.NoError(t, err)
+	assert.Contains(t, string(withDeployment), `"deployment"`)
+	assert.Contains(t, string(withDeployment), `"web"`)
+}
diff --git a/config-controller/api/v1alpha1/zz_generated.deepcopy.go b/config-controller/api/v1alpha1/zz_generated.deepcopy.go
index 89f899775ea59..93085d27ed0d5 100644
--- a/config-controller/api/v1alpha1/zz_generated.deepcopy.go
+++ b/config-controller/api/v1alpha1/zz_generated.deepcopy.go
@@ -60,11 +60,36 @@ func (in *EvaluationFilter) DeepCopy() *EvaluationFilter {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExcludeByKind) DeepCopyInto(out *ExcludeByKind) {
+	*out = *in
+	if in.Kinds != nil {
+		in, out := &in.Kinds, &out.Kinds
+		*out = make([]WorkloadKind, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExcludeByKind.
+func (in *ExcludeByKind) DeepCopy() *ExcludeByKind {
+	if in == nil {
+		return nil
+	}
+	out := new(ExcludeByKind)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Exclusion) DeepCopyInto(out *Exclusion) {
 	*out = *in
 	out.Deployment = in.Deployment
 	out.Image = in.Image
+	if in.ExcludeByKind != nil {
+		in, out := &in.ExcludeByKind, &out.ExcludeByKind
+		*out = new(ExcludeByKind)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Exclusion.
@@ -314,7 +339,9 @@ func (in *SecurityPolicySpec) DeepCopyInto(out *SecurityPolicySpec) {
 	if in.Exclusions != nil {
 		in, out := &in.Exclusions, &out.Exclusions
 		*out = make([]Exclusion, len(*in))
-		copy(*out, *in)
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
 	}
 	if in.Scope != nil {
 		in, out := &in.Scope, &out.Scope
diff --git a/config-controller/config/crd/bases/config.stackrox.io_securitypolicies.yaml b/config-controller/config/crd/bases/config.stackrox.io_securitypolicies.yaml
index 6329c0e2b6373..d3a1254eabdb2 100644
--- a/config-controller/config/crd/bases/config.stackrox.io_securitypolicies.yaml
+++ b/config-controller/config/crd/bases/config.stackrox.io_securitypolicies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.21.0
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: securitypolicies.config.stackrox.io
 spec:
   group: config.stackrox.io
@@ -82,7 +82,11 @@ spec:
                   evaluates.
                 properties:
                   skipContainerTypes:
+                    description: SkipContainerTypes lists container kinds to skip
+                      during evaluation.
                     items:
+                      description: ContainerType lists container kinds a policy may
+                        skip during evaluation.
                       enum:
                       - REGULAR
                       - INIT
@@ -138,6 +142,23 @@ spec:
                               type: object
                           type: object
                       type: object
+                    excludeByKind:
+                      description: ExcludeByKind excludes all workloads of the selected
+                        Kubernetes kinds.
+                      properties:
+                        kinds:
+                          description: Kinds is the list of Kubernetes workload kinds
+                            to exclude.
+                          items:
+                            enum:
+                            - CRON_JOB
+                            - JOB
+                            type: string
+                          minItems: 1
+                          type: array
+                      required:
+                      - kinds
+                      type: object
                     expiration:
                       format: date-time
                       type: string
@@ -149,6 +170,11 @@ spec:
                     name:
                       type: string
                   type: object
+                  x-kubernetes-validations:
+                  - message: at most one of the fields in [deployment excludeByKind]
+                      may be set
+                    rule: (has(self.deployment)?1:0)+(has(self.excludeByKind)?1:0)
+                      <= 1
                 type: array
               isDefault:
                 description: IsDefault is unused
diff --git a/deploy/README.md b/deploy/README.md
index 34cda08abfe6c..6f41a41b11f3a 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -24,8 +24,9 @@ Installation of roxie is straightforward:
    the hood.
 1. there is also a containerized version of roxie living at quay.io/rhacs-eng/roxie, which can be used ad-hoc.
 
-Furthermore, the `deploy/deploy.sh` shell script supports a roxie backend: set `USE_ROXIE_DEPLOY=true` in the
-environment and it will automatically download and run the roxie version specified in the `ROXIE_VERSION` file.
+Furthermore, the `deploy/deploy.sh` shell script uses a roxie backend by default. It will automatically
+download and run the roxie version specified in the `ROXIE_VERSION` file. To fall back to the legacy
+deploy flow, set `USE_ROXIE_DEPLOY=false` in the environment.
 
 Any extra arguments you pass to `deploy.sh` are forwarded directly to roxie,
 so you can use roxie CLI flags even with `deploy.sh`, e.g.:
@@ -34,8 +35,8 @@ so you can use roxie CLI flags even with `deploy.sh`, e.g.:
 ./deploy/deploy.sh --tag 4.11.0
 ```
 
-The roxie backend in `deploy.sh` is **opt-in** for now. Over time, we expect it to
-become opt-out, and eventually the legacy deployment scripts will be removed entirely.
+The roxie backend in `deploy.sh` is **opt-out**. Set `USE_ROXIE_DEPLOY=false` to fall
+back to the legacy flow. The legacy deployment scripts will be removed entirely soon.
 
 If you would like to use roxie directly, but roxie is not installed on your system, all `roxie`
 commands below can also be run via `scripts/roxie.sh` instead:
@@ -124,7 +125,6 @@ roxie deploy [ <roxie args> ... ] --tag <main tag>
 ```
 or alternatively
 ```
-export USE_ROXIE_DEPLOY=true
 MAIN_IMAGE_TAG=<main tag> ./deploy/deploy.sh [ <roxie args> ... ]
 ```
 
@@ -294,4 +294,5 @@ Most environment variables can be found in [common/env.sh](common/env.sh).
 | `ROX_LOCAL_SOURCE_PATH`              | `string`              | When `ROX_HOTRELOAD` is enabled this variable sets the path to the local binary. This is useful when the `hostPath` mount links into a VM or container, e.g. when using KIND.                                                                                              |
 | `ROX_INIT_BUNDLE_PATH`               | `string`              | Sets a custom init-bundle file path for Sensor.                                                                                                                                                                                                                            |
 | `ROX_CENTRAL_EXTRA_HELM_VALUES_FILE` | `string`              | Adds a custom value file path to the Central Helm chart.                                                                                                                                                                                                                   |
+| `SCANNER_V4_DB_CLAIM_NAME`           | `string`              | Sets the Scanner V4 DB PVC claim name in both Central and bundled monitoring when using classic Helm deploy.                                                                                                                                                |
 | `ROX_SENSOR_EXTRA_HELM_VALUES_FILE`  | `string`              | Adds a custom value file path to the Sensor Helm chart.                                                                                                                                                                                                                    |
diff --git a/deploy/charts/monitoring/README.md b/deploy/charts/monitoring/README.md
index 603f743ea3503..81ffd4f82d17a 100644
--- a/deploy/charts/monitoring/README.md
+++ b/deploy/charts/monitoring/README.md
@@ -21,6 +21,8 @@ On OpenShift, Helm may fail an upgrade with a ServiceAccount `imagePullSecrets`
 
 Roxie can install the same chart as add-on release `roxie-addon-monitoring` via `central.availableAddOns.monitoring`.
 
+For a custom Scanner V4 DB PVC, set `scannerV4DbPvcClaimName` to the same name as Central's `scannerV4.db.persistence.persistentVolumeClaim.claimName` when installing monitoring. Classic deploy can set `SCANNER_V4_DB_CLAIM_NAME` to pass the same name to both charts; a custom claim specified only in `ROX_CENTRAL_EXTRA_HELM_VALUES_FILE` will not change the monitoring chart.
+
 ## OpenShift
 
 When the cluster exposes `security.openshift.io/v1/SecurityContextConstraints`, the chart:
diff --git a/deploy/charts/monitoring/dashboards/vm-index-report-dashboard.json b/deploy/charts/monitoring/dashboards/vm-index-report-dashboard.json
index ea9ce35db4fc2..a48011b513d2b 100644
--- a/deploy/charts/monitoring/dashboards/vm-index-report-dashboard.json
+++ b/deploy/charts/monitoring/dashboards/vm-index-report-dashboard.json
@@ -15,7 +15,7 @@
       }
     ]
   },
-  "description": "Monitoring dashboard for Virtual Machine Index Report processing in StackRox Sensor",
+  "description": "Sensor pull-mode VM scanning: Sensor dials each VM's agent when that VM is due, optionally forwards a new index report to Central, and retries on NACK. Use this board to see whether jitter and the per-tick start cap pace Central sends, and whether scrapes are failing or only unchanged.",
   "editable": true,
   "fiscalYearStartMonth": 0,
   "graphTooltip": 1,
@@ -31,7 +31,7 @@
         "x": 0,
         "y": 0
       },
-      "id": 106,
+      "id": 100,
       "panels": [
         {
           "datasource": {
@@ -39,7 +39,7 @@
             "uid": "${datasource}"
           },
           "gridPos": {
-            "h": 16,
+            "h": 12,
             "w": 24,
             "x": 0,
             "y": 1
@@ -51,11 +51,11 @@
               "showLineNumbers": false,
               "showMiniMap": false
             },
-            "content": "```\n# How VM Index Report Processing Works in Sensor\n\n                                    Fake Workloads (scale testing)\n                                              │\n                                              ▼\n┌───────┐        ┌────────────────┐      ┌─────────────────────────────┐      ┌─────────┐      ┌────────────┐\n│ Relay │──GRPC──▶ Sensor Service │──────▶ handlerImpl.indexReports    │──────▶ Process │──────▶ to Central │\n└───────┘        └────────────────┘      │     (buffered channel)      │      └────┬────┘      └────────────┘\n                                         └─────────────────────────────┘           │\n                                                       ▲                           │\n                                                       │                           ▼\n                                                 capacity limit           ┌──────────────────┐\n                                                (blocks if full)          │ Check in-memory  │\n                                                                          │ store if VM is   │\n                                                                          │ known to Sensor  │\n                                                                          └────────┬─────────┘\n                                                                                   │\n                                                                    ┌──────────────┴──────────────┐\n                                                                    ▼                             ▼\n                                                              VM is known                  VM is unknown\n                                                            (outcome=success)         (outcome=vm_unknown_to_sensor)\n                                                                    │                             │\n                                                                    ▼                             ▼\n                                                            Transform & send              Report is dropped\n                                                              to Central\n```\n",
+            "content": "Sensor **pulls** index reports: VMScraper ticks, dials each due VM's roxagent over VSOCK, and forwards a successful report through `vmIndex.Handler` to Central. Central ACK/NACKs. Handler enqueue metrics are a secondary \"send to Central\" story, not the scrape scheduler.\n\n```\n  roxagent (in VM)                    Sensor                         Central\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510     VSOCK      \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510   SensorEvent   \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502 GetReport   \u2502\u25c4\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2502  VMScraper  \u2502\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502 VM pipe \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518   when due     \u2502 per-VM next \u2502                 \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n                                 \u2502 AttemptAt   \u2502                      \u2502\n                                 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2518              SensorACK\u2502\n                                        \u2502                    ACK | NACK\u2502\n                                        \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                                   NACK: clear report_generation, shared backoff\n```\n\n**Load spreading** (read `pollInterval` from Sensor env; do not assume 5m):\n\n- First wave / Sensor restart: a newly tracked VM gets `nextAttemptAt = now + U(0, C)` where `C = min(20m, pollInterval/3)`.\n- Success and permanent failure reschedule at `pollInterval + U(0, W)`, `W = pollInterval \u00d7 ROX_VIRTUAL_MACHINES_SCRAPER_STEADY_SPREAD_FRACTION` (default 2/3).\n- Per-tick start cap (backstop when jitter still lines VMs up): `min(concurrency, max(1, ceil(nDue \u00d7 tick / C)))`. Leftovers stay due for the next tick. `nDue` is the eligible pile at tick start, not the tracked fleet. Concurrency (default 20) is a separate overlap cap on the errgroup.\n- Retryable pull failures and NACKs share exponential backoff (`initialBackoff` default 10s, doubled, cap `min(pollInterval, 30m)`).\n\nDefaults: tick 10s, poll 5m, C 100s, W 200s, concurrency 20. A 4h poll uses C 20m and W 2h40m. First-wave `U(0, C)` is not exported as a histogram; only cadence `U(0, W)` is.\n",
             "mode": "markdown"
           },
           "pluginVersion": "10.4.17",
-          "title": "How this part of Sensor works",
+          "title": "How VMScraper pull mode works",
           "type": "text"
         }
       ],
@@ -70,9 +70,9 @@
         "x": 0,
         "y": 1
       },
-      "id": 100,
+      "id": 200,
       "panels": [],
-      "title": "📊 Overview",
+      "title": "Overview",
       "type": "row"
     },
     {
@@ -80,7 +80,7 @@
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Total number of VM index reports successfully sent to Central",
+      "description": "How many VMs Sensor is currently scheduling. Poll-interval advice uses this fleet size. The per-tick start cap uses how many are due, not this number.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -91,7 +91,7 @@
             "mode": "absolute",
             "steps": [
               {
-                "color": "green",
+                "color": "blue",
                 "value": null
               }
             ]
@@ -102,11 +102,11 @@
       },
       "gridPos": {
         "h": 4,
-        "w": 6,
+        "w": 4,
         "x": 0,
         "y": 2
       },
-      "id": 1,
+      "id": 201,
       "options": {
         "colorMode": "value",
         "graphMode": "area",
@@ -131,13 +131,13 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_reports_sent_total{status=\"success\"})",
-          "legendFormat": "Sent",
+          "expr": "rox_sensor_vsock_pull_tracked_vms",
+          "legendFormat": "Tracked",
           "range": true,
           "refId": "A"
         }
       ],
-      "title": "✅ Reports Sent to Central (Success)",
+      "title": "Tracked VMs",
       "type": "stat"
     },
     {
@@ -145,7 +145,7 @@
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Total number of VM index reports received by Sensor",
+      "description": "How many VMs were eligible to scrape on the most recent tick, before the start cap. A high number with ~1 start per tick is the cap draining a backlog. Zero means the next attempts are still in the future.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -156,7 +156,7 @@
             "mode": "absolute",
             "steps": [
               {
-                "color": "blue",
+                "color": "yellow",
                 "value": null
               }
             ]
@@ -167,11 +167,11 @@
       },
       "gridPos": {
         "h": 4,
-        "w": 6,
-        "x": 6,
+        "w": 4,
+        "x": 4,
         "y": 2
       },
-      "id": 2,
+      "id": 202,
       "options": {
         "colorMode": "value",
         "graphMode": "area",
@@ -196,13 +196,13 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_reports_received_total)",
-          "legendFormat": "Received",
+          "expr": "rox_sensor_vsock_pull_due_vms",
+          "legendFormat": "Due",
           "range": true,
           "refId": "A"
         }
       ],
-      "title": "📥 Reports Received from Relay",
+      "title": "Due VMs (last tick)",
       "type": "stat"
     },
     {
@@ -210,7 +210,7 @@
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Number of times enqueue was blocked due to full channel",
+      "description": "Lifetime count of full index reports Sensor sent to Central. Unchanged pulls are not included. A Sensor restart resets the counter to 0.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -223,18 +223,136 @@
               {
                 "color": "green",
                 "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 100
-              },
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 8,
+        "y": 2
+      },
+      "id": 203,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "10.4.17",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rox_sensor_vsock_pull_scrape_total{status=\"success\"})",
+          "legendFormat": "Success",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Successful forwards to Central",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Lifetime count of scrapes where the agent had nothing newer than last time. Sensor still talked to the VM; Central did not get a new report. This is the usual case between mandatory refreshes.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
               {
-                "color": "orange",
-                "value": 1000
-              },
+                "color": "blue",
+                "value": null
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 4,
+        "x": 12,
+        "y": 2
+      },
+      "id": 204,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "10.4.17",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rox_sensor_vsock_pull_get_report_total{status=\"unchanged\"})",
+          "legendFormat": "Unchanged",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Unchanged pulls",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "How many times Central rejected a VM index report. Sensor clears the cached generation and retries on a short backoff. The reason (Scanner down, and so on) is in Central logs, not in this number.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
               {
                 "color": "red",
-                "value": 10000
+                "value": null
               }
             ]
           },
@@ -244,11 +362,11 @@
       },
       "gridPos": {
         "h": 4,
-        "w": 6,
-        "x": 12,
+        "w": 4,
+        "x": 16,
         "y": 2
       },
-      "id": 3,
+      "id": 205,
       "options": {
         "colorMode": "value",
         "graphMode": "area",
@@ -273,13 +391,13 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_enqueue_blocked_total)",
-          "legendFormat": "Blocked",
+          "expr": "sum(rox_sensor_virtual_machine_index_report_acks_received_total{action=\"NACK\"})",
+          "legendFormat": "NACK",
           "range": true,
           "refId": "A"
         }
       ],
-      "title": "⚠️ Enqueue Blocked Count",
+      "title": "NACKs from Central",
       "type": "stat"
     },
     {
@@ -287,7 +405,7 @@
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Total reports processed (sum of all outcomes)",
+      "description": "How often the scraper loop wakes up. Default 10s tick is about 0.1 per second. A drop to zero means the loop is not running.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -303,17 +421,17 @@
               }
             ]
           },
-          "unit": "short"
+          "unit": "ops"
         },
         "overrides": []
       },
       "gridPos": {
         "h": 4,
-        "w": 6,
-        "x": 18,
+        "w": 4,
+        "x": 20,
         "y": 2
       },
-      "id": 4,
+      "id": 206,
       "options": {
         "colorMode": "value",
         "graphMode": "area",
@@ -338,13 +456,13 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count)",
-          "legendFormat": "Total Processed",
+          "expr": "rate(rox_sensor_vsock_pull_ticks_total[$__rate_interval])",
+          "legendFormat": "Ticks/s",
           "range": true,
           "refId": "A"
         }
       ],
-      "title": "🔄 Total Processed Index Reports",
+      "title": "Tick rate",
       "type": "stat"
     },
     {
@@ -355,9 +473,9 @@
         "x": 0,
         "y": 6
       },
-      "id": 101,
+      "id": 300,
       "panels": [],
-      "title": "📈 Throughput & Rates",
+      "title": "Load spreading",
       "type": "row"
     },
     {
@@ -365,7 +483,7 @@
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Rate of reports sent per second over time",
+      "description": "Running total of full index reports Sensor sent to Central (rox_sensor_vsock_pull_scrape_total{status=\"success\"}). Each step up is one or more forwards. A paced wave is a run of +1 steps a few seconds apart. A dump is one large jump. A Sensor restart resets the counter to 0. Unchanged pulls are not counted.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -375,19 +493,19 @@
             "axisBorderShow": false,
             "axisCenteredZero": false,
             "axisColorMode": "text",
-            "axisLabel": "Reports/sec",
+            "axisLabel": "forwards",
             "axisPlacement": "auto",
             "barAlignment": 0,
             "drawStyle": "line",
             "fillOpacity": 20,
-            "gradientMode": "opacity",
+            "gradientMode": "none",
             "hideFrom": {
               "legend": false,
               "tooltip": false,
               "viz": false
             },
             "insertNulls": false,
-            "lineInterpolation": "smooth",
+            "lineInterpolation": "stepAfter",
             "lineWidth": 2,
             "pointSize": 5,
             "scaleDistribution": {
@@ -413,21 +531,37 @@
               }
             ]
           },
-          "unit": "reqps"
+          "unit": "short"
         },
-        "overrides": []
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "success"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
       },
       "gridPos": {
         "h": 8,
-        "w": 12,
+        "w": 16,
         "x": 0,
         "y": 7
       },
-      "id": 5,
+      "id": 301,
       "options": {
         "legend": {
           "calcs": [
-            "mean",
+            "lastNotNull",
             "max"
           ],
           "displayMode": "table",
@@ -439,7 +573,7 @@
           "sort": "desc"
         }
       },
-      "pluginVersion": "10.0.0",
+      "pluginVersion": "10.4.17",
       "targets": [
         {
           "datasource": {
@@ -447,13 +581,13 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rate(rox_sensor_virtual_machine_index_reports_sent_total{status=\"success\"}[$__rate_interval]))",
-          "legendFormat": "Sent Rate",
+          "expr": "sum(rox_sensor_vsock_pull_scrape_total{status=\"success\"})",
+          "legendFormat": "success",
           "range": true,
           "refId": "A"
         }
       ],
-      "title": "📤 Reports Sent to Central Rate",
+      "title": "Successful forwards to Central",
       "type": "timeseries"
     },
     {
@@ -461,7 +595,7 @@
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Rate of processing by outcome",
+      "description": "How many VMs Sensor is scheduling, as a time series. The start cap is computed from the due pile, not from this series.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -471,7 +605,7 @@
             "axisBorderShow": false,
             "axisCenteredZero": false,
             "axisColorMode": "text",
-            "axisLabel": "Reports/sec",
+            "axisLabel": "VMs",
             "axisPlacement": "auto",
             "barAlignment": 0,
             "drawStyle": "line",
@@ -493,7 +627,7 @@
             "spanNulls": false,
             "stacking": {
               "group": "A",
-              "mode": "normal"
+              "mode": "none"
             },
             "thresholdsStyle": {
               "mode": "off"
@@ -509,34 +643,19 @@
               }
             ]
           },
-          "unit": "reqps"
+          "unit": "short"
         },
         "overrides": [
           {
             "matcher": {
               "id": "byName",
-              "options": "success"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "green",
-                  "mode": "fixed"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "vm_unknown_to_sensor"
+              "options": "tracked"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "orange",
+                  "fixedColor": "blue",
                   "mode": "fixed"
                 }
               }
@@ -546,11 +665,11 @@
       },
       "gridPos": {
         "h": 8,
-        "w": 12,
-        "x": 12,
+        "w": 8,
+        "x": 16,
         "y": 7
       },
-      "id": 6,
+      "id": 302,
       "options": {
         "legend": {
           "calcs": [
@@ -566,7 +685,7 @@
           "sort": "desc"
         }
       },
-      "pluginVersion": "10.0.0",
+      "pluginVersion": "10.4.17",
       "targets": [
         {
           "datasource": {
@@ -574,54 +693,90 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum by (outcome) (rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count[$__rate_interval]))",
-          "legendFormat": "{{outcome}}",
+          "expr": "rox_sensor_vsock_pull_tracked_vms",
+          "legendFormat": "tracked",
           "range": true,
           "refId": "A"
         }
       ],
-      "title": "🔄 Processing Rate by Outcome",
+      "title": "Fleet size",
       "type": "timeseries"
     },
-    {
-      "collapsed": false,
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 15
-      },
-      "id": 102,
-      "panels": [],
-      "title": "🥧 Processing Outcome Distribution",
-      "type": "row"
-    },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Distribution of processing outcomes - shows what percentage of reports succeeded vs failed",
+      "description": "Eligible VMs versus how many scrapes that tick actually started. Healthy catch-up with the start cap: due stays high, starts stay near 1. Jitter-only (no cap): due and starts move together. A dump: both jump toward the fleet. Starts are only recorded on ticks that had someone due; idle ticks are omitted.",
       "fieldConfig": {
         "defaults": {
           "color": {
             "mode": "palette-classic"
           },
           "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "VMs",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 20,
+            "gradientMode": "opacity",
             "hideFrom": {
               "legend": false,
               "tooltip": false,
               "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
             }
           },
           "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
           "unit": "short"
         },
         "overrides": [
           {
             "matcher": {
               "id": "byName",
-              "options": "success"
+              "options": "due (last tick)"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "avg starts / observed tick"
             },
             "properties": [
               {
@@ -636,13 +791,13 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "vm_unknown_to_sensor"
+              "options": "P95 starts / observed tick"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "orange",
+                  "fixedColor": "red",
                   "mode": "fixed"
                 }
               }
@@ -652,39 +807,27 @@
       },
       "gridPos": {
         "h": 8,
-        "w": 8,
+        "w": 24,
         "x": 0,
-        "y": 16
+        "y": 15
       },
-      "id": 7,
+      "id": 303,
       "options": {
-        "displayLabels": [
-          "name",
-          "percent"
-        ],
         "legend": {
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true,
-          "values": [
-            "value",
-            "percent"
-          ]
-        },
-        "pieType": "donut",
-        "reduceOptions": {
           "calcs": [
-            "lastNotNull"
+            "mean",
+            "max"
           ],
-          "fields": "",
-          "values": false
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
         },
         "tooltip": {
-          "mode": "single",
-          "sort": "none"
+          "mode": "multi",
+          "sort": "desc"
         }
       },
-      "pluginVersion": "10.0.0",
+      "pluginVersion": "10.4.17",
       "targets": [
         {
           "datasource": {
@@ -692,41 +835,176 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum by (outcome) (rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count)",
-          "legendFormat": "{{outcome}}",
+          "expr": "rox_sensor_vsock_pull_due_vms",
+          "legendFormat": "due (last tick)",
           "range": true,
           "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "rate(rox_sensor_vsock_pull_starts_per_tick_sum[$__rate_interval]) / rate(rox_sensor_vsock_pull_starts_per_tick_count[$__rate_interval])",
+          "legendFormat": "avg starts / observed tick",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_starts_per_tick_bucket[$__rate_interval])))",
+          "legendFormat": "P95 starts / observed tick",
+          "range": true,
+          "refId": "C"
         }
       ],
-      "title": "🎯 Processing Outcome Distribution",
-      "type": "piechart"
+      "title": "Due pile vs starts per tick",
+      "type": "timeseries"
     },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Shows the distribution of blocking enqueue wait times across latency buckets",
+      "description": "Time on X, how many VMs started in that tick on Y, color = how often that happened. Only ticks that had at least one due VM are recorded, so there is no 0 row. Cap 1 should glow on Y near 1. A bright band at Y near the fleet (or 20) is a dump. Compare Tick rate if most wall-clock ticks are idle.",
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
           "custom": {
             "hideFrom": {
               "legend": false,
               "tooltip": false,
               "viz": false
+            },
+            "scaleDistribution": {
+              "type": "linear"
             }
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 23
+      },
+      "id": 304,
+      "options": {
+        "calculate": false,
+        "cellGap": 1,
+        "cellValues": {
+          "unit": "short"
+        },
+        "color": {
+          "exponent": 0.5,
+          "fill": "dark-orange",
+          "mode": "scheme",
+          "reverse": false,
+          "scale": "exponential",
+          "scheme": "Oranges",
+          "steps": 64
+        },
+        "exemplars": {
+          "color": "rgba(255,0,255,0.7)"
+        },
+        "filterValues": {
+          "le": 1e-09
+        },
+        "legend": {
+          "show": true
+        },
+        "rowsFrame": {
+          "layout": "auto"
+        },
+        "tooltip": {
+          "mode": "single",
+          "showColorScale": false,
+          "yHistogram": false
+        },
+        "yAxis": {
+          "axisPlacement": "left",
+          "reverse": false,
+          "unit": "short"
+        }
+      },
+      "pluginVersion": "10.4.17",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum by (le) (increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le!=\"0\"}[$__rate_interval]))",
+          "legendFormat": "{{le}}",
+          "range": true,
+          "refId": "A",
+          "format": "heatmap"
+        }
+      ],
+      "title": "Starts per tick heatmap",
+      "type": "heatmap"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "How many observed ticks started 1, 2, 3, ... VMs. Idle ticks (nobody due) are not sampled, so there is no 0 bar; those ticks show up on Tick rate instead. For a small fleet with start cap 1, mass should sit in 1. Mass in 8 or 20 is a dump.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
           },
           "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 10
+              },
+              {
+                "color": "orange",
+                "value": 50
+              },
+              {
+                "color": "red",
+                "value": 200
+              }
+            ]
+          },
           "unit": "short"
         },
         "overrides": [
           {
             "matcher": {
               "id": "byName",
-              "options": "≤1ms"
+              "options": "1"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "2"
             },
             "properties": [
               {
@@ -741,7 +1019,7 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "1-10ms"
+              "options": "3"
             },
             "properties": [
               {
@@ -756,7 +1034,22 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "10-100ms"
+              "options": "4-5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "yellow",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "6-8"
             },
             "properties": [
               {
@@ -771,7 +1064,37 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "100-500ms"
+              "options": "9-10"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "11-15"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "16-20"
             },
             "properties": [
               {
@@ -786,7 +1109,22 @@
           {
             "matcher": {
               "id": "byName",
-              "options": ">500ms"
+              "options": "21-30"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "31-50"
             },
             "properties": [
               {
@@ -797,31 +1135,53 @@
                 }
               }
             ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "51-100"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": ">100"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
           }
         ]
       },
       "gridPos": {
         "h": 8,
-        "w": 8,
-        "x": 8,
-        "y": 16
+        "w": 12,
+        "x": 12,
+        "y": 23
       },
-      "id": 8,
+      "id": 305,
       "options": {
-        "displayLabels": [
-          "name",
-          "percent"
-        ],
-        "legend": {
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true,
-          "values": [
-            "value",
-            "percent"
-          ]
-        },
-        "pieType": "donut",
+        "displayMode": "gradient",
+        "maxVizHeight": 300,
+        "minVizHeight": 10,
+        "minVizWidth": 0,
+        "namePlacement": "auto",
+        "orientation": "horizontal",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -829,12 +1189,11 @@
           "fields": "",
           "values": false
         },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
+        "showUnfilled": true,
+        "sizing": "auto",
+        "valueMode": "color"
       },
-      "pluginVersion": "10.0.0",
+      "pluginVersion": "10.4.17",
       "targets": [
         {
           "datasource": {
@@ -842,10 +1201,10 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"1\"})",
-          "legendFormat": "≤1ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"1\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"0\"}[$__range]))",
+          "legendFormat": "1",
           "range": true,
-          "refId": "A"
+          "refId": "B"
         },
         {
           "datasource": {
@@ -853,10 +1212,10 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"10\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"1\"})",
-          "legendFormat": "1-10ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"2\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"1\"}[$__range]))",
+          "legendFormat": "2",
           "range": true,
-          "refId": "B"
+          "refId": "C"
         },
         {
           "datasource": {
@@ -864,10 +1223,10 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"100\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"10\"})",
-          "legendFormat": "10-100ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"3\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"2\"}[$__range]))",
+          "legendFormat": "3",
           "range": true,
-          "refId": "C"
+          "refId": "D"
         },
         {
           "datasource": {
@@ -875,10 +1234,10 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"500\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"100\"})",
-          "legendFormat": "100-500ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"5\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"3\"}[$__range]))",
+          "legendFormat": "4-5",
           "range": true,
-          "refId": "D"
+          "refId": "E"
         },
         {
           "datasource": {
@@ -886,130 +1245,65 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"+Inf\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"500\"})",
-          "legendFormat": ">500ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"8\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"5\"}[$__range]))",
+          "legendFormat": "6-8",
           "range": true,
-          "refId": "E"
-        }
-      ],
-      "title": "⏱️ Blocking Enqueue Duration Distribution",
-      "type": "piechart"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "description": "Shows the distribution of processing times for successful operations",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
+          "refId": "F"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
           },
-          "custom": {
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            }
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"10\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"8\"}[$__range]))",
+          "legendFormat": "9-10",
+          "range": true,
+          "refId": "G"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
           },
-          "mappings": [],
-          "unit": "short"
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"15\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"10\"}[$__range]))",
+          "legendFormat": "11-15",
+          "range": true,
+          "refId": "H"
         },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "≤10ms"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "green",
-                  "mode": "fixed"
-                }
-              }
-            ]
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
           },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "10-40ms"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "yellow",
-                  "mode": "fixed"
-                }
-              }
-            ]
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"20\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"15\"}[$__range]))",
+          "legendFormat": "16-20",
+          "range": true,
+          "refId": "I"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
           },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": ">40ms"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "red",
-                  "mode": "fixed"
-                }
-              }
-            ]
-          }
-        ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 8,
-        "x": 16,
-        "y": 16
-      },
-      "id": 9,
-      "options": {
-        "displayLabels": [
-          "name",
-          "percent"
-        ],
-        "legend": {
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true,
-          "values": [
-            "value",
-            "percent"
-          ]
-        },
-        "pieType": "donut",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"30\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"20\"}[$__range]))",
+          "legendFormat": "21-30",
+          "range": true,
+          "refId": "J"
         },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
         {
           "datasource": {
             "type": "prometheus",
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\",le=\"10\"})",
-          "legendFormat": "≤10ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"50\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"30\"}[$__range]))",
+          "legendFormat": "31-50",
           "range": true,
-          "refId": "A"
+          "refId": "K"
         },
         {
           "datasource": {
@@ -1017,10 +1311,10 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\",le=\"40\"}) - sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\",le=\"10\"})",
-          "legendFormat": "10-40ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"100\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"50\"}[$__range]))",
+          "legendFormat": "51-100",
           "range": true,
-          "refId": "B"
+          "refId": "L"
         },
         {
           "datasource": {
@@ -1028,169 +1322,82 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\",le=\"+Inf\"}) - sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\",le=\"40\"})",
-          "legendFormat": ">40ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"+Inf\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_starts_per_tick_bucket{le=\"100\"}[$__range]))",
+          "legendFormat": ">100",
           "range": true,
-          "refId": "C"
+          "refId": "M"
         }
       ],
-      "title": "⚡ Processing Duration Distribution (Success)",
-      "type": "piechart"
-    },
-    {
-      "collapsed": false,
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 24
-      },
-      "id": 103,
-      "panels": [],
-      "title": "📊 Latency Percentiles",
-      "type": "row"
+      "title": "Starts per tick distribution",
+      "type": "bargauge"
     },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "P50, P90, P95, and P99 latencies for blocking enqueue duration",
+      "description": "Time on X, gap between consecutive Central sends on Y (seconds), color = how often that gap occurred. This is Sensor-wide, not per VM, and only full forwards (not unchanged pulls). A paced wave is a bright band around the tick (default ~10s). A dump is bright near 0s. Long quiet stretches between waves are normal.",
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
           "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "Latency (ms)",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "opacity",
             "hideFrom": {
               "legend": false,
               "tooltip": false,
               "viz": false
             },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 2,
-            "pointSize": 5,
             "scaleDistribution": {
               "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
             }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "ms"
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "P50"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "green",
-                  "mode": "fixed"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "P90"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "yellow",
-                  "mode": "fixed"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "P95"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "orange",
-                  "mode": "fixed"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "P99"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "red",
-                  "mode": "fixed"
-                }
-              }
-            ]
           }
-        ]
+        },
+        "overrides": []
       },
       "gridPos": {
         "h": 8,
         "w": 12,
         "x": 0,
-        "y": 25
+        "y": 31
       },
-      "id": 10,
+      "id": 306,
       "options": {
+        "calculate": false,
+        "cellGap": 1,
+        "cellValues": {
+          "unit": "short"
+        },
+        "color": {
+          "exponent": 0.5,
+          "fill": "dark-orange",
+          "mode": "scheme",
+          "reverse": false,
+          "scale": "exponential",
+          "scheme": "Oranges",
+          "steps": 64
+        },
+        "exemplars": {
+          "color": "rgba(255,0,255,0.7)"
+        },
+        "filterValues": {
+          "le": 1e-09
+        },
         "legend": {
-          "calcs": [
-            "mean",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
+          "show": true
+        },
+        "rowsFrame": {
+          "layout": "auto"
         },
         "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
+          "mode": "single",
+          "showColorScale": false,
+          "yHistogram": false
+        },
+        "yAxis": {
+          "axisPlacement": "left",
+          "reverse": false,
+          "unit": "s"
         }
       },
-      "pluginVersion": "10.0.0",
+      "pluginVersion": "10.4.17",
       "targets": [
         {
           "datasource": {
@@ -1198,54 +1405,22 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "histogram_quantile(0.50, sum(rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])) by (le))",
-          "legendFormat": "P50",
-          "range": true,
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "expr": "histogram_quantile(0.90, sum(rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])) by (le))",
-          "legendFormat": "P90",
-          "range": true,
-          "refId": "B"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "expr": "histogram_quantile(0.95, sum(rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])) by (le))",
-          "legendFormat": "P95",
-          "range": true,
-          "refId": "C"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "expr": "histogram_quantile(0.99, sum(rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])) by (le))",
-          "legendFormat": "P99",
+          "expr": "sum by (le) (increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket[$__rate_interval]))",
+          "legendFormat": "{{le}}",
           "range": true,
-          "refId": "D"
+          "refId": "A",
+          "format": "heatmap"
         }
       ],
-      "title": "⏱️ Blocking Enqueue Duration Percentiles",
-      "type": "timeseries"
+      "title": "Forward interarrival heatmap",
+      "type": "heatmap"
     },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "P50, P90, P95, and P99 latencies for processing duration",
+      "description": "Typical (P50) and large (P90/P99) gaps between consecutive Central sends over time. With few forwards the lines jump; histogram_quantile on a sparse rate() window can pin to ~0. Prefer the heatmap and distribution for gap size.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1255,7 +1430,7 @@
             "axisBorderShow": false,
             "axisCenteredZero": false,
             "axisColorMode": "text",
-            "axisLabel": "Latency (ms)",
+            "axisLabel": "gap",
             "axisPlacement": "auto",
             "barAlignment": 0,
             "drawStyle": "line",
@@ -1293,7 +1468,7 @@
               }
             ]
           },
-          "unit": "ms"
+          "unit": "s"
         },
         "overrides": [
           {
@@ -1362,9 +1537,9 @@
         "h": 8,
         "w": 12,
         "x": 12,
-        "y": 25
+        "y": 31
       },
-      "id": 11,
+      "id": 307,
       "options": {
         "legend": {
           "calcs": [
@@ -1380,7 +1555,7 @@
           "sort": "desc"
         }
       },
-      "pluginVersion": "10.0.0",
+      "pluginVersion": "10.4.17",
       "targets": [
         {
           "datasource": {
@@ -1388,7 +1563,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "histogram_quantile(0.50, sum(rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])) by (le))",
+          "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket[$__rate_interval])))",
           "legendFormat": "P50",
           "range": true,
           "refId": "A"
@@ -1399,7 +1574,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "histogram_quantile(0.90, sum(rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])) by (le))",
+          "expr": "histogram_quantile(0.90, sum by (le) (rate(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket[$__rate_interval])))",
           "legendFormat": "P90",
           "range": true,
           "refId": "B"
@@ -1410,7 +1585,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "histogram_quantile(0.95, sum(rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])) by (le))",
+          "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket[$__rate_interval])))",
           "legendFormat": "P95",
           "range": true,
           "refId": "C"
@@ -1421,34 +1596,21 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "histogram_quantile(0.99, sum(rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])) by (le))",
+          "expr": "histogram_quantile(0.99, sum by (le) (rate(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket[$__rate_interval])))",
           "legendFormat": "P99",
           "range": true,
           "refId": "D"
         }
       ],
-      "title": "⚡ Processing Duration Percentiles (Success)",
+      "title": "Forward interarrival percentiles",
       "type": "timeseries"
     },
-    {
-      "collapsed": false,
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 33
-      },
-      "id": 104,
-      "panels": [],
-      "title": "📉 Detailed Histogram View",
-      "type": "row"
-    },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Bar gauge showing the count of operations in each latency bucket for blocking enqueue",
+      "description": "How many Central-send gaps fell in each size bucket over the selected range. Mass in 0.08s or less means reports left Sensor almost together (a dump). Mass around 10-41s is a paced wave at a 10s tick. Mass in minutes-or-more is idle time between waves, which is normal when guests are unchanged.",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1464,15 +1626,15 @@
               },
               {
                 "color": "yellow",
-                "value": 1000
+                "value": 10
               },
               {
                 "color": "orange",
-                "value": 5000
+                "value": 50
               },
               {
                 "color": "red",
-                "value": 10000
+                "value": 200
               }
             ]
           },
@@ -1482,13 +1644,13 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "≤1ms"
+              "options": "\u22640.08s (dump)"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "green",
+                  "fixedColor": "red",
                   "mode": "fixed"
                 }
               }
@@ -1497,13 +1659,13 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "1-5ms"
+              "options": "0.08-1.3s"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "super-light-green",
+                  "fixedColor": "orange",
                   "mode": "fixed"
                 }
               }
@@ -1512,13 +1674,13 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "5-10ms"
+              "options": "1.3-10s"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "light-green",
+                  "fixedColor": "yellow",
                   "mode": "fixed"
                 }
               }
@@ -1527,13 +1689,13 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "10-50ms"
+              "options": "10-41s"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "yellow",
+                  "fixedColor": "green",
                   "mode": "fixed"
                 }
               }
@@ -1542,13 +1704,13 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "50-100ms"
+              "options": "41s-2.7m"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "light-orange",
+                  "fixedColor": "green",
                   "mode": "fixed"
                 }
               }
@@ -1557,13 +1719,13 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "100-500ms"
+              "options": "2.7-5.5m"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "orange",
+                  "fixedColor": "blue",
                   "mode": "fixed"
                 }
               }
@@ -1572,13 +1734,28 @@
           {
             "matcher": {
               "id": "byName",
-              "options": ">500ms"
+              "options": "5.5-11m"
             },
             "properties": [
               {
                 "id": "color",
                 "value": {
-                  "fixedColor": "red",
+                  "fixedColor": "blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": ">11m"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "purple",
                   "mode": "fixed"
                 }
               }
@@ -1588,11 +1765,11 @@
       },
       "gridPos": {
         "h": 8,
-        "w": 24,
+        "w": 12,
         "x": 0,
-        "y": 34
+        "y": 39
       },
-      "id": 12,
+      "id": 308,
       "options": {
         "displayMode": "gradient",
         "maxVizHeight": 300,
@@ -1619,8 +1796,8 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"1\"})",
-          "legendFormat": "≤1ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"0.08\"}[$__range]))",
+          "legendFormat": "\u22640.08s (dump)",
           "range": true,
           "refId": "A"
         },
@@ -1630,8 +1807,8 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"5\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"1\"})",
-          "legendFormat": "1-5ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"1.28\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"0.08\"}[$__range]))",
+          "legendFormat": "0.08-1.3s",
           "range": true,
           "refId": "B"
         },
@@ -1641,8 +1818,8 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"10\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"5\"})",
-          "legendFormat": "5-10ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"10.24\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"1.28\"}[$__range]))",
+          "legendFormat": "1.3-10s",
           "range": true,
           "refId": "C"
         },
@@ -1652,8 +1829,8 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"50\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"10\"})",
-          "legendFormat": "10-50ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"40.96\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"10.24\"}[$__range]))",
+          "legendFormat": "10-41s",
           "range": true,
           "refId": "D"
         },
@@ -1663,8 +1840,8 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"100\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"50\"})",
-          "legendFormat": "50-100ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"163.84\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"40.96\"}[$__range]))",
+          "legendFormat": "41s-2.7m",
           "range": true,
           "refId": "E"
         },
@@ -1674,8 +1851,8 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"500\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"100\"})",
-          "legendFormat": "100-500ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"327.68\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"163.84\"}[$__range]))",
+          "legendFormat": "2.7-5.5m",
           "range": true,
           "refId": "F"
         },
@@ -1685,87 +1862,135 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"+Inf\"}) - sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket{le=\"500\"})",
-          "legendFormat": ">500ms",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"655.36\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"327.68\"}[$__range]))",
+          "legendFormat": "5.5-11m",
           "range": true,
           "refId": "G"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"1310.72\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"655.36\"}[$__range]))",
+          "legendFormat": "11-22m",
+          "range": true,
+          "refId": "H"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"2621.44\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"1310.72\"}[$__range]))",
+          "legendFormat": "22-44m",
+          "range": true,
+          "refId": "I"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"5242.88\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"2621.44\"}[$__range]))",
+          "legendFormat": "44m-1.5h",
+          "range": true,
+          "refId": "J"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"10485.76\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"5242.88\"}[$__range]))",
+          "legendFormat": "1.5-2.9h",
+          "range": true,
+          "refId": "K"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"+Inf\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_forward_interarrival_seconds_bucket{le=\"10485.76\"}[$__range]))",
+          "legendFormat": ">2.9h",
+          "range": true,
+          "refId": "L"
         }
       ],
-      "title": "📊 Blocking Enqueue Duration - Histogram Buckets",
+      "title": "Forward interarrival distribution",
       "type": "bargauge"
     },
-    {
-      "collapsed": false,
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 42
-      },
-      "id": 105,
-      "panels": [],
-      "title": "📈 Average Latencies",
-      "type": "row"
-    },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Average blocking enqueue duration in milliseconds",
+      "description": "Time on X, extra random delay added on top of the poll interval on Y. Recorded only when a VM returns to cadence after a successful scrape or a permanent failure. First-wave U(0, C) jitter and NACK/retry backoff are not on this chart. Empty after Sensor start until the first cadence reschedule. A uniform draw on [0, W] should fill the band, not pile on 0.",
       "fieldConfig": {
         "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 50
-              },
-              {
-                "color": "orange",
-                "value": 100
-              },
-              {
-                "color": "red",
-                "value": 500
-              }
-            ]
-          },
-          "unit": "ms"
+          "custom": {
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "scaleDistribution": {
+              "type": "linear"
+            }
+          }
         },
         "overrides": []
       },
       "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 0,
-        "y": 43
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 39
       },
-      "id": 13,
+      "id": 309,
       "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
+        "calculate": false,
+        "cellGap": 1,
+        "cellValues": {
+          "unit": "short"
         },
-        "showPercentChange": false,
-        "textMode": "auto",
-        "wideLayout": true
+        "color": {
+          "exponent": 0.5,
+          "fill": "dark-orange",
+          "mode": "scheme",
+          "reverse": false,
+          "scale": "exponential",
+          "scheme": "Oranges",
+          "steps": 64
+        },
+        "exemplars": {
+          "color": "rgba(255,0,255,0.7)"
+        },
+        "filterValues": {
+          "le": 1e-09
+        },
+        "legend": {
+          "show": true
+        },
+        "rowsFrame": {
+          "layout": "auto"
+        },
+        "tooltip": {
+          "mode": "single",
+          "showColorScale": false,
+          "yHistogram": false
+        },
+        "yAxis": {
+          "axisPlacement": "left",
+          "reverse": false,
+          "unit": "s"
+        }
       },
       "pluginVersion": "10.4.17",
       "targets": [
@@ -1775,25 +2000,58 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_sum) / sum(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_count)",
-          "legendFormat": "Avg",
+          "expr": "sum by (le) (increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket[$__rate_interval]))",
+          "legendFormat": "{{le}}",
           "range": true,
-          "refId": "A"
+          "refId": "A",
+          "format": "heatmap"
         }
       ],
-      "title": "⏱️ Avg Blocking Enqueue Duration",
-      "type": "stat"
+      "title": "Schedule offset heatmap",
+      "type": "heatmap"
     },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Average processing duration for successful operations",
+      "description": "Typical extra delay on return-to-cadence, over time. Empty until the first success or permanent-failure reschedule. NACK retries will not move this chart. P50 should sit near W/2 (2/3 of poll / 2).",
       "fieldConfig": {
         "defaults": {
           "color": {
-            "mode": "thresholds"
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "offset",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "opacity",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
           },
           "mappings": [],
           "thresholds": {
@@ -1802,47 +2060,95 @@
               {
                 "color": "green",
                 "value": null
-              },
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "P50"
+            },
+            "properties": [
               {
-                "color": "yellow",
-                "value": 20
-              },
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "P90"
+            },
+            "properties": [
               {
-                "color": "orange",
-                "value": 50
-              },
+                "id": "color",
+                "value": {
+                  "fixedColor": "yellow",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "P95"
+            },
+            "properties": [
               {
-                "color": "red",
-                "value": 100
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
               }
             ]
           },
-          "unit": "ms"
-        },
-        "overrides": []
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "P99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
       },
       "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 6,
-        "y": 43
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 47
       },
-      "id": 14,
+      "id": 310,
       "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
+        "legend": {
           "calcs": [
-            "lastNotNull"
+            "mean",
+            "max"
           ],
-          "fields": "",
-          "values": false
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
         },
-        "showPercentChange": false,
-        "textMode": "auto",
-        "wideLayout": true
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
       },
       "pluginVersion": "10.4.17",
       "targets": [
@@ -1852,29 +2158,60 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_sum{outcome=\"success\"}) / sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count{outcome=\"success\"})",
-          "legendFormat": "Avg",
+          "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_schedule_offset_seconds_bucket[$__rate_interval])))",
+          "legendFormat": "P50",
           "range": true,
           "refId": "A"
-        }
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.90, sum by (le) (rate(rox_sensor_vsock_pull_schedule_offset_seconds_bucket[$__rate_interval])))",
+          "legendFormat": "P90",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_schedule_offset_seconds_bucket[$__rate_interval])))",
+          "legendFormat": "P95",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.99, sum by (le) (rate(rox_sensor_vsock_pull_schedule_offset_seconds_bucket[$__rate_interval])))",
+          "legendFormat": "P99",
+          "range": true,
+          "refId": "D"
+        }
       ],
-      "title": "⚡ Avg Processing Duration (Success)",
-      "type": "stat"
+      "title": "Schedule offset percentiles",
+      "type": "timeseries"
     },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Percentage of reports that encountered blocking during enqueue",
+      "description": "Totals of those extra delays over the selected range. Default poll 5m piles around 0-200s. A 4h poll piles under ~2h40m (W). This is the random band on the next poll, not the gap between Central forwards.",
       "fieldConfig": {
         "defaults": {
           "color": {
             "mode": "thresholds"
           },
           "mappings": [],
-          "max": 100,
-          "min": 0,
           "thresholds": {
             "mode": "absolute",
             "steps": [
@@ -1888,29 +2225,153 @@
               },
               {
                 "color": "orange",
-                "value": 30
+                "value": 50
               },
               {
                 "color": "red",
-                "value": 50
+                "value": 200
               }
             ]
           },
-          "unit": "percent"
+          "unit": "short"
         },
-        "overrides": []
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "\u226432s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "yellow",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "32-128s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "128-256s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "256-512s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "512-1024s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "1024-2048s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "purple",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "2048-4096s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "purple",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": ">4096s"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
       },
       "gridPos": {
-        "h": 5,
-        "w": 6,
+        "h": 8,
+        "w": 12,
         "x": 12,
-        "y": 43
+        "y": 47
       },
-      "id": 15,
+      "id": 311,
       "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
-        "orientation": "auto",
+        "displayMode": "gradient",
+        "maxVizHeight": 300,
+        "minVizHeight": 10,
+        "minVizWidth": 0,
+        "namePlacement": "auto",
+        "orientation": "horizontal",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -1918,9 +2379,9 @@
           "fields": "",
           "values": false
         },
-        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
+        "showUnfilled": true,
+        "sizing": "auto",
+        "valueMode": "color"
       },
       "pluginVersion": "10.4.17",
       "targets": [
@@ -1930,92 +2391,2507 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "(sum(rox_sensor_virtual_machine_index_report_enqueue_blocked_total) / sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count)) * 100",
-          "legendFormat": "Block Rate",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"32\"}[$__range]))",
+          "legendFormat": "\u226432s",
           "range": true,
           "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"128\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"32\"}[$__range]))",
+          "legendFormat": "32-128s",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"256\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"128\"}[$__range]))",
+          "legendFormat": "128-256s",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"512\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"256\"}[$__range]))",
+          "legendFormat": "256-512s",
+          "range": true,
+          "refId": "D"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"1024\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"512\"}[$__range]))",
+          "legendFormat": "512-1024s",
+          "range": true,
+          "refId": "E"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"2048\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"1024\"}[$__range]))",
+          "legendFormat": "1024-2048s",
+          "range": true,
+          "refId": "F"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"4096\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"2048\"}[$__range]))",
+          "legendFormat": "2048-4096s",
+          "range": true,
+          "refId": "G"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"8192\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"4096\"}[$__range]))",
+          "legendFormat": "4096-8192s",
+          "range": true,
+          "refId": "H"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"16384\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"8192\"}[$__range]))",
+          "legendFormat": "8192-16384s",
+          "range": true,
+          "refId": "I"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"+Inf\"}[$__range])) - sum(increase(rox_sensor_vsock_pull_schedule_offset_seconds_bucket{le=\"16384\"}[$__range]))",
+          "legendFormat": ">16384s (~4.5h)",
+          "range": true,
+          "refId": "J"
         }
       ],
-      "title": "🚫 Enqueue Block Rate",
-      "type": "gauge"
+      "title": "Schedule offset distribution",
+      "type": "bargauge"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 55
+      },
+      "id": 400,
+      "panels": [],
+      "title": "Retries and NACKs",
+      "type": "row"
     },
     {
       "datasource": {
         "type": "prometheus",
         "uid": "${datasource}"
       },
-      "description": "Percentage of processed reports where VM was unknown to sensor",
+      "description": "Rate of scrape results across the three layered counters (transport, GetReport, scrape). success = new report sent to Central. unchanged = agent had nothing new. The rest are errors (dial, timeout, not_ready, busy, and so on). Retryable errors should continue at backoff, not at 1 per tick for the whole fleet.",
       "fieldConfig": {
         "defaults": {
           "color": {
-            "mode": "thresholds"
+            "mode": "palette-classic"
           },
-          "mappings": [],
-          "max": 100,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "pulls/s",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 40,
+            "gradientMode": "opacity",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "success"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "unchanged"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "dial_error"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "timeout"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "read_error"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "not_ready"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "yellow",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "busy"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "yellow",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "send_error"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "invalid_report"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "unknown_method"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "abnormal_close"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "unexpected"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "internal_error"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "yellow",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "unknown_agent_error"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "yellow",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "malformed_request"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "request_too_large"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 16,
+        "x": 0,
+        "y": 56
+      },
+      "id": 401,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "10.4.17",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum by (status) (rate(rox_sensor_vsock_pull_transport_total[$__rate_interval]) or rate(rox_sensor_vsock_pull_get_report_total[$__rate_interval]) or rate(rox_sensor_vsock_pull_scrape_total[$__rate_interval]))",
+          "legendFormat": "{{status}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Pull outcomes by status",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Rate of Central acknowledgements. NACKs with ongoing success means Sensor is resending full reports after a reject. The NACK reason is in Central logs.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "acks/s",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 20,
+            "gradientMode": "opacity",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "ACK"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "NACK"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 16,
+        "y": 56
+      },
+      "id": 402,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "10.4.17",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum by (action) (rate(rox_sensor_virtual_machine_index_report_acks_received_total[$__rate_interval]))",
+          "legendFormat": "{{action}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "ACK vs NACK",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Good pulls (success + unchanged) versus retryable errors versus permanent failures. A retryable stack as large as fleet times 1/tick is a tight loop, not backoff.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "pulls/s",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 40,
+            "gradientMode": "opacity",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "success+unchanged"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "retryable errors"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "orange",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "permanent failures"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 16,
+        "x": 0,
+        "y": 64
+      },
+      "id": 403,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "10.4.17",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(rox_sensor_vsock_pull_scrape_total{status=\"success\"}[$__rate_interval]) or rate(rox_sensor_vsock_pull_get_report_total{status=\"unchanged\"}[$__rate_interval]))",
+          "legendFormat": "success+unchanged",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(rox_sensor_vsock_pull_transport_total{status=~\"dial_error|timeout|read_error|abnormal_close|unexpected\"}[$__rate_interval]) or rate(rox_sensor_vsock_pull_get_report_total{status=~\"not_ready|busy|internal_error|unknown_agent_error\"}[$__rate_interval]) or rate(rox_sensor_vsock_pull_scrape_total{status=\"send_error\"}[$__rate_interval]))",
+          "legendFormat": "retryable errors",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(rox_sensor_vsock_pull_scrape_total{status=\"invalid_report\"}[$__rate_interval]) or rate(rox_sensor_vsock_pull_get_report_total{status=~\"unknown_method|malformed_request|request_too_large\"}[$__rate_interval]))",
+          "legendFormat": "permanent failures",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Retryable errors vs success+unchanged",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Running totals of Central ACK vs NACK. A climbing NACK line plus continued success is retry-after-reject, not a silent stall.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "opacity",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
                 "value": null
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "ACK"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "NACK"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 16,
+        "y": 64
+      },
+      "id": 404,
+      "options": {
+        "legend": {
+          "calcs": [
+            "mean",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "10.4.17",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rox_sensor_virtual_machine_index_report_acks_received_total{action=\"ACK\"})",
+          "legendFormat": "ACK",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rox_sensor_virtual_machine_index_report_acks_received_total{action=\"NACK\"})",
+          "legendFormat": "NACK",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "ACK / NACK cumulative",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": true,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 72
+      },
+      "id": 500,
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Time to connect to the agent, time to read the report, and end-to-end (dial + read + send). A high read P99 with a healthy dial points at a slow agent, not a VSOCK connect problem. Total is only recorded on successful forwards.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "seconds",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "s"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 16,
+            "x": 0,
+            "y": 73
+          },
+          "id": 501,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_dial_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "dial P50",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_dial_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "dial P95",
+              "range": true,
+              "refId": "B"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_read_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "read P50",
+              "range": true,
+              "refId": "C"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_read_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "read P95",
+              "range": true,
+              "refId": "D"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_total_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "total P50",
+              "range": true,
+              "refId": "E"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_total_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "total P95",
+              "range": true,
+              "refId": "F"
+            }
+          ],
+          "title": "Pull latency: dial / read / total",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "How long a tick spent waiting on the scrapes it started. If this sits well above the configured tick (default 10s), the ticker is falling behind and the due pile can grow even when the start cap is 1 per tick.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "tick",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "s"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P50"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P95"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "orange",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 8,
+            "x": 16,
+            "y": 73
+          },
+          "id": 502,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_tick_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "P50",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_tick_duration_seconds_bucket[$__rate_interval])))",
+              "legendFormat": "P95",
+              "range": true,
+              "refId": "B"
+            }
+          ],
+          "title": "Tick duration",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Size of forwarded reports (not unchanged pulls). Watch this against the 16MB response ceiling. Climbing multi-MB P95 is early warning before rejects.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "bytes",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "bytes"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P50"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P90"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "yellow",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P95"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "orange",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P99"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 8,
+            "x": 0,
+            "y": 81
+          },
+          "id": 503,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_report_bytes_bucket[$__rate_interval])))",
+              "legendFormat": "P50",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_report_bytes_bucket[$__rate_interval])))",
+              "legendFormat": "P95",
+              "range": true,
+              "refId": "B"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.99, sum by (le) (rate(rox_sensor_vsock_pull_report_bytes_bucket[$__rate_interval])))",
+              "legendFormat": "P99",
+              "range": true,
+              "refId": "C"
+            }
+          ],
+          "title": "Report payload bytes",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Package count in forwarded reports. Use with payload bytes when a report is oversized.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "packages",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
               },
+              "unit": "short"
+            },
+            "overrides": [
               {
-                "color": "yellow",
-                "value": 5
+                "matcher": {
+                  "id": "byName",
+                  "options": "P50"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
               },
               {
-                "color": "orange",
-                "value": 10
+                "matcher": {
+                  "id": "byName",
+                  "options": "P90"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "yellow",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
               },
               {
-                "color": "red",
-                "value": 20
+                "matcher": {
+                  "id": "byName",
+                  "options": "P95"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "orange",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P99"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
               }
             ]
           },
-          "unit": "percent"
+          "gridPos": {
+            "h": 8,
+            "w": 8,
+            "x": 8,
+            "y": 81
+          },
+          "id": 504,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_vsock_pull_report_packages_bucket[$__rate_interval])))",
+              "legendFormat": "P50",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_vsock_pull_report_packages_bucket[$__rate_interval])))",
+              "legendFormat": "P95",
+              "range": true,
+              "refId": "B"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.99, sum by (le) (rate(rox_sensor_vsock_pull_report_packages_bucket[$__rate_interval])))",
+              "legendFormat": "P99",
+              "range": true,
+              "refId": "C"
+            }
+          ],
+          "title": "Packages per report",
+          "type": "timeseries"
         },
-        "overrides": []
-      },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Tick rate should stay about 1 per tick interval. Starts-per-tick samples are fewer because idle ticks are omitted. A large gap between the two means most ticks had an empty due pile (steady state), not a broken histogram.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "ops"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "ticks"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "purple",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "starts-per-tick samples"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 8,
+            "x": 16,
+            "y": 81
+          },
+          "id": 505,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "rate(rox_sensor_vsock_pull_ticks_total[$__rate_interval])",
+              "legendFormat": "ticks",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "rate(rox_sensor_vsock_pull_starts_per_tick_count[$__rate_interval])",
+              "legendFormat": "starts-per-tick samples",
+              "range": true,
+              "refId": "B"
+            }
+          ],
+          "title": "Ticks vs starts-per-tick samples",
+          "type": "timeseries"
+        }
+      ],
+      "title": "Pull latency and payload",
+      "type": "row"
+    },
+    {
+      "collapsed": true,
       "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 18,
-        "y": 43
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 73
       },
-      "id": 16,
-      "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
+      "id": 600,
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "After a successful pull, Handler sends to Central. This is dequeue/send outcomes (success, unknown VM, and so on), not the scrape scheduler.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 40,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "normal"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "ops"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "success"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "vm_unknown_to_sensor"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "orange",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "invalid_vsock_cid"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "nil_report"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "yellow",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 74
+          },
+          "id": 601,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (outcome) (rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count[$__rate_interval]))",
+              "legendFormat": "{{outcome}}",
+              "range": true,
+              "refId": "A"
+            }
           ],
-          "fields": "",
-          "values": false
+          "title": "Handler processing rate by outcome",
+          "type": "timeseries"
         },
-        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
-      },
-      "pluginVersion": "10.4.17",
-      "targets": [
         {
           "datasource": {
             "type": "prometheus",
             "uid": "${datasource}"
           },
-          "editorMode": "code",
-          "expr": "(sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count{outcome=\"vm_unknown_to_sensor\"}) / sum(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_count)) * 100",
-          "legendFormat": "Unknown VM Rate",
-          "range": true,
-          "refId": "A"
+          "description": "Handler's send counter. If this diverges from pull success, the scrape worked but enqueue/send did not.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 20,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "ops"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "success"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "error"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 74
+          },
+          "id": 602,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (status) (rate(rox_sensor_virtual_machine_index_reports_sent_total[$__rate_interval]))",
+              "legendFormat": "{{status}}",
+              "range": true,
+              "refId": "A"
+            }
+          ],
+          "title": "Handler reports sent to Central",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Time spent waiting because the Handler channel was full. Spreading should keep this near zero. Rising P95 means Central/Handler cannot drain as fast as VMScraper forwards.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "ms"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P50"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P90"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "yellow",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P95"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "orange",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P99"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 82
+          },
+          "id": 603,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])))",
+              "legendFormat": "P50",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.90, sum by (le) (rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])))",
+              "legendFormat": "P90",
+              "range": true,
+              "refId": "B"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])))",
+              "legendFormat": "P95",
+              "range": true,
+              "refId": "C"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.99, sum by (le) (rate(rox_sensor_virtual_machine_index_report_blocking_enqueue_duration_milliseconds_bucket[$__rate_interval])))",
+              "legendFormat": "P99",
+              "range": true,
+              "refId": "D"
+            }
+          ],
+          "title": "Handler blocking enqueue percentiles",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "How often that channel was full. A climb is Handler/Central backpressure, not a due-pile dump by itself.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "short"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "blocked/s"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "orange",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "blocked total"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 82
+          },
+          "id": 604,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(rox_sensor_virtual_machine_index_report_enqueue_blocked_total[$__rate_interval]))",
+              "legendFormat": "blocked/s",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rox_sensor_virtual_machine_index_report_enqueue_blocked_total)",
+              "legendFormat": "blocked total",
+              "range": true,
+              "refId": "B"
+            }
+          ],
+          "title": "Enqueue blocked count",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Time from dequeue to a successful Central send. Spikes here can fill the enqueue channel even when scrape spreading is healthy.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "smooth",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "ms"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P50"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "green",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P90"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "yellow",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P95"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "orange",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "P99"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 24,
+            "x": 0,
+            "y": 90
+          },
+          "id": 605,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "pluginVersion": "10.4.17",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.50, sum by (le) (rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])))",
+              "legendFormat": "P50",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.90, sum by (le) (rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])))",
+              "legendFormat": "P90",
+              "range": true,
+              "refId": "B"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])))",
+              "legendFormat": "P95",
+              "range": true,
+              "refId": "C"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.99, sum by (le) (rate(rox_sensor_virtual_machine_index_report_processing_duration_milliseconds_bucket{outcome=\"success\"}[$__rate_interval])))",
+              "legendFormat": "P99",
+              "range": true,
+              "refId": "D"
+            }
+          ],
+          "title": "Handler processing duration (success)",
+          "type": "timeseries"
         }
       ],
-      "title": "❓ Unknown VM Rate",
-      "type": "gauge"
+      "title": "Forward to Central (handler)",
+      "type": "row"
     }
   ],
   "refresh": "30s",
@@ -2024,7 +4900,8 @@
     "stackrox",
     "sensor",
     "virtual-machine",
-    "index-report"
+    "index-report",
+    "vmscraper"
   ],
   "templating": {
     "list": [
@@ -2050,13 +4927,13 @@
     ]
   },
   "time": {
-    "from": "now-15m",
+    "from": "now-6h",
     "to": "now"
   },
   "timepicker": {},
   "timezone": "browser",
   "title": "VM Index Report - Sensor Metrics",
   "uid": "vm-index-report-sensor",
-  "version": 8,
+  "version": 9,
   "weekStart": ""
-}
\ No newline at end of file
+}
diff --git a/deploy/charts/monitoring/templates/prometheus.yaml b/deploy/charts/monitoring/templates/prometheus.yaml
index 0f81a5b2835c9..849f65facc268 100644
--- a/deploy/charts/monitoring/templates/prometheus.yaml
+++ b/deploy/charts/monitoring/templates/prometheus.yaml
@@ -58,6 +58,28 @@ data:
 {{ toYaml .Values.cadvisorMetricRelabelConfigs | indent 10 }}
 {{- end }}
 
+      # Kubelet /metrics exposes kubelet_volume_stats_* (PVC used/capacity),
+      # which cadvisor does not. Used for central-db and scanner-v4-db PVC space
+      # alerting.
+      - job_name: "kubernetes-kubelet"
+        scheme: https
+        metrics_path: /metrics
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          insecure_skip_verify: true
+        authorization:
+          credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+        kubernetes_sd_configs:
+          - role: node
+        relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+        metric_relabel_configs:
+          # Keep only the StackRox DB PVC volume stats needed for space alerting.
+          - source_labels: [__name__, persistentvolumeclaim]
+            action: keep
+            regex: kubelet_volume_stats_(used|capacity)_bytes;(central-db|{{ .Values.scannerV4DbPvcClaimName | regexQuoteMeta }})
+
       - job_name: stackrox
         tls_config:
           insecure_skip_verify: false
@@ -109,3 +131,55 @@ data:
           annotations:
             summary: Kubernetes ReplicaSet mismatch (replicaset {{ "{{" }} $labels.replicaset {{ "}}" }})
             description: "Replicas mismatch in ReplicaSet {{ "{{" }} $labels.exported_namespace {{ "}}" }}/{{ "{{" }} $labels.replicaset {{ "}}" }}"
+
+  rules_alerts_stackrox.yml: |-
+    groups:
+    - name: StackRox
+      rules:
+        # Central DB PVC space utilization (used / filesystem capacity) from the
+        # kubelet volume stats. Exposed as a stable metric for dashboards and
+        # reused by the alerts below.
+        - record: stackrox:central_db_pvc_usage_ratio
+          expr: kubelet_volume_stats_used_bytes{persistentvolumeclaim="central-db"} / kubelet_volume_stats_capacity_bytes{persistentvolumeclaim="central-db"}
+
+        - alert: StackRoxCentralDbPvcSpaceWarning
+          expr: stackrox:central_db_pvc_usage_ratio > {{ .Values.centralDbPvcUsageWarningRatio }}
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: Central DB PVC filling up (pvc {{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }})
+            description: "Central DB PVC {{ "{{" }} $labels.namespace {{ "}}" }}/{{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full."
+
+        - alert: StackRoxCentralDbPvcSpaceCritical
+          expr: stackrox:central_db_pvc_usage_ratio > {{ .Values.centralDbPvcUsageCriticalRatio }}
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: Central DB PVC almost full (pvc {{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }})
+            description: "Central DB PVC {{ "{{" }} $labels.namespace {{ "}}" }}/{{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full."
+
+        # Scanner V4 DB PVC space utilization (used / filesystem capacity) from the
+        # kubelet volume stats. Exposed as a stable metric for dashboards and
+        # reused by the alerts below.
+        - record: stackrox:scanner_v4_db_pvc_usage_ratio
+          expr: kubelet_volume_stats_used_bytes{persistentvolumeclaim={{ .Values.scannerV4DbPvcClaimName | quote }}} / kubelet_volume_stats_capacity_bytes{persistentvolumeclaim={{ .Values.scannerV4DbPvcClaimName | quote }}}
+
+        - alert: StackRoxScannerV4DbPvcSpaceWarning
+          expr: stackrox:scanner_v4_db_pvc_usage_ratio > {{ .Values.scannerV4DbPvcUsageWarningRatio }}
+          for: 1h
+          labels:
+            severity: warning
+          annotations:
+            summary: Scanner V4 DB PVC filling up (pvc {{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }})
+            description: "Scanner V4 DB PVC {{ "{{" }} $labels.namespace {{ "}}" }}/{{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full."
+
+        - alert: StackRoxScannerV4DbPvcSpaceCritical
+          expr: stackrox:scanner_v4_db_pvc_usage_ratio > {{ .Values.scannerV4DbPvcUsageCriticalRatio }}
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: Scanner V4 DB PVC almost full (pvc {{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }})
+            description: "Scanner V4 DB PVC {{ "{{" }} $labels.namespace {{ "}}" }}/{{ "{{" }} $labels.persistentvolumeclaim {{ "}}" }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full."
diff --git a/deploy/charts/monitoring/values.yaml b/deploy/charts/monitoring/values.yaml
index 2b644d260b240..e84192fbcfc43 100644
--- a/deploy/charts/monitoring/values.yaml
+++ b/deploy/charts/monitoring/values.yaml
@@ -27,6 +27,19 @@ nodeSelector: {}
 # Metric relabel configs for kubernetes-cadvisor job to filter out metrics
 cadvisorMetricRelabelConfigs: []
 
+# Central DB PVC space-usage alerting. Utilization is used/capacity from the
+# kubelet volume stats (scraped by the kubernetes-kubelet job). The warning and
+# critical alerts fire when the central-db PVC exceeds these fill ratios.
+centralDbPvcUsageWarningRatio: 0.8
+centralDbPvcUsageCriticalRatio: 0.9
+
+# Scanner V4 DB PVC space-usage alerting. Same mechanism as central-db above; the
+# warning and critical alerts fire when this PVC exceeds these fill ratios.
+# Match scannerV4.db.persistence.persistentVolumeClaim.claimName in the Central chart.
+scannerV4DbPvcClaimName: scanner-v4-db
+scannerV4DbPvcUsageWarningRatio: 0.8
+scannerV4DbPvcUsageCriticalRatio: 0.9
+
 kube-state-metrics:
   releaseNamespace: true
   # Align with the parent monitoring Deployment UIDs. Upstream defaults use
diff --git a/deploy/common/ci-values.yaml b/deploy/common/ci-values.yaml
index 1f311fb93d713..cf0dfe7fc85d4 100644
--- a/deploy/common/ci-values.yaml
+++ b/deploy/common/ci-values.yaml
@@ -23,9 +23,13 @@ scannerV4:
     replicas: 1
     autoscaling:
       disable: true
+    # 4Gi aims at covering the rhel-vex cold-import peak that OOMs at the original 3Gi Helm default.
     resources:
       requests:
         cpu: "400m"
+        memory: "6Gi"
+      limits:
+        memory: "6Gi"
   indexer:
     replicas: 1
     autoscaling:
diff --git a/deploy/common/deploy.sh b/deploy/common/deploy.sh
index 39be0003ffe1b..f4bfce7728b87 100755
--- a/deploy/common/deploy.sh
+++ b/deploy/common/deploy.sh
@@ -27,22 +27,6 @@ echo "StackRox central db image tag set to $CENTRAL_DB_IMAGE_TAG"
 export CENTRAL_DB_IMAGE="${CENTRAL_DB_IMAGE:-${CENTRAL_DB_IMAGE_REPO}:${CENTRAL_DB_IMAGE_TAG}}"
 echo "StackRox central db image set to $CENTRAL_DB_IMAGE"
 
-export SCANNER_IMAGE_REPO="${SCANNER_IMAGE_REPO:-$DEFAULT_IMAGE_REGISTRY/scanner}"
-echo "SCANNER_IMAGE_REPO set to $SCANNER_IMAGE_REPO"
-
-SCANNER_IMAGE_TAG=$(make --quiet --no-print-directory -C "$(git rev-parse --show-toplevel)" scanner-tag)
-export SCANNER_IMAGE_TAG
-echo "SCANNER_IMAGE_TAG set to $SCANNER_IMAGE_TAG"
-
-export SCANNER_IMAGE="${SCANNER_IMAGE:-${SCANNER_IMAGE_REPO}:${SCANNER_IMAGE_TAG}}"
-echo "SCANNER_IMAGE image set to $SCANNER_IMAGE"
-
-export SCANNER_DB_IMAGE_REPO="${SCANNER_DB_IMAGE_REPO:-$DEFAULT_IMAGE_REGISTRY/scanner-db}"
-echo "SCANNER_DB_IMAGE_REPO set to $SCANNER_DB_IMAGE_REPO"
-
-export SCANNER_DB_IMAGE="${SCANNER_DB_IMAGE:-${SCANNER_DB_IMAGE_REPO}:${SCANNER_IMAGE_TAG}}"
-echo "SCANNER_DB_IMAGE image set to $SCANNER_DB_IMAGE"
-
 export ROXCTL_IMAGE_REPO="${ROXCTL_IMAGE_REPO:-$DEFAULT_IMAGE_REGISTRY/roxctl}"
 echo "ROXCTL_IMAGE_REPO set to $ROXCTL_IMAGE_REPO"
 
diff --git a/deploy/common/env.sh b/deploy/common/env.sh
index e4531d5698095..0b50d6c1d6ac6 100644
--- a/deploy/common/env.sh
+++ b/deploy/common/env.sh
@@ -88,12 +88,18 @@ echo "ROX_DECLARATIVE_CONFIGURATION is set to ${ROX_DECLARATIVE_CONFIGURATION}"
 export ROX_MANAGED_CENTRAL="${ROX_MANAGED_CENTRAL:-false}"
 echo "ROX_MANAGED_CENTRAL is set to ${ROX_MANAGED_CENTRAL}"
 
+# central-worker is enabled by default in the central-services chart. Disabling it is only
+# possible through Helm values, which the kubectl output format does not support.
+export ROX_CENTRAL_WORKER_ENABLED="${ROX_CENTRAL_WORKER_ENABLED:-true}"
+echo "ROX_CENTRAL_WORKER_ENABLED is set to ${ROX_CENTRAL_WORKER_ENABLED}"
+if [[ "${ROX_CENTRAL_WORKER_ENABLED}" == "false" && "${OUTPUT_FORMAT}" != "helm" ]]; then
+  echo "ROX_CENTRAL_WORKER_ENABLED=false requires OUTPUT_FORMAT=helm, overriding"
+  export OUTPUT_FORMAT="helm"
+fi
+
 export SENSOR_DEV_RESOURCES="${SENSOR_DEV_RESOURCES:-true}"
 echo "SENSOR_DEV_RESOURCES is set to ${SENSOR_DEV_RESOURCES}"
 
-export SENSOR_SCANNER_SUPPORT="${SENSOR_SCANNER_SUPPORT:-false}"
-echo "SENSOR_SCANNER_SUPPORT is set to ${SENSOR_SCANNER_SUPPORT}"
-
 export SENSOR_SCANNER_V4_SUPPORT="${SENSOR_SCANNER_V4_SUPPORT:-false}"
 echo "SENSOR_SCANNER_V4_SUPPORT is set to ${SENSOR_SCANNER_V4_SUPPORT}"
 
diff --git a/deploy/common/feature-flag-env.sh b/deploy/common/feature-flag-env.sh
new file mode 100644
index 0000000000000..0113a4b415578
--- /dev/null
+++ b/deploy/common/feature-flag-env.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# ROX_SCANNER_V4 and ROX_LEGACY_SCANNER are not ordinary feature-flag env.
+# The Central Helm chart already writes them onto the Central container from
+# scannerV4 / scanner config (01-central-13-deployment.yaml.htpl). Helm
+# customize.central.envVars is rendered by srox.envVars, which appends to
+# that list, so injecting the same name produces a second env entry.
+# Kubernetes keeps both (last wins at runtime), but kubectl apply cannot
+# patch a Deployment that has duplicate env names, and tests that expect a
+# single value fail. Scanner V4 / legacy scanner still follow the chart
+# values; this skip only avoids copying the env name twice.
+# Kubectl inject does not skip these flags: generated manifests omit those
+# names, and kubectl set env --local overwrites by name.
+is_helm_owned_feature_flag() {
+    case "$1" in
+        ROX_SCANNER_V4 | ROX_LEGACY_SCANNER) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# omit_helm_owned_feature_flags drops Helm-owned scanner flags from a stream
+# of VAR=value lines. Use on the Helm inject path only.
+omit_helm_owned_feature_flags() {
+    local assignment var
+    while IFS= read -r assignment; do
+        [[ -z "${assignment}" ]] && continue
+        var="${assignment%%=*}"
+        if is_helm_owned_feature_flag "${var}"; then
+            continue
+        fi
+        printf '%s\n' "${assignment}"
+    done
+}
+
+# feature_flag_env_assignments prints VAR=value for every pkg/features flag
+# that is set and non-empty in this process. Release roxctl generate does not
+# copy these into the bundle; callers apply them to Central after generate.
+feature_flag_env_assignments() {
+    local list_file="$1"
+    local var
+
+    if [[ ! -f "${list_file}" ]]; then
+        echo >&2 "WARNING: feature flag list ${list_file} not found; Central will not receive feature-flag env"
+        return 0
+    fi
+
+    while IFS= read -r var; do
+        if [[ -n "${!var:-}" ]]; then
+            printf '%s=%s\n' "${var}" "${!var}"
+        fi
+    done < <(grep -oE '"ROX_[A-Z0-9_]+"' "${list_file}" | tr -d '"' | sort -u)
+}
diff --git a/deploy/common/k8sbased.sh b/deploy/common/k8sbased.sh
index 256a4ef972363..a205b6eb430f2 100644
--- a/deploy/common/k8sbased.sh
+++ b/deploy/common/k8sbased.sh
@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 
+# shellcheck source=./feature-flag-env.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/feature-flag-env.sh"
+
 function realpath {
 	[[ -n "$1" ]] || return 0
 	python3 -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$1"
@@ -221,8 +224,6 @@ function launch_central {
     add_args -i "${MAIN_IMAGE}"
 
     add_args "--central-db-image=${CENTRAL_DB_IMAGE}"
-    add_args "--scanner-image=${SCANNER_IMAGE}"
-    add_args "--scanner-db-image=${SCANNER_DB_IMAGE}"
 
     add_args "--image-defaults=${ROXCTL_ROX_IMAGE_FLAVOR}"
 
@@ -321,6 +322,9 @@ function launch_central {
           --set persistence.type="${STORAGE}"
           --set exposure.type="${MONITORING_LOAD_BALANCER}"
         )
+        if [[ -n "${SCANNER_V4_DB_CLAIM_NAME:-}" ]]; then
+          helm_args+=(--set-string "scannerV4DbPvcClaimName=${SCANNER_V4_DB_CLAIM_NAME}")
+        fi
         if [[ "${is_local_dev}" == "true" ]]; then
           helm_args+=(-f "${COMMON_DIR}/monitoring-values-local.yaml")
         fi
@@ -343,6 +347,16 @@ function launch_central {
     ${KUBE_COMMAND:-kubectl} get namespace "${central_namespace}" &>/dev/null || \
       ${KUBE_COMMAND:-kubectl} create namespace "${central_namespace}"
 
+    # Release roxctl generate omits feature-flag env from the bundle. Copy
+    # whatever is set in this process onto Central so CI/dev overrides apply.
+    local feature_flag_list_file
+    feature_flag_list_file="$(realpath "${common_dir}/../../pkg/features/list.go")"
+    local feature_flag_env=()
+    local _ff_assignment
+    while IFS= read -r _ff_assignment; do
+        feature_flag_env+=("${_ff_assignment}")
+    done < <(feature_flag_env_assignments "${feature_flag_list_file}")
+
     if [[ -f "$unzip_dir/values-public.yaml" ]]; then
       echo "Deploying central using Helm..."
       if [[ -n "${REGISTRY_USERNAME}" ]]; then
@@ -356,10 +370,6 @@ function launch_central {
       if [[ "${central_namespace}" != "stackrox" ]]; then
         helm_args+=(--set "allowNonstandardNamespace=true")
       fi
-      if [[ "$SCANNER_SUPPORT" != "true" ]]; then
-        helm_args+=(--set scanner.disable=true)
-      fi
-
       if [[ "${CGO_CHECKS}" == "true" ]]; then
         echo "CGO_CHECKS set to true. Setting GOEXPERIMENT=cgocheck2 and MUTEX_WATCHDOG_TIMEOUT_SECS=15"
         # Extend mutex watchdog timeout because cgochecks hamper performance
@@ -381,6 +391,28 @@ function launch_central {
         )
       fi
 
+      # Shorten signing key watcher poll for e2e tests (production default is 4h).
+      helm_args+=(--set customize.central.envVars.ROX_REDHAT_SIGNING_KEY_WATCH_INTERVAL=5s)
+
+      # Skip ROX_SCANNER_V4 / ROX_LEGACY_SCANNER: the chart already sets them
+      # from scanner config; customize.envVars would add a duplicate env name.
+      # See is_helm_owned_feature_flag in feature-flag-env.sh.
+      local helm_feature_flag_env=()
+      if (( ${#feature_flag_env[@]} > 0 )); then
+        while IFS= read -r _ff_assignment; do
+          helm_feature_flag_env+=("${_ff_assignment}")
+        done < <(printf '%s\n' "${feature_flag_env[@]}" | omit_helm_owned_feature_flags)
+      fi
+      if (( ${#helm_feature_flag_env[@]} > 0 )); then
+        echo "Injecting feature flag env into Central: ${helm_feature_flag_env[*]}"
+        local _ff_var _ff_val
+        for _ff_assignment in "${helm_feature_flag_env[@]}"; do
+          _ff_var="${_ff_assignment%%=*}"
+          _ff_val="${_ff_assignment#*=}"
+          helm_args+=(--set-string "customize.central.envVars.${_ff_var}=${_ff_val}")
+        done
+      fi
+
       if [[ -n "$POD_SECURITY_POLICIES" ]]; then
         helm_args+=(
           --set system.enablePodSecurityPolicies="${POD_SECURITY_POLICIES}"
@@ -428,6 +460,12 @@ function launch_central {
         fi
       fi
 
+      if [[ -n "${ROX_CENTRAL_WORKER_ENABLED:-}" ]]; then
+        helm_args+=(
+          --set "centralWorker.enabled=${ROX_CENTRAL_WORKER_ENABLED}"
+        )
+      fi
+
       if [[ -n "$EXTERNAL_DB" ]]; then
           helm_args+=(
             --set "central.db.password.value=${EXTERNAL_DB_PASSWORD}"
@@ -480,6 +518,9 @@ function launch_central {
       if [[ -n "${SCANNER_V4_DB_STORAGE_CLASS}" ]]; then
         helm_args+=(--set "scannerV4.db.persistence.persistentVolumeClaim.storageClass=${SCANNER_V4_DB_STORAGE_CLASS}")
       fi
+      if [[ -n "${SCANNER_V4_DB_CLAIM_NAME:-}" ]]; then
+        helm_args+=(--set-string "scannerV4.db.persistence.persistentVolumeClaim.claimName=${SCANNER_V4_DB_CLAIM_NAME}")
+      fi
 
       # Add a custom values file to Helm
       if [[ -n "$ROX_CENTRAL_EXTRA_HELM_VALUES_FILE" ]]; then
@@ -500,6 +541,24 @@ function launch_central {
         ROX_NAMESPACE="${central_namespace}" "${unzip_dir}/central/scripts/setup.sh"
       fi
       central_scripts_dir="$unzip_dir/central/scripts"
+
+      # Shorten signing key watcher poll for e2e tests (production default is 4h).
+      # Bake it into the manifest so Central starts with fast polling instead of
+      # requiring a second rollout via a post-launch `set env`.
+      central_deployment="${unzip_dir}/central/01-central-13-deployment.yaml"
+      if [[ -f "${central_deployment}" ]]; then
+        local central_env=(ROX_REDHAT_SIGNING_KEY_WATCH_INTERVAL=5s)
+        if (( ${#feature_flag_env[@]} > 0 )); then
+          echo "Injecting feature flag env into Central: ${feature_flag_env[*]}"
+          central_env+=("${feature_flag_env[@]}")
+        fi
+        ${ORCH_CMD} set env --local -o yaml -f "${central_deployment}" -c central \
+          "${central_env[@]}" > "${central_deployment}.tmp"
+        mv "${central_deployment}.tmp" "${central_deployment}"
+      else
+        echo >&2 "WARNING: ${central_deployment} not found; Central will deploy with the default signing key watch interval and rely on the test's set env fallback."
+      fi
+
       launch_service "${unzip_dir}" central
       echo
 
@@ -529,11 +588,6 @@ function launch_central {
       fi
 
       if [[ "$SCANNER_SUPPORT" == "true" ]]; then
-          echo "Deploying Scanner..."
-          if [[ -n "${REGISTRY_USERNAME}" ]]; then
-            "${unzip_dir}/scanner/scripts/setup.sh"
-          fi
-          launch_service "${unzip_dir}" scanner
           if [[ "${ROX_SCANNER_V4:-}" != "false" ]]; then
             if [[ -d "${unzip_dir}/scanner-v4" ]]; then
               echo "Deploying ScannerV4..."
@@ -570,14 +624,6 @@ function launch_central {
               echo >&2 "Possible reason for this: the roxctl in PATH does not support Scanner V4."
             fi
           fi
-
-          if [[ -n "$CI" ]]; then
-            ${ORCH_CMD} -n stackrox patch deployment scanner --patch "$(cat "${common_dir}/scanner-patch.yaml")"
-            ${ORCH_CMD} -n stackrox patch hpa scanner --patch "$(cat "${common_dir}/scanner-hpa-patch.yaml")"
-          elif [[ "${is_local_dev}" == "true" ]]; then
-            ${ORCH_CMD} -n stackrox patch deployment scanner --patch "$(cat "${common_dir}/scanner-local-patch.yaml")"
-            ${ORCH_CMD} -n stackrox patch hpa scanner --patch "$(cat "${common_dir}/scanner-hpa-patch.yaml")"
-          fi
           echo
       fi
     fi
@@ -595,7 +641,11 @@ function launch_central {
     # On some systems there's a race condition when port-forward connects to central but its pod then gets deleted due
     # to ongoing modifications to the central deployment. This port-forward dies and the script hangs "Waiting for
     # Central to respond" until it times out. Waiting for rollout status should help not get into such situation.
+    # Central-db is waited first because it needs to be online before Central can start.
     rollout_wait_timeout="10m"
+    if [[ -z "$EXTERNAL_DB" ]]; then
+        kubectl -n "${central_namespace}" rollout status deploy/central-db --timeout="${rollout_wait_timeout}"
+    fi
     kubectl -n "${central_namespace}" rollout status deploy/central --timeout="${rollout_wait_timeout}"
 
     # if we have specified that we want to use a load balancer, then use that endpoint instead of localhost
@@ -887,20 +937,17 @@ function launch_sensor {
         helm_args+=(--set "helmManaged=false")
       fi
 
-      if [[ "$SENSOR_SCANNER_SUPPORT" == "true" ]]; then
-        helm_args+=(--set scanner.disable=false)
-      fi
-
       if [[ "$SENSOR_SCANNER_V4_SUPPORT" == "true" ]]; then
         helm_args+=(--set scannerV4.disable=false)
       fi
 
       if [[ "${ROX_VIRTUAL_MACHINES:-}" == "true" ]]; then
-        # Enables Sensor VSOCK RBAC and ROX_VIRTUAL_MACHINES on Sensor.
         extra_helm_config+=(--set "virtualMachines.enabled=true")
-        # Shorten pull-mode scraper cadence for VM e2e (production default is 5m).
+        # Shorten pull-mode scraper cadence for VM e2e (production default is 4h).
         # Floor is 1m (vmscraper.clampPollInterval); values below that are raised to 1m.
         extra_helm_config+=(--set "customize.envVars.ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL=${ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL:-1m}")
+      elif [[ "${ROX_VIRTUAL_MACHINES:-}" == "false" ]]; then
+        extra_helm_config+=(--set "virtualMachines.enabled=false")
       fi
 
       if [[ -n "$LOGLEVEL" ]]; then
@@ -909,6 +956,12 @@ function launch_sensor {
         )
       fi
 
+      # Scan every 9-11 minutes with Helm deployments.
+      helm_args+=(
+        --set customize.envVars.ROX_NODE_SCANNING_INTERVAL=10m
+        --set customize.envVars.ROX_NODE_SCANNING_INTERVAL_DEVIATION=60s
+      )
+
       if [[ -n "${ROX_NETFLOW_BATCHING:-}" ]]; then
         helm_args+=(
           --set customize.envVars.ROX_NETFLOW_BATCHING="${ROX_NETFLOW_BATCHING}"
@@ -954,7 +1007,7 @@ function launch_sensor {
 
       if [[ "${sensor_namespace}" != "stackrox" ]]; then
         kubectl create namespace "${sensor_namespace}" &>/dev/null || true
-        kubectl -n "${sensor_namespace}" get secret stackrox &>/dev/null || kubectl -n "${sensor_namespace}" create -f - < <("${common_dir}/pull-secret.sh" stackrox docker.io)
+        kubectl -n "${sensor_namespace}" get secret stackrox &>/dev/null || kubectl -n "${sensor_namespace}" create -f - < <("${common_dir}/../../scripts/pull-secret.sh" stackrox docker.io)
       fi
 
       if [[ -n "${ROX_PROCESS_INDICATORS_PER_NAMESPACE}" ]]; then
@@ -1047,9 +1100,17 @@ function launch_sensor {
         sensor_env+=("ROX_NETFLOW_CACHE_LIMITING=${ROX_NETFLOW_CACHE_LIMITING}")
       fi
 
+      if [[ -n "${ROX_VIRTUAL_MACHINES:-}" ]]; then
+        sensor_env+=("ROX_VIRTUAL_MACHINES=${ROX_VIRTUAL_MACHINES}")
+      fi
+
       if [[ "${#sensor_env[@]}" -gt 0 ]]; then
         kubectl -n "${sensor_namespace}" set env deploy/sensor "${sensor_env[@]}"
       fi
+
+      # Scan every 9-11 minutes with manifest deployments.
+      kubectl -n "${sensor_namespace}" set env ds/collector --containers=compliance \
+        ROX_NODE_SCANNING_INTERVAL=10m ROX_NODE_SCANNING_INTERVAL_DEVIATION=60s
     fi
 
     collector_env=()
diff --git a/deploy/common/local-dev-values.yaml b/deploy/common/local-dev-values.yaml
index 2a834c5b34d1b..25b8701ab94cb 100644
--- a/deploy/common/local-dev-values.yaml
+++ b/deploy/common/local-dev-values.yaml
@@ -56,23 +56,3 @@ scannerV4:
       limits:
         cpu: "1000m"
         memory: "2500Mi"
-
-scanner:
-  replicas: 1
-  autoscaling:
-    disable: true
-
-  resources:
-    requests:
-      memory: "500Mi"
-      cpu: "500m"
-    limits:
-      memory: "2500Mi"
-      cpu: "2000m"
-  dbResources:
-    requests:
-      cpu: "400m"
-      memory: "512Mi"
-    limits:
-      cpu: "2000m"
-      memory: "4Gi"
diff --git a/deploy/common/scanner-hpa-patch.yaml b/deploy/common/scanner-hpa-patch.yaml
deleted file mode 100644
index ef680ea967e8b..0000000000000
--- a/deploy/common/scanner-hpa-patch.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-spec:
-  minReplicas: 1
diff --git a/deploy/common/scanner-local-patch.yaml b/deploy/common/scanner-local-patch.yaml
deleted file mode 100644
index eb614fc564391..0000000000000
--- a/deploy/common/scanner-local-patch.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-spec:
-  replicas: 1
-  template:
-    spec:
-      containers:
-      - name: scanner
-        resources:
-          requests:
-            cpu: "250m"
-            memory: "500Mi"
-          limits:
-            cpu: null
-            memory: "2500Mi"
diff --git a/deploy/common/scanner-patch.yaml b/deploy/common/scanner-patch.yaml
deleted file mode 100644
index 9f295c35179c2..0000000000000
--- a/deploy/common/scanner-patch.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-spec:
-  replicas: 2
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index d431739141589..a9b091f08ccbd 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -3,13 +3,13 @@ set -e
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)"
 
-if [[ "${USE_ROXIE_DEPLOY:-false}" == "true" ]]; then
+if [[ "${USE_ROXIE_DEPLOY:-true}" == "true" ]]; then
     ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
     if [[ "${SKIP_ROXIE_DEPLOY_BANNER:-false}" != "true" ]]; then
         cat <<EOF
 ----------------------------------------------------------------------------------------
 Using roxie to deploy StackRox. 🎉
-If this is not intended, please unset USE_ROXIE_DEPLOY and re-run the deployment script.
+If this is not intended, please set USE_ROXIE_DEPLOY=false and re-run the deployment script.
 
 This is a limited shell wrapper leveraging roxie under the hood.
 In particular, you won't be able to configure feature flags by setting environment
@@ -49,12 +49,9 @@ fi
 
 cat <<EOF
 -------------------------------------------------------------------------------------
-USE_ROXIE_DEPLOY not enabled, using legacy flow to deploy StackRox
-Please consider setting
-
-    USE_ROXIE_DEPLOY=true
-
-to opt into roxie-based deployments.
+Using legacy flow to deploy StackRox (USE_ROXIE_DEPLOY=false).
+The legacy flow is deprecated and WILL BE REMOVED SOON. Please use the roxie-based deployment
+by unsetting USE_ROXIE_DEPLOY or setting it to true.
 
 You can find quick start instructions for roxie in:
 
diff --git a/generated/api/common/extended_rpc_status.pb.go b/generated/api/common/extended_rpc_status.pb.go
index 2e4fd515fed3f..1b98d4df7d216 100644
--- a/generated/api/common/extended_rpc_status.pb.go
+++ b/generated/api/common/extended_rpc_status.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/common/extended_rpc_status.proto
 
diff --git a/generated/api/integrations/splunk_service.pb.go b/generated/api/integrations/splunk_service.pb.go
index 78c283fc1e2fa..fb8e951bf08be 100644
--- a/generated/api/integrations/splunk_service.pb.go
+++ b/generated/api/integrations/splunk_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/integrations/splunk_service.proto
 
diff --git a/generated/api/v1/administration_events_service.pb.go b/generated/api/v1/administration_events_service.pb.go
index 43eeec241c05d..d9a59d764f8de 100644
--- a/generated/api/v1/administration_events_service.pb.go
+++ b/generated/api/v1/administration_events_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/administration_events_service.proto
 
diff --git a/generated/api/v1/administration_events_service.pb.gw.go b/generated/api/v1/administration_events_service.pb.gw.go
index 57855747ef4fb..fabc7317f3e53 100644
--- a/generated/api/v1/administration_events_service.pb.gw.go
+++ b/generated/api/v1/administration_events_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_AdministrationEventService_CountAdministrationEvents_0(ctx context.
 		protoReq CountAdministrationEventsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AdministrationEventService_CountAdministrationEvents_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountAdministrationEvents(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -76,9 +76,6 @@ func request_AdministrationEventService_GetAdministrationEvent_0(ctx context.Con
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -87,6 +84,9 @@ func request_AdministrationEventService_GetAdministrationEvent_0(ctx context.Con
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAdministrationEvent(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,15 +116,15 @@ func request_AdministrationEventService_ListAdministrationEvents_0(ctx context.C
 		protoReq ListAdministrationEventsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AdministrationEventService_ListAdministrationEvents_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListAdministrationEvents(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/administration_usage_service.pb.go b/generated/api/v1/administration_usage_service.pb.go
index 6e92409a7e7e3..8d53d6e5cd51f 100644
--- a/generated/api/v1/administration_usage_service.pb.go
+++ b/generated/api/v1/administration_usage_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/administration_usage_service.proto
 
diff --git a/generated/api/v1/administration_usage_service.pb.gw.go b/generated/api/v1/administration_usage_service.pb.gw.go
index 0889ec45c387c..b9dec12d1b966 100644
--- a/generated/api/v1/administration_usage_service.pb.gw.go
+++ b/generated/api/v1/administration_usage_service.pb.gw.go
@@ -63,15 +63,15 @@ func request_AdministrationUsageService_GetMaxSecuredUnitsUsage_0(ctx context.Co
 		protoReq TimeRange
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AdministrationUsageService_GetMaxSecuredUnitsUsage_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetMaxSecuredUnitsUsage(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/alert_service.pb.go b/generated/api/v1/alert_service.pb.go
index 3e23235d9c681..7c6cfa1d39954 100644
--- a/generated/api/v1/alert_service.pb.go
+++ b/generated/api/v1/alert_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/alert_service.proto
 
diff --git a/generated/api/v1/alert_service.pb.gw.go b/generated/api/v1/alert_service.pb.gw.go
index 07c4e44e552ba..1f46e3201bf5a 100644
--- a/generated/api/v1/alert_service.pb.gw.go
+++ b/generated/api/v1/alert_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_AlertService_GetAlert_0(ctx context.Context, marshaler runtime.Mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_AlertService_GetAlert_0(ctx context.Context, marshaler runtime.Mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAlert(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_AlertService_CountAlerts_0(ctx context.Context, marshaler runtime.M
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AlertService_CountAlerts_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountAlerts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,15 +116,15 @@ func request_AlertService_ListAlerts_0(ctx context.Context, marshaler runtime.Ma
 		protoReq ListAlertsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AlertService_ListAlerts_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListAlerts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -151,15 +151,15 @@ func request_AlertService_GetAlertsGroup_0(ctx context.Context, marshaler runtim
 		protoReq ListAlertsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AlertService_GetAlertsGroup_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAlertsGroup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -186,15 +186,15 @@ func request_AlertService_GetAlertsCounts_0(ctx context.Context, marshaler runti
 		protoReq GetAlertsCountsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AlertService_GetAlertsCounts_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAlertsCounts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -221,15 +221,15 @@ func request_AlertService_GetAlertTimeseries_0(ctx context.Context, marshaler ru
 		protoReq ListAlertsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AlertService_GetAlertTimeseries_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAlertTimeseries(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -258,9 +258,6 @@ func request_AlertService_ResolveAlert_0(ctx context.Context, marshaler runtime.
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -269,6 +266,9 @@ func request_AlertService_ResolveAlert_0(ctx context.Context, marshaler runtime.
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ResolveAlert(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -328,15 +328,15 @@ func request_AlertService_DeleteAlerts_0(ctx context.Context, marshaler runtime.
 		protoReq DeleteAlertsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AlertService_DeleteAlerts_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteAlerts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/alert_service.swagger.json b/generated/api/v1/alert_service.swagger.json
index 2134c2e45324b..5b418ad79e7fb 100644
--- a/generated/api/v1/alert_service.swagger.json
+++ b/generated/api/v1/alert_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "AlertService"
+      "name": "AlertService",
+      "description": "AlertService APIs can be used to manage alerts."
     }
   ],
   "consumes": [
@@ -762,6 +763,18 @@
         }
       }
     },
+    "ExclusionExcludeByKind": {
+      "type": "object",
+      "properties": {
+        "kinds": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ExclusionWorkloadKind"
+          }
+        }
+      },
+      "description": "ExcludeByKind excludes all workloads of the selected Kubernetes kinds."
+    },
     "ExclusionImage": {
       "type": "object",
       "properties": {
@@ -770,6 +783,16 @@
         }
       }
     },
+    "ExclusionWorkloadKind": {
+      "type": "string",
+      "enum": [
+        "WORKLOAD_KIND_UNSPECIFIED",
+        "CRON_JOB",
+        "JOB"
+      ],
+      "default": "WORKLOAD_KIND_UNSPECIFIED",
+      "description": "WorkloadKind is a Kubernetes workload kind that can be excluded from a policy in bulk."
+    },
     "FileAccessFileMetadata": {
       "type": "object",
       "properties": {
@@ -1294,15 +1317,18 @@
         "name": {
           "type": "string"
         },
-        "deployment": {
-          "$ref": "#/definitions/storageExclusionDeployment"
-        },
         "image": {
           "$ref": "#/definitions/ExclusionImage"
         },
         "expiration": {
           "type": "string",
           "format": "date-time"
+        },
+        "deployment": {
+          "$ref": "#/definitions/storageExclusionDeployment"
+        },
+        "excludeByKind": {
+          "$ref": "#/definitions/ExclusionExcludeByKind"
         }
       }
     },
@@ -1518,7 +1544,7 @@
         "NODE"
       ],
       "default": "DEPLOYMENT",
-      "title": "A special ListAlert-only enumeration of all resource types. Unlike Alert.Resource.ResourceType this also includes deployment and node as types\nThis must be kept in sync with Alert.Resource.ResourceType (excluding the deployment and node values)"
+      "description": "A special ListAlert-only enumeration of all resource types. Unlike Alert.Resource.ResourceType this also includes deployment and node as types\nThis must be kept in sync with Alert.Resource.ResourceType (excluding the deployment and node values)"
     },
     "storageNetworkEntityInfoType": {
       "type": "string",
@@ -1531,7 +1557,7 @@
         "INTERNAL_ENTITIES"
       ],
       "default": "UNKNOWN_TYPE",
-      "title": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
+      "description": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
     },
     "storagePolicy": {
       "type": "object",
@@ -1582,7 +1608,7 @@
             "type": "object",
             "$ref": "#/definitions/storageExclusion"
           },
-          "description": "Define deployments or images that should be excluded from this policy."
+          "description": "Define deployments, images, or workload kinds that should be excluded from this policy."
         },
         "scope": {
           "type": "array",
diff --git a/generated/api/v1/api_token_service.pb.go b/generated/api/v1/api_token_service.pb.go
index bf9a3a7a27e33..fc0a1e08254a5 100644
--- a/generated/api/v1/api_token_service.pb.go
+++ b/generated/api/v1/api_token_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/api_token_service.proto
 
diff --git a/generated/api/v1/api_token_service.pb.gw.go b/generated/api/v1/api_token_service.pb.gw.go
index ad7c42e56b2e6..dc9007767ffa3 100644
--- a/generated/api/v1/api_token_service.pb.gw.go
+++ b/generated/api/v1/api_token_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_APITokenService_GetAPIToken_0(ctx context.Context, marshaler runtim
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_APITokenService_GetAPIToken_0(ctx context.Context, marshaler runtim
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAPIToken(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_APITokenService_GetAPITokens_0(ctx context.Context, marshaler runti
 		protoReq GetAPITokensRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_APITokenService_GetAPITokens_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAPITokens(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -142,9 +142,6 @@ func request_APITokenService_RevokeToken_0(ctx context.Context, marshaler runtim
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -153,6 +150,9 @@ func request_APITokenService_RevokeToken_0(ctx context.Context, marshaler runtim
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.RevokeToken(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/api_token_service.swagger.json b/generated/api/v1/api_token_service.swagger.json
index 96a411c1f51bb..35fe471045723 100644
--- a/generated/api/v1/api_token_service.swagger.json
+++ b/generated/api/v1/api_token_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "APITokenService"
+      "name": "APITokenService",
+      "description": "APITokenService APIs can be used to manage API tokens."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/audit.pb.go b/generated/api/v1/audit.pb.go
index d6061d0c60a33..21ac701c05122 100644
--- a/generated/api/v1/audit.pb.go
+++ b/generated/api/v1/audit.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/audit.proto
 
diff --git a/generated/api/v1/auth_service.pb.go b/generated/api/v1/auth_service.pb.go
index a1a9293bb741a..f73e92a603e26 100644
--- a/generated/api/v1/auth_service.pb.go
+++ b/generated/api/v1/auth_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/auth_service.proto
 
diff --git a/generated/api/v1/auth_service.pb.gw.go b/generated/api/v1/auth_service.pb.gw.go
index e8c4600adf4ec..fea8409f5290c 100644
--- a/generated/api/v1/auth_service.pb.gw.go
+++ b/generated/api/v1/auth_service.pb.gw.go
@@ -83,9 +83,6 @@ func request_AuthService_GetAuthMachineToMachineConfig_0(ctx context.Context, ma
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -94,6 +91,9 @@ func request_AuthService_GetAuthMachineToMachineConfig_0(ctx context.Context, ma
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAuthMachineToMachineConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -152,9 +152,6 @@ func request_AuthService_UpdateAuthMachineToMachineConfig_0(ctx context.Context,
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["config.id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "config.id")
@@ -163,6 +160,9 @@ func request_AuthService_UpdateAuthMachineToMachineConfig_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "config.id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateAuthMachineToMachineConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -194,9 +194,6 @@ func request_AuthService_DeleteAuthMachineToMachineConfig_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -205,6 +202,9 @@ func request_AuthService_DeleteAuthMachineToMachineConfig_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteAuthMachineToMachineConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/auth_service.swagger.json b/generated/api/v1/auth_service.swagger.json
index fd3bc392d36ea..a4a0ca235ca17 100644
--- a/generated/api/v1/auth_service.swagger.json
+++ b/generated/api/v1/auth_service.swagger.json
@@ -370,7 +370,7 @@
           "additionalProperties": {
             "type": "string"
           },
-          "description": "Config holds auth provider specific configuration. Each configuration options\nare different based on the given auth provider type.\nOIDC:\n- \"issuer\": the OIDC issuer according to https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier.\n- \"client_id\": the client ID according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2.\n- \"client_secret\": the client secret according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3.1.\n- \"do_not_use_client_secret\": set to \"true\" if you want to create a configuration with only\n  a client ID and no client secret.\n- \"mode\": the OIDC callback mode, choosing from \"fragment\", \"post\", or \"query\".\n- \"disable_offline_access_scope\": set to \"true\" if no offline tokens shall be issued.\n- \"extra_scopes\": a space-delimited string of additional scopes to request in addition to \"openid profile email\"\n  according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.\n\nOpenShift Auth: supports no extra configuration options.\n\nUser PKI:\n- \"keys\": the trusted certificates PEM encoded.\n\nSAML:\n- \"sp_issuer\": the service provider issuer according to https://datatracker.ietf.org/doc/html/rfc7522#section-3.\n- \"sp_audience\": the expected audience URI for assertion validation. If empty, audience is not enforced.\n- \"idp_metadata_url\": the metadata URL according to https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf.\n- \"idp_issuer\": the IdP issuer.\n- \"idp_cert_pem\": the cert PEM encoded for the IdP endpoint.\n- \"idp_sso_url\": the IdP SSO URL.\n- \"idp_nameid_format\": the IdP name ID format.\n\nIAP:\n- \"audience\": the audience to use."
+          "description": "Config holds auth provider specific configuration. Each configuration options\nare different based on the given auth provider type.\nOIDC:\n- \"issuer\": the OIDC issuer according to https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier.\n- \"client_id\": the client ID according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2.\n- \"client_secret\": the client secret according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3.1.\n- \"do_not_use_client_secret\": set to \"true\" if you want to create a configuration with only\n  a client ID and no client secret.\n- \"mode\": the OIDC callback mode, choosing from \"fragment\", \"post\", or \"query\".\n- \"disable_offline_access_scope\": set to \"true\" if no offline tokens shall be issued.\n- \"extra_scopes\": a space-delimited string of additional scopes to request in addition to \"openid profile email\"\n  according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.\n\nOpenShift Auth:\nThese settings only apply for OpenShift Auth used with access control delegation to ACM.\nOtherwise, no extra configuration options are supported.\n- \"client_name\": the name of the OAuthClient object used to request an OpenShift auth token.\n- \"client_secret\": the OAuthClient secret.\n\nUser PKI:\n- \"keys\": the trusted certificates PEM encoded.\n\nSAML:\n- \"sp_issuer\": the service provider issuer according to https://datatracker.ietf.org/doc/html/rfc7522#section-3.\n- \"sp_audience\": the expected audience URI for assertion validation. If empty, audience is not enforced.\n- \"idp_metadata_url\": the metadata URL according to https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf.\n- \"idp_issuer\": the IdP issuer.\n- \"idp_cert_pem\": the cert PEM encoded for the IdP endpoint.\n- \"idp_sso_url\": the IdP SSO URL.\n- \"idp_nameid_format\": the IdP name ID format.\n\nIAP:\n- \"audience\": the audience to use."
         },
         "loginUrl": {
           "type": "string",
diff --git a/generated/api/v1/authprovider_service.pb.go b/generated/api/v1/authprovider_service.pb.go
index 6a330cdf80dfb..f8d8f077c2924 100644
--- a/generated/api/v1/authprovider_service.pb.go
+++ b/generated/api/v1/authprovider_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/authprovider_service.proto
 
diff --git a/generated/api/v1/authprovider_service.pb.gw.go b/generated/api/v1/authprovider_service.pb.gw.go
index 6f928439c544c..2de8e8e0edd2c 100644
--- a/generated/api/v1/authprovider_service.pb.gw.go
+++ b/generated/api/v1/authprovider_service.pb.gw.go
@@ -63,9 +63,6 @@ func request_AuthProviderService_GetAuthProvider_0(ctx context.Context, marshale
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -74,6 +71,9 @@ func request_AuthProviderService_GetAuthProvider_0(ctx context.Context, marshale
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAuthProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -124,15 +124,15 @@ func request_AuthProviderService_GetAuthProviders_0(ctx context.Context, marshal
 		protoReq GetAuthProvidersRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AuthProviderService_GetAuthProviders_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAuthProviders(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -188,9 +188,6 @@ func request_AuthProviderService_UpdateAuthProvider_0(ctx context.Context, marsh
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -199,6 +196,9 @@ func request_AuthProviderService_UpdateAuthProvider_0(ctx context.Context, marsh
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateAuthProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -233,9 +233,6 @@ func request_AuthProviderService_PutAuthProvider_0(ctx context.Context, marshale
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -244,6 +241,9 @@ func request_AuthProviderService_PutAuthProvider_0(ctx context.Context, marshale
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutAuthProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -277,9 +277,6 @@ func request_AuthProviderService_DeleteAuthProvider_0(ctx context.Context, marsh
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -294,6 +291,9 @@ func request_AuthProviderService_DeleteAuthProvider_0(ctx context.Context, marsh
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AuthProviderService_DeleteAuthProvider_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteAuthProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/authprovider_service.swagger.json b/generated/api/v1/authprovider_service.swagger.json
index ecc6b5448d791..c6d83c657690e 100644
--- a/generated/api/v1/authprovider_service.swagger.json
+++ b/generated/api/v1/authprovider_service.swagger.json
@@ -329,7 +329,7 @@
           "additionalProperties": {
             "type": "string"
           },
-          "description": "Config holds auth provider specific configuration. Each configuration options\nare different based on the given auth provider type.\nOIDC:\n- \"issuer\": the OIDC issuer according to https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier.\n- \"client_id\": the client ID according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2.\n- \"client_secret\": the client secret according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3.1.\n- \"do_not_use_client_secret\": set to \"true\" if you want to create a configuration with only\n  a client ID and no client secret.\n- \"mode\": the OIDC callback mode, choosing from \"fragment\", \"post\", or \"query\".\n- \"disable_offline_access_scope\": set to \"true\" if no offline tokens shall be issued.\n- \"extra_scopes\": a space-delimited string of additional scopes to request in addition to \"openid profile email\"\n  according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.\n\nOpenShift Auth: supports no extra configuration options.\n\nUser PKI:\n- \"keys\": the trusted certificates PEM encoded.\n\nSAML:\n- \"sp_issuer\": the service provider issuer according to https://datatracker.ietf.org/doc/html/rfc7522#section-3.\n- \"sp_audience\": the expected audience URI for assertion validation. If empty, audience is not enforced.\n- \"idp_metadata_url\": the metadata URL according to https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf.\n- \"idp_issuer\": the IdP issuer.\n- \"idp_cert_pem\": the cert PEM encoded for the IdP endpoint.\n- \"idp_sso_url\": the IdP SSO URL.\n- \"idp_nameid_format\": the IdP name ID format.\n\nIAP:\n- \"audience\": the audience to use."
+          "description": "Config holds auth provider specific configuration. Each configuration options\nare different based on the given auth provider type.\nOIDC:\n- \"issuer\": the OIDC issuer according to https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier.\n- \"client_id\": the client ID according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2.\n- \"client_secret\": the client secret according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3.1.\n- \"do_not_use_client_secret\": set to \"true\" if you want to create a configuration with only\n  a client ID and no client secret.\n- \"mode\": the OIDC callback mode, choosing from \"fragment\", \"post\", or \"query\".\n- \"disable_offline_access_scope\": set to \"true\" if no offline tokens shall be issued.\n- \"extra_scopes\": a space-delimited string of additional scopes to request in addition to \"openid profile email\"\n  according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.\n\nOpenShift Auth:\nThese settings only apply for OpenShift Auth used with access control delegation to ACM.\nOtherwise, no extra configuration options are supported.\n- \"client_name\": the name of the OAuthClient object used to request an OpenShift auth token.\n- \"client_secret\": the OAuthClient secret.\n\nUser PKI:\n- \"keys\": the trusted certificates PEM encoded.\n\nSAML:\n- \"sp_issuer\": the service provider issuer according to https://datatracker.ietf.org/doc/html/rfc7522#section-3.\n- \"sp_audience\": the expected audience URI for assertion validation. If empty, audience is not enforced.\n- \"idp_metadata_url\": the metadata URL according to https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf.\n- \"idp_issuer\": the IdP issuer.\n- \"idp_cert_pem\": the cert PEM encoded for the IdP endpoint.\n- \"idp_sso_url\": the IdP SSO URL.\n- \"idp_nameid_format\": the IdP name ID format.\n\nIAP:\n- \"audience\": the audience to use."
         },
         "loginUrl": {
           "type": "string",
@@ -490,7 +490,7 @@
           "additionalProperties": {
             "type": "string"
           },
-          "description": "Config holds auth provider specific configuration. Each configuration options\nare different based on the given auth provider type.\nOIDC:\n- \"issuer\": the OIDC issuer according to https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier.\n- \"client_id\": the client ID according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2.\n- \"client_secret\": the client secret according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3.1.\n- \"do_not_use_client_secret\": set to \"true\" if you want to create a configuration with only\n  a client ID and no client secret.\n- \"mode\": the OIDC callback mode, choosing from \"fragment\", \"post\", or \"query\".\n- \"disable_offline_access_scope\": set to \"true\" if no offline tokens shall be issued.\n- \"extra_scopes\": a space-delimited string of additional scopes to request in addition to \"openid profile email\"\n  according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.\n\nOpenShift Auth: supports no extra configuration options.\n\nUser PKI:\n- \"keys\": the trusted certificates PEM encoded.\n\nSAML:\n- \"sp_issuer\": the service provider issuer according to https://datatracker.ietf.org/doc/html/rfc7522#section-3.\n- \"sp_audience\": the expected audience URI for assertion validation. If empty, audience is not enforced.\n- \"idp_metadata_url\": the metadata URL according to https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf.\n- \"idp_issuer\": the IdP issuer.\n- \"idp_cert_pem\": the cert PEM encoded for the IdP endpoint.\n- \"idp_sso_url\": the IdP SSO URL.\n- \"idp_nameid_format\": the IdP name ID format.\n\nIAP:\n- \"audience\": the audience to use."
+          "description": "Config holds auth provider specific configuration. Each configuration options\nare different based on the given auth provider type.\nOIDC:\n- \"issuer\": the OIDC issuer according to https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier.\n- \"client_id\": the client ID according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2.\n- \"client_secret\": the client secret according to https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3.1.\n- \"do_not_use_client_secret\": set to \"true\" if you want to create a configuration with only\n  a client ID and no client secret.\n- \"mode\": the OIDC callback mode, choosing from \"fragment\", \"post\", or \"query\".\n- \"disable_offline_access_scope\": set to \"true\" if no offline tokens shall be issued.\n- \"extra_scopes\": a space-delimited string of additional scopes to request in addition to \"openid profile email\"\n  according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.\n\nOpenShift Auth:\nThese settings only apply for OpenShift Auth used with access control delegation to ACM.\nOtherwise, no extra configuration options are supported.\n- \"client_name\": the name of the OAuthClient object used to request an OpenShift auth token.\n- \"client_secret\": the OAuthClient secret.\n\nUser PKI:\n- \"keys\": the trusted certificates PEM encoded.\n\nSAML:\n- \"sp_issuer\": the service provider issuer according to https://datatracker.ietf.org/doc/html/rfc7522#section-3.\n- \"sp_audience\": the expected audience URI for assertion validation. If empty, audience is not enforced.\n- \"idp_metadata_url\": the metadata URL according to https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf.\n- \"idp_issuer\": the IdP issuer.\n- \"idp_cert_pem\": the cert PEM encoded for the IdP endpoint.\n- \"idp_sso_url\": the IdP SSO URL.\n- \"idp_nameid_format\": the IdP name ID format.\n\nIAP:\n- \"audience\": the audience to use."
         },
         "loginUrl": {
           "type": "string",
diff --git a/generated/api/v1/backup_service.pb.go b/generated/api/v1/backup_service.pb.go
index d34c9aa786c8c..7517816852110 100644
--- a/generated/api/v1/backup_service.pb.go
+++ b/generated/api/v1/backup_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/backup_service.proto
 
diff --git a/generated/api/v1/backup_service.pb.gw.go b/generated/api/v1/backup_service.pb.gw.go
index 114272eb9be8f..e2d80b0f41032 100644
--- a/generated/api/v1/backup_service.pb.gw.go
+++ b/generated/api/v1/backup_service.pb.gw.go
@@ -42,9 +42,6 @@ func request_ExternalBackupService_GetExternalBackup_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -53,6 +50,9 @@ func request_ExternalBackupService_GetExternalBackup_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetExternalBackup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -132,9 +132,6 @@ func request_ExternalBackupService_PutExternalBackup_0(ctx context.Context, mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -143,6 +140,9 @@ func request_ExternalBackupService_PutExternalBackup_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutExternalBackup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -201,9 +201,6 @@ func request_ExternalBackupService_DeleteExternalBackup_0(ctx context.Context, m
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -212,6 +209,9 @@ func request_ExternalBackupService_DeleteExternalBackup_0(ctx context.Context, m
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteExternalBackup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -240,9 +240,6 @@ func request_ExternalBackupService_TriggerExternalBackup_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -251,6 +248,9 @@ func request_ExternalBackupService_TriggerExternalBackup_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.TriggerExternalBackup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -282,9 +282,6 @@ func request_ExternalBackupService_UpdateExternalBackup_0(ctx context.Context, m
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["external_backup.id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "external_backup.id")
@@ -293,6 +290,9 @@ func request_ExternalBackupService_UpdateExternalBackup_0(ctx context.Context, m
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "external_backup.id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateExternalBackup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/central_health_service.pb.go b/generated/api/v1/central_health_service.pb.go
index f4c9e38293be9..bbdcdc6d51ef4 100644
--- a/generated/api/v1/central_health_service.pb.go
+++ b/generated/api/v1/central_health_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/central_health_service.proto
 
diff --git a/generated/api/v1/cloud_source_service.pb.go b/generated/api/v1/cloud_source_service.pb.go
index e6835b0d88b25..dbbd311948e97 100644
--- a/generated/api/v1/cloud_source_service.pb.go
+++ b/generated/api/v1/cloud_source_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/cloud_source_service.proto
 
diff --git a/generated/api/v1/cloud_source_service.pb.gw.go b/generated/api/v1/cloud_source_service.pb.gw.go
index 510f5f44218c0..2334cf4b1faa6 100644
--- a/generated/api/v1/cloud_source_service.pb.gw.go
+++ b/generated/api/v1/cloud_source_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_CloudSourcesService_CountCloudSources_0(ctx context.Context, marsha
 		protoReq CountCloudSourcesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_CloudSourcesService_CountCloudSources_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountCloudSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -76,9 +76,6 @@ func request_CloudSourcesService_GetCloudSource_0(ctx context.Context, marshaler
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -87,6 +84,9 @@ func request_CloudSourcesService_GetCloudSource_0(ctx context.Context, marshaler
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetCloudSource(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,15 +116,15 @@ func request_CloudSourcesService_ListCloudSources_0(ctx context.Context, marshal
 		protoReq ListCloudSourcesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_CloudSourcesService_ListCloudSources_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListCloudSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -180,9 +180,6 @@ func request_CloudSourcesService_UpdateCloudSource_0(ctx context.Context, marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cloud_source.id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cloud_source.id")
@@ -191,6 +188,9 @@ func request_CloudSourcesService_UpdateCloudSource_0(ctx context.Context, marsha
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "cloud_source.id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateCloudSource(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -222,9 +222,6 @@ func request_CloudSourcesService_DeleteCloudSource_0(ctx context.Context, marsha
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -233,6 +230,9 @@ func request_CloudSourcesService_DeleteCloudSource_0(ctx context.Context, marsha
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteCloudSource(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/cluster_init_service.pb.go b/generated/api/v1/cluster_init_service.pb.go
index 85a88915e3a19..c62740345a676 100644
--- a/generated/api/v1/cluster_init_service.pb.go
+++ b/generated/api/v1/cluster_init_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/cluster_init_service.proto
 
diff --git a/generated/api/v1/cluster_init_service.swagger.json b/generated/api/v1/cluster_init_service.swagger.json
index 9e4773f0410d0..ec48899b0e1c2 100644
--- a/generated/api/v1/cluster_init_service.swagger.json
+++ b/generated/api/v1/cluster_init_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ClusterInitService"
+      "name": "ClusterInitService",
+      "description": "ClusterInitService manages cluster init bundles and CRSs."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/cluster_service.pb.go b/generated/api/v1/cluster_service.pb.go
index 6426337fbb739..aa892aa0471b7 100644
--- a/generated/api/v1/cluster_service.pb.go
+++ b/generated/api/v1/cluster_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/cluster_service.proto
 
diff --git a/generated/api/v1/cluster_service.pb.gw.go b/generated/api/v1/cluster_service.pb.gw.go
index d0ed73dd50c9c..55f9e25111dc7 100644
--- a/generated/api/v1/cluster_service.pb.gw.go
+++ b/generated/api/v1/cluster_service.pb.gw.go
@@ -43,15 +43,15 @@ func request_ClustersService_GetClusters_0(ctx context.Context, marshaler runtim
 		protoReq GetClustersRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ClustersService_GetClusters_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetClusters(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -77,9 +77,6 @@ func request_ClustersService_GetCluster_0(ctx context.Context, marshaler runtime
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -88,6 +85,9 @@ func request_ClustersService_GetCluster_0(ctx context.Context, marshaler runtime
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetCluster(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -146,9 +146,6 @@ func request_ClustersService_PutCluster_0(ctx context.Context, marshaler runtime
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -157,6 +154,9 @@ func request_ClustersService_PutCluster_0(ctx context.Context, marshaler runtime
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutCluster(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -188,9 +188,6 @@ func request_ClustersService_DeleteCluster_0(ctx context.Context, marshaler runt
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -199,6 +196,9 @@ func request_ClustersService_DeleteCluster_0(ctx context.Context, marshaler runt
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteCluster(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/cluster_service.swagger.json b/generated/api/v1/cluster_service.swagger.json
index 1f2a7a4fcdee1..9401492401ef4 100644
--- a/generated/api/v1/cluster_service.swagger.json
+++ b/generated/api/v1/cluster_service.swagger.json
@@ -229,7 +229,7 @@
         "HEALTHY"
       ],
       "default": "UNINITIALIZED",
-      "title": "- UNAVAILABLE: Only collector can have unavailable status"
+      "description": "- UNAVAILABLE: Only collector can have unavailable status"
     },
     "ClusterUpgradeStatusUpgradability": {
       "type": "string",
@@ -479,13 +479,15 @@
           "format": "int32"
         },
         "scanInline": {
-          "type": "boolean"
+          "type": "boolean",
+          "title": "always true since 4.9"
         },
         "disableBypass": {
           "type": "boolean"
         },
         "enforceOnUpdates": {
-          "type": "boolean"
+          "type": "boolean",
+          "title": "same as enabled since 4.9"
         }
       }
     },
diff --git a/generated/api/v1/common.pb.go b/generated/api/v1/common.pb.go
index 015f336224cb2..a459f0aed74a5 100644
--- a/generated/api/v1/common.pb.go
+++ b/generated/api/v1/common.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/common.proto
 
diff --git a/generated/api/v1/compliance_management_service.pb.go b/generated/api/v1/compliance_management_service.pb.go
index 5216c51320609..88b806e2b0d08 100644
--- a/generated/api/v1/compliance_management_service.pb.go
+++ b/generated/api/v1/compliance_management_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/compliance_management_service.proto
 
diff --git a/generated/api/v1/compliance_management_service.pb.gw.go b/generated/api/v1/compliance_management_service.pb.gw.go
index d07c28da3c7c6..85beb2bcc2ed7 100644
--- a/generated/api/v1/compliance_management_service.pb.gw.go
+++ b/generated/api/v1/compliance_management_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_ComplianceManagementService_GetRecentRuns_0(ctx context.Context, ma
 		protoReq GetRecentComplianceRunsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceManagementService_GetRecentRuns_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetRecentRuns(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -104,15 +104,15 @@ func request_ComplianceManagementService_GetRunStatuses_0(ctx context.Context, m
 		protoReq GetComplianceRunStatusesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceManagementService_GetRunStatuses_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetRunStatuses(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/compliance_management_service.swagger.json b/generated/api/v1/compliance_management_service.swagger.json
index e243bbe6ff9f5..6896bba6a615b 100644
--- a/generated/api/v1/compliance_management_service.swagger.json
+++ b/generated/api/v1/compliance_management_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ComplianceManagementService"
+      "name": "ComplianceManagementService",
+      "description": "BEGIN EXPERIMENTAL/UNSTABLE API"
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/compliance_service.pb.go b/generated/api/v1/compliance_service.pb.go
index 0e79d14433e1e..312ec3a6e252c 100644
--- a/generated/api/v1/compliance_service.pb.go
+++ b/generated/api/v1/compliance_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/compliance_service.proto
 
diff --git a/generated/api/v1/compliance_service.pb.gw.go b/generated/api/v1/compliance_service.pb.gw.go
index 519f5634ac267..a4f8692fd62f2 100644
--- a/generated/api/v1/compliance_service.pb.gw.go
+++ b/generated/api/v1/compliance_service.pb.gw.go
@@ -62,9 +62,6 @@ func request_ComplianceService_GetStandard_0(ctx context.Context, marshaler runt
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -73,6 +70,9 @@ func request_ComplianceService_GetStandard_0(ctx context.Context, marshaler runt
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetStandard(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -102,15 +102,15 @@ func request_ComplianceService_GetRunResults_0(ctx context.Context, marshaler ru
 		protoReq GetComplianceRunResultsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceService_GetRunResults_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetRunResults(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -137,15 +137,15 @@ func request_ComplianceService_GetAggregatedResults_0(ctx context.Context, marsh
 		protoReq ComplianceAggregationRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceService_GetAggregatedResults_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAggregatedResults(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -174,9 +174,6 @@ func request_ComplianceService_UpdateComplianceStandardConfig_0(ctx context.Cont
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -185,6 +182,9 @@ func request_ComplianceService_UpdateComplianceStandardConfig_0(ctx context.Cont
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateComplianceStandardConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/config_service.pb.go b/generated/api/v1/config_service.pb.go
index 40837fbde2163..babbb3f1f7cd8 100644
--- a/generated/api/v1/config_service.pb.go
+++ b/generated/api/v1/config_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/config_service.proto
 
diff --git a/generated/api/v1/config_service.swagger.json b/generated/api/v1/config_service.swagger.json
index ceb25909aa01f..0cf414400003e 100644
--- a/generated/api/v1/config_service.swagger.json
+++ b/generated/api/v1/config_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ConfigService"
+      "name": "ConfigService",
+      "description": "ConfigService APIs can be used to manage Central config."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/credential_expiry_service.pb.go b/generated/api/v1/credential_expiry_service.pb.go
index a5f7347929bf2..caaf77268effa 100644
--- a/generated/api/v1/credential_expiry_service.pb.go
+++ b/generated/api/v1/credential_expiry_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/credential_expiry_service.proto
 
diff --git a/generated/api/v1/credential_expiry_service.pb.gw.go b/generated/api/v1/credential_expiry_service.pb.gw.go
index 6429afb93f087..30b40f12b9633 100644
--- a/generated/api/v1/credential_expiry_service.pb.gw.go
+++ b/generated/api/v1/credential_expiry_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_CredentialExpiryService_GetCertExpiry_0(ctx context.Context, marsha
 		protoReq GetCertExpiry_Request
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_CredentialExpiryService_GetCertExpiry_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetCertExpiry(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/credential_expiry_service.swagger.json b/generated/api/v1/credential_expiry_service.swagger.json
index f5c32c154bd68..d553c06514444 100644
--- a/generated/api/v1/credential_expiry_service.swagger.json
+++ b/generated/api/v1/credential_expiry_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "CredentialExpiryService"
+      "name": "CredentialExpiryService",
+      "description": "CredentialExpiryService APIs can be used to retrieve information related to expiry\nof credentials of various StackRox services."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/cve_service.pb.go b/generated/api/v1/cve_service.pb.go
index c7793cfc68520..353f0bb81dd31 100644
--- a/generated/api/v1/cve_service.pb.go
+++ b/generated/api/v1/cve_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/cve_service.proto
 
diff --git a/generated/api/v1/cve_service.swagger.json b/generated/api/v1/cve_service.swagger.json
index 53503c19cd0a3..b94b6ccfe68aa 100644
--- a/generated/api/v1/cve_service.swagger.json
+++ b/generated/api/v1/cve_service.swagger.json
@@ -6,10 +6,12 @@
   },
   "tags": [
     {
-      "name": "NodeCVEService"
+      "name": "NodeCVEService",
+      "description": "NodeCVEService APIs can be used to manage node cves."
     },
     {
-      "name": "ClusterCVEService"
+      "name": "ClusterCVEService",
+      "description": "ClusterCVEService APIs can be used to manage cluster cves."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/db_service.pb.go b/generated/api/v1/db_service.pb.go
index 30c74ac743f8c..1c38c412fd736 100644
--- a/generated/api/v1/db_service.pb.go
+++ b/generated/api/v1/db_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/db_service.proto
 
diff --git a/generated/api/v1/db_service.pb.gw.go b/generated/api/v1/db_service.pb.gw.go
index 0979bd8be0048..7e864977dc57b 100644
--- a/generated/api/v1/db_service.pb.gw.go
+++ b/generated/api/v1/db_service.pb.gw.go
@@ -83,9 +83,6 @@ func request_DBService_InterruptRestoreProcess_0(ctx context.Context, marshaler
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["process_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "process_id")
@@ -102,6 +99,9 @@ func request_DBService_InterruptRestoreProcess_0(ctx context.Context, marshaler
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "attempt_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.InterruptRestoreProcess(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -138,9 +138,6 @@ func request_DBService_CancelRestoreProcess_0(ctx context.Context, marshaler run
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -149,6 +146,9 @@ func request_DBService_CancelRestoreProcess_0(ctx context.Context, marshaler run
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CancelRestoreProcess(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/db_service.swagger.json b/generated/api/v1/db_service.swagger.json
index eff15bc22e485..792ea0368bf80 100644
--- a/generated/api/v1/db_service.swagger.json
+++ b/generated/api/v1/db_service.swagger.json
@@ -323,7 +323,7 @@
         "COMPLETED"
       ],
       "default": "UNKNOWN",
-      "title": "- COMPLETED: successful if error is empty, unsuccessful otherwise"
+      "description": "- COMPLETED: successful if error is empty, unsuccessful otherwise"
     },
     "v1DBRestoreRequestHeader": {
       "type": "object",
diff --git a/generated/api/v1/debug_service.pb.go b/generated/api/v1/debug_service.pb.go
index aae29f1d51dd2..6e4848efff030 100644
--- a/generated/api/v1/debug_service.pb.go
+++ b/generated/api/v1/debug_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/debug_service.proto
 
diff --git a/generated/api/v1/debug_service.pb.gw.go b/generated/api/v1/debug_service.pb.gw.go
index f12ab6475098f..8dab0495d0993 100644
--- a/generated/api/v1/debug_service.pb.gw.go
+++ b/generated/api/v1/debug_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_DebugService_GetLogLevel_0(ctx context.Context, marshaler runtime.M
 		protoReq GetLogLevelRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DebugService_GetLogLevel_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetLogLevel(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/debug_service.swagger.json b/generated/api/v1/debug_service.swagger.json
index 3749e09c0718f..8a986517ce8cc 100644
--- a/generated/api/v1/debug_service.swagger.json
+++ b/generated/api/v1/debug_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "DebugService"
+      "name": "DebugService",
+      "description": "APIs for debugging."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/declarative_config_health_service.pb.go b/generated/api/v1/declarative_config_health_service.pb.go
index 6059cda2d6cb0..b5d64e94f95cf 100644
--- a/generated/api/v1/declarative_config_health_service.pb.go
+++ b/generated/api/v1/declarative_config_health_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/declarative_config_health_service.proto
 
diff --git a/generated/api/v1/delegated_registry_config_service.pb.go b/generated/api/v1/delegated_registry_config_service.pb.go
index 86984982c6e58..1c02c02d58982 100644
--- a/generated/api/v1/delegated_registry_config_service.pb.go
+++ b/generated/api/v1/delegated_registry_config_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/delegated_registry_config_service.proto
 
diff --git a/generated/api/v1/delegated_registry_config_service.swagger.json b/generated/api/v1/delegated_registry_config_service.swagger.json
index 00f59b70a2a22..bed355282cd08 100644
--- a/generated/api/v1/delegated_registry_config_service.swagger.json
+++ b/generated/api/v1/delegated_registry_config_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "DelegatedRegistryConfigService"
+      "name": "DelegatedRegistryConfigService",
+      "description": "DelegatedRegistryConfigService APIs can be used to control how to route image scans amongst\ncentral and secured clusters"
     }
   ],
   "consumes": [
@@ -117,7 +118,7 @@
         "SPECIFIC"
       ],
       "default": "NONE",
-      "title": "- NONE: Scan all images via central services except for images from the OCP integrated registry\n - ALL: Scan all images via the secured clusters\n - SPECIFIC: Scan images that match `registries` or are from the OCP integrated registry via the secured clusters\notherwise scan via central services"
+      "description": "- NONE: Scan all images via central services except for images from the OCP integrated registry\n - ALL: Scan all images via the secured clusters\n - SPECIFIC: Scan images that match `registries` or are from the OCP integrated registry via the secured clusters\notherwise scan via central services"
     },
     "googleRpcStatus": {
       "type": "object",
diff --git a/generated/api/v1/deployment_service.pb.go b/generated/api/v1/deployment_service.pb.go
index 1d50e671d94d0..ef061a27ec403 100644
--- a/generated/api/v1/deployment_service.pb.go
+++ b/generated/api/v1/deployment_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/deployment_service.proto
 
@@ -355,6 +355,50 @@ func (x *ExportDeploymentResponse) GetDeployment() *storage.Deployment {
 	return nil
 }
 
+type DeploymentRiskAISummaryResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Summary       string                 `protobuf:"bytes,1,opt,name=summary,proto3" json:"summary,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeploymentRiskAISummaryResponse) Reset() {
+	*x = DeploymentRiskAISummaryResponse{}
+	mi := &file_api_v1_deployment_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeploymentRiskAISummaryResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeploymentRiskAISummaryResponse) ProtoMessage() {}
+
+func (x *DeploymentRiskAISummaryResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_deployment_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeploymentRiskAISummaryResponse.ProtoReflect.Descriptor instead.
+func (*DeploymentRiskAISummaryResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_deployment_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *DeploymentRiskAISummaryResponse) GetSummary() string {
+	if x != nil {
+		return x.Summary
+	}
+	return ""
+}
+
 type DeploymentLabelsResponse_LabelValues struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Values        []string               `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
@@ -364,7 +408,7 @@ type DeploymentLabelsResponse_LabelValues struct {
 
 func (x *DeploymentLabelsResponse_LabelValues) Reset() {
 	*x = DeploymentLabelsResponse_LabelValues{}
-	mi := &file_api_v1_deployment_service_proto_msgTypes[7]
+	mi := &file_api_v1_deployment_service_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -376,7 +420,7 @@ func (x *DeploymentLabelsResponse_LabelValues) String() string {
 func (*DeploymentLabelsResponse_LabelValues) ProtoMessage() {}
 
 func (x *DeploymentLabelsResponse_LabelValues) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v1_deployment_service_proto_msgTypes[7]
+	mi := &file_api_v1_deployment_service_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -409,7 +453,7 @@ type ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo struct {
 
 func (x *ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo) Reset() {
 	*x = ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo{}
-	mi := &file_api_v1_deployment_service_proto_msgTypes[9]
+	mi := &file_api_v1_deployment_service_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -421,7 +465,7 @@ func (x *ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo) Strin
 func (*ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo) ProtoMessage() {}
 
 func (x *ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v1_deployment_service_proto_msgTypes[9]
+	mi := &file_api_v1_deployment_service_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -486,10 +530,13 @@ const file_api_v1_deployment_service_proto_rawDesc = "" +
 	"\x18ExportDeploymentResponse\x123\n" +
 	"\n" +
 	"deployment\x18\x01 \x01(\v2\x13.storage.DeploymentR\n" +
-	"deployment2\xe8\x05\n" +
+	"deployment\";\n" +
+	"\x1fDeploymentRiskAISummaryResponse\x12\x18\n" +
+	"\asummary\x18\x01 \x01(\tR\asummary2\xef\x06\n" +
 	"\x11DeploymentService\x12T\n" +
 	"\rGetDeployment\x12\x10.v1.ResourceByID\x1a\x13.storage.Deployment\"\x1c\x82\xd3\xe4\x93\x02\x16\x12\x14/v1/deployments/{id}\x12r\n" +
-	"\x15GetDeploymentWithRisk\x12\x10.v1.ResourceByID\x1a!.v1.GetDeploymentWithRiskResponse\"$\x82\xd3\xe4\x93\x02\x1e\x12\x1c/v1/deploymentswithrisk/{id}\x12\\\n" +
+	"\x15GetDeploymentWithRisk\x12\x10.v1.ResourceByID\x1a!.v1.GetDeploymentWithRiskResponse\"$\x82\xd3\xe4\x93\x02\x1e\x12\x1c/v1/deploymentswithrisk/{id}\x12\x84\x01\n" +
+	"\x1aGetDeploymentRiskAISummary\x12\x10.v1.ResourceByID\x1a#.v1.DeploymentRiskAISummaryResponse\"/\x82\xd3\xe4\x93\x02)\x12'/v1/deploymentswithrisk/{id}/ai-summary\x12\\\n" +
 	"\x10CountDeployments\x12\f.v1.RawQuery\x1a\x1c.v1.CountDeploymentsResponse\"\x1c\x82\xd3\xe4\x93\x02\x16\x12\x14/v1/deploymentscount\x12U\n" +
 	"\x0fListDeployments\x12\f.v1.RawQuery\x1a\x1b.v1.ListDeploymentsResponse\"\x17\x82\xd3\xe4\x93\x02\x11\x12\x0f/v1/deployments\x12\x82\x01\n" +
 	"\x1eListDeploymentsWithProcessInfo\x12\f.v1.RawQuery\x1a*.v1.ListDeploymentsWithProcessInfoResponse\"&\x82\xd3\xe4\x93\x02 \x12\x1e/v1/deploymentswithprocessinfo\x12]\n" +
@@ -509,7 +556,7 @@ func file_api_v1_deployment_service_proto_rawDescGZIP() []byte {
 	return file_api_v1_deployment_service_proto_rawDescData
 }
 
-var file_api_v1_deployment_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_api_v1_deployment_service_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_api_v1_deployment_service_proto_goTypes = []any{
 	(*DeploymentLabelsResponse)(nil),               // 0: v1.DeploymentLabelsResponse
 	(*ListDeploymentsResponse)(nil),                // 1: v1.ListDeploymentsResponse
@@ -518,43 +565,46 @@ var file_api_v1_deployment_service_proto_goTypes = []any{
 	(*GetDeploymentWithRiskResponse)(nil),          // 4: v1.GetDeploymentWithRiskResponse
 	(*ExportDeploymentRequest)(nil),                // 5: v1.ExportDeploymentRequest
 	(*ExportDeploymentResponse)(nil),               // 6: v1.ExportDeploymentResponse
-	(*DeploymentLabelsResponse_LabelValues)(nil),   // 7: v1.DeploymentLabelsResponse.LabelValues
-	nil, // 8: v1.DeploymentLabelsResponse.LabelsEntry
-	(*ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo)(nil), // 9: v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo
-	(*storage.ListDeployment)(nil),                                           // 10: storage.ListDeployment
-	(*storage.Deployment)(nil),                                               // 11: storage.Deployment
-	(*storage.Risk)(nil),                                                     // 12: storage.Risk
-	(*storage.ContainerNameAndBaselineStatus)(nil),                           // 13: storage.ContainerNameAndBaselineStatus
-	(*ResourceByID)(nil),                                                     // 14: v1.ResourceByID
-	(*RawQuery)(nil),                                                         // 15: v1.RawQuery
-	(*Empty)(nil),                                                            // 16: v1.Empty
+	(*DeploymentRiskAISummaryResponse)(nil),        // 7: v1.DeploymentRiskAISummaryResponse
+	(*DeploymentLabelsResponse_LabelValues)(nil),   // 8: v1.DeploymentLabelsResponse.LabelValues
+	nil, // 9: v1.DeploymentLabelsResponse.LabelsEntry
+	(*ListDeploymentsWithProcessInfoResponse_DeploymentWithProcessInfo)(nil), // 10: v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo
+	(*storage.ListDeployment)(nil),                                           // 11: storage.ListDeployment
+	(*storage.Deployment)(nil),                                               // 12: storage.Deployment
+	(*storage.Risk)(nil),                                                     // 13: storage.Risk
+	(*storage.ContainerNameAndBaselineStatus)(nil),                           // 14: storage.ContainerNameAndBaselineStatus
+	(*ResourceByID)(nil),                                                     // 15: v1.ResourceByID
+	(*RawQuery)(nil),                                                         // 16: v1.RawQuery
+	(*Empty)(nil),                                                            // 17: v1.Empty
 }
 var file_api_v1_deployment_service_proto_depIdxs = []int32{
-	8,  // 0: v1.DeploymentLabelsResponse.labels:type_name -> v1.DeploymentLabelsResponse.LabelsEntry
-	10, // 1: v1.ListDeploymentsResponse.deployments:type_name -> storage.ListDeployment
-	9,  // 2: v1.ListDeploymentsWithProcessInfoResponse.deployments:type_name -> v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo
-	11, // 3: v1.GetDeploymentWithRiskResponse.deployment:type_name -> storage.Deployment
-	12, // 4: v1.GetDeploymentWithRiskResponse.risk:type_name -> storage.Risk
-	11, // 5: v1.ExportDeploymentResponse.deployment:type_name -> storage.Deployment
-	7,  // 6: v1.DeploymentLabelsResponse.LabelsEntry.value:type_name -> v1.DeploymentLabelsResponse.LabelValues
-	10, // 7: v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo.deployment:type_name -> storage.ListDeployment
-	13, // 8: v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo.baseline_statuses:type_name -> storage.ContainerNameAndBaselineStatus
-	14, // 9: v1.DeploymentService.GetDeployment:input_type -> v1.ResourceByID
-	14, // 10: v1.DeploymentService.GetDeploymentWithRisk:input_type -> v1.ResourceByID
-	15, // 11: v1.DeploymentService.CountDeployments:input_type -> v1.RawQuery
-	15, // 12: v1.DeploymentService.ListDeployments:input_type -> v1.RawQuery
-	15, // 13: v1.DeploymentService.ListDeploymentsWithProcessInfo:input_type -> v1.RawQuery
-	16, // 14: v1.DeploymentService.GetLabels:input_type -> v1.Empty
-	5,  // 15: v1.DeploymentService.ExportDeployments:input_type -> v1.ExportDeploymentRequest
-	11, // 16: v1.DeploymentService.GetDeployment:output_type -> storage.Deployment
-	4,  // 17: v1.DeploymentService.GetDeploymentWithRisk:output_type -> v1.GetDeploymentWithRiskResponse
-	2,  // 18: v1.DeploymentService.CountDeployments:output_type -> v1.CountDeploymentsResponse
-	1,  // 19: v1.DeploymentService.ListDeployments:output_type -> v1.ListDeploymentsResponse
-	3,  // 20: v1.DeploymentService.ListDeploymentsWithProcessInfo:output_type -> v1.ListDeploymentsWithProcessInfoResponse
-	0,  // 21: v1.DeploymentService.GetLabels:output_type -> v1.DeploymentLabelsResponse
-	6,  // 22: v1.DeploymentService.ExportDeployments:output_type -> v1.ExportDeploymentResponse
-	16, // [16:23] is the sub-list for method output_type
-	9,  // [9:16] is the sub-list for method input_type
+	9,  // 0: v1.DeploymentLabelsResponse.labels:type_name -> v1.DeploymentLabelsResponse.LabelsEntry
+	11, // 1: v1.ListDeploymentsResponse.deployments:type_name -> storage.ListDeployment
+	10, // 2: v1.ListDeploymentsWithProcessInfoResponse.deployments:type_name -> v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo
+	12, // 3: v1.GetDeploymentWithRiskResponse.deployment:type_name -> storage.Deployment
+	13, // 4: v1.GetDeploymentWithRiskResponse.risk:type_name -> storage.Risk
+	12, // 5: v1.ExportDeploymentResponse.deployment:type_name -> storage.Deployment
+	8,  // 6: v1.DeploymentLabelsResponse.LabelsEntry.value:type_name -> v1.DeploymentLabelsResponse.LabelValues
+	11, // 7: v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo.deployment:type_name -> storage.ListDeployment
+	14, // 8: v1.ListDeploymentsWithProcessInfoResponse.DeploymentWithProcessInfo.baseline_statuses:type_name -> storage.ContainerNameAndBaselineStatus
+	15, // 9: v1.DeploymentService.GetDeployment:input_type -> v1.ResourceByID
+	15, // 10: v1.DeploymentService.GetDeploymentWithRisk:input_type -> v1.ResourceByID
+	15, // 11: v1.DeploymentService.GetDeploymentRiskAISummary:input_type -> v1.ResourceByID
+	16, // 12: v1.DeploymentService.CountDeployments:input_type -> v1.RawQuery
+	16, // 13: v1.DeploymentService.ListDeployments:input_type -> v1.RawQuery
+	16, // 14: v1.DeploymentService.ListDeploymentsWithProcessInfo:input_type -> v1.RawQuery
+	17, // 15: v1.DeploymentService.GetLabels:input_type -> v1.Empty
+	5,  // 16: v1.DeploymentService.ExportDeployments:input_type -> v1.ExportDeploymentRequest
+	12, // 17: v1.DeploymentService.GetDeployment:output_type -> storage.Deployment
+	4,  // 18: v1.DeploymentService.GetDeploymentWithRisk:output_type -> v1.GetDeploymentWithRiskResponse
+	7,  // 19: v1.DeploymentService.GetDeploymentRiskAISummary:output_type -> v1.DeploymentRiskAISummaryResponse
+	2,  // 20: v1.DeploymentService.CountDeployments:output_type -> v1.CountDeploymentsResponse
+	1,  // 21: v1.DeploymentService.ListDeployments:output_type -> v1.ListDeploymentsResponse
+	3,  // 22: v1.DeploymentService.ListDeploymentsWithProcessInfo:output_type -> v1.ListDeploymentsWithProcessInfoResponse
+	0,  // 23: v1.DeploymentService.GetLabels:output_type -> v1.DeploymentLabelsResponse
+	6,  // 24: v1.DeploymentService.ExportDeployments:output_type -> v1.ExportDeploymentResponse
+	17, // [17:25] is the sub-list for method output_type
+	9,  // [9:17] is the sub-list for method input_type
 	9,  // [9:9] is the sub-list for extension type_name
 	9,  // [9:9] is the sub-list for extension extendee
 	0,  // [0:9] is the sub-list for field type_name
@@ -574,7 +624,7 @@ func file_api_v1_deployment_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_deployment_service_proto_rawDesc), len(file_api_v1_deployment_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   10,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/generated/api/v1/deployment_service.pb.gw.go b/generated/api/v1/deployment_service.pb.gw.go
index 2e57466fb729a..ae0d3da2eab9a 100644
--- a/generated/api/v1/deployment_service.pb.gw.go
+++ b/generated/api/v1/deployment_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_DeploymentService_GetDeployment_0(ctx context.Context, marshaler ru
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_DeploymentService_GetDeployment_0(ctx context.Context, marshaler ru
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -80,9 +80,6 @@ func request_DeploymentService_GetDeploymentWithRisk_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -91,6 +88,9 @@ func request_DeploymentService_GetDeploymentWithRisk_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetDeploymentWithRisk(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -113,6 +113,45 @@ func local_request_DeploymentService_GetDeploymentWithRisk_0(ctx context.Context
 	return msg, metadata, err
 }
 
+func request_DeploymentService_GetDeploymentRiskAISummary_0(ctx context.Context, marshaler runtime.Marshaler, client DeploymentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetDeploymentRiskAISummary(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DeploymentService_GetDeploymentRiskAISummary_0(ctx context.Context, marshaler runtime.Marshaler, server DeploymentServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	msg, err := server.GetDeploymentRiskAISummary(ctx, &protoReq)
+	return msg, metadata, err
+}
+
 var filter_DeploymentService_CountDeployments_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
 
 func request_DeploymentService_CountDeployments_0(ctx context.Context, marshaler runtime.Marshaler, client DeploymentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
@@ -120,15 +159,15 @@ func request_DeploymentService_CountDeployments_0(ctx context.Context, marshaler
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DeploymentService_CountDeployments_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountDeployments(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -155,15 +194,15 @@ func request_DeploymentService_ListDeployments_0(ctx context.Context, marshaler
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DeploymentService_ListDeployments_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListDeployments(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -190,15 +229,15 @@ func request_DeploymentService_ListDeploymentsWithProcessInfo_0(ctx context.Cont
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DeploymentService_ListDeploymentsWithProcessInfo_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListDeploymentsWithProcessInfo(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -246,15 +285,15 @@ func request_DeploymentService_ExportDeployments_0(ctx context.Context, marshale
 		protoReq ExportDeploymentRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DeploymentService_ExportDeployments_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.ExportDeployments(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -313,6 +352,26 @@ func RegisterDeploymentServiceHandlerServer(ctx context.Context, mux *runtime.Se
 		}
 		forward_DeploymentService_GetDeploymentWithRisk_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodGet, pattern_DeploymentService_GetDeploymentRiskAISummary_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v1.DeploymentService/GetDeploymentRiskAISummary", runtime.WithHTTPPathPattern("/v1/deploymentswithrisk/{id}/ai-summary"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DeploymentService_GetDeploymentRiskAISummary_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DeploymentService_GetDeploymentRiskAISummary_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodGet, pattern_DeploymentService_CountDeployments_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -474,6 +533,23 @@ func RegisterDeploymentServiceHandlerClient(ctx context.Context, mux *runtime.Se
 		}
 		forward_DeploymentService_GetDeploymentWithRisk_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodGet, pattern_DeploymentService_GetDeploymentRiskAISummary_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v1.DeploymentService/GetDeploymentRiskAISummary", runtime.WithHTTPPathPattern("/v1/deploymentswithrisk/{id}/ai-summary"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DeploymentService_GetDeploymentRiskAISummary_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DeploymentService_GetDeploymentRiskAISummary_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodGet, pattern_DeploymentService_CountDeployments_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -565,6 +641,7 @@ func RegisterDeploymentServiceHandlerClient(ctx context.Context, mux *runtime.Se
 var (
 	pattern_DeploymentService_GetDeployment_0                  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "deployments", "id"}, ""))
 	pattern_DeploymentService_GetDeploymentWithRisk_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "deploymentswithrisk", "id"}, ""))
+	pattern_DeploymentService_GetDeploymentRiskAISummary_0     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2, 2, 3}, []string{"v1", "deploymentswithrisk", "id", "ai-summary"}, ""))
 	pattern_DeploymentService_CountDeployments_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "deploymentscount"}, ""))
 	pattern_DeploymentService_ListDeployments_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "deployments"}, ""))
 	pattern_DeploymentService_ListDeploymentsWithProcessInfo_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "deploymentswithprocessinfo"}, ""))
@@ -575,6 +652,7 @@ var (
 var (
 	forward_DeploymentService_GetDeployment_0                  = runtime.ForwardResponseMessage
 	forward_DeploymentService_GetDeploymentWithRisk_0          = runtime.ForwardResponseMessage
+	forward_DeploymentService_GetDeploymentRiskAISummary_0     = runtime.ForwardResponseMessage
 	forward_DeploymentService_CountDeployments_0               = runtime.ForwardResponseMessage
 	forward_DeploymentService_ListDeployments_0                = runtime.ForwardResponseMessage
 	forward_DeploymentService_ListDeploymentsWithProcessInfo_0 = runtime.ForwardResponseMessage
diff --git a/generated/api/v1/deployment_service.swagger.json b/generated/api/v1/deployment_service.swagger.json
index babf77c2d9216..afa5445cc0098 100644
--- a/generated/api/v1/deployment_service.swagger.json
+++ b/generated/api/v1/deployment_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "DeploymentService"
+      "name": "DeploymentService",
+      "description": "DeploymentService APIs can be used to manage deployments."
     }
   ],
   "consumes": [
@@ -329,6 +330,37 @@
         ]
       }
     },
+    "/v1/deploymentswithrisk/{id}/ai-summary": {
+      "get": {
+        "summary": "GetDeploymentRiskAISummary returns an AI-generated risk summary for a deployment.",
+        "operationId": "DeploymentService_GetDeploymentRiskAISummary",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1DeploymentRiskAISummaryResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/googleRpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "DeploymentService"
+        ]
+      }
+    },
     "/v1/export/deployments": {
       "get": {
         "operationId": "DeploymentService_ExportDeployments",
@@ -425,7 +457,7 @@
         "UNKNOWN"
       ],
       "default": "UNSET",
-      "title": "For any update to EnvVarSource, please also update 'ui/src/messages/common.js'"
+      "description": "For any update to EnvVarSource, please also update 'ui/src/messages/common.js'"
     },
     "LabelSelectorRequirement": {
       "type": "object",
@@ -996,7 +1028,7 @@
         "CLUSTER_ADMIN"
       ],
       "default": "UNSET",
-      "title": "For any update to PermissionLevel, also update:\n- pkg/searchbasedpolicies/builders/k8s_rbac.go\n- ui/src/messages/common.js"
+      "description": "For any update to PermissionLevel, also update:\n- pkg/searchbasedpolicies/builders/k8s_rbac.go\n- ui/src/messages/common.js"
     },
     "storagePortConfig": {
       "type": "object",
@@ -1110,7 +1142,7 @@
         "SERVICEACCOUNT"
       ],
       "default": "UNKNOWN",
-      "title": "Next tag: 9"
+      "description": "Next tag: 9"
     },
     "storageSecurityContext": {
       "type": "object",
@@ -1250,6 +1282,14 @@
         }
       }
     },
+    "v1DeploymentRiskAISummaryResponse": {
+      "type": "object",
+      "properties": {
+        "summary": {
+          "type": "string"
+        }
+      }
+    },
     "v1ExportDeploymentResponse": {
       "type": "object",
       "properties": {
diff --git a/generated/api/v1/deployment_service_grpc.pb.go b/generated/api/v1/deployment_service_grpc.pb.go
index b261e0e7c1a1d..caa666bb3286c 100644
--- a/generated/api/v1/deployment_service_grpc.pb.go
+++ b/generated/api/v1/deployment_service_grpc.pb.go
@@ -22,6 +22,7 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	DeploymentService_GetDeployment_FullMethodName                  = "/v1.DeploymentService/GetDeployment"
 	DeploymentService_GetDeploymentWithRisk_FullMethodName          = "/v1.DeploymentService/GetDeploymentWithRisk"
+	DeploymentService_GetDeploymentRiskAISummary_FullMethodName     = "/v1.DeploymentService/GetDeploymentRiskAISummary"
 	DeploymentService_CountDeployments_FullMethodName               = "/v1.DeploymentService/CountDeployments"
 	DeploymentService_ListDeployments_FullMethodName                = "/v1.DeploymentService/ListDeployments"
 	DeploymentService_ListDeploymentsWithProcessInfo_FullMethodName = "/v1.DeploymentService/ListDeploymentsWithProcessInfo"
@@ -39,6 +40,8 @@ type DeploymentServiceClient interface {
 	GetDeployment(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*storage.Deployment, error)
 	// GetDeploymentWithRisk returns a deployment and its risk given its ID.
 	GetDeploymentWithRisk(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*GetDeploymentWithRiskResponse, error)
+	// GetDeploymentRiskAISummary returns an AI-generated risk summary for a deployment.
+	GetDeploymentRiskAISummary(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*DeploymentRiskAISummaryResponse, error)
 	// CountDeployments returns the number of deployments.
 	CountDeployments(ctx context.Context, in *RawQuery, opts ...grpc.CallOption) (*CountDeploymentsResponse, error)
 	// ListDeployments returns the list of deployments.
@@ -78,6 +81,16 @@ func (c *deploymentServiceClient) GetDeploymentWithRisk(ctx context.Context, in
 	return out, nil
 }
 
+func (c *deploymentServiceClient) GetDeploymentRiskAISummary(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*DeploymentRiskAISummaryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeploymentRiskAISummaryResponse)
+	err := c.cc.Invoke(ctx, DeploymentService_GetDeploymentRiskAISummary_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *deploymentServiceClient) CountDeployments(ctx context.Context, in *RawQuery, opts ...grpc.CallOption) (*CountDeploymentsResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CountDeploymentsResponse)
@@ -147,6 +160,8 @@ type DeploymentServiceServer interface {
 	GetDeployment(context.Context, *ResourceByID) (*storage.Deployment, error)
 	// GetDeploymentWithRisk returns a deployment and its risk given its ID.
 	GetDeploymentWithRisk(context.Context, *ResourceByID) (*GetDeploymentWithRiskResponse, error)
+	// GetDeploymentRiskAISummary returns an AI-generated risk summary for a deployment.
+	GetDeploymentRiskAISummary(context.Context, *ResourceByID) (*DeploymentRiskAISummaryResponse, error)
 	// CountDeployments returns the number of deployments.
 	CountDeployments(context.Context, *RawQuery) (*CountDeploymentsResponse, error)
 	// ListDeployments returns the list of deployments.
@@ -171,6 +186,9 @@ func (UnimplementedDeploymentServiceServer) GetDeployment(context.Context, *Reso
 func (UnimplementedDeploymentServiceServer) GetDeploymentWithRisk(context.Context, *ResourceByID) (*GetDeploymentWithRiskResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetDeploymentWithRisk not implemented")
 }
+func (UnimplementedDeploymentServiceServer) GetDeploymentRiskAISummary(context.Context, *ResourceByID) (*DeploymentRiskAISummaryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetDeploymentRiskAISummary not implemented")
+}
 func (UnimplementedDeploymentServiceServer) CountDeployments(context.Context, *RawQuery) (*CountDeploymentsResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method CountDeployments not implemented")
 }
@@ -242,6 +260,24 @@ func _DeploymentService_GetDeploymentWithRisk_Handler(srv interface{}, ctx conte
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DeploymentService_GetDeploymentRiskAISummary_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResourceByID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DeploymentServiceServer).GetDeploymentRiskAISummary(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DeploymentService_GetDeploymentRiskAISummary_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DeploymentServiceServer).GetDeploymentRiskAISummary(ctx, req.(*ResourceByID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DeploymentService_CountDeployments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(RawQuery)
 	if err := dec(in); err != nil {
@@ -340,6 +376,10 @@ var DeploymentService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetDeploymentWithRisk",
 			Handler:    _DeploymentService_GetDeploymentWithRisk_Handler,
 		},
+		{
+			MethodName: "GetDeploymentRiskAISummary",
+			Handler:    _DeploymentService_GetDeploymentRiskAISummary_Handler,
+		},
 		{
 			MethodName: "CountDeployments",
 			Handler:    _DeploymentService_CountDeployments_Handler,
diff --git a/generated/api/v1/deployment_service_vtproto.pb.go b/generated/api/v1/deployment_service_vtproto.pb.go
index 6b15be77cab20..0e20efed81604 100644
--- a/generated/api/v1/deployment_service_vtproto.pb.go
+++ b/generated/api/v1/deployment_service_vtproto.pb.go
@@ -248,6 +248,23 @@ func (m *ExportDeploymentResponse) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *DeploymentRiskAISummaryResponse) CloneVT() *DeploymentRiskAISummaryResponse {
+	if m == nil {
+		return (*DeploymentRiskAISummaryResponse)(nil)
+	}
+	r := new(DeploymentRiskAISummaryResponse)
+	r.Summary = m.Summary
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *DeploymentRiskAISummaryResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
 func (this *DeploymentLabelsResponse_LabelValues) EqualVT(that *DeploymentLabelsResponse_LabelValues) bool {
 	if this == that {
 		return true
@@ -536,6 +553,25 @@ func (this *ExportDeploymentResponse) EqualMessageVT(thatMsg proto.Message) bool
 	}
 	return this.EqualVT(that)
 }
+func (this *DeploymentRiskAISummaryResponse) EqualVT(that *DeploymentRiskAISummaryResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Summary != that.Summary {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *DeploymentRiskAISummaryResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*DeploymentRiskAISummaryResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
 func (m *DeploymentLabelsResponse_LabelValues) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -1038,6 +1074,46 @@ func (m *ExportDeploymentResponse) MarshalToSizedBufferVT(dAtA []byte) (int, err
 	return len(dAtA) - i, nil
 }
 
+func (m *DeploymentRiskAISummaryResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeploymentRiskAISummaryResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *DeploymentRiskAISummaryResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Summary) > 0 {
+		i -= len(m.Summary)
+		copy(dAtA[i:], m.Summary)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Summary)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *DeploymentLabelsResponse_LabelValues) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -1233,6 +1309,20 @@ func (m *ExportDeploymentResponse) SizeVT() (n int) {
 	return n
 }
 
+func (m *DeploymentRiskAISummaryResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Summary)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
 func (m *DeploymentLabelsResponse_LabelValues) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -2249,6 +2339,89 @@ func (m *ExportDeploymentResponse) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *DeploymentRiskAISummaryResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeploymentRiskAISummaryResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeploymentRiskAISummaryResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Summary", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Summary = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *DeploymentLabelsResponse_LabelValues) UnmarshalVTUnsafe(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -3281,3 +3454,90 @@ func (m *ExportDeploymentResponse) UnmarshalVTUnsafe(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *DeploymentRiskAISummaryResponse) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeploymentRiskAISummaryResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeploymentRiskAISummaryResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Summary", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.Summary = stringValue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/generated/api/v1/detection_service.pb.go b/generated/api/v1/detection_service.pb.go
index c38b91ddd1363..d031244214079 100644
--- a/generated/api/v1/detection_service.pb.go
+++ b/generated/api/v1/detection_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/detection_service.proto
 
diff --git a/generated/api/v1/detection_service.swagger.json b/generated/api/v1/detection_service.swagger.json
index 4bfb593f41f83..e1a657d04cf2d 100644
--- a/generated/api/v1/detection_service.swagger.json
+++ b/generated/api/v1/detection_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "DetectionService"
+      "name": "DetectionService",
+      "description": "DetectionService APIs can be used to check for build and deploy time policy violations."
     }
   ],
   "consumes": [
@@ -279,7 +280,19 @@
         "UNKNOWN"
       ],
       "default": "UNSET",
-      "title": "For any update to EnvVarSource, please also update 'ui/src/messages/common.js'"
+      "description": "For any update to EnvVarSource, please also update 'ui/src/messages/common.js'"
+    },
+    "ExclusionExcludeByKind": {
+      "type": "object",
+      "properties": {
+        "kinds": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ExclusionWorkloadKind"
+          }
+        }
+      },
+      "description": "ExcludeByKind excludes all workloads of the selected Kubernetes kinds."
     },
     "ExclusionImage": {
       "type": "object",
@@ -289,6 +302,16 @@
         }
       }
     },
+    "ExclusionWorkloadKind": {
+      "type": "string",
+      "enum": [
+        "WORKLOAD_KIND_UNSPECIFIED",
+        "CRON_JOB",
+        "JOB"
+      ],
+      "default": "WORKLOAD_KIND_UNSPECIFIED",
+      "description": "WorkloadKind is a Kubernetes workload kind that can be excluded from a policy in bulk."
+    },
     "FileAccessFileMetadata": {
       "type": "object",
       "properties": {
@@ -1092,15 +1115,18 @@
         "name": {
           "type": "string"
         },
-        "deployment": {
-          "$ref": "#/definitions/storageExclusionDeployment"
-        },
         "image": {
           "$ref": "#/definitions/ExclusionImage"
         },
         "expiration": {
           "type": "string",
           "format": "date-time"
+        },
+        "deployment": {
+          "$ref": "#/definitions/storageExclusionDeployment"
+        },
+        "excludeByKind": {
+          "$ref": "#/definitions/ExclusionExcludeByKind"
         }
       }
     },
@@ -1250,7 +1276,7 @@
         "INTERNAL_ENTITIES"
       ],
       "default": "UNKNOWN_TYPE",
-      "title": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
+      "description": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
     },
     "storagePermissionLevel": {
       "type": "string",
@@ -1263,7 +1289,7 @@
         "CLUSTER_ADMIN"
       ],
       "default": "UNSET",
-      "title": "For any update to PermissionLevel, also update:\n- pkg/searchbasedpolicies/builders/k8s_rbac.go\n- ui/src/messages/common.js"
+      "description": "For any update to PermissionLevel, also update:\n- pkg/searchbasedpolicies/builders/k8s_rbac.go\n- ui/src/messages/common.js"
     },
     "storagePolicy": {
       "type": "object",
@@ -1314,7 +1340,7 @@
             "type": "object",
             "$ref": "#/definitions/storageExclusion"
           },
-          "description": "Define deployments or images that should be excluded from this policy."
+          "description": "Define deployments, images, or workload kinds that should be excluded from this policy."
         },
         "scope": {
           "type": "array",
diff --git a/generated/api/v1/discovered_cluster_service.pb.go b/generated/api/v1/discovered_cluster_service.pb.go
index d67e410e47c81..d90390f43f837 100644
--- a/generated/api/v1/discovered_cluster_service.pb.go
+++ b/generated/api/v1/discovered_cluster_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/discovered_cluster_service.proto
 
diff --git a/generated/api/v1/discovered_cluster_service.pb.gw.go b/generated/api/v1/discovered_cluster_service.pb.gw.go
index 10892f9ceb505..db873c116ff01 100644
--- a/generated/api/v1/discovered_cluster_service.pb.gw.go
+++ b/generated/api/v1/discovered_cluster_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_DiscoveredClustersService_CountDiscoveredClusters_0(ctx context.Con
 		protoReq CountDiscoveredClustersRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DiscoveredClustersService_CountDiscoveredClusters_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountDiscoveredClusters(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -76,9 +76,6 @@ func request_DiscoveredClustersService_GetDiscoveredCluster_0(ctx context.Contex
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -87,6 +84,9 @@ func request_DiscoveredClustersService_GetDiscoveredCluster_0(ctx context.Contex
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetDiscoveredCluster(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,15 +116,15 @@ func request_DiscoveredClustersService_ListDiscoveredClusters_0(ctx context.Cont
 		protoReq ListDiscoveredClustersRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DiscoveredClustersService_ListDiscoveredClusters_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListDiscoveredClusters(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/empty.pb.go b/generated/api/v1/empty.pb.go
index 29b2451dc443b..58f3dd273b55d 100644
--- a/generated/api/v1/empty.pb.go
+++ b/generated/api/v1/empty.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/empty.proto
 
diff --git a/generated/api/v1/feature_flag_service.pb.go b/generated/api/v1/feature_flag_service.pb.go
index 71964de453878..7054015e5656b 100644
--- a/generated/api/v1/feature_flag_service.pb.go
+++ b/generated/api/v1/feature_flag_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/feature_flag_service.proto
 
diff --git a/generated/api/v1/feature_flag_service.swagger.json b/generated/api/v1/feature_flag_service.swagger.json
index 795e4e2532902..c7896b60c6319 100644
--- a/generated/api/v1/feature_flag_service.swagger.json
+++ b/generated/api/v1/feature_flag_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "FeatureFlagService"
+      "name": "FeatureFlagService",
+      "description": "FeatureFlagService retrieves information about feature flags."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/group_service.pb.go b/generated/api/v1/group_service.pb.go
index 79eee42cb6a1a..3a10dba133c19 100644
--- a/generated/api/v1/group_service.pb.go
+++ b/generated/api/v1/group_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/group_service.proto
 
diff --git a/generated/api/v1/group_service.pb.gw.go b/generated/api/v1/group_service.pb.gw.go
index e1d807e755e26..4b73b238ea96b 100644
--- a/generated/api/v1/group_service.pb.gw.go
+++ b/generated/api/v1/group_service.pb.gw.go
@@ -43,15 +43,15 @@ func request_GroupService_GetGroups_0(ctx context.Context, marshaler runtime.Mar
 		protoReq GetGroupsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_GroupService_GetGroups_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetGroups(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -78,15 +78,15 @@ func request_GroupService_GetGroup_0(ctx context.Context, marshaler runtime.Mars
 		protoReq storage.GroupProperties
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_GroupService_GetGroup_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetGroup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -170,15 +170,15 @@ func request_GroupService_UpdateGroup_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Group); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_GroupService_UpdateGroup_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateGroup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -208,15 +208,15 @@ func request_GroupService_DeleteGroup_0(ctx context.Context, marshaler runtime.M
 		protoReq DeleteGroupRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_GroupService_DeleteGroup_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteGroup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/grpc_preference_service.pb.go b/generated/api/v1/grpc_preference_service.pb.go
index 8e57e5ea24a42..4fa4723aa6ba1 100644
--- a/generated/api/v1/grpc_preference_service.pb.go
+++ b/generated/api/v1/grpc_preference_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/grpc_preference_service.proto
 
diff --git a/generated/api/v1/image_integration_service.pb.go b/generated/api/v1/image_integration_service.pb.go
index 9d464ac7f4274..990fcb98237f5 100644
--- a/generated/api/v1/image_integration_service.pb.go
+++ b/generated/api/v1/image_integration_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/image_integration_service.proto
 
diff --git a/generated/api/v1/image_integration_service.pb.gw.go b/generated/api/v1/image_integration_service.pb.gw.go
index 2d5fab0235a4b..1be46ef0ea676 100644
--- a/generated/api/v1/image_integration_service.pb.gw.go
+++ b/generated/api/v1/image_integration_service.pb.gw.go
@@ -42,9 +42,6 @@ func request_ImageIntegrationService_GetImageIntegration_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -53,6 +50,9 @@ func request_ImageIntegrationService_GetImageIntegration_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetImageIntegration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -82,15 +82,15 @@ func request_ImageIntegrationService_GetImageIntegrations_0(ctx context.Context,
 		protoReq GetImageIntegrationsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ImageIntegrationService_GetImageIntegrations_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetImageIntegrations(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -146,9 +146,6 @@ func request_ImageIntegrationService_PutImageIntegration_0(ctx context.Context,
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -157,6 +154,9 @@ func request_ImageIntegrationService_PutImageIntegration_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutImageIntegration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -215,9 +215,6 @@ func request_ImageIntegrationService_DeleteImageIntegration_0(ctx context.Contex
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -226,6 +223,9 @@ func request_ImageIntegrationService_DeleteImageIntegration_0(ctx context.Contex
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteImageIntegration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -257,9 +257,6 @@ func request_ImageIntegrationService_UpdateImageIntegration_0(ctx context.Contex
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["config.id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "config.id")
@@ -268,6 +265,9 @@ func request_ImageIntegrationService_UpdateImageIntegration_0(ctx context.Contex
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "config.id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateImageIntegration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/image_integration_service.swagger.json b/generated/api/v1/image_integration_service.swagger.json
index 1385bd1518eb2..9006e3b4e1b25 100644
--- a/generated/api/v1/image_integration_service.swagger.json
+++ b/generated/api/v1/image_integration_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ImageIntegrationService"
+      "name": "ImageIntegrationService",
+      "description": "ImageIntegrationService APIs manage image registry and image scanner integration."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/image_service.pb.go b/generated/api/v1/image_service.pb.go
index faeb7f0d10492..debf248ab5af0 100644
--- a/generated/api/v1/image_service.pb.go
+++ b/generated/api/v1/image_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/image_service.proto
 
@@ -1309,7 +1309,8 @@ const file_api_v1_image_service_proto_rawDesc = "" +
 	"\atimeout\x18\x01 \x01(\x05R\atimeout\x12\x14\n" +
 	"\x05query\x18\x02 \x01(\tR\x05query\";\n" +
 	"\x13ExportImageResponse\x12$\n" +
-	"\x05image\x18\x01 \x01(\v2\x0e.storage.ImageR\x05image2\xce\t\n" +
+	"\x05image\x18\x01 \x01(\v2\x0e.storage.ImageR\x05image2\xac\n" +
+	"\n" +
 	"\fImageService\x12H\n" +
 	"\bGetImage\x12\x13.v1.GetImageRequest\x1a\x0e.storage.Image\"\x17\x82\xd3\xe4\x93\x02\x11\x12\x0f/v1/images/{id}\x12M\n" +
 	"\vCountImages\x12\f.v1.RawQuery\x1a\x17.v1.CountImagesResponse\"\x17\x82\xd3\xe4\x93\x02\x11\x12\x0f/v1/imagescount\x12F\n" +
@@ -1317,7 +1318,8 @@ const file_api_v1_image_service_proto_rawDesc = "" +
 	"ListImages\x12\f.v1.RawQuery\x1a\x16.v1.ListImagesResponse\"\x12\x82\xd3\xe4\x93\x02\f\x12\n" +
 	"/v1/images\x12M\n" +
 	"\tScanImage\x12\x14.v1.ScanImageRequest\x1a\x0e.storage.Image\"\x1a\x82\xd3\xe4\x93\x02\x14:\x01*\"\x0f/v1/images/scan\x12P\n" +
-	"\x11ScanImageInternal\x12\x1c.v1.ScanImageInternalRequest\x1a\x1d.v1.ScanImageInternalResponse\x12q\n" +
+	"\x11ScanImageInternal\x12\x1c.v1.ScanImageInternalRequest\x1a\x1d.v1.ScanImageInternalResponse\x12\\\n" +
+	"\x1dScanImageInternalForAdmission\x12\x1c.v1.ScanImageInternalRequest\x1a\x1d.v1.ScanImageInternalResponse\x12q\n" +
 	"\x1fGetImageVulnerabilitiesInternal\x12*.v1.GetImageVulnerabilitiesInternalRequest\x1a\x1d.v1.ScanImageInternalResponse\"\x03\x88\x02\x01\x12^\n" +
 	"\x18EnrichLocalImageInternal\x12#.v1.EnrichLocalImageInternalRequest\x1a\x1d.v1.ScanImageInternalResponse\x12T\n" +
 	"\x1dUpdateLocalScanStatusInternal\x12(.v1.UpdateLocalScanStatusInternalRequest\x1a\t.v1.Empty\x12\\\n" +
@@ -1406,31 +1408,33 @@ var file_api_v1_image_service_proto_depIdxs = []int32{
 	31, // 21: v1.ImageService.ListImages:input_type -> v1.RawQuery
 	4,  // 22: v1.ImageService.ScanImage:input_type -> v1.ScanImageRequest
 	5,  // 23: v1.ImageService.ScanImageInternal:input_type -> v1.ScanImageInternalRequest
-	7,  // 24: v1.ImageService.GetImageVulnerabilitiesInternal:input_type -> v1.GetImageVulnerabilitiesInternalRequest
-	8,  // 25: v1.ImageService.EnrichLocalImageInternal:input_type -> v1.EnrichLocalImageInternalRequest
-	9,  // 26: v1.ImageService.UpdateLocalScanStatusInternal:input_type -> v1.UpdateLocalScanStatusInternalRequest
-	33, // 27: v1.ImageService.InvalidateScanAndRegistryCaches:input_type -> v1.Empty
-	10, // 28: v1.ImageService.DeleteImages:input_type -> v1.DeleteImagesRequest
-	12, // 29: v1.ImageService.WatchImage:input_type -> v1.WatchImageRequest
-	14, // 30: v1.ImageService.UnwatchImage:input_type -> v1.UnwatchImageRequest
-	33, // 31: v1.ImageService.GetWatchedImages:input_type -> v1.Empty
-	17, // 32: v1.ImageService.ExportImages:input_type -> v1.ExportImageRequest
-	23, // 33: v1.ImageService.GetImage:output_type -> storage.Image
-	3,  // 34: v1.ImageService.CountImages:output_type -> v1.CountImagesResponse
-	2,  // 35: v1.ImageService.ListImages:output_type -> v1.ListImagesResponse
-	23, // 36: v1.ImageService.ScanImage:output_type -> storage.Image
-	6,  // 37: v1.ImageService.ScanImageInternal:output_type -> v1.ScanImageInternalResponse
-	6,  // 38: v1.ImageService.GetImageVulnerabilitiesInternal:output_type -> v1.ScanImageInternalResponse
-	6,  // 39: v1.ImageService.EnrichLocalImageInternal:output_type -> v1.ScanImageInternalResponse
-	33, // 40: v1.ImageService.UpdateLocalScanStatusInternal:output_type -> v1.Empty
-	33, // 41: v1.ImageService.InvalidateScanAndRegistryCaches:output_type -> v1.Empty
-	11, // 42: v1.ImageService.DeleteImages:output_type -> v1.DeleteImagesResponse
-	13, // 43: v1.ImageService.WatchImage:output_type -> v1.WatchImageResponse
-	33, // 44: v1.ImageService.UnwatchImage:output_type -> v1.Empty
-	15, // 45: v1.ImageService.GetWatchedImages:output_type -> v1.GetWatchedImagesResponse
-	18, // 46: v1.ImageService.ExportImages:output_type -> v1.ExportImageResponse
-	33, // [33:47] is the sub-list for method output_type
-	19, // [19:33] is the sub-list for method input_type
+	5,  // 24: v1.ImageService.ScanImageInternalForAdmission:input_type -> v1.ScanImageInternalRequest
+	7,  // 25: v1.ImageService.GetImageVulnerabilitiesInternal:input_type -> v1.GetImageVulnerabilitiesInternalRequest
+	8,  // 26: v1.ImageService.EnrichLocalImageInternal:input_type -> v1.EnrichLocalImageInternalRequest
+	9,  // 27: v1.ImageService.UpdateLocalScanStatusInternal:input_type -> v1.UpdateLocalScanStatusInternalRequest
+	33, // 28: v1.ImageService.InvalidateScanAndRegistryCaches:input_type -> v1.Empty
+	10, // 29: v1.ImageService.DeleteImages:input_type -> v1.DeleteImagesRequest
+	12, // 30: v1.ImageService.WatchImage:input_type -> v1.WatchImageRequest
+	14, // 31: v1.ImageService.UnwatchImage:input_type -> v1.UnwatchImageRequest
+	33, // 32: v1.ImageService.GetWatchedImages:input_type -> v1.Empty
+	17, // 33: v1.ImageService.ExportImages:input_type -> v1.ExportImageRequest
+	23, // 34: v1.ImageService.GetImage:output_type -> storage.Image
+	3,  // 35: v1.ImageService.CountImages:output_type -> v1.CountImagesResponse
+	2,  // 36: v1.ImageService.ListImages:output_type -> v1.ListImagesResponse
+	23, // 37: v1.ImageService.ScanImage:output_type -> storage.Image
+	6,  // 38: v1.ImageService.ScanImageInternal:output_type -> v1.ScanImageInternalResponse
+	6,  // 39: v1.ImageService.ScanImageInternalForAdmission:output_type -> v1.ScanImageInternalResponse
+	6,  // 40: v1.ImageService.GetImageVulnerabilitiesInternal:output_type -> v1.ScanImageInternalResponse
+	6,  // 41: v1.ImageService.EnrichLocalImageInternal:output_type -> v1.ScanImageInternalResponse
+	33, // 42: v1.ImageService.UpdateLocalScanStatusInternal:output_type -> v1.Empty
+	33, // 43: v1.ImageService.InvalidateScanAndRegistryCaches:output_type -> v1.Empty
+	11, // 44: v1.ImageService.DeleteImages:output_type -> v1.DeleteImagesResponse
+	13, // 45: v1.ImageService.WatchImage:output_type -> v1.WatchImageResponse
+	33, // 46: v1.ImageService.UnwatchImage:output_type -> v1.Empty
+	15, // 47: v1.ImageService.GetWatchedImages:output_type -> v1.GetWatchedImagesResponse
+	18, // 48: v1.ImageService.ExportImages:output_type -> v1.ExportImageResponse
+	34, // [34:49] is the sub-list for method output_type
+	19, // [19:34] is the sub-list for method input_type
 	19, // [19:19] is the sub-list for extension type_name
 	19, // [19:19] is the sub-list for extension extendee
 	0,  // [0:19] is the sub-list for field type_name
diff --git a/generated/api/v1/image_service.pb.gw.go b/generated/api/v1/image_service.pb.gw.go
index b90487a79c248..bd047a05a4f2a 100644
--- a/generated/api/v1/image_service.pb.gw.go
+++ b/generated/api/v1/image_service.pb.gw.go
@@ -43,9 +43,6 @@ func request_ImageService_GetImage_0(ctx context.Context, marshaler runtime.Mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -60,6 +57,9 @@ func request_ImageService_GetImage_0(ctx context.Context, marshaler runtime.Mars
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ImageService_GetImage_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetImage(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -95,15 +95,15 @@ func request_ImageService_CountImages_0(ctx context.Context, marshaler runtime.M
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ImageService_CountImages_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountImages(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -130,15 +130,15 @@ func request_ImageService_ListImages_0(ctx context.Context, marshaler runtime.Ma
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ImageService_ListImages_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListImages(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -213,15 +213,15 @@ func request_ImageService_DeleteImages_0(ctx context.Context, marshaler runtime.
 		protoReq DeleteImagesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ImageService_DeleteImages_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteImages(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -275,15 +275,15 @@ func request_ImageService_UnwatchImage_0(ctx context.Context, marshaler runtime.
 		protoReq UnwatchImageRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ImageService_UnwatchImage_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UnwatchImage(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -331,15 +331,15 @@ func request_ImageService_ExportImages_0(ctx context.Context, marshaler runtime.
 		protoReq ExportImageRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ImageService_ExportImages_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.ExportImages(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
diff --git a/generated/api/v1/image_service.swagger.json b/generated/api/v1/image_service.swagger.json
index 57c003b404037..013a93f5f0b2b 100644
--- a/generated/api/v1/image_service.swagger.json
+++ b/generated/api/v1/image_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ImageService"
+      "name": "ImageService",
+      "description": "ImageService APIs manages image metadata."
     }
   ],
   "consumes": [
@@ -1040,9 +1041,13 @@
         },
         "cisaKev": {
           "type": "boolean"
+        },
+        "origin": {
+          "$ref": "#/definitions/storageVulnOrigin",
+          "description": "origin indicates where vulnerability details came from, origin may be an aggregator (such as OSV)."
         }
       },
-      "title": "Next Tag: 29"
+      "title": "Next Tag: 30"
     },
     "storageExploit": {
       "type": "object",
@@ -1483,6 +1488,22 @@
         }
       }
     },
+    "storageVulnOrigin": {
+      "type": "string",
+      "enum": [
+        "VULN_ORIGIN_OTHER",
+        "VULN_ORIGIN_OSV",
+        "VULN_ORIGIN_ALPINE",
+        "VULN_ORIGIN_AMAZON",
+        "VULN_ORIGIN_DEBIAN",
+        "VULN_ORIGIN_ORACLE",
+        "VULN_ORIGIN_PHOTON",
+        "VULN_ORIGIN_RED_HAT",
+        "VULN_ORIGIN_SUSE",
+        "VULN_ORIGIN_UBUNTU"
+      ],
+      "default": "VULN_ORIGIN_OTHER"
+    },
     "storageVulnerabilitySeverity": {
       "type": "string",
       "enum": [
diff --git a/generated/api/v1/image_service_grpc.pb.go b/generated/api/v1/image_service_grpc.pb.go
index d509663dcd851..9f23fdcda8632 100644
--- a/generated/api/v1/image_service_grpc.pb.go
+++ b/generated/api/v1/image_service_grpc.pb.go
@@ -25,6 +25,7 @@ const (
 	ImageService_ListImages_FullMethodName                      = "/v1.ImageService/ListImages"
 	ImageService_ScanImage_FullMethodName                       = "/v1.ImageService/ScanImage"
 	ImageService_ScanImageInternal_FullMethodName               = "/v1.ImageService/ScanImageInternal"
+	ImageService_ScanImageInternalForAdmission_FullMethodName   = "/v1.ImageService/ScanImageInternalForAdmission"
 	ImageService_GetImageVulnerabilitiesInternal_FullMethodName = "/v1.ImageService/GetImageVulnerabilitiesInternal"
 	ImageService_EnrichLocalImageInternal_FullMethodName        = "/v1.ImageService/EnrichLocalImageInternal"
 	ImageService_UpdateLocalScanStatusInternal_FullMethodName   = "/v1.ImageService/UpdateLocalScanStatusInternal"
@@ -52,6 +53,12 @@ type ImageServiceClient interface {
 	ScanImage(ctx context.Context, in *ScanImageRequest, opts ...grpc.CallOption) (*storage.Image, error)
 	// ScanImageInternal is used solely by the Sensor and Admission Controller to send scan requests
 	ScanImageInternal(ctx context.Context, in *ScanImageInternalRequest, opts ...grpc.CallOption) (*ScanImageInternalResponse, error)
+	// ScanImageInternalForAdmission is used solely by the Admission Controller
+	// (via Sensor or directly) to send scan requests. For tag-only images it
+	// refreshes registry metadata but reuses an existing Central scan when
+	// the resolved digest is already known. For digest-based images it
+	// behaves identically to ScanImageInternal.
+	ScanImageInternalForAdmission(ctx context.Context, in *ScanImageInternalRequest, opts ...grpc.CallOption) (*ScanImageInternalResponse, error)
 	// Deprecated: Do not use.
 	// Deprecated: GetImageVulnerabilities is used solely by the Sensor to send vulnerability matching requests.
 	GetImageVulnerabilitiesInternal(ctx context.Context, in *GetImageVulnerabilitiesInternalRequest, opts ...grpc.CallOption) (*ScanImageInternalResponse, error)
@@ -135,6 +142,16 @@ func (c *imageServiceClient) ScanImageInternal(ctx context.Context, in *ScanImag
 	return out, nil
 }
 
+func (c *imageServiceClient) ScanImageInternalForAdmission(ctx context.Context, in *ScanImageInternalRequest, opts ...grpc.CallOption) (*ScanImageInternalResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ScanImageInternalResponse)
+	err := c.cc.Invoke(ctx, ImageService_ScanImageInternalForAdmission_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // Deprecated: Do not use.
 func (c *imageServiceClient) GetImageVulnerabilitiesInternal(ctx context.Context, in *GetImageVulnerabilitiesInternalRequest, opts ...grpc.CallOption) (*ScanImageInternalResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
@@ -251,6 +268,12 @@ type ImageServiceServer interface {
 	ScanImage(context.Context, *ScanImageRequest) (*storage.Image, error)
 	// ScanImageInternal is used solely by the Sensor and Admission Controller to send scan requests
 	ScanImageInternal(context.Context, *ScanImageInternalRequest) (*ScanImageInternalResponse, error)
+	// ScanImageInternalForAdmission is used solely by the Admission Controller
+	// (via Sensor or directly) to send scan requests. For tag-only images it
+	// refreshes registry metadata but reuses an existing Central scan when
+	// the resolved digest is already known. For digest-based images it
+	// behaves identically to ScanImageInternal.
+	ScanImageInternalForAdmission(context.Context, *ScanImageInternalRequest) (*ScanImageInternalResponse, error)
 	// Deprecated: Do not use.
 	// Deprecated: GetImageVulnerabilities is used solely by the Sensor to send vulnerability matching requests.
 	GetImageVulnerabilitiesInternal(context.Context, *GetImageVulnerabilitiesInternalRequest) (*ScanImageInternalResponse, error)
@@ -298,6 +321,9 @@ func (UnimplementedImageServiceServer) ScanImage(context.Context, *ScanImageRequ
 func (UnimplementedImageServiceServer) ScanImageInternal(context.Context, *ScanImageInternalRequest) (*ScanImageInternalResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method ScanImageInternal not implemented")
 }
+func (UnimplementedImageServiceServer) ScanImageInternalForAdmission(context.Context, *ScanImageInternalRequest) (*ScanImageInternalResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ScanImageInternalForAdmission not implemented")
+}
 func (UnimplementedImageServiceServer) GetImageVulnerabilitiesInternal(context.Context, *GetImageVulnerabilitiesInternalRequest) (*ScanImageInternalResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetImageVulnerabilitiesInternal not implemented")
 }
@@ -435,6 +461,24 @@ func _ImageService_ScanImageInternal_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _ImageService_ScanImageInternalForAdmission_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ScanImageInternalRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ImageServiceServer).ScanImageInternalForAdmission(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ImageService_ScanImageInternalForAdmission_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ImageServiceServer).ScanImageInternalForAdmission(ctx, req.(*ScanImageInternalRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _ImageService_GetImageVulnerabilitiesInternal_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetImageVulnerabilitiesInternalRequest)
 	if err := dec(in); err != nil {
@@ -617,6 +661,10 @@ var ImageService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ScanImageInternal",
 			Handler:    _ImageService_ScanImageInternal_Handler,
 		},
+		{
+			MethodName: "ScanImageInternalForAdmission",
+			Handler:    _ImageService_ScanImageInternalForAdmission_Handler,
+		},
 		{
 			MethodName: "GetImageVulnerabilitiesInternal",
 			Handler:    _ImageService_GetImageVulnerabilitiesInternal_Handler,
diff --git a/generated/api/v1/integration_health_service.pb.go b/generated/api/v1/integration_health_service.pb.go
index d0bcf266f4728..f30cbde79c49f 100644
--- a/generated/api/v1/integration_health_service.pb.go
+++ b/generated/api/v1/integration_health_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/integration_health_service.proto
 
diff --git a/generated/api/v1/integration_health_service.pb.gw.go b/generated/api/v1/integration_health_service.pb.gw.go
index 3e0b4c0bf7568..14e6b575d6a80 100644
--- a/generated/api/v1/integration_health_service.pb.gw.go
+++ b/generated/api/v1/integration_health_service.pb.gw.go
@@ -126,15 +126,15 @@ func request_IntegrationHealthService_GetVulnDefinitionsInfo_0(ctx context.Conte
 		protoReq VulnDefinitionsInfoRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_IntegrationHealthService_GetVulnDefinitionsInfo_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVulnDefinitionsInfo(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/metadata_service.pb.go b/generated/api/v1/metadata_service.pb.go
index a2fe9cff432c5..c472242c142a9 100644
--- a/generated/api/v1/metadata_service.pb.go
+++ b/generated/api/v1/metadata_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/metadata_service.proto
 
@@ -180,7 +180,7 @@ func (x CentralServicesCapabilities_CapabilityStatus) Number() protoreflect.Enum
 
 // Deprecated: Use CentralServicesCapabilities_CapabilityStatus.Descriptor instead.
 func (CentralServicesCapabilities_CapabilityStatus) EnumDescriptor() ([]byte, []int) {
-	return file_api_v1_metadata_service_proto_rawDescGZIP(), []int{6, 0}
+	return file_api_v1_metadata_service_proto_rawDescGZIP(), []int{7, 0}
 }
 
 type Metadata struct {
@@ -569,6 +569,58 @@ func (x *DatabaseBackupStatus) GetBackupInfo() *storage.BackupInfo {
 	return nil
 }
 
+type LightspeedStatusResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Available     bool                   `protobuf:"varint,1,opt,name=available,proto3" json:"available,omitempty"`
+	Message       string                 `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LightspeedStatusResponse) Reset() {
+	*x = LightspeedStatusResponse{}
+	mi := &file_api_v1_metadata_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LightspeedStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LightspeedStatusResponse) ProtoMessage() {}
+
+func (x *LightspeedStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_metadata_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LightspeedStatusResponse.ProtoReflect.Descriptor instead.
+func (*LightspeedStatusResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_metadata_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *LightspeedStatusResponse) GetAvailable() bool {
+	if x != nil {
+		return x.Available
+	}
+	return false
+}
+
+func (x *LightspeedStatusResponse) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
 // Provides availability of certain functionality of Central Services in the current configuration.
 // The initial intended use is to disable certain functionality that does not make sense in the Cloud Service context.
 type CentralServicesCapabilities struct {
@@ -595,7 +647,7 @@ type CentralServicesCapabilities struct {
 
 func (x *CentralServicesCapabilities) Reset() {
 	*x = CentralServicesCapabilities{}
-	mi := &file_api_v1_metadata_service_proto_msgTypes[6]
+	mi := &file_api_v1_metadata_service_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -607,7 +659,7 @@ func (x *CentralServicesCapabilities) String() string {
 func (*CentralServicesCapabilities) ProtoMessage() {}
 
 func (x *CentralServicesCapabilities) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v1_metadata_service_proto_msgTypes[6]
+	mi := &file_api_v1_metadata_service_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -620,7 +672,7 @@ func (x *CentralServicesCapabilities) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CentralServicesCapabilities.ProtoReflect.Descriptor instead.
 func (*CentralServicesCapabilities) Descriptor() ([]byte, []int) {
-	return file_api_v1_metadata_service_proto_rawDescGZIP(), []int{6}
+	return file_api_v1_metadata_service_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *CentralServicesCapabilities) GetCentralScanningCanUseContainerIamRoleForEcr() CentralServicesCapabilities_CapabilityStatus {
@@ -702,7 +754,10 @@ const file_api_v1_metadata_service_proto_rawDesc = "" +
 	"PostgresDB\x10\x02\"L\n" +
 	"\x14DatabaseBackupStatus\x124\n" +
 	"\vbackup_info\x18\x01 \x01(\v2\x13.storage.BackupInfoR\n" +
-	"backupInfo\"\x90\x06\n" +
+	"backupInfo\"R\n" +
+	"\x18LightspeedStatusResponse\x12\x1c\n" +
+	"\tavailable\x18\x01 \x01(\bR\tavailable\x12\x18\n" +
+	"\amessage\x18\x02 \x01(\tR\amessage\"\x90\x06\n" +
 	"\x1bCentralServicesCapabilities\x12\x9a\x01\n" +
 	"3central_scanning_can_use_container_iam_role_for_ecr\x18\x01 \x01(\x0e20.v1.CentralServicesCapabilities.CapabilityStatusR+centralScanningCanUseContainerIamRoleForEcr\x12\x89\x01\n" +
 	")central_can_use_cloud_backup_integrations\x18\x02 \x01(\x0e20.v1.CentralServicesCapabilities.CapabilityStatusR$centralCanUseCloudBackupIntegrations\x12\x91\x01\n" +
@@ -711,13 +766,14 @@ const file_api_v1_metadata_service_proto_rawDesc = "" +
 	"'central_can_use_acscs_email_integration\x18\x05 \x01(\x0e20.v1.CentralServicesCapabilities.CapabilityStatusR\"centralCanUseAcscsEmailIntegration\"C\n" +
 	"\x10CapabilityStatus\x12\x17\n" +
 	"\x13CapabilityAvailable\x10\x00\x12\x16\n" +
-	"\x12CapabilityDisabled\x10\x012\xc1\x03\n" +
+	"\x12CapabilityDisabled\x10\x012\xa0\x04\n" +
 	"\x0fMetadataService\x12<\n" +
 	"\vGetMetadata\x12\t.v1.Empty\x1a\f.v1.Metadata\"\x14\x82\xd3\xe4\x93\x02\x0e\x12\f/v1/metadata\x12\\\n" +
 	"\fTLSChallenge\x12\x17.v1.TLSChallengeRequest\x1a\x18.v1.TLSChallengeResponse\"\x19\x82\xd3\xe4\x93\x02\x13\x12\x11/v1/tls-challenge\x12O\n" +
 	"\x11GetDatabaseStatus\x12\t.v1.Empty\x1a\x12.v1.DatabaseStatus\"\x1b\x82\xd3\xe4\x93\x02\x15\x12\x13/v1/database/status\x12Y\n" +
 	"\x17GetDatabaseBackupStatus\x12\t.v1.Empty\x1a\x18.v1.DatabaseBackupStatus\"\x19\x82\xd3\xe4\x93\x02\x13\x12\x11/v1/backup/status\x12f\n" +
-	"\x16GetCentralCapabilities\x12\t.v1.Empty\x1a\x1f.v1.CentralServicesCapabilities\" \x82\xd3\xe4\x93\x02\x1a\x12\x18/v1/central-capabilitiesB'\n" +
+	"\x16GetCentralCapabilities\x12\t.v1.Empty\x1a\x1f.v1.CentralServicesCapabilities\" \x82\xd3\xe4\x93\x02\x1a\x12\x18/v1/central-capabilities\x12]\n" +
+	"\x13GetLightspeedStatus\x12\t.v1.Empty\x1a\x1c.v1.LightspeedStatusResponse\"\x1d\x82\xd3\xe4\x93\x02\x17\x12\x15/v1/lightspeed/statusB'\n" +
 	"\x18io.stackrox.proto.api.v1Z\v./api/v1;v1X\x01b\x06proto3"
 
 var (
@@ -733,7 +789,7 @@ func file_api_v1_metadata_service_proto_rawDescGZIP() []byte {
 }
 
 var file_api_v1_metadata_service_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_api_v1_metadata_service_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_api_v1_metadata_service_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_api_v1_metadata_service_proto_goTypes = []any{
 	(Metadata_LicenseStatus)(0),                       // 0: v1.Metadata.LicenseStatus
 	(DatabaseStatus_DatabaseType)(0),                  // 1: v1.DatabaseStatus.DatabaseType
@@ -744,31 +800,34 @@ var file_api_v1_metadata_service_proto_goTypes = []any{
 	(*TLSChallengeRequest)(nil),                       // 6: v1.TLSChallengeRequest
 	(*DatabaseStatus)(nil),                            // 7: v1.DatabaseStatus
 	(*DatabaseBackupStatus)(nil),                      // 8: v1.DatabaseBackupStatus
-	(*CentralServicesCapabilities)(nil),               // 9: v1.CentralServicesCapabilities
-	(*storage.BackupInfo)(nil),                        // 10: storage.BackupInfo
-	(*Empty)(nil),                                     // 11: v1.Empty
+	(*LightspeedStatusResponse)(nil),                  // 9: v1.LightspeedStatusResponse
+	(*CentralServicesCapabilities)(nil),               // 10: v1.CentralServicesCapabilities
+	(*storage.BackupInfo)(nil),                        // 11: storage.BackupInfo
+	(*Empty)(nil),                                     // 12: v1.Empty
 }
 var file_api_v1_metadata_service_proto_depIdxs = []int32{
 	0,  // 0: v1.Metadata.license_status:type_name -> v1.Metadata.LicenseStatus
 	1,  // 1: v1.DatabaseStatus.database_type:type_name -> v1.DatabaseStatus.DatabaseType
-	10, // 2: v1.DatabaseBackupStatus.backup_info:type_name -> storage.BackupInfo
+	11, // 2: v1.DatabaseBackupStatus.backup_info:type_name -> storage.BackupInfo
 	2,  // 3: v1.CentralServicesCapabilities.central_scanning_can_use_container_iam_role_for_ecr:type_name -> v1.CentralServicesCapabilities.CapabilityStatus
 	2,  // 4: v1.CentralServicesCapabilities.central_can_use_cloud_backup_integrations:type_name -> v1.CentralServicesCapabilities.CapabilityStatus
 	2,  // 5: v1.CentralServicesCapabilities.central_can_display_declarative_config_health:type_name -> v1.CentralServicesCapabilities.CapabilityStatus
 	2,  // 6: v1.CentralServicesCapabilities.central_can_update_cert:type_name -> v1.CentralServicesCapabilities.CapabilityStatus
 	2,  // 7: v1.CentralServicesCapabilities.central_can_use_acscs_email_integration:type_name -> v1.CentralServicesCapabilities.CapabilityStatus
-	11, // 8: v1.MetadataService.GetMetadata:input_type -> v1.Empty
+	12, // 8: v1.MetadataService.GetMetadata:input_type -> v1.Empty
 	6,  // 9: v1.MetadataService.TLSChallenge:input_type -> v1.TLSChallengeRequest
-	11, // 10: v1.MetadataService.GetDatabaseStatus:input_type -> v1.Empty
-	11, // 11: v1.MetadataService.GetDatabaseBackupStatus:input_type -> v1.Empty
-	11, // 12: v1.MetadataService.GetCentralCapabilities:input_type -> v1.Empty
-	3,  // 13: v1.MetadataService.GetMetadata:output_type -> v1.Metadata
-	5,  // 14: v1.MetadataService.TLSChallenge:output_type -> v1.TLSChallengeResponse
-	7,  // 15: v1.MetadataService.GetDatabaseStatus:output_type -> v1.DatabaseStatus
-	8,  // 16: v1.MetadataService.GetDatabaseBackupStatus:output_type -> v1.DatabaseBackupStatus
-	9,  // 17: v1.MetadataService.GetCentralCapabilities:output_type -> v1.CentralServicesCapabilities
-	13, // [13:18] is the sub-list for method output_type
-	8,  // [8:13] is the sub-list for method input_type
+	12, // 10: v1.MetadataService.GetDatabaseStatus:input_type -> v1.Empty
+	12, // 11: v1.MetadataService.GetDatabaseBackupStatus:input_type -> v1.Empty
+	12, // 12: v1.MetadataService.GetCentralCapabilities:input_type -> v1.Empty
+	12, // 13: v1.MetadataService.GetLightspeedStatus:input_type -> v1.Empty
+	3,  // 14: v1.MetadataService.GetMetadata:output_type -> v1.Metadata
+	5,  // 15: v1.MetadataService.TLSChallenge:output_type -> v1.TLSChallengeResponse
+	7,  // 16: v1.MetadataService.GetDatabaseStatus:output_type -> v1.DatabaseStatus
+	8,  // 17: v1.MetadataService.GetDatabaseBackupStatus:output_type -> v1.DatabaseBackupStatus
+	10, // 18: v1.MetadataService.GetCentralCapabilities:output_type -> v1.CentralServicesCapabilities
+	9,  // 19: v1.MetadataService.GetLightspeedStatus:output_type -> v1.LightspeedStatusResponse
+	14, // [14:20] is the sub-list for method output_type
+	8,  // [8:14] is the sub-list for method input_type
 	8,  // [8:8] is the sub-list for extension type_name
 	8,  // [8:8] is the sub-list for extension extendee
 	0,  // [0:8] is the sub-list for field type_name
@@ -786,7 +845,7 @@ func file_api_v1_metadata_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_metadata_service_proto_rawDesc), len(file_api_v1_metadata_service_proto_rawDesc)),
 			NumEnums:      3,
-			NumMessages:   7,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/generated/api/v1/metadata_service.pb.gw.go b/generated/api/v1/metadata_service.pb.gw.go
index 38d8e5bbb1052..30f10d2b48a76 100644
--- a/generated/api/v1/metadata_service.pb.gw.go
+++ b/generated/api/v1/metadata_service.pb.gw.go
@@ -63,15 +63,15 @@ func request_MetadataService_TLSChallenge_0(ctx context.Context, marshaler runti
 		protoReq TLSChallengeRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_MetadataService_TLSChallenge_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.TLSChallenge(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -154,6 +154,27 @@ func local_request_MetadataService_GetCentralCapabilities_0(ctx context.Context,
 	return msg, metadata, err
 }
 
+func request_MetadataService_GetLightspeedStatus_0(ctx context.Context, marshaler runtime.Marshaler, client MetadataServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq Empty
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetLightspeedStatus(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_MetadataService_GetLightspeedStatus_0(ctx context.Context, marshaler runtime.Marshaler, server MetadataServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq Empty
+		metadata runtime.ServerMetadata
+	)
+	msg, err := server.GetLightspeedStatus(ctx, &protoReq)
+	return msg, metadata, err
+}
+
 // RegisterMetadataServiceHandlerServer registers the http handlers for service MetadataService to "mux".
 // UnaryRPC     :call MetadataServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
@@ -260,6 +281,26 @@ func RegisterMetadataServiceHandlerServer(ctx context.Context, mux *runtime.Serv
 		}
 		forward_MetadataService_GetCentralCapabilities_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodGet, pattern_MetadataService_GetLightspeedStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v1.MetadataService/GetLightspeedStatus", runtime.WithHTTPPathPattern("/v1/lightspeed/status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MetadataService_GetLightspeedStatus_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_MetadataService_GetLightspeedStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 
 	return nil
 }
@@ -385,6 +426,23 @@ func RegisterMetadataServiceHandlerClient(ctx context.Context, mux *runtime.Serv
 		}
 		forward_MetadataService_GetCentralCapabilities_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodGet, pattern_MetadataService_GetLightspeedStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v1.MetadataService/GetLightspeedStatus", runtime.WithHTTPPathPattern("/v1/lightspeed/status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MetadataService_GetLightspeedStatus_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_MetadataService_GetLightspeedStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	return nil
 }
 
@@ -394,6 +452,7 @@ var (
 	pattern_MetadataService_GetDatabaseStatus_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "database", "status"}, ""))
 	pattern_MetadataService_GetDatabaseBackupStatus_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "backup", "status"}, ""))
 	pattern_MetadataService_GetCentralCapabilities_0  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "central-capabilities"}, ""))
+	pattern_MetadataService_GetLightspeedStatus_0     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "lightspeed", "status"}, ""))
 )
 
 var (
@@ -402,4 +461,5 @@ var (
 	forward_MetadataService_GetDatabaseStatus_0       = runtime.ForwardResponseMessage
 	forward_MetadataService_GetDatabaseBackupStatus_0 = runtime.ForwardResponseMessage
 	forward_MetadataService_GetCentralCapabilities_0  = runtime.ForwardResponseMessage
+	forward_MetadataService_GetLightspeedStatus_0     = runtime.ForwardResponseMessage
 )
diff --git a/generated/api/v1/metadata_service.swagger.json b/generated/api/v1/metadata_service.swagger.json
index c2e9f54cf2902..a5fd57814c65f 100644
--- a/generated/api/v1/metadata_service.swagger.json
+++ b/generated/api/v1/metadata_service.swagger.json
@@ -82,6 +82,29 @@
         ]
       }
     },
+    "/v1/lightspeed/status": {
+      "get": {
+        "summary": "GetLightspeedStatus returns the availability status of the Lightspeed AI service.",
+        "operationId": "MetadataService_GetLightspeedStatus",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1LightspeedStatusResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/googleRpcStatus"
+            }
+          }
+        },
+        "tags": [
+          "MetadataService"
+        ]
+      }
+    },
     "/v1/metadata": {
       "get": {
         "operationId": "MetadataService_GetMetadata",
@@ -286,6 +309,17 @@
         }
       }
     },
+    "v1LightspeedStatusResponse": {
+      "type": "object",
+      "properties": {
+        "available": {
+          "type": "boolean"
+        },
+        "message": {
+          "type": "string"
+        }
+      }
+    },
     "v1Metadata": {
       "type": "object",
       "properties": {
diff --git a/generated/api/v1/metadata_service_grpc.pb.go b/generated/api/v1/metadata_service_grpc.pb.go
index 622cf63cb8f1c..65201270aa09f 100644
--- a/generated/api/v1/metadata_service_grpc.pb.go
+++ b/generated/api/v1/metadata_service_grpc.pb.go
@@ -24,6 +24,7 @@ const (
 	MetadataService_GetDatabaseStatus_FullMethodName       = "/v1.MetadataService/GetDatabaseStatus"
 	MetadataService_GetDatabaseBackupStatus_FullMethodName = "/v1.MetadataService/GetDatabaseBackupStatus"
 	MetadataService_GetCentralCapabilities_FullMethodName  = "/v1.MetadataService/GetCentralCapabilities"
+	MetadataService_GetLightspeedStatus_FullMethodName     = "/v1.MetadataService/GetLightspeedStatus"
 )
 
 // MetadataServiceClient is the client API for MetadataService service.
@@ -40,6 +41,8 @@ type MetadataServiceClient interface {
 	GetDatabaseStatus(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*DatabaseStatus, error)
 	GetDatabaseBackupStatus(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*DatabaseBackupStatus, error)
 	GetCentralCapabilities(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*CentralServicesCapabilities, error)
+	// GetLightspeedStatus returns the availability status of the Lightspeed AI service.
+	GetLightspeedStatus(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*LightspeedStatusResponse, error)
 }
 
 type metadataServiceClient struct {
@@ -100,6 +103,16 @@ func (c *metadataServiceClient) GetCentralCapabilities(ctx context.Context, in *
 	return out, nil
 }
 
+func (c *metadataServiceClient) GetLightspeedStatus(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*LightspeedStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(LightspeedStatusResponse)
+	err := c.cc.Invoke(ctx, MetadataService_GetLightspeedStatus_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // MetadataServiceServer is the server API for MetadataService service.
 // All implementations should embed UnimplementedMetadataServiceServer
 // for forward compatibility.
@@ -114,6 +127,8 @@ type MetadataServiceServer interface {
 	GetDatabaseStatus(context.Context, *Empty) (*DatabaseStatus, error)
 	GetDatabaseBackupStatus(context.Context, *Empty) (*DatabaseBackupStatus, error)
 	GetCentralCapabilities(context.Context, *Empty) (*CentralServicesCapabilities, error)
+	// GetLightspeedStatus returns the availability status of the Lightspeed AI service.
+	GetLightspeedStatus(context.Context, *Empty) (*LightspeedStatusResponse, error)
 }
 
 // UnimplementedMetadataServiceServer should be embedded to have
@@ -138,6 +153,9 @@ func (UnimplementedMetadataServiceServer) GetDatabaseBackupStatus(context.Contex
 func (UnimplementedMetadataServiceServer) GetCentralCapabilities(context.Context, *Empty) (*CentralServicesCapabilities, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetCentralCapabilities not implemented")
 }
+func (UnimplementedMetadataServiceServer) GetLightspeedStatus(context.Context, *Empty) (*LightspeedStatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetLightspeedStatus not implemented")
+}
 func (UnimplementedMetadataServiceServer) testEmbeddedByValue() {}
 
 // UnsafeMetadataServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -248,6 +266,24 @@ func _MetadataService_GetCentralCapabilities_Handler(srv interface{}, ctx contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _MetadataService_GetLightspeedStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MetadataServiceServer).GetLightspeedStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MetadataService_GetLightspeedStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MetadataServiceServer).GetLightspeedStatus(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // MetadataService_ServiceDesc is the grpc.ServiceDesc for MetadataService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -275,6 +311,10 @@ var MetadataService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetCentralCapabilities",
 			Handler:    _MetadataService_GetCentralCapabilities_Handler,
 		},
+		{
+			MethodName: "GetLightspeedStatus",
+			Handler:    _MetadataService_GetLightspeedStatus_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "api/v1/metadata_service.proto",
diff --git a/generated/api/v1/metadata_service_vtproto.pb.go b/generated/api/v1/metadata_service_vtproto.pb.go
index ff149b12f4c3e..e22445a280ed5 100644
--- a/generated/api/v1/metadata_service_vtproto.pb.go
+++ b/generated/api/v1/metadata_service_vtproto.pb.go
@@ -182,6 +182,24 @@ func (m *DatabaseBackupStatus) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *LightspeedStatusResponse) CloneVT() *LightspeedStatusResponse {
+	if m == nil {
+		return (*LightspeedStatusResponse)(nil)
+	}
+	r := new(LightspeedStatusResponse)
+	r.Available = m.Available
+	r.Message = m.Message
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *LightspeedStatusResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
 func (m *CentralServicesCapabilities) CloneVT() *CentralServicesCapabilities {
 	if m == nil {
 		return (*CentralServicesCapabilities)(nil)
@@ -386,6 +404,28 @@ func (this *DatabaseBackupStatus) EqualMessageVT(thatMsg proto.Message) bool {
 	}
 	return this.EqualVT(that)
 }
+func (this *LightspeedStatusResponse) EqualVT(that *LightspeedStatusResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Available != that.Available {
+		return false
+	}
+	if this.Message != that.Message {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *LightspeedStatusResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*LightspeedStatusResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
 func (this *CentralServicesCapabilities) EqualVT(that *CentralServicesCapabilities) bool {
 	if this == that {
 		return true
@@ -776,6 +816,56 @@ func (m *DatabaseBackupStatus) MarshalToSizedBufferVT(dAtA []byte) (int, error)
 	return len(dAtA) - i, nil
 }
 
+func (m *LightspeedStatusResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LightspeedStatusResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *LightspeedStatusResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Message) > 0 {
+		i -= len(m.Message)
+		copy(dAtA[i:], m.Message)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Message)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Available {
+		i--
+		if m.Available {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *CentralServicesCapabilities) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -979,6 +1069,23 @@ func (m *DatabaseBackupStatus) SizeVT() (n int) {
 	return n
 }
 
+func (m *LightspeedStatusResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Available {
+		n += 2
+	}
+	l = len(m.Message)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
 func (m *CentralServicesCapabilities) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -1874,6 +1981,109 @@ func (m *DatabaseBackupStatus) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *LightspeedStatusResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LightspeedStatusResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LightspeedStatusResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Available", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Available = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *CentralServicesCapabilities) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -2906,6 +3116,113 @@ func (m *DatabaseBackupStatus) UnmarshalVTUnsafe(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *LightspeedStatusResponse) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LightspeedStatusResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LightspeedStatusResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Available", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Available = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.Message = stringValue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *CentralServicesCapabilities) UnmarshalVTUnsafe(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/generated/api/v1/mitre_service.pb.go b/generated/api/v1/mitre_service.pb.go
index d16ed7fb3822d..d1b698411d4b4 100644
--- a/generated/api/v1/mitre_service.pb.go
+++ b/generated/api/v1/mitre_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/mitre_service.proto
 
diff --git a/generated/api/v1/mitre_service.pb.gw.go b/generated/api/v1/mitre_service.pb.gw.go
index 20d08c6b0f6f3..b28db6432449f 100644
--- a/generated/api/v1/mitre_service.pb.gw.go
+++ b/generated/api/v1/mitre_service.pb.gw.go
@@ -62,9 +62,6 @@ func request_MitreAttackService_GetMitreAttackVector_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -73,6 +70,9 @@ func request_MitreAttackService_GetMitreAttackVector_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetMitreAttackVector(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/mitre_service.swagger.json b/generated/api/v1/mitre_service.swagger.json
index 79ccd8044ec9b..cee9fb88f3394 100644
--- a/generated/api/v1/mitre_service.swagger.json
+++ b/generated/api/v1/mitre_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "MitreAttackService"
+      "name": "MitreAttackService",
+      "description": "MitreAttackService can be used to retrieve information about MITRE ATT&CK matrix."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/namespace_service.pb.go b/generated/api/v1/namespace_service.pb.go
index 9987f3a8e3b8d..479f1d2b05855 100644
--- a/generated/api/v1/namespace_service.pb.go
+++ b/generated/api/v1/namespace_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/namespace_service.proto
 
diff --git a/generated/api/v1/namespace_service.pb.gw.go b/generated/api/v1/namespace_service.pb.gw.go
index 0234b1f9b1610..83f6246c36824 100644
--- a/generated/api/v1/namespace_service.pb.gw.go
+++ b/generated/api/v1/namespace_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_NamespaceService_GetNamespaces_0(ctx context.Context, marshaler run
 		protoReq GetNamespaceRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NamespaceService_GetNamespaces_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNamespaces(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -76,9 +76,6 @@ func request_NamespaceService_GetNamespace_0(ctx context.Context, marshaler runt
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -87,6 +84,9 @@ func request_NamespaceService_GetNamespace_0(ctx context.Context, marshaler runt
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNamespace(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/network_baseline_service.pb.go b/generated/api/v1/network_baseline_service.pb.go
index f7898440bda13..63cba2bb08abf 100644
--- a/generated/api/v1/network_baseline_service.pb.go
+++ b/generated/api/v1/network_baseline_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/network_baseline_service.proto
 
diff --git a/generated/api/v1/network_baseline_service.pb.gw.go b/generated/api/v1/network_baseline_service.pb.gw.go
index b8351ab14126a..a5b1194bc3030 100644
--- a/generated/api/v1/network_baseline_service.pb.gw.go
+++ b/generated/api/v1/network_baseline_service.pb.gw.go
@@ -44,9 +44,6 @@ func request_NetworkBaselineService_GetNetworkBaselineStatusForFlows_0(ctx conte
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -55,6 +52,9 @@ func request_NetworkBaselineService_GetNetworkBaselineStatusForFlows_0(ctx conte
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "deployment_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkBaselineStatusForFlows(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -88,9 +88,6 @@ func request_NetworkBaselineService_GetNetworkBaselineStatusForExternalFlows_0(c
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -105,6 +102,9 @@ func request_NetworkBaselineService_GetNetworkBaselineStatusForExternalFlows_0(c
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkBaselineService_GetNetworkBaselineStatusForExternalFlows_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkBaselineStatusForExternalFlows(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -139,9 +139,6 @@ func request_NetworkBaselineService_GetNetworkBaseline_0(ctx context.Context, ma
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -150,6 +147,9 @@ func request_NetworkBaselineService_GetNetworkBaseline_0(ctx context.Context, ma
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkBaseline(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -181,9 +181,6 @@ func request_NetworkBaselineService_ModifyBaselineStatusForPeers_0(ctx context.C
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -192,6 +189,9 @@ func request_NetworkBaselineService_ModifyBaselineStatusForPeers_0(ctx context.C
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "deployment_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ModifyBaselineStatusForPeers(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -226,9 +226,6 @@ func request_NetworkBaselineService_LockNetworkBaseline_0(ctx context.Context, m
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -237,6 +234,9 @@ func request_NetworkBaselineService_LockNetworkBaseline_0(ctx context.Context, m
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.LockNetworkBaseline(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -271,9 +271,6 @@ func request_NetworkBaselineService_UnlockNetworkBaseline_0(ctx context.Context,
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -282,6 +279,9 @@ func request_NetworkBaselineService_UnlockNetworkBaseline_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UnlockNetworkBaseline(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/network_baseline_service.swagger.json b/generated/api/v1/network_baseline_service.swagger.json
index 38d7a0bb1d716..0878afb1c71f5 100644
--- a/generated/api/v1/network_baseline_service.swagger.json
+++ b/generated/api/v1/network_baseline_service.swagger.json
@@ -531,7 +531,7 @@
         "INTERNAL_ENTITIES"
       ],
       "default": "UNKNOWN_TYPE",
-      "title": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
+      "description": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
     },
     "storageNetworkEntityScope": {
       "type": "object",
@@ -627,7 +627,7 @@
         "ANOMALOUS"
       ],
       "default": "BASELINE",
-      "title": "Status of this peer connection. As of now we only have two statuses:\n  - BASELINE: the connection is in the current deployment baseline\n  - ANOMALOUS: the connection is not recognized by the current deployment baseline"
+      "description": "Status of this peer connection. As of now we only have two statuses:\n  - BASELINE: the connection is in the current deployment baseline\n  - ANOMALOUS: the connection is not recognized by the current deployment baseline"
     },
     "v1NetworkBaselineStatusPeer": {
       "type": "object",
diff --git a/generated/api/v1/network_graph_service.pb.go b/generated/api/v1/network_graph_service.pb.go
index 561bb0d436488..14675ce92dad9 100644
--- a/generated/api/v1/network_graph_service.pb.go
+++ b/generated/api/v1/network_graph_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/network_graph_service.proto
 
diff --git a/generated/api/v1/network_graph_service.pb.gw.go b/generated/api/v1/network_graph_service.pb.gw.go
index f4854fbfcd6c8..7fbc8d1069b0d 100644
--- a/generated/api/v1/network_graph_service.pb.gw.go
+++ b/generated/api/v1/network_graph_service.pb.gw.go
@@ -43,9 +43,6 @@ func request_NetworkGraphService_GetNetworkGraph_0(ctx context.Context, marshale
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -60,6 +57,9 @@ func request_NetworkGraphService_GetNetworkGraph_0(ctx context.Context, marshale
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkGraphService_GetNetworkGraph_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkGraph(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -96,9 +96,6 @@ func request_NetworkGraphService_GetExternalNetworkEntities_0(ctx context.Contex
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -113,6 +110,9 @@ func request_NetworkGraphService_GetExternalNetworkEntities_0(ctx context.Contex
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkGraphService_GetExternalNetworkEntities_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetExternalNetworkEntities(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -149,9 +149,6 @@ func request_NetworkGraphService_GetExternalNetworkFlows_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -174,6 +171,9 @@ func request_NetworkGraphService_GetExternalNetworkFlows_0(ctx context.Context,
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkGraphService_GetExternalNetworkFlows_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetExternalNetworkFlows(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -218,9 +218,6 @@ func request_NetworkGraphService_GetExternalNetworkFlowsMetadata_0(ctx context.C
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -235,6 +232,9 @@ func request_NetworkGraphService_GetExternalNetworkFlowsMetadata_0(ctx context.C
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkGraphService_GetExternalNetworkFlowsMetadata_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetExternalNetworkFlowsMetadata(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -272,9 +272,6 @@ func request_NetworkGraphService_CreateExternalNetworkEntity_0(ctx context.Conte
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -283,6 +280,9 @@ func request_NetworkGraphService_CreateExternalNetworkEntity_0(ctx context.Conte
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "cluster_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CreateExternalNetworkEntity(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -317,9 +317,6 @@ func request_NetworkGraphService_PatchExternalNetworkEntity_0(ctx context.Contex
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -328,6 +325,9 @@ func request_NetworkGraphService_PatchExternalNetworkEntity_0(ctx context.Contex
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PatchExternalNetworkEntity(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -359,9 +359,6 @@ func request_NetworkGraphService_DeleteExternalNetworkEntity_0(ctx context.Conte
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -370,6 +367,9 @@ func request_NetworkGraphService_DeleteExternalNetworkEntity_0(ctx context.Conte
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteExternalNetworkEntity(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/network_graph_service.swagger.json b/generated/api/v1/network_graph_service.swagger.json
index 841f6bd97449b..88756b1f3b6f9 100644
--- a/generated/api/v1/network_graph_service.swagger.json
+++ b/generated/api/v1/network_graph_service.swagger.json
@@ -603,7 +603,7 @@
         "INTERNAL_ENTITIES"
       ],
       "default": "UNKNOWN_TYPE",
-      "title": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
+      "description": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
     },
     "storageNetworkEntityScope": {
       "type": "object",
diff --git a/generated/api/v1/network_policy_service.pb.go b/generated/api/v1/network_policy_service.pb.go
index 134a03b6f236e..1bb454e9459f5 100644
--- a/generated/api/v1/network_policy_service.pb.go
+++ b/generated/api/v1/network_policy_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/network_policy_service.proto
 
diff --git a/generated/api/v1/network_policy_service.pb.gw.go b/generated/api/v1/network_policy_service.pb.gw.go
index c472d6ec1006f..5575bdd5119b1 100644
--- a/generated/api/v1/network_policy_service.pb.gw.go
+++ b/generated/api/v1/network_policy_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_NetworkPolicyService_GetNetworkPolicy_0(ctx context.Context, marsha
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_NetworkPolicyService_GetNetworkPolicy_0(ctx context.Context, marsha
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_NetworkPolicyService_GetNetworkPolicies_0(ctx context.Context, mars
 		protoReq GetNetworkPoliciesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkPolicyService_GetNetworkPolicies_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkPolicies(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -117,9 +117,6 @@ func request_NetworkPolicyService_GetNetworkGraph_0(ctx context.Context, marshal
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -134,6 +131,9 @@ func request_NetworkPolicyService_GetNetworkGraph_0(ctx context.Context, marshal
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkPolicyService_GetNetworkGraph_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkGraph(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -169,15 +169,15 @@ func request_NetworkPolicyService_GetNetworkGraphEpoch_0(ctx context.Context, ma
 		protoReq GetNetworkGraphEpochRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkPolicyService_GetNetworkGraphEpoch_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNetworkGraphEpoch(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -206,9 +206,6 @@ func request_NetworkPolicyService_ApplyNetworkPolicy_0(ctx context.Context, mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Modification); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -217,6 +214,9 @@ func request_NetworkPolicyService_ApplyNetworkPolicy_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "cluster_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ApplyNetworkPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -248,9 +248,6 @@ func request_NetworkPolicyService_GetUndoModification_0(ctx context.Context, mar
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -259,6 +256,9 @@ func request_NetworkPolicyService_GetUndoModification_0(ctx context.Context, mar
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "cluster_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetUndoModification(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -292,9 +292,6 @@ func request_NetworkPolicyService_SimulateNetworkGraph_0(ctx context.Context, ma
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Modification); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -309,6 +306,9 @@ func request_NetworkPolicyService_SimulateNetworkGraph_0(ctx context.Context, ma
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkPolicyService_SimulateNetworkGraph_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.SimulateNetworkGraph(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -351,9 +351,6 @@ func request_NetworkPolicyService_SendNetworkPolicyYAML_0(ctx context.Context, m
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Modification); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -368,6 +365,9 @@ func request_NetworkPolicyService_SendNetworkPolicyYAML_0(ctx context.Context, m
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkPolicyService_SendNetworkPolicyYAML_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.SendNetworkPolicyYAML(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -407,9 +407,6 @@ func request_NetworkPolicyService_GenerateNetworkPolicies_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -424,6 +421,9 @@ func request_NetworkPolicyService_GenerateNetworkPolicies_0(ctx context.Context,
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NetworkPolicyService_GenerateNetworkPolicies_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GenerateNetworkPolicies(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -461,9 +461,6 @@ func request_NetworkPolicyService_GetBaselineGeneratedNetworkPolicyForDeployment
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -472,6 +469,9 @@ func request_NetworkPolicyService_GetBaselineGeneratedNetworkPolicyForDeployment
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "deployment_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetBaselineGeneratedNetworkPolicyForDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -503,9 +503,6 @@ func request_NetworkPolicyService_GetAllowedPeersFromCurrentPolicyForDeployment_
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -514,6 +511,9 @@ func request_NetworkPolicyService_GetAllowedPeersFromCurrentPolicyForDeployment_
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetAllowedPeersFromCurrentPolicyForDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -545,9 +545,6 @@ func request_NetworkPolicyService_ApplyNetworkPolicyYamlForDeployment_0(ctx cont
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -556,6 +553,9 @@ func request_NetworkPolicyService_ApplyNetworkPolicyYamlForDeployment_0(ctx cont
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "deployment_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ApplyNetworkPolicyYamlForDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -587,9 +587,6 @@ func request_NetworkPolicyService_GetUndoModificationForDeployment_0(ctx context
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -598,6 +595,9 @@ func request_NetworkPolicyService_GetUndoModificationForDeployment_0(ctx context
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetUndoModificationForDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -626,9 +626,6 @@ func request_NetworkPolicyService_GetDiffFlowsBetweenPolicyAndBaselineForDeploym
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -637,6 +634,9 @@ func request_NetworkPolicyService_GetDiffFlowsBetweenPolicyAndBaselineForDeploym
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetDiffFlowsBetweenPolicyAndBaselineForDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -665,9 +665,6 @@ func request_NetworkPolicyService_GetDiffFlowsFromUndoModificationForDeployment_
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -676,6 +673,9 @@ func request_NetworkPolicyService_GetDiffFlowsFromUndoModificationForDeployment_
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetDiffFlowsFromUndoModificationForDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/network_policy_service.swagger.json b/generated/api/v1/network_policy_service.swagger.json
index 6cae046bb1aa1..7b15ea6766ec8 100644
--- a/generated/api/v1/network_policy_service.swagger.json
+++ b/generated/api/v1/network_policy_service.swagger.json
@@ -843,7 +843,7 @@
         "INTERNAL_ENTITIES"
       ],
       "default": "UNKNOWN_TYPE",
-      "title": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
+      "description": "- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node"
     },
     "storageNetworkPolicy": {
       "type": "object",
diff --git a/generated/api/v1/node_service.pb.go b/generated/api/v1/node_service.pb.go
index c4d46819af44a..d4e6d727974aa 100644
--- a/generated/api/v1/node_service.pb.go
+++ b/generated/api/v1/node_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/node_service.proto
 
diff --git a/generated/api/v1/node_service.pb.gw.go b/generated/api/v1/node_service.pb.gw.go
index 02ab873b2bdf9..59afbd7b8a3e8 100644
--- a/generated/api/v1/node_service.pb.gw.go
+++ b/generated/api/v1/node_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_NodeService_ListNodes_0(ctx context.Context, marshaler runtime.Mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -52,6 +49,9 @@ func request_NodeService_ListNodes_0(ctx context.Context, marshaler runtime.Mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "cluster_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListNodes(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -80,9 +80,6 @@ func request_NodeService_GetNode_0(ctx context.Context, marshaler runtime.Marsha
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -99,6 +96,9 @@ func request_NodeService_GetNode_0(ctx context.Context, marshaler runtime.Marsha
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "node_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNode(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -136,15 +136,15 @@ func request_NodeService_ExportNodes_0(ctx context.Context, marshaler runtime.Ma
 		protoReq ExportNodeRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeService_ExportNodes_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.ExportNodes(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
diff --git a/generated/api/v1/node_service.swagger.json b/generated/api/v1/node_service.swagger.json
index 4f5fdaed4985e..6643b1fca6c29 100644
--- a/generated/api/v1/node_service.swagger.json
+++ b/generated/api/v1/node_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "NodeService"
+      "name": "NodeService",
+      "description": "storage.Node represents information about a node in the cluster."
     }
   ],
   "consumes": [
@@ -307,6 +308,9 @@
         },
         "cisaKev": {
           "type": "boolean"
+        },
+        "knownRansomwareCampaign": {
+          "type": "boolean"
         }
       }
     },
@@ -670,9 +674,13 @@
         },
         "cisaKev": {
           "type": "boolean"
+        },
+        "origin": {
+          "$ref": "#/definitions/storageVulnOrigin",
+          "description": "origin indicates where vulnerability details came from, origin may be an aggregator (such as OSV)."
         }
       },
-      "title": "Next Tag: 29"
+      "title": "Next Tag: 30"
     },
     "storageEmbeddedVulnerabilityScoreVersion": {
       "type": "string",
@@ -941,6 +949,22 @@
       ],
       "default": "UNKNOWN_TAINT_EFFECT"
     },
+    "storageVulnOrigin": {
+      "type": "string",
+      "enum": [
+        "VULN_ORIGIN_OTHER",
+        "VULN_ORIGIN_OSV",
+        "VULN_ORIGIN_ALPINE",
+        "VULN_ORIGIN_AMAZON",
+        "VULN_ORIGIN_DEBIAN",
+        "VULN_ORIGIN_ORACLE",
+        "VULN_ORIGIN_PHOTON",
+        "VULN_ORIGIN_RED_HAT",
+        "VULN_ORIGIN_SUSE",
+        "VULN_ORIGIN_UBUNTU"
+      ],
+      "default": "VULN_ORIGIN_OTHER"
+    },
     "storageVulnerabilitySeverity": {
       "type": "string",
       "enum": [
diff --git a/generated/api/v1/notifications.pb.go b/generated/api/v1/notifications.pb.go
index d1e211b7ca879..3793361470541 100644
--- a/generated/api/v1/notifications.pb.go
+++ b/generated/api/v1/notifications.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/notifications.proto
 
diff --git a/generated/api/v1/notifier_service.pb.go b/generated/api/v1/notifier_service.pb.go
index 17f3804e00d72..c49f9e1b2ab43 100644
--- a/generated/api/v1/notifier_service.pb.go
+++ b/generated/api/v1/notifier_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/notifier_service.proto
 
diff --git a/generated/api/v1/notifier_service.pb.gw.go b/generated/api/v1/notifier_service.pb.gw.go
index a6efe55dc4d07..efc7340a7a505 100644
--- a/generated/api/v1/notifier_service.pb.gw.go
+++ b/generated/api/v1/notifier_service.pb.gw.go
@@ -42,9 +42,6 @@ func request_NotifierService_GetNotifier_0(ctx context.Context, marshaler runtim
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -53,6 +50,9 @@ func request_NotifierService_GetNotifier_0(ctx context.Context, marshaler runtim
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNotifier(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -105,9 +105,6 @@ func request_NotifierService_PutNotifier_0(ctx context.Context, marshaler runtim
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -116,6 +113,9 @@ func request_NotifierService_PutNotifier_0(ctx context.Context, marshaler runtim
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutNotifier(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -203,9 +203,6 @@ func request_NotifierService_DeleteNotifier_0(ctx context.Context, marshaler run
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -220,6 +217,9 @@ func request_NotifierService_DeleteNotifier_0(ctx context.Context, marshaler run
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NotifierService_DeleteNotifier_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteNotifier(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -257,9 +257,6 @@ func request_NotifierService_UpdateNotifier_0(ctx context.Context, marshaler run
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["notifier.id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "notifier.id")
@@ -268,6 +265,9 @@ func request_NotifierService_UpdateNotifier_0(ctx context.Context, marshaler run
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "notifier.id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateNotifier(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/pagination.pb.go b/generated/api/v1/pagination.pb.go
index 67fcced57bd45..673948679eab8 100644
--- a/generated/api/v1/pagination.pb.go
+++ b/generated/api/v1/pagination.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/pagination.proto
 
diff --git a/generated/api/v1/ping_service.pb.go b/generated/api/v1/ping_service.pb.go
index bff82ac06521c..a82b6d3e58ea7 100644
--- a/generated/api/v1/ping_service.pb.go
+++ b/generated/api/v1/ping_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/ping_service.proto
 
diff --git a/generated/api/v1/pod_service.pb.go b/generated/api/v1/pod_service.pb.go
index 4908e85d853a3..3e7d8429e9531 100644
--- a/generated/api/v1/pod_service.pb.go
+++ b/generated/api/v1/pod_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/pod_service.proto
 
diff --git a/generated/api/v1/pod_service.pb.gw.go b/generated/api/v1/pod_service.pb.gw.go
index 39b12fc48f088..2ce4c45231940 100644
--- a/generated/api/v1/pod_service.pb.gw.go
+++ b/generated/api/v1/pod_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_PodService_GetPods_0(ctx context.Context, marshaler runtime.Marshal
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PodService_GetPods_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetPods(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -77,15 +77,15 @@ func request_PodService_ExportPods_0(ctx context.Context, marshaler runtime.Mars
 		protoReq ExportPodRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PodService_ExportPods_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.ExportPods(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
diff --git a/generated/api/v1/pod_service.swagger.json b/generated/api/v1/pod_service.swagger.json
index cb2ff3dfc3dd6..9999e581a2497 100644
--- a/generated/api/v1/pod_service.swagger.json
+++ b/generated/api/v1/pod_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "PodService"
+      "name": "PodService",
+      "description": "PodService APIs can be used to manage pods."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/policy_category_service.pb.go b/generated/api/v1/policy_category_service.pb.go
index 3243cb76f0ce5..a02160b93036c 100644
--- a/generated/api/v1/policy_category_service.pb.go
+++ b/generated/api/v1/policy_category_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/policy_category_service.proto
 
diff --git a/generated/api/v1/policy_category_service.pb.gw.go b/generated/api/v1/policy_category_service.pb.gw.go
index 86e759ec0dbdc..a5a74a2474bfb 100644
--- a/generated/api/v1/policy_category_service.pb.gw.go
+++ b/generated/api/v1/policy_category_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_PolicyCategoryService_GetPolicyCategory_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_PolicyCategoryService_GetPolicyCategory_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetPolicyCategory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_PolicyCategoryService_GetPolicyCategories_0(ctx context.Context, ma
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PolicyCategoryService_GetPolicyCategories_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetPolicyCategories(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -169,9 +169,6 @@ func request_PolicyCategoryService_DeletePolicyCategory_0(ctx context.Context, m
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -180,6 +177,9 @@ func request_PolicyCategoryService_DeletePolicyCategory_0(ctx context.Context, m
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeletePolicyCategory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/policy_category_service.swagger.json b/generated/api/v1/policy_category_service.swagger.json
index 7c631508e36af..6814e80eb5f00 100644
--- a/generated/api/v1/policy_category_service.swagger.json
+++ b/generated/api/v1/policy_category_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "PolicyCategoryService"
+      "name": "PolicyCategoryService",
+      "description": "PolicyCategoryService APIs can be used to manage policy categories."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/policy_service.pb.go b/generated/api/v1/policy_service.pb.go
index d650c2722cc4f..503c54a5edf39 100644
--- a/generated/api/v1/policy_service.pb.go
+++ b/generated/api/v1/policy_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/policy_service.proto
 
diff --git a/generated/api/v1/policy_service.pb.gw.go b/generated/api/v1/policy_service.pb.gw.go
index 2477addfe0469..0d08aab492beb 100644
--- a/generated/api/v1/policy_service.pb.gw.go
+++ b/generated/api/v1/policy_service.pb.gw.go
@@ -42,9 +42,6 @@ func request_PolicyService_GetPolicy_0(ctx context.Context, marshaler runtime.Ma
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -53,6 +50,9 @@ func request_PolicyService_GetPolicy_0(ctx context.Context, marshaler runtime.Ma
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -83,9 +83,6 @@ func request_PolicyService_GetPolicyMitreVectors_0(ctx context.Context, marshale
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -100,6 +97,9 @@ func request_PolicyService_GetPolicyMitreVectors_0(ctx context.Context, marshale
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PolicyService_GetPolicyMitreVectors_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetPolicyMitreVectors(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -135,15 +135,15 @@ func request_PolicyService_ListPolicies_0(ctx context.Context, marshaler runtime
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PolicyService_ListPolicies_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListPolicies(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -173,15 +173,15 @@ func request_PolicyService_PostPolicy_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Policy); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PolicyService_PostPolicy_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PostPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -213,9 +213,6 @@ func request_PolicyService_PutPolicy_0(ctx context.Context, marshaler runtime.Ma
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -224,6 +221,9 @@ func request_PolicyService_PutPolicy_0(ctx context.Context, marshaler runtime.Ma
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -258,9 +258,6 @@ func request_PolicyService_PatchPolicy_0(ctx context.Context, marshaler runtime.
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -269,6 +266,9 @@ func request_PolicyService_PatchPolicy_0(ctx context.Context, marshaler runtime.
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PatchPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -300,9 +300,6 @@ func request_PolicyService_DeletePolicy_0(ctx context.Context, marshaler runtime
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -311,6 +308,9 @@ func request_PolicyService_DeletePolicy_0(ctx context.Context, marshaler runtime
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeletePolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -342,9 +342,6 @@ func request_PolicyService_EnableDisablePolicyNotification_0(ctx context.Context
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["policy_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "policy_id")
@@ -353,6 +350,9 @@ func request_PolicyService_EnableDisablePolicyNotification_0(ctx context.Context
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "policy_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EnableDisablePolicyNotification(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -459,9 +459,6 @@ func request_PolicyService_QueryDryRunJobStatus_0(ctx context.Context, marshaler
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["job_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "job_id")
@@ -470,6 +467,9 @@ func request_PolicyService_QueryDryRunJobStatus_0(ctx context.Context, marshaler
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "job_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.QueryDryRunJobStatus(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -498,9 +498,6 @@ func request_PolicyService_CancelDryRunJob_0(ctx context.Context, marshaler runt
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["job_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "job_id")
@@ -509,6 +506,9 @@ func request_PolicyService_CancelDryRunJob_0(ctx context.Context, marshaler runt
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "job_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CancelDryRunJob(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/policy_service.swagger.json b/generated/api/v1/policy_service.swagger.json
index faeb58adf12cf..6982328c5cc91 100644
--- a/generated/api/v1/policy_service.swagger.json
+++ b/generated/api/v1/policy_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "PolicyService"
+      "name": "PolicyService",
+      "description": "PolicyService APIs can be used to manage policies."
     }
   ],
   "consumes": [
@@ -634,6 +635,18 @@
         }
       }
     },
+    "ExclusionExcludeByKind": {
+      "type": "object",
+      "properties": {
+        "kinds": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ExclusionWorkloadKind"
+          }
+        }
+      },
+      "description": "ExcludeByKind excludes all workloads of the selected Kubernetes kinds."
+    },
     "ExclusionImage": {
       "type": "object",
       "properties": {
@@ -642,6 +655,16 @@
         }
       }
     },
+    "ExclusionWorkloadKind": {
+      "type": "string",
+      "enum": [
+        "WORKLOAD_KIND_UNSPECIFIED",
+        "CRON_JOB",
+        "JOB"
+      ],
+      "default": "WORKLOAD_KIND_UNSPECIFIED",
+      "description": "WorkloadKind is a Kubernetes workload kind that can be excluded from a policy in bulk."
+    },
     "PolicyMitreAttackVectors": {
       "type": "object",
       "properties": {
@@ -724,7 +747,7 @@
             "type": "object",
             "$ref": "#/definitions/storageExclusion"
           },
-          "description": "Define deployments or images that should be excluded from this policy."
+          "description": "Define deployments, images, or workload kinds that should be excluded from this policy."
         },
         "scope": {
           "type": "array",
@@ -897,15 +920,18 @@
         "name": {
           "type": "string"
         },
-        "deployment": {
-          "$ref": "#/definitions/ExclusionDeployment"
-        },
         "image": {
           "$ref": "#/definitions/ExclusionImage"
         },
         "expiration": {
           "type": "string",
           "format": "date-time"
+        },
+        "deployment": {
+          "$ref": "#/definitions/ExclusionDeployment"
+        },
+        "excludeByKind": {
+          "$ref": "#/definitions/ExclusionExcludeByKind"
         }
       }
     },
@@ -1071,7 +1097,7 @@
             "type": "object",
             "$ref": "#/definitions/storageExclusion"
           },
-          "description": "Define deployments or images that should be excluded from this policy."
+          "description": "Define deployments, images, or workload kinds that should be excluded from this policy."
         },
         "scope": {
           "type": "array",
diff --git a/generated/api/v1/probe_upload_service.pb.go b/generated/api/v1/probe_upload_service.pb.go
index 46a14a15bc233..a38038150ccba 100644
--- a/generated/api/v1/probe_upload_service.pb.go
+++ b/generated/api/v1/probe_upload_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/probe_upload_service.proto
 
diff --git a/generated/api/v1/probe_upload_service.pb.gw.go b/generated/api/v1/probe_upload_service.pb.gw.go
index f35454c7cde77..526b315d8a40e 100644
--- a/generated/api/v1/probe_upload_service.pb.gw.go
+++ b/generated/api/v1/probe_upload_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_ProbeUploadService_GetExistingProbes_0(ctx context.Context, marshal
 		protoReq GetExistingProbesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ProbeUploadService_GetExistingProbes_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetExistingProbes(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/process_baseline_service.pb.go b/generated/api/v1/process_baseline_service.pb.go
index e078981337d5a..40c8f1b92aa6c 100644
--- a/generated/api/v1/process_baseline_service.pb.go
+++ b/generated/api/v1/process_baseline_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/process_baseline_service.proto
 
diff --git a/generated/api/v1/process_baseline_service.pb.gw.go b/generated/api/v1/process_baseline_service.pb.gw.go
index bd4fa797522a9..bf2f96e5b64d5 100644
--- a/generated/api/v1/process_baseline_service.pb.gw.go
+++ b/generated/api/v1/process_baseline_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_ProcessBaselineService_GetProcessBaseline_0(ctx context.Context, ma
 		protoReq GetProcessBaselineRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ProcessBaselineService_GetProcessBaseline_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetProcessBaseline(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -185,15 +185,15 @@ func request_ProcessBaselineService_DeleteProcessBaselines_0(ctx context.Context
 		protoReq DeleteProcessBaselinesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ProcessBaselineService_DeleteProcessBaselines_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteProcessBaselines(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/process_baseline_service.swagger.json b/generated/api/v1/process_baseline_service.swagger.json
index 8ab759940ec00..1e81749ddf499 100644
--- a/generated/api/v1/process_baseline_service.swagger.json
+++ b/generated/api/v1/process_baseline_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ProcessBaselineService"
+      "name": "ProcessBaselineService",
+      "description": "`ProcessBaselineService` APIs can be used to manage process baselines."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/process_listening_on_port_service.pb.go b/generated/api/v1/process_listening_on_port_service.pb.go
index b028c17d133b8..b7773df360138 100644
--- a/generated/api/v1/process_listening_on_port_service.pb.go
+++ b/generated/api/v1/process_listening_on_port_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/process_listening_on_port_service.proto
 
diff --git a/generated/api/v1/process_listening_on_port_service.pb.gw.go b/generated/api/v1/process_listening_on_port_service.pb.gw.go
index ad3a52474e845..abf8f51636f0c 100644
--- a/generated/api/v1/process_listening_on_port_service.pb.gw.go
+++ b/generated/api/v1/process_listening_on_port_service.pb.gw.go
@@ -43,9 +43,6 @@ func request_ListeningEndpointsService_GetListeningEndpoints_0(ctx context.Conte
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -60,6 +57,9 @@ func request_ListeningEndpointsService_GetListeningEndpoints_0(ctx context.Conte
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ListeningEndpointsService_GetListeningEndpoints_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetListeningEndpoints(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/process_listening_on_port_service.swagger.json b/generated/api/v1/process_listening_on_port_service.swagger.json
index 7953707c2f48a..52fe688b4fe00 100644
--- a/generated/api/v1/process_listening_on_port_service.swagger.json
+++ b/generated/api/v1/process_listening_on_port_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ListeningEndpointsService"
+      "name": "ListeningEndpointsService",
+      "description": "ListeningEndpointsService API can be used to list listening endpoints and the processes that opened them."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/process_service.pb.go b/generated/api/v1/process_service.pb.go
index 031690f9996fd..7dbd8e40ae252 100644
--- a/generated/api/v1/process_service.pb.go
+++ b/generated/api/v1/process_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/process_service.proto
 
diff --git a/generated/api/v1/process_service.pb.gw.go b/generated/api/v1/process_service.pb.gw.go
index f25925019271f..82447c5165500 100644
--- a/generated/api/v1/process_service.pb.gw.go
+++ b/generated/api/v1/process_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_ProcessService_CountProcesses_0(ctx context.Context, marshaler runt
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ProcessService_CountProcesses_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountProcesses(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -76,9 +76,6 @@ func request_ProcessService_GetProcessesByDeployment_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -87,6 +84,9 @@ func request_ProcessService_GetProcessesByDeployment_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "deployment_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetProcessesByDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -115,9 +115,6 @@ func request_ProcessService_GetGroupedProcessByDeployment_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -126,6 +123,9 @@ func request_ProcessService_GetGroupedProcessByDeployment_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "deployment_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetGroupedProcessByDeployment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -154,9 +154,6 @@ func request_ProcessService_GetGroupedProcessByDeploymentAndContainer_0(ctx cont
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["deployment_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "deployment_id")
@@ -165,6 +162,9 @@ func request_ProcessService_GetGroupedProcessByDeploymentAndContainer_0(ctx cont
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "deployment_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetGroupedProcessByDeploymentAndContainer(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/process_service.swagger.json b/generated/api/v1/process_service.swagger.json
index c517bfb0d3de2..6df20adc41588 100644
--- a/generated/api/v1/process_service.swagger.json
+++ b/generated/api/v1/process_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "ProcessService"
+      "name": "ProcessService",
+      "description": "ProcessService APIs can be used to list processes executed in deployments."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/rbac_service.pb.go b/generated/api/v1/rbac_service.pb.go
index 742ade005a9fe..09bc326a11fe2 100644
--- a/generated/api/v1/rbac_service.pb.go
+++ b/generated/api/v1/rbac_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/rbac_service.proto
 
diff --git a/generated/api/v1/rbac_service.pb.gw.go b/generated/api/v1/rbac_service.pb.gw.go
index 83e52643eb37b..e762978e6b3be 100644
--- a/generated/api/v1/rbac_service.pb.gw.go
+++ b/generated/api/v1/rbac_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_RbacService_GetRole_0(ctx context.Context, marshaler runtime.Marsha
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_RbacService_GetRole_0(ctx context.Context, marshaler runtime.Marsha
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetRole(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_RbacService_ListRoles_0(ctx context.Context, marshaler runtime.Mars
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_RbacService_ListRoles_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListRoles(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -115,9 +115,6 @@ func request_RbacService_GetRoleBinding_0(ctx context.Context, marshaler runtime
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -126,6 +123,9 @@ func request_RbacService_GetRoleBinding_0(ctx context.Context, marshaler runtime
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetRoleBinding(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -155,15 +155,15 @@ func request_RbacService_ListRoleBindings_0(ctx context.Context, marshaler runti
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_RbacService_ListRoleBindings_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListRoleBindings(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -189,9 +189,6 @@ func request_RbacService_GetSubject_0(ctx context.Context, marshaler runtime.Mar
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -200,6 +197,9 @@ func request_RbacService_GetSubject_0(ctx context.Context, marshaler runtime.Mar
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetSubject(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -229,15 +229,15 @@ func request_RbacService_ListSubjects_0(ctx context.Context, marshaler runtime.M
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_RbacService_ListSubjects_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListSubjects(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/resource_collection_service.pb.go b/generated/api/v1/resource_collection_service.pb.go
index 0b71cbc3194f2..eb6720e5d5234 100644
--- a/generated/api/v1/resource_collection_service.pb.go
+++ b/generated/api/v1/resource_collection_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/resource_collection_service.proto
 
diff --git a/generated/api/v1/resource_collection_service.pb.gw.go b/generated/api/v1/resource_collection_service.pb.gw.go
index 6de4f6646b426..17989bc5527ed 100644
--- a/generated/api/v1/resource_collection_service.pb.gw.go
+++ b/generated/api/v1/resource_collection_service.pb.gw.go
@@ -64,9 +64,6 @@ func request_CollectionService_GetCollection_0(ctx context.Context, marshaler ru
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -81,6 +78,9 @@ func request_CollectionService_GetCollection_0(ctx context.Context, marshaler ru
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_CollectionService_GetCollection_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetCollection(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,15 +116,15 @@ func request_CollectionService_GetCollectionCount_0(ctx context.Context, marshal
 		protoReq GetCollectionCountRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_CollectionService_GetCollectionCount_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetCollectionCount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -180,9 +180,6 @@ func request_CollectionService_UpdateCollection_0(ctx context.Context, marshaler
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -191,6 +188,9 @@ func request_CollectionService_UpdateCollection_0(ctx context.Context, marshaler
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateCollection(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -223,15 +223,15 @@ func request_CollectionService_ListCollections_0(ctx context.Context, marshaler
 		protoReq ListCollectionsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_CollectionService_ListCollections_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListCollections(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -257,9 +257,6 @@ func request_CollectionService_DeleteCollection_0(ctx context.Context, marshaler
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -268,6 +265,9 @@ func request_CollectionService_DeleteCollection_0(ctx context.Context, marshaler
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteCollection(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/role_service.pb.go b/generated/api/v1/role_service.pb.go
index cfe89975452c7..236017eb36dd0 100644
--- a/generated/api/v1/role_service.pb.go
+++ b/generated/api/v1/role_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/role_service.proto
 
diff --git a/generated/api/v1/role_service.pb.gw.go b/generated/api/v1/role_service.pb.gw.go
index 69f19e28bf71c..ffd6c83912a0d 100644
--- a/generated/api/v1/role_service.pb.gw.go
+++ b/generated/api/v1/role_service.pb.gw.go
@@ -63,9 +63,6 @@ func request_RoleService_GetRole_0(ctx context.Context, marshaler runtime.Marsha
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -74,6 +71,9 @@ func request_RoleService_GetRole_0(ctx context.Context, marshaler runtime.Marsha
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetRole(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -126,9 +126,6 @@ func request_RoleService_CreateRole_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Role); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
@@ -137,6 +134,9 @@ func request_RoleService_CreateRole_0(ctx context.Context, marshaler runtime.Mar
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CreateRole(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -171,9 +171,6 @@ func request_RoleService_UpdateRole_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
@@ -182,6 +179,9 @@ func request_RoleService_UpdateRole_0(ctx context.Context, marshaler runtime.Mar
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateRole(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -213,9 +213,6 @@ func request_RoleService_DeleteRole_0(ctx context.Context, marshaler runtime.Mar
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -224,6 +221,9 @@ func request_RoleService_DeleteRole_0(ctx context.Context, marshaler runtime.Mar
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteRole(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -273,9 +273,6 @@ func request_RoleService_GetPermissionSet_0(ctx context.Context, marshaler runti
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -284,6 +281,9 @@ func request_RoleService_GetPermissionSet_0(ctx context.Context, marshaler runti
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetPermissionSet(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -363,9 +363,6 @@ func request_RoleService_PutPermissionSet_0(ctx context.Context, marshaler runti
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -374,6 +371,9 @@ func request_RoleService_PutPermissionSet_0(ctx context.Context, marshaler runti
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutPermissionSet(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -405,9 +405,6 @@ func request_RoleService_DeletePermissionSet_0(ctx context.Context, marshaler ru
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -416,6 +413,9 @@ func request_RoleService_DeletePermissionSet_0(ctx context.Context, marshaler ru
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeletePermissionSet(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -444,9 +444,6 @@ func request_RoleService_GetSimpleAccessScope_0(ctx context.Context, marshaler r
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -455,6 +452,9 @@ func request_RoleService_GetSimpleAccessScope_0(ctx context.Context, marshaler r
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetSimpleAccessScope(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -534,9 +534,6 @@ func request_RoleService_PutSimpleAccessScope_0(ctx context.Context, marshaler r
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -545,6 +542,9 @@ func request_RoleService_PutSimpleAccessScope_0(ctx context.Context, marshaler r
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutSimpleAccessScope(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -576,9 +576,6 @@ func request_RoleService_DeleteSimpleAccessScope_0(ctx context.Context, marshale
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -587,6 +584,9 @@ func request_RoleService_DeleteSimpleAccessScope_0(ctx context.Context, marshale
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteSimpleAccessScope(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -619,15 +619,15 @@ func request_RoleService_ComputeEffectiveAccessScope_0(ctx context.Context, mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.AccessScope); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_RoleService_ComputeEffectiveAccessScope_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ComputeEffectiveAccessScope(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -657,15 +657,15 @@ func request_RoleService_GetClustersForPermissions_0(ctx context.Context, marsha
 		protoReq GetClustersForPermissionsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_RoleService_GetClustersForPermissions_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetClustersForPermissions(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -693,9 +693,6 @@ func request_RoleService_GetNamespacesForClusterAndPermissions_0(ctx context.Con
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -710,6 +707,9 @@ func request_RoleService_GetNamespacesForClusterAndPermissions_0(ctx context.Con
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_RoleService_GetNamespacesForClusterAndPermissions_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetNamespacesForClusterAndPermissions(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/sbom.pb.go b/generated/api/v1/sbom.pb.go
index 5857f099a3d19..e5a28eab3710e 100644
--- a/generated/api/v1/sbom.pb.go
+++ b/generated/api/v1/sbom.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/sbom.proto
 
diff --git a/generated/api/v1/search_service.pb.go b/generated/api/v1/search_service.pb.go
index 1a7e19fa32741..9b50e8b779b00 100644
--- a/generated/api/v1/search_service.pb.go
+++ b/generated/api/v1/search_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/search_service.proto
 
diff --git a/generated/api/v1/search_service.pb.gw.go b/generated/api/v1/search_service.pb.gw.go
index d3552e35e4529..d378f935e30c5 100644
--- a/generated/api/v1/search_service.pb.gw.go
+++ b/generated/api/v1/search_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_SearchService_Search_0(ctx context.Context, marshaler runtime.Marsh
 		protoReq RawSearchRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_SearchService_Search_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Search(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -77,15 +77,15 @@ func request_SearchService_Options_0(ctx context.Context, marshaler runtime.Mars
 		protoReq SearchOptionsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_SearchService_Options_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Options(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -112,15 +112,15 @@ func request_SearchService_Autocomplete_0(ctx context.Context, marshaler runtime
 		protoReq RawSearchRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_SearchService_Autocomplete_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Autocomplete(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/search_service.swagger.json b/generated/api/v1/search_service.swagger.json
index f5a8a5301592d..50579f6c31c4a 100644
--- a/generated/api/v1/search_service.swagger.json
+++ b/generated/api/v1/search_service.swagger.json
@@ -531,7 +531,7 @@
         "IMAGE_CVE_INFOS"
       ],
       "default": "SEARCH_UNSET",
-      "title": "Next available tag: 85"
+      "description": "Next available tag: 85"
     },
     "v1SearchOptionsResponse": {
       "type": "object",
diff --git a/generated/api/v1/secret_service.pb.go b/generated/api/v1/secret_service.pb.go
index c88e62cb63f80..9c480651181a1 100644
--- a/generated/api/v1/secret_service.pb.go
+++ b/generated/api/v1/secret_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/secret_service.proto
 
diff --git a/generated/api/v1/secret_service.pb.gw.go b/generated/api/v1/secret_service.pb.gw.go
index 5cc80c64bf04c..d48c3cd9aaf6a 100644
--- a/generated/api/v1/secret_service.pb.gw.go
+++ b/generated/api/v1/secret_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_SecretService_GetSecret_0(ctx context.Context, marshaler runtime.Ma
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_SecretService_GetSecret_0(ctx context.Context, marshaler runtime.Ma
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetSecret(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_SecretService_CountSecrets_0(ctx context.Context, marshaler runtime
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_SecretService_CountSecrets_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountSecrets(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,15 +116,15 @@ func request_SecretService_ListSecrets_0(ctx context.Context, marshaler runtime.
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_SecretService_ListSecrets_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListSecrets(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -151,15 +151,15 @@ func request_SecretService_ListSecretsExtended_0(ctx context.Context, marshaler
 		protoReq ListSecretsExtendedRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_SecretService_ListSecretsExtended_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListSecretsExtended(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/sensor_upgrade_service.pb.go b/generated/api/v1/sensor_upgrade_service.pb.go
index 15d26cfdf661f..690ee71561cf4 100644
--- a/generated/api/v1/sensor_upgrade_service.pb.go
+++ b/generated/api/v1/sensor_upgrade_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/sensor_upgrade_service.proto
 
diff --git a/generated/api/v1/sensor_upgrade_service.pb.gw.go b/generated/api/v1/sensor_upgrade_service.pb.gw.go
index 77e2081bf85f1..8ae39c741f536 100644
--- a/generated/api/v1/sensor_upgrade_service.pb.gw.go
+++ b/generated/api/v1/sensor_upgrade_service.pb.gw.go
@@ -89,9 +89,6 @@ func request_SensorUpgradeService_TriggerSensorUpgrade_0(ctx context.Context, ma
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -100,6 +97,9 @@ func request_SensorUpgradeService_TriggerSensorUpgrade_0(ctx context.Context, ma
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.TriggerSensorUpgrade(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -128,9 +128,6 @@ func request_SensorUpgradeService_TriggerSensorCertRotation_0(ctx context.Contex
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -139,6 +136,9 @@ func request_SensorUpgradeService_TriggerSensorCertRotation_0(ctx context.Contex
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.TriggerSensorCertRotation(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/sensor_upgrade_service.swagger.json b/generated/api/v1/sensor_upgrade_service.swagger.json
index a324e351aea17..0a768d37d377d 100644
--- a/generated/api/v1/sensor_upgrade_service.swagger.json
+++ b/generated/api/v1/sensor_upgrade_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "SensorUpgradeService"
+      "name": "SensorUpgradeService",
+      "description": "SensorUpgradeService is deprecated. Use operator-based installation instead;\nthe operator handles sensor upgrades and certificate rotation."
     }
   ],
   "consumes": [
diff --git a/generated/api/v1/service_account_service.pb.go b/generated/api/v1/service_account_service.pb.go
index b76622395e63a..5e1c0556f42e8 100644
--- a/generated/api/v1/service_account_service.pb.go
+++ b/generated/api/v1/service_account_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/service_account_service.proto
 
diff --git a/generated/api/v1/service_account_service.pb.gw.go b/generated/api/v1/service_account_service.pb.gw.go
index 8958f848a264f..8bddc40cc38c8 100644
--- a/generated/api/v1/service_account_service.pb.gw.go
+++ b/generated/api/v1/service_account_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_ServiceAccountService_GetServiceAccount_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_ServiceAccountService_GetServiceAccount_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetServiceAccount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_ServiceAccountService_ListServiceAccounts_0(ctx context.Context, ma
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ServiceAccountService_ListServiceAccounts_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListServiceAccounts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/service_identity_service.pb.go b/generated/api/v1/service_identity_service.pb.go
index abb0f106b4b7f..a7a8d1a0af870 100644
--- a/generated/api/v1/service_identity_service.pb.go
+++ b/generated/api/v1/service_identity_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/service_identity_service.proto
 
diff --git a/generated/api/v1/signal.pb.go b/generated/api/v1/signal.pb.go
index c54ddaf697f5a..059076c5abc56 100644
--- a/generated/api/v1/signal.pb.go
+++ b/generated/api/v1/signal.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/signal.proto
 
diff --git a/generated/api/v1/signature_integration_service.pb.go b/generated/api/v1/signature_integration_service.pb.go
index fbed8847a24d2..ccff377da6b66 100644
--- a/generated/api/v1/signature_integration_service.pb.go
+++ b/generated/api/v1/signature_integration_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/signature_integration_service.proto
 
diff --git a/generated/api/v1/signature_integration_service.pb.gw.go b/generated/api/v1/signature_integration_service.pb.gw.go
index 9159179d308eb..3e0726fa787d4 100644
--- a/generated/api/v1/signature_integration_service.pb.gw.go
+++ b/generated/api/v1/signature_integration_service.pb.gw.go
@@ -63,9 +63,6 @@ func request_SignatureIntegrationService_GetSignatureIntegration_0(ctx context.C
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -74,6 +71,9 @@ func request_SignatureIntegrationService_GetSignatureIntegration_0(ctx context.C
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetSignatureIntegration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -132,9 +132,6 @@ func request_SignatureIntegrationService_PutSignatureIntegration_0(ctx context.C
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -143,6 +140,9 @@ func request_SignatureIntegrationService_PutSignatureIntegration_0(ctx context.C
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.PutSignatureIntegration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -174,9 +174,6 @@ func request_SignatureIntegrationService_DeleteSignatureIntegration_0(ctx contex
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -185,6 +182,9 @@ func request_SignatureIntegrationService_DeleteSignatureIntegration_0(ctx contex
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteSignatureIntegration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/telemetry_service.pb.go b/generated/api/v1/telemetry_service.pb.go
index 4923cccc45643..b7961504d70ce 100644
--- a/generated/api/v1/telemetry_service.pb.go
+++ b/generated/api/v1/telemetry_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/telemetry_service.proto
 
diff --git a/generated/api/v1/traits.pb.go b/generated/api/v1/traits.pb.go
index 413295858e8b4..2fbf9683cedbf 100644
--- a/generated/api/v1/traits.pb.go
+++ b/generated/api/v1/traits.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/traits.proto
 
diff --git a/generated/api/v1/user_service.pb.go b/generated/api/v1/user_service.pb.go
index 5db9fbf6de584..2ab345487c4d1 100644
--- a/generated/api/v1/user_service.pb.go
+++ b/generated/api/v1/user_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/user_service.proto
 
diff --git a/generated/api/v1/user_service.pb.gw.go b/generated/api/v1/user_service.pb.gw.go
index 231759af351f3..842f59fccefe4 100644
--- a/generated/api/v1/user_service.pb.gw.go
+++ b/generated/api/v1/user_service.pb.gw.go
@@ -62,9 +62,6 @@ func request_UserService_GetUser_0(ctx context.Context, marshaler runtime.Marsha
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -73,6 +70,9 @@ func request_UserService_GetUser_0(ctx context.Context, marshaler runtime.Marsha
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetUser(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v1/vuln_mgmt_service.pb.go b/generated/api/v1/vuln_mgmt_service.pb.go
index 09a84733debfc..7b48309d83bc4 100644
--- a/generated/api/v1/vuln_mgmt_service.pb.go
+++ b/generated/api/v1/vuln_mgmt_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v1/vuln_mgmt_service.proto
 
diff --git a/generated/api/v1/vuln_mgmt_service.pb.gw.go b/generated/api/v1/vuln_mgmt_service.pb.gw.go
index 211534deb1394..77e79d7c43d65 100644
--- a/generated/api/v1/vuln_mgmt_service.pb.gw.go
+++ b/generated/api/v1/vuln_mgmt_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_VulnMgmtService_VulnMgmtExportWorkloads_0(ctx context.Context, mars
 		protoReq VulnMgmtExportWorkloadsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VulnMgmtService_VulnMgmtExportWorkloads_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.VulnMgmtExportWorkloads(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
diff --git a/generated/api/v1/vuln_mgmt_service.swagger.json b/generated/api/v1/vuln_mgmt_service.swagger.json
index d54d36b3fd31a..3ffb4f3fa154c 100644
--- a/generated/api/v1/vuln_mgmt_service.swagger.json
+++ b/generated/api/v1/vuln_mgmt_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "VulnMgmtService"
+      "name": "VulnMgmtService",
+      "description": "VulnMgmtService APIs are used to manage workload vulnerabilities."
     }
   ],
   "consumes": [
@@ -183,7 +184,7 @@
         "UNKNOWN"
       ],
       "default": "UNSET",
-      "title": "For any update to EnvVarSource, please also update 'ui/src/messages/common.js'"
+      "description": "For any update to EnvVarSource, please also update 'ui/src/messages/common.js'"
     },
     "LabelSelectorRequirement": {
       "type": "object",
@@ -1025,9 +1026,13 @@
         },
         "cisaKev": {
           "type": "boolean"
+        },
+        "origin": {
+          "$ref": "#/definitions/storageVulnOrigin",
+          "description": "origin indicates where vulnerability details came from, origin may be an aggregator (such as OSV)."
         }
       },
-      "title": "Next Tag: 29"
+      "title": "Next Tag: 30"
     },
     "storageExploit": {
       "type": "object",
@@ -1395,7 +1400,7 @@
         "CLUSTER_ADMIN"
       ],
       "default": "UNSET",
-      "title": "For any update to PermissionLevel, also update:\n- pkg/searchbasedpolicies/builders/k8s_rbac.go\n- ui/src/messages/common.js"
+      "description": "For any update to PermissionLevel, also update:\n- pkg/searchbasedpolicies/builders/k8s_rbac.go\n- ui/src/messages/common.js"
     },
     "storagePortConfig": {
       "type": "object",
@@ -1636,6 +1641,22 @@
         }
       }
     },
+    "storageVulnOrigin": {
+      "type": "string",
+      "enum": [
+        "VULN_ORIGIN_OTHER",
+        "VULN_ORIGIN_OSV",
+        "VULN_ORIGIN_ALPINE",
+        "VULN_ORIGIN_AMAZON",
+        "VULN_ORIGIN_DEBIAN",
+        "VULN_ORIGIN_ORACLE",
+        "VULN_ORIGIN_PHOTON",
+        "VULN_ORIGIN_RED_HAT",
+        "VULN_ORIGIN_SUSE",
+        "VULN_ORIGIN_UBUNTU"
+      ],
+      "default": "VULN_ORIGIN_OTHER"
+    },
     "storageVulnerabilitySeverity": {
       "type": "string",
       "enum": [
diff --git a/generated/api/v2/base_image_service.pb.go b/generated/api/v2/base_image_service.pb.go
index e14ce1c99dfb9..0ee3a84f97fe0 100644
--- a/generated/api/v2/base_image_service.pb.go
+++ b/generated/api/v2/base_image_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/base_image_service.proto
 
diff --git a/generated/api/v2/base_image_service.pb.gw.go b/generated/api/v2/base_image_service.pb.gw.go
index 4f16f63e08867..c3a0d7cf29f6f 100644
--- a/generated/api/v2/base_image_service.pb.gw.go
+++ b/generated/api/v2/base_image_service.pb.gw.go
@@ -92,9 +92,6 @@ func request_BaseImageServiceV2_UpdateBaseImageTagPattern_0(ctx context.Context,
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -103,6 +100,9 @@ func request_BaseImageServiceV2_UpdateBaseImageTagPattern_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateBaseImageTagPattern(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -134,9 +134,6 @@ func request_BaseImageServiceV2_DeleteBaseImageReference_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -145,6 +142,9 @@ func request_BaseImageServiceV2_DeleteBaseImageReference_0(ctx context.Context,
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteBaseImageReference(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/base_image_service.swagger.json b/generated/api/v2/base_image_service.swagger.json
index 60d0dd4bb7c61..4fe252015cbb7 100644
--- a/generated/api/v2/base_image_service.swagger.json
+++ b/generated/api/v2/base_image_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "BaseImageServiceV2"
+      "name": "BaseImageServiceV2",
+      "description": "BaseImageServiceV2 APIs manages base image references."
     }
   ],
   "consumes": [
diff --git a/generated/api/v2/common.pb.go b/generated/api/v2/common.pb.go
index 46c6af89b3828..05518776c4403 100644
--- a/generated/api/v2/common.pb.go
+++ b/generated/api/v2/common.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/common.proto
 
diff --git a/generated/api/v2/compliance_common.pb.go b/generated/api/v2/compliance_common.pb.go
index ba7c41a32adee..d92f5c5cbc5d6 100644
--- a/generated/api/v2/compliance_common.pb.go
+++ b/generated/api/v2/compliance_common.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/compliance_common.proto
 
diff --git a/generated/api/v2/compliance_integration_service.pb.go b/generated/api/v2/compliance_integration_service.pb.go
index 769817cd4bcae..7a9ea6cae2642 100644
--- a/generated/api/v2/compliance_integration_service.pb.go
+++ b/generated/api/v2/compliance_integration_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/compliance_integration_service.proto
 
diff --git a/generated/api/v2/compliance_integration_service.pb.gw.go b/generated/api/v2/compliance_integration_service.pb.gw.go
index b3ae5fb8f858a..1fedb13211987 100644
--- a/generated/api/v2/compliance_integration_service.pb.gw.go
+++ b/generated/api/v2/compliance_integration_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_ComplianceIntegrationService_ListComplianceIntegrations_0(ctx conte
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceIntegrationService_ListComplianceIntegrations_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListComplianceIntegrations(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/compliance_integration_service.swagger.json b/generated/api/v2/compliance_integration_service.swagger.json
index 8457fc910e24f..c3162a7b61802 100644
--- a/generated/api/v2/compliance_integration_service.swagger.json
+++ b/generated/api/v2/compliance_integration_service.swagger.json
@@ -150,7 +150,7 @@
         "UNHEALTHY"
       ],
       "default": "HEALTHY",
-      "title": "Represents the status of compliance operator"
+      "description": "Represents the status of compliance operator"
     },
     "v2ClusterPlatformType": {
       "type": "string",
diff --git a/generated/api/v2/compliance_profile_service.pb.go b/generated/api/v2/compliance_profile_service.pb.go
index f16414001848c..7336af6368561 100644
--- a/generated/api/v2/compliance_profile_service.pb.go
+++ b/generated/api/v2/compliance_profile_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/compliance_profile_service.proto
 
diff --git a/generated/api/v2/compliance_profile_service.pb.gw.go b/generated/api/v2/compliance_profile_service.pb.gw.go
index 76840ac44f315..54b5a20c7959b 100644
--- a/generated/api/v2/compliance_profile_service.pb.gw.go
+++ b/generated/api/v2/compliance_profile_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_ComplianceProfileService_GetComplianceProfile_0(ctx context.Context
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_ComplianceProfileService_GetComplianceProfile_0(ctx context.Context
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_ComplianceProfileService_ListComplianceProfiles_0(ctx context.Conte
 		protoReq ProfilesForClusterRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceProfileService_ListComplianceProfiles_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListComplianceProfiles(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,15 +116,15 @@ func request_ComplianceProfileService_ListProfileSummaries_0(ctx context.Context
 		protoReq ClustersProfileSummaryRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceProfileService_ListProfileSummaries_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListProfileSummaries(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/compliance_results_service.pb.go b/generated/api/v2/compliance_results_service.pb.go
index d3960013e7c7e..65cd85ab10ffe 100644
--- a/generated/api/v2/compliance_results_service.pb.go
+++ b/generated/api/v2/compliance_results_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/compliance_results_service.proto
 
diff --git a/generated/api/v2/compliance_results_service.pb.gw.go b/generated/api/v2/compliance_results_service.pb.gw.go
index 1e74de8c07eb7..0b059ab384986 100644
--- a/generated/api/v2/compliance_results_service.pb.gw.go
+++ b/generated/api/v2/compliance_results_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_ComplianceResultsService_GetComplianceScanCheckResult_0(ctx context
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_ComplianceResultsService_GetComplianceScanCheckResult_0(ctx context
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceScanCheckResult(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_ComplianceResultsService_GetComplianceScanResults_0(ctx context.Con
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsService_GetComplianceScanResults_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceScanResults(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -117,9 +117,6 @@ func request_ComplianceResultsService_GetComplianceScanConfigurationResults_0(ct
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["scan_config_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "scan_config_name")
@@ -134,6 +131,9 @@ func request_ComplianceResultsService_GetComplianceScanConfigurationResults_0(ct
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsService_GetComplianceScanConfigurationResults_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceScanConfigurationResults(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -170,9 +170,6 @@ func request_ComplianceResultsService_GetComplianceProfileResults_0(ctx context.
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["profile_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "profile_name")
@@ -187,6 +184,9 @@ func request_ComplianceResultsService_GetComplianceProfileResults_0(ctx context.
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsService_GetComplianceProfileResults_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfileResults(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -223,9 +223,6 @@ func request_ComplianceResultsService_GetComplianceProfileCheckResult_0(ctx cont
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["profile_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "profile_name")
@@ -248,6 +245,9 @@ func request_ComplianceResultsService_GetComplianceProfileCheckResult_0(ctx cont
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsService_GetComplianceProfileCheckResult_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfileCheckResult(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -292,9 +292,6 @@ func request_ComplianceResultsService_GetComplianceProfileClusterResults_0(ctx c
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["profile_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "profile_name")
@@ -317,6 +314,9 @@ func request_ComplianceResultsService_GetComplianceProfileClusterResults_0(ctx c
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsService_GetComplianceProfileClusterResults_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfileClusterResults(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -361,9 +361,6 @@ func request_ComplianceResultsService_GetComplianceProfileCheckDetails_0(ctx con
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["profile_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "profile_name")
@@ -386,6 +383,9 @@ func request_ComplianceResultsService_GetComplianceProfileCheckDetails_0(ctx con
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsService_GetComplianceProfileCheckDetails_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfileCheckDetails(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/compliance_results_stats_service.pb.go b/generated/api/v2/compliance_results_stats_service.pb.go
index b2858c0c473c0..aad9bbc9b9a98 100644
--- a/generated/api/v2/compliance_results_stats_service.pb.go
+++ b/generated/api/v2/compliance_results_stats_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/compliance_results_stats_service.proto
 
diff --git a/generated/api/v2/compliance_results_stats_service.pb.gw.go b/generated/api/v2/compliance_results_stats_service.pb.gw.go
index a5a101f60df19..ea656923fb95f 100644
--- a/generated/api/v2/compliance_results_stats_service.pb.gw.go
+++ b/generated/api/v2/compliance_results_stats_service.pb.gw.go
@@ -43,9 +43,6 @@ func request_ComplianceResultsStatsService_GetComplianceProfileStats_0(ctx conte
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["profile_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "profile_name")
@@ -60,6 +57,9 @@ func request_ComplianceResultsStatsService_GetComplianceProfileStats_0(ctx conte
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsStatsService_GetComplianceProfileStats_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfileStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -95,15 +95,15 @@ func request_ComplianceResultsStatsService_GetComplianceProfilesStats_0(ctx cont
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsStatsService_GetComplianceProfilesStats_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfilesStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -131,9 +131,6 @@ func request_ComplianceResultsStatsService_GetComplianceProfilesClusterStats_0(c
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -148,6 +145,9 @@ func request_ComplianceResultsStatsService_GetComplianceProfilesClusterStats_0(c
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsStatsService_GetComplianceProfilesClusterStats_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfilesClusterStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -184,9 +184,6 @@ func request_ComplianceResultsStatsService_GetComplianceProfileCheckStats_0(ctx
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["profile_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "profile_name")
@@ -209,6 +206,9 @@ func request_ComplianceResultsStatsService_GetComplianceProfileCheckStats_0(ctx
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsStatsService_GetComplianceProfileCheckStats_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceProfileCheckStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -253,9 +253,6 @@ func request_ComplianceResultsStatsService_GetComplianceClusterScanStats_0(ctx c
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -270,6 +267,9 @@ func request_ComplianceResultsStatsService_GetComplianceClusterScanStats_0(ctx c
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsStatsService_GetComplianceClusterScanStats_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceClusterScanStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -305,15 +305,15 @@ func request_ComplianceResultsStatsService_GetComplianceOverallClusterStats_0(ct
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsStatsService_GetComplianceOverallClusterStats_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceOverallClusterStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -341,9 +341,6 @@ func request_ComplianceResultsStatsService_GetComplianceClusterStats_0(ctx conte
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["profile_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "profile_name")
@@ -358,6 +355,9 @@ func request_ComplianceResultsStatsService_GetComplianceClusterStats_0(ctx conte
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceResultsStatsService_GetComplianceClusterStats_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceClusterStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/compliance_rule_service.pb.go b/generated/api/v2/compliance_rule_service.pb.go
index 018f0515d91f3..f962e1500e898 100644
--- a/generated/api/v2/compliance_rule_service.pb.go
+++ b/generated/api/v2/compliance_rule_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/compliance_rule_service.proto
 
diff --git a/generated/api/v2/compliance_rule_service.pb.gw.go b/generated/api/v2/compliance_rule_service.pb.gw.go
index 4a934175a8038..6584493a35518 100644
--- a/generated/api/v2/compliance_rule_service.pb.gw.go
+++ b/generated/api/v2/compliance_rule_service.pb.gw.go
@@ -43,9 +43,6 @@ func request_ComplianceRuleService_GetComplianceRule_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["rule_name"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "rule_name")
@@ -60,6 +57,9 @@ func request_ComplianceRuleService_GetComplianceRule_0(ctx context.Context, mars
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceRuleService_GetComplianceRule_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceRule(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/compliance_scan_configuration_service.pb.go b/generated/api/v2/compliance_scan_configuration_service.pb.go
index c5e288dec6d33..bdb65f6518c61 100644
--- a/generated/api/v2/compliance_scan_configuration_service.pb.go
+++ b/generated/api/v2/compliance_scan_configuration_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/compliance_scan_configuration_service.proto
 
diff --git a/generated/api/v2/compliance_scan_configuration_service.pb.gw.go b/generated/api/v2/compliance_scan_configuration_service.pb.gw.go
index 67b0864a0e3f9..c500547c45890 100644
--- a/generated/api/v2/compliance_scan_configuration_service.pb.gw.go
+++ b/generated/api/v2/compliance_scan_configuration_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_ComplianceScanConfigurationService_ListComplianceScanConfigurations
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceScanConfigurationService_ListComplianceScanConfigurations_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListComplianceScanConfigurations(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -76,9 +76,6 @@ func request_ComplianceScanConfigurationService_GetComplianceScanConfiguration_0
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -87,6 +84,9 @@ func request_ComplianceScanConfigurationService_GetComplianceScanConfiguration_0
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetComplianceScanConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -145,9 +145,6 @@ func request_ComplianceScanConfigurationService_UpdateComplianceScanConfiguratio
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -156,6 +153,9 @@ func request_ComplianceScanConfigurationService_UpdateComplianceScanConfiguratio
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateComplianceScanConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -187,9 +187,6 @@ func request_ComplianceScanConfigurationService_DeleteComplianceScanConfiguratio
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -198,6 +195,9 @@ func request_ComplianceScanConfigurationService_DeleteComplianceScanConfiguratio
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteComplianceScanConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -226,9 +226,6 @@ func request_ComplianceScanConfigurationService_RunComplianceScanConfiguration_0
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -237,6 +234,9 @@ func request_ComplianceScanConfigurationService_RunComplianceScanConfiguration_0
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.RunComplianceScanConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -294,9 +294,6 @@ func request_ComplianceScanConfigurationService_GetReportHistory_0(ctx context.C
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -311,6 +308,9 @@ func request_ComplianceScanConfigurationService_GetReportHistory_0(ctx context.C
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceScanConfigurationService_GetReportHistory_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -347,9 +347,6 @@ func request_ComplianceScanConfigurationService_GetMyReportHistory_0(ctx context
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -364,6 +361,9 @@ func request_ComplianceScanConfigurationService_GetMyReportHistory_0(ctx context
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceScanConfigurationService_GetMyReportHistory_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetMyReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -398,9 +398,6 @@ func request_ComplianceScanConfigurationService_DeleteReport_0(ctx context.Conte
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -409,6 +406,9 @@ func request_ComplianceScanConfigurationService_DeleteReport_0(ctx context.Conte
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteReport(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -438,15 +438,15 @@ func request_ComplianceScanConfigurationService_ListComplianceScanConfigProfiles
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceScanConfigurationService_ListComplianceScanConfigProfiles_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListComplianceScanConfigProfiles(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -474,9 +474,6 @@ func request_ComplianceScanConfigurationService_ListComplianceScanConfigClusterP
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cluster_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cluster_id")
@@ -491,6 +488,9 @@ func request_ComplianceScanConfigurationService_ListComplianceScanConfigClusterP
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ComplianceScanConfigurationService_ListComplianceScanConfigClusterProfiles_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListComplianceScanConfigClusterProfiles(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/node_report_service.pb.go b/generated/api/v2/node_report_service.pb.go
new file mode 100644
index 0000000000000..2c30b83c3ad23
--- /dev/null
+++ b/generated/api/v2/node_report_service.pb.go
@@ -0,0 +1,126 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.12
+// 	protoc        v6.32.1
+// source: api/v2/node_report_service.proto
+
+package v2
+
+import (
+	_ "google.golang.org/genproto/googleapis/api/annotations"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+var File_api_v2_node_report_service_proto protoreflect.FileDescriptor
+
+const file_api_v2_node_report_service_proto_rawDesc = "" +
+	"\n" +
+	" api/v2/node_report_service.proto\x12\x02v2\x1a\x13api/v2/common.proto\x1a\x1bapi/v2/report_service.proto\x1a\x19api/v2/search_query.proto\x1a\x1cgoogle/api/annotations.proto2\xb3\x0e\n" +
+	"\x11NodeReportService\x12{\n" +
+	"\x1bPostNodeReportConfiguration\x12\x17.v2.ReportConfiguration\x1a\x17.v2.ReportConfiguration\"*\x82\xd3\xe4\x93\x02$:\x01*\"\x1f/v2/reports/node/configurations\x12t\n" +
+	"\x1dUpdateNodeReportConfiguration\x12\x17.v2.ReportConfiguration\x1a\t.v2.Empty\"/\x82\xd3\xe4\x93\x02):\x01*\x1a$/v2/reports/node/configurations/{id}\x12{\n" +
+	"\x1cListNodeReportConfigurations\x12\f.v2.RawQuery\x1a$.v2.ListReportConfigurationsResponse\"'\x82\xd3\xe4\x93\x02!\x12\x1f/v2/reports/node/configurations\x12\x82\x01\n" +
+	"\x1dCountNodeReportConfigurations\x12\f.v2.RawQuery\x1a%.v2.CountReportConfigurationsResponse\",\x82\xd3\xe4\x93\x02&\x12$/v2/reports/node/configuration-count\x12u\n" +
+	"\x1aGetNodeReportConfiguration\x12\x10.v2.ResourceByID\x1a\x17.v2.ReportConfiguration\",\x82\xd3\xe4\x93\x02&\x12$/v2/reports/node/configurations/{id}\x12j\n" +
+	"\x1dDeleteNodeReportConfiguration\x12\x10.v2.ResourceByID\x1a\t.v2.Empty\",\x82\xd3\xe4\x93\x02&*$/v2/reports/node/configurations/{id}\x12]\n" +
+	"\rRunNodeReport\x12\x14.v2.RunReportRequest\x1a\x15.v2.RunReportResponse\"\x1f\x82\xd3\xe4\x93\x02\x19:\x01*\"\x14/v2/reports/node/run\x12\x84\x01\n" +
+	"\x14GetNodeReportHistory\x12\x1b.v2.GetReportHistoryRequest\x1a\x19.v2.ReportHistoryResponse\"4\x82\xd3\xe4\x93\x02.\x12,/v2/reports/node/configurations/{id}/history\x12\x89\x01\n" +
+	"\x16GetMyNodeReportHistory\x12\x1b.v2.GetReportHistoryRequest\x1a\x19.v2.ReportHistoryResponse\"7\x82\xd3\xe4\x93\x021\x12//v2/reports/node/configurations/{id}/my-history\x12l\n" +
+	"\x13GetNodeReportStatus\x12\x10.v2.ResourceByID\x1a\x18.v2.ReportStatusResponse\")\x82\xd3\xe4\x93\x02#\x12!/v2/reports/node/jobs/{id}/status\x12Z\n" +
+	"\x10CancelNodeReport\x12\x10.v2.ResourceByID\x1a\t.v2.Empty\")\x82\xd3\xe4\x93\x02#*!/v2/reports/node/jobs/{id}/cancel\x12a\n" +
+	"\x10DeleteNodeReport\x12\x17.v2.DeleteReportRequest\x1a\t.v2.Empty\")\x82\xd3\xe4\x93\x02#*!/v2/reports/node/jobs/{id}/delete\x12\x81\x01\n" +
+	"\x17PostViewBasedNodeReport\x12\x1a.v2.ReportRequestViewBased\x1a\x1e.v2.RunReportResponseViewBased\"*\x82\xd3\xe4\x93\x02$:\x01*\"\x1f/v2/reports/node/view-based/run\x12\x8d\x01\n" +
+	"\x1dGetViewBasedNodeReportHistory\x12$.v2.GetViewBasedReportHistoryRequest\x1a\x19.v2.ReportHistoryResponse\"+\x82\xd3\xe4\x93\x02%\x12#/v2/reports/node/view-based/history\x12\x92\x01\n" +
+	"\x1fGetViewBasedMyNodeReportHistory\x12$.v2.GetViewBasedReportHistoryRequest\x1a\x19.v2.ReportHistoryResponse\".\x82\xd3\xe4\x93\x02(\x12&/v2/reports/node/view-based/my-historyB'\n" +
+	"\x18io.stackrox.proto.api.v2Z\v./api/v2;v2X\x03b\x06proto3"
+
+var file_api_v2_node_report_service_proto_goTypes = []any{
+	(*ReportConfiguration)(nil),               // 0: v2.ReportConfiguration
+	(*RawQuery)(nil),                          // 1: v2.RawQuery
+	(*ResourceByID)(nil),                      // 2: v2.ResourceByID
+	(*RunReportRequest)(nil),                  // 3: v2.RunReportRequest
+	(*GetReportHistoryRequest)(nil),           // 4: v2.GetReportHistoryRequest
+	(*DeleteReportRequest)(nil),               // 5: v2.DeleteReportRequest
+	(*ReportRequestViewBased)(nil),            // 6: v2.ReportRequestViewBased
+	(*GetViewBasedReportHistoryRequest)(nil),  // 7: v2.GetViewBasedReportHistoryRequest
+	(*Empty)(nil),                             // 8: v2.Empty
+	(*ListReportConfigurationsResponse)(nil),  // 9: v2.ListReportConfigurationsResponse
+	(*CountReportConfigurationsResponse)(nil), // 10: v2.CountReportConfigurationsResponse
+	(*RunReportResponse)(nil),                 // 11: v2.RunReportResponse
+	(*ReportHistoryResponse)(nil),             // 12: v2.ReportHistoryResponse
+	(*ReportStatusResponse)(nil),              // 13: v2.ReportStatusResponse
+	(*RunReportResponseViewBased)(nil),        // 14: v2.RunReportResponseViewBased
+}
+var file_api_v2_node_report_service_proto_depIdxs = []int32{
+	0,  // 0: v2.NodeReportService.PostNodeReportConfiguration:input_type -> v2.ReportConfiguration
+	0,  // 1: v2.NodeReportService.UpdateNodeReportConfiguration:input_type -> v2.ReportConfiguration
+	1,  // 2: v2.NodeReportService.ListNodeReportConfigurations:input_type -> v2.RawQuery
+	1,  // 3: v2.NodeReportService.CountNodeReportConfigurations:input_type -> v2.RawQuery
+	2,  // 4: v2.NodeReportService.GetNodeReportConfiguration:input_type -> v2.ResourceByID
+	2,  // 5: v2.NodeReportService.DeleteNodeReportConfiguration:input_type -> v2.ResourceByID
+	3,  // 6: v2.NodeReportService.RunNodeReport:input_type -> v2.RunReportRequest
+	4,  // 7: v2.NodeReportService.GetNodeReportHistory:input_type -> v2.GetReportHistoryRequest
+	4,  // 8: v2.NodeReportService.GetMyNodeReportHistory:input_type -> v2.GetReportHistoryRequest
+	2,  // 9: v2.NodeReportService.GetNodeReportStatus:input_type -> v2.ResourceByID
+	2,  // 10: v2.NodeReportService.CancelNodeReport:input_type -> v2.ResourceByID
+	5,  // 11: v2.NodeReportService.DeleteNodeReport:input_type -> v2.DeleteReportRequest
+	6,  // 12: v2.NodeReportService.PostViewBasedNodeReport:input_type -> v2.ReportRequestViewBased
+	7,  // 13: v2.NodeReportService.GetViewBasedNodeReportHistory:input_type -> v2.GetViewBasedReportHistoryRequest
+	7,  // 14: v2.NodeReportService.GetViewBasedMyNodeReportHistory:input_type -> v2.GetViewBasedReportHistoryRequest
+	0,  // 15: v2.NodeReportService.PostNodeReportConfiguration:output_type -> v2.ReportConfiguration
+	8,  // 16: v2.NodeReportService.UpdateNodeReportConfiguration:output_type -> v2.Empty
+	9,  // 17: v2.NodeReportService.ListNodeReportConfigurations:output_type -> v2.ListReportConfigurationsResponse
+	10, // 18: v2.NodeReportService.CountNodeReportConfigurations:output_type -> v2.CountReportConfigurationsResponse
+	0,  // 19: v2.NodeReportService.GetNodeReportConfiguration:output_type -> v2.ReportConfiguration
+	8,  // 20: v2.NodeReportService.DeleteNodeReportConfiguration:output_type -> v2.Empty
+	11, // 21: v2.NodeReportService.RunNodeReport:output_type -> v2.RunReportResponse
+	12, // 22: v2.NodeReportService.GetNodeReportHistory:output_type -> v2.ReportHistoryResponse
+	12, // 23: v2.NodeReportService.GetMyNodeReportHistory:output_type -> v2.ReportHistoryResponse
+	13, // 24: v2.NodeReportService.GetNodeReportStatus:output_type -> v2.ReportStatusResponse
+	8,  // 25: v2.NodeReportService.CancelNodeReport:output_type -> v2.Empty
+	8,  // 26: v2.NodeReportService.DeleteNodeReport:output_type -> v2.Empty
+	14, // 27: v2.NodeReportService.PostViewBasedNodeReport:output_type -> v2.RunReportResponseViewBased
+	12, // 28: v2.NodeReportService.GetViewBasedNodeReportHistory:output_type -> v2.ReportHistoryResponse
+	12, // 29: v2.NodeReportService.GetViewBasedMyNodeReportHistory:output_type -> v2.ReportHistoryResponse
+	15, // [15:30] is the sub-list for method output_type
+	0,  // [0:15] is the sub-list for method input_type
+	0,  // [0:0] is the sub-list for extension type_name
+	0,  // [0:0] is the sub-list for extension extendee
+	0,  // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_api_v2_node_report_service_proto_init() }
+func file_api_v2_node_report_service_proto_init() {
+	if File_api_v2_node_report_service_proto != nil {
+		return
+	}
+	file_api_v2_common_proto_init()
+	file_api_v2_report_service_proto_init()
+	file_api_v2_search_query_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v2_node_report_service_proto_rawDesc), len(file_api_v2_node_report_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   0,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_v2_node_report_service_proto_goTypes,
+		DependencyIndexes: file_api_v2_node_report_service_proto_depIdxs,
+	}.Build()
+	File_api_v2_node_report_service_proto = out.File
+	file_api_v2_node_report_service_proto_goTypes = nil
+	file_api_v2_node_report_service_proto_depIdxs = nil
+}
diff --git a/generated/api/v2/node_report_service.pb.gw.go b/generated/api/v2/node_report_service.pb.gw.go
new file mode 100644
index 0000000000000..d9a561139487d
--- /dev/null
+++ b/generated/api/v2/node_report_service.pb.gw.go
@@ -0,0 +1,1243 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: api/v2/node_report_service.proto
+
+/*
+Package v2 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package v2
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_NodeReportService_PostNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ReportConfiguration
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.PostNodeReportConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_PostNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ReportConfiguration
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.PostNodeReportConfiguration(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_UpdateNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ReportConfiguration
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.UpdateNodeReportConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_UpdateNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ReportConfiguration
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	msg, err := server.UpdateNodeReportConfiguration(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_NodeReportService_ListNodeReportConfigurations_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+
+func request_NodeReportService_ListNodeReportConfigurations_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RawQuery
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_ListNodeReportConfigurations_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.ListNodeReportConfigurations(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_ListNodeReportConfigurations_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RawQuery
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_ListNodeReportConfigurations_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListNodeReportConfigurations(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_NodeReportService_CountNodeReportConfigurations_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+
+func request_NodeReportService_CountNodeReportConfigurations_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RawQuery
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_CountNodeReportConfigurations_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.CountNodeReportConfigurations(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_CountNodeReportConfigurations_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RawQuery
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_CountNodeReportConfigurations_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.CountNodeReportConfigurations(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_GetNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetNodeReportConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_GetNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	msg, err := server.GetNodeReportConfiguration(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_DeleteNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.DeleteNodeReportConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_DeleteNodeReportConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	msg, err := server.DeleteNodeReportConfiguration(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_RunNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RunReportRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.RunNodeReport(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_RunNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RunReportRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RunNodeReport(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_NodeReportService_GetNodeReportHistory_0 = &utilities.DoubleArray{Encoding: map[string]int{"id": 0}, Base: []int{1, 1, 0}, Check: []int{0, 1, 2}}
+
+func request_NodeReportService_GetNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetReportHistoryRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetNodeReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_GetNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetReportHistoryRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetNodeReportHistory(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_NodeReportService_GetMyNodeReportHistory_0 = &utilities.DoubleArray{Encoding: map[string]int{"id": 0}, Base: []int{1, 1, 0}, Check: []int{0, 1, 2}}
+
+func request_NodeReportService_GetMyNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetReportHistoryRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetMyNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetMyNodeReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_GetMyNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetReportHistoryRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetMyNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetMyNodeReportHistory(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_GetNodeReportStatus_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetNodeReportStatus(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_GetNodeReportStatus_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	msg, err := server.GetNodeReportStatus(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_CancelNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.CancelNodeReport(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_CancelNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResourceByID
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	msg, err := server.CancelNodeReport(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_DeleteNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteReportRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.DeleteNodeReport(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_DeleteNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteReportRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+	msg, err := server.DeleteNodeReport(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_NodeReportService_PostViewBasedNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ReportRequestViewBased
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.PostViewBasedNodeReport(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_PostViewBasedNodeReport_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ReportRequestViewBased
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.PostViewBasedNodeReport(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_NodeReportService_GetViewBasedNodeReportHistory_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+
+func request_NodeReportService_GetViewBasedNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetViewBasedReportHistoryRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetViewBasedNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetViewBasedNodeReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_GetViewBasedNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetViewBasedReportHistoryRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetViewBasedNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetViewBasedNodeReportHistory(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_NodeReportService_GetViewBasedMyNodeReportHistory_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+
+func request_NodeReportService_GetViewBasedMyNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, client NodeReportServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetViewBasedReportHistoryRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetViewBasedMyNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetViewBasedMyNodeReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_NodeReportService_GetViewBasedMyNodeReportHistory_0(ctx context.Context, marshaler runtime.Marshaler, server NodeReportServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetViewBasedReportHistoryRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_NodeReportService_GetViewBasedMyNodeReportHistory_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetViewBasedMyNodeReportHistory(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterNodeReportServiceHandlerServer registers the http handlers for service NodeReportService to "mux".
+// UnaryRPC     :call NodeReportServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterNodeReportServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterNodeReportServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server NodeReportServiceServer) error {
+	mux.Handle(http.MethodPost, pattern_NodeReportService_PostNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/PostNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_PostNodeReportConfiguration_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_PostNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPut, pattern_NodeReportService_UpdateNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/UpdateNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_UpdateNodeReportConfiguration_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_UpdateNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_ListNodeReportConfigurations_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/ListNodeReportConfigurations", runtime.WithHTTPPathPattern("/v2/reports/node/configurations"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_ListNodeReportConfigurations_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_ListNodeReportConfigurations_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_CountNodeReportConfigurations_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/CountNodeReportConfigurations", runtime.WithHTTPPathPattern("/v2/reports/node/configuration-count"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_CountNodeReportConfigurations_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_CountNodeReportConfigurations_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/GetNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_GetNodeReportConfiguration_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_NodeReportService_DeleteNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/DeleteNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_DeleteNodeReportConfiguration_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_DeleteNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_NodeReportService_RunNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/RunNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/run"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_RunNodeReport_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_RunNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/GetNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}/history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_GetNodeReportHistory_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetMyNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/GetMyNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}/my-history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_GetMyNodeReportHistory_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetMyNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetNodeReportStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/GetNodeReportStatus", runtime.WithHTTPPathPattern("/v2/reports/node/jobs/{id}/status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_GetNodeReportStatus_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetNodeReportStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_NodeReportService_CancelNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/CancelNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/jobs/{id}/cancel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_CancelNodeReport_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_CancelNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_NodeReportService_DeleteNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/DeleteNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/jobs/{id}/delete"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_DeleteNodeReport_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_DeleteNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_NodeReportService_PostViewBasedNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/PostViewBasedNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/view-based/run"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_PostViewBasedNodeReport_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_PostViewBasedNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetViewBasedNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/GetViewBasedNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/view-based/history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_GetViewBasedNodeReportHistory_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetViewBasedNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetViewBasedMyNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/v2.NodeReportService/GetViewBasedMyNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/view-based/my-history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_NodeReportService_GetViewBasedMyNodeReportHistory_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetViewBasedMyNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterNodeReportServiceHandlerFromEndpoint is same as RegisterNodeReportServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterNodeReportServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterNodeReportServiceHandler(ctx, mux, conn)
+}
+
+// RegisterNodeReportServiceHandler registers the http handlers for service NodeReportService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterNodeReportServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterNodeReportServiceHandlerClient(ctx, mux, NewNodeReportServiceClient(conn))
+}
+
+// RegisterNodeReportServiceHandlerClient registers the http handlers for service NodeReportService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "NodeReportServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "NodeReportServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "NodeReportServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterNodeReportServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client NodeReportServiceClient) error {
+	mux.Handle(http.MethodPost, pattern_NodeReportService_PostNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/PostNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_PostNodeReportConfiguration_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_PostNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPut, pattern_NodeReportService_UpdateNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/UpdateNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_UpdateNodeReportConfiguration_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_UpdateNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_ListNodeReportConfigurations_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/ListNodeReportConfigurations", runtime.WithHTTPPathPattern("/v2/reports/node/configurations"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_ListNodeReportConfigurations_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_ListNodeReportConfigurations_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_CountNodeReportConfigurations_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/CountNodeReportConfigurations", runtime.WithHTTPPathPattern("/v2/reports/node/configuration-count"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_CountNodeReportConfigurations_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_CountNodeReportConfigurations_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/GetNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_GetNodeReportConfiguration_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_NodeReportService_DeleteNodeReportConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/DeleteNodeReportConfiguration", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_DeleteNodeReportConfiguration_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_DeleteNodeReportConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_NodeReportService_RunNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/RunNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/run"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_RunNodeReport_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_RunNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/GetNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}/history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_GetNodeReportHistory_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetMyNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/GetMyNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/configurations/{id}/my-history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_GetMyNodeReportHistory_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetMyNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetNodeReportStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/GetNodeReportStatus", runtime.WithHTTPPathPattern("/v2/reports/node/jobs/{id}/status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_GetNodeReportStatus_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetNodeReportStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_NodeReportService_CancelNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/CancelNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/jobs/{id}/cancel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_CancelNodeReport_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_CancelNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_NodeReportService_DeleteNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/DeleteNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/jobs/{id}/delete"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_DeleteNodeReport_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_DeleteNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_NodeReportService_PostViewBasedNodeReport_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/PostViewBasedNodeReport", runtime.WithHTTPPathPattern("/v2/reports/node/view-based/run"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_PostViewBasedNodeReport_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_PostViewBasedNodeReport_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetViewBasedNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/GetViewBasedNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/view-based/history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_GetViewBasedNodeReportHistory_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetViewBasedNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_NodeReportService_GetViewBasedMyNodeReportHistory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/v2.NodeReportService/GetViewBasedMyNodeReportHistory", runtime.WithHTTPPathPattern("/v2/reports/node/view-based/my-history"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_NodeReportService_GetViewBasedMyNodeReportHistory_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_NodeReportService_GetViewBasedMyNodeReportHistory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_NodeReportService_PostNodeReportConfiguration_0     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v2", "reports", "node", "configurations"}, ""))
+	pattern_NodeReportService_UpdateNodeReportConfiguration_0   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4}, []string{"v2", "reports", "node", "configurations", "id"}, ""))
+	pattern_NodeReportService_ListNodeReportConfigurations_0    = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v2", "reports", "node", "configurations"}, ""))
+	pattern_NodeReportService_CountNodeReportConfigurations_0   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v2", "reports", "node", "configuration-count"}, ""))
+	pattern_NodeReportService_GetNodeReportConfiguration_0      = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4}, []string{"v2", "reports", "node", "configurations", "id"}, ""))
+	pattern_NodeReportService_DeleteNodeReportConfiguration_0   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4}, []string{"v2", "reports", "node", "configurations", "id"}, ""))
+	pattern_NodeReportService_RunNodeReport_0                   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v2", "reports", "node", "run"}, ""))
+	pattern_NodeReportService_GetNodeReportHistory_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4, 2, 5}, []string{"v2", "reports", "node", "configurations", "id", "history"}, ""))
+	pattern_NodeReportService_GetMyNodeReportHistory_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4, 2, 5}, []string{"v2", "reports", "node", "configurations", "id", "my-history"}, ""))
+	pattern_NodeReportService_GetNodeReportStatus_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4, 2, 5}, []string{"v2", "reports", "node", "jobs", "id", "status"}, ""))
+	pattern_NodeReportService_CancelNodeReport_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4, 2, 5}, []string{"v2", "reports", "node", "jobs", "id", "cancel"}, ""))
+	pattern_NodeReportService_DeleteNodeReport_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 1, 5, 4, 2, 5}, []string{"v2", "reports", "node", "jobs", "id", "delete"}, ""))
+	pattern_NodeReportService_PostViewBasedNodeReport_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"v2", "reports", "node", "view-based", "run"}, ""))
+	pattern_NodeReportService_GetViewBasedNodeReportHistory_0   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"v2", "reports", "node", "view-based", "history"}, ""))
+	pattern_NodeReportService_GetViewBasedMyNodeReportHistory_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"v2", "reports", "node", "view-based", "my-history"}, ""))
+)
+
+var (
+	forward_NodeReportService_PostNodeReportConfiguration_0     = runtime.ForwardResponseMessage
+	forward_NodeReportService_UpdateNodeReportConfiguration_0   = runtime.ForwardResponseMessage
+	forward_NodeReportService_ListNodeReportConfigurations_0    = runtime.ForwardResponseMessage
+	forward_NodeReportService_CountNodeReportConfigurations_0   = runtime.ForwardResponseMessage
+	forward_NodeReportService_GetNodeReportConfiguration_0      = runtime.ForwardResponseMessage
+	forward_NodeReportService_DeleteNodeReportConfiguration_0   = runtime.ForwardResponseMessage
+	forward_NodeReportService_RunNodeReport_0                   = runtime.ForwardResponseMessage
+	forward_NodeReportService_GetNodeReportHistory_0            = runtime.ForwardResponseMessage
+	forward_NodeReportService_GetMyNodeReportHistory_0          = runtime.ForwardResponseMessage
+	forward_NodeReportService_GetNodeReportStatus_0             = runtime.ForwardResponseMessage
+	forward_NodeReportService_CancelNodeReport_0                = runtime.ForwardResponseMessage
+	forward_NodeReportService_DeleteNodeReport_0                = runtime.ForwardResponseMessage
+	forward_NodeReportService_PostViewBasedNodeReport_0         = runtime.ForwardResponseMessage
+	forward_NodeReportService_GetViewBasedNodeReportHistory_0   = runtime.ForwardResponseMessage
+	forward_NodeReportService_GetViewBasedMyNodeReportHistory_0 = runtime.ForwardResponseMessage
+)
diff --git a/generated/api/v2/node_report_service.swagger.json b/generated/api/v2/node_report_service.swagger.json
new file mode 100644
index 0000000000000..f66f7737488b5
--- /dev/null
+++ b/generated/api/v2/node_report_service.swagger.json
@@ -0,0 +1,1454 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "api/v2/node_report_service.proto",
+    "version": "version not set"
+  },
+  "tags": [
+    {
+      "name": "NodeReportService"
+    }
+  ],
+  "consumes": [
+    "application/json"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "paths": {
+    "/v2/reports/node/configuration-count": {
+      "get": {
+        "operationId": "NodeReportService_CountNodeReportConfigurations",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2CountReportConfigurationsResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "query",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "pagination.limit",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "pagination.offset",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "pagination.sortOption.field",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "pagination.sortOption.reversed",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          },
+          {
+            "name": "pagination.sortOption.aggregateBy.aggrFunc",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "enum": [
+              "UNSET",
+              "COUNT",
+              "MIN",
+              "MAX"
+            ],
+            "default": "UNSET"
+          },
+          {
+            "name": "pagination.sortOption.aggregateBy.distinct",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/configurations": {
+      "get": {
+        "operationId": "NodeReportService_ListNodeReportConfigurations",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ListReportConfigurationsResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "query",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "pagination.limit",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "pagination.offset",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "pagination.sortOption.field",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "pagination.sortOption.reversed",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          },
+          {
+            "name": "pagination.sortOption.aggregateBy.aggrFunc",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "enum": [
+              "UNSET",
+              "COUNT",
+              "MIN",
+              "MAX"
+            ],
+            "default": "UNSET"
+          },
+          {
+            "name": "pagination.sortOption.aggregateBy.distinct",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      },
+      "post": {
+        "operationId": "NodeReportService_PostNodeReportConfiguration",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ReportConfiguration"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v2ReportConfiguration"
+            }
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/configurations/{id}": {
+      "get": {
+        "operationId": "NodeReportService_GetNodeReportConfiguration",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ReportConfiguration"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      },
+      "delete": {
+        "operationId": "NodeReportService_DeleteNodeReportConfiguration",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2Empty"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      },
+      "put": {
+        "operationId": "NodeReportService_UpdateNodeReportConfiguration",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2Empty"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/NodeReportServiceUpdateNodeReportConfigurationBody"
+            }
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/configurations/{id}/history": {
+      "get": {
+        "operationId": "NodeReportService_GetNodeReportHistory",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ReportHistoryResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.query",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.limit",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.offset",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.field",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.reversed",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.aggrFunc",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "enum": [
+              "UNSET",
+              "COUNT",
+              "MIN",
+              "MAX"
+            ],
+            "default": "UNSET"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.distinct",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/configurations/{id}/my-history": {
+      "get": {
+        "operationId": "NodeReportService_GetMyNodeReportHistory",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ReportHistoryResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.query",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.limit",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.offset",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.field",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.reversed",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.aggrFunc",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "enum": [
+              "UNSET",
+              "COUNT",
+              "MIN",
+              "MAX"
+            ],
+            "default": "UNSET"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.distinct",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/jobs/{id}/cancel": {
+      "delete": {
+        "operationId": "NodeReportService_CancelNodeReport",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2Empty"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/jobs/{id}/delete": {
+      "delete": {
+        "operationId": "NodeReportService_DeleteNodeReport",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2Empty"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/jobs/{id}/status": {
+      "get": {
+        "operationId": "NodeReportService_GetNodeReportStatus",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ReportStatusResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/run": {
+      "post": {
+        "operationId": "NodeReportService_RunNodeReport",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2RunReportResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v2RunReportRequest"
+            }
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/view-based/history": {
+      "get": {
+        "operationId": "NodeReportService_GetViewBasedNodeReportHistory",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ReportHistoryResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "reportParamQuery.query",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.limit",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.offset",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.field",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.reversed",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.aggrFunc",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "enum": [
+              "UNSET",
+              "COUNT",
+              "MIN",
+              "MAX"
+            ],
+            "default": "UNSET"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.distinct",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/view-based/my-history": {
+      "get": {
+        "operationId": "NodeReportService_GetViewBasedMyNodeReportHistory",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2ReportHistoryResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "reportParamQuery.query",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.limit",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.offset",
+            "in": "query",
+            "required": false,
+            "type": "integer",
+            "format": "int32"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.field",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.reversed",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.aggrFunc",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "enum": [
+              "UNSET",
+              "COUNT",
+              "MIN",
+              "MAX"
+            ],
+            "default": "UNSET"
+          },
+          {
+            "name": "reportParamQuery.pagination.sortOption.aggregateBy.distinct",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    },
+    "/v2/reports/node/view-based/run": {
+      "post": {
+        "operationId": "NodeReportService_PostViewBasedNodeReport",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v2RunReportResponseViewBased"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v2ReportRequestViewBased"
+            }
+          }
+        ],
+        "tags": [
+          "NodeReportService"
+        ]
+      }
+    }
+  },
+  "definitions": {
+    "NodeReportServiceUpdateNodeReportConfigurationBody": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "type": {
+          "$ref": "#/definitions/v2ReportConfigurationReportType"
+        },
+        "vulnReportFilters": {
+          "$ref": "#/definitions/v2VulnerabilityReportFilters"
+        },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
+        "schedule": {
+          "$ref": "#/definitions/v2ReportSchedule"
+        },
+        "resourceScope": {
+          "$ref": "#/definitions/v2ResourceScope"
+        },
+        "notifiers": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2NotifierConfiguration"
+          }
+        }
+      }
+    },
+    "VulnerabilityReportFiltersFixability": {
+      "type": "string",
+      "enum": [
+        "BOTH",
+        "FIXABLE",
+        "NOT_FIXABLE"
+      ],
+      "default": "BOTH"
+    },
+    "VulnerabilityReportFiltersImageType": {
+      "type": "string",
+      "enum": [
+        "DEPLOYED",
+        "WATCHED"
+      ],
+      "default": "DEPLOYED"
+    },
+    "protobufAny": {
+      "type": "object",
+      "properties": {
+        "@type": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": {}
+    },
+    "rpcStatus": {
+      "type": "object",
+      "properties": {
+        "code": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "message": {
+          "type": "string"
+        },
+        "details": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/protobufAny"
+          }
+        }
+      }
+    },
+    "v2AggregateBy": {
+      "type": "object",
+      "properties": {
+        "aggrFunc": {
+          "$ref": "#/definitions/v2Aggregation"
+        },
+        "distinct": {
+          "type": "boolean"
+        }
+      }
+    },
+    "v2Aggregation": {
+      "type": "string",
+      "enum": [
+        "UNSET",
+        "COUNT",
+        "MIN",
+        "MAX"
+      ],
+      "default": "UNSET"
+    },
+    "v2CollectionReference": {
+      "type": "object",
+      "properties": {
+        "collectionId": {
+          "type": "string"
+        },
+        "collectionName": {
+          "type": "string"
+        }
+      }
+    },
+    "v2CollectionSnapshot": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "v2CountReportConfigurationsResponse": {
+      "type": "object",
+      "properties": {
+        "count": {
+          "type": "integer",
+          "format": "int32"
+        }
+      }
+    },
+    "v2EmailNotifierConfiguration": {
+      "type": "object",
+      "properties": {
+        "notifierId": {
+          "type": "string"
+        },
+        "mailingLists": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "customSubject": {
+          "type": "string"
+        },
+        "customBody": {
+          "type": "string"
+        }
+      }
+    },
+    "v2Empty": {
+      "type": "object"
+    },
+    "v2EntityScope": {
+      "type": "object",
+      "properties": {
+        "rules": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2EntityScopeRule"
+          }
+        }
+      }
+    },
+    "v2EntityScopeRule": {
+      "type": "object",
+      "properties": {
+        "entity": {
+          "$ref": "#/definitions/v2ScopeEntity"
+        },
+        "field": {
+          "$ref": "#/definitions/v2ScopeField"
+        },
+        "values": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2RuleValue"
+          }
+        }
+      }
+    },
+    "v2ListReportConfigurationsResponse": {
+      "type": "object",
+      "properties": {
+        "reportConfigs": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2ReportConfiguration"
+          }
+        }
+      }
+    },
+    "v2MatchType": {
+      "type": "string",
+      "enum": [
+        "EXACT",
+        "REGEX"
+      ],
+      "default": "EXACT"
+    },
+    "v2NodeVulnerabilityReportFilters": {
+      "type": "object",
+      "properties": {
+        "allVuln": {
+          "type": "boolean"
+        },
+        "query": {
+          "type": "string"
+        }
+      }
+    },
+    "v2NotificationMethod": {
+      "type": "string",
+      "enum": [
+        "EMAIL",
+        "DOWNLOAD"
+      ],
+      "default": "EMAIL"
+    },
+    "v2NotifierConfiguration": {
+      "type": "object",
+      "properties": {
+        "emailConfig": {
+          "$ref": "#/definitions/v2EmailNotifierConfiguration"
+        },
+        "notifierName": {
+          "type": "string"
+        }
+      }
+    },
+    "v2Pagination": {
+      "type": "object",
+      "properties": {
+        "limit": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "offset": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "sortOption": {
+          "$ref": "#/definitions/v2SortOption"
+        },
+        "sortOptions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2SortOption"
+          },
+          "description": "This field is under development. It is not supported on any REST APIs."
+        }
+      }
+    },
+    "v2RawQuery": {
+      "type": "object",
+      "properties": {
+        "query": {
+          "type": "string"
+        },
+        "pagination": {
+          "$ref": "#/definitions/v2Pagination"
+        }
+      },
+      "description": "RawQuery represents the search query string.\nThe format of the query string is \"<field name>:<value,value,...>+<field name>:<value, value,...>+...\"\nFor example:\nTo search for deployments named \"central\" and \"sensor\" in the namespace \"stackrox\", the query string would be\n\"Deployment:central,sensor+Namespace:stackrox\"\nRawQuery is used in ListAPIs to search for a particular object."
+    },
+    "v2ReportConfiguration": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "type": {
+          "$ref": "#/definitions/v2ReportConfigurationReportType"
+        },
+        "vulnReportFilters": {
+          "$ref": "#/definitions/v2VulnerabilityReportFilters"
+        },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
+        "schedule": {
+          "$ref": "#/definitions/v2ReportSchedule"
+        },
+        "resourceScope": {
+          "$ref": "#/definitions/v2ResourceScope"
+        },
+        "notifiers": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2NotifierConfiguration"
+          }
+        }
+      }
+    },
+    "v2ReportConfigurationReportType": {
+      "type": "string",
+      "enum": [
+        "VULNERABILITY",
+        "NODE_VULNERABILITY"
+      ],
+      "default": "VULNERABILITY",
+      "description": "- VULNERABILITY: for historical reasons, this short form was used to mean \"Image Vulnerability\""
+    },
+    "v2ReportHistoryResponse": {
+      "type": "object",
+      "properties": {
+        "reportSnapshots": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2ReportSnapshot"
+          }
+        }
+      }
+    },
+    "v2ReportRequestViewBased": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/v2ReportRequestViewBasedReportType"
+        },
+        "viewBasedVulnReportFilters": {
+          "$ref": "#/definitions/v2ViewBasedVulnerabilityReportFilters"
+        },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
+        "areaOfConcern": {
+          "type": "string"
+        }
+      }
+    },
+    "v2ReportRequestViewBasedReportType": {
+      "type": "string",
+      "enum": [
+        "VULNERABILITY",
+        "NODE_VULNERABILITY"
+      ],
+      "default": "VULNERABILITY",
+      "description": "- VULNERABILITY: for historical reasons, this short form was used to mean \"Image Vulnerability\""
+    },
+    "v2ReportSchedule": {
+      "type": "object",
+      "properties": {
+        "intervalType": {
+          "$ref": "#/definitions/v2ReportScheduleIntervalType"
+        },
+        "hour": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "minute": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "daysOfWeek": {
+          "$ref": "#/definitions/v2ReportScheduleDaysOfWeek"
+        },
+        "daysOfMonth": {
+          "$ref": "#/definitions/v2ReportScheduleDaysOfMonth"
+        }
+      }
+    },
+    "v2ReportScheduleDaysOfMonth": {
+      "type": "object",
+      "properties": {
+        "days": {
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "title": "1 for 1st, 2 for 2nd .... 31 for 31st"
+    },
+    "v2ReportScheduleDaysOfWeek": {
+      "type": "object",
+      "properties": {
+        "days": {
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "title": "Sunday = 0, Monday = 1, .... Saturday =  6"
+    },
+    "v2ReportScheduleIntervalType": {
+      "type": "string",
+      "enum": [
+        "UNSET",
+        "WEEKLY",
+        "MONTHLY",
+        "DAILY"
+      ],
+      "default": "UNSET"
+    },
+    "v2ReportSnapshot": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/v2ReportSnapshotReportType"
+        },
+        "reportConfigId": {
+          "type": "string"
+        },
+        "reportJobId": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "vulnReportFilters": {
+          "$ref": "#/definitions/v2VulnerabilityReportFilters"
+        },
+        "viewBasedVulnReportFilters": {
+          "$ref": "#/definitions/v2ViewBasedVulnerabilityReportFilters"
+        },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
+        "collectionSnapshot": {
+          "$ref": "#/definitions/v2CollectionSnapshot"
+        },
+        "schedule": {
+          "$ref": "#/definitions/v2ReportSchedule"
+        },
+        "reportStatus": {
+          "$ref": "#/definitions/v2ReportStatus"
+        },
+        "notifiers": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v2NotifierConfiguration"
+          }
+        },
+        "user": {
+          "$ref": "#/definitions/v2SlimUser"
+        },
+        "isDownloadAvailable": {
+          "type": "boolean"
+        },
+        "areaOfConcern": {
+          "type": "string"
+        },
+        "resourceScope": {
+          "$ref": "#/definitions/v2ResourceScope"
+        }
+      }
+    },
+    "v2ReportSnapshotReportType": {
+      "type": "string",
+      "enum": [
+        "VULNERABILITY",
+        "NODE_VULNERABILITY"
+      ],
+      "default": "VULNERABILITY",
+      "description": "- VULNERABILITY: for historical reasons, this short form was used to mean \"Image Vulnerability\""
+    },
+    "v2ReportStatus": {
+      "type": "object",
+      "properties": {
+        "runState": {
+          "$ref": "#/definitions/v2ReportStatusRunState"
+        },
+        "completedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "errorMsg": {
+          "type": "string"
+        },
+        "reportRequestType": {
+          "$ref": "#/definitions/v2ReportStatusReportMethod"
+        },
+        "reportNotificationMethod": {
+          "$ref": "#/definitions/v2NotificationMethod"
+        }
+      }
+    },
+    "v2ReportStatusReportMethod": {
+      "type": "string",
+      "enum": [
+        "ON_DEMAND",
+        "SCHEDULED"
+      ],
+      "default": "ON_DEMAND"
+    },
+    "v2ReportStatusResponse": {
+      "type": "object",
+      "properties": {
+        "status": {
+          "$ref": "#/definitions/v2ReportStatus"
+        }
+      }
+    },
+    "v2ReportStatusRunState": {
+      "type": "string",
+      "enum": [
+        "WAITING",
+        "PREPARING",
+        "GENERATED",
+        "DELIVERED",
+        "FAILURE"
+      ],
+      "default": "WAITING"
+    },
+    "v2ResourceScope": {
+      "type": "object",
+      "properties": {
+        "collectionScope": {
+          "$ref": "#/definitions/v2CollectionReference"
+        },
+        "entityScope": {
+          "$ref": "#/definitions/v2EntityScope",
+          "title": "scope for deployment, namespace, cluster"
+        }
+      },
+      "description": "Reports are transitioning to a modernized architecture in a future release.\nTo prepare for future updates, we recommend transitioning your collections-based reports to the “Entity Scope” method.\nWhen the “Collection scope” option is removed in a future release, existing reports will not automatically convert to the “Entity scope” method."
+    },
+    "v2RuleValue": {
+      "type": "object",
+      "properties": {
+        "value": {
+          "type": "string"
+        },
+        "matchType": {
+          "$ref": "#/definitions/v2MatchType"
+        }
+      }
+    },
+    "v2RunReportRequest": {
+      "type": "object",
+      "properties": {
+        "reportConfigId": {
+          "type": "string"
+        },
+        "reportNotificationMethod": {
+          "$ref": "#/definitions/v2NotificationMethod"
+        }
+      }
+    },
+    "v2RunReportResponse": {
+      "type": "object",
+      "properties": {
+        "reportConfigId": {
+          "type": "string"
+        },
+        "reportId": {
+          "type": "string"
+        }
+      }
+    },
+    "v2RunReportResponseViewBased": {
+      "type": "object",
+      "properties": {
+        "reportID": {
+          "type": "string"
+        },
+        "requestName": {
+          "type": "string"
+        }
+      }
+    },
+    "v2ScopeEntity": {
+      "type": "string",
+      "enum": [
+        "SCOPE_ENTITY_UNSET",
+        "SCOPE_ENTITY_DEPLOYMENT",
+        "SCOPE_ENTITY_NAMESPACE",
+        "SCOPE_ENTITY_CLUSTER"
+      ],
+      "default": "SCOPE_ENTITY_UNSET"
+    },
+    "v2ScopeField": {
+      "type": "string",
+      "enum": [
+        "FIELD_UNSET",
+        "FIELD_ID",
+        "FIELD_NAME",
+        "FIELD_LABEL",
+        "FIELD_ANNOTATION"
+      ],
+      "default": "FIELD_UNSET"
+    },
+    "v2SlimUser": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "v2SortOption": {
+      "type": "object",
+      "properties": {
+        "field": {
+          "type": "string"
+        },
+        "reversed": {
+          "type": "boolean"
+        },
+        "aggregateBy": {
+          "$ref": "#/definitions/v2AggregateBy",
+          "description": "This field is under development. It is not supported on any REST APIs."
+        }
+      }
+    },
+    "v2ViewBasedVulnerabilityReportFilters": {
+      "type": "object",
+      "properties": {
+        "query": {
+          "type": "string"
+        }
+      },
+      "title": "filter for ondemand view based reports"
+    },
+    "v2VulnerabilityReportFilters": {
+      "type": "object",
+      "properties": {
+        "fixability": {
+          "$ref": "#/definitions/VulnerabilityReportFiltersFixability"
+        },
+        "severities": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v2VulnerabilityReportFiltersVulnerabilitySeverity"
+          }
+        },
+        "imageTypes": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/VulnerabilityReportFiltersImageType"
+          }
+        },
+        "allVuln": {
+          "type": "boolean"
+        },
+        "sinceLastSentScheduledReport": {
+          "type": "boolean"
+        },
+        "sinceStartDate": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "includeNvdCvss": {
+          "type": "boolean",
+          "description": "Deprecated: These fields are no longer used.\nNVD CVSS, EPSS Probability and Advisory columns are always included in reports."
+        },
+        "includeEpssProbability": {
+          "type": "boolean"
+        },
+        "includeAdvisory": {
+          "type": "boolean"
+        },
+        "query": {
+          "type": "string",
+          "title": "Filters related to image, cve etc for non-collection-based scopes"
+        }
+      }
+    },
+    "v2VulnerabilityReportFiltersVulnerabilitySeverity": {
+      "type": "string",
+      "enum": [
+        "UNKNOWN_VULNERABILITY_SEVERITY",
+        "LOW_VULNERABILITY_SEVERITY",
+        "MODERATE_VULNERABILITY_SEVERITY",
+        "IMPORTANT_VULNERABILITY_SEVERITY",
+        "CRITICAL_VULNERABILITY_SEVERITY"
+      ],
+      "default": "UNKNOWN_VULNERABILITY_SEVERITY"
+    }
+  }
+}
diff --git a/generated/api/v2/node_report_service_grpc.pb.go b/generated/api/v2/node_report_service_grpc.pb.go
new file mode 100644
index 0000000000000..bd8f96d000832
--- /dev/null
+++ b/generated/api/v2/node_report_service_grpc.pb.go
@@ -0,0 +1,651 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             v6.32.1
+// source: api/v2/node_report_service.proto
+
+package v2
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	NodeReportService_PostNodeReportConfiguration_FullMethodName     = "/v2.NodeReportService/PostNodeReportConfiguration"
+	NodeReportService_UpdateNodeReportConfiguration_FullMethodName   = "/v2.NodeReportService/UpdateNodeReportConfiguration"
+	NodeReportService_ListNodeReportConfigurations_FullMethodName    = "/v2.NodeReportService/ListNodeReportConfigurations"
+	NodeReportService_CountNodeReportConfigurations_FullMethodName   = "/v2.NodeReportService/CountNodeReportConfigurations"
+	NodeReportService_GetNodeReportConfiguration_FullMethodName      = "/v2.NodeReportService/GetNodeReportConfiguration"
+	NodeReportService_DeleteNodeReportConfiguration_FullMethodName   = "/v2.NodeReportService/DeleteNodeReportConfiguration"
+	NodeReportService_RunNodeReport_FullMethodName                   = "/v2.NodeReportService/RunNodeReport"
+	NodeReportService_GetNodeReportHistory_FullMethodName            = "/v2.NodeReportService/GetNodeReportHistory"
+	NodeReportService_GetMyNodeReportHistory_FullMethodName          = "/v2.NodeReportService/GetMyNodeReportHistory"
+	NodeReportService_GetNodeReportStatus_FullMethodName             = "/v2.NodeReportService/GetNodeReportStatus"
+	NodeReportService_CancelNodeReport_FullMethodName                = "/v2.NodeReportService/CancelNodeReport"
+	NodeReportService_DeleteNodeReport_FullMethodName                = "/v2.NodeReportService/DeleteNodeReport"
+	NodeReportService_PostViewBasedNodeReport_FullMethodName         = "/v2.NodeReportService/PostViewBasedNodeReport"
+	NodeReportService_GetViewBasedNodeReportHistory_FullMethodName   = "/v2.NodeReportService/GetViewBasedNodeReportHistory"
+	NodeReportService_GetViewBasedMyNodeReportHistory_FullMethodName = "/v2.NodeReportService/GetViewBasedMyNodeReportHistory"
+)
+
+// NodeReportServiceClient is the client API for NodeReportService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type NodeReportServiceClient interface {
+	PostNodeReportConfiguration(ctx context.Context, in *ReportConfiguration, opts ...grpc.CallOption) (*ReportConfiguration, error)
+	UpdateNodeReportConfiguration(ctx context.Context, in *ReportConfiguration, opts ...grpc.CallOption) (*Empty, error)
+	ListNodeReportConfigurations(ctx context.Context, in *RawQuery, opts ...grpc.CallOption) (*ListReportConfigurationsResponse, error)
+	CountNodeReportConfigurations(ctx context.Context, in *RawQuery, opts ...grpc.CallOption) (*CountReportConfigurationsResponse, error)
+	GetNodeReportConfiguration(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*ReportConfiguration, error)
+	DeleteNodeReportConfiguration(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*Empty, error)
+	RunNodeReport(ctx context.Context, in *RunReportRequest, opts ...grpc.CallOption) (*RunReportResponse, error)
+	GetNodeReportHistory(ctx context.Context, in *GetReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error)
+	GetMyNodeReportHistory(ctx context.Context, in *GetReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error)
+	GetNodeReportStatus(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*ReportStatusResponse, error)
+	CancelNodeReport(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*Empty, error)
+	DeleteNodeReport(ctx context.Context, in *DeleteReportRequest, opts ...grpc.CallOption) (*Empty, error)
+	PostViewBasedNodeReport(ctx context.Context, in *ReportRequestViewBased, opts ...grpc.CallOption) (*RunReportResponseViewBased, error)
+	GetViewBasedNodeReportHistory(ctx context.Context, in *GetViewBasedReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error)
+	GetViewBasedMyNodeReportHistory(ctx context.Context, in *GetViewBasedReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error)
+}
+
+type nodeReportServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewNodeReportServiceClient(cc grpc.ClientConnInterface) NodeReportServiceClient {
+	return &nodeReportServiceClient{cc}
+}
+
+func (c *nodeReportServiceClient) PostNodeReportConfiguration(ctx context.Context, in *ReportConfiguration, opts ...grpc.CallOption) (*ReportConfiguration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReportConfiguration)
+	err := c.cc.Invoke(ctx, NodeReportService_PostNodeReportConfiguration_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) UpdateNodeReportConfiguration(ctx context.Context, in *ReportConfiguration, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, NodeReportService_UpdateNodeReportConfiguration_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) ListNodeReportConfigurations(ctx context.Context, in *RawQuery, opts ...grpc.CallOption) (*ListReportConfigurationsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListReportConfigurationsResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_ListNodeReportConfigurations_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) CountNodeReportConfigurations(ctx context.Context, in *RawQuery, opts ...grpc.CallOption) (*CountReportConfigurationsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CountReportConfigurationsResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_CountNodeReportConfigurations_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) GetNodeReportConfiguration(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*ReportConfiguration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReportConfiguration)
+	err := c.cc.Invoke(ctx, NodeReportService_GetNodeReportConfiguration_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) DeleteNodeReportConfiguration(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, NodeReportService_DeleteNodeReportConfiguration_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) RunNodeReport(ctx context.Context, in *RunReportRequest, opts ...grpc.CallOption) (*RunReportResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RunReportResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_RunNodeReport_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) GetNodeReportHistory(ctx context.Context, in *GetReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReportHistoryResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_GetNodeReportHistory_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) GetMyNodeReportHistory(ctx context.Context, in *GetReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReportHistoryResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_GetMyNodeReportHistory_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) GetNodeReportStatus(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*ReportStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReportStatusResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_GetNodeReportStatus_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) CancelNodeReport(ctx context.Context, in *ResourceByID, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, NodeReportService_CancelNodeReport_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) DeleteNodeReport(ctx context.Context, in *DeleteReportRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, NodeReportService_DeleteNodeReport_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) PostViewBasedNodeReport(ctx context.Context, in *ReportRequestViewBased, opts ...grpc.CallOption) (*RunReportResponseViewBased, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RunReportResponseViewBased)
+	err := c.cc.Invoke(ctx, NodeReportService_PostViewBasedNodeReport_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) GetViewBasedNodeReportHistory(ctx context.Context, in *GetViewBasedReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReportHistoryResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_GetViewBasedNodeReportHistory_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeReportServiceClient) GetViewBasedMyNodeReportHistory(ctx context.Context, in *GetViewBasedReportHistoryRequest, opts ...grpc.CallOption) (*ReportHistoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReportHistoryResponse)
+	err := c.cc.Invoke(ctx, NodeReportService_GetViewBasedMyNodeReportHistory_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// NodeReportServiceServer is the server API for NodeReportService service.
+// All implementations should embed UnimplementedNodeReportServiceServer
+// for forward compatibility.
+type NodeReportServiceServer interface {
+	PostNodeReportConfiguration(context.Context, *ReportConfiguration) (*ReportConfiguration, error)
+	UpdateNodeReportConfiguration(context.Context, *ReportConfiguration) (*Empty, error)
+	ListNodeReportConfigurations(context.Context, *RawQuery) (*ListReportConfigurationsResponse, error)
+	CountNodeReportConfigurations(context.Context, *RawQuery) (*CountReportConfigurationsResponse, error)
+	GetNodeReportConfiguration(context.Context, *ResourceByID) (*ReportConfiguration, error)
+	DeleteNodeReportConfiguration(context.Context, *ResourceByID) (*Empty, error)
+	RunNodeReport(context.Context, *RunReportRequest) (*RunReportResponse, error)
+	GetNodeReportHistory(context.Context, *GetReportHistoryRequest) (*ReportHistoryResponse, error)
+	GetMyNodeReportHistory(context.Context, *GetReportHistoryRequest) (*ReportHistoryResponse, error)
+	GetNodeReportStatus(context.Context, *ResourceByID) (*ReportStatusResponse, error)
+	CancelNodeReport(context.Context, *ResourceByID) (*Empty, error)
+	DeleteNodeReport(context.Context, *DeleteReportRequest) (*Empty, error)
+	PostViewBasedNodeReport(context.Context, *ReportRequestViewBased) (*RunReportResponseViewBased, error)
+	GetViewBasedNodeReportHistory(context.Context, *GetViewBasedReportHistoryRequest) (*ReportHistoryResponse, error)
+	GetViewBasedMyNodeReportHistory(context.Context, *GetViewBasedReportHistoryRequest) (*ReportHistoryResponse, error)
+}
+
+// UnimplementedNodeReportServiceServer should be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedNodeReportServiceServer struct{}
+
+func (UnimplementedNodeReportServiceServer) PostNodeReportConfiguration(context.Context, *ReportConfiguration) (*ReportConfiguration, error) {
+	return nil, status.Error(codes.Unimplemented, "method PostNodeReportConfiguration not implemented")
+}
+func (UnimplementedNodeReportServiceServer) UpdateNodeReportConfiguration(context.Context, *ReportConfiguration) (*Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateNodeReportConfiguration not implemented")
+}
+func (UnimplementedNodeReportServiceServer) ListNodeReportConfigurations(context.Context, *RawQuery) (*ListReportConfigurationsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListNodeReportConfigurations not implemented")
+}
+func (UnimplementedNodeReportServiceServer) CountNodeReportConfigurations(context.Context, *RawQuery) (*CountReportConfigurationsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method CountNodeReportConfigurations not implemented")
+}
+func (UnimplementedNodeReportServiceServer) GetNodeReportConfiguration(context.Context, *ResourceByID) (*ReportConfiguration, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetNodeReportConfiguration not implemented")
+}
+func (UnimplementedNodeReportServiceServer) DeleteNodeReportConfiguration(context.Context, *ResourceByID) (*Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteNodeReportConfiguration not implemented")
+}
+func (UnimplementedNodeReportServiceServer) RunNodeReport(context.Context, *RunReportRequest) (*RunReportResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RunNodeReport not implemented")
+}
+func (UnimplementedNodeReportServiceServer) GetNodeReportHistory(context.Context, *GetReportHistoryRequest) (*ReportHistoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetNodeReportHistory not implemented")
+}
+func (UnimplementedNodeReportServiceServer) GetMyNodeReportHistory(context.Context, *GetReportHistoryRequest) (*ReportHistoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetMyNodeReportHistory not implemented")
+}
+func (UnimplementedNodeReportServiceServer) GetNodeReportStatus(context.Context, *ResourceByID) (*ReportStatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetNodeReportStatus not implemented")
+}
+func (UnimplementedNodeReportServiceServer) CancelNodeReport(context.Context, *ResourceByID) (*Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method CancelNodeReport not implemented")
+}
+func (UnimplementedNodeReportServiceServer) DeleteNodeReport(context.Context, *DeleteReportRequest) (*Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteNodeReport not implemented")
+}
+func (UnimplementedNodeReportServiceServer) PostViewBasedNodeReport(context.Context, *ReportRequestViewBased) (*RunReportResponseViewBased, error) {
+	return nil, status.Error(codes.Unimplemented, "method PostViewBasedNodeReport not implemented")
+}
+func (UnimplementedNodeReportServiceServer) GetViewBasedNodeReportHistory(context.Context, *GetViewBasedReportHistoryRequest) (*ReportHistoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetViewBasedNodeReportHistory not implemented")
+}
+func (UnimplementedNodeReportServiceServer) GetViewBasedMyNodeReportHistory(context.Context, *GetViewBasedReportHistoryRequest) (*ReportHistoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetViewBasedMyNodeReportHistory not implemented")
+}
+func (UnimplementedNodeReportServiceServer) testEmbeddedByValue() {}
+
+// UnsafeNodeReportServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to NodeReportServiceServer will
+// result in compilation errors.
+type UnsafeNodeReportServiceServer interface {
+	mustEmbedUnimplementedNodeReportServiceServer()
+}
+
+func RegisterNodeReportServiceServer(s grpc.ServiceRegistrar, srv NodeReportServiceServer) {
+	// If the following call panics, it indicates UnimplementedNodeReportServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&NodeReportService_ServiceDesc, srv)
+}
+
+func _NodeReportService_PostNodeReportConfiguration_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportConfiguration)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).PostNodeReportConfiguration(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_PostNodeReportConfiguration_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).PostNodeReportConfiguration(ctx, req.(*ReportConfiguration))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_UpdateNodeReportConfiguration_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportConfiguration)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).UpdateNodeReportConfiguration(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_UpdateNodeReportConfiguration_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).UpdateNodeReportConfiguration(ctx, req.(*ReportConfiguration))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_ListNodeReportConfigurations_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RawQuery)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).ListNodeReportConfigurations(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_ListNodeReportConfigurations_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).ListNodeReportConfigurations(ctx, req.(*RawQuery))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_CountNodeReportConfigurations_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RawQuery)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).CountNodeReportConfigurations(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_CountNodeReportConfigurations_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).CountNodeReportConfigurations(ctx, req.(*RawQuery))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_GetNodeReportConfiguration_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResourceByID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).GetNodeReportConfiguration(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_GetNodeReportConfiguration_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).GetNodeReportConfiguration(ctx, req.(*ResourceByID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_DeleteNodeReportConfiguration_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResourceByID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).DeleteNodeReportConfiguration(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_DeleteNodeReportConfiguration_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).DeleteNodeReportConfiguration(ctx, req.(*ResourceByID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_RunNodeReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RunReportRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).RunNodeReport(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_RunNodeReport_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).RunNodeReport(ctx, req.(*RunReportRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_GetNodeReportHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetReportHistoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).GetNodeReportHistory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_GetNodeReportHistory_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).GetNodeReportHistory(ctx, req.(*GetReportHistoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_GetMyNodeReportHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetReportHistoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).GetMyNodeReportHistory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_GetMyNodeReportHistory_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).GetMyNodeReportHistory(ctx, req.(*GetReportHistoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_GetNodeReportStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResourceByID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).GetNodeReportStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_GetNodeReportStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).GetNodeReportStatus(ctx, req.(*ResourceByID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_CancelNodeReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResourceByID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).CancelNodeReport(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_CancelNodeReport_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).CancelNodeReport(ctx, req.(*ResourceByID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_DeleteNodeReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteReportRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).DeleteNodeReport(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_DeleteNodeReport_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).DeleteNodeReport(ctx, req.(*DeleteReportRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_PostViewBasedNodeReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportRequestViewBased)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).PostViewBasedNodeReport(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_PostViewBasedNodeReport_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).PostViewBasedNodeReport(ctx, req.(*ReportRequestViewBased))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_GetViewBasedNodeReportHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetViewBasedReportHistoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).GetViewBasedNodeReportHistory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_GetViewBasedNodeReportHistory_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).GetViewBasedNodeReportHistory(ctx, req.(*GetViewBasedReportHistoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeReportService_GetViewBasedMyNodeReportHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetViewBasedReportHistoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeReportServiceServer).GetViewBasedMyNodeReportHistory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NodeReportService_GetViewBasedMyNodeReportHistory_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeReportServiceServer).GetViewBasedMyNodeReportHistory(ctx, req.(*GetViewBasedReportHistoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// NodeReportService_ServiceDesc is the grpc.ServiceDesc for NodeReportService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var NodeReportService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "v2.NodeReportService",
+	HandlerType: (*NodeReportServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "PostNodeReportConfiguration",
+			Handler:    _NodeReportService_PostNodeReportConfiguration_Handler,
+		},
+		{
+			MethodName: "UpdateNodeReportConfiguration",
+			Handler:    _NodeReportService_UpdateNodeReportConfiguration_Handler,
+		},
+		{
+			MethodName: "ListNodeReportConfigurations",
+			Handler:    _NodeReportService_ListNodeReportConfigurations_Handler,
+		},
+		{
+			MethodName: "CountNodeReportConfigurations",
+			Handler:    _NodeReportService_CountNodeReportConfigurations_Handler,
+		},
+		{
+			MethodName: "GetNodeReportConfiguration",
+			Handler:    _NodeReportService_GetNodeReportConfiguration_Handler,
+		},
+		{
+			MethodName: "DeleteNodeReportConfiguration",
+			Handler:    _NodeReportService_DeleteNodeReportConfiguration_Handler,
+		},
+		{
+			MethodName: "RunNodeReport",
+			Handler:    _NodeReportService_RunNodeReport_Handler,
+		},
+		{
+			MethodName: "GetNodeReportHistory",
+			Handler:    _NodeReportService_GetNodeReportHistory_Handler,
+		},
+		{
+			MethodName: "GetMyNodeReportHistory",
+			Handler:    _NodeReportService_GetMyNodeReportHistory_Handler,
+		},
+		{
+			MethodName: "GetNodeReportStatus",
+			Handler:    _NodeReportService_GetNodeReportStatus_Handler,
+		},
+		{
+			MethodName: "CancelNodeReport",
+			Handler:    _NodeReportService_CancelNodeReport_Handler,
+		},
+		{
+			MethodName: "DeleteNodeReport",
+			Handler:    _NodeReportService_DeleteNodeReport_Handler,
+		},
+		{
+			MethodName: "PostViewBasedNodeReport",
+			Handler:    _NodeReportService_PostViewBasedNodeReport_Handler,
+		},
+		{
+			MethodName: "GetViewBasedNodeReportHistory",
+			Handler:    _NodeReportService_GetViewBasedNodeReportHistory_Handler,
+		},
+		{
+			MethodName: "GetViewBasedMyNodeReportHistory",
+			Handler:    _NodeReportService_GetViewBasedMyNodeReportHistory_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v2/node_report_service.proto",
+}
diff --git a/generated/api/v2/pagination.pb.go b/generated/api/v2/pagination.pb.go
index 872cc707cd73a..4caf365cac11a 100644
--- a/generated/api/v2/pagination.pb.go
+++ b/generated/api/v2/pagination.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/pagination.proto
 
diff --git a/generated/api/v2/report_service.pb.go b/generated/api/v2/report_service.pb.go
index 5813d7bdbc563..a0e3d59f5b211 100644
--- a/generated/api/v2/report_service.pb.go
+++ b/generated/api/v2/report_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/report_service.proto
 
@@ -225,16 +225,19 @@ func (NotificationMethod) EnumDescriptor() ([]byte, []int) {
 type ReportConfiguration_ReportType int32
 
 const (
-	ReportConfiguration_VULNERABILITY ReportConfiguration_ReportType = 0
+	ReportConfiguration_VULNERABILITY      ReportConfiguration_ReportType = 0 // for historical reasons, this short form was used to mean "Image Vulnerability"
+	ReportConfiguration_NODE_VULNERABILITY ReportConfiguration_ReportType = 1
 )
 
 // Enum value maps for ReportConfiguration_ReportType.
 var (
 	ReportConfiguration_ReportType_name = map[int32]string{
 		0: "VULNERABILITY",
+		1: "NODE_VULNERABILITY",
 	}
 	ReportConfiguration_ReportType_value = map[string]int32{
-		"VULNERABILITY": 0,
+		"VULNERABILITY":      0,
+		"NODE_VULNERABILITY": 1,
 	}
 )
 
@@ -464,7 +467,53 @@ func (x ReportSchedule_IntervalType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ReportSchedule_IntervalType.Descriptor instead.
 func (ReportSchedule_IntervalType) EnumDescriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{3, 0}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{4, 0}
+}
+
+type ReportSnapshot_ReportType int32
+
+const (
+	ReportSnapshot_VULNERABILITY      ReportSnapshot_ReportType = 0 // for historical reasons, this short form was used to mean "Image Vulnerability"
+	ReportSnapshot_NODE_VULNERABILITY ReportSnapshot_ReportType = 1
+)
+
+// Enum value maps for ReportSnapshot_ReportType.
+var (
+	ReportSnapshot_ReportType_name = map[int32]string{
+		0: "VULNERABILITY",
+		1: "NODE_VULNERABILITY",
+	}
+	ReportSnapshot_ReportType_value = map[string]int32{
+		"VULNERABILITY":      0,
+		"NODE_VULNERABILITY": 1,
+	}
+)
+
+func (x ReportSnapshot_ReportType) Enum() *ReportSnapshot_ReportType {
+	p := new(ReportSnapshot_ReportType)
+	*p = x
+	return p
+}
+
+func (x ReportSnapshot_ReportType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ReportSnapshot_ReportType) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_v2_report_service_proto_enumTypes[9].Descriptor()
+}
+
+func (ReportSnapshot_ReportType) Type() protoreflect.EnumType {
+	return &file_api_v2_report_service_proto_enumTypes[9]
+}
+
+func (x ReportSnapshot_ReportType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ReportSnapshot_ReportType.Descriptor instead.
+func (ReportSnapshot_ReportType) EnumDescriptor() ([]byte, []int) {
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{19, 0}
 }
 
 type ReportStatus_RunState int32
@@ -506,11 +555,11 @@ func (x ReportStatus_RunState) String() string {
 }
 
 func (ReportStatus_RunState) Descriptor() protoreflect.EnumDescriptor {
-	return file_api_v2_report_service_proto_enumTypes[9].Descriptor()
+	return file_api_v2_report_service_proto_enumTypes[10].Descriptor()
 }
 
 func (ReportStatus_RunState) Type() protoreflect.EnumType {
-	return &file_api_v2_report_service_proto_enumTypes[9]
+	return &file_api_v2_report_service_proto_enumTypes[10]
 }
 
 func (x ReportStatus_RunState) Number() protoreflect.EnumNumber {
@@ -519,7 +568,7 @@ func (x ReportStatus_RunState) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ReportStatus_RunState.Descriptor instead.
 func (ReportStatus_RunState) EnumDescriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{19, 0}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{20, 0}
 }
 
 type ReportStatus_ReportMethod int32
@@ -552,11 +601,11 @@ func (x ReportStatus_ReportMethod) String() string {
 }
 
 func (ReportStatus_ReportMethod) Descriptor() protoreflect.EnumDescriptor {
-	return file_api_v2_report_service_proto_enumTypes[10].Descriptor()
+	return file_api_v2_report_service_proto_enumTypes[11].Descriptor()
 }
 
 func (ReportStatus_ReportMethod) Type() protoreflect.EnumType {
-	return &file_api_v2_report_service_proto_enumTypes[10]
+	return &file_api_v2_report_service_proto_enumTypes[11]
 }
 
 func (x ReportStatus_ReportMethod) Number() protoreflect.EnumNumber {
@@ -565,22 +614,25 @@ func (x ReportStatus_ReportMethod) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ReportStatus_ReportMethod.Descriptor instead.
 func (ReportStatus_ReportMethod) EnumDescriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{19, 1}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{20, 1}
 }
 
 type ReportRequestViewBased_ReportType int32
 
 const (
-	ReportRequestViewBased_VULNERABILITY ReportRequestViewBased_ReportType = 0
+	ReportRequestViewBased_VULNERABILITY      ReportRequestViewBased_ReportType = 0 // for historical reasons, this short form was used to mean "Image Vulnerability"
+	ReportRequestViewBased_NODE_VULNERABILITY ReportRequestViewBased_ReportType = 1
 )
 
 // Enum value maps for ReportRequestViewBased_ReportType.
 var (
 	ReportRequestViewBased_ReportType_name = map[int32]string{
 		0: "VULNERABILITY",
+		1: "NODE_VULNERABILITY",
 	}
 	ReportRequestViewBased_ReportType_value = map[string]int32{
-		"VULNERABILITY": 0,
+		"VULNERABILITY":      0,
+		"NODE_VULNERABILITY": 1,
 	}
 )
 
@@ -595,11 +647,11 @@ func (x ReportRequestViewBased_ReportType) String() string {
 }
 
 func (ReportRequestViewBased_ReportType) Descriptor() protoreflect.EnumDescriptor {
-	return file_api_v2_report_service_proto_enumTypes[11].Descriptor()
+	return file_api_v2_report_service_proto_enumTypes[12].Descriptor()
 }
 
 func (ReportRequestViewBased_ReportType) Type() protoreflect.EnumType {
-	return &file_api_v2_report_service_proto_enumTypes[11]
+	return &file_api_v2_report_service_proto_enumTypes[12]
 }
 
 func (x ReportRequestViewBased_ReportType) Number() protoreflect.EnumNumber {
@@ -608,7 +660,7 @@ func (x ReportRequestViewBased_ReportType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ReportRequestViewBased_ReportType.Descriptor instead.
 func (ReportRequestViewBased_ReportType) EnumDescriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{23, 0}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{24, 0}
 }
 
 type ReportConfiguration struct {
@@ -620,6 +672,7 @@ type ReportConfiguration struct {
 	// Types that are valid to be assigned to Filter:
 	//
 	//	*ReportConfiguration_VulnReportFilters
+	//	*ReportConfiguration_NodeVulnReportFilters
 	Filter        isReportConfiguration_Filter `protobuf_oneof:"filter"`
 	Schedule      *ReportSchedule              `protobuf:"bytes,6,opt,name=schedule,proto3" json:"schedule,omitempty"`
 	ResourceScope *ResourceScope               `protobuf:"bytes,7,opt,name=resource_scope,json=resourceScope,proto3" json:"resource_scope,omitempty"`
@@ -702,6 +755,15 @@ func (x *ReportConfiguration) GetVulnReportFilters() *VulnerabilityReportFilters
 	return nil
 }
 
+func (x *ReportConfiguration) GetNodeVulnReportFilters() *NodeVulnerabilityReportFilters {
+	if x != nil {
+		if x, ok := x.Filter.(*ReportConfiguration_NodeVulnReportFilters); ok {
+			return x.NodeVulnReportFilters
+		}
+	}
+	return nil
+}
+
 func (x *ReportConfiguration) GetSchedule() *ReportSchedule {
 	if x != nil {
 		return x.Schedule
@@ -731,8 +793,14 @@ type ReportConfiguration_VulnReportFilters struct {
 	VulnReportFilters *VulnerabilityReportFilters `protobuf:"bytes,5,opt,name=vuln_report_filters,json=vulnReportFilters,proto3,oneof"`
 }
 
+type ReportConfiguration_NodeVulnReportFilters struct {
+	NodeVulnReportFilters *NodeVulnerabilityReportFilters `protobuf:"bytes,9,opt,name=node_vuln_report_filters,json=nodeVulnReportFilters,proto3,oneof"`
+}
+
 func (*ReportConfiguration_VulnReportFilters) isReportConfiguration_Filter() {}
 
+func (*ReportConfiguration_NodeVulnReportFilters) isReportConfiguration_Filter() {}
+
 type VulnerabilityReportFilters struct {
 	state      protoimpl.MessageState                             `protogen:"open.v1"`
 	Fixability VulnerabilityReportFilters_Fixability              `protobuf:"varint,1,opt,name=fixability,proto3,enum=v2.VulnerabilityReportFilters_Fixability" json:"fixability,omitempty"`
@@ -898,6 +966,80 @@ func (*VulnerabilityReportFilters_SinceLastSentScheduledReport) isVulnerabilityR
 
 func (*VulnerabilityReportFilters_SinceStartDate) isVulnerabilityReportFilters_CvesSince() {}
 
+type NodeVulnerabilityReportFilters struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to CvesSince:
+	//
+	//	*NodeVulnerabilityReportFilters_AllVuln
+	CvesSince     isNodeVulnerabilityReportFilters_CvesSince `protobuf_oneof:"cves_since"`
+	Query         string                                     `protobuf:"bytes,2,opt,name=query,proto3" json:"query,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NodeVulnerabilityReportFilters) Reset() {
+	*x = NodeVulnerabilityReportFilters{}
+	mi := &file_api_v2_report_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NodeVulnerabilityReportFilters) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NodeVulnerabilityReportFilters) ProtoMessage() {}
+
+func (x *NodeVulnerabilityReportFilters) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_report_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NodeVulnerabilityReportFilters.ProtoReflect.Descriptor instead.
+func (*NodeVulnerabilityReportFilters) Descriptor() ([]byte, []int) {
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *NodeVulnerabilityReportFilters) GetCvesSince() isNodeVulnerabilityReportFilters_CvesSince {
+	if x != nil {
+		return x.CvesSince
+	}
+	return nil
+}
+
+func (x *NodeVulnerabilityReportFilters) GetAllVuln() bool {
+	if x != nil {
+		if x, ok := x.CvesSince.(*NodeVulnerabilityReportFilters_AllVuln); ok {
+			return x.AllVuln
+		}
+	}
+	return false
+}
+
+func (x *NodeVulnerabilityReportFilters) GetQuery() string {
+	if x != nil {
+		return x.Query
+	}
+	return ""
+}
+
+type isNodeVulnerabilityReportFilters_CvesSince interface {
+	isNodeVulnerabilityReportFilters_CvesSince()
+}
+
+type NodeVulnerabilityReportFilters_AllVuln struct {
+	AllVuln bool `protobuf:"varint,1,opt,name=all_vuln,json=allVuln,proto3,oneof"`
+}
+
+func (*NodeVulnerabilityReportFilters_AllVuln) isNodeVulnerabilityReportFilters_CvesSince() {}
+
 // filter for ondemand view based reports
 type ViewBasedVulnerabilityReportFilters struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -908,7 +1050,7 @@ type ViewBasedVulnerabilityReportFilters struct {
 
 func (x *ViewBasedVulnerabilityReportFilters) Reset() {
 	*x = ViewBasedVulnerabilityReportFilters{}
-	mi := &file_api_v2_report_service_proto_msgTypes[2]
+	mi := &file_api_v2_report_service_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -920,7 +1062,7 @@ func (x *ViewBasedVulnerabilityReportFilters) String() string {
 func (*ViewBasedVulnerabilityReportFilters) ProtoMessage() {}
 
 func (x *ViewBasedVulnerabilityReportFilters) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[2]
+	mi := &file_api_v2_report_service_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -933,7 +1075,7 @@ func (x *ViewBasedVulnerabilityReportFilters) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use ViewBasedVulnerabilityReportFilters.ProtoReflect.Descriptor instead.
 func (*ViewBasedVulnerabilityReportFilters) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{2}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ViewBasedVulnerabilityReportFilters) GetQuery() string {
@@ -959,7 +1101,7 @@ type ReportSchedule struct {
 
 func (x *ReportSchedule) Reset() {
 	*x = ReportSchedule{}
-	mi := &file_api_v2_report_service_proto_msgTypes[3]
+	mi := &file_api_v2_report_service_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -971,7 +1113,7 @@ func (x *ReportSchedule) String() string {
 func (*ReportSchedule) ProtoMessage() {}
 
 func (x *ReportSchedule) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[3]
+	mi := &file_api_v2_report_service_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -984,7 +1126,7 @@ func (x *ReportSchedule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportSchedule.ProtoReflect.Descriptor instead.
 func (*ReportSchedule) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{3}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *ReportSchedule) GetIntervalType() ReportSchedule_IntervalType {
@@ -1065,7 +1207,7 @@ type ResourceScope struct {
 
 func (x *ResourceScope) Reset() {
 	*x = ResourceScope{}
-	mi := &file_api_v2_report_service_proto_msgTypes[4]
+	mi := &file_api_v2_report_service_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1077,7 +1219,7 @@ func (x *ResourceScope) String() string {
 func (*ResourceScope) ProtoMessage() {}
 
 func (x *ResourceScope) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[4]
+	mi := &file_api_v2_report_service_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1090,7 +1232,7 @@ func (x *ResourceScope) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResourceScope.ProtoReflect.Descriptor instead.
 func (*ResourceScope) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{4}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *ResourceScope) GetScopeReference() isResourceScope_ScopeReference {
@@ -1144,7 +1286,7 @@ type CollectionReference struct {
 
 func (x *CollectionReference) Reset() {
 	*x = CollectionReference{}
-	mi := &file_api_v2_report_service_proto_msgTypes[5]
+	mi := &file_api_v2_report_service_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1156,7 +1298,7 @@ func (x *CollectionReference) String() string {
 func (*CollectionReference) ProtoMessage() {}
 
 func (x *CollectionReference) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[5]
+	mi := &file_api_v2_report_service_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1169,7 +1311,7 @@ func (x *CollectionReference) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionReference.ProtoReflect.Descriptor instead.
 func (*CollectionReference) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{5}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *CollectionReference) GetCollectionId() string {
@@ -1195,7 +1337,7 @@ type EntityScope struct {
 
 func (x *EntityScope) Reset() {
 	*x = EntityScope{}
-	mi := &file_api_v2_report_service_proto_msgTypes[6]
+	mi := &file_api_v2_report_service_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1207,7 +1349,7 @@ func (x *EntityScope) String() string {
 func (*EntityScope) ProtoMessage() {}
 
 func (x *EntityScope) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[6]
+	mi := &file_api_v2_report_service_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1220,7 +1362,7 @@ func (x *EntityScope) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EntityScope.ProtoReflect.Descriptor instead.
 func (*EntityScope) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{6}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *EntityScope) GetRules() []*EntityScopeRule {
@@ -1240,7 +1382,7 @@ type RuleValue struct {
 
 func (x *RuleValue) Reset() {
 	*x = RuleValue{}
-	mi := &file_api_v2_report_service_proto_msgTypes[7]
+	mi := &file_api_v2_report_service_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1252,7 +1394,7 @@ func (x *RuleValue) String() string {
 func (*RuleValue) ProtoMessage() {}
 
 func (x *RuleValue) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[7]
+	mi := &file_api_v2_report_service_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1265,7 +1407,7 @@ func (x *RuleValue) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RuleValue.ProtoReflect.Descriptor instead.
 func (*RuleValue) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{7}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *RuleValue) GetValue() string {
@@ -1293,7 +1435,7 @@ type EntityScopeRule struct {
 
 func (x *EntityScopeRule) Reset() {
 	*x = EntityScopeRule{}
-	mi := &file_api_v2_report_service_proto_msgTypes[8]
+	mi := &file_api_v2_report_service_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1305,7 +1447,7 @@ func (x *EntityScopeRule) String() string {
 func (*EntityScopeRule) ProtoMessage() {}
 
 func (x *EntityScopeRule) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[8]
+	mi := &file_api_v2_report_service_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1318,7 +1460,7 @@ func (x *EntityScopeRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EntityScopeRule.ProtoReflect.Descriptor instead.
 func (*EntityScopeRule) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{8}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *EntityScopeRule) GetEntity() ScopeEntity {
@@ -1355,7 +1497,7 @@ type NotifierConfiguration struct {
 
 func (x *NotifierConfiguration) Reset() {
 	*x = NotifierConfiguration{}
-	mi := &file_api_v2_report_service_proto_msgTypes[9]
+	mi := &file_api_v2_report_service_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1367,7 +1509,7 @@ func (x *NotifierConfiguration) String() string {
 func (*NotifierConfiguration) ProtoMessage() {}
 
 func (x *NotifierConfiguration) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[9]
+	mi := &file_api_v2_report_service_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1380,7 +1522,7 @@ func (x *NotifierConfiguration) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NotifierConfiguration.ProtoReflect.Descriptor instead.
 func (*NotifierConfiguration) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{9}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *NotifierConfiguration) GetNotifierConfig() isNotifierConfiguration_NotifierConfig {
@@ -1428,7 +1570,7 @@ type EmailNotifierConfiguration struct {
 
 func (x *EmailNotifierConfiguration) Reset() {
 	*x = EmailNotifierConfiguration{}
-	mi := &file_api_v2_report_service_proto_msgTypes[10]
+	mi := &file_api_v2_report_service_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1440,7 +1582,7 @@ func (x *EmailNotifierConfiguration) String() string {
 func (*EmailNotifierConfiguration) ProtoMessage() {}
 
 func (x *EmailNotifierConfiguration) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[10]
+	mi := &file_api_v2_report_service_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1453,7 +1595,7 @@ func (x *EmailNotifierConfiguration) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EmailNotifierConfiguration.ProtoReflect.Descriptor instead.
 func (*EmailNotifierConfiguration) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{10}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *EmailNotifierConfiguration) GetNotifierId() string {
@@ -1493,7 +1635,7 @@ type ListReportConfigurationsResponse struct {
 
 func (x *ListReportConfigurationsResponse) Reset() {
 	*x = ListReportConfigurationsResponse{}
-	mi := &file_api_v2_report_service_proto_msgTypes[11]
+	mi := &file_api_v2_report_service_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1505,7 +1647,7 @@ func (x *ListReportConfigurationsResponse) String() string {
 func (*ListReportConfigurationsResponse) ProtoMessage() {}
 
 func (x *ListReportConfigurationsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[11]
+	mi := &file_api_v2_report_service_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1518,7 +1660,7 @@ func (x *ListReportConfigurationsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListReportConfigurationsResponse.ProtoReflect.Descriptor instead.
 func (*ListReportConfigurationsResponse) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{11}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *ListReportConfigurationsResponse) GetReportConfigs() []*ReportConfiguration {
@@ -1537,7 +1679,7 @@ type CountReportConfigurationsResponse struct {
 
 func (x *CountReportConfigurationsResponse) Reset() {
 	*x = CountReportConfigurationsResponse{}
-	mi := &file_api_v2_report_service_proto_msgTypes[12]
+	mi := &file_api_v2_report_service_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1549,7 +1691,7 @@ func (x *CountReportConfigurationsResponse) String() string {
 func (*CountReportConfigurationsResponse) ProtoMessage() {}
 
 func (x *CountReportConfigurationsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[12]
+	mi := &file_api_v2_report_service_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1562,7 +1704,7 @@ func (x *CountReportConfigurationsResponse) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use CountReportConfigurationsResponse.ProtoReflect.Descriptor instead.
 func (*CountReportConfigurationsResponse) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{12}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *CountReportConfigurationsResponse) GetCount() int32 {
@@ -1582,7 +1724,7 @@ type GetReportHistoryRequest struct {
 
 func (x *GetReportHistoryRequest) Reset() {
 	*x = GetReportHistoryRequest{}
-	mi := &file_api_v2_report_service_proto_msgTypes[13]
+	mi := &file_api_v2_report_service_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1594,7 +1736,7 @@ func (x *GetReportHistoryRequest) String() string {
 func (*GetReportHistoryRequest) ProtoMessage() {}
 
 func (x *GetReportHistoryRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[13]
+	mi := &file_api_v2_report_service_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1607,7 +1749,7 @@ func (x *GetReportHistoryRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetReportHistoryRequest.ProtoReflect.Descriptor instead.
 func (*GetReportHistoryRequest) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{13}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *GetReportHistoryRequest) GetId() string {
@@ -1633,7 +1775,7 @@ type GetViewBasedReportHistoryRequest struct {
 
 func (x *GetViewBasedReportHistoryRequest) Reset() {
 	*x = GetViewBasedReportHistoryRequest{}
-	mi := &file_api_v2_report_service_proto_msgTypes[14]
+	mi := &file_api_v2_report_service_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1645,7 +1787,7 @@ func (x *GetViewBasedReportHistoryRequest) String() string {
 func (*GetViewBasedReportHistoryRequest) ProtoMessage() {}
 
 func (x *GetViewBasedReportHistoryRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[14]
+	mi := &file_api_v2_report_service_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1658,7 +1800,7 @@ func (x *GetViewBasedReportHistoryRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetViewBasedReportHistoryRequest.ProtoReflect.Descriptor instead.
 func (*GetViewBasedReportHistoryRequest) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{14}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *GetViewBasedReportHistoryRequest) GetReportParamQuery() *RawQuery {
@@ -1677,7 +1819,7 @@ type ReportHistoryResponse struct {
 
 func (x *ReportHistoryResponse) Reset() {
 	*x = ReportHistoryResponse{}
-	mi := &file_api_v2_report_service_proto_msgTypes[15]
+	mi := &file_api_v2_report_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1689,7 +1831,7 @@ func (x *ReportHistoryResponse) String() string {
 func (*ReportHistoryResponse) ProtoMessage() {}
 
 func (x *ReportHistoryResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[15]
+	mi := &file_api_v2_report_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1702,7 +1844,7 @@ func (x *ReportHistoryResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportHistoryResponse.ProtoReflect.Descriptor instead.
 func (*ReportHistoryResponse) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{15}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *ReportHistoryResponse) GetReportSnapshots() []*ReportSnapshot {
@@ -1721,7 +1863,7 @@ type ReportStatusResponse struct {
 
 func (x *ReportStatusResponse) Reset() {
 	*x = ReportStatusResponse{}
-	mi := &file_api_v2_report_service_proto_msgTypes[16]
+	mi := &file_api_v2_report_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1733,7 +1875,7 @@ func (x *ReportStatusResponse) String() string {
 func (*ReportStatusResponse) ProtoMessage() {}
 
 func (x *ReportStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[16]
+	mi := &file_api_v2_report_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1746,7 +1888,7 @@ func (x *ReportStatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportStatusResponse.ProtoReflect.Descriptor instead.
 func (*ReportStatusResponse) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{16}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *ReportStatusResponse) GetStatus() *ReportStatus {
@@ -1766,7 +1908,7 @@ type CollectionSnapshot struct {
 
 func (x *CollectionSnapshot) Reset() {
 	*x = CollectionSnapshot{}
-	mi := &file_api_v2_report_service_proto_msgTypes[17]
+	mi := &file_api_v2_report_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1778,7 +1920,7 @@ func (x *CollectionSnapshot) String() string {
 func (*CollectionSnapshot) ProtoMessage() {}
 
 func (x *CollectionSnapshot) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[17]
+	mi := &file_api_v2_report_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1791,7 +1933,7 @@ func (x *CollectionSnapshot) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionSnapshot.ProtoReflect.Descriptor instead.
 func (*CollectionSnapshot) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{17}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *CollectionSnapshot) GetId() string {
@@ -1809,15 +1951,17 @@ func (x *CollectionSnapshot) GetName() string {
 }
 
 type ReportSnapshot struct {
-	state          protoimpl.MessageState `protogen:"open.v1"`
-	ReportConfigId string                 `protobuf:"bytes,1,opt,name=report_config_id,json=reportConfigId,proto3" json:"report_config_id,omitempty"`
-	ReportJobId    string                 `protobuf:"bytes,2,opt,name=report_job_id,json=reportJobId,proto3" json:"report_job_id,omitempty"`
-	Name           string                 `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
-	Description    string                 `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
+	state          protoimpl.MessageState    `protogen:"open.v1"`
+	Type           ReportSnapshot_ReportType `protobuf:"varint,16,opt,name=type,proto3,enum=v2.ReportSnapshot_ReportType" json:"type,omitempty"`
+	ReportConfigId string                    `protobuf:"bytes,1,opt,name=report_config_id,json=reportConfigId,proto3" json:"report_config_id,omitempty"`
+	ReportJobId    string                    `protobuf:"bytes,2,opt,name=report_job_id,json=reportJobId,proto3" json:"report_job_id,omitempty"`
+	Name           string                    `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	Description    string                    `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
 	// Types that are valid to be assigned to Filter:
 	//
 	//	*ReportSnapshot_VulnReportFilters
 	//	*ReportSnapshot_ViewBasedVulnReportFilters
+	//	*ReportSnapshot_NodeVulnReportFilters
 	Filter              isReportSnapshot_Filter  `protobuf_oneof:"filter"`
 	CollectionSnapshot  *CollectionSnapshot      `protobuf:"bytes,6,opt,name=collection_snapshot,json=collectionSnapshot,proto3" json:"collection_snapshot,omitempty"`
 	Schedule            *ReportSchedule          `protobuf:"bytes,7,opt,name=schedule,proto3" json:"schedule,omitempty"`
@@ -1833,7 +1977,7 @@ type ReportSnapshot struct {
 
 func (x *ReportSnapshot) Reset() {
 	*x = ReportSnapshot{}
-	mi := &file_api_v2_report_service_proto_msgTypes[18]
+	mi := &file_api_v2_report_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1845,7 +1989,7 @@ func (x *ReportSnapshot) String() string {
 func (*ReportSnapshot) ProtoMessage() {}
 
 func (x *ReportSnapshot) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[18]
+	mi := &file_api_v2_report_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1858,7 +2002,14 @@ func (x *ReportSnapshot) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportSnapshot.ProtoReflect.Descriptor instead.
 func (*ReportSnapshot) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{18}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *ReportSnapshot) GetType() ReportSnapshot_ReportType {
+	if x != nil {
+		return x.Type
+	}
+	return ReportSnapshot_VULNERABILITY
 }
 
 func (x *ReportSnapshot) GetReportConfigId() string {
@@ -1914,6 +2065,15 @@ func (x *ReportSnapshot) GetViewBasedVulnReportFilters() *ViewBasedVulnerability
 	return nil
 }
 
+func (x *ReportSnapshot) GetNodeVulnReportFilters() *NodeVulnerabilityReportFilters {
+	if x != nil {
+		if x, ok := x.Filter.(*ReportSnapshot_NodeVulnReportFilters); ok {
+			return x.NodeVulnReportFilters
+		}
+	}
+	return nil
+}
+
 func (x *ReportSnapshot) GetCollectionSnapshot() *CollectionSnapshot {
 	if x != nil {
 		return x.CollectionSnapshot
@@ -1982,10 +2142,16 @@ type ReportSnapshot_ViewBasedVulnReportFilters struct {
 	ViewBasedVulnReportFilters *ViewBasedVulnerabilityReportFilters `protobuf:"bytes,12,opt,name=view_based_vuln_report_filters,json=viewBasedVulnReportFilters,proto3,oneof"`
 }
 
+type ReportSnapshot_NodeVulnReportFilters struct {
+	NodeVulnReportFilters *NodeVulnerabilityReportFilters `protobuf:"bytes,15,opt,name=node_vuln_report_filters,json=nodeVulnReportFilters,proto3,oneof"`
+}
+
 func (*ReportSnapshot_VulnReportFilters) isReportSnapshot_Filter() {}
 
 func (*ReportSnapshot_ViewBasedVulnReportFilters) isReportSnapshot_Filter() {}
 
+func (*ReportSnapshot_NodeVulnReportFilters) isReportSnapshot_Filter() {}
+
 type ReportStatus struct {
 	state                    protoimpl.MessageState    `protogen:"open.v1"`
 	RunState                 ReportStatus_RunState     `protobuf:"varint,1,opt,name=run_state,json=runState,proto3,enum=v2.ReportStatus_RunState" json:"run_state,omitempty"`
@@ -1999,7 +2165,7 @@ type ReportStatus struct {
 
 func (x *ReportStatus) Reset() {
 	*x = ReportStatus{}
-	mi := &file_api_v2_report_service_proto_msgTypes[19]
+	mi := &file_api_v2_report_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2011,7 +2177,7 @@ func (x *ReportStatus) String() string {
 func (*ReportStatus) ProtoMessage() {}
 
 func (x *ReportStatus) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[19]
+	mi := &file_api_v2_report_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2024,7 +2190,7 @@ func (x *ReportStatus) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportStatus.ProtoReflect.Descriptor instead.
 func (*ReportStatus) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{19}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *ReportStatus) GetRunState() ReportStatus_RunState {
@@ -2072,7 +2238,7 @@ type RunReportRequest struct {
 
 func (x *RunReportRequest) Reset() {
 	*x = RunReportRequest{}
-	mi := &file_api_v2_report_service_proto_msgTypes[20]
+	mi := &file_api_v2_report_service_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2084,7 +2250,7 @@ func (x *RunReportRequest) String() string {
 func (*RunReportRequest) ProtoMessage() {}
 
 func (x *RunReportRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[20]
+	mi := &file_api_v2_report_service_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2097,7 +2263,7 @@ func (x *RunReportRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RunReportRequest.ProtoReflect.Descriptor instead.
 func (*RunReportRequest) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{20}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *RunReportRequest) GetReportConfigId() string {
@@ -2124,7 +2290,7 @@ type RunReportResponse struct {
 
 func (x *RunReportResponse) Reset() {
 	*x = RunReportResponse{}
-	mi := &file_api_v2_report_service_proto_msgTypes[21]
+	mi := &file_api_v2_report_service_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2136,7 +2302,7 @@ func (x *RunReportResponse) String() string {
 func (*RunReportResponse) ProtoMessage() {}
 
 func (x *RunReportResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[21]
+	mi := &file_api_v2_report_service_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2149,7 +2315,7 @@ func (x *RunReportResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RunReportResponse.ProtoReflect.Descriptor instead.
 func (*RunReportResponse) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{21}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *RunReportResponse) GetReportConfigId() string {
@@ -2175,7 +2341,7 @@ type DeleteReportRequest struct {
 
 func (x *DeleteReportRequest) Reset() {
 	*x = DeleteReportRequest{}
-	mi := &file_api_v2_report_service_proto_msgTypes[22]
+	mi := &file_api_v2_report_service_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2187,7 +2353,7 @@ func (x *DeleteReportRequest) String() string {
 func (*DeleteReportRequest) ProtoMessage() {}
 
 func (x *DeleteReportRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[22]
+	mi := &file_api_v2_report_service_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2200,7 +2366,7 @@ func (x *DeleteReportRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteReportRequest.ProtoReflect.Descriptor instead.
 func (*DeleteReportRequest) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{22}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *DeleteReportRequest) GetId() string {
@@ -2216,6 +2382,7 @@ type ReportRequestViewBased struct {
 	// Types that are valid to be assigned to Filter:
 	//
 	//	*ReportRequestViewBased_ViewBasedVulnReportFilters
+	//	*ReportRequestViewBased_NodeVulnReportFilters
 	Filter        isReportRequestViewBased_Filter `protobuf_oneof:"filter"`
 	AreaOfConcern string                          `protobuf:"bytes,3,opt,name=area_of_concern,json=areaOfConcern,proto3" json:"area_of_concern,omitempty"`
 	unknownFields protoimpl.UnknownFields
@@ -2224,7 +2391,7 @@ type ReportRequestViewBased struct {
 
 func (x *ReportRequestViewBased) Reset() {
 	*x = ReportRequestViewBased{}
-	mi := &file_api_v2_report_service_proto_msgTypes[23]
+	mi := &file_api_v2_report_service_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2236,7 +2403,7 @@ func (x *ReportRequestViewBased) String() string {
 func (*ReportRequestViewBased) ProtoMessage() {}
 
 func (x *ReportRequestViewBased) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[23]
+	mi := &file_api_v2_report_service_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2249,7 +2416,7 @@ func (x *ReportRequestViewBased) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportRequestViewBased.ProtoReflect.Descriptor instead.
 func (*ReportRequestViewBased) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{23}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *ReportRequestViewBased) GetType() ReportRequestViewBased_ReportType {
@@ -2275,6 +2442,15 @@ func (x *ReportRequestViewBased) GetViewBasedVulnReportFilters() *ViewBasedVulne
 	return nil
 }
 
+func (x *ReportRequestViewBased) GetNodeVulnReportFilters() *NodeVulnerabilityReportFilters {
+	if x != nil {
+		if x, ok := x.Filter.(*ReportRequestViewBased_NodeVulnReportFilters); ok {
+			return x.NodeVulnReportFilters
+		}
+	}
+	return nil
+}
+
 func (x *ReportRequestViewBased) GetAreaOfConcern() string {
 	if x != nil {
 		return x.AreaOfConcern
@@ -2290,8 +2466,14 @@ type ReportRequestViewBased_ViewBasedVulnReportFilters struct {
 	ViewBasedVulnReportFilters *ViewBasedVulnerabilityReportFilters `protobuf:"bytes,2,opt,name=view_based_vuln_report_filters,json=viewBasedVulnReportFilters,proto3,oneof"`
 }
 
+type ReportRequestViewBased_NodeVulnReportFilters struct {
+	NodeVulnReportFilters *NodeVulnerabilityReportFilters `protobuf:"bytes,4,opt,name=node_vuln_report_filters,json=nodeVulnReportFilters,proto3,oneof"`
+}
+
 func (*ReportRequestViewBased_ViewBasedVulnReportFilters) isReportRequestViewBased_Filter() {}
 
+func (*ReportRequestViewBased_NodeVulnReportFilters) isReportRequestViewBased_Filter() {}
+
 type RunReportResponseViewBased struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	ReportID      string                 `protobuf:"bytes,1,opt,name=reportID,proto3" json:"reportID,omitempty"`
@@ -2302,7 +2484,7 @@ type RunReportResponseViewBased struct {
 
 func (x *RunReportResponseViewBased) Reset() {
 	*x = RunReportResponseViewBased{}
-	mi := &file_api_v2_report_service_proto_msgTypes[24]
+	mi := &file_api_v2_report_service_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2314,7 +2496,7 @@ func (x *RunReportResponseViewBased) String() string {
 func (*RunReportResponseViewBased) ProtoMessage() {}
 
 func (x *RunReportResponseViewBased) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[24]
+	mi := &file_api_v2_report_service_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2327,7 +2509,7 @@ func (x *RunReportResponseViewBased) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RunReportResponseViewBased.ProtoReflect.Descriptor instead.
 func (*RunReportResponseViewBased) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{24}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *RunReportResponseViewBased) GetReportID() string {
@@ -2354,7 +2536,7 @@ type ReportSchedule_DaysOfWeek struct {
 
 func (x *ReportSchedule_DaysOfWeek) Reset() {
 	*x = ReportSchedule_DaysOfWeek{}
-	mi := &file_api_v2_report_service_proto_msgTypes[25]
+	mi := &file_api_v2_report_service_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2366,7 +2548,7 @@ func (x *ReportSchedule_DaysOfWeek) String() string {
 func (*ReportSchedule_DaysOfWeek) ProtoMessage() {}
 
 func (x *ReportSchedule_DaysOfWeek) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[25]
+	mi := &file_api_v2_report_service_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2379,7 +2561,7 @@ func (x *ReportSchedule_DaysOfWeek) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportSchedule_DaysOfWeek.ProtoReflect.Descriptor instead.
 func (*ReportSchedule_DaysOfWeek) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{3, 0}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{4, 0}
 }
 
 func (x *ReportSchedule_DaysOfWeek) GetDays() []int32 {
@@ -2399,7 +2581,7 @@ type ReportSchedule_DaysOfMonth struct {
 
 func (x *ReportSchedule_DaysOfMonth) Reset() {
 	*x = ReportSchedule_DaysOfMonth{}
-	mi := &file_api_v2_report_service_proto_msgTypes[26]
+	mi := &file_api_v2_report_service_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2411,7 +2593,7 @@ func (x *ReportSchedule_DaysOfMonth) String() string {
 func (*ReportSchedule_DaysOfMonth) ProtoMessage() {}
 
 func (x *ReportSchedule_DaysOfMonth) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_report_service_proto_msgTypes[26]
+	mi := &file_api_v2_report_service_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2424,7 +2606,7 @@ func (x *ReportSchedule_DaysOfMonth) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportSchedule_DaysOfMonth.ProtoReflect.Descriptor instead.
 func (*ReportSchedule_DaysOfMonth) Descriptor() ([]byte, []int) {
-	return file_api_v2_report_service_proto_rawDescGZIP(), []int{3, 1}
+	return file_api_v2_report_service_proto_rawDescGZIP(), []int{4, 1}
 }
 
 func (x *ReportSchedule_DaysOfMonth) GetDays() []int32 {
@@ -2438,19 +2620,21 @@ var File_api_v2_report_service_proto protoreflect.FileDescriptor
 
 const file_api_v2_report_service_proto_rawDesc = "" +
 	"\n" +
-	"\x1bapi/v2/report_service.proto\x12\x02v2\x1a\x13api/v2/common.proto\x1a\x19api/v2/search_query.proto\x1a\x11api/v2/user.proto\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xb3\x03\n" +
+	"\x1bapi/v2/report_service.proto\x12\x02v2\x1a\x13api/v2/common.proto\x1a\x19api/v2/search_query.proto\x1a\x11api/v2/user.proto\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xaa\x04\n" +
 	"\x13ReportConfiguration\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12 \n" +
 	"\vdescription\x18\x03 \x01(\tR\vdescription\x126\n" +
 	"\x04type\x18\x04 \x01(\x0e2\".v2.ReportConfiguration.ReportTypeR\x04type\x12P\n" +
-	"\x13vuln_report_filters\x18\x05 \x01(\v2\x1e.v2.VulnerabilityReportFiltersH\x00R\x11vulnReportFilters\x12.\n" +
+	"\x13vuln_report_filters\x18\x05 \x01(\v2\x1e.v2.VulnerabilityReportFiltersH\x00R\x11vulnReportFilters\x12]\n" +
+	"\x18node_vuln_report_filters\x18\t \x01(\v2\".v2.NodeVulnerabilityReportFiltersH\x00R\x15nodeVulnReportFilters\x12.\n" +
 	"\bschedule\x18\x06 \x01(\v2\x12.v2.ReportScheduleR\bschedule\x128\n" +
 	"\x0eresource_scope\x18\a \x01(\v2\x11.v2.ResourceScopeR\rresourceScope\x127\n" +
-	"\tnotifiers\x18\b \x03(\v2\x19.v2.NotifierConfigurationR\tnotifiers\"\x1f\n" +
+	"\tnotifiers\x18\b \x03(\v2\x19.v2.NotifierConfigurationR\tnotifiers\"7\n" +
 	"\n" +
 	"ReportType\x12\x11\n" +
-	"\rVULNERABILITY\x10\x00B\b\n" +
+	"\rVULNERABILITY\x10\x00\x12\x16\n" +
+	"\x12NODE_VULNERABILITY\x10\x01B\b\n" +
 	"\x06filter\"\xa2\a\n" +
 	"\x1aVulnerabilityReportFilters\x12I\n" +
 	"\n" +
@@ -2483,6 +2667,11 @@ const file_api_v2_report_service_proto_rawDesc = "" +
 	"\bDEPLOYED\x10\x00\x12\v\n" +
 	"\aWATCHED\x10\x01B\f\n" +
 	"\n" +
+	"cves_since\"a\n" +
+	"\x1eNodeVulnerabilityReportFilters\x12\x1b\n" +
+	"\ball_vuln\x18\x01 \x01(\bH\x00R\aallVuln\x12\x14\n" +
+	"\x05query\x18\x02 \x01(\tR\x05queryB\f\n" +
+	"\n" +
 	"cves_since\";\n" +
 	"#ViewBasedVulnerabilityReportFilters\x12\x14\n" +
 	"\x05query\x18\x05 \x01(\tR\x05query\"\x9b\x03\n" +
@@ -2549,14 +2738,16 @@ const file_api_v2_report_service_proto_rawDesc = "" +
 	"\x06status\x18\x01 \x01(\v2\x10.v2.ReportStatusR\x06status\"8\n" +
 	"\x12CollectionSnapshot\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
-	"\x04name\x18\x02 \x01(\tR\x04name\"\x80\x06\n" +
-	"\x0eReportSnapshot\x12(\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name\"\xcb\a\n" +
+	"\x0eReportSnapshot\x121\n" +
+	"\x04type\x18\x10 \x01(\x0e2\x1d.v2.ReportSnapshot.ReportTypeR\x04type\x12(\n" +
 	"\x10report_config_id\x18\x01 \x01(\tR\x0ereportConfigId\x12\"\n" +
 	"\rreport_job_id\x18\x02 \x01(\tR\vreportJobId\x12\x12\n" +
 	"\x04name\x18\x03 \x01(\tR\x04name\x12 \n" +
 	"\vdescription\x18\x04 \x01(\tR\vdescription\x12P\n" +
 	"\x13vuln_report_filters\x18\x05 \x01(\v2\x1e.v2.VulnerabilityReportFiltersH\x00R\x11vulnReportFilters\x12m\n" +
-	"\x1eview_based_vuln_report_filters\x18\f \x01(\v2'.v2.ViewBasedVulnerabilityReportFiltersH\x00R\x1aviewBasedVulnReportFilters\x12G\n" +
+	"\x1eview_based_vuln_report_filters\x18\f \x01(\v2'.v2.ViewBasedVulnerabilityReportFiltersH\x00R\x1aviewBasedVulnReportFilters\x12]\n" +
+	"\x18node_vuln_report_filters\x18\x0f \x01(\v2\".v2.NodeVulnerabilityReportFiltersH\x00R\x15nodeVulnReportFilters\x12G\n" +
 	"\x13collection_snapshot\x18\x06 \x01(\v2\x16.v2.CollectionSnapshotR\x12collectionSnapshot\x12.\n" +
 	"\bschedule\x18\a \x01(\v2\x12.v2.ReportScheduleR\bschedule\x125\n" +
 	"\rreport_status\x18\b \x01(\v2\x10.v2.ReportStatusR\freportStatus\x127\n" +
@@ -2565,7 +2756,11 @@ const file_api_v2_report_service_proto_rawDesc = "" +
 	" \x01(\v2\f.v2.SlimUserR\x04user\x122\n" +
 	"\x15is_download_available\x18\v \x01(\bR\x13isDownloadAvailable\x12&\n" +
 	"\x0farea_of_concern\x18\r \x01(\tR\rareaOfConcern\x128\n" +
-	"\x0eresource_scope\x18\x0e \x01(\v2\x11.v2.ResourceScopeR\rresourceScopeB\b\n" +
+	"\x0eresource_scope\x18\x0e \x01(\v2\x11.v2.ResourceScopeR\rresourceScope\"7\n" +
+	"\n" +
+	"ReportType\x12\x11\n" +
+	"\rVULNERABILITY\x10\x00\x12\x16\n" +
+	"\x12NODE_VULNERABILITY\x10\x01B\b\n" +
 	"\x06filter\"\xc8\x03\n" +
 	"\fReportStatus\x126\n" +
 	"\trun_state\x18\x01 \x01(\x0e2\x19.v2.ReportStatus.RunStateR\brunState\x12=\n" +
@@ -2589,14 +2784,16 @@ const file_api_v2_report_service_proto_rawDesc = "" +
 	"\x10report_config_id\x18\x01 \x01(\tR\x0ereportConfigId\x12\x1b\n" +
 	"\treport_id\x18\x02 \x01(\tR\breportId\"%\n" +
 	"\x13DeleteReportRequest\x12\x0e\n" +
-	"\x02id\x18\x01 \x01(\tR\x02id\"\x95\x02\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\"\x8c\x03\n" +
 	"\x16ReportRequestViewBased\x129\n" +
 	"\x04type\x18\x01 \x01(\x0e2%.v2.ReportRequestViewBased.ReportTypeR\x04type\x12m\n" +
-	"\x1eview_based_vuln_report_filters\x18\x02 \x01(\v2'.v2.ViewBasedVulnerabilityReportFiltersH\x00R\x1aviewBasedVulnReportFilters\x12&\n" +
-	"\x0farea_of_concern\x18\x03 \x01(\tR\rareaOfConcern\"\x1f\n" +
+	"\x1eview_based_vuln_report_filters\x18\x02 \x01(\v2'.v2.ViewBasedVulnerabilityReportFiltersH\x00R\x1aviewBasedVulnReportFilters\x12]\n" +
+	"\x18node_vuln_report_filters\x18\x04 \x01(\v2\".v2.NodeVulnerabilityReportFiltersH\x00R\x15nodeVulnReportFilters\x12&\n" +
+	"\x0farea_of_concern\x18\x03 \x01(\tR\rareaOfConcern\"7\n" +
 	"\n" +
 	"ReportType\x12\x11\n" +
-	"\rVULNERABILITY\x10\x00B\b\n" +
+	"\rVULNERABILITY\x10\x00\x12\x16\n" +
+	"\x12NODE_VULNERABILITY\x10\x01B\b\n" +
 	"\x06filter\"Z\n" +
 	"\x1aRunReportResponseViewBased\x12\x1a\n" +
 	"\breportID\x18\x01 \x01(\tR\breportID\x12 \n" +
@@ -2650,8 +2847,8 @@ func file_api_v2_report_service_proto_rawDescGZIP() []byte {
 	return file_api_v2_report_service_proto_rawDescData
 }
 
-var file_api_v2_report_service_proto_enumTypes = make([]protoimpl.EnumInfo, 12)
-var file_api_v2_report_service_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
+var file_api_v2_report_service_proto_enumTypes = make([]protoimpl.EnumInfo, 13)
+var file_api_v2_report_service_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
 var file_api_v2_report_service_proto_goTypes = []any{
 	(MatchType)(0),                                        // 0: v2.MatchType
 	(ScopeEntity)(0),                                      // 1: v2.ScopeEntity
@@ -2662,118 +2859,124 @@ var file_api_v2_report_service_proto_goTypes = []any{
 	(VulnerabilityReportFilters_VulnerabilitySeverity)(0), // 6: v2.VulnerabilityReportFilters.VulnerabilitySeverity
 	(VulnerabilityReportFilters_ImageType)(0),             // 7: v2.VulnerabilityReportFilters.ImageType
 	(ReportSchedule_IntervalType)(0),                      // 8: v2.ReportSchedule.IntervalType
-	(ReportStatus_RunState)(0),                            // 9: v2.ReportStatus.RunState
-	(ReportStatus_ReportMethod)(0),                        // 10: v2.ReportStatus.ReportMethod
-	(ReportRequestViewBased_ReportType)(0),                // 11: v2.ReportRequestViewBased.ReportType
-	(*ReportConfiguration)(nil),                           // 12: v2.ReportConfiguration
-	(*VulnerabilityReportFilters)(nil),                    // 13: v2.VulnerabilityReportFilters
-	(*ViewBasedVulnerabilityReportFilters)(nil),           // 14: v2.ViewBasedVulnerabilityReportFilters
-	(*ReportSchedule)(nil),                                // 15: v2.ReportSchedule
-	(*ResourceScope)(nil),                                 // 16: v2.ResourceScope
-	(*CollectionReference)(nil),                           // 17: v2.CollectionReference
-	(*EntityScope)(nil),                                   // 18: v2.EntityScope
-	(*RuleValue)(nil),                                     // 19: v2.RuleValue
-	(*EntityScopeRule)(nil),                               // 20: v2.EntityScopeRule
-	(*NotifierConfiguration)(nil),                         // 21: v2.NotifierConfiguration
-	(*EmailNotifierConfiguration)(nil),                    // 22: v2.EmailNotifierConfiguration
-	(*ListReportConfigurationsResponse)(nil),              // 23: v2.ListReportConfigurationsResponse
-	(*CountReportConfigurationsResponse)(nil),             // 24: v2.CountReportConfigurationsResponse
-	(*GetReportHistoryRequest)(nil),                       // 25: v2.GetReportHistoryRequest
-	(*GetViewBasedReportHistoryRequest)(nil),              // 26: v2.GetViewBasedReportHistoryRequest
-	(*ReportHistoryResponse)(nil),                         // 27: v2.ReportHistoryResponse
-	(*ReportStatusResponse)(nil),                          // 28: v2.ReportStatusResponse
-	(*CollectionSnapshot)(nil),                            // 29: v2.CollectionSnapshot
-	(*ReportSnapshot)(nil),                                // 30: v2.ReportSnapshot
-	(*ReportStatus)(nil),                                  // 31: v2.ReportStatus
-	(*RunReportRequest)(nil),                              // 32: v2.RunReportRequest
-	(*RunReportResponse)(nil),                             // 33: v2.RunReportResponse
-	(*DeleteReportRequest)(nil),                           // 34: v2.DeleteReportRequest
-	(*ReportRequestViewBased)(nil),                        // 35: v2.ReportRequestViewBased
-	(*RunReportResponseViewBased)(nil),                    // 36: v2.RunReportResponseViewBased
-	(*ReportSchedule_DaysOfWeek)(nil),                     // 37: v2.ReportSchedule.DaysOfWeek
-	(*ReportSchedule_DaysOfMonth)(nil),                    // 38: v2.ReportSchedule.DaysOfMonth
-	(*timestamppb.Timestamp)(nil),                         // 39: google.protobuf.Timestamp
-	(*RawQuery)(nil),                                      // 40: v2.RawQuery
-	(*SlimUser)(nil),                                      // 41: v2.SlimUser
-	(*ResourceByID)(nil),                                  // 42: v2.ResourceByID
-	(*Empty)(nil),                                         // 43: v2.Empty
+	(ReportSnapshot_ReportType)(0),                        // 9: v2.ReportSnapshot.ReportType
+	(ReportStatus_RunState)(0),                            // 10: v2.ReportStatus.RunState
+	(ReportStatus_ReportMethod)(0),                        // 11: v2.ReportStatus.ReportMethod
+	(ReportRequestViewBased_ReportType)(0),                // 12: v2.ReportRequestViewBased.ReportType
+	(*ReportConfiguration)(nil),                           // 13: v2.ReportConfiguration
+	(*VulnerabilityReportFilters)(nil),                    // 14: v2.VulnerabilityReportFilters
+	(*NodeVulnerabilityReportFilters)(nil),                // 15: v2.NodeVulnerabilityReportFilters
+	(*ViewBasedVulnerabilityReportFilters)(nil),           // 16: v2.ViewBasedVulnerabilityReportFilters
+	(*ReportSchedule)(nil),                                // 17: v2.ReportSchedule
+	(*ResourceScope)(nil),                                 // 18: v2.ResourceScope
+	(*CollectionReference)(nil),                           // 19: v2.CollectionReference
+	(*EntityScope)(nil),                                   // 20: v2.EntityScope
+	(*RuleValue)(nil),                                     // 21: v2.RuleValue
+	(*EntityScopeRule)(nil),                               // 22: v2.EntityScopeRule
+	(*NotifierConfiguration)(nil),                         // 23: v2.NotifierConfiguration
+	(*EmailNotifierConfiguration)(nil),                    // 24: v2.EmailNotifierConfiguration
+	(*ListReportConfigurationsResponse)(nil),              // 25: v2.ListReportConfigurationsResponse
+	(*CountReportConfigurationsResponse)(nil),             // 26: v2.CountReportConfigurationsResponse
+	(*GetReportHistoryRequest)(nil),                       // 27: v2.GetReportHistoryRequest
+	(*GetViewBasedReportHistoryRequest)(nil),              // 28: v2.GetViewBasedReportHistoryRequest
+	(*ReportHistoryResponse)(nil),                         // 29: v2.ReportHistoryResponse
+	(*ReportStatusResponse)(nil),                          // 30: v2.ReportStatusResponse
+	(*CollectionSnapshot)(nil),                            // 31: v2.CollectionSnapshot
+	(*ReportSnapshot)(nil),                                // 32: v2.ReportSnapshot
+	(*ReportStatus)(nil),                                  // 33: v2.ReportStatus
+	(*RunReportRequest)(nil),                              // 34: v2.RunReportRequest
+	(*RunReportResponse)(nil),                             // 35: v2.RunReportResponse
+	(*DeleteReportRequest)(nil),                           // 36: v2.DeleteReportRequest
+	(*ReportRequestViewBased)(nil),                        // 37: v2.ReportRequestViewBased
+	(*RunReportResponseViewBased)(nil),                    // 38: v2.RunReportResponseViewBased
+	(*ReportSchedule_DaysOfWeek)(nil),                     // 39: v2.ReportSchedule.DaysOfWeek
+	(*ReportSchedule_DaysOfMonth)(nil),                    // 40: v2.ReportSchedule.DaysOfMonth
+	(*timestamppb.Timestamp)(nil),                         // 41: google.protobuf.Timestamp
+	(*RawQuery)(nil),                                      // 42: v2.RawQuery
+	(*SlimUser)(nil),                                      // 43: v2.SlimUser
+	(*ResourceByID)(nil),                                  // 44: v2.ResourceByID
+	(*Empty)(nil),                                         // 45: v2.Empty
 }
 var file_api_v2_report_service_proto_depIdxs = []int32{
 	4,  // 0: v2.ReportConfiguration.type:type_name -> v2.ReportConfiguration.ReportType
-	13, // 1: v2.ReportConfiguration.vuln_report_filters:type_name -> v2.VulnerabilityReportFilters
-	15, // 2: v2.ReportConfiguration.schedule:type_name -> v2.ReportSchedule
-	16, // 3: v2.ReportConfiguration.resource_scope:type_name -> v2.ResourceScope
-	21, // 4: v2.ReportConfiguration.notifiers:type_name -> v2.NotifierConfiguration
-	5,  // 5: v2.VulnerabilityReportFilters.fixability:type_name -> v2.VulnerabilityReportFilters.Fixability
-	6,  // 6: v2.VulnerabilityReportFilters.severities:type_name -> v2.VulnerabilityReportFilters.VulnerabilitySeverity
-	7,  // 7: v2.VulnerabilityReportFilters.image_types:type_name -> v2.VulnerabilityReportFilters.ImageType
-	39, // 8: v2.VulnerabilityReportFilters.since_start_date:type_name -> google.protobuf.Timestamp
-	8,  // 9: v2.ReportSchedule.interval_type:type_name -> v2.ReportSchedule.IntervalType
-	37, // 10: v2.ReportSchedule.days_of_week:type_name -> v2.ReportSchedule.DaysOfWeek
-	38, // 11: v2.ReportSchedule.days_of_month:type_name -> v2.ReportSchedule.DaysOfMonth
-	17, // 12: v2.ResourceScope.collection_scope:type_name -> v2.CollectionReference
-	18, // 13: v2.ResourceScope.entity_scope:type_name -> v2.EntityScope
-	20, // 14: v2.EntityScope.rules:type_name -> v2.EntityScopeRule
-	0,  // 15: v2.RuleValue.match_type:type_name -> v2.MatchType
-	1,  // 16: v2.EntityScopeRule.entity:type_name -> v2.ScopeEntity
-	2,  // 17: v2.EntityScopeRule.field:type_name -> v2.ScopeField
-	19, // 18: v2.EntityScopeRule.values:type_name -> v2.RuleValue
-	22, // 19: v2.NotifierConfiguration.email_config:type_name -> v2.EmailNotifierConfiguration
-	12, // 20: v2.ListReportConfigurationsResponse.report_configs:type_name -> v2.ReportConfiguration
-	40, // 21: v2.GetReportHistoryRequest.report_param_query:type_name -> v2.RawQuery
-	40, // 22: v2.GetViewBasedReportHistoryRequest.report_param_query:type_name -> v2.RawQuery
-	30, // 23: v2.ReportHistoryResponse.report_snapshots:type_name -> v2.ReportSnapshot
-	31, // 24: v2.ReportStatusResponse.status:type_name -> v2.ReportStatus
-	13, // 25: v2.ReportSnapshot.vuln_report_filters:type_name -> v2.VulnerabilityReportFilters
-	14, // 26: v2.ReportSnapshot.view_based_vuln_report_filters:type_name -> v2.ViewBasedVulnerabilityReportFilters
-	29, // 27: v2.ReportSnapshot.collection_snapshot:type_name -> v2.CollectionSnapshot
-	15, // 28: v2.ReportSnapshot.schedule:type_name -> v2.ReportSchedule
-	31, // 29: v2.ReportSnapshot.report_status:type_name -> v2.ReportStatus
-	21, // 30: v2.ReportSnapshot.notifiers:type_name -> v2.NotifierConfiguration
-	41, // 31: v2.ReportSnapshot.user:type_name -> v2.SlimUser
-	16, // 32: v2.ReportSnapshot.resource_scope:type_name -> v2.ResourceScope
-	9,  // 33: v2.ReportStatus.run_state:type_name -> v2.ReportStatus.RunState
-	39, // 34: v2.ReportStatus.completed_at:type_name -> google.protobuf.Timestamp
-	10, // 35: v2.ReportStatus.report_request_type:type_name -> v2.ReportStatus.ReportMethod
-	3,  // 36: v2.ReportStatus.report_notification_method:type_name -> v2.NotificationMethod
-	3,  // 37: v2.RunReportRequest.report_notification_method:type_name -> v2.NotificationMethod
-	11, // 38: v2.ReportRequestViewBased.type:type_name -> v2.ReportRequestViewBased.ReportType
-	14, // 39: v2.ReportRequestViewBased.view_based_vuln_report_filters:type_name -> v2.ViewBasedVulnerabilityReportFilters
-	12, // 40: v2.ReportService.PostReportConfiguration:input_type -> v2.ReportConfiguration
-	12, // 41: v2.ReportService.UpdateReportConfiguration:input_type -> v2.ReportConfiguration
-	40, // 42: v2.ReportService.ListReportConfigurations:input_type -> v2.RawQuery
-	40, // 43: v2.ReportService.CountReportConfigurations:input_type -> v2.RawQuery
-	42, // 44: v2.ReportService.GetReportConfiguration:input_type -> v2.ResourceByID
-	42, // 45: v2.ReportService.DeleteReportConfiguration:input_type -> v2.ResourceByID
-	42, // 46: v2.ReportService.GetReportStatus:input_type -> v2.ResourceByID
-	25, // 47: v2.ReportService.GetReportHistory:input_type -> v2.GetReportHistoryRequest
-	25, // 48: v2.ReportService.GetMyReportHistory:input_type -> v2.GetReportHistoryRequest
-	32, // 49: v2.ReportService.RunReport:input_type -> v2.RunReportRequest
-	42, // 50: v2.ReportService.CancelReport:input_type -> v2.ResourceByID
-	34, // 51: v2.ReportService.DeleteReport:input_type -> v2.DeleteReportRequest
-	35, // 52: v2.ReportService.PostViewBasedReport:input_type -> v2.ReportRequestViewBased
-	26, // 53: v2.ReportService.GetViewBasedMyReportHistory:input_type -> v2.GetViewBasedReportHistoryRequest
-	26, // 54: v2.ReportService.GetViewBasedReportHistory:input_type -> v2.GetViewBasedReportHistoryRequest
-	12, // 55: v2.ReportService.PostReportConfiguration:output_type -> v2.ReportConfiguration
-	43, // 56: v2.ReportService.UpdateReportConfiguration:output_type -> v2.Empty
-	23, // 57: v2.ReportService.ListReportConfigurations:output_type -> v2.ListReportConfigurationsResponse
-	24, // 58: v2.ReportService.CountReportConfigurations:output_type -> v2.CountReportConfigurationsResponse
-	12, // 59: v2.ReportService.GetReportConfiguration:output_type -> v2.ReportConfiguration
-	43, // 60: v2.ReportService.DeleteReportConfiguration:output_type -> v2.Empty
-	28, // 61: v2.ReportService.GetReportStatus:output_type -> v2.ReportStatusResponse
-	27, // 62: v2.ReportService.GetReportHistory:output_type -> v2.ReportHistoryResponse
-	27, // 63: v2.ReportService.GetMyReportHistory:output_type -> v2.ReportHistoryResponse
-	33, // 64: v2.ReportService.RunReport:output_type -> v2.RunReportResponse
-	43, // 65: v2.ReportService.CancelReport:output_type -> v2.Empty
-	43, // 66: v2.ReportService.DeleteReport:output_type -> v2.Empty
-	36, // 67: v2.ReportService.PostViewBasedReport:output_type -> v2.RunReportResponseViewBased
-	27, // 68: v2.ReportService.GetViewBasedMyReportHistory:output_type -> v2.ReportHistoryResponse
-	27, // 69: v2.ReportService.GetViewBasedReportHistory:output_type -> v2.ReportHistoryResponse
-	55, // [55:70] is the sub-list for method output_type
-	40, // [40:55] is the sub-list for method input_type
-	40, // [40:40] is the sub-list for extension type_name
-	40, // [40:40] is the sub-list for extension extendee
-	0,  // [0:40] is the sub-list for field type_name
+	14, // 1: v2.ReportConfiguration.vuln_report_filters:type_name -> v2.VulnerabilityReportFilters
+	15, // 2: v2.ReportConfiguration.node_vuln_report_filters:type_name -> v2.NodeVulnerabilityReportFilters
+	17, // 3: v2.ReportConfiguration.schedule:type_name -> v2.ReportSchedule
+	18, // 4: v2.ReportConfiguration.resource_scope:type_name -> v2.ResourceScope
+	23, // 5: v2.ReportConfiguration.notifiers:type_name -> v2.NotifierConfiguration
+	5,  // 6: v2.VulnerabilityReportFilters.fixability:type_name -> v2.VulnerabilityReportFilters.Fixability
+	6,  // 7: v2.VulnerabilityReportFilters.severities:type_name -> v2.VulnerabilityReportFilters.VulnerabilitySeverity
+	7,  // 8: v2.VulnerabilityReportFilters.image_types:type_name -> v2.VulnerabilityReportFilters.ImageType
+	41, // 9: v2.VulnerabilityReportFilters.since_start_date:type_name -> google.protobuf.Timestamp
+	8,  // 10: v2.ReportSchedule.interval_type:type_name -> v2.ReportSchedule.IntervalType
+	39, // 11: v2.ReportSchedule.days_of_week:type_name -> v2.ReportSchedule.DaysOfWeek
+	40, // 12: v2.ReportSchedule.days_of_month:type_name -> v2.ReportSchedule.DaysOfMonth
+	19, // 13: v2.ResourceScope.collection_scope:type_name -> v2.CollectionReference
+	20, // 14: v2.ResourceScope.entity_scope:type_name -> v2.EntityScope
+	22, // 15: v2.EntityScope.rules:type_name -> v2.EntityScopeRule
+	0,  // 16: v2.RuleValue.match_type:type_name -> v2.MatchType
+	1,  // 17: v2.EntityScopeRule.entity:type_name -> v2.ScopeEntity
+	2,  // 18: v2.EntityScopeRule.field:type_name -> v2.ScopeField
+	21, // 19: v2.EntityScopeRule.values:type_name -> v2.RuleValue
+	24, // 20: v2.NotifierConfiguration.email_config:type_name -> v2.EmailNotifierConfiguration
+	13, // 21: v2.ListReportConfigurationsResponse.report_configs:type_name -> v2.ReportConfiguration
+	42, // 22: v2.GetReportHistoryRequest.report_param_query:type_name -> v2.RawQuery
+	42, // 23: v2.GetViewBasedReportHistoryRequest.report_param_query:type_name -> v2.RawQuery
+	32, // 24: v2.ReportHistoryResponse.report_snapshots:type_name -> v2.ReportSnapshot
+	33, // 25: v2.ReportStatusResponse.status:type_name -> v2.ReportStatus
+	9,  // 26: v2.ReportSnapshot.type:type_name -> v2.ReportSnapshot.ReportType
+	14, // 27: v2.ReportSnapshot.vuln_report_filters:type_name -> v2.VulnerabilityReportFilters
+	16, // 28: v2.ReportSnapshot.view_based_vuln_report_filters:type_name -> v2.ViewBasedVulnerabilityReportFilters
+	15, // 29: v2.ReportSnapshot.node_vuln_report_filters:type_name -> v2.NodeVulnerabilityReportFilters
+	31, // 30: v2.ReportSnapshot.collection_snapshot:type_name -> v2.CollectionSnapshot
+	17, // 31: v2.ReportSnapshot.schedule:type_name -> v2.ReportSchedule
+	33, // 32: v2.ReportSnapshot.report_status:type_name -> v2.ReportStatus
+	23, // 33: v2.ReportSnapshot.notifiers:type_name -> v2.NotifierConfiguration
+	43, // 34: v2.ReportSnapshot.user:type_name -> v2.SlimUser
+	18, // 35: v2.ReportSnapshot.resource_scope:type_name -> v2.ResourceScope
+	10, // 36: v2.ReportStatus.run_state:type_name -> v2.ReportStatus.RunState
+	41, // 37: v2.ReportStatus.completed_at:type_name -> google.protobuf.Timestamp
+	11, // 38: v2.ReportStatus.report_request_type:type_name -> v2.ReportStatus.ReportMethod
+	3,  // 39: v2.ReportStatus.report_notification_method:type_name -> v2.NotificationMethod
+	3,  // 40: v2.RunReportRequest.report_notification_method:type_name -> v2.NotificationMethod
+	12, // 41: v2.ReportRequestViewBased.type:type_name -> v2.ReportRequestViewBased.ReportType
+	16, // 42: v2.ReportRequestViewBased.view_based_vuln_report_filters:type_name -> v2.ViewBasedVulnerabilityReportFilters
+	15, // 43: v2.ReportRequestViewBased.node_vuln_report_filters:type_name -> v2.NodeVulnerabilityReportFilters
+	13, // 44: v2.ReportService.PostReportConfiguration:input_type -> v2.ReportConfiguration
+	13, // 45: v2.ReportService.UpdateReportConfiguration:input_type -> v2.ReportConfiguration
+	42, // 46: v2.ReportService.ListReportConfigurations:input_type -> v2.RawQuery
+	42, // 47: v2.ReportService.CountReportConfigurations:input_type -> v2.RawQuery
+	44, // 48: v2.ReportService.GetReportConfiguration:input_type -> v2.ResourceByID
+	44, // 49: v2.ReportService.DeleteReportConfiguration:input_type -> v2.ResourceByID
+	44, // 50: v2.ReportService.GetReportStatus:input_type -> v2.ResourceByID
+	27, // 51: v2.ReportService.GetReportHistory:input_type -> v2.GetReportHistoryRequest
+	27, // 52: v2.ReportService.GetMyReportHistory:input_type -> v2.GetReportHistoryRequest
+	34, // 53: v2.ReportService.RunReport:input_type -> v2.RunReportRequest
+	44, // 54: v2.ReportService.CancelReport:input_type -> v2.ResourceByID
+	36, // 55: v2.ReportService.DeleteReport:input_type -> v2.DeleteReportRequest
+	37, // 56: v2.ReportService.PostViewBasedReport:input_type -> v2.ReportRequestViewBased
+	28, // 57: v2.ReportService.GetViewBasedMyReportHistory:input_type -> v2.GetViewBasedReportHistoryRequest
+	28, // 58: v2.ReportService.GetViewBasedReportHistory:input_type -> v2.GetViewBasedReportHistoryRequest
+	13, // 59: v2.ReportService.PostReportConfiguration:output_type -> v2.ReportConfiguration
+	45, // 60: v2.ReportService.UpdateReportConfiguration:output_type -> v2.Empty
+	25, // 61: v2.ReportService.ListReportConfigurations:output_type -> v2.ListReportConfigurationsResponse
+	26, // 62: v2.ReportService.CountReportConfigurations:output_type -> v2.CountReportConfigurationsResponse
+	13, // 63: v2.ReportService.GetReportConfiguration:output_type -> v2.ReportConfiguration
+	45, // 64: v2.ReportService.DeleteReportConfiguration:output_type -> v2.Empty
+	30, // 65: v2.ReportService.GetReportStatus:output_type -> v2.ReportStatusResponse
+	29, // 66: v2.ReportService.GetReportHistory:output_type -> v2.ReportHistoryResponse
+	29, // 67: v2.ReportService.GetMyReportHistory:output_type -> v2.ReportHistoryResponse
+	35, // 68: v2.ReportService.RunReport:output_type -> v2.RunReportResponse
+	45, // 69: v2.ReportService.CancelReport:output_type -> v2.Empty
+	45, // 70: v2.ReportService.DeleteReport:output_type -> v2.Empty
+	38, // 71: v2.ReportService.PostViewBasedReport:output_type -> v2.RunReportResponseViewBased
+	29, // 72: v2.ReportService.GetViewBasedMyReportHistory:output_type -> v2.ReportHistoryResponse
+	29, // 73: v2.ReportService.GetViewBasedReportHistory:output_type -> v2.ReportHistoryResponse
+	59, // [59:74] is the sub-list for method output_type
+	44, // [44:59] is the sub-list for method input_type
+	44, // [44:44] is the sub-list for extension type_name
+	44, // [44:44] is the sub-list for extension extendee
+	0,  // [0:44] is the sub-list for field type_name
 }
 
 func init() { file_api_v2_report_service_proto_init() }
@@ -2786,37 +2989,43 @@ func file_api_v2_report_service_proto_init() {
 	file_api_v2_user_proto_init()
 	file_api_v2_report_service_proto_msgTypes[0].OneofWrappers = []any{
 		(*ReportConfiguration_VulnReportFilters)(nil),
+		(*ReportConfiguration_NodeVulnReportFilters)(nil),
 	}
 	file_api_v2_report_service_proto_msgTypes[1].OneofWrappers = []any{
 		(*VulnerabilityReportFilters_AllVuln)(nil),
 		(*VulnerabilityReportFilters_SinceLastSentScheduledReport)(nil),
 		(*VulnerabilityReportFilters_SinceStartDate)(nil),
 	}
-	file_api_v2_report_service_proto_msgTypes[3].OneofWrappers = []any{
+	file_api_v2_report_service_proto_msgTypes[2].OneofWrappers = []any{
+		(*NodeVulnerabilityReportFilters_AllVuln)(nil),
+	}
+	file_api_v2_report_service_proto_msgTypes[4].OneofWrappers = []any{
 		(*ReportSchedule_DaysOfWeek_)(nil),
 		(*ReportSchedule_DaysOfMonth_)(nil),
 	}
-	file_api_v2_report_service_proto_msgTypes[4].OneofWrappers = []any{
+	file_api_v2_report_service_proto_msgTypes[5].OneofWrappers = []any{
 		(*ResourceScope_CollectionScope)(nil),
 		(*ResourceScope_EntityScope)(nil),
 	}
-	file_api_v2_report_service_proto_msgTypes[9].OneofWrappers = []any{
+	file_api_v2_report_service_proto_msgTypes[10].OneofWrappers = []any{
 		(*NotifierConfiguration_EmailConfig)(nil),
 	}
-	file_api_v2_report_service_proto_msgTypes[18].OneofWrappers = []any{
+	file_api_v2_report_service_proto_msgTypes[19].OneofWrappers = []any{
 		(*ReportSnapshot_VulnReportFilters)(nil),
 		(*ReportSnapshot_ViewBasedVulnReportFilters)(nil),
+		(*ReportSnapshot_NodeVulnReportFilters)(nil),
 	}
-	file_api_v2_report_service_proto_msgTypes[23].OneofWrappers = []any{
+	file_api_v2_report_service_proto_msgTypes[24].OneofWrappers = []any{
 		(*ReportRequestViewBased_ViewBasedVulnReportFilters)(nil),
+		(*ReportRequestViewBased_NodeVulnReportFilters)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v2_report_service_proto_rawDesc), len(file_api_v2_report_service_proto_rawDesc)),
-			NumEnums:      12,
-			NumMessages:   27,
+			NumEnums:      13,
+			NumMessages:   28,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/generated/api/v2/report_service.pb.gw.go b/generated/api/v2/report_service.pb.gw.go
index c950a85a074fa..360f14b3d2e54 100644
--- a/generated/api/v2/report_service.pb.gw.go
+++ b/generated/api/v2/report_service.pb.gw.go
@@ -71,9 +71,6 @@ func request_ReportService_UpdateReportConfiguration_0(ctx context.Context, mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -82,6 +79,9 @@ func request_ReportService_UpdateReportConfiguration_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateReportConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -114,15 +114,15 @@ func request_ReportService_ListReportConfigurations_0(ctx context.Context, marsh
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ReportService_ListReportConfigurations_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListReportConfigurations(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -149,15 +149,15 @@ func request_ReportService_CountReportConfigurations_0(ctx context.Context, mars
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ReportService_CountReportConfigurations_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CountReportConfigurations(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -183,9 +183,6 @@ func request_ReportService_GetReportConfiguration_0(ctx context.Context, marshal
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -194,6 +191,9 @@ func request_ReportService_GetReportConfiguration_0(ctx context.Context, marshal
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetReportConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -222,9 +222,6 @@ func request_ReportService_DeleteReportConfiguration_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -233,6 +230,9 @@ func request_ReportService_DeleteReportConfiguration_0(ctx context.Context, mars
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteReportConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -261,9 +261,6 @@ func request_ReportService_GetReportStatus_0(ctx context.Context, marshaler runt
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -272,6 +269,9 @@ func request_ReportService_GetReportStatus_0(ctx context.Context, marshaler runt
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetReportStatus(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -302,9 +302,6 @@ func request_ReportService_GetReportHistory_0(ctx context.Context, marshaler run
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -319,6 +316,9 @@ func request_ReportService_GetReportHistory_0(ctx context.Context, marshaler run
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ReportService_GetReportHistory_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -355,9 +355,6 @@ func request_ReportService_GetMyReportHistory_0(ctx context.Context, marshaler r
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -372,6 +369,9 @@ func request_ReportService_GetMyReportHistory_0(ctx context.Context, marshaler r
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ReportService_GetMyReportHistory_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetMyReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -433,9 +433,6 @@ func request_ReportService_CancelReport_0(ctx context.Context, marshaler runtime
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -444,6 +441,9 @@ func request_ReportService_CancelReport_0(ctx context.Context, marshaler runtime
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CancelReport(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -472,9 +472,6 @@ func request_ReportService_DeleteReport_0(ctx context.Context, marshaler runtime
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -483,6 +480,9 @@ func request_ReportService_DeleteReport_0(ctx context.Context, marshaler runtime
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteReport(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -539,15 +539,15 @@ func request_ReportService_GetViewBasedMyReportHistory_0(ctx context.Context, ma
 		protoReq GetViewBasedReportHistoryRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ReportService_GetViewBasedMyReportHistory_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetViewBasedMyReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -574,15 +574,15 @@ func request_ReportService_GetViewBasedReportHistory_0(ctx context.Context, mars
 		protoReq GetViewBasedReportHistoryRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ReportService_GetViewBasedReportHistory_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetViewBasedReportHistory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/report_service.swagger.json b/generated/api/v2/report_service.swagger.json
index ecff107b9da62..20949012ad90d 100644
--- a/generated/api/v2/report_service.swagger.json
+++ b/generated/api/v2/report_service.swagger.json
@@ -785,6 +785,9 @@
         "vulnReportFilters": {
           "$ref": "#/definitions/v2VulnerabilityReportFilters"
         },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
         "schedule": {
           "$ref": "#/definitions/v2ReportSchedule"
         },
@@ -970,6 +973,17 @@
       ],
       "default": "EXACT"
     },
+    "v2NodeVulnerabilityReportFilters": {
+      "type": "object",
+      "properties": {
+        "allVuln": {
+          "type": "boolean"
+        },
+        "query": {
+          "type": "string"
+        }
+      }
+    },
     "v2NotificationMethod": {
       "type": "string",
       "enum": [
@@ -1043,6 +1057,9 @@
         "vulnReportFilters": {
           "$ref": "#/definitions/v2VulnerabilityReportFilters"
         },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
         "schedule": {
           "$ref": "#/definitions/v2ReportSchedule"
         },
@@ -1061,9 +1078,11 @@
     "v2ReportConfigurationReportType": {
       "type": "string",
       "enum": [
-        "VULNERABILITY"
+        "VULNERABILITY",
+        "NODE_VULNERABILITY"
       ],
-      "default": "VULNERABILITY"
+      "default": "VULNERABILITY",
+      "description": "- VULNERABILITY: for historical reasons, this short form was used to mean \"Image Vulnerability\""
     },
     "v2ReportHistoryResponse": {
       "type": "object",
@@ -1086,6 +1105,9 @@
         "viewBasedVulnReportFilters": {
           "$ref": "#/definitions/v2ViewBasedVulnerabilityReportFilters"
         },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
         "areaOfConcern": {
           "type": "string"
         }
@@ -1094,9 +1116,11 @@
     "v2ReportRequestViewBasedReportType": {
       "type": "string",
       "enum": [
-        "VULNERABILITY"
+        "VULNERABILITY",
+        "NODE_VULNERABILITY"
       ],
-      "default": "VULNERABILITY"
+      "default": "VULNERABILITY",
+      "description": "- VULNERABILITY: for historical reasons, this short form was used to mean \"Image Vulnerability\""
     },
     "v2ReportSchedule": {
       "type": "object",
@@ -1159,6 +1183,9 @@
     "v2ReportSnapshot": {
       "type": "object",
       "properties": {
+        "type": {
+          "$ref": "#/definitions/v2ReportSnapshotReportType"
+        },
         "reportConfigId": {
           "type": "string"
         },
@@ -1177,6 +1204,9 @@
         "viewBasedVulnReportFilters": {
           "$ref": "#/definitions/v2ViewBasedVulnerabilityReportFilters"
         },
+        "nodeVulnReportFilters": {
+          "$ref": "#/definitions/v2NodeVulnerabilityReportFilters"
+        },
         "collectionSnapshot": {
           "$ref": "#/definitions/v2CollectionSnapshot"
         },
@@ -1207,6 +1237,15 @@
         }
       }
     },
+    "v2ReportSnapshotReportType": {
+      "type": "string",
+      "enum": [
+        "VULNERABILITY",
+        "NODE_VULNERABILITY"
+      ],
+      "default": "VULNERABILITY",
+      "description": "- VULNERABILITY: for historical reasons, this short form was used to mean \"Image Vulnerability\""
+    },
     "v2ReportStatus": {
       "type": "object",
       "properties": {
diff --git a/generated/api/v2/report_service_vtproto.pb.go b/generated/api/v2/report_service_vtproto.pb.go
index 7e29192d12e97..09cdc5697b797 100644
--- a/generated/api/v2/report_service_vtproto.pb.go
+++ b/generated/api/v2/report_service_vtproto.pb.go
@@ -65,6 +65,15 @@ func (m *ReportConfiguration_VulnReportFilters) CloneVT() isReportConfiguration_
 	return r
 }
 
+func (m *ReportConfiguration_NodeVulnReportFilters) CloneVT() isReportConfiguration_Filter {
+	if m == nil {
+		return (*ReportConfiguration_NodeVulnReportFilters)(nil)
+	}
+	r := new(ReportConfiguration_NodeVulnReportFilters)
+	r.NodeVulnReportFilters = m.NodeVulnReportFilters.CloneVT()
+	return r
+}
+
 func (m *VulnerabilityReportFilters) CloneVT() *VulnerabilityReportFilters {
 	if m == nil {
 		return (*VulnerabilityReportFilters)(nil)
@@ -128,6 +137,37 @@ func (m *VulnerabilityReportFilters_SinceStartDate) CloneVT() isVulnerabilityRep
 	return r
 }
 
+func (m *NodeVulnerabilityReportFilters) CloneVT() *NodeVulnerabilityReportFilters {
+	if m == nil {
+		return (*NodeVulnerabilityReportFilters)(nil)
+	}
+	r := new(NodeVulnerabilityReportFilters)
+	r.Query = m.Query
+	if m.CvesSince != nil {
+		r.CvesSince = m.CvesSince.(interface {
+			CloneVT() isNodeVulnerabilityReportFilters_CvesSince
+		}).CloneVT()
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *NodeVulnerabilityReportFilters) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) CloneVT() isNodeVulnerabilityReportFilters_CvesSince {
+	if m == nil {
+		return (*NodeVulnerabilityReportFilters_AllVuln)(nil)
+	}
+	r := new(NodeVulnerabilityReportFilters_AllVuln)
+	r.AllVuln = m.AllVuln
+	return r
+}
+
 func (m *ViewBasedVulnerabilityReportFilters) CloneVT() *ViewBasedVulnerabilityReportFilters {
 	if m == nil {
 		return (*ViewBasedVulnerabilityReportFilters)(nil)
@@ -545,6 +585,7 @@ func (m *ReportSnapshot) CloneVT() *ReportSnapshot {
 		return (*ReportSnapshot)(nil)
 	}
 	r := new(ReportSnapshot)
+	r.Type = m.Type
 	r.ReportConfigId = m.ReportConfigId
 	r.ReportJobId = m.ReportJobId
 	r.Name = m.Name
@@ -597,6 +638,15 @@ func (m *ReportSnapshot_ViewBasedVulnReportFilters) CloneVT() isReportSnapshot_F
 	return r
 }
 
+func (m *ReportSnapshot_NodeVulnReportFilters) CloneVT() isReportSnapshot_Filter {
+	if m == nil {
+		return (*ReportSnapshot_NodeVulnReportFilters)(nil)
+	}
+	r := new(ReportSnapshot_NodeVulnReportFilters)
+	r.NodeVulnReportFilters = m.NodeVulnReportFilters.CloneVT()
+	return r
+}
+
 func (m *ReportStatus) CloneVT() *ReportStatus {
 	if m == nil {
 		return (*ReportStatus)(nil)
@@ -703,6 +753,15 @@ func (m *ReportRequestViewBased_ViewBasedVulnReportFilters) CloneVT() isReportRe
 	return r
 }
 
+func (m *ReportRequestViewBased_NodeVulnReportFilters) CloneVT() isReportRequestViewBased_Filter {
+	if m == nil {
+		return (*ReportRequestViewBased_NodeVulnReportFilters)(nil)
+	}
+	r := new(ReportRequestViewBased_NodeVulnReportFilters)
+	r.NodeVulnReportFilters = m.NodeVulnReportFilters.CloneVT()
+	return r
+}
+
 func (m *RunReportResponseViewBased) CloneVT() *RunReportResponseViewBased {
 	if m == nil {
 		return (*RunReportResponseViewBased)(nil)
@@ -809,6 +868,31 @@ func (this *ReportConfiguration_VulnReportFilters) EqualVT(thatIface isReportCon
 	return true
 }
 
+func (this *ReportConfiguration_NodeVulnReportFilters) EqualVT(thatIface isReportConfiguration_Filter) bool {
+	that, ok := thatIface.(*ReportConfiguration_NodeVulnReportFilters)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.NodeVulnReportFilters, that.NodeVulnReportFilters; p != q {
+		if p == nil {
+			p = &NodeVulnerabilityReportFilters{}
+		}
+		if q == nil {
+			q = &NodeVulnerabilityReportFilters{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *VulnerabilityReportFilters) EqualVT(that *VulnerabilityReportFilters) bool {
 	if this == that {
 		return true
@@ -929,6 +1013,54 @@ func (this *VulnerabilityReportFilters_SinceStartDate) EqualVT(thatIface isVulne
 	return true
 }
 
+func (this *NodeVulnerabilityReportFilters) EqualVT(that *NodeVulnerabilityReportFilters) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.CvesSince == nil && that.CvesSince != nil {
+		return false
+	} else if this.CvesSince != nil {
+		if that.CvesSince == nil {
+			return false
+		}
+		if !this.CvesSince.(interface {
+			EqualVT(isNodeVulnerabilityReportFilters_CvesSince) bool
+		}).EqualVT(that.CvesSince) {
+			return false
+		}
+	}
+	if this.Query != that.Query {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *NodeVulnerabilityReportFilters) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*NodeVulnerabilityReportFilters)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *NodeVulnerabilityReportFilters_AllVuln) EqualVT(thatIface isNodeVulnerabilityReportFilters_CvesSince) bool {
+	that, ok := thatIface.(*NodeVulnerabilityReportFilters_AllVuln)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if this.AllVuln != that.AllVuln {
+		return false
+	}
+	return true
+}
+
 func (this *ViewBasedVulnerabilityReportFilters) EqualVT(that *ViewBasedVulnerabilityReportFilters) bool {
 	if this == that {
 		return true
@@ -1604,6 +1736,9 @@ func (this *ReportSnapshot) EqualVT(that *ReportSnapshot) bool {
 	if !this.ResourceScope.EqualVT(that.ResourceScope) {
 		return false
 	}
+	if this.Type != that.Type {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -1664,6 +1799,31 @@ func (this *ReportSnapshot_ViewBasedVulnReportFilters) EqualVT(thatIface isRepor
 	return true
 }
 
+func (this *ReportSnapshot_NodeVulnReportFilters) EqualVT(thatIface isReportSnapshot_Filter) bool {
+	that, ok := thatIface.(*ReportSnapshot_NodeVulnReportFilters)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.NodeVulnReportFilters, that.NodeVulnReportFilters; p != q {
+		if p == nil {
+			p = &NodeVulnerabilityReportFilters{}
+		}
+		if q == nil {
+			q = &NodeVulnerabilityReportFilters{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *ReportStatus) EqualVT(that *ReportStatus) bool {
 	if this == that {
 		return true
@@ -1817,6 +1977,31 @@ func (this *ReportRequestViewBased_ViewBasedVulnReportFilters) EqualVT(thatIface
 	return true
 }
 
+func (this *ReportRequestViewBased_NodeVulnReportFilters) EqualVT(thatIface isReportRequestViewBased_Filter) bool {
+	that, ok := thatIface.(*ReportRequestViewBased_NodeVulnReportFilters)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.NodeVulnReportFilters, that.NodeVulnReportFilters; p != q {
+		if p == nil {
+			p = &NodeVulnerabilityReportFilters{}
+		}
+		if q == nil {
+			q = &NodeVulnerabilityReportFilters{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *RunReportResponseViewBased) EqualVT(that *RunReportResponseViewBased) bool {
 	if this == that {
 		return true
@@ -1962,6 +2147,29 @@ func (m *ReportConfiguration_VulnReportFilters) MarshalToSizedBufferVT(dAtA []by
 	}
 	return len(dAtA) - i, nil
 }
+func (m *ReportConfiguration_NodeVulnReportFilters) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ReportConfiguration_NodeVulnReportFilters) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.NodeVulnReportFilters != nil {
+		size, err := m.NodeVulnReportFilters.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x4a
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x4a
+	}
+	return len(dAtA) - i, nil
+}
 func (m *VulnerabilityReportFilters) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -2145,6 +2353,72 @@ func (m *VulnerabilityReportFilters_SinceStartDate) MarshalToSizedBufferVT(dAtA
 	}
 	return len(dAtA) - i, nil
 }
+func (m *NodeVulnerabilityReportFilters) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeVulnerabilityReportFilters) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *NodeVulnerabilityReportFilters) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if vtmsg, ok := m.CvesSince.(interface {
+		MarshalToSizedBufferVT([]byte) (int, error)
+	}); ok {
+		size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+	}
+	if len(m.Query) > 0 {
+		i -= len(m.Query)
+		copy(dAtA[i:], m.Query)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Query)))
+		i--
+		dAtA[i] = 0x12
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i--
+	if m.AllVuln {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
 func (m *ViewBasedVulnerabilityReportFilters) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -3161,6 +3435,13 @@ func (m *ReportSnapshot) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		}
 		i -= size
 	}
+	if m.Type != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Type))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x80
+	}
 	if m.ResourceScope != nil {
 		size, err := m.ResourceScope.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -3317,6 +3598,29 @@ func (m *ReportSnapshot_ViewBasedVulnReportFilters) MarshalToSizedBufferVT(dAtA
 	}
 	return len(dAtA) - i, nil
 }
+func (m *ReportSnapshot_NodeVulnReportFilters) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ReportSnapshot_NodeVulnReportFilters) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.NodeVulnReportFilters != nil {
+		size, err := m.NodeVulnReportFilters.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x7a
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x7a
+	}
+	return len(dAtA) - i, nil
+}
 func (m *ReportStatus) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -3591,6 +3895,29 @@ func (m *ReportRequestViewBased_ViewBasedVulnReportFilters) MarshalToSizedBuffer
 	}
 	return len(dAtA) - i, nil
 }
+func (m *ReportRequestViewBased_NodeVulnReportFilters) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ReportRequestViewBased_NodeVulnReportFilters) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.NodeVulnReportFilters != nil {
+		size, err := m.NodeVulnReportFilters.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x22
+	}
+	return len(dAtA) - i, nil
+}
 func (m *RunReportResponseViewBased) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -3694,6 +4021,20 @@ func (m *ReportConfiguration_VulnReportFilters) SizeVT() (n int) {
 	}
 	return n
 }
+func (m *ReportConfiguration_NodeVulnReportFilters) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.NodeVulnReportFilters != nil {
+		l = m.NodeVulnReportFilters.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *VulnerabilityReportFilters) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -3746,27 +4087,53 @@ func (m *VulnerabilityReportFilters_AllVuln) SizeVT() (n int) {
 	n += 2
 	return n
 }
-func (m *VulnerabilityReportFilters_SinceLastSentScheduledReport) SizeVT() (n int) {
+func (m *VulnerabilityReportFilters_SinceLastSentScheduledReport) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 2
+	return n
+}
+func (m *VulnerabilityReportFilters_SinceStartDate) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.SinceStartDate != nil {
+		l = (*timestamppb1.Timestamp)(m.SinceStartDate).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
+func (m *NodeVulnerabilityReportFilters) SizeVT() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	n += 2
+	if vtmsg, ok := m.CvesSince.(interface{ SizeVT() int }); ok {
+		n += vtmsg.SizeVT()
+	}
+	l = len(m.Query)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
 	return n
 }
-func (m *VulnerabilityReportFilters_SinceStartDate) SizeVT() (n int) {
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) SizeVT() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SinceStartDate != nil {
-		l = (*timestamppb1.Timestamp)(m.SinceStartDate).SizeVT()
-		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
-	} else {
-		n += 2
-	}
+	n += 2
 	return n
 }
 func (m *ViewBasedVulnerabilityReportFilters) SizeVT() (n int) {
@@ -4207,6 +4574,9 @@ func (m *ReportSnapshot) SizeVT() (n int) {
 		l = m.ResourceScope.SizeVT()
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.Type != 0 {
+		n += 2 + protohelpers.SizeOfVarint(uint64(m.Type))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -4239,6 +4609,20 @@ func (m *ReportSnapshot_ViewBasedVulnReportFilters) SizeVT() (n int) {
 	}
 	return n
 }
+func (m *ReportSnapshot_NodeVulnReportFilters) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.NodeVulnReportFilters != nil {
+		l = m.NodeVulnReportFilters.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *ReportStatus) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -4349,6 +4733,20 @@ func (m *ReportRequestViewBased_ViewBasedVulnReportFilters) SizeVT() (n int) {
 	}
 	return n
 }
+func (m *ReportRequestViewBased_NodeVulnReportFilters) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.NodeVulnReportFilters != nil {
+		l = m.NodeVulnReportFilters.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *RunReportResponseViewBased) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -4658,6 +5056,47 @@ func (m *ReportConfiguration) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportConfiguration_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportConfiguration_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -5063,6 +5502,110 @@ func (m *VulnerabilityReportFilters) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *NodeVulnerabilityReportFilters) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllVuln", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.CvesSince = &NodeVulnerabilityReportFilters_AllVuln{AllVuln: b}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Query = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ViewBasedVulnerabilityReportFilters) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -7604,6 +8147,66 @@ func (m *ReportSnapshot) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportSnapshot_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportSnapshot_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
+		case 16:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			m.Type = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Type |= ReportSnapshot_ReportType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -8191,11 +8794,43 @@ func (m *ReportRequestViewBased) UnmarshalVT(dAtA []byte) error {
 				m.Filter = &ReportRequestViewBased_ViewBasedVulnReportFilters{ViewBasedVulnReportFilters: v}
 			}
 			iNdEx = postIndex
-		case 3:
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AreaOfConcern", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AreaOfConcern = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AreaOfConcern", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -8205,23 +8840,32 @@ func (m *ReportRequestViewBased) UnmarshalVT(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return protohelpers.ErrInvalidLength
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return protohelpers.ErrInvalidLength
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AreaOfConcern = string(dAtA[iNdEx:postIndex])
+			if oneof, ok := m.Filter.(*ReportRequestViewBased_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportRequestViewBased_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -8663,6 +9307,47 @@ func (m *ReportConfiguration) UnmarshalVTUnsafe(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportConfiguration_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportConfiguration_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -9072,6 +9757,114 @@ func (m *VulnerabilityReportFilters) UnmarshalVTUnsafe(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *NodeVulnerabilityReportFilters) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllVuln", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.CvesSince = &NodeVulnerabilityReportFilters_AllVuln{AllVuln: b}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.Query = stringValue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ViewBasedVulnerabilityReportFilters) UnmarshalVTUnsafe(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -11681,6 +12474,66 @@ func (m *ReportSnapshot) UnmarshalVTUnsafe(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportSnapshot_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportSnapshot_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
+		case 16:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			m.Type = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Type |= ReportSnapshot_ReportType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -12324,6 +13177,47 @@ func (m *ReportRequestViewBased) UnmarshalVTUnsafe(dAtA []byte) error {
 			}
 			m.AreaOfConcern = stringValue
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportRequestViewBased_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportRequestViewBased_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/generated/api/v2/scan_component.pb.go b/generated/api/v2/scan_component.pb.go
index a28631c792fe7..1c34fc2650d30 100644
--- a/generated/api/v2/scan_component.pb.go
+++ b/generated/api/v2/scan_component.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/scan_component.proto
 
diff --git a/generated/api/v2/search_query.pb.go b/generated/api/v2/search_query.pb.go
index bf921ff60f374..af455db782c5b 100644
--- a/generated/api/v2/search_query.pb.go
+++ b/generated/api/v2/search_query.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/search_query.proto
 
diff --git a/generated/api/v2/user.pb.go b/generated/api/v2/user.pb.go
index 00506829287a8..b594a8bec8d52 100644
--- a/generated/api/v2/user.pb.go
+++ b/generated/api/v2/user.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/user.proto
 
diff --git a/generated/api/v2/virtual_machine_service.pb.go b/generated/api/v2/virtual_machine_service.pb.go
index 3fb3ad8e65eac..2b63475d9a674 100644
--- a/generated/api/v2/virtual_machine_service.pb.go
+++ b/generated/api/v2/virtual_machine_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/virtual_machine_service.proto
 
diff --git a/generated/api/v2/virtual_machine_service.pb.gw.go b/generated/api/v2/virtual_machine_service.pb.gw.go
index 7a0f59a3c2ec1..ab4bf0dc49f3f 100644
--- a/generated/api/v2/virtual_machine_service.pb.gw.go
+++ b/generated/api/v2/virtual_machine_service.pb.gw.go
@@ -43,9 +43,6 @@ func request_VirtualMachineService_GetVirtualMachine_0(ctx context.Context, mars
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -60,6 +57,9 @@ func request_VirtualMachineService_GetVirtualMachine_0(ctx context.Context, mars
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineService_GetVirtualMachine_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVirtualMachine(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -95,15 +95,15 @@ func request_VirtualMachineService_ListVirtualMachines_0(ctx context.Context, ma
 		protoReq ListVirtualMachinesRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineService_ListVirtualMachines_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListVirtualMachines(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/virtual_machine_v2_service.pb.go b/generated/api/v2/virtual_machine_v2_service.pb.go
index 55fb3c8513dc1..f57b4bf3b44e3 100644
--- a/generated/api/v2/virtual_machine_v2_service.pb.go
+++ b/generated/api/v2/virtual_machine_v2_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/virtual_machine_v2_service.proto
 
@@ -179,12 +179,14 @@ func (VMNote) EnumDescriptor() ([]byte, []int) {
 	return file_api_v2_virtual_machine_v2_service_proto_rawDescGZIP(), []int{2}
 }
 
-// Agent status enriched from a separate data source (not on VirtualMachineV2 storage).
+// AgentStatus is roxagent liveness from scrape freshness, computed on GetVM
+// (not a stored enum). UNKNOWN means never scraped; INACTIVE means scraped, then quiet.
 type AgentStatus int32
 
 const (
-	AgentStatus_AGENT_STATUS_UNKNOWN AgentStatus = 0
-	AgentStatus_AGENT_STATUS_ACTIVE  AgentStatus = 1
+	AgentStatus_AGENT_STATUS_UNKNOWN  AgentStatus = 0
+	AgentStatus_AGENT_STATUS_ACTIVE   AgentStatus = 1
+	AgentStatus_AGENT_STATUS_INACTIVE AgentStatus = 2
 )
 
 // Enum value maps for AgentStatus.
@@ -192,10 +194,12 @@ var (
 	AgentStatus_name = map[int32]string{
 		0: "AGENT_STATUS_UNKNOWN",
 		1: "AGENT_STATUS_ACTIVE",
+		2: "AGENT_STATUS_INACTIVE",
 	}
 	AgentStatus_value = map[string]int32{
-		"AGENT_STATUS_UNKNOWN": 0,
-		"AGENT_STATUS_ACTIVE":  1,
+		"AGENT_STATUS_UNKNOWN":  0,
+		"AGENT_STATUS_ACTIVE":   1,
+		"AGENT_STATUS_INACTIVE": 2,
 	}
 )
 
@@ -2537,10 +2541,11 @@ const file_api_v2_virtual_machine_v2_service_proto_rawDesc = "" +
 	"\x19VM_NOTE_MISSING_SIGNATURE\x10\x02\x12/\n" +
 	"+VM_NOTE_MISSING_SIGNATURE_VERIFICATION_DATA\x10\x03\x12\x1b\n" +
 	"\x17VM_NOTE_MISSING_SCANNER\x10\x04\x12\x17\n" +
-	"\x13VM_NOTE_SCAN_FAILED\x10\x05*@\n" +
+	"\x13VM_NOTE_SCAN_FAILED\x10\x05*[\n" +
 	"\vAgentStatus\x12\x18\n" +
 	"\x14AGENT_STATUS_UNKNOWN\x10\x00\x12\x17\n" +
-	"\x13AGENT_STATUS_ACTIVE\x10\x01*_\n" +
+	"\x13AGENT_STATUS_ACTIVE\x10\x01\x12\x19\n" +
+	"\x15AGENT_STATUS_INACTIVE\x10\x02*_\n" +
 	"\n" +
 	"ScanStatus\x12\x0f\n" +
 	"\vNOT_SCANNED\x10\x00\x12\x10\n" +
diff --git a/generated/api/v2/virtual_machine_v2_service.pb.gw.go b/generated/api/v2/virtual_machine_v2_service.pb.gw.go
index 1ed2bd3562d05..aeafc249b1ffc 100644
--- a/generated/api/v2/virtual_machine_v2_service.pb.gw.go
+++ b/generated/api/v2/virtual_machine_v2_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_VirtualMachineV2Service_GetVM_0(ctx context.Context, marshaler runt
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_VirtualMachineV2Service_GetVM_0(ctx context.Context, marshaler runt
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVM(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -82,9 +82,6 @@ func request_VirtualMachineV2Service_GetVMVulnSummary_0(ctx context.Context, mar
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -99,6 +96,9 @@ func request_VirtualMachineV2Service_GetVMVulnSummary_0(ctx context.Context, mar
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_GetVMVulnSummary_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVMVulnSummary(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -135,9 +135,6 @@ func request_VirtualMachineV2Service_ListVMCVEsByVM_0(ctx context.Context, marsh
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["vm_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "vm_id")
@@ -152,6 +149,9 @@ func request_VirtualMachineV2Service_ListVMCVEsByVM_0(ctx context.Context, marsh
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_ListVMCVEsByVM_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListVMCVEsByVM(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -186,9 +186,6 @@ func request_VirtualMachineV2Service_GetVMCVEComponents_0(ctx context.Context, m
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["vm_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "vm_id")
@@ -205,6 +202,9 @@ func request_VirtualMachineV2Service_GetVMCVEComponents_0(ctx context.Context, m
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "cve_id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVMCVEComponents(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -243,9 +243,6 @@ func request_VirtualMachineV2Service_ListVMComponents_0(ctx context.Context, mar
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["vm_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "vm_id")
@@ -260,6 +257,9 @@ func request_VirtualMachineV2Service_ListVMComponents_0(ctx context.Context, mar
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_ListVMComponents_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListVMComponents(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -295,15 +295,15 @@ func request_VirtualMachineV2Service_ListVMs_0(ctx context.Context, marshaler ru
 		protoReq ListVMsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_ListVMs_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListVMs(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -330,15 +330,15 @@ func request_VirtualMachineV2Service_ListVMCVEs_0(ctx context.Context, marshaler
 		protoReq ListVMCVEsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_ListVMCVEs_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListVMCVEs(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -365,15 +365,15 @@ func request_VirtualMachineV2Service_GetVMDashboardCounts_0(ctx context.Context,
 		protoReq VMDashboardCountsRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_GetVMDashboardCounts_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVMDashboardCounts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -401,9 +401,6 @@ func request_VirtualMachineV2Service_GetVMCVEDetail_0(ctx context.Context, marsh
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cve_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cve_id")
@@ -418,6 +415,9 @@ func request_VirtualMachineV2Service_GetVMCVEDetail_0(ctx context.Context, marsh
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_GetVMCVEDetail_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVMCVEDetail(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -454,9 +454,6 @@ func request_VirtualMachineV2Service_ListVMCVEAffectedVMs_0(ctx context.Context,
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["cve_id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "cve_id")
@@ -471,6 +468,9 @@ func request_VirtualMachineV2Service_ListVMCVEAffectedVMs_0(ctx context.Context,
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VirtualMachineV2Service_ListVMCVEAffectedVMs_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListVMCVEAffectedVMs(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/virtual_machine_v2_service.swagger.json b/generated/api/v2/virtual_machine_v2_service.swagger.json
index 2cdd381899c79..ec95ea8fc97a4 100644
--- a/generated/api/v2/virtual_machine_v2_service.swagger.json
+++ b/generated/api/v2/virtual_machine_v2_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "VirtualMachineV2Service"
+      "name": "VirtualMachineV2Service",
+      "description": "NOTE: RPC ordering matters for grpc-gateway routing. The gateway prepends\neach handler (last registered = first matched), so wildcard routes like\n{id} must be defined FIRST to end up at the back of the matching list.\nLiteral routes defined after will match before the wildcard."
     }
   ],
   "consumes": [
@@ -767,10 +768,11 @@
       "type": "string",
       "enum": [
         "AGENT_STATUS_UNKNOWN",
-        "AGENT_STATUS_ACTIVE"
+        "AGENT_STATUS_ACTIVE",
+        "AGENT_STATUS_INACTIVE"
       ],
       "default": "AGENT_STATUS_UNKNOWN",
-      "description": "Agent status enriched from a separate data source (not on VirtualMachineV2 storage)."
+      "description": "AgentStatus is roxagent liveness from scrape freshness, computed on GetVM\n(not a stored enum). UNKNOWN means never scraped; INACTIVE means scraped, then quiet."
     },
     "v2AggregateBy": {
       "type": "object",
diff --git a/generated/api/v2/vuln_exception_service.pb.go b/generated/api/v2/vuln_exception_service.pb.go
index 4fc43b0fba1fa..e7bc42d269992 100644
--- a/generated/api/v2/vuln_exception_service.pb.go
+++ b/generated/api/v2/vuln_exception_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/vuln_exception_service.proto
 
diff --git a/generated/api/v2/vuln_exception_service.pb.gw.go b/generated/api/v2/vuln_exception_service.pb.gw.go
index c2cf3ff4bdc5c..f2132de0f7ad9 100644
--- a/generated/api/v2/vuln_exception_service.pb.gw.go
+++ b/generated/api/v2/vuln_exception_service.pb.gw.go
@@ -41,9 +41,6 @@ func request_VulnerabilityExceptionService_GetVulnerabilityException_0(ctx conte
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -52,6 +49,9 @@ func request_VulnerabilityExceptionService_GetVulnerabilityException_0(ctx conte
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetVulnerabilityException(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -81,15 +81,15 @@ func request_VulnerabilityExceptionService_ListVulnerabilityExceptions_0(ctx con
 		protoReq RawQuery
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_VulnerabilityExceptionService_ListVulnerabilityExceptions_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListVulnerabilityExceptions(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -172,9 +172,6 @@ func request_VulnerabilityExceptionService_ApproveVulnerabilityException_0(ctx c
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -183,6 +180,9 @@ func request_VulnerabilityExceptionService_ApproveVulnerabilityException_0(ctx c
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ApproveVulnerabilityException(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -217,9 +217,6 @@ func request_VulnerabilityExceptionService_DenyVulnerabilityException_0(ctx cont
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -228,6 +225,9 @@ func request_VulnerabilityExceptionService_DenyVulnerabilityException_0(ctx cont
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DenyVulnerabilityException(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -262,9 +262,6 @@ func request_VulnerabilityExceptionService_UpdateVulnerabilityException_0(ctx co
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -273,6 +270,9 @@ func request_VulnerabilityExceptionService_UpdateVulnerabilityException_0(ctx co
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.UpdateVulnerabilityException(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -304,9 +304,6 @@ func request_VulnerabilityExceptionService_CancelVulnerabilityException_0(ctx co
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -315,6 +312,9 @@ func request_VulnerabilityExceptionService_CancelVulnerabilityException_0(ctx co
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CancelVulnerabilityException(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -343,9 +343,6 @@ func request_VulnerabilityExceptionService_DeleteVulnerabilityException_0(ctx co
 		metadata runtime.ServerMetadata
 		err      error
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	val, ok := pathParams["id"]
 	if !ok {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
@@ -354,6 +351,9 @@ func request_VulnerabilityExceptionService_DeleteVulnerabilityException_0(ctx co
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DeleteVulnerabilityException(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/api/v2/vuln_exception_service.swagger.json b/generated/api/v2/vuln_exception_service.swagger.json
index 6bb1cd47996dc..348e5cb80392e 100644
--- a/generated/api/v2/vuln_exception_service.swagger.json
+++ b/generated/api/v2/vuln_exception_service.swagger.json
@@ -6,7 +6,8 @@
   },
   "tags": [
     {
-      "name": "VulnerabilityExceptionService"
+      "name": "VulnerabilityExceptionService",
+      "description": "VulnerabilityExceptionService APIs can be used to manage create and manage vulnerability exceptions."
     }
   ],
   "consumes": [
diff --git a/generated/api/v2/vuln_state.pb.go b/generated/api/v2/vuln_state.pb.go
index c37d616e94f1b..6edbc792a07a8 100644
--- a/generated/api/v2/vuln_state.pb.go
+++ b/generated/api/v2/vuln_state.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/vuln_state.proto
 
diff --git a/generated/api/v2/vulnerability.pb.go b/generated/api/v2/vulnerability.pb.go
index 18099224a6193..0da91357ddea9 100644
--- a/generated/api/v2/vulnerability.pb.go
+++ b/generated/api/v2/vulnerability.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: api/v2/vulnerability.proto
 
diff --git a/generated/internalapi/central/auth.pb.go b/generated/internalapi/central/auth.pb.go
index 98310971c11fa..0dbfada5ec090 100644
--- a/generated/internalapi/central/auth.pb.go
+++ b/generated/internalapi/central/auth.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/auth.proto
 
diff --git a/generated/internalapi/central/baseline_sync.pb.go b/generated/internalapi/central/baseline_sync.pb.go
index f4d7faf9c78a6..03f6b169863ae 100644
--- a/generated/internalapi/central/baseline_sync.pb.go
+++ b/generated/internalapi/central/baseline_sync.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/baseline_sync.proto
 
diff --git a/generated/internalapi/central/cluster_config.pb.go b/generated/internalapi/central/cluster_config.pb.go
index d9340b258415d..a0edcdf059287 100644
--- a/generated/internalapi/central/cluster_config.pb.go
+++ b/generated/internalapi/central/cluster_config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/cluster_config.proto
 
diff --git a/generated/internalapi/central/cluster_metrics.pb.go b/generated/internalapi/central/cluster_metrics.pb.go
index 0f499f4c5facf..cdf3289ee21d9 100644
--- a/generated/internalapi/central/cluster_metrics.pb.go
+++ b/generated/internalapi/central/cluster_metrics.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/cluster_metrics.proto
 
@@ -28,8 +28,10 @@ type ClusterMetrics struct {
 	NodeCount                 int64                  `protobuf:"varint,1,opt,name=node_count,json=nodeCount,proto3" json:"node_count,omitempty"`                                                  // The number of nodes in the cluster accessible by Sensor.
 	CpuCapacity               int64                  `protobuf:"varint,2,opt,name=cpu_capacity,json=cpuCapacity,proto3" json:"cpu_capacity,omitempty"`                                            // The total cpu capacity of all nodes accessible by Sensor.
 	ComplianceOperatorVersion string                 `protobuf:"bytes,3,opt,name=compliance_operator_version,json=complianceOperatorVersion,proto3" json:"compliance_operator_version,omitempty"` // Compliance operator version discovered by this Sensor.
-	unknownFields             protoimpl.UnknownFields
-	sizeCache                 protoimpl.SizeCache
+	// Filled only when ROX_VIRTUAL_MACHINES is enabled on this Sensor.
+	VirtualMachineMetrics *VirtualMachineMetrics `protobuf:"bytes,4,opt,name=virtual_machine_metrics,json=virtualMachineMetrics,proto3" json:"virtual_machine_metrics,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
 }
 
 func (x *ClusterMetrics) Reset() {
@@ -83,16 +85,93 @@ func (x *ClusterMetrics) GetComplianceOperatorVersion() string {
 	return ""
 }
 
+func (x *ClusterMetrics) GetVirtualMachineMetrics() *VirtualMachineMetrics {
+	if x != nil {
+		return x.VirtualMachineMetrics
+	}
+	return nil
+}
+
+type VirtualMachineMetrics struct {
+	state                 protoimpl.MessageState `protogen:"open.v1"`
+	TrackedVms            int32                  `protobuf:"varint,1,opt,name=tracked_vms,json=trackedVms,proto3" json:"tracked_vms,omitempty"`                                                                                                              // VMs currently tracked for scraping.
+	VmsScanned            int32                  `protobuf:"varint,2,opt,name=vms_scanned,json=vmsScanned,proto3" json:"vms_scanned,omitempty"`                                                                                                              // Tracked VMs with at least one successful scrape ever.
+	RoxagentVersionCounts map[string]int32       `protobuf:"bytes,3,rep,name=roxagent_version_counts,json=roxagentVersionCounts,proto3" json:"roxagent_version_counts,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` // Version (or "unknown"/"other") -> count of scanned VMs. Unscanned VMs are omitted.
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
+}
+
+func (x *VirtualMachineMetrics) Reset() {
+	*x = VirtualMachineMetrics{}
+	mi := &file_internalapi_central_cluster_metrics_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VirtualMachineMetrics) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VirtualMachineMetrics) ProtoMessage() {}
+
+func (x *VirtualMachineMetrics) ProtoReflect() protoreflect.Message {
+	mi := &file_internalapi_central_cluster_metrics_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VirtualMachineMetrics.ProtoReflect.Descriptor instead.
+func (*VirtualMachineMetrics) Descriptor() ([]byte, []int) {
+	return file_internalapi_central_cluster_metrics_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *VirtualMachineMetrics) GetTrackedVms() int32 {
+	if x != nil {
+		return x.TrackedVms
+	}
+	return 0
+}
+
+func (x *VirtualMachineMetrics) GetVmsScanned() int32 {
+	if x != nil {
+		return x.VmsScanned
+	}
+	return 0
+}
+
+func (x *VirtualMachineMetrics) GetRoxagentVersionCounts() map[string]int32 {
+	if x != nil {
+		return x.RoxagentVersionCounts
+	}
+	return nil
+}
+
 var File_internalapi_central_cluster_metrics_proto protoreflect.FileDescriptor
 
 const file_internalapi_central_cluster_metrics_proto_rawDesc = "" +
 	"\n" +
-	")internalapi/central/cluster_metrics.proto\x12\acentral\"\x92\x01\n" +
+	")internalapi/central/cluster_metrics.proto\x12\acentral\"\xea\x01\n" +
 	"\x0eClusterMetrics\x12\x1d\n" +
 	"\n" +
 	"node_count\x18\x01 \x01(\x03R\tnodeCount\x12!\n" +
 	"\fcpu_capacity\x18\x02 \x01(\x03R\vcpuCapacity\x12>\n" +
-	"\x1bcompliance_operator_version\x18\x03 \x01(\tR\x19complianceOperatorVersionB\x1fZ\x1d./internalapi/central;centralb\x06proto3"
+	"\x1bcompliance_operator_version\x18\x03 \x01(\tR\x19complianceOperatorVersion\x12V\n" +
+	"\x17virtual_machine_metrics\x18\x04 \x01(\v2\x1e.central.VirtualMachineMetricsR\x15virtualMachineMetrics\"\x96\x02\n" +
+	"\x15VirtualMachineMetrics\x12\x1f\n" +
+	"\vtracked_vms\x18\x01 \x01(\x05R\n" +
+	"trackedVms\x12\x1f\n" +
+	"\vvms_scanned\x18\x02 \x01(\x05R\n" +
+	"vmsScanned\x12q\n" +
+	"\x17roxagent_version_counts\x18\x03 \x03(\v29.central.VirtualMachineMetrics.RoxagentVersionCountsEntryR\x15roxagentVersionCounts\x1aH\n" +
+	"\x1aRoxagentVersionCountsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\x05R\x05value:\x028\x01B\x1fZ\x1d./internalapi/central;centralb\x06proto3"
 
 var (
 	file_internalapi_central_cluster_metrics_proto_rawDescOnce sync.Once
@@ -106,16 +185,20 @@ func file_internalapi_central_cluster_metrics_proto_rawDescGZIP() []byte {
 	return file_internalapi_central_cluster_metrics_proto_rawDescData
 }
 
-var file_internalapi_central_cluster_metrics_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_internalapi_central_cluster_metrics_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
 var file_internalapi_central_cluster_metrics_proto_goTypes = []any{
-	(*ClusterMetrics)(nil), // 0: central.ClusterMetrics
+	(*ClusterMetrics)(nil),        // 0: central.ClusterMetrics
+	(*VirtualMachineMetrics)(nil), // 1: central.VirtualMachineMetrics
+	nil,                           // 2: central.VirtualMachineMetrics.RoxagentVersionCountsEntry
 }
 var file_internalapi_central_cluster_metrics_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	1, // 0: central.ClusterMetrics.virtual_machine_metrics:type_name -> central.VirtualMachineMetrics
+	2, // 1: central.VirtualMachineMetrics.roxagent_version_counts:type_name -> central.VirtualMachineMetrics.RoxagentVersionCountsEntry
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
 }
 
 func init() { file_internalapi_central_cluster_metrics_proto_init() }
@@ -129,7 +212,7 @@ func file_internalapi_central_cluster_metrics_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_internalapi_central_cluster_metrics_proto_rawDesc), len(file_internalapi_central_cluster_metrics_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   1,
+			NumMessages:   3,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/generated/internalapi/central/cluster_metrics_vtproto.pb.go b/generated/internalapi/central/cluster_metrics_vtproto.pb.go
index 9aaf2dc21c058..26c0472555395 100644
--- a/generated/internalapi/central/cluster_metrics_vtproto.pb.go
+++ b/generated/internalapi/central/cluster_metrics_vtproto.pb.go
@@ -28,6 +28,7 @@ func (m *ClusterMetrics) CloneVT() *ClusterMetrics {
 	r.NodeCount = m.NodeCount
 	r.CpuCapacity = m.CpuCapacity
 	r.ComplianceOperatorVersion = m.ComplianceOperatorVersion
+	r.VirtualMachineMetrics = m.VirtualMachineMetrics.CloneVT()
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -39,6 +40,31 @@ func (m *ClusterMetrics) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *VirtualMachineMetrics) CloneVT() *VirtualMachineMetrics {
+	if m == nil {
+		return (*VirtualMachineMetrics)(nil)
+	}
+	r := new(VirtualMachineMetrics)
+	r.TrackedVms = m.TrackedVms
+	r.VmsScanned = m.VmsScanned
+	if rhs := m.RoxagentVersionCounts; rhs != nil {
+		tmpContainer := make(map[string]int32, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v
+		}
+		r.RoxagentVersionCounts = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *VirtualMachineMetrics) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
 func (this *ClusterMetrics) EqualVT(that *ClusterMetrics) bool {
 	if this == that {
 		return true
@@ -54,6 +80,9 @@ func (this *ClusterMetrics) EqualVT(that *ClusterMetrics) bool {
 	if this.ComplianceOperatorVersion != that.ComplianceOperatorVersion {
 		return false
 	}
+	if !this.VirtualMachineMetrics.EqualVT(that.VirtualMachineMetrics) {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -64,6 +93,40 @@ func (this *ClusterMetrics) EqualMessageVT(thatMsg proto.Message) bool {
 	}
 	return this.EqualVT(that)
 }
+func (this *VirtualMachineMetrics) EqualVT(that *VirtualMachineMetrics) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.TrackedVms != that.TrackedVms {
+		return false
+	}
+	if this.VmsScanned != that.VmsScanned {
+		return false
+	}
+	if len(this.RoxagentVersionCounts) != len(that.RoxagentVersionCounts) {
+		return false
+	}
+	for i, vx := range this.RoxagentVersionCounts {
+		vy, ok := that.RoxagentVersionCounts[i]
+		if !ok {
+			return false
+		}
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *VirtualMachineMetrics) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*VirtualMachineMetrics)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
 func (m *ClusterMetrics) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -94,6 +157,16 @@ func (m *ClusterMetrics) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.VirtualMachineMetrics != nil {
+		size, err := m.VirtualMachineMetrics.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
 	if len(m.ComplianceOperatorVersion) > 0 {
 		i -= len(m.ComplianceOperatorVersion)
 		copy(dAtA[i:], m.ComplianceOperatorVersion)
@@ -114,6 +187,66 @@ func (m *ClusterMetrics) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *VirtualMachineMetrics) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *VirtualMachineMetrics) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *VirtualMachineMetrics) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.RoxagentVersionCounts) > 0 {
+		for k := range m.RoxagentVersionCounts {
+			v := m.RoxagentVersionCounts[k]
+			baseI := i
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(v))
+			i--
+			dAtA[i] = 0x10
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if m.VmsScanned != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.VmsScanned))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.TrackedVms != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.TrackedVms))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *ClusterMetrics) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -130,6 +263,34 @@ func (m *ClusterMetrics) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.VirtualMachineMetrics != nil {
+		l = m.VirtualMachineMetrics.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *VirtualMachineMetrics) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.TrackedVms != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.TrackedVms))
+	}
+	if m.VmsScanned != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.VmsScanned))
+	}
+	if len(m.RoxagentVersionCounts) > 0 {
+		for k, v := range m.RoxagentVersionCounts {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + 1 + protohelpers.SizeOfVarint(uint64(v))
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -233,6 +394,244 @@ func (m *ClusterMetrics) UnmarshalVT(dAtA []byte) error {
 			}
 			m.ComplianceOperatorVersion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VirtualMachineMetrics", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.VirtualMachineMetrics == nil {
+				m.VirtualMachineMetrics = &VirtualMachineMetrics{}
+			}
+			if err := m.VirtualMachineMetrics.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *VirtualMachineMetrics) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: VirtualMachineMetrics: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: VirtualMachineMetrics: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TrackedVms", wireType)
+			}
+			m.TrackedVms = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TrackedVms |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VmsScanned", wireType)
+			}
+			m.VmsScanned = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.VmsScanned |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RoxagentVersionCounts", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.RoxagentVersionCounts == nil {
+				m.RoxagentVersionCounts = make(map[string]int32)
+			}
+			var mapkey string
+			var mapvalue int32
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapvalue |= int32(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.RoxagentVersionCounts[mapkey] = mapvalue
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -358,6 +757,248 @@ func (m *ClusterMetrics) UnmarshalVTUnsafe(dAtA []byte) error {
 			}
 			m.ComplianceOperatorVersion = stringValue
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VirtualMachineMetrics", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.VirtualMachineMetrics == nil {
+				m.VirtualMachineMetrics = &VirtualMachineMetrics{}
+			}
+			if err := m.VirtualMachineMetrics.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *VirtualMachineMetrics) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: VirtualMachineMetrics: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: VirtualMachineMetrics: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TrackedVms", wireType)
+			}
+			m.TrackedVms = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TrackedVms |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VmsScanned", wireType)
+			}
+			m.VmsScanned = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.VmsScanned |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RoxagentVersionCounts", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.RoxagentVersionCounts == nil {
+				m.RoxagentVersionCounts = make(map[string]int32)
+			}
+			var mapkey string
+			var mapvalue int32
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					if intStringLenmapkey == 0 {
+						mapkey = ""
+					} else {
+						mapkey = unsafe.String(&dAtA[iNdEx], intStringLenmapkey)
+					}
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapvalue |= int32(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.RoxagentVersionCounts[mapkey] = mapvalue
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/generated/internalapi/central/cluster_status.pb.go b/generated/internalapi/central/cluster_status.pb.go
index 469bf3766797d..b33a449c6d802 100644
--- a/generated/internalapi/central/cluster_status.pb.go
+++ b/generated/internalapi/central/cluster_status.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/cluster_status.proto
 
diff --git a/generated/internalapi/central/compliance_operator.pb.go b/generated/internalapi/central/compliance_operator.pb.go
index ded411391134d..49c13bbf8686c 100644
--- a/generated/internalapi/central/compliance_operator.pb.go
+++ b/generated/internalapi/central/compliance_operator.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/compliance_operator.proto
 
diff --git a/generated/internalapi/central/delegated_registry_config.pb.go b/generated/internalapi/central/delegated_registry_config.pb.go
index 2b52fcd7c6deb..6fcdf4cb2f17a 100644
--- a/generated/internalapi/central/delegated_registry_config.pb.go
+++ b/generated/internalapi/central/delegated_registry_config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/delegated_registry_config.proto
 
diff --git a/generated/internalapi/central/deployment_enhancement.pb.go b/generated/internalapi/central/deployment_enhancement.pb.go
index e8efe5675e331..82700235ecd76 100644
--- a/generated/internalapi/central/deployment_enhancement.pb.go
+++ b/generated/internalapi/central/deployment_enhancement.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/deployment_enhancement.proto
 
diff --git a/generated/internalapi/central/development_service.pb.go b/generated/internalapi/central/development_service.pb.go
index d5beefb4c85e6..80058f8093a05 100644
--- a/generated/internalapi/central/development_service.pb.go
+++ b/generated/internalapi/central/development_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/development_service.proto
 
diff --git a/generated/internalapi/central/development_service.pb.gw.go b/generated/internalapi/central/development_service.pb.gw.go
index 1de6586c60742..21ba64121e2dd 100644
--- a/generated/internalapi/central/development_service.pb.gw.go
+++ b/generated/internalapi/central/development_service.pb.gw.go
@@ -69,15 +69,15 @@ func request_DevelopmentService_URLHasValidCert_0(ctx context.Context, marshaler
 		protoReq URLHasValidCertRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DevelopmentService_URLHasValidCert_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.URLHasValidCert(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -104,15 +104,15 @@ func request_DevelopmentService_RandomData_0(ctx context.Context, marshaler runt
 		protoReq RandomDataRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_DevelopmentService_RandomData_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.RandomData(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/internalapi/central/hello.pb.go b/generated/internalapi/central/hello.pb.go
index 874368738bfee..5720311cf4bdd 100644
--- a/generated/internalapi/central/hello.pb.go
+++ b/generated/internalapi/central/hello.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/hello.proto
 
diff --git a/generated/internalapi/central/image.pb.go b/generated/internalapi/central/image.pb.go
index 25305a6e5585c..85e1a447b3475 100644
--- a/generated/internalapi/central/image.pb.go
+++ b/generated/internalapi/central/image.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/image.proto
 
diff --git a/generated/internalapi/central/local_scanner.pb.go b/generated/internalapi/central/local_scanner.pb.go
index 803964ec1fbbd..2209659e9768b 100644
--- a/generated/internalapi/central/local_scanner.pb.go
+++ b/generated/internalapi/central/local_scanner.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/local_scanner.proto
 
diff --git a/generated/internalapi/central/network_baseline_sync.pb.go b/generated/internalapi/central/network_baseline_sync.pb.go
index aec1571dd98d8..d2a1090fdcbc8 100644
--- a/generated/internalapi/central/network_baseline_sync.pb.go
+++ b/generated/internalapi/central/network_baseline_sync.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/network_baseline_sync.proto
 
diff --git a/generated/internalapi/central/network_flow.pb.go b/generated/internalapi/central/network_flow.pb.go
index fb9f918627c6f..ea6da89962369 100644
--- a/generated/internalapi/central/network_flow.pb.go
+++ b/generated/internalapi/central/network_flow.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/network_flow.proto
 
diff --git a/generated/internalapi/central/policy_sync.pb.go b/generated/internalapi/central/policy_sync.pb.go
index 532b9c8020cff..8477cde92b692 100644
--- a/generated/internalapi/central/policy_sync.pb.go
+++ b/generated/internalapi/central/policy_sync.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/policy_sync.proto
 
diff --git a/generated/internalapi/central/process_listening_on_ports_update.pb.go b/generated/internalapi/central/process_listening_on_ports_update.pb.go
index 87aabe9a70a6e..0adb573d5fc14 100644
--- a/generated/internalapi/central/process_listening_on_ports_update.pb.go
+++ b/generated/internalapi/central/process_listening_on_ports_update.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/process_listening_on_ports_update.proto
 
diff --git a/generated/internalapi/central/secured_cluster_cert_refresh.pb.go b/generated/internalapi/central/secured_cluster_cert_refresh.pb.go
index d29951663abb5..2a8aa24d86315 100644
--- a/generated/internalapi/central/secured_cluster_cert_refresh.pb.go
+++ b/generated/internalapi/central/secured_cluster_cert_refresh.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/secured_cluster_cert_refresh.proto
 
diff --git a/generated/internalapi/central/sensor_events.pb.go b/generated/internalapi/central/sensor_events.pb.go
index 3a567cb1fb43e..32c8efbcc3d04 100644
--- a/generated/internalapi/central/sensor_events.pb.go
+++ b/generated/internalapi/central/sensor_events.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/sensor_events.proto
 
diff --git a/generated/internalapi/central/sensor_iservice.pb.go b/generated/internalapi/central/sensor_iservice.pb.go
index 61ca5245e77b4..835caba41697b 100644
--- a/generated/internalapi/central/sensor_iservice.pb.go
+++ b/generated/internalapi/central/sensor_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/sensor_iservice.proto
 
diff --git a/generated/internalapi/central/sensor_upgrade.pb.go b/generated/internalapi/central/sensor_upgrade.pb.go
index 0217c7996b8ce..03e18f908e9c5 100644
--- a/generated/internalapi/central/sensor_upgrade.pb.go
+++ b/generated/internalapi/central/sensor_upgrade.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/sensor_upgrade.proto
 
diff --git a/generated/internalapi/central/sensor_upgrade_ctrl_iservice.pb.go b/generated/internalapi/central/sensor_upgrade_ctrl_iservice.pb.go
index 11ed075adf498..cf8e6b1027d39 100644
--- a/generated/internalapi/central/sensor_upgrade_ctrl_iservice.pb.go
+++ b/generated/internalapi/central/sensor_upgrade_ctrl_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/sensor_upgrade_ctrl_iservice.proto
 
diff --git a/generated/internalapi/central/telemetry.pb.go b/generated/internalapi/central/telemetry.pb.go
index fff1ae98a6a00..a21c999c5b8c1 100644
--- a/generated/internalapi/central/telemetry.pb.go
+++ b/generated/internalapi/central/telemetry.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/telemetry.proto
 
diff --git a/generated/internalapi/central/v1/token_service.pb.go b/generated/internalapi/central/v1/token_service.pb.go
index 44d13cacd94c5..e8045d252b33b 100644
--- a/generated/internalapi/central/v1/token_service.pb.go
+++ b/generated/internalapi/central/v1/token_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/central/v1/token_service.proto
 
diff --git a/generated/internalapi/central/v1/token_service.pb.gw.go b/generated/internalapi/central/v1/token_service.pb.gw.go
index 7d726f38314dd..ee94c3884fed2 100644
--- a/generated/internalapi/central/v1/token_service.pb.gw.go
+++ b/generated/internalapi/central/v1/token_service.pb.gw.go
@@ -42,15 +42,15 @@ func request_TokenService_GenerateTokenForPermissionsAndScope_0(ctx context.Cont
 		protoReq GenerateTokenForPermissionsAndScopeRequest
 		metadata runtime.ServerMetadata
 	)
-	if req.Body != nil {
-		_, _ = io.Copy(io.Discard, req.Body)
-	}
 	if err := req.ParseForm(); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_TokenService_GenerateTokenForPermissionsAndScope_0); err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GenerateTokenForPermissionsAndScope(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
diff --git a/generated/internalapi/compliance/compliance_data.pb.go b/generated/internalapi/compliance/compliance_data.pb.go
index f83af5017b2c2..e9eef707766e8 100644
--- a/generated/internalapi/compliance/compliance_data.pb.go
+++ b/generated/internalapi/compliance/compliance_data.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/compliance/compliance_data.proto
 
diff --git a/generated/internalapi/scanner/v4/common.pb.go b/generated/internalapi/scanner/v4/common.pb.go
index 0e880bdfa519d..67299462678e8 100644
--- a/generated/internalapi/scanner/v4/common.pb.go
+++ b/generated/internalapi/scanner/v4/common.pb.go
@@ -4,7 +4,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/scanner/v4/common.proto
 
diff --git a/generated/internalapi/scanner/v4/index_report.pb.go b/generated/internalapi/scanner/v4/index_report.pb.go
index 8ef70bab7f8ec..ef57844231a47 100644
--- a/generated/internalapi/scanner/v4/index_report.pb.go
+++ b/generated/internalapi/scanner/v4/index_report.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/scanner/v4/index_report.proto
 
diff --git a/generated/internalapi/scanner/v4/indexer_service.pb.go b/generated/internalapi/scanner/v4/indexer_service.pb.go
index 5febdad9a7344..aea3b37eed023 100644
--- a/generated/internalapi/scanner/v4/indexer_service.pb.go
+++ b/generated/internalapi/scanner/v4/indexer_service.pb.go
@@ -4,7 +4,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/scanner/v4/indexer_service.proto
 
diff --git a/generated/internalapi/scanner/v4/matcher_service.pb.go b/generated/internalapi/scanner/v4/matcher_service.pb.go
index 93368d7f63fa2..c3b614afc7077 100644
--- a/generated/internalapi/scanner/v4/matcher_service.pb.go
+++ b/generated/internalapi/scanner/v4/matcher_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/scanner/v4/matcher_service.proto
 
diff --git a/generated/internalapi/scanner/v4/vulnerability_report.pb.go b/generated/internalapi/scanner/v4/vulnerability_report.pb.go
index 3bd16abc49155..ffab5a0dbef8a 100644
--- a/generated/internalapi/scanner/v4/vulnerability_report.pb.go
+++ b/generated/internalapi/scanner/v4/vulnerability_report.pb.go
@@ -4,7 +4,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/scanner/v4/vulnerability_report.proto
 
diff --git a/generated/internalapi/sensor/admission_control.pb.go b/generated/internalapi/sensor/admission_control.pb.go
index c43f3c244cb34..c1adff451079a 100644
--- a/generated/internalapi/sensor/admission_control.pb.go
+++ b/generated/internalapi/sensor/admission_control.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/admission_control.proto
 
diff --git a/generated/internalapi/sensor/admission_control_iservice.pb.go b/generated/internalapi/sensor/admission_control_iservice.pb.go
index e01e909a96d3e..e9cb91ee552f6 100644
--- a/generated/internalapi/sensor/admission_control_iservice.pb.go
+++ b/generated/internalapi/sensor/admission_control_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/admission_control_iservice.proto
 
diff --git a/generated/internalapi/sensor/collector.pb.go b/generated/internalapi/sensor/collector.pb.go
index 2a95c1d7facd3..f9ef7f7c936e3 100644
--- a/generated/internalapi/sensor/collector.pb.go
+++ b/generated/internalapi/sensor/collector.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/collector.proto
 
diff --git a/generated/internalapi/sensor/collector_iservice.pb.go b/generated/internalapi/sensor/collector_iservice.pb.go
index 96efa3e0321b9..9d48eda3a6234 100644
--- a/generated/internalapi/sensor/collector_iservice.pb.go
+++ b/generated/internalapi/sensor/collector_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/collector_iservice.proto
 
diff --git a/generated/internalapi/sensor/compliance_iservice.pb.go b/generated/internalapi/sensor/compliance_iservice.pb.go
index 041c11c982e9e..fb1533932bca2 100644
--- a/generated/internalapi/sensor/compliance_iservice.pb.go
+++ b/generated/internalapi/sensor/compliance_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/compliance_iservice.proto
 
diff --git a/generated/internalapi/sensor/deployment_iservice.pb.go b/generated/internalapi/sensor/deployment_iservice.pb.go
index 82e9efadd2409..23963030dfb0e 100644
--- a/generated/internalapi/sensor/deployment_iservice.pb.go
+++ b/generated/internalapi/sensor/deployment_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/deployment_iservice.proto
 
diff --git a/generated/internalapi/sensor/fact.pb.go b/generated/internalapi/sensor/fact.pb.go
index 1c5fac5e74654..11d3811fbace7 100644
--- a/generated/internalapi/sensor/fact.pb.go
+++ b/generated/internalapi/sensor/fact.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/fact.proto
 
diff --git a/generated/internalapi/sensor/image_iservice.pb.go b/generated/internalapi/sensor/image_iservice.pb.go
index 59839e0540733..1827aa49de2f9 100644
--- a/generated/internalapi/sensor/image_iservice.pb.go
+++ b/generated/internalapi/sensor/image_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/image_iservice.proto
 
@@ -23,10 +23,11 @@ const (
 )
 
 type GetImageRequest struct {
-	state         protoimpl.MessageState  `protogen:"open.v1"`
-	Image         *storage.ContainerImage `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
-	Namespace     string                  `protobuf:"bytes,3,opt,name=namespace,proto3" json:"namespace,omitempty"`
-	ScanInline    bool                    `protobuf:"varint,2,opt,name=scan_inline,json=scanInline,proto3" json:"scan_inline,omitempty"`
+	state     protoimpl.MessageState  `protogen:"open.v1"`
+	Image     *storage.ContainerImage `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
+	Namespace string                  `protobuf:"bytes,3,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// Deprecated: Marked as deprecated in internalapi/sensor/image_iservice.proto.
+	ScanInline    bool `protobuf:"varint,2,opt,name=scan_inline,json=scanInline,proto3" json:"scan_inline,omitempty"` // always true; AC is the only client
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -75,6 +76,7 @@ func (x *GetImageRequest) GetNamespace() string {
 	return ""
 }
 
+// Deprecated: Marked as deprecated in internalapi/sensor/image_iservice.proto.
 func (x *GetImageRequest) GetScanInline() bool {
 	if x != nil {
 		return x.ScanInline
@@ -130,11 +132,11 @@ var File_internalapi_sensor_image_iservice_proto protoreflect.FileDescriptor
 
 const file_internalapi_sensor_image_iservice_proto_rawDesc = "" +
 	"\n" +
-	"'internalapi/sensor/image_iservice.proto\x12\x06sensor\x1a\x18storage/deployment.proto\x1a\x13storage/image.proto\"\x7f\n" +
+	"'internalapi/sensor/image_iservice.proto\x12\x06sensor\x1a\x18storage/deployment.proto\x1a\x13storage/image.proto\"\x83\x01\n" +
 	"\x0fGetImageRequest\x12-\n" +
 	"\x05image\x18\x01 \x01(\v2\x17.storage.ContainerImageR\x05image\x12\x1c\n" +
-	"\tnamespace\x18\x03 \x01(\tR\tnamespace\x12\x1f\n" +
-	"\vscan_inline\x18\x02 \x01(\bR\n" +
+	"\tnamespace\x18\x03 \x01(\tR\tnamespace\x12#\n" +
+	"\vscan_inline\x18\x02 \x01(\bB\x02\x18\x01R\n" +
 	"scanInline\"8\n" +
 	"\x10GetImageResponse\x12$\n" +
 	"\x05image\x18\x01 \x01(\v2\x0e.storage.ImageR\x05image2M\n" +
diff --git a/generated/internalapi/sensor/network_connection_info.pb.go b/generated/internalapi/sensor/network_connection_info.pb.go
index 1e4dea02732ec..80cb31835ed4b 100644
--- a/generated/internalapi/sensor/network_connection_info.pb.go
+++ b/generated/internalapi/sensor/network_connection_info.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/network_connection_info.proto
 
diff --git a/generated/internalapi/sensor/network_connection_iservice.pb.go b/generated/internalapi/sensor/network_connection_iservice.pb.go
index 832a4e7718f1a..205af81b2f734 100644
--- a/generated/internalapi/sensor/network_connection_iservice.pb.go
+++ b/generated/internalapi/sensor/network_connection_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/network_connection_iservice.proto
 
diff --git a/generated/internalapi/sensor/network_enums.pb.go b/generated/internalapi/sensor/network_enums.pb.go
index 745fdb6eca418..3e5af29aa0212 100644
--- a/generated/internalapi/sensor/network_enums.pb.go
+++ b/generated/internalapi/sensor/network_enums.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/network_enums.proto
 
diff --git a/generated/internalapi/sensor/sfa.pb.go b/generated/internalapi/sensor/sfa.pb.go
index 7e484946ff09a..5b692eb8ede3a 100644
--- a/generated/internalapi/sensor/sfa.pb.go
+++ b/generated/internalapi/sensor/sfa.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/sfa.proto
 
diff --git a/generated/internalapi/sensor/sfa_iservice.pb.go b/generated/internalapi/sensor/sfa_iservice.pb.go
index acbc88d078122..a0fe9781bdf8d 100644
--- a/generated/internalapi/sensor/sfa_iservice.pb.go
+++ b/generated/internalapi/sensor/sfa_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/sfa_iservice.proto
 
diff --git a/generated/internalapi/sensor/signal_iservice.pb.go b/generated/internalapi/sensor/signal_iservice.pb.go
index f719986c05bdf..a60cecc1da7e1 100644
--- a/generated/internalapi/sensor/signal_iservice.pb.go
+++ b/generated/internalapi/sensor/signal_iservice.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/sensor/signal_iservice.proto
 
diff --git a/generated/internalapi/virtualmachine/v1/index_report.pb.go b/generated/internalapi/virtualmachine/v1/index_report.pb.go
index 61269d35286d4..f82fea0df92c2 100644
--- a/generated/internalapi/virtualmachine/v1/index_report.pb.go
+++ b/generated/internalapi/virtualmachine/v1/index_report.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/virtualmachine/v1/index_report.proto
 
diff --git a/generated/internalapi/virtualmachine/v1/virtual_machine.pb.go b/generated/internalapi/virtualmachine/v1/virtual_machine.pb.go
index 5921d62ac5a53..a68ca4d0d3d13 100644
--- a/generated/internalapi/virtualmachine/v1/virtual_machine.pb.go
+++ b/generated/internalapi/virtualmachine/v1/virtual_machine.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/virtualmachine/v1/virtual_machine.proto
 
diff --git a/generated/internalapi/virtualmachine/v1/vm_service.pb.go b/generated/internalapi/virtualmachine/v1/vm_service.pb.go
index 247cb13a9b7f9..e209febc395c0 100644
--- a/generated/internalapi/virtualmachine/v1/vm_service.pb.go
+++ b/generated/internalapi/virtualmachine/v1/vm_service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/virtualmachine/v1/vm_service.proto
 
@@ -23,6 +23,55 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type RepoCPEMappingUpdatePath int32
+
+const (
+	RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED RepoCPEMappingUpdatePath = 0
+	RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR      RepoCPEMappingUpdatePath = 1
+	RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL         RepoCPEMappingUpdatePath = 2
+)
+
+// Enum value maps for RepoCPEMappingUpdatePath.
+var (
+	RepoCPEMappingUpdatePath_name = map[int32]string{
+		0: "REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED",
+		1: "REPO_CPE_MAPPING_UPDATE_PATH_SENSOR",
+		2: "REPO_CPE_MAPPING_UPDATE_PATH_URL",
+	}
+	RepoCPEMappingUpdatePath_value = map[string]int32{
+		"REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED": 0,
+		"REPO_CPE_MAPPING_UPDATE_PATH_SENSOR":      1,
+		"REPO_CPE_MAPPING_UPDATE_PATH_URL":         2,
+	}
+)
+
+func (x RepoCPEMappingUpdatePath) Enum() *RepoCPEMappingUpdatePath {
+	p := new(RepoCPEMappingUpdatePath)
+	*p = x
+	return p
+}
+
+func (x RepoCPEMappingUpdatePath) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (RepoCPEMappingUpdatePath) Descriptor() protoreflect.EnumDescriptor {
+	return file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes[0].Descriptor()
+}
+
+func (RepoCPEMappingUpdatePath) Type() protoreflect.EnumType {
+	return &file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes[0]
+}
+
+func (x RepoCPEMappingUpdatePath) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use RepoCPEMappingUpdatePath.Descriptor instead.
+func (RepoCPEMappingUpdatePath) EnumDescriptor() ([]byte, []int) {
+	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{0}
+}
+
 type ErrorCode int32
 
 const (
@@ -41,6 +90,10 @@ const (
 	ErrorCode_ERROR_CODE_REQUEST_TOO_LARGE ErrorCode = 5
 	// Agent is already serving another connection; retry after a backoff.
 	ErrorCode_ERROR_CODE_BUSY ErrorCode = 6
+	// No usable mapping yet; guest disk has not been scanned.
+	ErrorCode_ERROR_CODE_MAPPING_REQUIRED ErrorCode = 7
+	// SyncRepoCPEMapping rejected because updater is not Sensor-managed.
+	ErrorCode_ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED ErrorCode = 8
 )
 
 // Enum value maps for ErrorCode.
@@ -53,15 +106,19 @@ var (
 		4: "ERROR_CODE_MALFORMED_REQUEST",
 		5: "ERROR_CODE_REQUEST_TOO_LARGE",
 		6: "ERROR_CODE_BUSY",
+		7: "ERROR_CODE_MAPPING_REQUIRED",
+		8: "ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED",
 	}
 	ErrorCode_value = map[string]int32{
-		"ERROR_CODE_UNSPECIFIED":       0,
-		"ERROR_CODE_UNKNOWN_METHOD":    1,
-		"ERROR_CODE_NOT_READY":         2,
-		"ERROR_CODE_INTERNAL":          3,
-		"ERROR_CODE_MALFORMED_REQUEST": 4,
-		"ERROR_CODE_REQUEST_TOO_LARGE": 5,
-		"ERROR_CODE_BUSY":              6,
+		"ERROR_CODE_UNSPECIFIED":                0,
+		"ERROR_CODE_UNKNOWN_METHOD":             1,
+		"ERROR_CODE_NOT_READY":                  2,
+		"ERROR_CODE_INTERNAL":                   3,
+		"ERROR_CODE_MALFORMED_REQUEST":          4,
+		"ERROR_CODE_REQUEST_TOO_LARGE":          5,
+		"ERROR_CODE_BUSY":                       6,
+		"ERROR_CODE_MAPPING_REQUIRED":           7,
+		"ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED": 8,
 	}
 )
 
@@ -76,11 +133,11 @@ func (x ErrorCode) String() string {
 }
 
 func (ErrorCode) Descriptor() protoreflect.EnumDescriptor {
-	return file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes[0].Descriptor()
+	return file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes[1].Descriptor()
 }
 
 func (ErrorCode) Type() protoreflect.EnumType {
-	return &file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes[0]
+	return &file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes[1]
 }
 
 func (x ErrorCode) Number() protoreflect.EnumNumber {
@@ -89,7 +146,7 @@ func (x ErrorCode) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ErrorCode.Descriptor instead.
 func (ErrorCode) EnumDescriptor() ([]byte, []int) {
-	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{0}
+	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{1}
 }
 
 // VMServiceRequest is sent by Sensor to roxagent over a length-prefixed VSOCK frame.
@@ -100,6 +157,7 @@ type VMServiceRequest struct {
 	// Types that are valid to be assigned to Method:
 	//
 	//	*VMServiceRequest_GetReport
+	//	*VMServiceRequest_SyncRepoCpeMapping
 	Method        isVMServiceRequest_Method `protobuf_oneof:"method"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -158,6 +216,15 @@ func (x *VMServiceRequest) GetGetReport() *GetReportRequest {
 	return nil
 }
 
+func (x *VMServiceRequest) GetSyncRepoCpeMapping() *SyncRepoCPEMappingRequest {
+	if x != nil {
+		if x, ok := x.Method.(*VMServiceRequest_SyncRepoCpeMapping); ok {
+			return x.SyncRepoCpeMapping
+		}
+	}
+	return nil
+}
+
 type isVMServiceRequest_Method interface {
 	isVMServiceRequest_Method()
 }
@@ -166,8 +233,14 @@ type VMServiceRequest_GetReport struct {
 	GetReport *GetReportRequest `protobuf:"bytes,2,opt,name=get_report,json=getReport,proto3,oneof"`
 }
 
+type VMServiceRequest_SyncRepoCpeMapping struct {
+	SyncRepoCpeMapping *SyncRepoCPEMappingRequest `protobuf:"bytes,3,opt,name=sync_repo_cpe_mapping,json=syncRepoCpeMapping,proto3,oneof"`
+}
+
 func (*VMServiceRequest_GetReport) isVMServiceRequest_Method() {}
 
+func (*VMServiceRequest_SyncRepoCpeMapping) isVMServiceRequest_Method() {}
+
 // VMServiceResponse is returned by roxagent. Contains either a successful result
 // or an ErrorResponse, never both.
 type VMServiceResponse struct {
@@ -177,6 +250,7 @@ type VMServiceResponse struct {
 	//
 	//	*VMServiceResponse_GetReport
 	//	*VMServiceResponse_Error
+	//	*VMServiceResponse_SyncRepoCpeMapping
 	Result        isVMServiceResponse_Result `protobuf_oneof:"result"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -244,6 +318,15 @@ func (x *VMServiceResponse) GetError() *ErrorResponse {
 	return nil
 }
 
+func (x *VMServiceResponse) GetSyncRepoCpeMapping() *SyncRepoCPEMappingResponse {
+	if x != nil {
+		if x, ok := x.Result.(*VMServiceResponse_SyncRepoCpeMapping); ok {
+			return x.SyncRepoCpeMapping
+		}
+	}
+	return nil
+}
+
 type isVMServiceResponse_Result interface {
 	isVMServiceResponse_Result()
 }
@@ -256,10 +339,16 @@ type VMServiceResponse_Error struct {
 	Error *ErrorResponse `protobuf:"bytes,3,opt,name=error,proto3,oneof"`
 }
 
+type VMServiceResponse_SyncRepoCpeMapping struct {
+	SyncRepoCpeMapping *SyncRepoCPEMappingResponse `protobuf:"bytes,4,opt,name=sync_repo_cpe_mapping,json=syncRepoCpeMapping,proto3,oneof"`
+}
+
 func (*VMServiceResponse_GetReport) isVMServiceResponse_Result() {}
 
 func (*VMServiceResponse_Error) isVMServiceResponse_Result() {}
 
+func (*VMServiceResponse_SyncRepoCpeMapping) isVMServiceResponse_Result() {}
+
 type RequestMeta struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Correlation ID (UUID) for tracing across Sensor and agent logs.
@@ -330,25 +419,22 @@ type ResponseMeta struct {
 	AgentVersion string `protobuf:"bytes,1,opt,name=agent_version,json=agentVersion,proto3" json:"agent_version,omitempty"`
 	// When the cached scan report was produced by the scanner.
 	ReportGeneratedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=report_generated_at,json=reportGeneratedAt,proto3" json:"report_generated_at,omitempty"`
-	// Monotonic counter incremented on each rescan; resets to 1 on agent restart.
-	// Sensor uses this for deduplication (see ADR-0006 §2, "Generation counter").
-	ReportGeneration uint32 `protobuf:"varint,3,opt,name=report_generation,json=reportGeneration,proto3" json:"report_generation,omitempty"`
+	// XXH64 of the cached IndexReport and facts. Identical content keeps the
+	// same token; Sensor still forces a full report with an empty last_known_token.
+	ReportToken string `protobuf:"bytes,3,opt,name=report_token,json=reportToken,proto3" json:"report_token,omitempty"`
 	// Methods this agent accepts (e.g. ["get_report"]). Doubles as capability
 	// discovery — no separate handshake needed. See ADR-0006 §2.
 	SupportedMethods []string `protobuf:"bytes,4,rep,name=supported_methods,json=supportedMethods,proto3" json:"supported_methods,omitempty"`
 	// VM metadata from the scan (detected_os, os_version, activation_status, etc.).
 	// Future: may also carry roxagent operational metrics.
 	Facts map[string]string `protobuf:"bytes,5,rep,name=facts,proto3" json:"facts,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	// Opaque value seeded once per agent process lifetime (random/time-derived),
-	// held in memory only, never persisted to VM disk. Changes on every agent
-	// restart, unlike report_generation which resets to 1. Sensor should treat
-	// an epoch mismatch as "changed" regardless of report_generation, to avoid
-	// false-negative dedup when a restarted agent's reset generation coincides
-	// with Sensor's cached value for that VM. Zero means the agent predates this
-	// field; Sensor falls back to generation-only comparison in that case.
-	Epoch         uint32 `protobuf:"varint,6,opt,name=epoch,proto3" json:"epoch,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	// XXH64 hex of active mapping; empty string means none. optional so absence
+	// means an older agent that does not report mapping metadata.
+	RepoCpeMappingHash *string `protobuf:"bytes,6,opt,name=repo_cpe_mapping_hash,json=repoCpeMappingHash,proto3,oneof" json:"repo_cpe_mapping_hash,omitempty"`
+	// SENSOR or URL only; UNSPECIFIED means Sensor must not sync.
+	RepoCpeMappingUpdatePath *RepoCPEMappingUpdatePath `protobuf:"varint,7,opt,name=repo_cpe_mapping_update_path,json=repoCpeMappingUpdatePath,proto3,enum=virtualmachine.v1.RepoCPEMappingUpdatePath,oneof" json:"repo_cpe_mapping_update_path,omitempty"`
+	unknownFields            protoimpl.UnknownFields
+	sizeCache                protoimpl.SizeCache
 }
 
 func (x *ResponseMeta) Reset() {
@@ -395,11 +481,11 @@ func (x *ResponseMeta) GetReportGeneratedAt() *timestamppb.Timestamp {
 	return nil
 }
 
-func (x *ResponseMeta) GetReportGeneration() uint32 {
+func (x *ResponseMeta) GetReportToken() string {
 	if x != nil {
-		return x.ReportGeneration
+		return x.ReportToken
 	}
-	return 0
+	return ""
 }
 
 func (x *ResponseMeta) GetSupportedMethods() []string {
@@ -416,29 +502,27 @@ func (x *ResponseMeta) GetFacts() map[string]string {
 	return nil
 }
 
-func (x *ResponseMeta) GetEpoch() uint32 {
-	if x != nil {
-		return x.Epoch
+func (x *ResponseMeta) GetRepoCpeMappingHash() string {
+	if x != nil && x.RepoCpeMappingHash != nil {
+		return *x.RepoCpeMappingHash
+	}
+	return ""
+}
+
+func (x *ResponseMeta) GetRepoCpeMappingUpdatePath() RepoCPEMappingUpdatePath {
+	if x != nil && x.RepoCpeMappingUpdatePath != nil {
+		return *x.RepoCpeMappingUpdatePath
 	}
-	return 0
+	return RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED
 }
 
 type GetReportRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// Generation last observed by Sensor for this VM (see ResponseMeta.report_generation).
-	// Use 0 when no prior generation is known, which forces a full report. See
-	// ADR-0006 §2, "Generation counter", for how the agent uses this value.
-	LastKnownGeneration uint32 `protobuf:"varint,1,opt,name=last_known_generation,json=lastKnownGeneration,proto3" json:"last_known_generation,omitempty"`
-	// Epoch last observed by Sensor for this VM (see ResponseMeta.epoch). 0 means
-	// unknown (first-ever request for this VM, or a Sensor build that predates
-	// this field) -- the agent should ignore epoch and fall back to
-	// generation-only comparison, exactly as if this field did not exist. This
-	// lets the agent detect a restart-coincidence false match (last_known_generation
-	// happens to equal the post-restart generation) and serve the full report in
-	// the same round trip, instead of Sensor needing a second, forced request.
-	KnownEpoch    uint32 `protobuf:"varint,2,opt,name=known_epoch,json=knownEpoch,proto3" json:"known_epoch,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	// Token last observed by Sensor for this VM (see ResponseMeta.report_token).
+	// Empty when none is known, which forces a full report.
+	LastKnownToken string `protobuf:"bytes,1,opt,name=last_known_token,json=lastKnownToken,proto3" json:"last_known_token,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *GetReportRequest) Reset() {
@@ -471,26 +555,19 @@ func (*GetReportRequest) Descriptor() ([]byte, []int) {
 	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{4}
 }
 
-func (x *GetReportRequest) GetLastKnownGeneration() uint32 {
-	if x != nil {
-		return x.LastKnownGeneration
-	}
-	return 0
-}
-
-func (x *GetReportRequest) GetKnownEpoch() uint32 {
+func (x *GetReportRequest) GetLastKnownToken() string {
 	if x != nil {
-		return x.KnownEpoch
+		return x.LastKnownToken
 	}
-	return 0
+	return ""
 }
 
 type GetReportResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// Full scan report; set when generation changed or forced (generation 0).
+	// Full scan report; set when the content hash changed or last_known_token is empty.
 	IndexReport *v4.IndexReport `protobuf:"bytes,1,opt,name=index_report,json=indexReport,proto3" json:"index_report,omitempty"`
-	// True when agent's generation matches last_known_generation; index_report
-	// is nil in this case. Sensor may still force a refresh after 4 h (ADR-0006 §2).
+	// True when the agent's token matches last_known_token; index_report is nil.
+	// Sensor may still force a refresh after 4 h with an empty last_known_token.
 	Unchanged     bool `protobuf:"varint,2,opt,name=unchanged,proto3" json:"unchanged,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -540,6 +617,95 @@ func (x *GetReportResponse) GetUnchanged() bool {
 	return false
 }
 
+type SyncRepoCPEMappingRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Mapping       []byte                 `protobuf:"bytes,1,opt,name=mapping,proto3" json:"mapping,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SyncRepoCPEMappingRequest) Reset() {
+	*x = SyncRepoCPEMappingRequest{}
+	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SyncRepoCPEMappingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SyncRepoCPEMappingRequest) ProtoMessage() {}
+
+func (x *SyncRepoCPEMappingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SyncRepoCPEMappingRequest.ProtoReflect.Descriptor instead.
+func (*SyncRepoCPEMappingRequest) Descriptor() ([]byte, []int) {
+	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *SyncRepoCPEMappingRequest) GetMapping() []byte {
+	if x != nil {
+		return x.Mapping
+	}
+	return nil
+}
+
+type SyncRepoCPEMappingResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// True when the agent accepted new content (applied or staged).
+	Updated       bool `protobuf:"varint,1,opt,name=updated,proto3" json:"updated,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SyncRepoCPEMappingResponse) Reset() {
+	*x = SyncRepoCPEMappingResponse{}
+	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SyncRepoCPEMappingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SyncRepoCPEMappingResponse) ProtoMessage() {}
+
+func (x *SyncRepoCPEMappingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SyncRepoCPEMappingResponse.ProtoReflect.Descriptor instead.
+func (*SyncRepoCPEMappingResponse) Descriptor() ([]byte, []int) {
+	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *SyncRepoCPEMappingResponse) GetUpdated() bool {
+	if x != nil {
+		return x.Updated
+	}
+	return false
+}
+
 type ErrorResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	Code  ErrorCode              `protobuf:"varint,1,opt,name=code,proto3,enum=virtualmachine.v1.ErrorCode" json:"code,omitempty"`
@@ -553,7 +719,7 @@ type ErrorResponse struct {
 
 func (x *ErrorResponse) Reset() {
 	*x = ErrorResponse{}
-	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[6]
+	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -565,7 +731,7 @@ func (x *ErrorResponse) String() string {
 func (*ErrorResponse) ProtoMessage() {}
 
 func (x *ErrorResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[6]
+	mi := &file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -578,7 +744,7 @@ func (x *ErrorResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ErrorResponse.ProtoReflect.Descriptor instead.
 func (*ErrorResponse) Descriptor() ([]byte, []int) {
-	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{6}
+	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ErrorResponse) GetCode() ErrorCode {
@@ -606,17 +772,19 @@ var File_internalapi_virtualmachine_v1_vm_service_proto protoreflect.FileDescrip
 
 const file_internalapi_virtualmachine_v1_vm_service_proto_rawDesc = "" +
 	"\n" +
-	".internalapi/virtualmachine/v1/vm_service.proto\x12\x11virtualmachine.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a)internalapi/scanner/v4/index_report.proto\"\x96\x01\n" +
+	".internalapi/virtualmachine/v1/vm_service.proto\x12\x11virtualmachine.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a)internalapi/scanner/v4/index_report.proto\"\xf9\x01\n" +
 	"\x10VMServiceRequest\x122\n" +
 	"\x04meta\x18\x01 \x01(\v2\x1e.virtualmachine.v1.RequestMetaR\x04meta\x12D\n" +
 	"\n" +
-	"get_report\x18\x02 \x01(\v2#.virtualmachine.v1.GetReportRequestH\x00R\tgetReportB\b\n" +
-	"\x06method\"\xd3\x01\n" +
+	"get_report\x18\x02 \x01(\v2#.virtualmachine.v1.GetReportRequestH\x00R\tgetReport\x12a\n" +
+	"\x15sync_repo_cpe_mapping\x18\x03 \x01(\v2,.virtualmachine.v1.SyncRepoCPEMappingRequestH\x00R\x12syncRepoCpeMappingB\b\n" +
+	"\x06method\"\xb7\x02\n" +
 	"\x11VMServiceResponse\x123\n" +
 	"\x04meta\x18\x01 \x01(\v2\x1f.virtualmachine.v1.ResponseMetaR\x04meta\x12E\n" +
 	"\n" +
 	"get_report\x18\x02 \x01(\v2$.virtualmachine.v1.GetReportResponseH\x00R\tgetReport\x128\n" +
-	"\x05error\x18\x03 \x01(\v2 .virtualmachine.v1.ErrorResponseH\x00R\x05errorB\b\n" +
+	"\x05error\x18\x03 \x01(\v2 .virtualmachine.v1.ErrorResponseH\x00R\x05error\x12b\n" +
+	"\x15sync_repo_cpe_mapping\x18\x04 \x01(\v2-.virtualmachine.v1.SyncRepoCPEMappingResponseH\x00R\x12syncRepoCpeMappingB\b\n" +
 	"\x06result\"\xcb\x01\n" +
 	"\vRequestMeta\x12\x1d\n" +
 	"\n" +
@@ -626,32 +794,41 @@ const file_internalapi_virtualmachine_v1_vm_service_proto_rawDesc = "" +
 	"\n" +
 	"FactsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xeb\x02\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xb0\x04\n" +
 	"\fResponseMeta\x12#\n" +
 	"\ragent_version\x18\x01 \x01(\tR\fagentVersion\x12J\n" +
-	"\x13report_generated_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\x11reportGeneratedAt\x12+\n" +
-	"\x11report_generation\x18\x03 \x01(\rR\x10reportGeneration\x12+\n" +
+	"\x13report_generated_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\x11reportGeneratedAt\x12!\n" +
+	"\freport_token\x18\x03 \x01(\tR\vreportToken\x12+\n" +
 	"\x11supported_methods\x18\x04 \x03(\tR\x10supportedMethods\x12@\n" +
-	"\x05facts\x18\x05 \x03(\v2*.virtualmachine.v1.ResponseMeta.FactsEntryR\x05facts\x12\x14\n" +
-	"\x05epoch\x18\x06 \x01(\rR\x05epoch\x1a8\n" +
+	"\x05facts\x18\x05 \x03(\v2*.virtualmachine.v1.ResponseMeta.FactsEntryR\x05facts\x126\n" +
+	"\x15repo_cpe_mapping_hash\x18\x06 \x01(\tH\x00R\x12repoCpeMappingHash\x88\x01\x01\x12p\n" +
+	"\x1crepo_cpe_mapping_update_path\x18\a \x01(\x0e2+.virtualmachine.v1.RepoCPEMappingUpdatePathH\x01R\x18repoCpeMappingUpdatePath\x88\x01\x01\x1a8\n" +
 	"\n" +
 	"FactsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"g\n" +
-	"\x10GetReportRequest\x122\n" +
-	"\x15last_known_generation\x18\x01 \x01(\rR\x13lastKnownGeneration\x12\x1f\n" +
-	"\vknown_epoch\x18\x02 \x01(\rR\n" +
-	"knownEpoch\"m\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x18\n" +
+	"\x16_repo_cpe_mapping_hashB\x1f\n" +
+	"\x1d_repo_cpe_mapping_update_path\"<\n" +
+	"\x10GetReportRequest\x12(\n" +
+	"\x10last_known_token\x18\x01 \x01(\tR\x0elastKnownToken\"m\n" +
 	"\x11GetReportResponse\x12:\n" +
 	"\findex_report\x18\x01 \x01(\v2\x17.scanner.v4.IndexReportR\vindexReport\x12\x1c\n" +
-	"\tunchanged\x18\x02 \x01(\bR\tunchanged\"\xe0\x01\n" +
+	"\tunchanged\x18\x02 \x01(\bR\tunchanged\"5\n" +
+	"\x19SyncRepoCPEMappingRequest\x12\x18\n" +
+	"\amapping\x18\x01 \x01(\fR\amapping\"6\n" +
+	"\x1aSyncRepoCPEMappingResponse\x12\x18\n" +
+	"\aupdated\x18\x01 \x01(\bR\aupdated\"\xe0\x01\n" +
 	"\rErrorResponse\x120\n" +
 	"\x04code\x18\x01 \x01(\x0e2\x1c.virtualmachine.v1.ErrorCodeR\x04code\x12\x18\n" +
 	"\amessage\x18\x02 \x01(\tR\amessage\x12G\n" +
 	"\adetails\x18\x03 \x03(\v2-.virtualmachine.v1.ErrorResponse.DetailsEntryR\adetails\x1a:\n" +
 	"\fDetailsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01*\xd2\x01\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01*\x97\x01\n" +
+	"\x18RepoCPEMappingUpdatePath\x12,\n" +
+	"(REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED\x10\x00\x12'\n" +
+	"#REPO_CPE_MAPPING_UPDATE_PATH_SENSOR\x10\x01\x12$\n" +
+	" REPO_CPE_MAPPING_UPDATE_PATH_URL\x10\x02*\x9e\x02\n" +
 	"\tErrorCode\x12\x1a\n" +
 	"\x16ERROR_CODE_UNSPECIFIED\x10\x00\x12\x1d\n" +
 	"\x19ERROR_CODE_UNKNOWN_METHOD\x10\x01\x12\x18\n" +
@@ -659,7 +836,9 @@ const file_internalapi_virtualmachine_v1_vm_service_proto_rawDesc = "" +
 	"\x13ERROR_CODE_INTERNAL\x10\x03\x12 \n" +
 	"\x1cERROR_CODE_MALFORMED_REQUEST\x10\x04\x12 \n" +
 	"\x1cERROR_CODE_REQUEST_TOO_LARGE\x10\x05\x12\x13\n" +
-	"\x0fERROR_CODE_BUSY\x10\x06B$Z\"./internalapi/virtualmachine/v1;v1b\x06proto3"
+	"\x0fERROR_CODE_BUSY\x10\x06\x12\x1f\n" +
+	"\x1bERROR_CODE_MAPPING_REQUIRED\x10\a\x12)\n" +
+	"%ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED\x10\bB$Z\"./internalapi/virtualmachine/v1;v1b\x06proto3"
 
 var (
 	file_internalapi_virtualmachine_v1_vm_service_proto_rawDescOnce sync.Once
@@ -673,40 +852,46 @@ func file_internalapi_virtualmachine_v1_vm_service_proto_rawDescGZIP() []byte {
 	return file_internalapi_virtualmachine_v1_vm_service_proto_rawDescData
 }
 
-var file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_internalapi_virtualmachine_v1_vm_service_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
 var file_internalapi_virtualmachine_v1_vm_service_proto_goTypes = []any{
-	(ErrorCode)(0),                // 0: virtualmachine.v1.ErrorCode
-	(*VMServiceRequest)(nil),      // 1: virtualmachine.v1.VMServiceRequest
-	(*VMServiceResponse)(nil),     // 2: virtualmachine.v1.VMServiceResponse
-	(*RequestMeta)(nil),           // 3: virtualmachine.v1.RequestMeta
-	(*ResponseMeta)(nil),          // 4: virtualmachine.v1.ResponseMeta
-	(*GetReportRequest)(nil),      // 5: virtualmachine.v1.GetReportRequest
-	(*GetReportResponse)(nil),     // 6: virtualmachine.v1.GetReportResponse
-	(*ErrorResponse)(nil),         // 7: virtualmachine.v1.ErrorResponse
-	nil,                           // 8: virtualmachine.v1.RequestMeta.FactsEntry
-	nil,                           // 9: virtualmachine.v1.ResponseMeta.FactsEntry
-	nil,                           // 10: virtualmachine.v1.ErrorResponse.DetailsEntry
-	(*timestamppb.Timestamp)(nil), // 11: google.protobuf.Timestamp
-	(*v4.IndexReport)(nil),        // 12: scanner.v4.IndexReport
+	(RepoCPEMappingUpdatePath)(0),      // 0: virtualmachine.v1.RepoCPEMappingUpdatePath
+	(ErrorCode)(0),                     // 1: virtualmachine.v1.ErrorCode
+	(*VMServiceRequest)(nil),           // 2: virtualmachine.v1.VMServiceRequest
+	(*VMServiceResponse)(nil),          // 3: virtualmachine.v1.VMServiceResponse
+	(*RequestMeta)(nil),                // 4: virtualmachine.v1.RequestMeta
+	(*ResponseMeta)(nil),               // 5: virtualmachine.v1.ResponseMeta
+	(*GetReportRequest)(nil),           // 6: virtualmachine.v1.GetReportRequest
+	(*GetReportResponse)(nil),          // 7: virtualmachine.v1.GetReportResponse
+	(*SyncRepoCPEMappingRequest)(nil),  // 8: virtualmachine.v1.SyncRepoCPEMappingRequest
+	(*SyncRepoCPEMappingResponse)(nil), // 9: virtualmachine.v1.SyncRepoCPEMappingResponse
+	(*ErrorResponse)(nil),              // 10: virtualmachine.v1.ErrorResponse
+	nil,                                // 11: virtualmachine.v1.RequestMeta.FactsEntry
+	nil,                                // 12: virtualmachine.v1.ResponseMeta.FactsEntry
+	nil,                                // 13: virtualmachine.v1.ErrorResponse.DetailsEntry
+	(*timestamppb.Timestamp)(nil),      // 14: google.protobuf.Timestamp
+	(*v4.IndexReport)(nil),             // 15: scanner.v4.IndexReport
 }
 var file_internalapi_virtualmachine_v1_vm_service_proto_depIdxs = []int32{
-	3,  // 0: virtualmachine.v1.VMServiceRequest.meta:type_name -> virtualmachine.v1.RequestMeta
-	5,  // 1: virtualmachine.v1.VMServiceRequest.get_report:type_name -> virtualmachine.v1.GetReportRequest
-	4,  // 2: virtualmachine.v1.VMServiceResponse.meta:type_name -> virtualmachine.v1.ResponseMeta
-	6,  // 3: virtualmachine.v1.VMServiceResponse.get_report:type_name -> virtualmachine.v1.GetReportResponse
-	7,  // 4: virtualmachine.v1.VMServiceResponse.error:type_name -> virtualmachine.v1.ErrorResponse
-	8,  // 5: virtualmachine.v1.RequestMeta.facts:type_name -> virtualmachine.v1.RequestMeta.FactsEntry
-	11, // 6: virtualmachine.v1.ResponseMeta.report_generated_at:type_name -> google.protobuf.Timestamp
-	9,  // 7: virtualmachine.v1.ResponseMeta.facts:type_name -> virtualmachine.v1.ResponseMeta.FactsEntry
-	12, // 8: virtualmachine.v1.GetReportResponse.index_report:type_name -> scanner.v4.IndexReport
-	0,  // 9: virtualmachine.v1.ErrorResponse.code:type_name -> virtualmachine.v1.ErrorCode
-	10, // 10: virtualmachine.v1.ErrorResponse.details:type_name -> virtualmachine.v1.ErrorResponse.DetailsEntry
-	11, // [11:11] is the sub-list for method output_type
-	11, // [11:11] is the sub-list for method input_type
-	11, // [11:11] is the sub-list for extension type_name
-	11, // [11:11] is the sub-list for extension extendee
-	0,  // [0:11] is the sub-list for field type_name
+	4,  // 0: virtualmachine.v1.VMServiceRequest.meta:type_name -> virtualmachine.v1.RequestMeta
+	6,  // 1: virtualmachine.v1.VMServiceRequest.get_report:type_name -> virtualmachine.v1.GetReportRequest
+	8,  // 2: virtualmachine.v1.VMServiceRequest.sync_repo_cpe_mapping:type_name -> virtualmachine.v1.SyncRepoCPEMappingRequest
+	5,  // 3: virtualmachine.v1.VMServiceResponse.meta:type_name -> virtualmachine.v1.ResponseMeta
+	7,  // 4: virtualmachine.v1.VMServiceResponse.get_report:type_name -> virtualmachine.v1.GetReportResponse
+	10, // 5: virtualmachine.v1.VMServiceResponse.error:type_name -> virtualmachine.v1.ErrorResponse
+	9,  // 6: virtualmachine.v1.VMServiceResponse.sync_repo_cpe_mapping:type_name -> virtualmachine.v1.SyncRepoCPEMappingResponse
+	11, // 7: virtualmachine.v1.RequestMeta.facts:type_name -> virtualmachine.v1.RequestMeta.FactsEntry
+	14, // 8: virtualmachine.v1.ResponseMeta.report_generated_at:type_name -> google.protobuf.Timestamp
+	12, // 9: virtualmachine.v1.ResponseMeta.facts:type_name -> virtualmachine.v1.ResponseMeta.FactsEntry
+	0,  // 10: virtualmachine.v1.ResponseMeta.repo_cpe_mapping_update_path:type_name -> virtualmachine.v1.RepoCPEMappingUpdatePath
+	15, // 11: virtualmachine.v1.GetReportResponse.index_report:type_name -> scanner.v4.IndexReport
+	1,  // 12: virtualmachine.v1.ErrorResponse.code:type_name -> virtualmachine.v1.ErrorCode
+	13, // 13: virtualmachine.v1.ErrorResponse.details:type_name -> virtualmachine.v1.ErrorResponse.DetailsEntry
+	14, // [14:14] is the sub-list for method output_type
+	14, // [14:14] is the sub-list for method input_type
+	14, // [14:14] is the sub-list for extension type_name
+	14, // [14:14] is the sub-list for extension extendee
+	0,  // [0:14] is the sub-list for field type_name
 }
 
 func init() { file_internalapi_virtualmachine_v1_vm_service_proto_init() }
@@ -716,18 +901,21 @@ func file_internalapi_virtualmachine_v1_vm_service_proto_init() {
 	}
 	file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[0].OneofWrappers = []any{
 		(*VMServiceRequest_GetReport)(nil),
+		(*VMServiceRequest_SyncRepoCpeMapping)(nil),
 	}
 	file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[1].OneofWrappers = []any{
 		(*VMServiceResponse_GetReport)(nil),
 		(*VMServiceResponse_Error)(nil),
+		(*VMServiceResponse_SyncRepoCpeMapping)(nil),
 	}
+	file_internalapi_virtualmachine_v1_vm_service_proto_msgTypes[3].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_internalapi_virtualmachine_v1_vm_service_proto_rawDesc), len(file_internalapi_virtualmachine_v1_vm_service_proto_rawDesc)),
-			NumEnums:      1,
-			NumMessages:   10,
+			NumEnums:      2,
+			NumMessages:   12,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/generated/internalapi/virtualmachine/v1/vm_service_vtproto.pb.go b/generated/internalapi/virtualmachine/v1/vm_service_vtproto.pb.go
index db84d131c4430..71813d28e9c49 100644
--- a/generated/internalapi/virtualmachine/v1/vm_service_vtproto.pb.go
+++ b/generated/internalapi/virtualmachine/v1/vm_service_vtproto.pb.go
@@ -54,6 +54,15 @@ func (m *VMServiceRequest_GetReport) CloneVT() isVMServiceRequest_Method {
 	return r
 }
 
+func (m *VMServiceRequest_SyncRepoCpeMapping) CloneVT() isVMServiceRequest_Method {
+	if m == nil {
+		return (*VMServiceRequest_SyncRepoCpeMapping)(nil)
+	}
+	r := new(VMServiceRequest_SyncRepoCpeMapping)
+	r.SyncRepoCpeMapping = m.SyncRepoCpeMapping.CloneVT()
+	return r
+}
+
 func (m *VMServiceResponse) CloneVT() *VMServiceResponse {
 	if m == nil {
 		return (*VMServiceResponse)(nil)
@@ -94,6 +103,15 @@ func (m *VMServiceResponse_Error) CloneVT() isVMServiceResponse_Result {
 	return r
 }
 
+func (m *VMServiceResponse_SyncRepoCpeMapping) CloneVT() isVMServiceResponse_Result {
+	if m == nil {
+		return (*VMServiceResponse_SyncRepoCpeMapping)(nil)
+	}
+	r := new(VMServiceResponse_SyncRepoCpeMapping)
+	r.SyncRepoCpeMapping = m.SyncRepoCpeMapping.CloneVT()
+	return r
+}
+
 func (m *RequestMeta) CloneVT() *RequestMeta {
 	if m == nil {
 		return (*RequestMeta)(nil)
@@ -130,8 +148,7 @@ func (m *ResponseMeta) CloneVT() *ResponseMeta {
 	r := new(ResponseMeta)
 	r.AgentVersion = m.AgentVersion
 	r.ReportGeneratedAt = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.ReportGeneratedAt).CloneVT())
-	r.ReportGeneration = m.ReportGeneration
-	r.Epoch = m.Epoch
+	r.ReportToken = m.ReportToken
 	if rhs := m.SupportedMethods; rhs != nil {
 		tmpContainer := make([]string, len(rhs))
 		copy(tmpContainer, rhs)
@@ -144,6 +161,14 @@ func (m *ResponseMeta) CloneVT() *ResponseMeta {
 		}
 		r.Facts = tmpContainer
 	}
+	if rhs := m.RepoCpeMappingHash; rhs != nil {
+		tmpVal := *rhs
+		r.RepoCpeMappingHash = &tmpVal
+	}
+	if rhs := m.RepoCpeMappingUpdatePath; rhs != nil {
+		tmpVal := *rhs
+		r.RepoCpeMappingUpdatePath = &tmpVal
+	}
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -160,8 +185,7 @@ func (m *GetReportRequest) CloneVT() *GetReportRequest {
 		return (*GetReportRequest)(nil)
 	}
 	r := new(GetReportRequest)
-	r.LastKnownGeneration = m.LastKnownGeneration
-	r.KnownEpoch = m.KnownEpoch
+	r.LastKnownToken = m.LastKnownToken
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -197,6 +221,44 @@ func (m *GetReportResponse) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *SyncRepoCPEMappingRequest) CloneVT() *SyncRepoCPEMappingRequest {
+	if m == nil {
+		return (*SyncRepoCPEMappingRequest)(nil)
+	}
+	r := new(SyncRepoCPEMappingRequest)
+	if rhs := m.Mapping; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Mapping = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SyncRepoCPEMappingRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SyncRepoCPEMappingResponse) CloneVT() *SyncRepoCPEMappingResponse {
+	if m == nil {
+		return (*SyncRepoCPEMappingResponse)(nil)
+	}
+	r := new(SyncRepoCPEMappingResponse)
+	r.Updated = m.Updated
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SyncRepoCPEMappingResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
 func (m *ErrorResponse) CloneVT() *ErrorResponse {
 	if m == nil {
 		return (*ErrorResponse)(nil)
@@ -278,6 +340,31 @@ func (this *VMServiceRequest_GetReport) EqualVT(thatIface isVMServiceRequest_Met
 	return true
 }
 
+func (this *VMServiceRequest_SyncRepoCpeMapping) EqualVT(thatIface isVMServiceRequest_Method) bool {
+	that, ok := thatIface.(*VMServiceRequest_SyncRepoCpeMapping)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.SyncRepoCpeMapping, that.SyncRepoCpeMapping; p != q {
+		if p == nil {
+			p = &SyncRepoCPEMappingRequest{}
+		}
+		if q == nil {
+			q = &SyncRepoCPEMappingRequest{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *VMServiceResponse) EqualVT(that *VMServiceResponse) bool {
 	if this == that {
 		return true
@@ -359,6 +446,31 @@ func (this *VMServiceResponse_Error) EqualVT(thatIface isVMServiceResponse_Resul
 	return true
 }
 
+func (this *VMServiceResponse_SyncRepoCpeMapping) EqualVT(thatIface isVMServiceResponse_Result) bool {
+	that, ok := thatIface.(*VMServiceResponse_SyncRepoCpeMapping)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.SyncRepoCpeMapping, that.SyncRepoCpeMapping; p != q {
+		if p == nil {
+			p = &SyncRepoCPEMappingResponse{}
+		}
+		if q == nil {
+			q = &SyncRepoCPEMappingResponse{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *RequestMeta) EqualVT(that *RequestMeta) bool {
 	if this == that {
 		return true
@@ -411,7 +523,7 @@ func (this *ResponseMeta) EqualVT(that *ResponseMeta) bool {
 	if !(*timestamppb1.Timestamp)(this.ReportGeneratedAt).EqualVT((*timestamppb1.Timestamp)(that.ReportGeneratedAt)) {
 		return false
 	}
-	if this.ReportGeneration != that.ReportGeneration {
+	if this.ReportToken != that.ReportToken {
 		return false
 	}
 	if len(this.SupportedMethods) != len(that.SupportedMethods) {
@@ -435,7 +547,10 @@ func (this *ResponseMeta) EqualVT(that *ResponseMeta) bool {
 			return false
 		}
 	}
-	if this.Epoch != that.Epoch {
+	if p, q := this.RepoCpeMappingHash, that.RepoCpeMappingHash; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.RepoCpeMappingUpdatePath, that.RepoCpeMappingUpdatePath; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
 		return false
 	}
 	return string(this.unknownFields) == string(that.unknownFields)
@@ -454,10 +569,7 @@ func (this *GetReportRequest) EqualVT(that *GetReportRequest) bool {
 	} else if this == nil || that == nil {
 		return false
 	}
-	if this.LastKnownGeneration != that.LastKnownGeneration {
-		return false
-	}
-	if this.KnownEpoch != that.KnownEpoch {
+	if this.LastKnownToken != that.LastKnownToken {
 		return false
 	}
 	return string(this.unknownFields) == string(that.unknownFields)
@@ -496,6 +608,44 @@ func (this *GetReportResponse) EqualMessageVT(thatMsg proto.Message) bool {
 	}
 	return this.EqualVT(that)
 }
+func (this *SyncRepoCPEMappingRequest) EqualVT(that *SyncRepoCPEMappingRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Mapping) != string(that.Mapping) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SyncRepoCPEMappingRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SyncRepoCPEMappingRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SyncRepoCPEMappingResponse) EqualVT(that *SyncRepoCPEMappingResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Updated != that.Updated {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SyncRepoCPEMappingResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SyncRepoCPEMappingResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
 func (this *ErrorResponse) EqualVT(that *ErrorResponse) bool {
 	if this == that {
 		return true
@@ -605,6 +755,29 @@ func (m *VMServiceRequest_GetReport) MarshalToSizedBufferVT(dAtA []byte) (int, e
 	}
 	return len(dAtA) - i, nil
 }
+func (m *VMServiceRequest_SyncRepoCpeMapping) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *VMServiceRequest_SyncRepoCpeMapping) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SyncRepoCpeMapping != nil {
+		size, err := m.SyncRepoCpeMapping.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
+}
 func (m *VMServiceResponse) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -703,6 +876,29 @@ func (m *VMServiceResponse_Error) MarshalToSizedBufferVT(dAtA []byte) (int, erro
 	}
 	return len(dAtA) - i, nil
 }
+func (m *VMServiceResponse_SyncRepoCpeMapping) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *VMServiceResponse_SyncRepoCpeMapping) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SyncRepoCpeMapping != nil {
+		size, err := m.SyncRepoCpeMapping.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x22
+	}
+	return len(dAtA) - i, nil
+}
 func (m *RequestMeta) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -801,10 +997,17 @@ func (m *ResponseMeta) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
-	if m.Epoch != 0 {
-		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Epoch))
+	if m.RepoCpeMappingUpdatePath != nil {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(*m.RepoCpeMappingUpdatePath))
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.RepoCpeMappingHash != nil {
+		i -= len(*m.RepoCpeMappingHash)
+		copy(dAtA[i:], *m.RepoCpeMappingHash)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(*m.RepoCpeMappingHash)))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x32
 	}
 	if len(m.Facts) > 0 {
 		for k := range m.Facts {
@@ -834,10 +1037,12 @@ func (m *ResponseMeta) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 			dAtA[i] = 0x22
 		}
 	}
-	if m.ReportGeneration != 0 {
-		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.ReportGeneration))
+	if len(m.ReportToken) > 0 {
+		i -= len(m.ReportToken)
+		copy(dAtA[i:], m.ReportToken)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ReportToken)))
 		i--
-		dAtA[i] = 0x18
+		dAtA[i] = 0x1a
 	}
 	if m.ReportGeneratedAt != nil {
 		size, err := (*timestamppb1.Timestamp)(m.ReportGeneratedAt).MarshalToSizedBufferVT(dAtA[:i])
@@ -889,15 +1094,12 @@ func (m *GetReportRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
-	if m.KnownEpoch != 0 {
-		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.KnownEpoch))
-		i--
-		dAtA[i] = 0x10
-	}
-	if m.LastKnownGeneration != 0 {
-		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.LastKnownGeneration))
+	if len(m.LastKnownToken) > 0 {
+		i -= len(m.LastKnownToken)
+		copy(dAtA[i:], m.LastKnownToken)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastKnownToken)))
 		i--
-		dAtA[i] = 0x8
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
@@ -967,6 +1169,89 @@ func (m *GetReportResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *SyncRepoCPEMappingRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SyncRepoCPEMappingRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SyncRepoCPEMappingRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Mapping) > 0 {
+		i -= len(m.Mapping)
+		copy(dAtA[i:], m.Mapping)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Mapping)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SyncRepoCPEMappingResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SyncRepoCPEMappingResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SyncRepoCPEMappingResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Updated {
+		i--
+		if m.Updated {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *ErrorResponse) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -1062,6 +1347,20 @@ func (m *VMServiceRequest_GetReport) SizeVT() (n int) {
 	}
 	return n
 }
+func (m *VMServiceRequest_SyncRepoCpeMapping) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.SyncRepoCpeMapping != nil {
+		l = m.SyncRepoCpeMapping.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *VMServiceResponse) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -1107,6 +1406,20 @@ func (m *VMServiceResponse_Error) SizeVT() (n int) {
 	}
 	return n
 }
+func (m *VMServiceResponse_SyncRepoCpeMapping) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.SyncRepoCpeMapping != nil {
+		l = m.SyncRepoCpeMapping.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *RequestMeta) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -1149,8 +1462,9 @@ func (m *ResponseMeta) SizeVT() (n int) {
 		l = (*timestamppb1.Timestamp)(m.ReportGeneratedAt).SizeVT()
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
-	if m.ReportGeneration != 0 {
-		n += 1 + protohelpers.SizeOfVarint(uint64(m.ReportGeneration))
+	l = len(m.ReportToken)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
 	if len(m.SupportedMethods) > 0 {
 		for _, s := range m.SupportedMethods {
@@ -1166,8 +1480,12 @@ func (m *ResponseMeta) SizeVT() (n int) {
 			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
 		}
 	}
-	if m.Epoch != 0 {
-		n += 1 + protohelpers.SizeOfVarint(uint64(m.Epoch))
+	if m.RepoCpeMappingHash != nil {
+		l = len(*m.RepoCpeMappingHash)
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.RepoCpeMappingUpdatePath != nil {
+		n += 1 + protohelpers.SizeOfVarint(uint64(*m.RepoCpeMappingUpdatePath))
 	}
 	n += len(m.unknownFields)
 	return n
@@ -1179,11 +1497,9 @@ func (m *GetReportRequest) SizeVT() (n int) {
 	}
 	var l int
 	_ = l
-	if m.LastKnownGeneration != 0 {
-		n += 1 + protohelpers.SizeOfVarint(uint64(m.LastKnownGeneration))
-	}
-	if m.KnownEpoch != 0 {
-		n += 1 + protohelpers.SizeOfVarint(uint64(m.KnownEpoch))
+	l = len(m.LastKnownToken)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
 	n += len(m.unknownFields)
 	return n
@@ -1212,7 +1528,34 @@ func (m *GetReportResponse) SizeVT() (n int) {
 	return n
 }
 
-func (m *ErrorResponse) SizeVT() (n int) {
+func (m *SyncRepoCPEMappingRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Mapping)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SyncRepoCPEMappingResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Updated {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ErrorResponse) SizeVT() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -1343,6 +1686,47 @@ func (m *VMServiceRequest) UnmarshalVT(dAtA []byte) error {
 				m.Method = &VMServiceRequest_GetReport{GetReport: v}
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncRepoCpeMapping", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Method.(*VMServiceRequest_SyncRepoCpeMapping); ok {
+				if err := oneof.SyncRepoCpeMapping.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &SyncRepoCPEMappingRequest{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Method = &VMServiceRequest_SyncRepoCpeMapping{SyncRepoCpeMapping: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -1512,6 +1896,47 @@ func (m *VMServiceResponse) UnmarshalVT(dAtA []byte) error {
 				m.Result = &VMServiceResponse_Error{Error: v}
 			}
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncRepoCpeMapping", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Result.(*VMServiceResponse_SyncRepoCpeMapping); ok {
+				if err := oneof.SyncRepoCpeMapping.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &SyncRepoCPEMappingResponse{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Result = &VMServiceResponse_SyncRepoCpeMapping{SyncRepoCpeMapping: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -1874,10 +2299,10 @@ func (m *ResponseMeta) UnmarshalVT(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReportGeneration", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReportToken", wireType)
 			}
-			m.ReportGeneration = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -1887,11 +2312,24 @@ func (m *ResponseMeta) UnmarshalVT(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ReportGeneration |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReportToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field SupportedMethods", wireType)
@@ -2052,10 +2490,43 @@ func (m *ResponseMeta) UnmarshalVT(dAtA []byte) error {
 			m.Facts[mapkey] = mapvalue
 			iNdEx = postIndex
 		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RepoCpeMappingHash", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.RepoCpeMappingHash = &s
+			iNdEx = postIndex
+		case 7:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Epoch", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RepoCpeMappingUpdatePath", wireType)
 			}
-			m.Epoch = 0
+			var v RepoCPEMappingUpdatePath
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -2065,11 +2536,12 @@ func (m *ResponseMeta) UnmarshalVT(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Epoch |= uint32(b&0x7F) << shift
+				v |= RepoCPEMappingUpdatePath(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			m.RepoCpeMappingUpdatePath = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -2122,10 +2594,10 @@ func (m *GetReportRequest) UnmarshalVT(dAtA []byte) error {
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LastKnownGeneration", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastKnownToken", wireType)
 			}
-			m.LastKnownGeneration = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -2135,30 +2607,24 @@ func (m *GetReportRequest) UnmarshalVT(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.LastKnownGeneration |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KnownEpoch", wireType)
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
 			}
-			m.KnownEpoch = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return protohelpers.ErrIntOverflow
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.KnownEpoch |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
+			m.LastKnownToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -2296,7 +2762,7 @@ func (m *GetReportResponse) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ErrorResponse) UnmarshalVT(dAtA []byte) error {
+func (m *SyncRepoCPEMappingRequest) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -2319,36 +2785,17 @@ func (m *ErrorResponse) UnmarshalVT(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ErrorResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: SyncRepoCPEMappingRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ErrorResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SyncRepoCPEMappingRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
-			}
-			m.Code = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return protohelpers.ErrIntOverflow
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Code |= ErrorCode(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Mapping", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -2358,29 +2805,82 @@ func (m *ErrorResponse) UnmarshalVT(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return protohelpers.ErrInvalidLength
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return protohelpers.ErrInvalidLength
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Message = string(dAtA[iNdEx:postIndex])
+			m.Mapping = append(m.Mapping[:0], dAtA[iNdEx:postIndex]...)
+			if m.Mapping == nil {
+				m.Mapping = []byte{}
+			}
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			var msglen int
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SyncRepoCPEMappingResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SyncRepoCPEMappingResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SyncRepoCPEMappingResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Updated", wireType)
+			}
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -2390,7 +2890,129 @@ func (m *ErrorResponse) UnmarshalVT(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Updated = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ErrorResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ErrorResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ErrorResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
+			}
+			m.Code = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Code |= ErrorCode(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -2631,6 +3253,47 @@ func (m *VMServiceRequest) UnmarshalVTUnsafe(dAtA []byte) error {
 				m.Method = &VMServiceRequest_GetReport{GetReport: v}
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncRepoCpeMapping", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Method.(*VMServiceRequest_SyncRepoCpeMapping); ok {
+				if err := oneof.SyncRepoCpeMapping.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &SyncRepoCPEMappingRequest{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Method = &VMServiceRequest_SyncRepoCpeMapping{SyncRepoCpeMapping: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -2800,6 +3463,47 @@ func (m *VMServiceResponse) UnmarshalVTUnsafe(dAtA []byte) error {
 				m.Result = &VMServiceResponse_Error{Error: v}
 			}
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncRepoCpeMapping", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Result.(*VMServiceResponse_SyncRepoCpeMapping); ok {
+				if err := oneof.SyncRepoCpeMapping.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &SyncRepoCPEMappingResponse{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Result = &VMServiceResponse_SyncRepoCpeMapping{SyncRepoCpeMapping: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -3182,10 +3886,10 @@ func (m *ResponseMeta) UnmarshalVTUnsafe(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReportGeneration", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReportToken", wireType)
 			}
-			m.ReportGeneration = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -3195,11 +3899,28 @@ func (m *ResponseMeta) UnmarshalVTUnsafe(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ReportGeneration |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.ReportToken = stringValue
+			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field SupportedMethods", wireType)
@@ -3372,10 +4093,47 @@ func (m *ResponseMeta) UnmarshalVTUnsafe(dAtA []byte) error {
 			m.Facts[mapkey] = mapvalue
 			iNdEx = postIndex
 		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RepoCpeMappingHash", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.RepoCpeMappingHash = &s
+			iNdEx = postIndex
+		case 7:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Epoch", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RepoCpeMappingUpdatePath", wireType)
 			}
-			m.Epoch = 0
+			var v RepoCPEMappingUpdatePath
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -3385,11 +4143,12 @@ func (m *ResponseMeta) UnmarshalVTUnsafe(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Epoch |= uint32(b&0x7F) << shift
+				v |= RepoCPEMappingUpdatePath(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			m.RepoCpeMappingUpdatePath = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -3442,10 +4201,10 @@ func (m *GetReportRequest) UnmarshalVTUnsafe(dAtA []byte) error {
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LastKnownGeneration", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastKnownToken", wireType)
 			}
-			m.LastKnownGeneration = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
@@ -3455,30 +4214,28 @@ func (m *GetReportRequest) UnmarshalVTUnsafe(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.LastKnownGeneration |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KnownEpoch", wireType)
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
 			}
-			m.KnownEpoch = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return protohelpers.ErrIntOverflow
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.KnownEpoch |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
 			}
+			m.LastKnownToken = stringValue
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -3616,6 +4373,159 @@ func (m *GetReportResponse) UnmarshalVTUnsafe(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *SyncRepoCPEMappingRequest) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SyncRepoCPEMappingRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SyncRepoCPEMappingRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mapping", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Mapping = dAtA[iNdEx:postIndex]
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SyncRepoCPEMappingResponse) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SyncRepoCPEMappingResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SyncRepoCPEMappingResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Updated", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Updated = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ErrorResponse) UnmarshalVTUnsafe(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/generated/internalapi/wrapper/splunk_alert.pb.go b/generated/internalapi/wrapper/splunk_alert.pb.go
index 5f337f671b73b..e9059584398c6 100644
--- a/generated/internalapi/wrapper/splunk_alert.pb.go
+++ b/generated/internalapi/wrapper/splunk_alert.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: internalapi/wrapper/splunk_alert.proto
 
diff --git a/generated/storage/administration_event.pb.go b/generated/storage/administration_event.pb.go
index df9d45e84de39..e9be271076741 100644
--- a/generated/storage/administration_event.pb.go
+++ b/generated/storage/administration_event.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/administration_event.proto
 
diff --git a/generated/storage/administration_usage.pb.go b/generated/storage/administration_usage.pb.go
index 6dd7fe42016e1..5a47c7315b122 100644
--- a/generated/storage/administration_usage.pb.go
+++ b/generated/storage/administration_usage.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/administration_usage.proto
 
diff --git a/generated/storage/alert.pb.go b/generated/storage/alert.pb.go
index 5efdec723b73f..0cb19c88a4b7b 100644
--- a/generated/storage/alert.pb.go
+++ b/generated/storage/alert.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/alert.proto
 
diff --git a/generated/storage/api_token.pb.go b/generated/storage/api_token.pb.go
index 553d80929e232..ccf6a95ad4ece 100644
--- a/generated/storage/api_token.pb.go
+++ b/generated/storage/api_token.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/api_token.proto
 
diff --git a/generated/storage/auth_machine_to_machine.pb.go b/generated/storage/auth_machine_to_machine.pb.go
index 75595ab528119..8dee2c425a520 100644
--- a/generated/storage/auth_machine_to_machine.pb.go
+++ b/generated/storage/auth_machine_to_machine.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/auth_machine_to_machine.proto
 
diff --git a/generated/storage/auth_provider.pb.go b/generated/storage/auth_provider.pb.go
index 3f701ddf542ae..6894934e299ac 100644
--- a/generated/storage/auth_provider.pb.go
+++ b/generated/storage/auth_provider.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/auth_provider.proto
 
@@ -46,7 +46,11 @@ type AuthProvider struct {
 	//   - "extra_scopes": a space-delimited string of additional scopes to request in addition to "openid profile email"
 	//     according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.
 	//
-	// OpenShift Auth: supports no extra configuration options.
+	// OpenShift Auth:
+	// These settings only apply for OpenShift Auth used with access control delegation to ACM.
+	// Otherwise, no extra configuration options are supported.
+	// - "client_name": the name of the OAuthClient object used to request an OpenShift auth token.
+	// - "client_secret": the OAuthClient secret.
 	//
 	// User PKI:
 	// - "keys": the trusted certificates PEM encoded.
diff --git a/generated/storage/base_image.pb.go b/generated/storage/base_image.pb.go
index 2302244fc1d57..91e6f9bdd80b6 100644
--- a/generated/storage/base_image.pb.go
+++ b/generated/storage/base_image.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/base_image.proto
 
diff --git a/generated/storage/base_image_repository.pb.go b/generated/storage/base_image_repository.pb.go
index 98275adf0ee64..71c3665241dbe 100644
--- a/generated/storage/base_image_repository.pb.go
+++ b/generated/storage/base_image_repository.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/base_image_repository.proto
 
diff --git a/generated/storage/blob.pb.go b/generated/storage/blob.pb.go
index de4cb680fa39d..71f5d355b89d2 100644
--- a/generated/storage/blob.pb.go
+++ b/generated/storage/blob.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/blob.proto
 
diff --git a/generated/storage/cloud_source.pb.go b/generated/storage/cloud_source.pb.go
index 645bc74b61d5a..512ac32e377cb 100644
--- a/generated/storage/cloud_source.pb.go
+++ b/generated/storage/cloud_source.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/cloud_source.proto
 
diff --git a/generated/storage/cluster.pb.go b/generated/storage/cluster.pb.go
index 3a93715df58b2..6b327ad571102 100644
--- a/generated/storage/cluster.pb.go
+++ b/generated/storage/cluster.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/cluster.proto
 
@@ -998,12 +998,14 @@ type OrchestratorMetadata_OpenshiftVersion struct {
 func (*OrchestratorMetadata_OpenshiftVersion) isOrchestratorMetadata_IsOpenshift() {}
 
 type AdmissionControllerConfig struct {
-	state            protoimpl.MessageState `protogen:"open.v1"`
-	Enabled          bool                   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	TimeoutSeconds   int32                  `protobuf:"varint,2,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`
-	ScanInline       bool                   `protobuf:"varint,3,opt,name=scan_inline,json=scanInline,proto3" json:"scan_inline,omitempty"`
-	DisableBypass    bool                   `protobuf:"varint,4,opt,name=disable_bypass,json=disableBypass,proto3" json:"disable_bypass,omitempty"`
-	EnforceOnUpdates bool                   `protobuf:"varint,5,opt,name=enforce_on_updates,json=enforceOnUpdates,proto3" json:"enforce_on_updates,omitempty"`
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	Enabled        bool                   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	TimeoutSeconds int32                  `protobuf:"varint,2,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`
+	// Deprecated: Marked as deprecated in storage/cluster.proto.
+	ScanInline    bool `protobuf:"varint,3,opt,name=scan_inline,json=scanInline,proto3" json:"scan_inline,omitempty"` // always true since 4.9
+	DisableBypass bool `protobuf:"varint,4,opt,name=disable_bypass,json=disableBypass,proto3" json:"disable_bypass,omitempty"`
+	// Deprecated: Marked as deprecated in storage/cluster.proto.
+	EnforceOnUpdates bool `protobuf:"varint,5,opt,name=enforce_on_updates,json=enforceOnUpdates,proto3" json:"enforce_on_updates,omitempty"` // same as enabled since 4.9
 	unknownFields    protoimpl.UnknownFields
 	sizeCache        protoimpl.SizeCache
 }
@@ -1052,6 +1054,7 @@ func (x *AdmissionControllerConfig) GetTimeoutSeconds() int32 {
 	return 0
 }
 
+// Deprecated: Marked as deprecated in storage/cluster.proto.
 func (x *AdmissionControllerConfig) GetScanInline() bool {
 	if x != nil {
 		return x.ScanInline
@@ -1066,6 +1069,7 @@ func (x *AdmissionControllerConfig) GetDisableBypass() bool {
 	return false
 }
 
+// Deprecated: Marked as deprecated in storage/cluster.proto.
 func (x *AdmissionControllerConfig) GetEnforceOnUpdates() bool {
 	if x != nil {
 		return x.EnforceOnUpdates
@@ -2859,14 +2863,14 @@ const file_storage_cluster_proto_rawDesc = "" +
 	"\n" +
 	"build_date\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\tbuildDate\x12!\n" +
 	"\fapi_versions\x18\x03 \x03(\tR\vapiVersionsB\x0e\n" +
-	"\fis_openshift\"\xd4\x01\n" +
+	"\fis_openshift\"\xdc\x01\n" +
 	"\x19AdmissionControllerConfig\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x12'\n" +
-	"\x0ftimeout_seconds\x18\x02 \x01(\x05R\x0etimeoutSeconds\x12\x1f\n" +
-	"\vscan_inline\x18\x03 \x01(\bR\n" +
+	"\x0ftimeout_seconds\x18\x02 \x01(\x05R\x0etimeoutSeconds\x12#\n" +
+	"\vscan_inline\x18\x03 \x01(\bB\x02\x18\x01R\n" +
 	"scanInline\x12%\n" +
-	"\x0edisable_bypass\x18\x04 \x01(\bR\rdisableBypass\x12,\n" +
-	"\x12enforce_on_updates\x18\x05 \x01(\bR\x10enforceOnUpdates\"/\n" +
+	"\x0edisable_bypass\x18\x04 \x01(\bR\rdisableBypass\x120\n" +
+	"\x12enforce_on_updates\x18\x05 \x01(\bB\x02\x18\x01R\x10enforceOnUpdates\"/\n" +
 	"\x11TolerationsConfig\x12\x1a\n" +
 	"\bdisabled\x18\x01 \x01(\bR\bdisabled\"\xf4\x04\n" +
 	"\x13StaticClusterConfig\x12(\n" +
diff --git a/generated/storage/cluster_init.pb.go b/generated/storage/cluster_init.pb.go
index e145a4a0f8d52..76809c3446204 100644
--- a/generated/storage/cluster_init.pb.go
+++ b/generated/storage/cluster_init.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/cluster_init.proto
 
diff --git a/generated/storage/common.pb.go b/generated/storage/common.pb.go
index 0019e4dfbfa26..5de76e47c3144 100644
--- a/generated/storage/common.pb.go
+++ b/generated/storage/common.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/common.proto
 
diff --git a/generated/storage/compliance.pb.go b/generated/storage/compliance.pb.go
index a50a75801c3f2..c1747d82f5353 100644
--- a/generated/storage/compliance.pb.go
+++ b/generated/storage/compliance.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/compliance.proto
 
diff --git a/generated/storage/compliance_config.pb.go b/generated/storage/compliance_config.pb.go
index 2c2541f8c00bb..39f7b1941bf93 100644
--- a/generated/storage/compliance_config.pb.go
+++ b/generated/storage/compliance_config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/compliance_config.proto
 
diff --git a/generated/storage/compliance_integration.pb.go b/generated/storage/compliance_integration.pb.go
index 43ba8b37010b3..2ea6bb1a2d1cb 100644
--- a/generated/storage/compliance_integration.pb.go
+++ b/generated/storage/compliance_integration.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/compliance_integration.proto
 
diff --git a/generated/storage/compliance_operator.pb.go b/generated/storage/compliance_operator.pb.go
index 22e7bc33f22b9..09a4962f8d3c6 100644
--- a/generated/storage/compliance_operator.pb.go
+++ b/generated/storage/compliance_operator.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/compliance_operator.proto
 
diff --git a/generated/storage/compliance_operator_v2.pb.go b/generated/storage/compliance_operator_v2.pb.go
index 5ad5bbeb070b2..a6d253464298f 100644
--- a/generated/storage/compliance_operator_v2.pb.go
+++ b/generated/storage/compliance_operator_v2.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/compliance_operator_v2.proto
 
diff --git a/generated/storage/config.pb.go b/generated/storage/config.pb.go
index d0e5a336d1bec..96c75b18bff25 100644
--- a/generated/storage/config.pb.go
+++ b/generated/storage/config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/config.proto
 
diff --git a/generated/storage/container_runtime.pb.go b/generated/storage/container_runtime.pb.go
index 5b0cbfc4c857b..2aff805dfac12 100644
--- a/generated/storage/container_runtime.pb.go
+++ b/generated/storage/container_runtime.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/container_runtime.proto
 
diff --git a/generated/storage/cve.pb.go b/generated/storage/cve.pb.go
index 5c6d7a8540e32..62dd566ae5313 100644
--- a/generated/storage/cve.pb.go
+++ b/generated/storage/cve.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/cve.proto
 
@@ -179,6 +179,76 @@ func (Source) EnumDescriptor() ([]byte, []int) {
 	return file_storage_cve_proto_rawDescGZIP(), []int{2}
 }
 
+type VulnOrigin int32
+
+const (
+	VulnOrigin_VULN_ORIGIN_OTHER   VulnOrigin = 0
+	VulnOrigin_VULN_ORIGIN_OSV     VulnOrigin = 1
+	VulnOrigin_VULN_ORIGIN_ALPINE  VulnOrigin = 2
+	VulnOrigin_VULN_ORIGIN_AMAZON  VulnOrigin = 3
+	VulnOrigin_VULN_ORIGIN_DEBIAN  VulnOrigin = 4
+	VulnOrigin_VULN_ORIGIN_ORACLE  VulnOrigin = 5
+	VulnOrigin_VULN_ORIGIN_PHOTON  VulnOrigin = 6
+	VulnOrigin_VULN_ORIGIN_RED_HAT VulnOrigin = 7
+	VulnOrigin_VULN_ORIGIN_SUSE    VulnOrigin = 8
+	VulnOrigin_VULN_ORIGIN_UBUNTU  VulnOrigin = 9
+)
+
+// Enum value maps for VulnOrigin.
+var (
+	VulnOrigin_name = map[int32]string{
+		0: "VULN_ORIGIN_OTHER",
+		1: "VULN_ORIGIN_OSV",
+		2: "VULN_ORIGIN_ALPINE",
+		3: "VULN_ORIGIN_AMAZON",
+		4: "VULN_ORIGIN_DEBIAN",
+		5: "VULN_ORIGIN_ORACLE",
+		6: "VULN_ORIGIN_PHOTON",
+		7: "VULN_ORIGIN_RED_HAT",
+		8: "VULN_ORIGIN_SUSE",
+		9: "VULN_ORIGIN_UBUNTU",
+	}
+	VulnOrigin_value = map[string]int32{
+		"VULN_ORIGIN_OTHER":   0,
+		"VULN_ORIGIN_OSV":     1,
+		"VULN_ORIGIN_ALPINE":  2,
+		"VULN_ORIGIN_AMAZON":  3,
+		"VULN_ORIGIN_DEBIAN":  4,
+		"VULN_ORIGIN_ORACLE":  5,
+		"VULN_ORIGIN_PHOTON":  6,
+		"VULN_ORIGIN_RED_HAT": 7,
+		"VULN_ORIGIN_SUSE":    8,
+		"VULN_ORIGIN_UBUNTU":  9,
+	}
+)
+
+func (x VulnOrigin) Enum() *VulnOrigin {
+	p := new(VulnOrigin)
+	*p = x
+	return p
+}
+
+func (x VulnOrigin) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (VulnOrigin) Descriptor() protoreflect.EnumDescriptor {
+	return file_storage_cve_proto_enumTypes[3].Descriptor()
+}
+
+func (VulnOrigin) Type() protoreflect.EnumType {
+	return &file_storage_cve_proto_enumTypes[3]
+}
+
+func (x VulnOrigin) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use VulnOrigin.Descriptor instead.
+func (VulnOrigin) EnumDescriptor() ([]byte, []int) {
+	return file_storage_cve_proto_rawDescGZIP(), []int{3}
+}
+
 // Added this score version for nvd cvss score. moving out and re using score version from cveinfo will cause backward compatibility issue
 type CvssScoreVersion int32
 
@@ -213,11 +283,11 @@ func (x CvssScoreVersion) String() string {
 }
 
 func (CvssScoreVersion) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[3].Descriptor()
+	return file_storage_cve_proto_enumTypes[4].Descriptor()
 }
 
 func (CvssScoreVersion) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[3]
+	return &file_storage_cve_proto_enumTypes[4]
 }
 
 func (x CvssScoreVersion) Number() protoreflect.EnumNumber {
@@ -226,7 +296,7 @@ func (x CvssScoreVersion) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use CvssScoreVersion.Descriptor instead.
 func (CvssScoreVersion) EnumDescriptor() ([]byte, []int) {
-	return file_storage_cve_proto_rawDescGZIP(), []int{3}
+	return file_storage_cve_proto_rawDescGZIP(), []int{4}
 }
 
 type CVE_CVEType int32
@@ -271,11 +341,11 @@ func (x CVE_CVEType) String() string {
 }
 
 func (CVE_CVEType) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[4].Descriptor()
+	return file_storage_cve_proto_enumTypes[5].Descriptor()
 }
 
 func (CVE_CVEType) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[4]
+	return &file_storage_cve_proto_enumTypes[5]
 }
 
 func (x CVE_CVEType) Number() protoreflect.EnumNumber {
@@ -320,11 +390,11 @@ func (x CVE_ScoreVersion) String() string {
 }
 
 func (CVE_ScoreVersion) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[5].Descriptor()
+	return file_storage_cve_proto_enumTypes[6].Descriptor()
 }
 
 func (CVE_ScoreVersion) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[5]
+	return &file_storage_cve_proto_enumTypes[6]
 }
 
 func (x CVE_ScoreVersion) Number() protoreflect.EnumNumber {
@@ -370,11 +440,11 @@ func (x CVEInfo_ScoreVersion) String() string {
 }
 
 func (CVEInfo_ScoreVersion) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[6].Descriptor()
+	return file_storage_cve_proto_enumTypes[7].Descriptor()
 }
 
 func (CVEInfo_ScoreVersion) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[6]
+	return &file_storage_cve_proto_enumTypes[7]
 }
 
 func (x CVEInfo_ScoreVersion) Number() protoreflect.EnumNumber {
@@ -419,11 +489,11 @@ func (x CVSSV2_Impact) String() string {
 }
 
 func (CVSSV2_Impact) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[7].Descriptor()
+	return file_storage_cve_proto_enumTypes[8].Descriptor()
 }
 
 func (CVSSV2_Impact) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[7]
+	return &file_storage_cve_proto_enumTypes[8]
 }
 
 func (x CVSSV2_Impact) Number() protoreflect.EnumNumber {
@@ -468,11 +538,11 @@ func (x CVSSV2_AttackVector) String() string {
 }
 
 func (CVSSV2_AttackVector) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[8].Descriptor()
+	return file_storage_cve_proto_enumTypes[9].Descriptor()
 }
 
 func (CVSSV2_AttackVector) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[8]
+	return &file_storage_cve_proto_enumTypes[9]
 }
 
 func (x CVSSV2_AttackVector) Number() protoreflect.EnumNumber {
@@ -517,11 +587,11 @@ func (x CVSSV2_AccessComplexity) String() string {
 }
 
 func (CVSSV2_AccessComplexity) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[9].Descriptor()
+	return file_storage_cve_proto_enumTypes[10].Descriptor()
 }
 
 func (CVSSV2_AccessComplexity) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[9]
+	return &file_storage_cve_proto_enumTypes[10]
 }
 
 func (x CVSSV2_AccessComplexity) Number() protoreflect.EnumNumber {
@@ -566,11 +636,11 @@ func (x CVSSV2_Authentication) String() string {
 }
 
 func (CVSSV2_Authentication) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[10].Descriptor()
+	return file_storage_cve_proto_enumTypes[11].Descriptor()
 }
 
 func (CVSSV2_Authentication) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[10]
+	return &file_storage_cve_proto_enumTypes[11]
 }
 
 func (x CVSSV2_Authentication) Number() protoreflect.EnumNumber {
@@ -618,11 +688,11 @@ func (x CVSSV2_Severity) String() string {
 }
 
 func (CVSSV2_Severity) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[11].Descriptor()
+	return file_storage_cve_proto_enumTypes[12].Descriptor()
 }
 
 func (CVSSV2_Severity) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[11]
+	return &file_storage_cve_proto_enumTypes[12]
 }
 
 func (x CVSSV2_Severity) Number() protoreflect.EnumNumber {
@@ -667,11 +737,11 @@ func (x CVSSV3_Impact) String() string {
 }
 
 func (CVSSV3_Impact) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[12].Descriptor()
+	return file_storage_cve_proto_enumTypes[13].Descriptor()
 }
 
 func (CVSSV3_Impact) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[12]
+	return &file_storage_cve_proto_enumTypes[13]
 }
 
 func (x CVSSV3_Impact) Number() protoreflect.EnumNumber {
@@ -719,11 +789,11 @@ func (x CVSSV3_AttackVector) String() string {
 }
 
 func (CVSSV3_AttackVector) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[13].Descriptor()
+	return file_storage_cve_proto_enumTypes[14].Descriptor()
 }
 
 func (CVSSV3_AttackVector) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[13]
+	return &file_storage_cve_proto_enumTypes[14]
 }
 
 func (x CVSSV3_AttackVector) Number() protoreflect.EnumNumber {
@@ -765,11 +835,11 @@ func (x CVSSV3_Complexity) String() string {
 }
 
 func (CVSSV3_Complexity) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[14].Descriptor()
+	return file_storage_cve_proto_enumTypes[15].Descriptor()
 }
 
 func (CVSSV3_Complexity) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[14]
+	return &file_storage_cve_proto_enumTypes[15]
 }
 
 func (x CVSSV3_Complexity) Number() protoreflect.EnumNumber {
@@ -814,11 +884,11 @@ func (x CVSSV3_Privileges) String() string {
 }
 
 func (CVSSV3_Privileges) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[15].Descriptor()
+	return file_storage_cve_proto_enumTypes[16].Descriptor()
 }
 
 func (CVSSV3_Privileges) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[15]
+	return &file_storage_cve_proto_enumTypes[16]
 }
 
 func (x CVSSV3_Privileges) Number() protoreflect.EnumNumber {
@@ -860,11 +930,11 @@ func (x CVSSV3_UserInteraction) String() string {
 }
 
 func (CVSSV3_UserInteraction) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[16].Descriptor()
+	return file_storage_cve_proto_enumTypes[17].Descriptor()
 }
 
 func (CVSSV3_UserInteraction) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[16]
+	return &file_storage_cve_proto_enumTypes[17]
 }
 
 func (x CVSSV3_UserInteraction) Number() protoreflect.EnumNumber {
@@ -906,11 +976,11 @@ func (x CVSSV3_Scope) String() string {
 }
 
 func (CVSSV3_Scope) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[17].Descriptor()
+	return file_storage_cve_proto_enumTypes[18].Descriptor()
 }
 
 func (CVSSV3_Scope) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[17]
+	return &file_storage_cve_proto_enumTypes[18]
 }
 
 func (x CVSSV3_Scope) Number() protoreflect.EnumNumber {
@@ -964,11 +1034,11 @@ func (x CVSSV3_Severity) String() string {
 }
 
 func (CVSSV3_Severity) Descriptor() protoreflect.EnumDescriptor {
-	return file_storage_cve_proto_enumTypes[18].Descriptor()
+	return file_storage_cve_proto_enumTypes[19].Descriptor()
 }
 
 func (CVSSV3_Severity) Type() protoreflect.EnumType {
-	return &file_storage_cve_proto_enumTypes[18]
+	return &file_storage_cve_proto_enumTypes[19]
 }
 
 func (x CVSSV3_Severity) Number() protoreflect.EnumNumber {
@@ -1320,12 +1390,13 @@ type CVEInfo struct {
 	CvssV3     *CVSSV3              `protobuf:"bytes,9,opt,name=cvss_v3,json=cvssV3,proto3" json:"cvss_v3,omitempty"`
 	References []*CVEInfo_Reference `protobuf:"bytes,10,rep,name=references,proto3" json:"references,omitempty"`
 	// cvss_metrics stores list of cvss scores from different sources like nvd, Redhat etc
-	CvssMetrics   []*CVSSScore `protobuf:"bytes,11,rep,name=cvss_metrics,json=cvssMetrics,proto3" json:"cvss_metrics,omitempty"`
-	Epss          *EPSS        `protobuf:"bytes,12,opt,name=epss,proto3" json:"epss,omitempty"`
-	Exploit       *Exploit     `protobuf:"bytes,13,opt,name=exploit,proto3" json:"exploit,omitempty"`
-	CisaKev       bool         `protobuf:"varint,14,opt,name=cisa_kev,json=cisaKev,proto3" json:"cisa_kev,omitempty" search:"CISA KEV"` // @gotags: search:"CISA KEV"
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	CvssMetrics             []*CVSSScore `protobuf:"bytes,11,rep,name=cvss_metrics,json=cvssMetrics,proto3" json:"cvss_metrics,omitempty"`
+	Epss                    *EPSS        `protobuf:"bytes,12,opt,name=epss,proto3" json:"epss,omitempty"`
+	Exploit                 *Exploit     `protobuf:"bytes,13,opt,name=exploit,proto3" json:"exploit,omitempty"`
+	CisaKev                 bool         `protobuf:"varint,14,opt,name=cisa_kev,json=cisaKev,proto3" json:"cisa_kev,omitempty" search:"CISA KEV"`                                                   // @gotags: search:"CISA KEV"
+	KnownRansomwareCampaign bool         `protobuf:"varint,15,opt,name=known_ransomware_campaign,json=knownRansomwareCampaign,proto3" json:"known_ransomware_campaign,omitempty" search:"Known Ransomware Campaign"` // @gotags: search:"Known Ransomware Campaign"
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
 }
 
 func (x *CVEInfo) Reset() {
@@ -1456,6 +1527,13 @@ func (x *CVEInfo) GetCisaKev() bool {
 	return false
 }
 
+func (x *CVEInfo) GetKnownRansomwareCampaign() bool {
+	if x != nil {
+		return x.KnownRansomwareCampaign
+	}
+	return false
+}
+
 type Advisory struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty" search:"Advisory Name"` // @gotags: search:"Advisory Name"
@@ -1684,8 +1762,10 @@ type ImageCVEV2 struct {
 	// Timestamp when the fix for this CVE was made available according to the sources.
 	FixAvailableTimestamp *timestamppb.Timestamp `protobuf:"bytes,16,opt,name=fix_available_timestamp,json=fixAvailableTimestamp,proto3" json:"fix_available_timestamp,omitempty" search:"CVE Fix Available Timestamp,hidden"` // @gotags: search:"CVE Fix Available Timestamp,hidden"
 	Datasource            string                 `protobuf:"bytes,17,opt,name=datasource,proto3" json:"datasource,omitempty"`
-	unknownFields         protoimpl.UnknownFields
-	sizeCache             protoimpl.SizeCache
+	// origin indicates where vulnerability details came from, origin may be an aggregator (such as OSV).
+	Origin        VulnOrigin `protobuf:"varint,18,opt,name=origin,proto3,enum=storage.VulnOrigin" json:"origin,omitempty" search:"CVE Origin,hidden"` // @gotags: search:"CVE Origin,hidden"
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ImageCVEV2) Reset() {
@@ -1847,6 +1927,13 @@ func (x *ImageCVEV2) GetDatasource() string {
 	return ""
 }
 
+func (x *ImageCVEV2) GetOrigin() VulnOrigin {
+	if x != nil {
+		return x.Origin
+	}
+	return VulnOrigin_VULN_ORIGIN_OTHER
+}
+
 type isImageCVEV2_HasFixedBy interface {
 	isImageCVEV2_HasFixedBy()
 }
@@ -2764,7 +2851,7 @@ const file_storage_cve_proto_rawDesc = "" +
 	"\fScoreVersion\x12\x06\n" +
 	"\x02V2\x10\x00\x12\x06\n" +
 	"\x02V3\x10\x01\x12\v\n" +
-	"\aUNKNOWN\x10\x02J\x04\b\x16\x10\x17J\x04\b\x15\x10\x16\"\xd9\x05\n" +
+	"\aUNKNOWN\x10\x02J\x04\b\x16\x10\x17J\x04\b\x15\x10\x16\"\x95\x06\n" +
 	"\aCVEInfo\x12\x10\n" +
 	"\x03cve\x18\x01 \x01(\tR\x03cve\x12\x18\n" +
 	"\asummary\x18\x02 \x01(\tR\asummary\x12\x12\n" +
@@ -2783,7 +2870,8 @@ const file_storage_cve_proto_rawDesc = "" +
 	"\fcvss_metrics\x18\v \x03(\v2\x12.storage.CVSSScoreR\vcvssMetrics\x12!\n" +
 	"\x04epss\x18\f \x01(\v2\r.storage.EPSSR\x04epss\x12*\n" +
 	"\aexploit\x18\r \x01(\v2\x10.storage.ExploitR\aexploit\x12\x19\n" +
-	"\bcisa_kev\x18\x0e \x01(\bR\acisaKev\x1a1\n" +
+	"\bcisa_kev\x18\x0e \x01(\bR\acisaKev\x12:\n" +
+	"\x19known_ransomware_campaign\x18\x0f \x01(\bR\x17knownRansomwareCampaign\x1a1\n" +
 	"\tReference\x12\x10\n" +
 	"\x03URI\x18\x01 \x01(\tR\x03URI\x12\x12\n" +
 	"\x04tags\x18\x02 \x03(\tR\x04tags\"+\n" +
@@ -2807,7 +2895,7 @@ const file_storage_cve_proto_rawDesc = "" +
 	"\anvdcvss\x18\n" +
 	" \x01(\x02R\anvdcvss\x125\n" +
 	"\fcvss_metrics\x18\v \x03(\v2\x12.storage.CVSSScoreR\vcvssMetrics\x12E\n" +
-	"\x11nvd_score_version\x18\f \x01(\x0e2\x19.storage.CvssScoreVersionR\x0fnvdScoreVersion:\x02\x18\x01\"\xfc\x05\n" +
+	"\x11nvd_score_version\x18\f \x01(\x0e2\x19.storage.CvssScoreVersionR\x0fnvdScoreVersion:\x02\x18\x01\"\xa9\x06\n" +
 	"\n" +
 	"ImageCVEV2\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" +
@@ -2830,7 +2918,8 @@ const file_storage_cve_proto_rawDesc = "" +
 	"\x17fix_available_timestamp\x18\x10 \x01(\v2\x1a.google.protobuf.TimestampR\x15fixAvailableTimestamp\x12\x1e\n" +
 	"\n" +
 	"datasource\x18\x11 \x01(\tR\n" +
-	"datasourceB\x0e\n" +
+	"datasource\x12+\n" +
+	"\x06origin\x18\x12 \x01(\x0e2\x13.storage.VulnOriginR\x06originB\x0e\n" +
 	"\fhas_fixed_by\"\xe4\x03\n" +
 	"\aNodeCVE\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x124\n" +
@@ -2968,7 +3057,19 @@ const file_storage_cve_proto_rawDesc = "" +
 	"\n" +
 	"SOURCE_OSV\x10\x02\x12\x0e\n" +
 	"\n" +
-	"SOURCE_NVD\x10\x03*7\n" +
+	"SOURCE_NVD\x10\x03*\xf7\x01\n" +
+	"\n" +
+	"VulnOrigin\x12\x15\n" +
+	"\x11VULN_ORIGIN_OTHER\x10\x00\x12\x13\n" +
+	"\x0fVULN_ORIGIN_OSV\x10\x01\x12\x16\n" +
+	"\x12VULN_ORIGIN_ALPINE\x10\x02\x12\x16\n" +
+	"\x12VULN_ORIGIN_AMAZON\x10\x03\x12\x16\n" +
+	"\x12VULN_ORIGIN_DEBIAN\x10\x04\x12\x16\n" +
+	"\x12VULN_ORIGIN_ORACLE\x10\x05\x12\x16\n" +
+	"\x12VULN_ORIGIN_PHOTON\x10\x06\x12\x17\n" +
+	"\x13VULN_ORIGIN_RED_HAT\x10\a\x12\x14\n" +
+	"\x10VULN_ORIGIN_SUSE\x10\b\x12\x16\n" +
+	"\x12VULN_ORIGIN_UBUNTU\x10\t*7\n" +
 	"\x10CvssScoreVersion\x12\x13\n" +
 	"\x0fUNKNOWN_VERSION\x10\x00\x12\x06\n" +
 	"\x02V2\x10\x01\x12\x06\n" +
@@ -2987,125 +3088,127 @@ func file_storage_cve_proto_rawDescGZIP() []byte {
 	return file_storage_cve_proto_rawDescData
 }
 
-var file_storage_cve_proto_enumTypes = make([]protoimpl.EnumInfo, 19)
+var file_storage_cve_proto_enumTypes = make([]protoimpl.EnumInfo, 20)
 var file_storage_cve_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
 var file_storage_cve_proto_goTypes = []any{
 	(VulnerabilityState)(0),       // 0: storage.VulnerabilityState
 	(VulnerabilitySeverity)(0),    // 1: storage.VulnerabilitySeverity
 	(Source)(0),                   // 2: storage.Source
-	(CvssScoreVersion)(0),         // 3: storage.CvssScoreVersion
-	(CVE_CVEType)(0),              // 4: storage.CVE.CVEType
-	(CVE_ScoreVersion)(0),         // 5: storage.CVE.ScoreVersion
-	(CVEInfo_ScoreVersion)(0),     // 6: storage.CVEInfo.ScoreVersion
-	(CVSSV2_Impact)(0),            // 7: storage.CVSSV2.Impact
-	(CVSSV2_AttackVector)(0),      // 8: storage.CVSSV2.AttackVector
-	(CVSSV2_AccessComplexity)(0),  // 9: storage.CVSSV2.AccessComplexity
-	(CVSSV2_Authentication)(0),    // 10: storage.CVSSV2.Authentication
-	(CVSSV2_Severity)(0),          // 11: storage.CVSSV2.Severity
-	(CVSSV3_Impact)(0),            // 12: storage.CVSSV3.Impact
-	(CVSSV3_AttackVector)(0),      // 13: storage.CVSSV3.AttackVector
-	(CVSSV3_Complexity)(0),        // 14: storage.CVSSV3.Complexity
-	(CVSSV3_Privileges)(0),        // 15: storage.CVSSV3.Privileges
-	(CVSSV3_UserInteraction)(0),   // 16: storage.CVSSV3.UserInteraction
-	(CVSSV3_Scope)(0),             // 17: storage.CVSSV3.Scope
-	(CVSSV3_Severity)(0),          // 18: storage.CVSSV3.Severity
-	(*EPSS)(nil),                  // 19: storage.EPSS
-	(*Exploit)(nil),               // 20: storage.Exploit
-	(*CVE)(nil),                   // 21: storage.CVE
-	(*CVEInfo)(nil),               // 22: storage.CVEInfo
-	(*Advisory)(nil),              // 23: storage.Advisory
-	(*ImageCVE)(nil),              // 24: storage.ImageCVE
-	(*ImageCVEV2)(nil),            // 25: storage.ImageCVEV2
-	(*NodeCVE)(nil),               // 26: storage.NodeCVE
-	(*ClusterCVE)(nil),            // 27: storage.ClusterCVE
-	(*CVSSScore)(nil),             // 28: storage.CVSSScore
-	(*CVSSV2)(nil),                // 29: storage.CVSSV2
-	(*CVSSV3)(nil),                // 30: storage.CVSSV3
-	(*ImageCVEInfo)(nil),          // 31: storage.ImageCVEInfo
-	(*CVE_DistroSpecific)(nil),    // 32: storage.CVE.DistroSpecific
-	(*CVE_Reference)(nil),         // 33: storage.CVE.Reference
-	nil,                           // 34: storage.CVE.DistroSpecificsEntry
-	(*CVEInfo_Reference)(nil),     // 35: storage.CVEInfo.Reference
-	(*timestamppb.Timestamp)(nil), // 36: google.protobuf.Timestamp
+	(VulnOrigin)(0),               // 3: storage.VulnOrigin
+	(CvssScoreVersion)(0),         // 4: storage.CvssScoreVersion
+	(CVE_CVEType)(0),              // 5: storage.CVE.CVEType
+	(CVE_ScoreVersion)(0),         // 6: storage.CVE.ScoreVersion
+	(CVEInfo_ScoreVersion)(0),     // 7: storage.CVEInfo.ScoreVersion
+	(CVSSV2_Impact)(0),            // 8: storage.CVSSV2.Impact
+	(CVSSV2_AttackVector)(0),      // 9: storage.CVSSV2.AttackVector
+	(CVSSV2_AccessComplexity)(0),  // 10: storage.CVSSV2.AccessComplexity
+	(CVSSV2_Authentication)(0),    // 11: storage.CVSSV2.Authentication
+	(CVSSV2_Severity)(0),          // 12: storage.CVSSV2.Severity
+	(CVSSV3_Impact)(0),            // 13: storage.CVSSV3.Impact
+	(CVSSV3_AttackVector)(0),      // 14: storage.CVSSV3.AttackVector
+	(CVSSV3_Complexity)(0),        // 15: storage.CVSSV3.Complexity
+	(CVSSV3_Privileges)(0),        // 16: storage.CVSSV3.Privileges
+	(CVSSV3_UserInteraction)(0),   // 17: storage.CVSSV3.UserInteraction
+	(CVSSV3_Scope)(0),             // 18: storage.CVSSV3.Scope
+	(CVSSV3_Severity)(0),          // 19: storage.CVSSV3.Severity
+	(*EPSS)(nil),                  // 20: storage.EPSS
+	(*Exploit)(nil),               // 21: storage.Exploit
+	(*CVE)(nil),                   // 22: storage.CVE
+	(*CVEInfo)(nil),               // 23: storage.CVEInfo
+	(*Advisory)(nil),              // 24: storage.Advisory
+	(*ImageCVE)(nil),              // 25: storage.ImageCVE
+	(*ImageCVEV2)(nil),            // 26: storage.ImageCVEV2
+	(*NodeCVE)(nil),               // 27: storage.NodeCVE
+	(*ClusterCVE)(nil),            // 28: storage.ClusterCVE
+	(*CVSSScore)(nil),             // 29: storage.CVSSScore
+	(*CVSSV2)(nil),                // 30: storage.CVSSV2
+	(*CVSSV3)(nil),                // 31: storage.CVSSV3
+	(*ImageCVEInfo)(nil),          // 32: storage.ImageCVEInfo
+	(*CVE_DistroSpecific)(nil),    // 33: storage.CVE.DistroSpecific
+	(*CVE_Reference)(nil),         // 34: storage.CVE.Reference
+	nil,                           // 35: storage.CVE.DistroSpecificsEntry
+	(*CVEInfo_Reference)(nil),     // 36: storage.CVEInfo.Reference
+	(*timestamppb.Timestamp)(nil), // 37: google.protobuf.Timestamp
 }
 var file_storage_cve_proto_depIdxs = []int32{
-	4,  // 0: storage.CVE.type:type_name -> storage.CVE.CVEType
-	4,  // 1: storage.CVE.types:type_name -> storage.CVE.CVEType
-	36, // 2: storage.CVE.published_on:type_name -> google.protobuf.Timestamp
-	36, // 3: storage.CVE.created_at:type_name -> google.protobuf.Timestamp
-	36, // 4: storage.CVE.last_modified:type_name -> google.protobuf.Timestamp
-	33, // 5: storage.CVE.references:type_name -> storage.CVE.Reference
-	5,  // 6: storage.CVE.score_version:type_name -> storage.CVE.ScoreVersion
-	29, // 7: storage.CVE.cvss_v2:type_name -> storage.CVSSV2
-	30, // 8: storage.CVE.cvss_v3:type_name -> storage.CVSSV3
-	36, // 9: storage.CVE.suppress_activation:type_name -> google.protobuf.Timestamp
-	36, // 10: storage.CVE.suppress_expiry:type_name -> google.protobuf.Timestamp
-	34, // 11: storage.CVE.distro_specifics:type_name -> storage.CVE.DistroSpecificsEntry
+	5,  // 0: storage.CVE.type:type_name -> storage.CVE.CVEType
+	5,  // 1: storage.CVE.types:type_name -> storage.CVE.CVEType
+	37, // 2: storage.CVE.published_on:type_name -> google.protobuf.Timestamp
+	37, // 3: storage.CVE.created_at:type_name -> google.protobuf.Timestamp
+	37, // 4: storage.CVE.last_modified:type_name -> google.protobuf.Timestamp
+	34, // 5: storage.CVE.references:type_name -> storage.CVE.Reference
+	6,  // 6: storage.CVE.score_version:type_name -> storage.CVE.ScoreVersion
+	30, // 7: storage.CVE.cvss_v2:type_name -> storage.CVSSV2
+	31, // 8: storage.CVE.cvss_v3:type_name -> storage.CVSSV3
+	37, // 9: storage.CVE.suppress_activation:type_name -> google.protobuf.Timestamp
+	37, // 10: storage.CVE.suppress_expiry:type_name -> google.protobuf.Timestamp
+	35, // 11: storage.CVE.distro_specifics:type_name -> storage.CVE.DistroSpecificsEntry
 	1,  // 12: storage.CVE.severity:type_name -> storage.VulnerabilitySeverity
-	36, // 13: storage.CVEInfo.published_on:type_name -> google.protobuf.Timestamp
-	36, // 14: storage.CVEInfo.created_at:type_name -> google.protobuf.Timestamp
-	36, // 15: storage.CVEInfo.last_modified:type_name -> google.protobuf.Timestamp
-	6,  // 16: storage.CVEInfo.score_version:type_name -> storage.CVEInfo.ScoreVersion
-	29, // 17: storage.CVEInfo.cvss_v2:type_name -> storage.CVSSV2
-	30, // 18: storage.CVEInfo.cvss_v3:type_name -> storage.CVSSV3
-	35, // 19: storage.CVEInfo.references:type_name -> storage.CVEInfo.Reference
-	28, // 20: storage.CVEInfo.cvss_metrics:type_name -> storage.CVSSScore
-	19, // 21: storage.CVEInfo.epss:type_name -> storage.EPSS
-	20, // 22: storage.CVEInfo.exploit:type_name -> storage.Exploit
-	22, // 23: storage.ImageCVE.cve_base_info:type_name -> storage.CVEInfo
+	37, // 13: storage.CVEInfo.published_on:type_name -> google.protobuf.Timestamp
+	37, // 14: storage.CVEInfo.created_at:type_name -> google.protobuf.Timestamp
+	37, // 15: storage.CVEInfo.last_modified:type_name -> google.protobuf.Timestamp
+	7,  // 16: storage.CVEInfo.score_version:type_name -> storage.CVEInfo.ScoreVersion
+	30, // 17: storage.CVEInfo.cvss_v2:type_name -> storage.CVSSV2
+	31, // 18: storage.CVEInfo.cvss_v3:type_name -> storage.CVSSV3
+	36, // 19: storage.CVEInfo.references:type_name -> storage.CVEInfo.Reference
+	29, // 20: storage.CVEInfo.cvss_metrics:type_name -> storage.CVSSScore
+	20, // 21: storage.CVEInfo.epss:type_name -> storage.EPSS
+	21, // 22: storage.CVEInfo.exploit:type_name -> storage.Exploit
+	23, // 23: storage.ImageCVE.cve_base_info:type_name -> storage.CVEInfo
 	1,  // 24: storage.ImageCVE.severity:type_name -> storage.VulnerabilitySeverity
-	36, // 25: storage.ImageCVE.snooze_start:type_name -> google.protobuf.Timestamp
-	36, // 26: storage.ImageCVE.snooze_expiry:type_name -> google.protobuf.Timestamp
-	28, // 27: storage.ImageCVE.cvss_metrics:type_name -> storage.CVSSScore
-	3,  // 28: storage.ImageCVE.nvd_score_version:type_name -> storage.CvssScoreVersion
-	22, // 29: storage.ImageCVEV2.cve_base_info:type_name -> storage.CVEInfo
+	37, // 25: storage.ImageCVE.snooze_start:type_name -> google.protobuf.Timestamp
+	37, // 26: storage.ImageCVE.snooze_expiry:type_name -> google.protobuf.Timestamp
+	29, // 27: storage.ImageCVE.cvss_metrics:type_name -> storage.CVSSScore
+	4,  // 28: storage.ImageCVE.nvd_score_version:type_name -> storage.CvssScoreVersion
+	23, // 29: storage.ImageCVEV2.cve_base_info:type_name -> storage.CVEInfo
 	1,  // 30: storage.ImageCVEV2.severity:type_name -> storage.VulnerabilitySeverity
-	3,  // 31: storage.ImageCVEV2.nvd_score_version:type_name -> storage.CvssScoreVersion
-	36, // 32: storage.ImageCVEV2.first_image_occurrence:type_name -> google.protobuf.Timestamp
+	4,  // 31: storage.ImageCVEV2.nvd_score_version:type_name -> storage.CvssScoreVersion
+	37, // 32: storage.ImageCVEV2.first_image_occurrence:type_name -> google.protobuf.Timestamp
 	0,  // 33: storage.ImageCVEV2.state:type_name -> storage.VulnerabilityState
-	23, // 34: storage.ImageCVEV2.advisory:type_name -> storage.Advisory
-	36, // 35: storage.ImageCVEV2.fix_available_timestamp:type_name -> google.protobuf.Timestamp
-	22, // 36: storage.NodeCVE.cve_base_info:type_name -> storage.CVEInfo
-	1,  // 37: storage.NodeCVE.severity:type_name -> storage.VulnerabilitySeverity
-	36, // 38: storage.NodeCVE.snooze_start:type_name -> google.protobuf.Timestamp
-	36, // 39: storage.NodeCVE.snooze_expiry:type_name -> google.protobuf.Timestamp
-	36, // 40: storage.NodeCVE.orphaned_time:type_name -> google.protobuf.Timestamp
-	22, // 41: storage.ClusterCVE.cve_base_info:type_name -> storage.CVEInfo
-	1,  // 42: storage.ClusterCVE.severity:type_name -> storage.VulnerabilitySeverity
-	36, // 43: storage.ClusterCVE.snooze_start:type_name -> google.protobuf.Timestamp
-	36, // 44: storage.ClusterCVE.snooze_expiry:type_name -> google.protobuf.Timestamp
-	4,  // 45: storage.ClusterCVE.type:type_name -> storage.CVE.CVEType
-	2,  // 46: storage.CVSSScore.source:type_name -> storage.Source
-	29, // 47: storage.CVSSScore.cvssv2:type_name -> storage.CVSSV2
-	30, // 48: storage.CVSSScore.cvssv3:type_name -> storage.CVSSV3
-	8,  // 49: storage.CVSSV2.attack_vector:type_name -> storage.CVSSV2.AttackVector
-	9,  // 50: storage.CVSSV2.access_complexity:type_name -> storage.CVSSV2.AccessComplexity
-	10, // 51: storage.CVSSV2.authentication:type_name -> storage.CVSSV2.Authentication
-	7,  // 52: storage.CVSSV2.confidentiality:type_name -> storage.CVSSV2.Impact
-	7,  // 53: storage.CVSSV2.integrity:type_name -> storage.CVSSV2.Impact
-	7,  // 54: storage.CVSSV2.availability:type_name -> storage.CVSSV2.Impact
-	11, // 55: storage.CVSSV2.severity:type_name -> storage.CVSSV2.Severity
-	13, // 56: storage.CVSSV3.attack_vector:type_name -> storage.CVSSV3.AttackVector
-	14, // 57: storage.CVSSV3.attack_complexity:type_name -> storage.CVSSV3.Complexity
-	15, // 58: storage.CVSSV3.privileges_required:type_name -> storage.CVSSV3.Privileges
-	16, // 59: storage.CVSSV3.user_interaction:type_name -> storage.CVSSV3.UserInteraction
-	17, // 60: storage.CVSSV3.scope:type_name -> storage.CVSSV3.Scope
-	12, // 61: storage.CVSSV3.confidentiality:type_name -> storage.CVSSV3.Impact
-	12, // 62: storage.CVSSV3.integrity:type_name -> storage.CVSSV3.Impact
-	12, // 63: storage.CVSSV3.availability:type_name -> storage.CVSSV3.Impact
-	18, // 64: storage.CVSSV3.severity:type_name -> storage.CVSSV3.Severity
-	36, // 65: storage.ImageCVEInfo.fix_available_timestamp:type_name -> google.protobuf.Timestamp
-	36, // 66: storage.ImageCVEInfo.first_system_occurrence:type_name -> google.protobuf.Timestamp
-	1,  // 67: storage.CVE.DistroSpecific.severity:type_name -> storage.VulnerabilitySeverity
-	5,  // 68: storage.CVE.DistroSpecific.score_version:type_name -> storage.CVE.ScoreVersion
-	29, // 69: storage.CVE.DistroSpecific.cvss_v2:type_name -> storage.CVSSV2
-	30, // 70: storage.CVE.DistroSpecific.cvss_v3:type_name -> storage.CVSSV3
-	32, // 71: storage.CVE.DistroSpecificsEntry.value:type_name -> storage.CVE.DistroSpecific
-	72, // [72:72] is the sub-list for method output_type
-	72, // [72:72] is the sub-list for method input_type
-	72, // [72:72] is the sub-list for extension type_name
-	72, // [72:72] is the sub-list for extension extendee
-	0,  // [0:72] is the sub-list for field type_name
+	24, // 34: storage.ImageCVEV2.advisory:type_name -> storage.Advisory
+	37, // 35: storage.ImageCVEV2.fix_available_timestamp:type_name -> google.protobuf.Timestamp
+	3,  // 36: storage.ImageCVEV2.origin:type_name -> storage.VulnOrigin
+	23, // 37: storage.NodeCVE.cve_base_info:type_name -> storage.CVEInfo
+	1,  // 38: storage.NodeCVE.severity:type_name -> storage.VulnerabilitySeverity
+	37, // 39: storage.NodeCVE.snooze_start:type_name -> google.protobuf.Timestamp
+	37, // 40: storage.NodeCVE.snooze_expiry:type_name -> google.protobuf.Timestamp
+	37, // 41: storage.NodeCVE.orphaned_time:type_name -> google.protobuf.Timestamp
+	23, // 42: storage.ClusterCVE.cve_base_info:type_name -> storage.CVEInfo
+	1,  // 43: storage.ClusterCVE.severity:type_name -> storage.VulnerabilitySeverity
+	37, // 44: storage.ClusterCVE.snooze_start:type_name -> google.protobuf.Timestamp
+	37, // 45: storage.ClusterCVE.snooze_expiry:type_name -> google.protobuf.Timestamp
+	5,  // 46: storage.ClusterCVE.type:type_name -> storage.CVE.CVEType
+	2,  // 47: storage.CVSSScore.source:type_name -> storage.Source
+	30, // 48: storage.CVSSScore.cvssv2:type_name -> storage.CVSSV2
+	31, // 49: storage.CVSSScore.cvssv3:type_name -> storage.CVSSV3
+	9,  // 50: storage.CVSSV2.attack_vector:type_name -> storage.CVSSV2.AttackVector
+	10, // 51: storage.CVSSV2.access_complexity:type_name -> storage.CVSSV2.AccessComplexity
+	11, // 52: storage.CVSSV2.authentication:type_name -> storage.CVSSV2.Authentication
+	8,  // 53: storage.CVSSV2.confidentiality:type_name -> storage.CVSSV2.Impact
+	8,  // 54: storage.CVSSV2.integrity:type_name -> storage.CVSSV2.Impact
+	8,  // 55: storage.CVSSV2.availability:type_name -> storage.CVSSV2.Impact
+	12, // 56: storage.CVSSV2.severity:type_name -> storage.CVSSV2.Severity
+	14, // 57: storage.CVSSV3.attack_vector:type_name -> storage.CVSSV3.AttackVector
+	15, // 58: storage.CVSSV3.attack_complexity:type_name -> storage.CVSSV3.Complexity
+	16, // 59: storage.CVSSV3.privileges_required:type_name -> storage.CVSSV3.Privileges
+	17, // 60: storage.CVSSV3.user_interaction:type_name -> storage.CVSSV3.UserInteraction
+	18, // 61: storage.CVSSV3.scope:type_name -> storage.CVSSV3.Scope
+	13, // 62: storage.CVSSV3.confidentiality:type_name -> storage.CVSSV3.Impact
+	13, // 63: storage.CVSSV3.integrity:type_name -> storage.CVSSV3.Impact
+	13, // 64: storage.CVSSV3.availability:type_name -> storage.CVSSV3.Impact
+	19, // 65: storage.CVSSV3.severity:type_name -> storage.CVSSV3.Severity
+	37, // 66: storage.ImageCVEInfo.fix_available_timestamp:type_name -> google.protobuf.Timestamp
+	37, // 67: storage.ImageCVEInfo.first_system_occurrence:type_name -> google.protobuf.Timestamp
+	1,  // 68: storage.CVE.DistroSpecific.severity:type_name -> storage.VulnerabilitySeverity
+	6,  // 69: storage.CVE.DistroSpecific.score_version:type_name -> storage.CVE.ScoreVersion
+	30, // 70: storage.CVE.DistroSpecific.cvss_v2:type_name -> storage.CVSSV2
+	31, // 71: storage.CVE.DistroSpecific.cvss_v3:type_name -> storage.CVSSV3
+	33, // 72: storage.CVE.DistroSpecificsEntry.value:type_name -> storage.CVE.DistroSpecific
+	73, // [73:73] is the sub-list for method output_type
+	73, // [73:73] is the sub-list for method input_type
+	73, // [73:73] is the sub-list for extension type_name
+	73, // [73:73] is the sub-list for extension extendee
+	0,  // [0:73] is the sub-list for field type_name
 }
 
 func init() { file_storage_cve_proto_init() }
@@ -3125,7 +3228,7 @@ func file_storage_cve_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_storage_cve_proto_rawDesc), len(file_storage_cve_proto_rawDesc)),
-			NumEnums:      19,
+			NumEnums:      20,
 			NumMessages:   17,
 			NumExtensions: 0,
 			NumServices:   0,
diff --git a/generated/storage/cve_vtproto.pb.go b/generated/storage/cve_vtproto.pb.go
index 6b1495a836eda..c0392a9ed578d 100644
--- a/generated/storage/cve_vtproto.pb.go
+++ b/generated/storage/cve_vtproto.pb.go
@@ -196,6 +196,7 @@ func (m *CVEInfo) CloneVT() *CVEInfo {
 	r.Epss = m.Epss.CloneVT()
 	r.Exploit = m.Exploit.CloneVT()
 	r.CisaKev = m.CisaKev
+	r.KnownRansomwareCampaign = m.KnownRansomwareCampaign
 	if rhs := m.References; rhs != nil {
 		tmpContainer := make([]*CVEInfo_Reference, len(rhs))
 		for k, v := range rhs {
@@ -294,6 +295,7 @@ func (m *ImageCVEV2) CloneVT() *ImageCVEV2 {
 	r.ImageIdV2 = m.ImageIdV2
 	r.FixAvailableTimestamp = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.FixAvailableTimestamp).CloneVT())
 	r.Datasource = m.Datasource
+	r.Origin = m.Origin
 	if m.HasFixedBy != nil {
 		r.HasFixedBy = m.HasFixedBy.(interface {
 			CloneVT() isImageCVEV2_HasFixedBy
@@ -812,6 +814,9 @@ func (this *CVEInfo) EqualVT(that *CVEInfo) bool {
 	if this.CisaKev != that.CisaKev {
 		return false
 	}
+	if this.KnownRansomwareCampaign != that.KnownRansomwareCampaign {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -976,6 +981,9 @@ func (this *ImageCVEV2) EqualVT(that *ImageCVEV2) bool {
 	if this.Datasource != that.Datasource {
 		return false
 	}
+	if this.Origin != that.Origin {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -1847,6 +1855,16 @@ func (m *CVEInfo) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.KnownRansomwareCampaign {
+		i--
+		if m.KnownRansomwareCampaign {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x78
+	}
 	if m.CisaKev {
 		i--
 		if m.CisaKev {
@@ -2193,6 +2211,13 @@ func (m *ImageCVEV2) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		}
 		i -= size
 	}
+	if m.Origin != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Origin))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x90
+	}
 	if len(m.Datasource) > 0 {
 		i -= len(m.Datasource)
 		copy(dAtA[i:], m.Datasource)
@@ -3192,6 +3217,9 @@ func (m *CVEInfo) SizeVT() (n int) {
 	if m.CisaKev {
 		n += 2
 	}
+	if m.KnownRansomwareCampaign {
+		n += 2
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -3334,6 +3362,9 @@ func (m *ImageCVEV2) SizeVT() (n int) {
 	if l > 0 {
 		n += 2 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.Origin != 0 {
+		n += 2 + protohelpers.SizeOfVarint(uint64(m.Origin))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -5506,6 +5537,26 @@ func (m *CVEInfo) UnmarshalVT(dAtA []byte) error {
 				}
 			}
 			m.CisaKev = bool(v != 0)
+		case 15:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KnownRansomwareCampaign", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.KnownRansomwareCampaign = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -6466,6 +6517,25 @@ func (m *ImageCVEV2) UnmarshalVT(dAtA []byte) error {
 			}
 			m.Datasource = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 18:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Origin", wireType)
+			}
+			m.Origin = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Origin |= VulnOrigin(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -9970,6 +10040,26 @@ func (m *CVEInfo) UnmarshalVTUnsafe(dAtA []byte) error {
 				}
 			}
 			m.CisaKev = bool(v != 0)
+		case 15:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KnownRansomwareCampaign", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.KnownRansomwareCampaign = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -10970,6 +11060,25 @@ func (m *ImageCVEV2) UnmarshalVTUnsafe(dAtA []byte) error {
 			}
 			m.Datasource = stringValue
 			iNdEx = postIndex
+		case 18:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Origin", wireType)
+			}
+			m.Origin = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Origin |= VulnOrigin(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/generated/storage/declarative_config_health.pb.go b/generated/storage/declarative_config_health.pb.go
index 2774a543154a8..ab8ae734357da 100644
--- a/generated/storage/declarative_config_health.pb.go
+++ b/generated/storage/declarative_config_health.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/declarative_config_health.proto
 
diff --git a/generated/storage/delegated_registry_config.pb.go b/generated/storage/delegated_registry_config.pb.go
index e95aa9ab08de4..0c37b53103134 100644
--- a/generated/storage/delegated_registry_config.pb.go
+++ b/generated/storage/delegated_registry_config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/delegated_registry_config.proto
 
diff --git a/generated/storage/deployment.pb.go b/generated/storage/deployment.pb.go
index 652446d8996e5..e239a6b485255 100644
--- a/generated/storage/deployment.pb.go
+++ b/generated/storage/deployment.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/deployment.proto
 
diff --git a/generated/storage/discovered_cluster.pb.go b/generated/storage/discovered_cluster.pb.go
index 305e3e5415b3d..44af51e85fd49 100644
--- a/generated/storage/discovered_cluster.pb.go
+++ b/generated/storage/discovered_cluster.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/discovered_cluster.proto
 
diff --git a/generated/storage/external_backup.pb.go b/generated/storage/external_backup.pb.go
index 139ce582c3ace..a3abba232dbe3 100644
--- a/generated/storage/external_backup.pb.go
+++ b/generated/storage/external_backup.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/external_backup.proto
 
diff --git a/generated/storage/file_access.pb.go b/generated/storage/file_access.pb.go
index 4c1a916c401b9..af066b531e822 100644
--- a/generated/storage/file_access.pb.go
+++ b/generated/storage/file_access.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/file_access.proto
 
diff --git a/generated/storage/group.pb.go b/generated/storage/group.pb.go
index 0a7256ef0ca46..6e8dfd698d8d5 100644
--- a/generated/storage/group.pb.go
+++ b/generated/storage/group.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/group.proto
 
diff --git a/generated/storage/hash.pb.go b/generated/storage/hash.pb.go
index fafb3d2e6e183..af6d811abd811 100644
--- a/generated/storage/hash.pb.go
+++ b/generated/storage/hash.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/hash.proto
 
diff --git a/generated/storage/helm_cluster.pb.go b/generated/storage/helm_cluster.pb.go
index 6a4925aa0b167..7097f25b31a47 100644
--- a/generated/storage/helm_cluster.pb.go
+++ b/generated/storage/helm_cluster.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/helm_cluster.proto
 
diff --git a/generated/storage/http_endpoint.pb.go b/generated/storage/http_endpoint.pb.go
index 40c5fe6f9220b..a67789f8acf25 100644
--- a/generated/storage/http_endpoint.pb.go
+++ b/generated/storage/http_endpoint.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/http_endpoint.proto
 
diff --git a/generated/storage/image.pb.go b/generated/storage/image.pb.go
index 9e7c6399be2c8..514f86d078138 100644
--- a/generated/storage/image.pb.go
+++ b/generated/storage/image.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/image.proto
 
diff --git a/generated/storage/image_component.pb.go b/generated/storage/image_component.pb.go
index 6f19b3ae98933..f3de77c18fa76 100644
--- a/generated/storage/image_component.pb.go
+++ b/generated/storage/image_component.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/image_component.proto
 
diff --git a/generated/storage/image_integration.pb.go b/generated/storage/image_integration.pb.go
index a07822bbcd53f..5bd60d6f5a3de 100644
--- a/generated/storage/image_integration.pb.go
+++ b/generated/storage/image_integration.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/image_integration.proto
 
diff --git a/generated/storage/image_v2.pb.go b/generated/storage/image_v2.pb.go
index 91c8fec274ec4..5ad060b592d96 100644
--- a/generated/storage/image_v2.pb.go
+++ b/generated/storage/image_v2.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/image_v2.proto
 
diff --git a/generated/storage/installation.pb.go b/generated/storage/installation.pb.go
index 9116f619063db..d4377c57509ca 100644
--- a/generated/storage/installation.pb.go
+++ b/generated/storage/installation.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/installation.proto
 
diff --git a/generated/storage/integration_health.pb.go b/generated/storage/integration_health.pb.go
index 1db17d2ebdc65..19730f4b31677 100644
--- a/generated/storage/integration_health.pb.go
+++ b/generated/storage/integration_health.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/integration_health.proto
 
diff --git a/generated/storage/kube_event.pb.go b/generated/storage/kube_event.pb.go
index f16d6361dd25a..dfb2371d0fefb 100644
--- a/generated/storage/kube_event.pb.go
+++ b/generated/storage/kube_event.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/kube_event.proto
 
diff --git a/generated/storage/labels.pb.go b/generated/storage/labels.pb.go
index efef57b7c92a3..564be4ea5bea5 100644
--- a/generated/storage/labels.pb.go
+++ b/generated/storage/labels.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/labels.proto
 
diff --git a/generated/storage/log.pb.go b/generated/storage/log.pb.go
index 8d97ea23b666a..ccc10571fb333 100644
--- a/generated/storage/log.pb.go
+++ b/generated/storage/log.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/log.proto
 
diff --git a/generated/storage/mitre.pb.go b/generated/storage/mitre.pb.go
index ce55aad910033..eae305559454e 100644
--- a/generated/storage/mitre.pb.go
+++ b/generated/storage/mitre.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/mitre.proto
 
diff --git a/generated/storage/namespace_metadata.pb.go b/generated/storage/namespace_metadata.pb.go
index d1f325690d21a..416992ff47e30 100644
--- a/generated/storage/namespace_metadata.pb.go
+++ b/generated/storage/namespace_metadata.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/namespace_metadata.proto
 
diff --git a/generated/storage/network_baseline.pb.go b/generated/storage/network_baseline.pb.go
index 5eb542d00dac6..9aeff948794ed 100644
--- a/generated/storage/network_baseline.pb.go
+++ b/generated/storage/network_baseline.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/network_baseline.proto
 
diff --git a/generated/storage/network_flow.pb.go b/generated/storage/network_flow.pb.go
index f414d43499582..8c1037154ceca 100644
--- a/generated/storage/network_flow.pb.go
+++ b/generated/storage/network_flow.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/network_flow.proto
 
diff --git a/generated/storage/network_graph_config.pb.go b/generated/storage/network_graph_config.pb.go
index d4d827735d388..f997b69b2bec9 100644
--- a/generated/storage/network_graph_config.pb.go
+++ b/generated/storage/network_graph_config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/network_graph_config.proto
 
diff --git a/generated/storage/network_policy.pb.go b/generated/storage/network_policy.pb.go
index 7c54d9d2c5c07..5a024cf1fbcfc 100644
--- a/generated/storage/network_policy.pb.go
+++ b/generated/storage/network_policy.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/network_policy.proto
 
diff --git a/generated/storage/node.pb.go b/generated/storage/node.pb.go
index cc9988e90a4f6..26f5199b75a28 100644
--- a/generated/storage/node.pb.go
+++ b/generated/storage/node.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/node.proto
 
diff --git a/generated/storage/node_component.pb.go b/generated/storage/node_component.pb.go
index 11103bf02cf2e..e64871d9945e0 100644
--- a/generated/storage/node_component.pb.go
+++ b/generated/storage/node_component.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/node_component.proto
 
diff --git a/generated/storage/node_integration.pb.go b/generated/storage/node_integration.pb.go
index 62f2462fc3288..705aba38b1421 100644
--- a/generated/storage/node_integration.pb.go
+++ b/generated/storage/node_integration.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/node_integration.proto
 
diff --git a/generated/storage/notification_schedule.pb.go b/generated/storage/notification_schedule.pb.go
index b2bbe7ce7762d..5fc49b03dcac7 100644
--- a/generated/storage/notification_schedule.pb.go
+++ b/generated/storage/notification_schedule.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/notification_schedule.proto
 
diff --git a/generated/storage/notifier.pb.go b/generated/storage/notifier.pb.go
index 251d60ffc26b2..b18b3e0af803d 100644
--- a/generated/storage/notifier.pb.go
+++ b/generated/storage/notifier.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/notifier.proto
 
diff --git a/generated/storage/notifier_enc_config.pb.go b/generated/storage/notifier_enc_config.pb.go
index 81a3a16a931f3..be1f06c80499c 100644
--- a/generated/storage/notifier_enc_config.pb.go
+++ b/generated/storage/notifier_enc_config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/notifier_enc_config.proto
 
diff --git a/generated/storage/operation_status.pb.go b/generated/storage/operation_status.pb.go
index 52d2abff8fa90..3fd6f13c5ba2a 100644
--- a/generated/storage/operation_status.pb.go
+++ b/generated/storage/operation_status.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/operation_status.proto
 
diff --git a/generated/storage/orchestrator_integration.pb.go b/generated/storage/orchestrator_integration.pb.go
index 11e713af2a7df..76d6ce66b1d1d 100644
--- a/generated/storage/orchestrator_integration.pb.go
+++ b/generated/storage/orchestrator_integration.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/orchestrator_integration.proto
 
diff --git a/generated/storage/policy.pb.go b/generated/storage/policy.pb.go
index c99de9332733b..bee936d9fb804 100644
--- a/generated/storage/policy.pb.go
+++ b/generated/storage/policy.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/policy.proto
 
@@ -392,6 +392,56 @@ func (Comparator) EnumDescriptor() ([]byte, []int) {
 	return file_storage_policy_proto_rawDescGZIP(), []int{6}
 }
 
+// WorkloadKind is a Kubernetes workload kind that can be excluded from a policy in bulk.
+type Exclusion_WorkloadKind int32
+
+const (
+	Exclusion_WORKLOAD_KIND_UNSPECIFIED Exclusion_WorkloadKind = 0
+	Exclusion_CRON_JOB                  Exclusion_WorkloadKind = 1
+	Exclusion_JOB                       Exclusion_WorkloadKind = 2
+)
+
+// Enum value maps for Exclusion_WorkloadKind.
+var (
+	Exclusion_WorkloadKind_name = map[int32]string{
+		0: "WORKLOAD_KIND_UNSPECIFIED",
+		1: "CRON_JOB",
+		2: "JOB",
+	}
+	Exclusion_WorkloadKind_value = map[string]int32{
+		"WORKLOAD_KIND_UNSPECIFIED": 0,
+		"CRON_JOB":                  1,
+		"JOB":                       2,
+	}
+)
+
+func (x Exclusion_WorkloadKind) Enum() *Exclusion_WorkloadKind {
+	p := new(Exclusion_WorkloadKind)
+	*p = x
+	return p
+}
+
+func (x Exclusion_WorkloadKind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Exclusion_WorkloadKind) Descriptor() protoreflect.EnumDescriptor {
+	return file_storage_policy_proto_enumTypes[7].Descriptor()
+}
+
+func (Exclusion_WorkloadKind) Type() protoreflect.EnumType {
+	return &file_storage_policy_proto_enumTypes[7]
+}
+
+func (x Exclusion_WorkloadKind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Exclusion_WorkloadKind.Descriptor instead.
+func (Exclusion_WorkloadKind) EnumDescriptor() ([]byte, []int) {
+	return file_storage_policy_proto_rawDescGZIP(), []int{7, 0}
+}
+
 // Next tag: 29
 type Policy struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -411,7 +461,7 @@ type Policy struct {
 	LifecycleStages []LifecycleStage `protobuf:"varint,9,rep,packed,name=lifecycle_stages,json=lifecycleStages,proto3,enum=storage.LifecycleStage" json:"lifecycle_stages,omitempty" search:"Lifecycle Stage" crYaml:"lifecycleStages,stringer"` // @gotags: search:"Lifecycle Stage" crYaml:"lifecycleStages,stringer"
 	// Describes which events should trigger execution of this policy
 	EventSource EventSource `protobuf:"varint,22,opt,name=event_source,json=eventSource,proto3,enum=storage.EventSource" json:"event_source,omitempty" crYaml:"eventSource,stringer"` // @gotags: crYaml:"eventSource,stringer"
-	// Define deployments or images that should be excluded from this policy.
+	// Define deployments, images, or workload kinds that should be excluded from this policy.
 	Exclusions []*Exclusion `protobuf:"bytes,21,rep,name=exclusions,proto3" json:"exclusions,omitempty" crYaml:",omitempty"` // @gotags: crYaml:",omitempty"
 	// Defines clusters, namespaces, and deployments that should be included in this policy.  No scopes defined includes everything.
 	Scope []*Scope `protobuf:"bytes,11,rep,name=scope,proto3" json:"scope,omitempty" crYaml:",omitempty"` // @gotags: crYaml:",omitempty"
@@ -1008,7 +1058,7 @@ func (x *ListPolicy) GetEvaluationFilter() *EvaluationFilter {
 // EvaluationFilter pre-filters which entities a policy evaluates.
 type EvaluationFilter struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
-	SkipContainerTypes []ContainerType        `protobuf:"varint,1,rep,packed,name=skip_container_types,json=skipContainerTypes,proto3,enum=storage.ContainerType" json:"skip_container_types,omitempty"`
+	SkipContainerTypes []ContainerType        `protobuf:"varint,1,rep,packed,name=skip_container_types,json=skipContainerTypes,proto3,enum=storage.ContainerType" json:"skip_container_types,omitempty" crYaml:"skipContainerTypes,omitempty,stringer"` // @gotags: crYaml:"skipContainerTypes,omitempty,stringer"
 	unknownFields      protoimpl.UnknownFields
 	sizeCache          protoimpl.SizeCache
 }
@@ -1051,11 +1101,18 @@ func (x *EvaluationFilter) GetSkipContainerTypes() []ContainerType {
 }
 
 type Exclusion struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty" crYaml:",omitempty"`             // @gotags: crYaml:",omitempty"
-	Deployment    *Exclusion_Deployment  `protobuf:"bytes,5,opt,name=deployment,proto3" json:"deployment,omitempty" crYaml:",omitempty"` // @gotags: crYaml:",omitempty"
-	Image         *Exclusion_Image       `protobuf:"bytes,7,opt,name=image,proto3" json:"image,omitempty" crYaml:",omitempty"`           // @gotags: crYaml:",omitempty"
-	Expiration    *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=expiration,proto3" json:"expiration,omitempty" crYaml:",timestamp,omitempty"` // @gotags: crYaml:",timestamp,omitempty"
+	state      protoimpl.MessageState `protogen:"open.v1"`
+	Name       string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty" crYaml:",omitempty"`             // @gotags: crYaml:",omitempty"
+	Image      *Exclusion_Image       `protobuf:"bytes,7,opt,name=image,proto3" json:"image,omitempty" crYaml:",omitempty"`           // @gotags: crYaml:",omitempty"
+	Expiration *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=expiration,proto3" json:"expiration,omitempty" crYaml:",timestamp,omitempty"` // @gotags: crYaml:",timestamp,omitempty"
+	// matcher is either a name/scope exclusion or an exclusion by Kubernetes kind.
+	// Image stays outside the oneof because existing payloads may set both image and deployment.
+	//
+	// Types that are valid to be assigned to Matcher:
+	//
+	//	*Exclusion_Deployment_
+	//	*Exclusion_ExcludeByKind_
+	Matcher       isExclusion_Matcher `protobuf_oneof:"matcher"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1097,27 +1154,61 @@ func (x *Exclusion) GetName() string {
 	return ""
 }
 
-func (x *Exclusion) GetDeployment() *Exclusion_Deployment {
+func (x *Exclusion) GetImage() *Exclusion_Image {
 	if x != nil {
-		return x.Deployment
+		return x.Image
 	}
 	return nil
 }
 
-func (x *Exclusion) GetImage() *Exclusion_Image {
+func (x *Exclusion) GetExpiration() *timestamppb.Timestamp {
 	if x != nil {
-		return x.Image
+		return x.Expiration
 	}
 	return nil
 }
 
-func (x *Exclusion) GetExpiration() *timestamppb.Timestamp {
+func (x *Exclusion) GetMatcher() isExclusion_Matcher {
 	if x != nil {
-		return x.Expiration
+		return x.Matcher
 	}
 	return nil
 }
 
+func (x *Exclusion) GetDeployment() *Exclusion_Deployment {
+	if x != nil {
+		if x, ok := x.Matcher.(*Exclusion_Deployment_); ok {
+			return x.Deployment
+		}
+	}
+	return nil
+}
+
+func (x *Exclusion) GetExcludeByKind() *Exclusion_ExcludeByKind {
+	if x != nil {
+		if x, ok := x.Matcher.(*Exclusion_ExcludeByKind_); ok {
+			return x.ExcludeByKind
+		}
+	}
+	return nil
+}
+
+type isExclusion_Matcher interface {
+	isExclusion_Matcher()
+}
+
+type Exclusion_Deployment_ struct {
+	Deployment *Exclusion_Deployment `protobuf:"bytes,5,opt,name=deployment,proto3,oneof" crYaml:",omitempty"` // @gotags: crYaml:",omitempty"
+}
+
+type Exclusion_ExcludeByKind_ struct {
+	ExcludeByKind *Exclusion_ExcludeByKind `protobuf:"bytes,8,opt,name=exclude_by_kind,json=excludeByKind,proto3,oneof" crYaml:"excludeByKind,omitempty"` // @gotags: crYaml:"excludeByKind,omitempty"
+}
+
+func (*Exclusion_Deployment_) isExclusion_Matcher() {}
+
+func (*Exclusion_ExcludeByKind_) isExclusion_Matcher() {}
+
 // ExportPoliciesResponse is used by the API but it is defined in storage because we expect customers to store them.
 // We do backwards-compatibility checks on objects in the storge folder and those checks should be applied to this object
 type ExportPoliciesResponse struct {
@@ -1356,6 +1447,51 @@ func (x *Exclusion_Image) GetName() string {
 	return ""
 }
 
+// ExcludeByKind excludes all workloads of the selected Kubernetes kinds.
+type Exclusion_ExcludeByKind struct {
+	state         protoimpl.MessageState   `protogen:"open.v1"`
+	Kinds         []Exclusion_WorkloadKind `protobuf:"varint,1,rep,packed,name=kinds,proto3,enum=storage.Exclusion_WorkloadKind" json:"kinds,omitempty" crYaml:",omitempty,stringer"` // @gotags: crYaml:",omitempty,stringer"
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Exclusion_ExcludeByKind) Reset() {
+	*x = Exclusion_ExcludeByKind{}
+	mi := &file_storage_policy_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Exclusion_ExcludeByKind) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Exclusion_ExcludeByKind) ProtoMessage() {}
+
+func (x *Exclusion_ExcludeByKind) ProtoReflect() protoreflect.Message {
+	mi := &file_storage_policy_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Exclusion_ExcludeByKind.ProtoReflect.Descriptor instead.
+func (*Exclusion_ExcludeByKind) Descriptor() ([]byte, []int) {
+	return file_storage_policy_proto_rawDescGZIP(), []int{7, 3}
+}
+
+func (x *Exclusion_ExcludeByKind) GetKinds() []Exclusion_WorkloadKind {
+	if x != nil {
+		return x.Kinds
+	}
+	return nil
+}
+
 var File_storage_policy_proto protoreflect.FileDescriptor
 
 const file_storage_policy_proto_rawDesc = "" +
@@ -1430,16 +1566,17 @@ const file_storage_policy_proto_rawDesc = "" +
 	"\x06source\x18\v \x01(\x0e2\x15.storage.PolicySourceR\x06source\x12F\n" +
 	"\x11evaluation_filter\x18\f \x01(\v2\x19.storage.EvaluationFilterR\x10evaluationFilter\"\\\n" +
 	"\x10EvaluationFilter\x12H\n" +
-	"\x14skip_container_types\x18\x01 \x03(\x0e2\x16.storage.ContainerTypeR\x12skipContainerTypes\"\xf5\x02\n" +
+	"\x14skip_container_types\x18\x01 \x03(\x0e2\x16.storage.ContainerTypeR\x12skipContainerTypes\"\xdc\x04\n" +
 	"\tExclusion\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\x12=\n" +
-	"\n" +
-	"deployment\x18\x05 \x01(\v2\x1d.storage.Exclusion.DeploymentR\n" +
-	"deployment\x12.\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12.\n" +
 	"\x05image\x18\a \x01(\v2\x18.storage.Exclusion.ImageR\x05image\x12:\n" +
 	"\n" +
 	"expiration\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
-	"expiration\x1a>\n" +
+	"expiration\x12?\n" +
+	"\n" +
+	"deployment\x18\x05 \x01(\v2\x1d.storage.Exclusion.DeploymentH\x00R\n" +
+	"deployment\x12J\n" +
+	"\x0fexclude_by_kind\x18\b \x01(\v2 .storage.Exclusion.ExcludeByKindH\x00R\rexcludeByKind\x1a>\n" +
 	"\tContainer\x121\n" +
 	"\n" +
 	"image_name\x18\x03 \x01(\v2\x12.storage.ImageNameR\timageName\x1aF\n" +
@@ -1448,7 +1585,14 @@ const file_storage_policy_proto_rawDesc = "" +
 	"\x04name\x18\x03 \x01(\tR\x04name\x12$\n" +
 	"\x05scope\x18\x04 \x01(\v2\x0e.storage.ScopeR\x05scope\x1a\x1b\n" +
 	"\x05Image\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04nameJ\x04\b\x02\x10\x03\"E\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x1aF\n" +
+	"\rExcludeByKind\x125\n" +
+	"\x05kinds\x18\x01 \x03(\x0e2\x1f.storage.Exclusion.WorkloadKindR\x05kinds\"D\n" +
+	"\fWorkloadKind\x12\x1d\n" +
+	"\x19WORKLOAD_KIND_UNSPECIFIED\x10\x00\x12\f\n" +
+	"\bCRON_JOB\x10\x01\x12\a\n" +
+	"\x03JOB\x10\x02B\t\n" +
+	"\amatcherJ\x04\b\x02\x10\x03\"E\n" +
 	"\x16ExportPoliciesResponse\x12+\n" +
 	"\bpolicies\x18\x01 \x03(\v2\x0f.storage.PolicyR\bpolicies*/\n" +
 	"\fPolicySource\x12\x0e\n" +
@@ -1506,8 +1650,8 @@ func file_storage_policy_proto_rawDescGZIP() []byte {
 	return file_storage_policy_proto_rawDescData
 }
 
-var file_storage_policy_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
-var file_storage_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
+var file_storage_policy_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
+var file_storage_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_storage_policy_proto_goTypes = []any{
 	(PolicySource)(0),                 // 0: storage.PolicySource
 	(EventSource)(0),                  // 1: storage.EventSource
@@ -1516,58 +1660,62 @@ var file_storage_policy_proto_goTypes = []any{
 	(Severity)(0),                     // 4: storage.Severity
 	(LifecycleStage)(0),               // 5: storage.LifecycleStage
 	(Comparator)(0),                   // 6: storage.Comparator
-	(*Policy)(nil),                    // 7: storage.Policy
-	(*PolicySection)(nil),             // 8: storage.PolicySection
-	(*PolicyGroup)(nil),               // 9: storage.PolicyGroup
-	(*PolicyValue)(nil),               // 10: storage.PolicyValue
-	(*PolicyList)(nil),                // 11: storage.PolicyList
-	(*ListPolicy)(nil),                // 12: storage.ListPolicy
-	(*EvaluationFilter)(nil),          // 13: storage.EvaluationFilter
-	(*Exclusion)(nil),                 // 14: storage.Exclusion
-	(*ExportPoliciesResponse)(nil),    // 15: storage.ExportPoliciesResponse
-	(*Policy_MitreAttackVectors)(nil), // 16: storage.Policy.MitreAttackVectors
-	(*Exclusion_Container)(nil),       // 17: storage.Exclusion.Container
-	(*Exclusion_Deployment)(nil),      // 18: storage.Exclusion.Deployment
-	(*Exclusion_Image)(nil),           // 19: storage.Exclusion.Image
-	(*Scope)(nil),                     // 20: storage.Scope
-	(*timestamppb.Timestamp)(nil),     // 21: google.protobuf.Timestamp
-	(ContainerType)(0),                // 22: storage.ContainerType
-	(*ImageName)(nil),                 // 23: storage.ImageName
+	(Exclusion_WorkloadKind)(0),       // 7: storage.Exclusion.WorkloadKind
+	(*Policy)(nil),                    // 8: storage.Policy
+	(*PolicySection)(nil),             // 9: storage.PolicySection
+	(*PolicyGroup)(nil),               // 10: storage.PolicyGroup
+	(*PolicyValue)(nil),               // 11: storage.PolicyValue
+	(*PolicyList)(nil),                // 12: storage.PolicyList
+	(*ListPolicy)(nil),                // 13: storage.ListPolicy
+	(*EvaluationFilter)(nil),          // 14: storage.EvaluationFilter
+	(*Exclusion)(nil),                 // 15: storage.Exclusion
+	(*ExportPoliciesResponse)(nil),    // 16: storage.ExportPoliciesResponse
+	(*Policy_MitreAttackVectors)(nil), // 17: storage.Policy.MitreAttackVectors
+	(*Exclusion_Container)(nil),       // 18: storage.Exclusion.Container
+	(*Exclusion_Deployment)(nil),      // 19: storage.Exclusion.Deployment
+	(*Exclusion_Image)(nil),           // 20: storage.Exclusion.Image
+	(*Exclusion_ExcludeByKind)(nil),   // 21: storage.Exclusion.ExcludeByKind
+	(*Scope)(nil),                     // 22: storage.Scope
+	(*timestamppb.Timestamp)(nil),     // 23: google.protobuf.Timestamp
+	(ContainerType)(0),                // 24: storage.ContainerType
+	(*ImageName)(nil),                 // 25: storage.ImageName
 }
 var file_storage_policy_proto_depIdxs = []int32{
 	5,  // 0: storage.Policy.lifecycle_stages:type_name -> storage.LifecycleStage
 	1,  // 1: storage.Policy.event_source:type_name -> storage.EventSource
-	14, // 2: storage.Policy.exclusions:type_name -> storage.Exclusion
-	20, // 3: storage.Policy.scope:type_name -> storage.Scope
+	15, // 2: storage.Policy.exclusions:type_name -> storage.Exclusion
+	22, // 3: storage.Policy.scope:type_name -> storage.Scope
 	4,  // 4: storage.Policy.severity:type_name -> storage.Severity
 	3,  // 5: storage.Policy.enforcement_actions:type_name -> storage.EnforcementAction
-	21, // 6: storage.Policy.last_updated:type_name -> google.protobuf.Timestamp
-	8,  // 7: storage.Policy.policy_sections:type_name -> storage.PolicySection
-	16, // 8: storage.Policy.mitre_attack_vectors:type_name -> storage.Policy.MitreAttackVectors
+	23, // 6: storage.Policy.last_updated:type_name -> google.protobuf.Timestamp
+	9,  // 7: storage.Policy.policy_sections:type_name -> storage.PolicySection
+	17, // 8: storage.Policy.mitre_attack_vectors:type_name -> storage.Policy.MitreAttackVectors
 	0,  // 9: storage.Policy.source:type_name -> storage.PolicySource
-	13, // 10: storage.Policy.evaluation_filter:type_name -> storage.EvaluationFilter
-	9,  // 11: storage.PolicySection.policy_groups:type_name -> storage.PolicyGroup
+	14, // 10: storage.Policy.evaluation_filter:type_name -> storage.EvaluationFilter
+	10, // 11: storage.PolicySection.policy_groups:type_name -> storage.PolicyGroup
 	2,  // 12: storage.PolicyGroup.boolean_operator:type_name -> storage.BooleanOperator
-	10, // 13: storage.PolicyGroup.values:type_name -> storage.PolicyValue
-	7,  // 14: storage.PolicyList.policies:type_name -> storage.Policy
+	11, // 13: storage.PolicyGroup.values:type_name -> storage.PolicyValue
+	8,  // 14: storage.PolicyList.policies:type_name -> storage.Policy
 	4,  // 15: storage.ListPolicy.severity:type_name -> storage.Severity
 	5,  // 16: storage.ListPolicy.lifecycle_stages:type_name -> storage.LifecycleStage
-	21, // 17: storage.ListPolicy.last_updated:type_name -> google.protobuf.Timestamp
+	23, // 17: storage.ListPolicy.last_updated:type_name -> google.protobuf.Timestamp
 	1,  // 18: storage.ListPolicy.event_source:type_name -> storage.EventSource
 	0,  // 19: storage.ListPolicy.source:type_name -> storage.PolicySource
-	13, // 20: storage.ListPolicy.evaluation_filter:type_name -> storage.EvaluationFilter
-	22, // 21: storage.EvaluationFilter.skip_container_types:type_name -> storage.ContainerType
-	18, // 22: storage.Exclusion.deployment:type_name -> storage.Exclusion.Deployment
-	19, // 23: storage.Exclusion.image:type_name -> storage.Exclusion.Image
-	21, // 24: storage.Exclusion.expiration:type_name -> google.protobuf.Timestamp
-	7,  // 25: storage.ExportPoliciesResponse.policies:type_name -> storage.Policy
-	23, // 26: storage.Exclusion.Container.image_name:type_name -> storage.ImageName
-	20, // 27: storage.Exclusion.Deployment.scope:type_name -> storage.Scope
-	28, // [28:28] is the sub-list for method output_type
-	28, // [28:28] is the sub-list for method input_type
-	28, // [28:28] is the sub-list for extension type_name
-	28, // [28:28] is the sub-list for extension extendee
-	0,  // [0:28] is the sub-list for field type_name
+	14, // 20: storage.ListPolicy.evaluation_filter:type_name -> storage.EvaluationFilter
+	24, // 21: storage.EvaluationFilter.skip_container_types:type_name -> storage.ContainerType
+	20, // 22: storage.Exclusion.image:type_name -> storage.Exclusion.Image
+	23, // 23: storage.Exclusion.expiration:type_name -> google.protobuf.Timestamp
+	19, // 24: storage.Exclusion.deployment:type_name -> storage.Exclusion.Deployment
+	21, // 25: storage.Exclusion.exclude_by_kind:type_name -> storage.Exclusion.ExcludeByKind
+	8,  // 26: storage.ExportPoliciesResponse.policies:type_name -> storage.Policy
+	25, // 27: storage.Exclusion.Container.image_name:type_name -> storage.ImageName
+	22, // 28: storage.Exclusion.Deployment.scope:type_name -> storage.Scope
+	7,  // 29: storage.Exclusion.ExcludeByKind.kinds:type_name -> storage.Exclusion.WorkloadKind
+	30, // [30:30] is the sub-list for method output_type
+	30, // [30:30] is the sub-list for method input_type
+	30, // [30:30] is the sub-list for extension type_name
+	30, // [30:30] is the sub-list for extension extendee
+	0,  // [0:30] is the sub-list for field type_name
 }
 
 func init() { file_storage_policy_proto_init() }
@@ -1578,13 +1726,17 @@ func file_storage_policy_proto_init() {
 	file_storage_deployment_proto_init()
 	file_storage_image_proto_init()
 	file_storage_scope_proto_init()
+	file_storage_policy_proto_msgTypes[7].OneofWrappers = []any{
+		(*Exclusion_Deployment_)(nil),
+		(*Exclusion_ExcludeByKind_)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_storage_policy_proto_rawDesc), len(file_storage_policy_proto_rawDesc)),
-			NumEnums:      7,
-			NumMessages:   13,
+			NumEnums:      8,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/generated/storage/policy_category.pb.go b/generated/storage/policy_category.pb.go
index 1d9f7c240caee..9f251b985de73 100644
--- a/generated/storage/policy_category.pb.go
+++ b/generated/storage/policy_category.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/policy_category.proto
 
diff --git a/generated/storage/policy_vtproto.pb.go b/generated/storage/policy_vtproto.pb.go
index e24289130948a..4e4e98f768d0f 100644
--- a/generated/storage/policy_vtproto.pb.go
+++ b/generated/storage/policy_vtproto.pb.go
@@ -325,15 +325,38 @@ func (m *Exclusion_Image) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *Exclusion_ExcludeByKind) CloneVT() *Exclusion_ExcludeByKind {
+	if m == nil {
+		return (*Exclusion_ExcludeByKind)(nil)
+	}
+	r := new(Exclusion_ExcludeByKind)
+	if rhs := m.Kinds; rhs != nil {
+		tmpContainer := make([]Exclusion_WorkloadKind, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Kinds = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *Exclusion_ExcludeByKind) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
 func (m *Exclusion) CloneVT() *Exclusion {
 	if m == nil {
 		return (*Exclusion)(nil)
 	}
 	r := new(Exclusion)
 	r.Name = m.Name
-	r.Deployment = m.Deployment.CloneVT()
 	r.Image = m.Image.CloneVT()
 	r.Expiration = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.Expiration).CloneVT())
+	if m.Matcher != nil {
+		r.Matcher = m.Matcher.(interface{ CloneVT() isExclusion_Matcher }).CloneVT()
+	}
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -345,6 +368,24 @@ func (m *Exclusion) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *Exclusion_Deployment_) CloneVT() isExclusion_Matcher {
+	if m == nil {
+		return (*Exclusion_Deployment_)(nil)
+	}
+	r := new(Exclusion_Deployment_)
+	r.Deployment = m.Deployment.CloneVT()
+	return r
+}
+
+func (m *Exclusion_ExcludeByKind_) CloneVT() isExclusion_Matcher {
+	if m == nil {
+		return (*Exclusion_ExcludeByKind_)(nil)
+	}
+	r := new(Exclusion_ExcludeByKind_)
+	r.ExcludeByKind = m.ExcludeByKind.CloneVT()
+	return r
+}
+
 func (m *ExportPoliciesResponse) CloneVT() *ExportPoliciesResponse {
 	if m == nil {
 		return (*ExportPoliciesResponse)(nil)
@@ -849,16 +890,50 @@ func (this *Exclusion_Image) EqualMessageVT(thatMsg proto.Message) bool {
 	}
 	return this.EqualVT(that)
 }
+func (this *Exclusion_ExcludeByKind) EqualVT(that *Exclusion_ExcludeByKind) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Kinds) != len(that.Kinds) {
+		return false
+	}
+	for i, vx := range this.Kinds {
+		vy := that.Kinds[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *Exclusion_ExcludeByKind) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*Exclusion_ExcludeByKind)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
 func (this *Exclusion) EqualVT(that *Exclusion) bool {
 	if this == that {
 		return true
 	} else if this == nil || that == nil {
 		return false
 	}
-	if this.Name != that.Name {
+	if this.Matcher == nil && that.Matcher != nil {
 		return false
+	} else if this.Matcher != nil {
+		if that.Matcher == nil {
+			return false
+		}
+		if !this.Matcher.(interface {
+			EqualVT(isExclusion_Matcher) bool
+		}).EqualVT(that.Matcher) {
+			return false
+		}
 	}
-	if !this.Deployment.EqualVT(that.Deployment) {
+	if this.Name != that.Name {
 		return false
 	}
 	if !(*timestamppb1.Timestamp)(this.Expiration).EqualVT((*timestamppb1.Timestamp)(that.Expiration)) {
@@ -877,6 +952,56 @@ func (this *Exclusion) EqualMessageVT(thatMsg proto.Message) bool {
 	}
 	return this.EqualVT(that)
 }
+func (this *Exclusion_Deployment_) EqualVT(thatIface isExclusion_Matcher) bool {
+	that, ok := thatIface.(*Exclusion_Deployment_)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.Deployment, that.Deployment; p != q {
+		if p == nil {
+			p = &Exclusion_Deployment{}
+		}
+		if q == nil {
+			q = &Exclusion_Deployment{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
+func (this *Exclusion_ExcludeByKind_) EqualVT(thatIface isExclusion_Matcher) bool {
+	that, ok := thatIface.(*Exclusion_ExcludeByKind_)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.ExcludeByKind, that.ExcludeByKind; p != q {
+		if p == nil {
+			p = &Exclusion_ExcludeByKind{}
+		}
+		if q == nil {
+			q = &Exclusion_ExcludeByKind{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *ExportPoliciesResponse) EqualVT(that *ExportPoliciesResponse) bool {
 	if this == that {
 		return true
@@ -1797,6 +1922,60 @@ func (m *Exclusion_Image) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *Exclusion_ExcludeByKind) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Exclusion_ExcludeByKind) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *Exclusion_ExcludeByKind) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Kinds) > 0 {
+		var pksize2 int
+		for _, num := range m.Kinds {
+			pksize2 += protohelpers.SizeOfVarint(uint64(num))
+		}
+		i -= pksize2
+		j1 := i
+		for _, num1 := range m.Kinds {
+			num := uint64(num1)
+			for num >= 1<<7 {
+				dAtA[j1] = uint8(uint64(num)&0x7f | 0x80)
+				num >>= 7
+				j1++
+			}
+			dAtA[j1] = uint8(num)
+			j1++
+		}
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(pksize2))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *Exclusion) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -1827,6 +2006,15 @@ func (m *Exclusion) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if vtmsg, ok := m.Matcher.(interface {
+		MarshalToSizedBufferVT([]byte) (int, error)
+	}); ok {
+		size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+	}
 	if m.Image != nil {
 		size, err := m.Image.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -1847,6 +2035,23 @@ func (m *Exclusion) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x32
 	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Exclusion_Deployment_) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *Exclusion_Deployment_) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
 	if m.Deployment != nil {
 		size, err := m.Deployment.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -1856,17 +2061,36 @@ func (m *Exclusion) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
 		i--
 		dAtA[i] = 0x2a
-	}
-	if len(m.Name) > 0 {
-		i -= len(m.Name)
-		copy(dAtA[i:], m.Name)
-		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x2a
 	}
 	return len(dAtA) - i, nil
 }
+func (m *Exclusion_ExcludeByKind_) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
 
+func (m *Exclusion_ExcludeByKind_) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.ExcludeByKind != nil {
+		size, err := m.ExcludeByKind.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x42
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x42
+	}
+	return len(dAtA) - i, nil
+}
 func (m *ExportPoliciesResponse) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -2253,6 +2477,23 @@ func (m *Exclusion_Image) SizeVT() (n int) {
 	return n
 }
 
+func (m *Exclusion_ExcludeByKind) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Kinds) > 0 {
+		l = 0
+		for _, e := range m.Kinds {
+			l += protohelpers.SizeOfVarint(uint64(e))
+		}
+		n += 1 + protohelpers.SizeOfVarint(uint64(l)) + l
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
 func (m *Exclusion) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -2263,9 +2504,8 @@ func (m *Exclusion) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
-	if m.Deployment != nil {
-		l = m.Deployment.SizeVT()
-		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	if vtmsg, ok := m.Matcher.(interface{ SizeVT() int }); ok {
+		n += vtmsg.SizeVT()
 	}
 	if m.Expiration != nil {
 		l = (*timestamppb1.Timestamp)(m.Expiration).SizeVT()
@@ -2279,6 +2519,34 @@ func (m *Exclusion) SizeVT() (n int) {
 	return n
 }
 
+func (m *Exclusion_Deployment_) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Deployment != nil {
+		l = m.Deployment.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
+func (m *Exclusion_ExcludeByKind_) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ExcludeByKind != nil {
+		l = m.ExcludeByKind.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *ExportPoliciesResponse) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -4551,6 +4819,126 @@ func (m *Exclusion_Image) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *Exclusion_ExcludeByKind) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Exclusion_ExcludeByKind: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Exclusion_ExcludeByKind: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType == 0 {
+				var v Exclusion_WorkloadKind
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					v |= Exclusion_WorkloadKind(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				m.Kinds = append(m.Kinds, v)
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				if packedLen < 0 {
+					return protohelpers.ErrInvalidLength
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return protohelpers.ErrInvalidLength
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				if elementCount != 0 && len(m.Kinds) == 0 {
+					m.Kinds = make([]Exclusion_WorkloadKind, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v Exclusion_WorkloadKind
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						v |= Exclusion_WorkloadKind(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					m.Kinds = append(m.Kinds, v)
+				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kinds", wireType)
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *Exclusion) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -4641,11 +5029,16 @@ func (m *Exclusion) UnmarshalVT(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Deployment == nil {
-				m.Deployment = &Exclusion_Deployment{}
-			}
-			if err := m.Deployment.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if oneof, ok := m.Matcher.(*Exclusion_Deployment_); ok {
+				if err := oneof.Deployment.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &Exclusion_Deployment{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Matcher = &Exclusion_Deployment_{Deployment: v}
 			}
 			iNdEx = postIndex
 		case 6:
@@ -4720,6 +5113,47 @@ func (m *Exclusion) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExcludeByKind", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Matcher.(*Exclusion_ExcludeByKind_); ok {
+				if err := oneof.ExcludeByKind.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &Exclusion_ExcludeByKind{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Matcher = &Exclusion_ExcludeByKind_{ExcludeByKind: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -7167,6 +7601,126 @@ func (m *Exclusion_Image) UnmarshalVTUnsafe(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *Exclusion_ExcludeByKind) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Exclusion_ExcludeByKind: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Exclusion_ExcludeByKind: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType == 0 {
+				var v Exclusion_WorkloadKind
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					v |= Exclusion_WorkloadKind(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				m.Kinds = append(m.Kinds, v)
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				if packedLen < 0 {
+					return protohelpers.ErrInvalidLength
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return protohelpers.ErrInvalidLength
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				if elementCount != 0 && len(m.Kinds) == 0 {
+					m.Kinds = make([]Exclusion_WorkloadKind, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v Exclusion_WorkloadKind
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						v |= Exclusion_WorkloadKind(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					m.Kinds = append(m.Kinds, v)
+				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kinds", wireType)
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *Exclusion) UnmarshalVTUnsafe(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -7261,11 +7815,16 @@ func (m *Exclusion) UnmarshalVTUnsafe(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Deployment == nil {
-				m.Deployment = &Exclusion_Deployment{}
-			}
-			if err := m.Deployment.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if oneof, ok := m.Matcher.(*Exclusion_Deployment_); ok {
+				if err := oneof.Deployment.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &Exclusion_Deployment{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Matcher = &Exclusion_Deployment_{Deployment: v}
 			}
 			iNdEx = postIndex
 		case 6:
@@ -7340,6 +7899,47 @@ func (m *Exclusion) UnmarshalVTUnsafe(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExcludeByKind", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Matcher.(*Exclusion_ExcludeByKind_); ok {
+				if err := oneof.ExcludeByKind.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &Exclusion_ExcludeByKind{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Matcher = &Exclusion_ExcludeByKind_{ExcludeByKind: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/generated/storage/process_baseline.pb.go b/generated/storage/process_baseline.pb.go
index 60b8012737c28..5514b838e8e50 100644
--- a/generated/storage/process_baseline.pb.go
+++ b/generated/storage/process_baseline.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/process_baseline.proto
 
diff --git a/generated/storage/process_indicator.pb.go b/generated/storage/process_indicator.pb.go
index 8bb409310fb2b..42af97489fbef 100644
--- a/generated/storage/process_indicator.pb.go
+++ b/generated/storage/process_indicator.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/process_indicator.proto
 
diff --git a/generated/storage/process_listening_on_port.pb.go b/generated/storage/process_listening_on_port.pb.go
index aed79161edf94..d6f7d2bf73396 100644
--- a/generated/storage/process_listening_on_port.pb.go
+++ b/generated/storage/process_listening_on_port.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/process_listening_on_port.proto
 
diff --git a/generated/storage/rbac.pb.go b/generated/storage/rbac.pb.go
index c792bfb7cd9a2..dbde734a53ab8 100644
--- a/generated/storage/rbac.pb.go
+++ b/generated/storage/rbac.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/rbac.proto
 
diff --git a/generated/storage/relations.pb.go b/generated/storage/relations.pb.go
index 9fa78603c26f5..1e51ad5cb2adc 100644
--- a/generated/storage/relations.pb.go
+++ b/generated/storage/relations.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/relations.proto
 
diff --git a/generated/storage/report_configuration.pb.go b/generated/storage/report_configuration.pb.go
index 6b916dde2269d..3f969710bdc18 100644
--- a/generated/storage/report_configuration.pb.go
+++ b/generated/storage/report_configuration.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/report_configuration.proto
 
@@ -132,16 +132,19 @@ func (EntityField) EnumDescriptor() ([]byte, []int) {
 type ReportConfiguration_ReportType int32
 
 const (
-	ReportConfiguration_VULNERABILITY ReportConfiguration_ReportType = 0
+	ReportConfiguration_VULNERABILITY      ReportConfiguration_ReportType = 0 // for historical reasons, this short form was used to mean "Image Vulnerability"
+	ReportConfiguration_NODE_VULNERABILITY ReportConfiguration_ReportType = 1
 )
 
 // Enum value maps for ReportConfiguration_ReportType.
 var (
 	ReportConfiguration_ReportType_name = map[int32]string{
 		0: "VULNERABILITY",
+		1: "NODE_VULNERABILITY",
 	}
 	ReportConfiguration_ReportType_value = map[string]int32{
-		"VULNERABILITY": 0,
+		"VULNERABILITY":      0,
+		"NODE_VULNERABILITY": 1,
 	}
 )
 
@@ -322,6 +325,7 @@ type ReportConfiguration struct {
 	// Types that are valid to be assigned to Filter:
 	//
 	//	*ReportConfiguration_VulnReportFilters
+	//	*ReportConfiguration_NodeVulnReportFilters
 	Filter isReportConfiguration_Filter `protobuf_oneof:"filter"`
 	// Deprecated: V1 field. Use resource_scope instead.
 	//
@@ -424,6 +428,15 @@ func (x *ReportConfiguration) GetVulnReportFilters() *VulnerabilityReportFilters
 	return nil
 }
 
+func (x *ReportConfiguration) GetNodeVulnReportFilters() *NodeVulnerabilityReportFilters {
+	if x != nil {
+		if x, ok := x.Filter.(*ReportConfiguration_NodeVulnReportFilters); ok {
+			return x.NodeVulnReportFilters
+		}
+	}
+	return nil
+}
+
 // Deprecated: Marked as deprecated in storage/report_configuration.proto.
 func (x *ReportConfiguration) GetScopeId() string {
 	if x != nil {
@@ -508,8 +521,14 @@ type ReportConfiguration_VulnReportFilters struct {
 	VulnReportFilters *VulnerabilityReportFilters `protobuf:"bytes,5,opt,name=vuln_report_filters,json=vulnReportFilters,proto3,oneof"`
 }
 
+type ReportConfiguration_NodeVulnReportFilters struct {
+	NodeVulnReportFilters *NodeVulnerabilityReportFilters `protobuf:"bytes,15,opt,name=node_vuln_report_filters,json=nodeVulnReportFilters,proto3,oneof"`
+}
+
 func (*ReportConfiguration_VulnReportFilters) isReportConfiguration_Filter() {}
 
+func (*ReportConfiguration_NodeVulnReportFilters) isReportConfiguration_Filter() {}
+
 type isReportConfiguration_NotifierConfig interface {
 	isReportConfiguration_NotifierConfig()
 }
@@ -951,6 +970,88 @@ func (x *EntityScopeRule) GetValues() []*RuleValue {
 	return nil
 }
 
+type NodeVulnerabilityReportFilters struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to CvesSince:
+	//
+	//	*NodeVulnerabilityReportFilters_AllVuln
+	CvesSince        isNodeVulnerabilityReportFilters_CvesSince `protobuf_oneof:"cves_since"`
+	AccessScopeRules []*SimpleAccessScope_Rules                 `protobuf:"bytes,2,rep,name=access_scope_rules,json=accessScopeRules,proto3" json:"access_scope_rules,omitempty"`
+	Query            string                                     `protobuf:"bytes,3,opt,name=query,proto3" json:"query,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *NodeVulnerabilityReportFilters) Reset() {
+	*x = NodeVulnerabilityReportFilters{}
+	mi := &file_storage_report_configuration_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NodeVulnerabilityReportFilters) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NodeVulnerabilityReportFilters) ProtoMessage() {}
+
+func (x *NodeVulnerabilityReportFilters) ProtoReflect() protoreflect.Message {
+	mi := &file_storage_report_configuration_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NodeVulnerabilityReportFilters.ProtoReflect.Descriptor instead.
+func (*NodeVulnerabilityReportFilters) Descriptor() ([]byte, []int) {
+	return file_storage_report_configuration_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *NodeVulnerabilityReportFilters) GetCvesSince() isNodeVulnerabilityReportFilters_CvesSince {
+	if x != nil {
+		return x.CvesSince
+	}
+	return nil
+}
+
+func (x *NodeVulnerabilityReportFilters) GetAllVuln() bool {
+	if x != nil {
+		if x, ok := x.CvesSince.(*NodeVulnerabilityReportFilters_AllVuln); ok {
+			return x.AllVuln
+		}
+	}
+	return false
+}
+
+func (x *NodeVulnerabilityReportFilters) GetAccessScopeRules() []*SimpleAccessScope_Rules {
+	if x != nil {
+		return x.AccessScopeRules
+	}
+	return nil
+}
+
+func (x *NodeVulnerabilityReportFilters) GetQuery() string {
+	if x != nil {
+		return x.Query
+	}
+	return ""
+}
+
+type isNodeVulnerabilityReportFilters_CvesSince interface {
+	isNodeVulnerabilityReportFilters_CvesSince()
+}
+
+type NodeVulnerabilityReportFilters_AllVuln struct {
+	AllVuln bool `protobuf:"varint,1,opt,name=all_vuln,json=allVuln,proto3,oneof"`
+}
+
+func (*NodeVulnerabilityReportFilters_AllVuln) isNodeVulnerabilityReportFilters_CvesSince() {}
+
 // filter for view based reports
 type ViewBasedVulnerabilityReportFilters struct {
 	state            protoimpl.MessageState     `protogen:"open.v1"`
@@ -962,7 +1063,7 @@ type ViewBasedVulnerabilityReportFilters struct {
 
 func (x *ViewBasedVulnerabilityReportFilters) Reset() {
 	*x = ViewBasedVulnerabilityReportFilters{}
-	mi := &file_storage_report_configuration_proto_msgTypes[6]
+	mi := &file_storage_report_configuration_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -974,7 +1075,7 @@ func (x *ViewBasedVulnerabilityReportFilters) String() string {
 func (*ViewBasedVulnerabilityReportFilters) ProtoMessage() {}
 
 func (x *ViewBasedVulnerabilityReportFilters) ProtoReflect() protoreflect.Message {
-	mi := &file_storage_report_configuration_proto_msgTypes[6]
+	mi := &file_storage_report_configuration_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -987,7 +1088,7 @@ func (x *ViewBasedVulnerabilityReportFilters) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use ViewBasedVulnerabilityReportFilters.ProtoReflect.Descriptor instead.
 func (*ViewBasedVulnerabilityReportFilters) Descriptor() ([]byte, []int) {
-	return file_storage_report_configuration_proto_rawDescGZIP(), []int{6}
+	return file_storage_report_configuration_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *ViewBasedVulnerabilityReportFilters) GetQuery() string {
@@ -1008,13 +1109,14 @@ var File_storage_report_configuration_proto protoreflect.FileDescriptor
 
 const file_storage_report_configuration_proto_rawDesc = "" +
 	"\n" +
-	"\"storage/report_configuration.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x11storage/cve.proto\x1a+storage/report_notifier_configuration.proto\x1a!storage/resource_collection.proto\x1a\x12storage/role.proto\x1a\x16storage/schedule.proto\x1a\x12storage/user.proto\"\xb0\x06\n" +
+	"\"storage/report_configuration.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x11storage/cve.proto\x1a+storage/report_notifier_configuration.proto\x1a!storage/resource_collection.proto\x1a\x12storage/role.proto\x1a\x16storage/schedule.proto\x1a\x12storage/user.proto\"\xac\a\n" +
 	"\x13ReportConfiguration\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12 \n" +
 	"\vdescription\x18\x03 \x01(\tR\vdescription\x12;\n" +
 	"\x04type\x18\x04 \x01(\x0e2'.storage.ReportConfiguration.ReportTypeR\x04type\x12U\n" +
-	"\x13vuln_report_filters\x18\x05 \x01(\v2#.storage.VulnerabilityReportFiltersH\x00R\x11vulnReportFilters\x12\x1d\n" +
+	"\x13vuln_report_filters\x18\x05 \x01(\v2#.storage.VulnerabilityReportFiltersH\x00R\x11vulnReportFilters\x12b\n" +
+	"\x18node_vuln_report_filters\x18\x0f \x01(\v2'.storage.NodeVulnerabilityReportFiltersH\x00R\x15nodeVulnReportFilters\x12\x1d\n" +
 	"\bscope_id\x18\x06 \x01(\tB\x02\x18\x01R\ascopeId\x12L\n" +
 	"\femail_config\x18\a \x01(\v2#.storage.EmailNotifierConfigurationB\x02\x18\x01H\x01R\vemailConfig\x12-\n" +
 	"\bschedule\x18\b \x01(\v2\x11.storage.ScheduleR\bschedule\x12H\n" +
@@ -1024,10 +1126,11 @@ const file_storage_report_configuration_proto_rawDesc = "" +
 	"\x0eresource_scope\x18\v \x01(\v2\x16.storage.ResourceScopeR\rresourceScope\x12<\n" +
 	"\tnotifiers\x18\f \x03(\v2\x1e.storage.NotifierConfigurationR\tnotifiers\x12+\n" +
 	"\acreator\x18\r \x01(\v2\x11.storage.SlimUserR\acreator\x12\x18\n" +
-	"\aversion\x18\x0e \x01(\x05R\aversion\"\x1f\n" +
+	"\aversion\x18\x0e \x01(\x05R\aversion\"7\n" +
 	"\n" +
 	"ReportType\x12\x11\n" +
-	"\rVULNERABILITY\x10\x00B\b\n" +
+	"\rVULNERABILITY\x10\x00\x12\x16\n" +
+	"\x12NODE_VULNERABILITY\x10\x01B\b\n" +
 	"\x06filterB\x11\n" +
 	"\x0fnotifier_config\"\xe6\x01\n" +
 	"\x13ReportLastRunStatus\x12K\n" +
@@ -1075,7 +1178,13 @@ const file_storage_report_configuration_proto_rawDesc = "" +
 	"\x0fEntityScopeRule\x12+\n" +
 	"\x06entity\x18\x01 \x01(\x0e2\x13.storage.EntityTypeR\x06entity\x12*\n" +
 	"\x05field\x18\x02 \x01(\x0e2\x14.storage.EntityFieldR\x05field\x12*\n" +
-	"\x06values\x18\x03 \x03(\v2\x12.storage.RuleValueR\x06values\"\x8b\x01\n" +
+	"\x06values\x18\x03 \x03(\v2\x12.storage.RuleValueR\x06values\"\xb1\x01\n" +
+	"\x1eNodeVulnerabilityReportFilters\x12\x1b\n" +
+	"\ball_vuln\x18\x01 \x01(\bH\x00R\aallVuln\x12N\n" +
+	"\x12access_scope_rules\x18\x02 \x03(\v2 .storage.SimpleAccessScope.RulesR\x10accessScopeRules\x12\x14\n" +
+	"\x05query\x18\x03 \x01(\tR\x05queryB\f\n" +
+	"\n" +
+	"cves_since\"\x8b\x01\n" +
 	"#ViewBasedVulnerabilityReportFilters\x12\x14\n" +
 	"\x05query\x18\x01 \x01(\tR\x05query\x12N\n" +
 	"\x12access_scope_rules\x18\x02 \x03(\v2 .storage.SimpleAccessScope.RulesR\x10accessScopeRules*s\n" +
@@ -1107,7 +1216,7 @@ func file_storage_report_configuration_proto_rawDescGZIP() []byte {
 }
 
 var file_storage_report_configuration_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
-var file_storage_report_configuration_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_storage_report_configuration_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_storage_report_configuration_proto_goTypes = []any{
 	(EntityType)(0),                             // 0: storage.EntityType
 	(EntityField)(0),                            // 1: storage.EntityField
@@ -1121,44 +1230,47 @@ var file_storage_report_configuration_proto_goTypes = []any{
 	(*ResourceScope)(nil),                       // 9: storage.ResourceScope
 	(*EntityScope)(nil),                         // 10: storage.EntityScope
 	(*EntityScopeRule)(nil),                     // 11: storage.EntityScopeRule
-	(*ViewBasedVulnerabilityReportFilters)(nil), // 12: storage.ViewBasedVulnerabilityReportFilters
-	(*EmailNotifierConfiguration)(nil),          // 13: storage.EmailNotifierConfiguration
-	(*Schedule)(nil),                            // 14: storage.Schedule
-	(*timestamppb.Timestamp)(nil),               // 15: google.protobuf.Timestamp
-	(*NotifierConfiguration)(nil),               // 16: storage.NotifierConfiguration
-	(*SlimUser)(nil),                            // 17: storage.SlimUser
-	(VulnerabilitySeverity)(0),                  // 18: storage.VulnerabilitySeverity
-	(*SimpleAccessScope_Rules)(nil),             // 19: storage.SimpleAccessScope.Rules
-	(*RuleValue)(nil),                           // 20: storage.RuleValue
+	(*NodeVulnerabilityReportFilters)(nil),      // 12: storage.NodeVulnerabilityReportFilters
+	(*ViewBasedVulnerabilityReportFilters)(nil), // 13: storage.ViewBasedVulnerabilityReportFilters
+	(*EmailNotifierConfiguration)(nil),          // 14: storage.EmailNotifierConfiguration
+	(*Schedule)(nil),                            // 15: storage.Schedule
+	(*timestamppb.Timestamp)(nil),               // 16: google.protobuf.Timestamp
+	(*NotifierConfiguration)(nil),               // 17: storage.NotifierConfiguration
+	(*SlimUser)(nil),                            // 18: storage.SlimUser
+	(VulnerabilitySeverity)(0),                  // 19: storage.VulnerabilitySeverity
+	(*SimpleAccessScope_Rules)(nil),             // 20: storage.SimpleAccessScope.Rules
+	(*RuleValue)(nil),                           // 21: storage.RuleValue
 }
 var file_storage_report_configuration_proto_depIdxs = []int32{
 	2,  // 0: storage.ReportConfiguration.type:type_name -> storage.ReportConfiguration.ReportType
 	8,  // 1: storage.ReportConfiguration.vuln_report_filters:type_name -> storage.VulnerabilityReportFilters
-	13, // 2: storage.ReportConfiguration.email_config:type_name -> storage.EmailNotifierConfiguration
-	14, // 3: storage.ReportConfiguration.schedule:type_name -> storage.Schedule
-	7,  // 4: storage.ReportConfiguration.last_run_status:type_name -> storage.ReportLastRunStatus
-	15, // 5: storage.ReportConfiguration.last_successful_run_time:type_name -> google.protobuf.Timestamp
-	9,  // 6: storage.ReportConfiguration.resource_scope:type_name -> storage.ResourceScope
-	16, // 7: storage.ReportConfiguration.notifiers:type_name -> storage.NotifierConfiguration
-	17, // 8: storage.ReportConfiguration.creator:type_name -> storage.SlimUser
-	3,  // 9: storage.ReportLastRunStatus.report_status:type_name -> storage.ReportLastRunStatus.RunStatus
-	15, // 10: storage.ReportLastRunStatus.last_run_time:type_name -> google.protobuf.Timestamp
-	4,  // 11: storage.VulnerabilityReportFilters.fixability:type_name -> storage.VulnerabilityReportFilters.Fixability
-	18, // 12: storage.VulnerabilityReportFilters.severities:type_name -> storage.VulnerabilitySeverity
-	5,  // 13: storage.VulnerabilityReportFilters.image_types:type_name -> storage.VulnerabilityReportFilters.ImageType
-	15, // 14: storage.VulnerabilityReportFilters.since_start_date:type_name -> google.protobuf.Timestamp
-	19, // 15: storage.VulnerabilityReportFilters.access_scope_rules:type_name -> storage.SimpleAccessScope.Rules
-	10, // 16: storage.ResourceScope.entity_scope:type_name -> storage.EntityScope
-	11, // 17: storage.EntityScope.rules:type_name -> storage.EntityScopeRule
-	0,  // 18: storage.EntityScopeRule.entity:type_name -> storage.EntityType
-	1,  // 19: storage.EntityScopeRule.field:type_name -> storage.EntityField
-	20, // 20: storage.EntityScopeRule.values:type_name -> storage.RuleValue
-	19, // 21: storage.ViewBasedVulnerabilityReportFilters.access_scope_rules:type_name -> storage.SimpleAccessScope.Rules
-	22, // [22:22] is the sub-list for method output_type
-	22, // [22:22] is the sub-list for method input_type
-	22, // [22:22] is the sub-list for extension type_name
-	22, // [22:22] is the sub-list for extension extendee
-	0,  // [0:22] is the sub-list for field type_name
+	12, // 2: storage.ReportConfiguration.node_vuln_report_filters:type_name -> storage.NodeVulnerabilityReportFilters
+	14, // 3: storage.ReportConfiguration.email_config:type_name -> storage.EmailNotifierConfiguration
+	15, // 4: storage.ReportConfiguration.schedule:type_name -> storage.Schedule
+	7,  // 5: storage.ReportConfiguration.last_run_status:type_name -> storage.ReportLastRunStatus
+	16, // 6: storage.ReportConfiguration.last_successful_run_time:type_name -> google.protobuf.Timestamp
+	9,  // 7: storage.ReportConfiguration.resource_scope:type_name -> storage.ResourceScope
+	17, // 8: storage.ReportConfiguration.notifiers:type_name -> storage.NotifierConfiguration
+	18, // 9: storage.ReportConfiguration.creator:type_name -> storage.SlimUser
+	3,  // 10: storage.ReportLastRunStatus.report_status:type_name -> storage.ReportLastRunStatus.RunStatus
+	16, // 11: storage.ReportLastRunStatus.last_run_time:type_name -> google.protobuf.Timestamp
+	4,  // 12: storage.VulnerabilityReportFilters.fixability:type_name -> storage.VulnerabilityReportFilters.Fixability
+	19, // 13: storage.VulnerabilityReportFilters.severities:type_name -> storage.VulnerabilitySeverity
+	5,  // 14: storage.VulnerabilityReportFilters.image_types:type_name -> storage.VulnerabilityReportFilters.ImageType
+	16, // 15: storage.VulnerabilityReportFilters.since_start_date:type_name -> google.protobuf.Timestamp
+	20, // 16: storage.VulnerabilityReportFilters.access_scope_rules:type_name -> storage.SimpleAccessScope.Rules
+	10, // 17: storage.ResourceScope.entity_scope:type_name -> storage.EntityScope
+	11, // 18: storage.EntityScope.rules:type_name -> storage.EntityScopeRule
+	0,  // 19: storage.EntityScopeRule.entity:type_name -> storage.EntityType
+	1,  // 20: storage.EntityScopeRule.field:type_name -> storage.EntityField
+	21, // 21: storage.EntityScopeRule.values:type_name -> storage.RuleValue
+	20, // 22: storage.NodeVulnerabilityReportFilters.access_scope_rules:type_name -> storage.SimpleAccessScope.Rules
+	20, // 23: storage.ViewBasedVulnerabilityReportFilters.access_scope_rules:type_name -> storage.SimpleAccessScope.Rules
+	24, // [24:24] is the sub-list for method output_type
+	24, // [24:24] is the sub-list for method input_type
+	24, // [24:24] is the sub-list for extension type_name
+	24, // [24:24] is the sub-list for extension extendee
+	0,  // [0:24] is the sub-list for field type_name
 }
 
 func init() { file_storage_report_configuration_proto_init() }
@@ -1174,6 +1286,7 @@ func file_storage_report_configuration_proto_init() {
 	file_storage_user_proto_init()
 	file_storage_report_configuration_proto_msgTypes[0].OneofWrappers = []any{
 		(*ReportConfiguration_VulnReportFilters)(nil),
+		(*ReportConfiguration_NodeVulnReportFilters)(nil),
 		(*ReportConfiguration_EmailConfig)(nil),
 	}
 	file_storage_report_configuration_proto_msgTypes[2].OneofWrappers = []any{
@@ -1185,13 +1298,16 @@ func file_storage_report_configuration_proto_init() {
 		(*ResourceScope_CollectionId)(nil),
 		(*ResourceScope_EntityScope)(nil),
 	}
+	file_storage_report_configuration_proto_msgTypes[6].OneofWrappers = []any{
+		(*NodeVulnerabilityReportFilters_AllVuln)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_storage_report_configuration_proto_rawDesc), len(file_storage_report_configuration_proto_rawDesc)),
 			NumEnums:      6,
-			NumMessages:   7,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/generated/storage/report_configuration_vtproto.pb.go b/generated/storage/report_configuration_vtproto.pb.go
index 9aa70cafd97d0..91e2555199854 100644
--- a/generated/storage/report_configuration_vtproto.pb.go
+++ b/generated/storage/report_configuration_vtproto.pb.go
@@ -75,6 +75,15 @@ func (m *ReportConfiguration_VulnReportFilters) CloneVT() isReportConfiguration_
 	return r
 }
 
+func (m *ReportConfiguration_NodeVulnReportFilters) CloneVT() isReportConfiguration_Filter {
+	if m == nil {
+		return (*ReportConfiguration_NodeVulnReportFilters)(nil)
+	}
+	r := new(ReportConfiguration_NodeVulnReportFilters)
+	r.NodeVulnReportFilters = m.NodeVulnReportFilters.CloneVT()
+	return r
+}
+
 func (m *ReportConfiguration_EmailConfig) CloneVT() isReportConfiguration_NotifierConfig {
 	if m == nil {
 		return (*ReportConfiguration_EmailConfig)(nil)
@@ -261,6 +270,44 @@ func (m *EntityScopeRule) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *NodeVulnerabilityReportFilters) CloneVT() *NodeVulnerabilityReportFilters {
+	if m == nil {
+		return (*NodeVulnerabilityReportFilters)(nil)
+	}
+	r := new(NodeVulnerabilityReportFilters)
+	r.Query = m.Query
+	if m.CvesSince != nil {
+		r.CvesSince = m.CvesSince.(interface {
+			CloneVT() isNodeVulnerabilityReportFilters_CvesSince
+		}).CloneVT()
+	}
+	if rhs := m.AccessScopeRules; rhs != nil {
+		tmpContainer := make([]*SimpleAccessScope_Rules, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.AccessScopeRules = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *NodeVulnerabilityReportFilters) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) CloneVT() isNodeVulnerabilityReportFilters_CvesSince {
+	if m == nil {
+		return (*NodeVulnerabilityReportFilters_AllVuln)(nil)
+	}
+	r := new(NodeVulnerabilityReportFilters_AllVuln)
+	r.AllVuln = m.AllVuln
+	return r
+}
+
 func (m *ViewBasedVulnerabilityReportFilters) CloneVT() *ViewBasedVulnerabilityReportFilters {
 	if m == nil {
 		return (*ViewBasedVulnerabilityReportFilters)(nil)
@@ -425,6 +472,31 @@ func (this *ReportConfiguration_EmailConfig) EqualVT(thatIface isReportConfigura
 	return true
 }
 
+func (this *ReportConfiguration_NodeVulnReportFilters) EqualVT(thatIface isReportConfiguration_Filter) bool {
+	that, ok := thatIface.(*ReportConfiguration_NodeVulnReportFilters)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.NodeVulnReportFilters, that.NodeVulnReportFilters; p != q {
+		if p == nil {
+			p = &NodeVulnerabilityReportFilters{}
+		}
+		if q == nil {
+			q = &NodeVulnerabilityReportFilters{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *ReportLastRunStatus) EqualVT(that *ReportLastRunStatus) bool {
 	if this == that {
 		return true
@@ -732,6 +804,71 @@ func (this *EntityScopeRule) EqualMessageVT(thatMsg proto.Message) bool {
 	}
 	return this.EqualVT(that)
 }
+func (this *NodeVulnerabilityReportFilters) EqualVT(that *NodeVulnerabilityReportFilters) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.CvesSince == nil && that.CvesSince != nil {
+		return false
+	} else if this.CvesSince != nil {
+		if that.CvesSince == nil {
+			return false
+		}
+		if !this.CvesSince.(interface {
+			EqualVT(isNodeVulnerabilityReportFilters_CvesSince) bool
+		}).EqualVT(that.CvesSince) {
+			return false
+		}
+	}
+	if len(this.AccessScopeRules) != len(that.AccessScopeRules) {
+		return false
+	}
+	for i, vx := range this.AccessScopeRules {
+		vy := that.AccessScopeRules[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &SimpleAccessScope_Rules{}
+			}
+			if q == nil {
+				q = &SimpleAccessScope_Rules{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if this.Query != that.Query {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *NodeVulnerabilityReportFilters) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*NodeVulnerabilityReportFilters)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *NodeVulnerabilityReportFilters_AllVuln) EqualVT(thatIface isNodeVulnerabilityReportFilters_CvesSince) bool {
+	that, ok := thatIface.(*NodeVulnerabilityReportFilters_AllVuln)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if this.AllVuln != that.AllVuln {
+		return false
+	}
+	return true
+}
+
 func (this *ViewBasedVulnerabilityReportFilters) EqualVT(that *ViewBasedVulnerabilityReportFilters) bool {
 	if this == that {
 		return true
@@ -798,7 +935,7 @@ func (m *ReportConfiguration) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
-	if vtmsg, ok := m.NotifierConfig.(interface {
+	if vtmsg, ok := m.Filter.(interface {
 		MarshalToSizedBufferVT([]byte) (int, error)
 	}); ok {
 		size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
@@ -807,7 +944,7 @@ func (m *ReportConfiguration) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		}
 		i -= size
 	}
-	if vtmsg, ok := m.Filter.(interface {
+	if vtmsg, ok := m.NotifierConfig.(interface {
 		MarshalToSizedBufferVT([]byte) (int, error)
 	}); ok {
 		size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
@@ -965,6 +1102,29 @@ func (m *ReportConfiguration_EmailConfig) MarshalToSizedBufferVT(dAtA []byte) (i
 	}
 	return len(dAtA) - i, nil
 }
+func (m *ReportConfiguration_NodeVulnReportFilters) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ReportConfiguration_NodeVulnReportFilters) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.NodeVulnReportFilters != nil {
+		size, err := m.NodeVulnReportFilters.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x7a
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x7a
+	}
+	return len(dAtA) - i, nil
+}
 func (m *ReportLastRunStatus) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -1404,6 +1564,84 @@ func (m *EntityScopeRule) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *NodeVulnerabilityReportFilters) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeVulnerabilityReportFilters) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *NodeVulnerabilityReportFilters) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if vtmsg, ok := m.CvesSince.(interface {
+		MarshalToSizedBufferVT([]byte) (int, error)
+	}); ok {
+		size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+	}
+	if len(m.Query) > 0 {
+		i -= len(m.Query)
+		copy(dAtA[i:], m.Query)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Query)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.AccessScopeRules) > 0 {
+		for iNdEx := len(m.AccessScopeRules) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.AccessScopeRules[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i--
+	if m.AllVuln {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
 func (m *ViewBasedVulnerabilityReportFilters) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -1548,6 +1786,20 @@ func (m *ReportConfiguration_EmailConfig) SizeVT() (n int) {
 	}
 	return n
 }
+func (m *ReportConfiguration_NodeVulnReportFilters) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.NodeVulnReportFilters != nil {
+		l = m.NodeVulnReportFilters.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *ReportLastRunStatus) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -1728,6 +1980,38 @@ func (m *EntityScopeRule) SizeVT() (n int) {
 	return n
 }
 
+func (m *NodeVulnerabilityReportFilters) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if vtmsg, ok := m.CvesSince.(interface{ SizeVT() int }); ok {
+		n += vtmsg.SizeVT()
+	}
+	if len(m.AccessScopeRules) > 0 {
+		for _, e := range m.AccessScopeRules {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	l = len(m.Query)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *NodeVulnerabilityReportFilters_AllVuln) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 2
+	return n
+}
 func (m *ViewBasedVulnerabilityReportFilters) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -2239,14 +2523,55 @@ func (m *ReportConfiguration) UnmarshalVT(dAtA []byte) error {
 					break
 				}
 			}
-		default:
-			iNdEx = preIndex
-			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return protohelpers.ErrInvalidLength
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportConfiguration_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportConfiguration_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
 			}
 			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
@@ -3168,6 +3493,144 @@ func (m *EntityScopeRule) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *NodeVulnerabilityReportFilters) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllVuln", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.CvesSince = &NodeVulnerabilityReportFilters_AllVuln{AllVuln: b}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessScopeRules", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccessScopeRules = append(m.AccessScopeRules, &SimpleAccessScope_Rules{})
+			if err := m.AccessScopeRules[len(m.AccessScopeRules)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Query = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ViewBasedVulnerabilityReportFilters) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -3792,6 +4255,47 @@ func (m *ReportConfiguration) UnmarshalVTUnsafe(dAtA []byte) error {
 					break
 				}
 			}
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportConfiguration_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportConfiguration_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -4733,6 +5237,148 @@ func (m *EntityScopeRule) UnmarshalVTUnsafe(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *NodeVulnerabilityReportFilters) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodeVulnerabilityReportFilters: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllVuln", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.CvesSince = &NodeVulnerabilityReportFilters_AllVuln{AllVuln: b}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessScopeRules", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccessScopeRules = append(m.AccessScopeRules, &SimpleAccessScope_Rules{})
+			if err := m.AccessScopeRules[len(m.AccessScopeRules)-1].UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.Query = stringValue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ViewBasedVulnerabilityReportFilters) UnmarshalVTUnsafe(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/generated/storage/report_notifier_configuration.pb.go b/generated/storage/report_notifier_configuration.pb.go
index 19dfa872e83af..7f687465c3762 100644
--- a/generated/storage/report_notifier_configuration.pb.go
+++ b/generated/storage/report_notifier_configuration.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/report_notifier_configuration.proto
 
diff --git a/generated/storage/report_snapshot.pb.go b/generated/storage/report_snapshot.pb.go
index 462aa59f8203d..5d0e879a64623 100644
--- a/generated/storage/report_snapshot.pb.go
+++ b/generated/storage/report_snapshot.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/report_snapshot.proto
 
@@ -25,16 +25,19 @@ const (
 type ReportSnapshot_ReportType int32
 
 const (
-	ReportSnapshot_VULNERABILITY ReportSnapshot_ReportType = 0
+	ReportSnapshot_VULNERABILITY      ReportSnapshot_ReportType = 0 // for historical reasons, this short form was used to mean "Image Vulnerability"
+	ReportSnapshot_NODE_VULNERABILITY ReportSnapshot_ReportType = 1
 )
 
 // Enum value maps for ReportSnapshot_ReportType.
 var (
 	ReportSnapshot_ReportType_name = map[int32]string{
 		0: "VULNERABILITY",
+		1: "NODE_VULNERABILITY",
 	}
 	ReportSnapshot_ReportType_value = map[string]int32{
-		"VULNERABILITY": 0,
+		"VULNERABILITY":      0,
+		"NODE_VULNERABILITY": 1,
 	}
 )
 
@@ -223,11 +226,12 @@ type ReportSnapshot struct {
 	ReportConfigurationId string                    `protobuf:"bytes,2,opt,name=report_configuration_id,json=reportConfigurationId,proto3" json:"report_configuration_id,omitempty" search:"Report Configuration ID" sql:"fk(ReportConfiguration:id),allow-null"` // @gotags: search:"Report Configuration ID" sql:"fk(ReportConfiguration:id),allow-null"
 	Name                  string                    `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty" search:"Report Name"`                                                                  // @gotags: search:"Report Name"
 	Description           string                    `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
-	Type                  ReportSnapshot_ReportType `protobuf:"varint,5,opt,name=type,proto3,enum=storage.ReportSnapshot_ReportType" json:"type,omitempty"`
+	Type                  ReportSnapshot_ReportType `protobuf:"varint,5,opt,name=type,proto3,enum=storage.ReportSnapshot_ReportType" json:"type,omitempty" search:"Report Type"` // @gotags: search:"Report Type"
 	// Types that are valid to be assigned to Filter:
 	//
 	//	*ReportSnapshot_VulnReportFilters
 	//	*ReportSnapshot_ViewBasedVulnReportFilters
+	//	*ReportSnapshot_NodeVulnReportFilters
 	Filter       isReportSnapshot_Filter `protobuf_oneof:"filter"`
 	Collection   *CollectionSnapshot     `protobuf:"bytes,7,opt,name=collection,proto3" json:"collection,omitempty"`
 	Schedule     *Schedule               `protobuf:"bytes,8,opt,name=schedule,proto3" json:"schedule,omitempty"`
@@ -333,6 +337,15 @@ func (x *ReportSnapshot) GetViewBasedVulnReportFilters() *ViewBasedVulnerability
 	return nil
 }
 
+func (x *ReportSnapshot) GetNodeVulnReportFilters() *NodeVulnerabilityReportFilters {
+	if x != nil {
+		if x, ok := x.Filter.(*ReportSnapshot_NodeVulnReportFilters); ok {
+			return x.NodeVulnReportFilters
+		}
+	}
+	return nil
+}
+
 func (x *ReportSnapshot) GetCollection() *CollectionSnapshot {
 	if x != nil {
 		return x.Collection
@@ -394,10 +407,16 @@ type ReportSnapshot_ViewBasedVulnReportFilters struct {
 	ViewBasedVulnReportFilters *ViewBasedVulnerabilityReportFilters `protobuf:"bytes,12,opt,name=view_based_vuln_report_filters,json=viewBasedVulnReportFilters,proto3,oneof"`
 }
 
+type ReportSnapshot_NodeVulnReportFilters struct {
+	NodeVulnReportFilters *NodeVulnerabilityReportFilters `protobuf:"bytes,15,opt,name=node_vuln_report_filters,json=nodeVulnReportFilters,proto3,oneof"`
+}
+
 func (*ReportSnapshot_VulnReportFilters) isReportSnapshot_Filter() {}
 
 func (*ReportSnapshot_ViewBasedVulnReportFilters) isReportSnapshot_Filter() {}
 
+func (*ReportSnapshot_NodeVulnReportFilters) isReportSnapshot_Filter() {}
+
 type CollectionSnapshot struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
@@ -612,7 +631,7 @@ var File_storage_report_snapshot_proto protoreflect.FileDescriptor
 
 const file_storage_report_snapshot_proto_rawDesc = "" +
 	"\n" +
-	"\x1dstorage/report_snapshot.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\"storage/report_configuration.proto\x1a+storage/report_notifier_configuration.proto\x1a\x16storage/schedule.proto\x1a\x12storage/user.proto\"\xc2\x06\n" +
+	"\x1dstorage/report_snapshot.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\"storage/report_configuration.proto\x1a+storage/report_notifier_configuration.proto\x1a\x16storage/schedule.proto\x1a\x12storage/user.proto\"\xbe\a\n" +
 	"\x0eReportSnapshot\x12\x1b\n" +
 	"\treport_id\x18\x01 \x01(\tR\breportId\x126\n" +
 	"\x17report_configuration_id\x18\x02 \x01(\tR\x15reportConfigurationId\x12\x12\n" +
@@ -620,7 +639,8 @@ const file_storage_report_snapshot_proto_rawDesc = "" +
 	"\vdescription\x18\x04 \x01(\tR\vdescription\x126\n" +
 	"\x04type\x18\x05 \x01(\x0e2\".storage.ReportSnapshot.ReportTypeR\x04type\x12U\n" +
 	"\x13vuln_report_filters\x18\x06 \x01(\v2#.storage.VulnerabilityReportFiltersH\x00R\x11vulnReportFilters\x12r\n" +
-	"\x1eview_based_vuln_report_filters\x18\f \x01(\v2,.storage.ViewBasedVulnerabilityReportFiltersH\x00R\x1aviewBasedVulnReportFilters\x12;\n" +
+	"\x1eview_based_vuln_report_filters\x18\f \x01(\v2,.storage.ViewBasedVulnerabilityReportFiltersH\x00R\x1aviewBasedVulnReportFilters\x12b\n" +
+	"\x18node_vuln_report_filters\x18\x0f \x01(\v2'.storage.NodeVulnerabilityReportFiltersH\x00R\x15nodeVulnReportFilters\x12;\n" +
 	"\n" +
 	"collection\x18\a \x01(\v2\x1b.storage.CollectionSnapshotR\n" +
 	"collection\x12-\n" +
@@ -630,10 +650,11 @@ const file_storage_report_snapshot_proto_rawDesc = "" +
 	" \x03(\v2\x19.storage.NotifierSnapshotR\tnotifiers\x12/\n" +
 	"\trequester\x18\v \x01(\v2\x11.storage.SlimUserR\trequester\x12&\n" +
 	"\x0farea_of_concern\x18\r \x01(\tR\rareaOfConcern\x12=\n" +
-	"\x0eresource_scope\x18\x0e \x01(\v2\x16.storage.ResourceScopeR\rresourceScope\"\x1f\n" +
+	"\x0eresource_scope\x18\x0e \x01(\v2\x16.storage.ResourceScopeR\rresourceScope\"7\n" +
 	"\n" +
 	"ReportType\x12\x11\n" +
-	"\rVULNERABILITY\x10\x00B\b\n" +
+	"\rVULNERABILITY\x10\x00\x12\x16\n" +
+	"\x12NODE_VULNERABILITY\x10\x01B\b\n" +
 	"\x06filter\"8\n" +
 	"\x12CollectionSnapshot\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
@@ -690,33 +711,35 @@ var file_storage_report_snapshot_proto_goTypes = []any{
 	(*ReportStatus)(nil),                        // 7: storage.ReportStatus
 	(*VulnerabilityReportFilters)(nil),          // 8: storage.VulnerabilityReportFilters
 	(*ViewBasedVulnerabilityReportFilters)(nil), // 9: storage.ViewBasedVulnerabilityReportFilters
-	(*Schedule)(nil),                            // 10: storage.Schedule
-	(*SlimUser)(nil),                            // 11: storage.SlimUser
-	(*ResourceScope)(nil),                       // 12: storage.ResourceScope
-	(*EmailNotifierConfiguration)(nil),          // 13: storage.EmailNotifierConfiguration
-	(*timestamppb.Timestamp)(nil),               // 14: google.protobuf.Timestamp
+	(*NodeVulnerabilityReportFilters)(nil),      // 10: storage.NodeVulnerabilityReportFilters
+	(*Schedule)(nil),                            // 11: storage.Schedule
+	(*SlimUser)(nil),                            // 12: storage.SlimUser
+	(*ResourceScope)(nil),                       // 13: storage.ResourceScope
+	(*EmailNotifierConfiguration)(nil),          // 14: storage.EmailNotifierConfiguration
+	(*timestamppb.Timestamp)(nil),               // 15: google.protobuf.Timestamp
 }
 var file_storage_report_snapshot_proto_depIdxs = []int32{
 	0,  // 0: storage.ReportSnapshot.type:type_name -> storage.ReportSnapshot.ReportType
 	8,  // 1: storage.ReportSnapshot.vuln_report_filters:type_name -> storage.VulnerabilityReportFilters
 	9,  // 2: storage.ReportSnapshot.view_based_vuln_report_filters:type_name -> storage.ViewBasedVulnerabilityReportFilters
-	5,  // 3: storage.ReportSnapshot.collection:type_name -> storage.CollectionSnapshot
-	10, // 4: storage.ReportSnapshot.schedule:type_name -> storage.Schedule
-	7,  // 5: storage.ReportSnapshot.report_status:type_name -> storage.ReportStatus
-	6,  // 6: storage.ReportSnapshot.notifiers:type_name -> storage.NotifierSnapshot
-	11, // 7: storage.ReportSnapshot.requester:type_name -> storage.SlimUser
-	12, // 8: storage.ReportSnapshot.resource_scope:type_name -> storage.ResourceScope
-	13, // 9: storage.NotifierSnapshot.email_config:type_name -> storage.EmailNotifierConfiguration
-	1,  // 10: storage.ReportStatus.run_state:type_name -> storage.ReportStatus.RunState
-	14, // 11: storage.ReportStatus.queued_at:type_name -> google.protobuf.Timestamp
-	14, // 12: storage.ReportStatus.completed_at:type_name -> google.protobuf.Timestamp
-	3,  // 13: storage.ReportStatus.report_request_type:type_name -> storage.ReportStatus.RunMethod
-	2,  // 14: storage.ReportStatus.report_notification_method:type_name -> storage.ReportStatus.NotificationMethod
-	15, // [15:15] is the sub-list for method output_type
-	15, // [15:15] is the sub-list for method input_type
-	15, // [15:15] is the sub-list for extension type_name
-	15, // [15:15] is the sub-list for extension extendee
-	0,  // [0:15] is the sub-list for field type_name
+	10, // 3: storage.ReportSnapshot.node_vuln_report_filters:type_name -> storage.NodeVulnerabilityReportFilters
+	5,  // 4: storage.ReportSnapshot.collection:type_name -> storage.CollectionSnapshot
+	11, // 5: storage.ReportSnapshot.schedule:type_name -> storage.Schedule
+	7,  // 6: storage.ReportSnapshot.report_status:type_name -> storage.ReportStatus
+	6,  // 7: storage.ReportSnapshot.notifiers:type_name -> storage.NotifierSnapshot
+	12, // 8: storage.ReportSnapshot.requester:type_name -> storage.SlimUser
+	13, // 9: storage.ReportSnapshot.resource_scope:type_name -> storage.ResourceScope
+	14, // 10: storage.NotifierSnapshot.email_config:type_name -> storage.EmailNotifierConfiguration
+	1,  // 11: storage.ReportStatus.run_state:type_name -> storage.ReportStatus.RunState
+	15, // 12: storage.ReportStatus.queued_at:type_name -> google.protobuf.Timestamp
+	15, // 13: storage.ReportStatus.completed_at:type_name -> google.protobuf.Timestamp
+	3,  // 14: storage.ReportStatus.report_request_type:type_name -> storage.ReportStatus.RunMethod
+	2,  // 15: storage.ReportStatus.report_notification_method:type_name -> storage.ReportStatus.NotificationMethod
+	16, // [16:16] is the sub-list for method output_type
+	16, // [16:16] is the sub-list for method input_type
+	16, // [16:16] is the sub-list for extension type_name
+	16, // [16:16] is the sub-list for extension extendee
+	0,  // [0:16] is the sub-list for field type_name
 }
 
 func init() { file_storage_report_snapshot_proto_init() }
@@ -731,6 +754,7 @@ func file_storage_report_snapshot_proto_init() {
 	file_storage_report_snapshot_proto_msgTypes[0].OneofWrappers = []any{
 		(*ReportSnapshot_VulnReportFilters)(nil),
 		(*ReportSnapshot_ViewBasedVulnReportFilters)(nil),
+		(*ReportSnapshot_NodeVulnReportFilters)(nil),
 	}
 	file_storage_report_snapshot_proto_msgTypes[2].OneofWrappers = []any{
 		(*NotifierSnapshot_EmailConfig)(nil),
diff --git a/generated/storage/report_snapshot_vtproto.pb.go b/generated/storage/report_snapshot_vtproto.pb.go
index decb6e35adc97..6b9c8a76027e3 100644
--- a/generated/storage/report_snapshot_vtproto.pb.go
+++ b/generated/storage/report_snapshot_vtproto.pb.go
@@ -79,6 +79,15 @@ func (m *ReportSnapshot_ViewBasedVulnReportFilters) CloneVT() isReportSnapshot_F
 	return r
 }
 
+func (m *ReportSnapshot_NodeVulnReportFilters) CloneVT() isReportSnapshot_Filter {
+	if m == nil {
+		return (*ReportSnapshot_NodeVulnReportFilters)(nil)
+	}
+	r := new(ReportSnapshot_NodeVulnReportFilters)
+	r.NodeVulnReportFilters = m.NodeVulnReportFilters.CloneVT()
+	return r
+}
+
 func (m *CollectionSnapshot) CloneVT() *CollectionSnapshot {
 	if m == nil {
 		return (*CollectionSnapshot)(nil)
@@ -278,6 +287,31 @@ func (this *ReportSnapshot_ViewBasedVulnReportFilters) EqualVT(thatIface isRepor
 	return true
 }
 
+func (this *ReportSnapshot_NodeVulnReportFilters) EqualVT(thatIface isReportSnapshot_Filter) bool {
+	that, ok := thatIface.(*ReportSnapshot_NodeVulnReportFilters)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.NodeVulnReportFilters, that.NodeVulnReportFilters; p != q {
+		if p == nil {
+			p = &NodeVulnerabilityReportFilters{}
+		}
+		if q == nil {
+			q = &NodeVulnerabilityReportFilters{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
 func (this *CollectionSnapshot) EqualVT(that *CollectionSnapshot) bool {
 	if this == that {
 		return true
@@ -580,6 +614,29 @@ func (m *ReportSnapshot_ViewBasedVulnReportFilters) MarshalToSizedBufferVT(dAtA
 	}
 	return len(dAtA) - i, nil
 }
+func (m *ReportSnapshot_NodeVulnReportFilters) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ReportSnapshot_NodeVulnReportFilters) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.NodeVulnReportFilters != nil {
+		size, err := m.NodeVulnReportFilters.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x7a
+	} else {
+		i = protohelpers.EncodeVarint(dAtA, i, 0)
+		i--
+		dAtA[i] = 0x7a
+	}
+	return len(dAtA) - i, nil
+}
 func (m *CollectionSnapshot) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -864,6 +921,20 @@ func (m *ReportSnapshot_ViewBasedVulnReportFilters) SizeVT() (n int) {
 	}
 	return n
 }
+func (m *ReportSnapshot_NodeVulnReportFilters) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.NodeVulnReportFilters != nil {
+		l = m.NodeVulnReportFilters.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	} else {
+		n += 2
+	}
+	return n
+}
 func (m *CollectionSnapshot) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -1448,6 +1519,47 @@ func (m *ReportSnapshot) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportSnapshot_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportSnapshot_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -2445,6 +2557,47 @@ func (m *ReportSnapshot) UnmarshalVTUnsafe(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeVulnReportFilters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Filter.(*ReportSnapshot_NodeVulnReportFilters); ok {
+				if err := oneof.NodeVulnReportFilters.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &NodeVulnerabilityReportFilters{}
+				if err := v.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Filter = &ReportSnapshot_NodeVulnReportFilters{NodeVulnReportFilters: v}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/generated/storage/resource_collection.pb.go b/generated/storage/resource_collection.pb.go
index 70e708df4febe..9b42e2f8865ad 100644
--- a/generated/storage/resource_collection.pb.go
+++ b/generated/storage/resource_collection.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/resource_collection.proto
 
diff --git a/generated/storage/risk.pb.go b/generated/storage/risk.pb.go
index 146a00fa04b64..27ad23016ba5a 100644
--- a/generated/storage/risk.pb.go
+++ b/generated/storage/risk.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/risk.proto
 
diff --git a/generated/storage/role.pb.go b/generated/storage/role.pb.go
index 095b43889468b..b140ce12e3969 100644
--- a/generated/storage/role.pb.go
+++ b/generated/storage/role.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/role.proto
 
diff --git a/generated/storage/schedule.pb.go b/generated/storage/schedule.pb.go
index c39adb9ca6945..696be25aea17e 100644
--- a/generated/storage/schedule.pb.go
+++ b/generated/storage/schedule.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/schedule.proto
 
diff --git a/generated/storage/scope.pb.go b/generated/storage/scope.pb.go
index 5810972bc89fe..4c74ece92a4cb 100644
--- a/generated/storage/scope.pb.go
+++ b/generated/storage/scope.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/scope.proto
 
@@ -26,8 +26,8 @@ type Scope struct {
 	Cluster        string                 `protobuf:"bytes,1,opt,name=cluster,proto3" json:"cluster,omitempty" crYaml:",omitempty"`                                     // @gotags: crYaml:",omitempty"`
 	Namespace      string                 `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty" crYaml:",omitempty"`                                 // @gotags: crYaml:",omitempty"`
 	Label          *Scope_Label           `protobuf:"bytes,3,opt,name=label,proto3" json:"label,omitempty" crYaml:",omitempty"`                                         // Deployment label. @gotags: crYaml:",omitempty"`
-	ClusterLabel   *Scope_Label           `protobuf:"bytes,4,opt,name=cluster_label,json=clusterLabel,proto3" json:"cluster_label,omitempty" crYaml:",omitempty"`       // @gotags: crYaml:",omitempty"`
-	NamespaceLabel *Scope_Label           `protobuf:"bytes,5,opt,name=namespace_label,json=namespaceLabel,proto3" json:"namespace_label,omitempty" crYaml:",omitempty"` // @gotags: crYaml:",omitempty"`
+	ClusterLabel   *Scope_Label           `protobuf:"bytes,4,opt,name=cluster_label,json=clusterLabel,proto3" json:"cluster_label,omitempty" crYaml:"clusterLabel,omitempty"`       // @gotags: crYaml:"clusterLabel,omitempty"`
+	NamespaceLabel *Scope_Label           `protobuf:"bytes,5,opt,name=namespace_label,json=namespaceLabel,proto3" json:"namespace_label,omitempty" crYaml:"namespaceLabel,omitempty"` // @gotags: crYaml:"namespaceLabel,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
diff --git a/generated/storage/secret.pb.go b/generated/storage/secret.pb.go
index 62340b587afc8..d793f8b30e3f9 100644
--- a/generated/storage/secret.pb.go
+++ b/generated/storage/secret.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/secret.proto
 
diff --git a/generated/storage/sensor_upgrade.pb.go b/generated/storage/sensor_upgrade.pb.go
index ea91a650104d0..a755cd2a7b3da 100644
--- a/generated/storage/sensor_upgrade.pb.go
+++ b/generated/storage/sensor_upgrade.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/sensor_upgrade.proto
 
diff --git a/generated/storage/service_account.pb.go b/generated/storage/service_account.pb.go
index 090ab6d6bc01c..9e1dffac42593 100644
--- a/generated/storage/service_account.pb.go
+++ b/generated/storage/service_account.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/service_account.proto
 
diff --git a/generated/storage/service_identity.pb.go b/generated/storage/service_identity.pb.go
index 977969b3c14c1..c5b86d165673d 100644
--- a/generated/storage/service_identity.pb.go
+++ b/generated/storage/service_identity.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/service_identity.proto
 
diff --git a/generated/storage/signature_integration.pb.go b/generated/storage/signature_integration.pb.go
index fb77716dd328c..ba5e6066215fc 100644
--- a/generated/storage/signature_integration.pb.go
+++ b/generated/storage/signature_integration.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/signature_integration.proto
 
diff --git a/generated/storage/system_info.pb.go b/generated/storage/system_info.pb.go
index 7610f92952411..9a785ad00ca21 100644
--- a/generated/storage/system_info.pb.go
+++ b/generated/storage/system_info.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/system_info.proto
 
diff --git a/generated/storage/taints.pb.go b/generated/storage/taints.pb.go
index 70442763e613b..0d65db63da121 100644
--- a/generated/storage/taints.pb.go
+++ b/generated/storage/taints.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/taints.proto
 
diff --git a/generated/storage/telemetry.pb.go b/generated/storage/telemetry.pb.go
index 92ee31589a4c4..f668c57b255ae 100644
--- a/generated/storage/telemetry.pb.go
+++ b/generated/storage/telemetry.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/telemetry.proto
 
diff --git a/generated/storage/test.pb.go b/generated/storage/test.pb.go
index f7a42207b4636..4eb02802084ca 100644
--- a/generated/storage/test.pb.go
+++ b/generated/storage/test.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/test.proto
 
diff --git a/generated/storage/traits.pb.go b/generated/storage/traits.pb.go
index 2b52cd5e6ca8c..95d2420db81f3 100644
--- a/generated/storage/traits.pb.go
+++ b/generated/storage/traits.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/traits.proto
 
diff --git a/generated/storage/user.pb.go b/generated/storage/user.pb.go
index 8cf1a7c6ffe81..f014ea07d7778 100644
--- a/generated/storage/user.pb.go
+++ b/generated/storage/user.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/user.proto
 
diff --git a/generated/storage/version.pb.go b/generated/storage/version.pb.go
index 07cbb4044198f..010bae61d2933 100644
--- a/generated/storage/version.pb.go
+++ b/generated/storage/version.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/version.proto
 
diff --git a/generated/storage/virtual_machine.pb.go b/generated/storage/virtual_machine.pb.go
index 3e6238c18d3cc..5b11e46a5573b 100644
--- a/generated/storage/virtual_machine.pb.go
+++ b/generated/storage/virtual_machine.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/virtual_machine.proto
 
diff --git a/generated/storage/virtual_machine_component_v2.pb.go b/generated/storage/virtual_machine_component_v2.pb.go
index 5c49311e552dc..cbbccf82b8dec 100644
--- a/generated/storage/virtual_machine_component_v2.pb.go
+++ b/generated/storage/virtual_machine_component_v2.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/virtual_machine_component_v2.proto
 
diff --git a/generated/storage/virtual_machine_cve_v2.pb.go b/generated/storage/virtual_machine_cve_v2.pb.go
index 97caffbf5325b..130097ac3e344 100644
--- a/generated/storage/virtual_machine_cve_v2.pb.go
+++ b/generated/storage/virtual_machine_cve_v2.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/virtual_machine_cve_v2.proto
 
diff --git a/generated/storage/virtual_machine_scan_v2.pb.go b/generated/storage/virtual_machine_scan_v2.pb.go
index 3f0adad8f9afb..cf2317cc60247 100644
--- a/generated/storage/virtual_machine_scan_v2.pb.go
+++ b/generated/storage/virtual_machine_scan_v2.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/virtual_machine_scan_v2.proto
 
diff --git a/generated/storage/virtual_machine_v2.pb.go b/generated/storage/virtual_machine_v2.pb.go
index eaa2db2556ba6..c228772e3559d 100644
--- a/generated/storage/virtual_machine_v2.pb.go
+++ b/generated/storage/virtual_machine_v2.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/virtual_machine_v2.proto
 
@@ -144,11 +144,14 @@ type VirtualMachineV2 struct {
 	// KubeVirt facts about the VM.
 	Facts map[string]string `protobuf:"bytes,6,rep,name=facts,proto3" json:"facts,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Guest OS reported by KubeVirt facts, extracted as a queryable column.
-	GuestOs     string                  `protobuf:"bytes,7,opt,name=guest_os,json=guestOs,proto3" json:"guest_os,omitempty" search:"Guest OS" sql:"index=btree"`                          // @gotags: search:"Guest OS" sql:"index=btree"
-	State       VirtualMachineV2_State  `protobuf:"varint,8,opt,name=state,proto3,enum=storage.VirtualMachineV2_State" json:"state,omitempty" search:"Virtual Machine State"`        // @gotags: search:"Virtual Machine State"
-	LastUpdated *timestamppb.Timestamp  `protobuf:"bytes,9,opt,name=last_updated,json=lastUpdated,proto3" json:"last_updated,omitempty" search:"Last Updated,hidden" sql:"type(timestamptz)" hash:"ignore"`              // @gotags: search:"Last Updated,hidden" sql:"type(timestamptz)" hash:"ignore"
-	Notes       []VirtualMachineV2_Note `protobuf:"varint,10,rep,packed,name=notes,proto3,enum=storage.VirtualMachineV2_Note" json:"notes,omitempty" hash:"set"` // @gotags: hash:"set"
-	VsockCid    int32                   `protobuf:"varint,11,opt,name=vsock_cid,json=vsockCid,proto3" json:"vsock_cid,omitempty"`
+	GuestOs     string                 `protobuf:"bytes,7,opt,name=guest_os,json=guestOs,proto3" json:"guest_os,omitempty" search:"Guest OS" sql:"index=btree"`                   // @gotags: search:"Guest OS" sql:"index=btree"
+	State       VirtualMachineV2_State `protobuf:"varint,8,opt,name=state,proto3,enum=storage.VirtualMachineV2_State" json:"state,omitempty" search:"Virtual Machine State"` // @gotags: search:"Virtual Machine State"
+	LastUpdated *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=last_updated,json=lastUpdated,proto3" json:"last_updated,omitempty" search:"Last Updated,hidden" sql:"type(timestamptz)" hash:"ignore"`       // @gotags: search:"Last Updated,hidden" sql:"type(timestamptz)" hash:"ignore"
+	// last_agent_contact is the last successful pull-mode scrape that landed in Central.
+	// Unset means never scraped; GetVM maps age against ROX_VIRTUAL_MACHINES_AGENT_STALE_AFTER.
+	LastAgentContact *timestamppb.Timestamp  `protobuf:"bytes,13,opt,name=last_agent_contact,json=lastAgentContact,proto3" json:"last_agent_contact,omitempty" search:"Last Agent Contact,hidden" sql:"type(timestamptz)" hash:"ignore"` // @gotags: search:"Last Agent Contact,hidden" sql:"type(timestamptz)" hash:"ignore"
+	Notes            []VirtualMachineV2_Note `protobuf:"varint,10,rep,packed,name=notes,proto3,enum=storage.VirtualMachineV2_Note" json:"notes,omitempty" hash:"set"`      // @gotags: hash:"set"
+	VsockCid         int32                   `protobuf:"varint,11,opt,name=vsock_cid,json=vsockCid,proto3" json:"vsock_cid,omitempty"`
 	// Hash of VM data fields for change detection (excludes last_updated).
 	Hash          uint64 `protobuf:"varint,12,opt,name=hash,proto3" json:"hash,omitempty" hash:"ignore"` // @gotags: hash:"ignore"
 	unknownFields protoimpl.UnknownFields
@@ -248,6 +251,13 @@ func (x *VirtualMachineV2) GetLastUpdated() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *VirtualMachineV2) GetLastAgentContact() *timestamppb.Timestamp {
+	if x != nil {
+		return x.LastAgentContact
+	}
+	return nil
+}
+
 func (x *VirtualMachineV2) GetNotes() []VirtualMachineV2_Note {
 	if x != nil {
 		return x.Notes
@@ -273,7 +283,7 @@ var File_storage_virtual_machine_v2_proto protoreflect.FileDescriptor
 
 const file_storage_virtual_machine_v2_proto_rawDesc = "" +
 	"\n" +
-	" storage/virtual_machine_v2.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\"\xd0\x05\n" +
+	" storage/virtual_machine_v2.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\"\x9a\x06\n" +
 	"\x10VirtualMachineV2\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12\x1c\n" +
@@ -284,7 +294,8 @@ const file_storage_virtual_machine_v2_proto_rawDesc = "" +
 	"\x05facts\x18\x06 \x03(\v2$.storage.VirtualMachineV2.FactsEntryR\x05facts\x12\x19\n" +
 	"\bguest_os\x18\a \x01(\tR\aguestOs\x125\n" +
 	"\x05state\x18\b \x01(\x0e2\x1f.storage.VirtualMachineV2.StateR\x05state\x12=\n" +
-	"\flast_updated\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\vlastUpdated\x124\n" +
+	"\flast_updated\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\vlastUpdated\x12H\n" +
+	"\x12last_agent_contact\x18\r \x01(\v2\x1a.google.protobuf.TimestampR\x10lastAgentContact\x124\n" +
 	"\x05notes\x18\n" +
 	" \x03(\x0e2\x1e.storage.VirtualMachineV2.NoteR\x05notes\x12\x1b\n" +
 	"\tvsock_cid\x18\v \x01(\x05R\bvsockCid\x12\x12\n" +
@@ -331,12 +342,13 @@ var file_storage_virtual_machine_v2_proto_depIdxs = []int32{
 	3, // 0: storage.VirtualMachineV2.facts:type_name -> storage.VirtualMachineV2.FactsEntry
 	0, // 1: storage.VirtualMachineV2.state:type_name -> storage.VirtualMachineV2.State
 	4, // 2: storage.VirtualMachineV2.last_updated:type_name -> google.protobuf.Timestamp
-	1, // 3: storage.VirtualMachineV2.notes:type_name -> storage.VirtualMachineV2.Note
-	4, // [4:4] is the sub-list for method output_type
-	4, // [4:4] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	4, // 3: storage.VirtualMachineV2.last_agent_contact:type_name -> google.protobuf.Timestamp
+	1, // 4: storage.VirtualMachineV2.notes:type_name -> storage.VirtualMachineV2.Note
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_storage_virtual_machine_v2_proto_init() }
diff --git a/generated/storage/virtual_machine_v2_vtproto.pb.go b/generated/storage/virtual_machine_v2_vtproto.pb.go
index 326b889e0a363..4daef4e9f0c44 100644
--- a/generated/storage/virtual_machine_v2_vtproto.pb.go
+++ b/generated/storage/virtual_machine_v2_vtproto.pb.go
@@ -35,6 +35,7 @@ func (m *VirtualMachineV2) CloneVT() *VirtualMachineV2 {
 	r.GuestOs = m.GuestOs
 	r.State = m.State
 	r.LastUpdated = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.LastUpdated).CloneVT())
+	r.LastAgentContact = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.LastAgentContact).CloneVT())
 	r.VsockCid = m.VsockCid
 	r.Hash = m.Hash
 	if rhs := m.Facts; rhs != nil {
@@ -117,6 +118,9 @@ func (this *VirtualMachineV2) EqualVT(that *VirtualMachineV2) bool {
 	if this.Hash != that.Hash {
 		return false
 	}
+	if !(*timestamppb1.Timestamp)(this.LastAgentContact).EqualVT((*timestamppb1.Timestamp)(that.LastAgentContact)) {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -157,6 +161,16 @@ func (m *VirtualMachineV2) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.LastAgentContact != nil {
+		size, err := (*timestamppb1.Timestamp)(m.LastAgentContact).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x6a
+	}
 	if m.Hash != 0 {
 		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Hash))
 		i--
@@ -325,6 +339,10 @@ func (m *VirtualMachineV2) SizeVT() (n int) {
 	if m.Hash != 0 {
 		n += 1 + protohelpers.SizeOfVarint(uint64(m.Hash))
 	}
+	if m.LastAgentContact != nil {
+		l = (*timestamppb1.Timestamp)(m.LastAgentContact).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -839,6 +857,42 @@ func (m *VirtualMachineV2) UnmarshalVT(dAtA []byte) error {
 					break
 				}
 			}
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastAgentContact", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastAgentContact == nil {
+				m.LastAgentContact = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.LastAgentContact).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -1403,6 +1457,42 @@ func (m *VirtualMachineV2) UnmarshalVTUnsafe(dAtA []byte) error {
 					break
 				}
 			}
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastAgentContact", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastAgentContact == nil {
+				m.LastAgentContact = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.LastAgentContact).UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/generated/storage/vuln_requests.pb.go b/generated/storage/vuln_requests.pb.go
index 4c9821d23dd56..b17ccd4bdb986 100644
--- a/generated/storage/vuln_requests.pb.go
+++ b/generated/storage/vuln_requests.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/vuln_requests.proto
 
diff --git a/generated/storage/vulnerability.pb.go b/generated/storage/vulnerability.pb.go
index 72d93b0238a75..95e619dea61a9 100644
--- a/generated/storage/vulnerability.pb.go
+++ b/generated/storage/vulnerability.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: storage/vulnerability.proto
 
@@ -127,7 +127,7 @@ func (EmbeddedVulnerability_VulnerabilityType) EnumDescriptor() ([]byte, []int)
 	return file_storage_vulnerability_proto_rawDescGZIP(), []int{0, 1}
 }
 
-// Next Tag: 29
+// Next Tag: 30
 type EmbeddedVulnerability struct {
 	state    protoimpl.MessageState `protogen:"open.v1"`
 	Cve      string                 `protobuf:"bytes,1,opt,name=cve,proto3" json:"cve,omitempty" search:"CVE"` // @gotags: search:"CVE"
@@ -166,9 +166,11 @@ type EmbeddedVulnerability struct {
 	NvdCvss     float32      `protobuf:"fixed32,22,opt,name=nvd_cvss,json=nvdCvss,proto3" json:"nvd_cvss,omitempty" search:"NVD CVSS"` // @gotags: search:"NVD CVSS"
 	Epss        *EPSS        `protobuf:"bytes,23,opt,name=epss,proto3" json:"epss,omitempty"`
 	// datasource is for internal use only
-	Datasource    string   `protobuf:"bytes,26,opt,name=datasource,proto3" json:"-" hash:"ignore"` // @gotags: json:"-" hash:"ignore"
-	Exploit       *Exploit `protobuf:"bytes,27,opt,name=exploit,proto3" json:"exploit,omitempty"`
-	CisaKev       bool     `protobuf:"varint,28,opt,name=cisa_kev,json=cisaKev,proto3" json:"cisa_kev,omitempty" policy:"CISA KEV"` // @gotags: policy:"CISA KEV"
+	Datasource string   `protobuf:"bytes,26,opt,name=datasource,proto3" json:"-" hash:"ignore"` // @gotags: json:"-" hash:"ignore"
+	Exploit    *Exploit `protobuf:"bytes,27,opt,name=exploit,proto3" json:"exploit,omitempty"`
+	CisaKev    bool     `protobuf:"varint,28,opt,name=cisa_kev,json=cisaKev,proto3" json:"cisa_kev,omitempty" policy:"CISA KEV"` // @gotags: policy:"CISA KEV"
+	// origin indicates where vulnerability details came from, origin may be an aggregator (such as OSV).
+	Origin        VulnOrigin `protobuf:"varint,29,opt,name=origin,proto3,enum=storage.VulnOrigin" json:"origin,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -401,6 +403,13 @@ func (x *EmbeddedVulnerability) GetCisaKev() bool {
 	return false
 }
 
+func (x *EmbeddedVulnerability) GetOrigin() VulnOrigin {
+	if x != nil {
+		return x.Origin
+	}
+	return VulnOrigin_VULN_ORIGIN_OTHER
+}
+
 type isEmbeddedVulnerability_SetFixedBy interface {
 	isEmbeddedVulnerability_SetFixedBy()
 }
@@ -529,7 +538,7 @@ var File_storage_vulnerability_proto protoreflect.FileDescriptor
 
 const file_storage_vulnerability_proto_rawDesc = "" +
 	"\n" +
-	"\x1bstorage/vulnerability.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x11storage/cve.proto\"\xfd\f\n" +
+	"\x1bstorage/vulnerability.proto\x12\astorage\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x11storage/cve.proto\"\xaa\r\n" +
 	"\x15EmbeddedVulnerability\x12\x10\n" +
 	"\x03cve\x18\x01 \x01(\tR\x03cve\x12-\n" +
 	"\badvisory\x18\x18 \x01(\v2\x11.storage.AdvisoryR\badvisory\x12\x12\n" +
@@ -562,7 +571,8 @@ const file_storage_vulnerability_proto_rawDesc = "" +
 	"datasource\x18\x1a \x01(\tR\n" +
 	"datasource\x12*\n" +
 	"\aexploit\x18\x1b \x01(\v2\x10.storage.ExploitR\aexploit\x12\x19\n" +
-	"\bcisa_kev\x18\x1c \x01(\bR\acisaKev\"\x1e\n" +
+	"\bcisa_kev\x18\x1c \x01(\bR\acisaKev\x12+\n" +
+	"\x06origin\x18\x1d \x01(\x0e2\x13.storage.VulnOriginR\x06origin\"\x1e\n" +
 	"\fScoreVersion\x12\x06\n" +
 	"\x02V2\x10\x00\x12\x06\n" +
 	"\x02V3\x10\x01\"\xac\x01\n" +
@@ -613,7 +623,8 @@ var file_storage_vulnerability_proto_goTypes = []any{
 	(*CVSSScore)(nil),                            // 10: storage.CVSSScore
 	(*EPSS)(nil),                                 // 11: storage.EPSS
 	(*Exploit)(nil),                              // 12: storage.Exploit
-	(*CVEInfo)(nil),                              // 13: storage.CVEInfo
+	(VulnOrigin)(0),                              // 13: storage.VulnOrigin
+	(*CVEInfo)(nil),                              // 14: storage.CVEInfo
 }
 var file_storage_vulnerability_proto_depIdxs = []int32{
 	4,  // 0: storage.EmbeddedVulnerability.advisory:type_name -> storage.Advisory
@@ -634,15 +645,16 @@ var file_storage_vulnerability_proto_depIdxs = []int32{
 	10, // 15: storage.EmbeddedVulnerability.cvss_metrics:type_name -> storage.CVSSScore
 	11, // 16: storage.EmbeddedVulnerability.epss:type_name -> storage.EPSS
 	12, // 17: storage.EmbeddedVulnerability.exploit:type_name -> storage.Exploit
-	13, // 18: storage.NodeVulnerability.cve_base_info:type_name -> storage.CVEInfo
-	8,  // 19: storage.NodeVulnerability.severity:type_name -> storage.VulnerabilitySeverity
-	7,  // 20: storage.NodeVulnerability.snooze_start:type_name -> google.protobuf.Timestamp
-	7,  // 21: storage.NodeVulnerability.snooze_expiry:type_name -> google.protobuf.Timestamp
-	22, // [22:22] is the sub-list for method output_type
-	22, // [22:22] is the sub-list for method input_type
-	22, // [22:22] is the sub-list for extension type_name
-	22, // [22:22] is the sub-list for extension extendee
-	0,  // [0:22] is the sub-list for field type_name
+	13, // 18: storage.EmbeddedVulnerability.origin:type_name -> storage.VulnOrigin
+	14, // 19: storage.NodeVulnerability.cve_base_info:type_name -> storage.CVEInfo
+	8,  // 20: storage.NodeVulnerability.severity:type_name -> storage.VulnerabilitySeverity
+	7,  // 21: storage.NodeVulnerability.snooze_start:type_name -> google.protobuf.Timestamp
+	7,  // 22: storage.NodeVulnerability.snooze_expiry:type_name -> google.protobuf.Timestamp
+	23, // [23:23] is the sub-list for method output_type
+	23, // [23:23] is the sub-list for method input_type
+	23, // [23:23] is the sub-list for extension type_name
+	23, // [23:23] is the sub-list for extension extendee
+	0,  // [0:23] is the sub-list for field type_name
 }
 
 func init() { file_storage_vulnerability_proto_init() }
diff --git a/generated/storage/vulnerability_vtproto.pb.go b/generated/storage/vulnerability_vtproto.pb.go
index 6b79fd4de7ec4..32deb7c430fda 100644
--- a/generated/storage/vulnerability_vtproto.pb.go
+++ b/generated/storage/vulnerability_vtproto.pb.go
@@ -53,6 +53,7 @@ func (m *EmbeddedVulnerability) CloneVT() *EmbeddedVulnerability {
 	r.Datasource = m.Datasource
 	r.Exploit = m.Exploit.CloneVT()
 	r.CisaKev = m.CisaKev
+	r.Origin = m.Origin
 	if m.SetFixedBy != nil {
 		r.SetFixedBy = m.SetFixedBy.(interface {
 			CloneVT() isEmbeddedVulnerability_SetFixedBy
@@ -242,6 +243,9 @@ func (this *EmbeddedVulnerability) EqualVT(that *EmbeddedVulnerability) bool {
 	if this.CisaKev != that.CisaKev {
 		return false
 	}
+	if this.Origin != that.Origin {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -371,6 +375,13 @@ func (m *EmbeddedVulnerability) MarshalToSizedBufferVT(dAtA []byte) (int, error)
 		}
 		i -= size
 	}
+	if m.Origin != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Origin))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xe8
+	}
 	if m.CisaKev {
 		i--
 		if m.CisaKev {
@@ -862,6 +873,9 @@ func (m *EmbeddedVulnerability) SizeVT() (n int) {
 	if m.CisaKev {
 		n += 3
 	}
+	if m.Origin != 0 {
+		n += 2 + protohelpers.SizeOfVarint(uint64(m.Origin))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -1782,6 +1796,25 @@ func (m *EmbeddedVulnerability) UnmarshalVT(dAtA []byte) error {
 				}
 			}
 			m.CisaKev = bool(v != 0)
+		case 29:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Origin", wireType)
+			}
+			m.Origin = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Origin |= VulnOrigin(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -2927,6 +2960,25 @@ func (m *EmbeddedVulnerability) UnmarshalVTUnsafe(dAtA []byte) error {
 				}
 			}
 			m.CisaKev = bool(v != 0)
+		case 29:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Origin", wireType)
+			}
+			m.Origin = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Origin |= VulnOrigin(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/generated/test/test.pb.go b/generated/test/test.pb.go
index 5bc6afe472a3d..f17e92627291e 100644
--- a/generated/test/test.pb.go
+++ b/generated/test/test.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: test/test.proto
 
diff --git a/generated/tools/local-sensor/message.pb.go b/generated/tools/local-sensor/message.pb.go
index fdd50698a2b55..a0b724624c413 100644
--- a/generated/tools/local-sensor/message.pb.go
+++ b/generated/tools/local-sensor/message.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.32.1
 // source: tools/local-sensor/message.proto
 
diff --git a/go.mod b/go.mod
index d3da3e27b50c4..c853c31da7fff 100644
--- a/go.mod
+++ b/go.mod
@@ -1,17 +1,17 @@
 module github.com/stackrox/rox
 
-go 1.26.5
+go 1.26.7
 
 require (
-	cloud.google.com/go/artifactregistry v1.26.0
-	cloud.google.com/go/compute/metadata v0.9.0
-	cloud.google.com/go/containeranalysis v0.19.0
-	cloud.google.com/go/securitycenter v1.46.0
-	cloud.google.com/go/storage v1.64.0
+	cloud.google.com/go/artifactregistry v1.27.0
+	cloud.google.com/go/compute/metadata v0.10.0
+	cloud.google.com/go/containeranalysis v0.20.0
+	cloud.google.com/go/securitycenter v1.47.0
+	cloud.google.com/go/storage v1.69.0
 	dario.cat/mergo v1.0.2
-	github.com/Azure/azure-sdk-for-go-extensions v0.6.0
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
+	github.com/Azure/azure-sdk-for-go-extensions v0.7.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1
 	github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3
 	github.com/Azure/azure-sdk-for-go/sdk/monitor/ingestion/azlogs v1.1.0
 	github.com/BurntSushi/toml v1.6.0
@@ -20,28 +20,28 @@ require (
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/PagerDuty/go-pagerduty v1.8.0
-	github.com/RoaringBitmap/roaring/v2 v2.24.0
+	github.com/RoaringBitmap/roaring/v2 v2.29.0
 	github.com/Shopify/toxiproxy/v2 v2.12.0
 	github.com/VividCortex/ewma v1.2.0
-	github.com/adhocore/gronx v1.20.1
+	github.com/adhocore/gronx v1.20.5
 	github.com/andygrunwald/go-jira v1.17.0
-	github.com/aws/aws-sdk-go-v2 v1.43.4
-	github.com/aws/aws-sdk-go-v2/config v1.32.35
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.34
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.41
-	github.com/aws/aws-sdk-go-v2/service/ecr v1.60.4
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.107.0
-	github.com/aws/aws-sdk-go-v2/service/securityhub v1.76.0
-	github.com/aws/aws-sdk-go-v2/service/sts v1.45.4
-	github.com/aws/smithy-go v1.27.8
-	github.com/bmatcuk/doublestar/v4 v4.10.0
+	github.com/aws/aws-sdk-go-v2 v1.47.3
+	github.com/aws/aws-sdk-go-v2/config v1.33.9
+	github.com/aws/aws-sdk-go-v2/credentials v1.20.9
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.3
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.23.14
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.66.4
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.114.3
+	github.com/aws/aws-sdk-go-v2/service/securityhub v1.84.1
+	github.com/aws/aws-sdk-go-v2/service/sts v1.51.4
+	github.com/aws/smithy-go v1.28.5
+	github.com/bmatcuk/doublestar/v4 v4.10.2
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/cloudflare/cfssl v1.6.5
-	github.com/cockroachdb/pebble/v2 v2.1.6
+	github.com/cockroachdb/pebble/v2 v2.1.7
 	github.com/containers/image/v5 v5.36.2
-	github.com/coreos/go-oidc/v3 v3.20.0
+	github.com/coreos/go-oidc/v3 v3.21.0
 	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/dave/jennifer v1.7.1
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
@@ -50,26 +50,27 @@ require (
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/fatih/color v1.19.0
 	github.com/georgysavva/scany/v2 v2.1.4
-	github.com/go-jose/go-jose/v4 v4.1.4
+	github.com/go-jose/go-jose/v4 v4.1.5
 	github.com/go-logr/logr v1.4.4
 	github.com/go-logr/zapr v1.3.0
-	github.com/gobwas/glob v0.2.3
-	github.com/godbus/dbus/v5 v5.2.2
+	github.com/go-viper/mapstructure/v2 v2.5.0
+	github.com/gobwas/glob v1.0.0
+	github.com/godbus/dbus/v5 v5.2.3
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/certificate-transparency-go v1.3.3
 	github.com/google/gnostic-models v0.7.1
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.21.9
-	github.com/google/go-github/v60 v60.0.0
+	github.com/google/go-containerregistry v0.22.1
+	github.com/google/go-github/v91 v91.0.0
 	github.com/google/uuid v1.6.0
-	github.com/googleapis/gax-go/v2 v2.23.0
+	github.com/googleapis/gax-go/v2 v2.26.2
 	github.com/gorilla/schema v1.4.1
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
-	github.com/grafana/pyroscope-go v1.4.2
-	github.com/graph-gophers/graphql-go v1.10.3-0.20260702060009-60399cce0c05
-	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3
+	github.com/grafana/pyroscope-go v1.4.3
+	github.com/graph-gophers/graphql-go v1.10.3
+	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.4
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/hashicorp/go-version v1.9.0
@@ -77,51 +78,51 @@ require (
 	github.com/heimdalr/dag v1.5.1
 	github.com/helm/helm-mapkubeapis v0.6.1
 	github.com/heroku/docker-registry-client v0.0.0
-	github.com/jackc/pgx/v5 v5.10.0
+	github.com/jackc/pgx/v5 v5.11.0
 	github.com/jeremywohl/flatten v1.0.1
 	github.com/joshdk/go-junit v1.0.0
-	github.com/klauspost/compress v1.19.2
+	github.com/klauspost/compress v1.20.3
 	github.com/lib/pq v1.12.3
 	github.com/machinebox/graphql v0.2.2
 	github.com/mailru/easyjson v0.9.2
 	github.com/mdlayher/vsock v1.3.0
 	github.com/mitchellh/go-wordwrap v1.0.1
-	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
 	github.com/np-guard/cluster-topology-analyzer/v2 v2.3.0
 	github.com/np-guard/netpol-analyzer v1.4.4
 	github.com/nxadm/tail v1.4.11
-	github.com/olekukonko/tablewriter v1.1.4
-	github.com/onsi/ginkgo/v2 v2.32.1
-	github.com/onsi/gomega v1.42.1
+	github.com/olekukonko/tablewriter v1.1.5
+	github.com/onsi/ginkgo/v2 v2.33.1
+	github.com/onsi/gomega v1.44.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/openshift-online/ocm-sdk-go v0.1.509
+	github.com/openshift-online/ocm-sdk-go v0.1.517
 	github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb
 	github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1
 	github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2
 	github.com/openshift/library-go v0.0.0-20260318142011-72bf34f474bc
 	github.com/openshift/runtime-utils v0.0.0-20230921210328-7bdb5b9c177b
 	github.com/operator-framework/helm-operator-plugins v0.0.0-00010101000000-000000000000
-	github.com/owenrumney/go-sarif/v2 v2.3.3
-	github.com/package-url/packageurl-go v0.1.6
+	github.com/owenrumney/go-sarif/v3 v3.3.1
+	github.com/package-url/packageurl-go v0.1.7
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pkg/errors v0.9.1
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240409071808-615f978279ca
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
-	github.com/prometheus/client_golang v1.24.1
-	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.70.1
-	github.com/quay/claircore v1.5.54
-	github.com/quay/claircore/toolkit v1.6.1
+	github.com/prometheus/client_golang v1.25.0
+	github.com/prometheus/client_model v0.6.3
+	github.com/prometheus/common v0.72.1
+	github.com/quay/claircore v1.6.1-0.20260916195820-3902930ff815
+	github.com/quay/claircore/toolkit v1.7.0
 	github.com/quay/zlog/v2 v2.1.1
 	github.com/remind101/migrate v0.0.0-20170729031349-52c1edff7319
 	github.com/russellhaering/gosaml2 v0.12.0
 	github.com/russellhaering/goxmldsig v1.6.1
-	github.com/segmentio/analytics-go/v3 v3.3.0
+	github.com/segmentio/analytics-go/v3 v3.4.0
 	github.com/sergi/go-diff v1.4.0
 	github.com/sigstore/cosign/v3 v3.1.3
-	github.com/sigstore/rekor v1.5.3
+	github.com/sigstore/rekor v1.5.4
 	github.com/sigstore/sigstore v1.10.9
+	github.com/sigstore/sigstore-go v1.3.0
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
@@ -132,52 +133,54 @@ require (
 	github.com/stackrox/k8s-overlay-patch v0.0.0-20250224110925-13b5b47fd812
 	github.com/stackrox/pkcs7 v0.0.0-20240314170115-841ca6b5f88d
 	github.com/stackrox/scanner v0.0.0-20240830165150-d133ba942d59
-	github.com/stretchr/testify v1.11.1
-	github.com/tidwall/gjson v1.19.0
+	github.com/stolostron/cluster-lifecycle-api v0.0.0-20260330032750-43755d6ceb09
+	github.com/stretchr/testify v1.12.1
+	github.com/tidwall/gjson v1.20.0
 	github.com/tkuchiki/go-timezone v0.2.3
 	github.com/travelaudience/go-promhttp v1.0.1
 	github.com/vbauerster/mpb/v4 v4.12.2
-	go.uber.org/atomic v1.11.0
+	go.uber.org/atomic v1.12.0
 	go.uber.org/goleak v1.3.0
 	go.uber.org/mock v0.6.0
 	go.uber.org/zap v1.28.0
 	go.yaml.in/yaml/v3 v3.0.5
-	golang.org/x/crypto v0.54.0
-	golang.org/x/mod v0.39.0
-	golang.org/x/net v0.57.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
-	golang.org/x/term v0.45.0
-	golang.org/x/text v0.40.0
-	golang.org/x/time v0.15.0
-	golang.org/x/tools v0.48.0
+	golang.org/x/crypto v0.58.0
+	golang.org/x/mod v0.42.0
+	golang.org/x/net v0.61.0
+	golang.org/x/oauth2 v0.37.0
+	golang.org/x/sync v0.24.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/term v0.47.0
+	golang.org/x/text v0.43.0
+	golang.org/x/time v0.16.0
+	golang.org/x/tools v0.52.0
 	golang.stackrox.io/grpc-http1 v0.5.1
-	google.golang.org/api v0.292.0
-	google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94
-	google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772
-	google.golang.org/grpc v1.83.0
+	google.golang.org/api v0.301.0
+	google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d
+	google.golang.org/genproto/googleapis/api v0.0.0-20260921155816-b14227669459
+	google.golang.org/grpc v1.84.0
 	google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/mcuadros/go-syslog.v2 v2.3.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/robfig/cron.v2 v2.0.0-20150107220207-be2e0b0deed5
 	gopkg.in/yaml.v3 v3.0.1
-	gorm.io/driver/postgres v1.6.2
+	gorm.io/driver/postgres v1.6.3
 	gorm.io/gorm v1.31.2
-	helm.sh/helm/v3 v3.21.3
-	k8s.io/api v0.36.3
-	k8s.io/apiextensions-apiserver v0.36.3
-	k8s.io/apimachinery v0.36.3
-	k8s.io/apiserver v0.36.3
-	k8s.io/cli-runtime v0.36.3
-	k8s.io/client-go v0.36.3
-	k8s.io/kubectl v0.36.3
+	helm.sh/helm/v3 v3.22.0
+	k8s.io/api v0.37.1
+	k8s.io/apiextensions-apiserver v0.37.1
+	k8s.io/apimachinery v0.37.1
+	k8s.io/apiserver v0.37.1
+	k8s.io/cli-runtime v0.37.1
+	k8s.io/client-go v0.37.1
+	k8s.io/kubectl v0.37.1
 	k8s.io/kubelet v0.32.13
-	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
-	kubevirt.io/api v1.9.0
-	sigs.k8s.io/controller-runtime v0.24.1
-	sigs.k8s.io/controller-tools v0.21.0
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd
+	kubevirt.io/api v1.9.1
+	kubevirt.io/client-go v1.10.0-beta.0
+	sigs.k8s.io/controller-runtime v0.25.2
+	sigs.k8s.io/controller-tools v0.22.0
 	sigs.k8s.io/e2e-framework v0.7.0
 	sigs.k8s.io/yaml v1.6.0
 )
@@ -186,18 +189,18 @@ require (
 	al.essio.dev/pkg/shellescape v1.6.0 // indirect
 	cel.dev/expr v0.25.2 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.22.0 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/iam v1.11.0 // indirect
+	cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.3.0 // indirect
+	cloud.google.com/go/iam v1.13.0 // indirect
 	cloud.google.com/go/longrunning v1.2.0 // indirect
-	cloud.google.com/go/monitoring v1.29.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
+	cloud.google.com/go/monitoring v1.30.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v9 v9.0.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect
 	github.com/ComplianceAsCode/compliance-sdk v0.0.0-20250925092238-0b432985772e // indirect
 	github.com/DataDog/zstd v1.5.7 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.35.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
@@ -205,7 +208,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/RaduBerinde/axisds v0.1.0 // indirect
 	github.com/RaduBerinde/btreemap v0.0.0-20250419174037-3d62b7205d54 // indirect
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
@@ -213,24 +216,22 @@ require (
 	github.com/andybalholm/brotli v1.1.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.22 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.10.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.38.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.4 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beevik/etree v1.7.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.4 // indirect
-	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/clipperhouse/displaywidth v0.10.0 // indirect
@@ -241,7 +242,7 @@ require (
 	github.com/cockroachdb/errors v1.12.0 // indirect
 	github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect
 	github.com/cockroachdb/redact v1.1.6 // indirect
-	github.com/cockroachdb/swiss v0.0.0-20251224182025-b0f6560f979b // indirect
+	github.com/cockroachdb/swiss v0.0.0-20260820225851-333444432258 // indirect
 	github.com/cockroachdb/tokenbucket v0.0.0-20250429170803-42689b6311bb // indirect
 	github.com/coder/websocket v1.8.14 // indirect
 	github.com/containers/storage v1.59.1 // indirect
@@ -250,7 +251,7 @@ require (
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
 	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
 	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
-	github.com/docker/cli v29.6.2+incompatible // indirect
+	github.com/docker/cli v29.7.2+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
@@ -267,42 +268,43 @@ require (
 	github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c // indirect
 	github.com/fatih/camelcase v1.0.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/getsentry/sentry-go v0.34.0 // indirect
 	github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 // indirect
-	github.com/go-chi/chi/v5 v5.3.0 // indirect
+	github.com/go-chi/chi/v5 v5.3.1 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/go-git/go-git/v5 v5.19.2 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
+	github.com/go-kit/log v0.2.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.25.2 // indirect
-	github.com/go-openapi/errors v0.22.8 // indirect
-	github.com/go-openapi/jsonpointer v0.23.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.6 // indirect
-	github.com/go-openapi/loads v0.24.0 // indirect
-	github.com/go-openapi/runtime v0.32.4 // indirect
-	github.com/go-openapi/runtime/server-middleware v0.30.0 // indirect
-	github.com/go-openapi/spec v0.22.6 // indirect
-	github.com/go-openapi/strfmt v0.26.4 // indirect
-	github.com/go-openapi/swag v0.26.1 // indirect
-	github.com/go-openapi/swag/cmdutils v0.26.1 // indirect
-	github.com/go-openapi/swag/conv v0.27.0 // indirect
-	github.com/go-openapi/swag/fileutils v0.26.1 // indirect
-	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
-	github.com/go-openapi/swag/jsonutils v0.26.1 // indirect
-	github.com/go-openapi/swag/loading v0.26.1 // indirect
-	github.com/go-openapi/swag/mangling v0.26.1 // indirect
-	github.com/go-openapi/swag/netutils v0.26.1 // indirect
-	github.com/go-openapi/swag/stringutils v0.26.1 // indirect
-	github.com/go-openapi/swag/typeutils v0.27.0 // indirect
-	github.com/go-openapi/swag/yamlutils v0.26.1 // indirect
-	github.com/go-openapi/validate v0.26.0 // indirect
+	github.com/go-openapi/analysis v1.0.0 // indirect
+	github.com/go-openapi/errors v0.22.9 // indirect
+	github.com/go-openapi/jsonpointer v1.0.1 // indirect
+	github.com/go-openapi/jsonreference v1.0.1 // indirect
+	github.com/go-openapi/loads v0.25.2 // indirect
+	github.com/go-openapi/runtime v0.33.2 // indirect
+	github.com/go-openapi/runtime/server-middleware v0.33.2 // indirect
+	github.com/go-openapi/spec v1.0.0 // indirect
+	github.com/go-openapi/strfmt v0.27.2 // indirect
+	github.com/go-openapi/swag v0.29.2 // indirect
+	github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
+	github.com/go-openapi/swag/conv v0.29.2 // indirect
+	github.com/go-openapi/swag/fileutils v0.29.2 // indirect
+	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
+	github.com/go-openapi/swag/loading v0.29.2 // indirect
+	github.com/go-openapi/swag/mangling v0.29.2 // indirect
+	github.com/go-openapi/swag/netutils v0.29.2 // indirect
+	github.com/go-openapi/swag/pools v0.29.2 // indirect
+	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
+	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
+	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
+	github.com/go-openapi/validate v1.0.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
@@ -310,11 +312,11 @@ require (
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/cel-go v0.29.0 // indirect
+	github.com/google/cel-go v0.31.0 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
-	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.19 // indirect
+	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect
+	github.com/google/s2a-go v0.1.11 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.22 // indirect
 	github.com/gorilla/css v1.0.0 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/grafana/pyroscope-go/godeltaprof v0.1.11 // indirect
@@ -352,7 +354,7 @@ require (
 	github.com/matryer/is v1.4.1 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-runewidth v0.0.19 // indirect
 	github.com/mdlayher/socket v0.6.0 // indirect
 	github.com/mholt/archiver/v3 v3.5.1 // indirect
@@ -364,7 +366,7 @@ require (
 	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
@@ -375,13 +377,13 @@ require (
 	github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect
 	github.com/np-guard/models v0.5.7 // indirect
 	github.com/nwaples/rardecode v1.1.3 // indirect
-	github.com/oklog/ulid/v2 v2.1.1 // indirect
+	github.com/oklog/ulid/v2 v2.1.2 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.6 // indirect
 	github.com/opencontainers/runtime-spec v1.2.1 // indirect
-	github.com/openshift-online/ocm-api-model/clientapi v0.0.464 // indirect
-	github.com/openshift-online/ocm-api-model/model v0.0.464 // indirect
+	github.com/openshift-online/ocm-api-model/clientapi v0.0.470 // indirect
+	github.com/openshift-online/ocm-api-model/model v0.0.470 // indirect
 	github.com/openshift/custom-resource-status v1.1.2 // indirect
 	github.com/operator-framework/operator-lib v0.17.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
@@ -389,7 +391,7 @@ require (
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
 	github.com/quay/claircore/updater/driver v1.0.0 // indirect
 	github.com/quay/goval-parser v0.8.8 // indirect
 	github.com/redis/go-redis/extra/redisotel/v9 v9.5.3 // indirect
@@ -398,23 +400,21 @@ require (
 	github.com/rubenv/sql-migrate v1.8.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
-	github.com/sassoftware/relic v7.2.1+incompatible // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
+	github.com/sassoftware/relic/v8 v8.2.0 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
-	github.com/segmentio/backo-go v1.0.1 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sigstore/protobuf-specs v0.5.1 // indirect
 	github.com/sigstore/rekor-tiles/v2 v2.3.0 // indirect
-	github.com/sigstore/sigstore-go v1.2.2 // indirect
-	github.com/sigstore/timestamp-authority/v2 v2.1.2 // indirect
+	github.com/sigstore/timestamp-authority/v2 v2.1.3 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/spdx/tools-golang v0.5.7 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
 	github.com/stackrox/dotnet-scraper v0.0.0-20201023051640-72ef543323dd // indirect
 	github.com/stackrox/istio-cves v0.0.0-20221007013142-0bde9b541ec8 // indirect
 	github.com/stackrox/k8s-cves v0.0.0-20220818200547-7d0d1420c58d // indirect
@@ -433,56 +433,58 @@ require (
 	github.com/weppos/publicsuffix-go v0.50.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
-	github.com/zalando/go-keyring v0.2.6 // indirect
 	github.com/zmap/zcrypto v0.0.0-20250129210703-03c45d0bae98 // indirect
 	github.com/zmap/zlint/v3 v3.6.6 // indirect
-	go.etcd.io/bbolt v1.4.3 // indirect
+	go.etcd.io/bbolt v1.5.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.45.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
+	go.opentelemetry.io/otel v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.46.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/trace v1.46.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/code-generator v0.36.3 // indirect
-	k8s.io/component-base v0.36.3 // indirect
-	k8s.io/component-helpers v0.36.3 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b // indirect
+	k8s.io/code-generator v0.37.1 // indirect
+	k8s.io/component-base v0.37.1 // indirect
+	k8s.io/component-helpers v0.37.1 // indirect
+	k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 // indirect
-	k8s.io/streaming v0.36.3 // indirect
+	k8s.io/kube-openapi v0.31.0 // indirect
+	k8s.io/streaming v0.37.1 // indirect
 	kubevirt.io/containerized-data-importer-api v1.64.0 // indirect
 	kubevirt.io/controller-lifecycle-operator-sdk/api v0.2.4 // indirect
-	modernc.org/libc v1.73.4 // indirect
+	modernc.org/libc v1.75.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.53.0 // indirect
-	oras.land/oras-go/v2 v2.6.1 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
+	modernc.org/memory v1.12.1 // indirect
+	modernc.org/sqlite v1.58.0 // indirect
+	oras.land/oras-go/v2 v2.6.2 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/kustomize/api v0.21.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
 	sigs.k8s.io/network-policy-api v0.1.5 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 )
 
 // HOW TO BUMP
@@ -537,6 +539,9 @@ replace (
 	gopkg.in/yaml.v3 => github.com/stackrox/yaml/v3 v3.0.0
 )
 
+// kubevirt.io/client-go requires the nonexistent k8s.io/kube-openapi@v0.31.0 tag.
+replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199
+
 // @stackrox/scanner
 replace (
 	github.com/facebookincubator/nvdtools => github.com/stackrox/nvdtools v0.0.0-20231111002313-57e262e4797e
diff --git a/go.sum b/go.sum
index b50c1aa557f73..738b265515d1e 100644
--- a/go.sum
+++ b/go.sum
@@ -32,12 +32,12 @@ cloud.google.com/go v0.98.0/go.mod h1:ua6Ush4NALrHk5QXDWnjvZHN93OuF0HfuEPq9I1X0c
 cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/artifactregistry v1.26.0 h1:iq5kkdY2FJY8RkkNghUelb3EOcqyy7dVhfDGVk/Xw9g=
-cloud.google.com/go/artifactregistry v1.26.0/go.mod h1:c5FPi5GtDBP+OAr5kKhCBNQDT9ZgAyobXQjekx93VWs=
-cloud.google.com/go/auth v0.22.0 h1:Xp9wAKkLoeaYb5pYZZoQGz4E9sdPxIbzS3gywZE3ciQ=
-cloud.google.com/go/auth v0.22.0/go.mod h1:M9o2Oz+YI2jAfxewJgb1vyI3vceHF+eohmxyzmrl+9s=
-cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
-cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/artifactregistry v1.27.0 h1:EBgdk9sXNAVyWJ3hnTmWRdlmKhGDKCjkJbLoF3EsyWE=
+cloud.google.com/go/artifactregistry v1.27.0/go.mod h1:r0rZgbNmn5ppdqwUMF182yc7EFH6vabJMbXM+PlfW9A=
+cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a h1:jW1ZLFy9oa5ai8LOI40z6s+DL1cO/L1KSm9hVGnibn8=
+cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a/go.mod h1:1dmBXa9xfBvBr39ZnDUDkaaA91ccq9CcqENDgJA4d7c=
+cloud.google.com/go/auth/oauth2adapt v0.3.0 h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=
+cloud.google.com/go/auth/oauth2adapt v0.3.0/go.mod h1:7+2uCm7++XFO+/lN06c2HXpDXb/NMNn2/UwyBPbTnkk=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -45,36 +45,36 @@ cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUM
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
 cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
-cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-cloud.google.com/go/containeranalysis v0.19.0 h1:89ZhFvJHWzX9/jUJy/IEVbtSa2hv4+NtsvwWMEsUYnY=
-cloud.google.com/go/containeranalysis v0.19.0/go.mod h1:Zq0XHzUIa0oTa7H6aSR8HWqeJnoRI9syUcYJzfozjZQ=
+cloud.google.com/go/compute/metadata v0.10.0 h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY=
+cloud.google.com/go/compute/metadata v0.10.0/go.mod h1:rGFHRrIif570kSibjFTMbt6/4/tzgJWFGI/HVol4GIk=
+cloud.google.com/go/containeranalysis v0.20.0 h1:5tko84zYirVH+FEU6JPuT/xGBvSagsllYxH7m8ytjyI=
+cloud.google.com/go/containeranalysis v0.20.0/go.mod h1:cJzgbuNqFTWswsVcT0eemqdqtOEq4dJEFvAH3cgzkyc=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
-cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM=
-cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4=
-cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE=
-cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U=
-cloud.google.com/go/logging v1.18.0 h1:KhzZq+1cSkPH9YUaKLLhLtQxIHitVayBmk0sGfoM9+k=
-cloud.google.com/go/logging v1.18.0/go.mod h1:ZGKnpBaURITh+g/uom2VhbiFoFWvejcrHPDhxFtU/gI=
+cloud.google.com/go/iam v1.13.0 h1:ufT3FPT5rFFXu6UtLkNoxaOaV5EuA1dsSkmemCSTo6U=
+cloud.google.com/go/iam v1.13.0/go.mod h1:gHXdDEiPDvqd1q1KwBDGQlgZY/BwY760zU2LhOZS5w0=
+cloud.google.com/go/kms v1.33.0 h1:pG0X78m212b2pv9N4fdMoUO69LuZGQ9kSvn8sHBOFAo=
+cloud.google.com/go/kms v1.33.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA=
+cloud.google.com/go/logging v1.19.0 h1:NCqhdVUg3wQ8Cobdf16FDSuTGi3+6+hdSBHrY5TsR6Q=
+cloud.google.com/go/logging v1.19.0/go.mod h1:i40NZCHC9Gqvod4yE+yQfDWwlgwW/SrshkkGibCHxcA=
 cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM=
 cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0=
-cloud.google.com/go/monitoring v1.29.0 h1:AHhDsFaSax1/4k+qlIDX/SDGe6hggnfXJ9dkgD9qBPY=
-cloud.google.com/go/monitoring v1.29.0/go.mod h1:72NOVjJXHY/HBfoLT0+qlCZBT059+9VXLeAnL2PeeVM=
+cloud.google.com/go/monitoring v1.30.0 h1:r/d+JUbyKmJ8b07iznuKfzVzrIXTWxHQ3lBRm3x2LlY=
+cloud.google.com/go/monitoring v1.30.0/go.mod h1:htlUR0QWVMrjFzZmN4LGnMAve9xB/eduwjmINxVZ8RM=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/securitycenter v1.46.0 h1:MfzR4Bj5W51MAIyJlA4molK/vj0xO64te4yCGAbwXL0=
-cloud.google.com/go/securitycenter v1.46.0/go.mod h1:7mAlzsCsKlEVmciAFORl431laDGpoKGFkSQndAzFs30=
+cloud.google.com/go/securitycenter v1.47.0 h1:cKjSLURYE5tewWgH6VW6Jo6YaZWG+FUUFh/SmrqrcHU=
+cloud.google.com/go/securitycenter v1.47.0/go.mod h1:OWKAGzP36rJ4pFSjU441g+vi7WTRdMFRVw1rykvMwPE=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.64.0 h1:KLpxI/oX9LxeRsNqn877d2WyeT3ryiEwnGt8pwcSPZg=
-cloud.google.com/go/storage v1.64.0/go.mod h1:lWyAtwvDZHdL3k68WVKbESP6bmWaV23ZJJ/JEVw/ZaQ=
+cloud.google.com/go/storage v1.69.0 h1:jAAMC1411HEh78nKsU0Zns+eFj3TnhjAWIhg5Ud/XBM=
+cloud.google.com/go/storage v1.69.0/go.mod h1:PELYsxTYm2peE4mwLEC1+mS1dA/kUSRUxNv56rOy44g=
 cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E=
 cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
@@ -90,18 +90,18 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/azure-sdk-for-go-extensions v0.6.0 h1:LzJ4iAk3ZBZ0Y27uUm66XBQntbgMr3QXn2KIDb4Mx04=
-github.com/Azure/azure-sdk-for-go-extensions v0.6.0/go.mod h1:f/wRrqvvh197V5r4jGADV7528UdO/zfL+/Ud92BMSag=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 h1:4gRPBpN1f6xt88yi4WR26m7XaD9OlWtVT6bWPdGUIok=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0/go.mod h1:G7QVLxw1j1JVyrO1MA95S8m8HStaaleDZYTcfGgjB2o=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA=
+github.com/Azure/azure-sdk-for-go-extensions v0.7.0 h1:ko7jxarxFmfm3OAtIkKcnC2yK1H7a7wB7As38huaa4Y=
+github.com/Azure/azure-sdk-for-go-extensions v0.7.0/go.mod h1:f/wRrqvvh197V5r4jGADV7528UdO/zfL+/Ud92BMSag=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 h1:qgnWTiWs1G7AqcKZegFvkJD1bmXJcaDU3uC0ELSgZ5U=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3/go.mod h1:XtxD48QPInqoj+GMlcRlXHEYsoOxFnP6w2JgIZ9rDS4=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1/go.mod h1:oXtinPO4OLj9d1DOTrqrL1oRwGhcqadvAmrl6wTeGlk=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso=
 github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 h1:ldKsKtEIblsgsr6mPwrd9yRntoX6uLz/K89wsldwx/k=
 github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3/go.mod h1:MAm7bk0oDLmD8yIkvfbxPW04fxzphPyL+7GzwHxOp6Y=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 h1:Terj1CMW4+NY5CpWjSRkqLoxh2DkYDdv/FH2z0897Uc=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0/go.mod h1:7Ut2Qw9vcwpLW5Q4MBy43uSxXS7tK2yjs94OJ6j5thE=
 github.com/Azure/azure-sdk-for-go/sdk/monitor/ingestion/azlogs v1.1.0 h1:Q+tp/BW0x11uAm5i9f2xEu3RZ3wy89KNYfDVCWFHUJQ=
 github.com/Azure/azure-sdk-for-go/sdk/monitor/ingestion/azlogs v1.1.0/go.mod h1:et3yi6OrdxM8YK0pfOwpHSLf4gWypxQVWh4T9wRzg3k=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v9 v9.0.0 h1:z5qKE92WxOYrrU2yWL7fL0XW7vVBjMKyaXOITK+Z3bI=
@@ -118,8 +118,8 @@ github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEK
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 h1:Nljr4q1GRA/5vCrMONS+g4u4LRHNgOXVSh3O43J2CnI=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
@@ -135,8 +135,8 @@ github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/DataDog/zstd v1.5.7 h1:ybO8RBeh29qrxIhCA9E8gKY6xfONU9T6G6aP9DTKfLE=
 github.com/DataDog/zstd v1.5.7/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 h1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.35.0 h1:bN1gA3of5bXtbnLsRPrwfmbbe7A5UWFlcTHseujLnpc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.35.0/go.mod h1:Yj5vHEz/aAepZGliRJsA6uvHAVAQyEwajq9ORCHPxzM=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 h1:jLdiS1vO+XJFyDSWRHBx56r4s/NNtcl5J6KyCcWUX/w=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0/go.mod h1:8lmpHY+1VRoteiOwyrQMDt1YGXOrFKCz+1wJW7n3ODY=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.57.0 h1:cSjUzZ7KU8hicTgzaSv9NmSyM9fTVK3y5lsBUl3wOis=
@@ -158,22 +158,21 @@ github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA4
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/PagerDuty/go-pagerduty v1.8.0 h1:MTFqTffIcAervB83U7Bx6HERzLbyaSPL/+oxH3zyluI=
 github.com/PagerDuty/go-pagerduty v1.8.0/go.mod h1:nzIeAqyFSJAFkjWKvMzug0JtwDg+V+UoCWjFrfFH5mI=
-github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
-github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/RaduBerinde/axisds v0.1.0 h1:YItk/RmU5nvlsv/awo2Fjx97Mfpt4JfgtEVAGPrLdz8=
 github.com/RaduBerinde/axisds v0.1.0/go.mod h1:UHGJonU9z4YYGKJxSaC6/TNcLOBptpmM5m2Cksbnw0Y=
 github.com/RaduBerinde/btreemap v0.0.0-20250419174037-3d62b7205d54 h1:bsU8Tzxr/PNz75ayvCnxKZWEYdLMPDkUgticP4a4Bvk=
 github.com/RaduBerinde/btreemap v0.0.0-20250419174037-3d62b7205d54/go.mod h1:0tr7FllbE9gJkHq7CVeeDDFAFKQVy5RnCSSNBOvdqbc=
-github.com/RoaringBitmap/roaring/v2 v2.24.0 h1:zQkkBZtG3WRP4j+P3A5DO221SvL1Br88TJkhyqEQRZo=
-github.com/RoaringBitmap/roaring/v2 v2.24.0/go.mod h1:SfT3of9nYh3vis1dIbCj4Yw6KQGujTN+f345nrN/0JA=
+github.com/RoaringBitmap/roaring/v2 v2.29.0 h1:jSjxqZEqiF9W5dHUFsemupb9bnLaQJwZVe5yMetbsZg=
+github.com/RoaringBitmap/roaring/v2 v2.29.0/go.mod h1:BZufmFbox589n3j5eOmyTaLSGXbRLc2LmQvjKjzSEGU=
 github.com/Shopify/toxiproxy/v2 v2.12.0 h1:d1x++lYZg/zijXPPcv7PH0MvHMzEI5aX/YuUi/Sw+yg=
 github.com/Shopify/toxiproxy/v2 v2.12.0/go.mod h1:R9Z38Pw6k2cGZWXHe7tbxjGW9azmY1KbDQJ1kd+h7Tk=
 github.com/VividCortex/ewma v1.1.1/go.mod h1:2Tkkvm3sRDVXaiyucHiACn4cqf7DpdyLvmxzcbUokwA=
@@ -183,8 +182,8 @@ github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpH
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/aclements/go-perfevent v0.0.0-20240301234650-f7843625020f h1:JjxwchlOepwsUWcQwD2mLUAGE9aCp0/ehy6yCHFBOvo=
 github.com/aclements/go-perfevent v0.0.0-20240301234650-f7843625020f/go.mod h1:tMDTce/yLLN/SK8gMOxQfnyeMeCg8KGzp0D1cbECEeo=
-github.com/adhocore/gronx v1.20.1 h1:knBhN6BrPz5zUI/S9xKAkXVHdojISoF0HyC5NuVrtG4=
-github.com/adhocore/gronx v1.20.1/go.mod h1:7oUY1WAU8rEJWmAxXR2DN0JaO4gi9khSgKjiRypqteg=
+github.com/adhocore/gronx v1.20.5 h1:UgXvkD97Hovm7yA1TTRTd309o9F1h7C8gX04rktaxnE=
+github.com/adhocore/gronx v1.20.5/go.mod h1:7oUY1WAU8rEJWmAxXR2DN0JaO4gi9khSgKjiRypqteg=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -204,7 +203,6 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuW
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
-github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
@@ -212,53 +210,52 @@ github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go-v2 v1.43.4 h1:b9FTvbRwy+JCsfp2Wp6wV/KbOx3Aj7nkoFb2cRX0IhE=
-github.com/aws/aws-sdk-go-v2 v1.43.4/go.mod h1:70vwSy16txshwG+g55WkpgPKDIByzHI8ccBsOteo3bQ=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 h1:aiuaKlDweRC5qExJondpWjOgyzMHpofpwspGXUtwn4c=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16/go.mod h1:nG/LOlmox9BDe9HvQnXWzgcK8uKbgBMZ/Hp5pVt/21I=
-github.com/aws/aws-sdk-go-v2/config v1.32.35 h1:UEzXuET8E42lxBPijuACu/tEK7v5lFPlk0Q+GT5WD9E=
-github.com/aws/aws-sdk-go-v2/config v1.32.35/go.mod h1:KaMtJpFa2JlL2BStjjHQVwQpzZEmw+ND/EgVrfFoo2g=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.34 h1:y6GkSmcv5myd1ngrYbGmiLlwQqB6TQhOuN/tbSSuWDY=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.34/go.mod h1:w3dTcnDVoQIewjo7JG45hduAToikiIFLC4FIO7fndvw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 h1:+S7kbJoLDDQ5tE+lHrUBgMkzC8NLgsaioS2F3dVoFAE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35/go.mod h1:Ak7xXviIARfFdNUJ9Etb0bdVDt/KAvKjMGJVLWXDzik=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.41 h1:RgRlA38QGJPnsG6TNEnMTQq8COa6Ye7AGwdnFlzd3Ys=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.41/go.mod h1:14QhagNwgiQqYUcAAJjQwgBXCcpxUau+8S/0YRLt5Uo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 h1:kzVuGlatQtYinwBJEEyLAbggepCoavosiaHHX9+fD+c=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35/go.mod h1:0yLx0yEI+SfqeJMPvOtIEFoZbiQYXMGszBueiutQyaI=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 h1:WK6CjihTuLisCjSKKbildJ79sGZZgbBz3iNa7VsKIhU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35/go.mod h1:KYleN57luLoe97R7vTnx8PMcVrr9gAcRECtOjl91DNg=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 h1:jbGY4CXLzZElOXgGsexlC3Hi+3YM0rSmk4opFXKqg/k=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36/go.mod h1:uBu/9aKsS/UQGc72RAt3y54kjgYQxmhut8ZD2dXCDNE=
-github.com/aws/aws-sdk-go-v2/service/ecr v1.60.4 h1:qIgueZwgw+rANqXuL1Cjk2Lm/Pihbw2nx3C1D7eQD+k=
-github.com/aws/aws-sdk-go-v2/service/ecr v1.60.4/go.mod h1:Jr9Mh7l72YtNr8nmEwcJiU4xwCerZB8/krBWW4RckmY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 h1:JJLBQxwY+AFwuPAi5ivGc1ChnTdUt4cXMv7e76m2c/Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15/go.mod h1:lQknBIe78MVL0cQOQDlag8KGflMbMEVFx9mB6O8ENvk=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 h1:Q1TF1J9jVD+vFo0LzNnmNdQ9EAt52TS+MQlq9Ir+Yxo=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28/go.mod h1:4KqXXC/p1hrotmouDFbrRoWaLy962b9PMUReCG6+uWo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 h1:BBEElKh4a+rKshvjrfpajTe9CbpZvrbb4Jkg2PB7RzA=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35/go.mod h1:zaZk983w//8beSruBVec/mr4CmDwgZitW/qzGhAAX0g=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 h1:EUIwBoN+q7UmhAejxgD27APiRjh1vwCFo53gSqdT0BM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36/go.mod h1:6u00gmlTGR6W0b2k9NBrld7MnOEmf1Spqx0VVt6AqyE=
-github.com/aws/aws-sdk-go-v2/service/kms v1.53.4 h1:PEgVSsWtR8NNxsDxFL2Ywisi7R+1EFQARGsT4q3mWwI=
-github.com/aws/aws-sdk-go-v2/service/kms v1.53.4/go.mod h1:3EeKyDGPGSCEphG2OolwNGNF45RvQIfm27AYYpfEWrw=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.107.0 h1:OkYV+1171za+ab9otU1tGxMXhx6uZvwVEtVddjLuYTg=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.107.0/go.mod h1:5FTZoQxhmLEiCAtYVk6V+t0iS/B5yGZVLZ3Wq5FDJZI=
-github.com/aws/aws-sdk-go-v2/service/securityhub v1.76.0 h1:J/olEWGa5NIIZiejnuG4u+ahM5liNIKa07sEP5OPbqs=
-github.com/aws/aws-sdk-go-v2/service/securityhub v1.76.0/go.mod h1:zHr00dDys+8JbwQALvat8WGyudYfzc2W3dw79e+bSWs=
-github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 h1:cOJELVNrq5Q3Udry2GLuHUM7MhwpeaQRdYaoa6GI/yI=
-github.com/aws/aws-sdk-go-v2/service/signin v1.5.4/go.mod h1:f4LxzKBtaTxD7xh3PiVg3CE1tchQemfmghaJr+NbK2c=
-github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 h1:AMW7a7S8iQaHjBYZdU3PCq4GKRPijTPRAc7e6XtEThY=
-github.com/aws/aws-sdk-go-v2/service/sso v1.33.4/go.mod h1:QQNsFV1DVXoXcZt18FS8lI8rtUrlDyAuWZLQ5shunv4=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 h1:AsbZcJAQPRmHDJG8K1N0pof/1zPWjVT8TFlTWuGLSvo=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4/go.mod h1:6imqztH0//t0mKbl6yWl7swSEl7F/w32oAmqB3vP1ag=
-github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 h1:w/AryDYMjSUANSQ2uoZxJovUsMTwWJNTv3IMex30Y+4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.45.4/go.mod h1:WeBiAa67azG7Su9Vf+ChGDBLiAozJCXzdjXiPBUwtbc=
-github.com/aws/smithy-go v1.27.8 h1:FR0dxZfIlV7Z8eh2iHfIofdunw382XsDV3Mxt9nUvRY=
-github.com/aws/smithy-go v1.27.8/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.47.3 h1:HRoT/MkNi3bjO5xF4dCzLzvVmkvRGHj3/cLINDnJejk=
+github.com/aws/aws-sdk-go-v2 v1.47.3/go.mod h1:xSl+OSI5ZUw6bSMupWc218zE5Pl+65MCCu3ySWFY99A=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.22 h1:oiEmPz/YMMeh/JvAE8xSxNCIsvWE6lpFe4ZPlyFykQI=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.22/go.mod h1:QWUDuRi9PFjBHIU2iH1Pkldbe7zqLfXJC4wWLbF8nuQ=
+github.com/aws/aws-sdk-go-v2/config v1.33.9 h1:Hv6bcQUJVnmuWaKjqD6Ot8sE75NrWsWV20oGT5aWle0=
+github.com/aws/aws-sdk-go-v2/config v1.33.9/go.mod h1:ivowmrZNfBQLcg4QkaItgi5wae4Bzot9RzIdbY1hfTg=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.9 h1:SNO55PnWhaDafsOcv16lCA0kdoFMl/YlegWoVsU02s0=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.9/go.mod h1:+2reOTRtdD3VSBqpRDNwrZIYy8yMCYa7oK3WKTJ/I1I=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.3 h1:gr3b87OLB29jymWPzp/CAyXwQRJVE+sC4Wm0qBIKHsk=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.3/go.mod h1:BRjf4L/Yx2hY54o+ZibPbLJyMMeSwqYQXwcJfqW66a8=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.23.14 h1:nX4dV32e7e2GSg60GojffG61w4tvYxVpvEGWfSlcImo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.23.14/go.mod h1:dNw78YbA0ylhEVJ1h84fPdtIiWkVTaszT7oHkE/cq5E=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.6 h1:CqL8NN3p4I0JTwwV5MEoatIl4Y2amZ2X9dRD+0hbRL0=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.6/go.mod h1:exdJ32hMqXl0Wyo6NwqEC5yIhtua3+PDaKE8P29m4qE=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.6 h1:FpBq24TG6WVSObTNhQOv7Q0088rounUUlwn3zlNItkM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.6/go.mod h1:ONzdPVYC95oBOu0VWNEsKEntcoemP3xVKjT+qWml1s4=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.6 h1:Qmn60RWuk9+bd2ddvJJqwf3Cpac3VvGMOdbGemtUhX4=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.6/go.mod h1:h/YJhe4AVyQxEUMluph10iqV7mjajH7A9L+BHF5ppis=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.66.4 h1:qnnwXADWCoti36pKognFfw3L4bPYW1wIlsm4JqYmjDY=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.66.4/go.mod h1:uDza1Eipo/Olii3CCgLglHmAni24PScSAhpfIKbUl0c=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.21 h1:e6YW5uME30TkrElR+4/xcY7NB6CCj2dcv7vtmGXhfhQ=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.21/go.mod h1:obpHAMP693+f3/A8PkLhIqfK1C+NWWn8zXzqD3OH520=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.7 h1:CwvFlKw0uUScfgOMflXSRZa+ayXgOf6wk7lhyMemQYU=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.7/go.mod h1:4SbD8BB+p+QEnG0aX6DoWwrtk9SufyYXRsUv0nve8LE=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.6 h1:LHHdobjo5le1sjJdolitV7uVvYg3wkaeM1Ju2fDgeZQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.6/go.mod h1:CBGB0evAiaMD3Lk4wPO7LQCcCZLuhzL5Qf/wfEUHQ5w=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.6 h1:mYViDr2azcgxOpRrObZOl631bvavqILoE/L+Kxgbwys=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.6/go.mod h1:OXVdAo9jNhggB+hJRGOyy7WolGTKB6Rg7IIulDeSzPM=
+github.com/aws/aws-sdk-go-v2/service/kms v1.55.0 h1:uB8ymkVosyourmGXCZHyWhJ4wuKA4xq3ii2dVMPtBZY=
+github.com/aws/aws-sdk-go-v2/service/kms v1.55.0/go.mod h1:rK4RITSY/qJw3qVJ7p19fceOWuvrisqqOChFkX05n5I=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.114.3 h1:NyeuyXkZL476uoAowNActm4XJO1QPKf7aassgXHpiqA=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.114.3/go.mod h1:GfoBeKMDJecgRUsGf/0RGdx0NJAh81ObTd922h8pQys=
+github.com/aws/aws-sdk-go-v2/service/securityhub v1.84.1 h1:LgsiaI6xfyBrEwso2XsZFZpqnmtjmqIJUN8p/mIkkH4=
+github.com/aws/aws-sdk-go-v2/service/securityhub v1.84.1/go.mod h1:/had+BOeuoD/E3LQR4PxHLZase9U7VOdXkC/+4425FA=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.4 h1:tvpDjuUvgKURf3Yk4hOaGbZ4QdY+070OWcA5d6LUv2A=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.4/go.mod h1:3ibVKg5Ng82Zby8++jELTD2nHxiPk2DJRLEeW/LKp8M=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.4 h1:ChCtagixSFOxltv0o6E3NT8F7ksvZtZGPwUBynO5Nmk=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.4/go.mod h1:+FEO9jrVMpc9oN3CdAxJbtlQEu3z8UddDPSedpeM3PY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.4 h1:j6c+HA4AoS0EBEjArPjavFEBrucJEryfrQU0TffmACk=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.4/go.mod h1:RhghaXUk9q66VtOQUX1FdPddQuHnqQZzbB0fEYXmPRA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.51.4 h1:OKEfbf2tcfsF2pBk/S9QqNpo6alaAtiBs4hysCsBjPw=
+github.com/aws/aws-sdk-go-v2/service/sts v1.51.4/go.mod h1:mCd6qGo9b8hTtfjgsmNkFlzwjyce4owd7HDVFnCLXhM=
+github.com/aws/smithy-go v1.28.5 h1:OqbqKtzY9NUnr2yAe9+hiTdFb20tNaK/lI0PMOGXX9k=
+github.com/aws/smithy-go v1.28.5/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA=
@@ -273,14 +270,10 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bits-and-blooms/bitset v1.24.4 h1:95H15Og1clikBrKr/DuzMXkQzECs1M6hhoGXLwLQOZE=
 github.com/bits-and-blooms/bitset v1.24.4/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
-github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
-github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
+github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
+github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bshuster-repo/logrus-logstash-hook v1.1.0 h1:o2FzZifLg+z/DN1OFmzTWzZZx/roaqt8IPZCIVco8r4=
 github.com/bshuster-repo/logrus-logstash-hook v1.1.0/go.mod h1:Q2aXOe7rNuPgbBtPCOzYyWDvKX7+FpxE5sRdvcPoui0=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -334,12 +327,12 @@ github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 h1:ASDL+UJcILM
 github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506/go.mod h1:Mw7HqKr2kdtu6aYGn3tPmAftiP3QPX63LdK/zcariIo=
 github.com/cockroachdb/metamorphic v0.0.0-20231108215700-4ba948b56895 h1:XANOgPYtvELQ/h4IrmPAohXqe2pWA8Bwhejr3VQoZsA=
 github.com/cockroachdb/metamorphic v0.0.0-20231108215700-4ba948b56895/go.mod h1:aPd7gM9ov9M8v32Yy5NJrDyOcD8z642dqs+F0CeNXfA=
-github.com/cockroachdb/pebble/v2 v2.1.6 h1:GDo7Z2+LgFZ7LJLdLmBXhDeTVIwgSPGxIT15hE7vGqM=
-github.com/cockroachdb/pebble/v2 v2.1.6/go.mod h1:Reo1RTniv1UjVTAu/Fv74y5i3kJ5gmVrPhO9UtFiKn8=
+github.com/cockroachdb/pebble/v2 v2.1.7 h1:hFQnbsniSWg9BVcNKMuaUufYPiVXY6uJvaY9grbQ9+U=
+github.com/cockroachdb/pebble/v2 v2.1.7/go.mod h1:JhU5cqqYkr2BdsBHbZhRZOryAtfhcV3eNI/oBcbrxWc=
 github.com/cockroachdb/redact v1.1.6 h1:zXJBwDZ84xJNlHl1rMyCojqyIxv+7YUpQiJLQ7n4314=
 github.com/cockroachdb/redact v1.1.6/go.mod h1:BVNblN9mBWFyMyqK1k3AAiSxhvhfK2oOZZ2lK+dpvRg=
-github.com/cockroachdb/swiss v0.0.0-20251224182025-b0f6560f979b h1:VXvSNzmr8hMj8XTuY0PT9Ane9qZGul/p67vGYwl9BFI=
-github.com/cockroachdb/swiss v0.0.0-20251224182025-b0f6560f979b/go.mod h1:yBRu/cnL4ks9bgy4vAASdjIW+/xMlFwuHKqtmh3GZQg=
+github.com/cockroachdb/swiss v0.0.0-20260820225851-333444432258 h1:IJ+uNItEm0qx9FE2AgIc1PMsCUtk8nbSIzhQE1t5GWw=
+github.com/cockroachdb/swiss v0.0.0-20260820225851-333444432258/go.mod h1:yBRu/cnL4ks9bgy4vAASdjIW+/xMlFwuHKqtmh3GZQg=
 github.com/cockroachdb/tokenbucket v0.0.0-20250429170803-42689b6311bb h1:3bCgBvB8PbJVMX1ouCcSIxvsqKPYM7gs72o0zC76n9g=
 github.com/cockroachdb/tokenbucket v0.0.0-20250429170803-42689b6311bb/go.mod h1:7nc4anLGjupUW/PeY5qiNYsdNXj7zopG+eqsS7To5IQ=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
@@ -350,8 +343,8 @@ github.com/containers/image/v5 v5.36.2 h1:GcxYQyAHRF/pLqR4p4RpvKllnNL8mOBn0eZnqJ
 github.com/containers/image/v5 v5.36.2/go.mod h1:b4GMKH2z/5t6/09utbse2ZiLK/c72GuGLFdp7K69eA4=
 github.com/containers/storage v1.59.1 h1:11Zu68MXsEQGBBd+GadPrHPpWeqjKS8hJDGiAHgIqDs=
 github.com/containers/storage v1.59.1/go.mod h1:KoAYHnAjP3/cTsRS+mmWZGkufSY2GACiKQ4V3ZLQnR0=
-github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=
-github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
+github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
+github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
@@ -375,8 +368,6 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/depcheck-test/depcheck-test v0.0.0-20220607135614-199033aaa936 h1:foGzavPWwtoyBvjWyKJYDYsyzy+23iBV7NKTwdk+LRY=
-github.com/depcheck-test/depcheck-test v0.0.0-20220607135614-199033aaa936/go.mod h1:ttKPnOepYt4LLzD+loXQ1rT6EmpyIYHro7TAJuIIlHo=
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
 github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 h1:ge14PCmCvPjpMQMIAH7uKg0lrtNSOdpYsRXlwk3QbaE=
@@ -389,8 +380,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw=
-github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY=
+github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
@@ -414,9 +405,9 @@ github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+m
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
-github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.15.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
 github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -458,8 +449,8 @@ github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
 github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
@@ -475,7 +466,6 @@ github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+r
 github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/georgysavva/scany/v2 v2.1.4 h1:nrzHEJ4oQVRoiKmocRqA1IyGOmM/GQOEsg9UjMR5Ip4=
 github.com/georgysavva/scany/v2 v2.1.4/go.mod h1:fqp9yHZzM/PFVa3/rYEC57VmDx+KDch0LoqrJzkvtos=
-github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg=
 github.com/getsentry/sentry-go v0.34.0 h1:1FCHBVp8TfSc8L10zqSwXUZNiOSF+10qw4czjarTiY4=
 github.com/getsentry/sentry-go v0.34.0/go.mod h1:C55omcY9ChRQIUcVcGcs+Zdy4ZpQGvNJ7JYHIoSWOtE=
 github.com/ghemawat/stream v0.0.0-20171120220530-696b145b53b9 h1:r5GgOLGbza2wVHRzK7aAj6lWZjfbAwiu/RDCVOKjRyM=
@@ -491,8 +481,8 @@ github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01
 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
-github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
+github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
@@ -508,87 +498,96 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
+github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
+github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/analysis v0.25.2 h1:I0vy4n3alz+DHTiN1PRhCb7QZxkK6g5YmswZKv2TKuw=
-github.com/go-openapi/analysis v0.25.2/go.mod h1:Uhs1t/2XR10EnwONYILGEzw8gcfGIG5Xk5K2AxnhqDo=
-github.com/go-openapi/errors v0.22.8 h1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRejk/I=
-github.com/go-openapi/errors v0.22.8/go.mod h1:BuUoHcYrU6E7V9gfj1I5wLQqgtIHnup/alXZ8KdgQ0w=
+github.com/go-openapi/analysis v1.0.0 h1:sNvbAGCJqUTqIAodr9IVqJMmuZas3YS9ms1dGK9yiJ4=
+github.com/go-openapi/analysis v1.0.0/go.mod h1:NhYjJ57fnE+bcE7UwrJyMkhWA3Dfz7TdiBfTVAnos4Y=
+github.com/go-openapi/errors v0.22.9 h1:HI9+SyVYiRzyeBQGv0CbWbQa+u2S0nny7G7AhY+UMiM=
+github.com/go-openapi/errors v0.22.9/go.mod h1:R73q66sXP2smzAGgFOI4nqtusRK2xN5pYCjsij+KX58=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
-github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
-github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonpointer v1.0.1 h1:2KxywRmNwJkT/FMBa3iRNHEaAxSJvjqoufQZy3au1Mg=
+github.com/go-openapi/jsonpointer v1.0.1/go.mod h1:wI7ZYsFmbIi9nBXOZqgDaS/bqOchRGZjqxFli7FBYxY=
 github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg=
 github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
-github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y=
-github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY=
-github.com/go-openapi/loads v0.24.0 h1:4LLorXRPTzIN9V6ngMUZbAscsBOUBk3Oa8cClu/bFrQ=
-github.com/go-openapi/loads v0.24.0/go.mod h1:xQMgX+hw5xRAhGrcDXxeMw78IFqUpIzhleu3HqPhyF4=
-github.com/go-openapi/runtime v0.32.4 h1:8ElGj/3goG0itt0nBPP6Cm57ehcYyuHoI3O20nxgvkw=
-github.com/go-openapi/runtime v0.32.4/go.mod h1:Bz6keOZw1NX4T6f+m42OoT1MBPDt6Re13dbccHyGH/4=
-github.com/go-openapi/runtime/server-middleware v0.30.0 h1:8rPoJ/xv7JL8BsovaqboKETlpWBArVh8n+0L/GyePog=
-github.com/go-openapi/runtime/server-middleware v0.30.0/go.mod h1:OYNT/TxNvB/VK5oe4htM2jDTwlEXuejVJmu0DVZfAMs=
-github.com/go-openapi/spec v0.22.6 h1:Tyy1pLaNCM8GBCFLoGYLonjJi6zykqyLCjXLc19ZPic=
-github.com/go-openapi/spec v0.22.6/go.mod h1:HZvTHat+iH0PALQRWhrqIHtU/PEqxqd89fu0MxGlMeM=
-github.com/go-openapi/strfmt v0.26.4 h1:yI6IAEfcWow459BD5UzFY430KUwXZwBHrYusPFkhWlc=
-github.com/go-openapi/strfmt v0.26.4/go.mod h1:hNJi6nb5ETD6i7A1yRo03M9S6ZoTPPoWff1iUexmfUc=
+github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/jsonreference v1.0.1 h1:4zJ7AmYDKNmD3aSpfPnFNCFA5E80/xMHUNKgydaLh38=
+github.com/go-openapi/jsonreference v1.0.1/go.mod h1:dYplQXa6p5lXprLcJ8LE2iU7vNpXsAHDQ5ZAgL+Qx3A=
+github.com/go-openapi/loads v0.25.2 h1:+uNsDlRQfYtZTrh+3pdwampcAqZVPuBJW0IA82aZHII=
+github.com/go-openapi/loads v0.25.2/go.mod h1:RXsfJEQGGNv4uw8u/KdmF8Vh8OR4fTfs9ZO4QrzNohA=
+github.com/go-openapi/runtime v0.33.2 h1:HSxskMs0WmpCdQvBWVxHt2t2mXMwn8DDav3VtVidwig=
+github.com/go-openapi/runtime v0.33.2/go.mod h1:NQpSLiIsEAIpZDEs6xUrhjm6ZiQh85X8bHKlqLPgNP8=
+github.com/go-openapi/runtime/server-middleware v0.33.2 h1:BVFjAaW4Jh/kZ4QSsgDrGzLuSuaKzSiyvappUFKxgUk=
+github.com/go-openapi/runtime/server-middleware v0.33.2/go.mod h1:E3mWY61/UgBJ5EUmKh+h6A1oQQdD1U4raowVMmPmQug=
+github.com/go-openapi/spec v1.0.0 h1:JtB/GHOj+eetjse6YvxqLze88oEekl/4uPBethvzRrA=
+github.com/go-openapi/spec v1.0.0/go.mod h1:boj1PRhqS0x5jylgcNp9BRWxenphrh7vVNYZ90IRCoo=
+github.com/go-openapi/strfmt v0.27.2 h1:SG32SlbwNy92s0KJiVxt2joJeFdqIYHvwrA0OU6HqzQ=
+github.com/go-openapi/strfmt v0.27.2/go.mod h1:M4CKsMO0Fb8qR10+1Ra75wCKNNquy+Vj+4LWZrhTo2E=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
 github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.26.1 h1:l5sVEyVpwj+DDYeZyo7wQI/Ebn/mKYIyGB/pFwAfGoQ=
-github.com/go-openapi/swag v0.26.1/go.mod h1:yNY38BbIVthxbkDtq1UHBCGasBqjakW3lCR6ANzdBEw=
-github.com/go-openapi/swag/cmdutils v0.26.1 h1:f2iE1ijYaJ3nuu5PaEMx3zpEhzhZFgivCJObWEObLIQ=
-github.com/go-openapi/swag/cmdutils v0.26.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
-github.com/go-openapi/swag/conv v0.27.0 h1:EKOH4feXrvdo8DbSsXSAqRT8fz1epEnS5O2IfXUOzE8=
-github.com/go-openapi/swag/conv v0.27.0/go.mod h1:pfiv0uKQTbaGApk8Zs/lZV3uSjmSpa2FO1y183YngN8=
-github.com/go-openapi/swag/fileutils v0.26.1 h1:K1XCM2CGhfNsc6YDt6v7Q5+1e59rftYWdcu/isZhvFw=
-github.com/go-openapi/swag/fileutils v0.26.1/go.mod h1:mYUgxQAKX4ShS3qvvySx+/9yrlUnDhjiD1CalaQl8lQ=
-github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
-github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc=
-github.com/go-openapi/swag/jsonutils v0.26.1 h1:2hdBfFkHg+7Wrz2VsCbeyR6hzkRDs7AztnMR2u84yOY=
-github.com/go-openapi/swag/jsonutils v0.26.1/go.mod h1:U+RMJH3wa+6BRiphuRtIyI8fW9HPFqFQ4sHk2oRx0UQ=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1 h1:1CD7NiLLb/TXl3tOnFYU4b+mNfb5rtgHkaA+q7RMYYQ=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1/go.mod h1:ZWafc8nMdYzTE3uYY6W86f0n46+IF0g4uUyRhJw/kXc=
-github.com/go-openapi/swag/loading v0.26.1 h1:E9K4wqXeROlhjFQ13K9zMz6ojFGXIggGe+ad1odrK9w=
-github.com/go-openapi/swag/loading v0.26.1/go.mod h1:3qvRIlWzWdq1HvmldwmuJ2ohpcAryN6xVt2OTKd0/7E=
-github.com/go-openapi/swag/mangling v0.26.1 h1:gpYI4WuPKFJJVjV5cDLGlDVJhFIxYjQc7yN5eEb4CqM=
-github.com/go-openapi/swag/mangling v0.26.1/go.mod h1:POETDH01hqAdASXfw7ISEd9bCOE6xBHOt8NHmGZRmYM=
-github.com/go-openapi/swag/netutils v0.26.1 h1:BNctoc39WTAUMxyAs355fExOPzMZtPbZ0ZZ1Am2FR5M=
-github.com/go-openapi/swag/netutils v0.26.1/go.mod h1:y02vByhZhQPAVwOX+0KipXFZ/hUbk6G/Enhf5rGaOkQ=
-github.com/go-openapi/swag/stringutils v0.26.1 h1:f88uYyTso7TnHrKM/bUBsQ5e2wKf37cpgo6pvbzd9yU=
-github.com/go-openapi/swag/stringutils v0.26.1/go.mod h1:Sc6d3bU8fgk5AyZR8/8jEQ+Is/Ald+TD/IIggPN8UJk=
-github.com/go-openapi/swag/typeutils v0.27.0 h1:aCf4MSGo8NLwZP8Q6t32DWLJSvl/WwNqgmEG+xJ6v2o=
-github.com/go-openapi/swag/typeutils v0.27.0/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
-github.com/go-openapi/swag/yamlutils v0.26.1 h1:0TSLK+lXs9vfIhAWzBeI/lOzEnIoot6WTCO1aAeWFTk=
-github.com/go-openapi/swag/yamlutils v0.26.1/go.mod h1:7W5b7PRX9MxwL7TjeG7H8HkyBGRsIDRObhyMWFgBI2M=
-github.com/go-openapi/testify/enable/yaml/v2 v2.5.1 h1:q9NtHwK4qHF7yZziBPvZyv7zWAIk8ok88Gh2mR6Jpc8=
-github.com/go-openapi/testify/enable/yaml/v2 v2.5.1/go.mod h1:JW0MXIotCYps/XsgJnG3a8Q7rE5xAiBwoOD5OfaIQBk=
-github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
-github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
-github.com/go-openapi/validate v0.26.0 h1:dxWzQ3F+vb1SajqUxHjwb5T4mTpSHmdrtv5Bi7+ZNhw=
-github.com/go-openapi/validate v0.26.0/go.mod h1:b4o00uq7fJeJA+wWhVFCJpKTctzeFwzZImGGmHsl2JA=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
+github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo=
+github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro=
+github.com/go-openapi/swag/cmdutils v0.29.2/go.mod h1:XziaSVzYqkDvpWXzASfWajw2YvJrLscq610O2XiyqJw=
+github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0=
+github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q=
+github.com/go-openapi/swag/fileutils v0.29.2 h1:mdUL+Vw5ah1fO1AvFCoHeIyv7YZsCz2MN3KNqd/lLVI=
+github.com/go-openapi/swag/fileutils v0.29.2/go.mod h1:7QKmmodjAebaq61lGVJa8ldLdGeMF4DSgYv8tXOGGo0=
+github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k=
+github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2/go.mod h1:HC2egPORFzbj/gf05Zrfgz8Mgplx3oW7hgGi7pjZVhM=
+github.com/go-openapi/swag/loading v0.29.2 h1:QU1ry24e6r6Shoxe380Nx0X5iKkpRO+hJffsyJ2dVlY=
+github.com/go-openapi/swag/loading v0.29.2/go.mod h1:DqilDjuiJKETecsS4TRopWG1acUDsfqN39ZmQhPu6uI=
+github.com/go-openapi/swag/mangling v0.29.2 h1:ltdo3K0tTP4P6zWhVVWDU9D37/YYBuMJRdZxiS2Dtog=
+github.com/go-openapi/swag/mangling v0.29.2/go.mod h1:RjDi4TnItAenS3cgCXSpIl1kKbjG7il6pnmQVl/8bp8=
+github.com/go-openapi/swag/netutils v0.29.2 h1:dBli6jyUa93sDS/XYWShJzf4+nnVfFKfvY9SLUaUzB8=
+github.com/go-openapi/swag/netutils v0.29.2/go.mod h1:1pM6Xg/Um8E1eps3umWl8Hme3ByWXOtHsvFC0CULHUE=
+github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c=
+github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc=
+github.com/go-openapi/swag/stringutils v0.29.2 h1:lcnBxwAaysT3bMUVBfn9V/PkfVqkurpqufKU6rTUMGk=
+github.com/go-openapi/swag/stringutils v0.29.2/go.mod h1:i9cdh7sGaa0nm3CqIvH5IM5h2QClk1wns2ktKeILvRI=
+github.com/go-openapi/swag/typeutils v0.29.2 h1:O7aVvkTs3pXwikgtrPLenigEMdQFgONKRooQA9pgf2I=
+github.com/go-openapi/swag/typeutils v0.29.2/go.mod h1:7+GDG+uz9Ke+eVt4rClZg7wklSDp8hT/mKNh/pC26TE=
+github.com/go-openapi/swag/yamlutils v0.29.2 h1:IFKFFeDnuIwzfsuWRQU+rI8iL3g4XyAYjV/RlnlxPLM=
+github.com/go-openapi/swag/yamlutils v0.29.2/go.mod h1:7MGqtcrK73sxQ4ceiyIf8qiXS/s09JLMdR5esK5euYQ=
+github.com/go-openapi/testify/enable/yaml/v2 v2.7.0 h1:wPW6YRgx3+SID1yUy/Xwa17L8kFEaEKod2VRbJDZNUs=
+github.com/go-openapi/testify/enable/yaml/v2 v2.7.0/go.mod h1:mI1M88etYbc3PhgHsWQK2kwvNwW5aGFqMPbmib+SGIs=
+github.com/go-openapi/testify/v2 v2.8.0 h1:19QDx5b57p8KjO2E4sgs/woL4Akp+FGLRlVm2xn0Rho=
+github.com/go-openapi/testify/v2 v2.8.0/go.mod h1:4gUN8jC+RqOE2qjW/vDmfyTvl5BCht4qL7oca0odrak=
+github.com/go-openapi/validate v1.0.0 h1:dFsYCLVUQUL6Vi2lQSexgwmCXDuHe7eWRDhQxkE+xYA=
+github.com/go-openapi/validate v1.0.0/go.mod h1:wwXGRqMQzOZ7PCqBcgNk+DD9+Cacnxv7we5T0M/eA3Y=
 github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA=
 github.com/go-rod/rod v0.116.2/go.mod h1:H+CMO9SCNc2TJ2WfrG+pKhITz57uGNYU43qYHh438Mg=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
+github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -600,13 +599,13 @@ github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPE
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
 github.com/gobuffalo/flect v1.0.3/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
-github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
-github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gobwas/glob v1.0.0 h1:p+FKbLEIsK1yZ39/OINwFvqNb5oyPY4H8xcy6uYu8dg=
+github.com/gobwas/glob v1.0.0/go.mod h1:oWCdo522i2P1n/hMXGNWs7yoV4wy/ciZuUIbvKj5rkc=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
-github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+github.com/godbus/dbus/v5 v5.2.3 h1:IQNSXULh6Nc4ZH8ETJ5Mdsj8loUFCWSBnsjmJkyjUB8=
+github.com/godbus/dbus/v5 v5.2.3/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
 github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -662,10 +661,11 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.29.0 h1:fEG+Ja3YRwNOqnQxTyJwoByAUAvTuxUGiro/jhrm4F4=
-github.com/google/cel-go v0.29.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
+github.com/google/cel-go v0.31.0 h1:H0bhpFTqOvmHrBGrWKp7ZlhBm5Hh8PYUEXnwxT1LL7A=
+github.com/google/cel-go v0.31.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/certificate-transparency-go v1.3.3 h1:hq/rSxztSkXN2tx/3jQqF6Xc0O565UQPdHrOWvZwybo=
 github.com/google/certificate-transparency-go v1.3.3/go.mod h1:iR17ZgSaXRzSa5qvjFl8TnVD5h8ky2JMVio+dzoKMgA=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -685,11 +685,11 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs=
-github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo=
+github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84=
+github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0=
 github.com/google/go-github/v32 v32.1.0/go.mod h1:rIEpZD9CTDQwDK9GDrtMTycQNA4JU3qBsCizh3q2WCI=
-github.com/google/go-github/v60 v60.0.0 h1:oLG98PsLauFvvu4D/YPxq374jhSxFYdzQGNCyONLfn8=
-github.com/google/go-github/v60 v60.0.0/go.mod h1:ByhX2dP9XT9o/ll2yXAu2VD8l5eNVg8hD4Cr0S/LmQk=
+github.com/google/go-github/v91 v91.0.0 h1:fpulREh37uBvOj4kF0vLuzjwJ1HHmFcAfquNjJfmpYs=
+github.com/google/go-github/v91 v91.0.0/go.mod h1:rHtn7haKvmkTLhUK/aCQypiIj/suWSB3rnS+a1FdH6M=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
@@ -719,32 +719,30 @@ github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/s2a-go v0.1.11 h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=
+github.com/google/s2a-go v0.1.11/go.mod h1:pz4tyvwXvJLLbyrkh6FW1eS2zPUXMaTmyNhYtyP2tNw=
 github.com/google/trillian v1.7.3 h1:hziW+vo4czis48tzx2GK5xRBl/ZxBA9B0/UR5avXOro=
 github.com/google/trillian v1.7.3/go.mod h1:qh8iy4x/GvnVXUBd5pK4oncuT1Y9vVYfibQVsR/WpKg=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.19 h1:mMOE7DN2+p76/EdIrmAy9B9bH+yC4563vmnJ34QR8i4=
-github.com/googleapis/enterprise-certificate-proxy v0.3.19/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
+github.com/googleapis/enterprise-certificate-proxy v0.3.22 h1:NU4XpII6jD+Dxcot94fqjE+AfJoE/lQP9q3faYGzC/c=
+github.com/googleapis/enterprise-certificate-proxy v0.3.22/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=
-github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=
-github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
+github.com/googleapis/gax-go/v2 v2.26.2 h1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=
+github.com/googleapis/gax-go/v2 v2.26.2/go.mod h1:sMKqnMesnKH+3wiRJROcttA+cJoZoGbZl1vDQ8XYtGk=
 github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA=
 github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
 github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/schema v1.4.1 h1:jUg5hUjCSDZpNGLuXQOgIWGdlgrIdYvgQ0wZtdK1M3E=
@@ -754,21 +752,19 @@ github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5T
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
 github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
-github.com/grafana/pyroscope-go v1.4.2 h1:0LW5HrUJXgGr9zF5gITP/HaFXN9/LsMiwlgVJAK75l0=
-github.com/grafana/pyroscope-go v1.4.2/go.mod h1:Ej13Jr05rRJrjWvrrFhfh6gGYXtfibuukOs3Tl3Y7QQ=
+github.com/grafana/pyroscope-go v1.4.3 h1:XAfYZe5ie8eRTsKAMHQG60ESJjHBV5XUijk8vDvqalw=
+github.com/grafana/pyroscope-go v1.4.3/go.mod h1:enNhwzbML7+hMzJHTvKAIqTGqIaOOF1rgF+2au+NOwg=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.11 h1:el5LYpXissAiCKZ5/6yjlr6mhYVV6Cp5lahTocxraXM=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.11/go.mod h1:jl1V8M4cWsXciROCPIDDG7CtjSjT/ECbp6eLVuMxYRI=
-github.com/graph-gophers/graphql-go v1.10.3-0.20260702060009-60399cce0c05 h1:nz9OX9q1iUJZwrPA2Ge8xNlB3inmq+pafyf6qmBLBew=
-github.com/graph-gophers/graphql-go v1.10.3-0.20260702060009-60399cce0c05/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
-github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
-github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
-github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 h1:B+8ClL/kCQkRiU82d9xajRPKYMrB7E0MbtzWVi1K4ns=
-github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3/go.mod h1:NbCUVmiS4foBGBHOYlCT25+YmGpJ32dZPi75pGEUpj4=
+github.com/graph-gophers/graphql-go v1.10.3 h1:H6bqOfbuyolAQsbLapHnkIFdJ59vrXuAvDmc4uFvjbY=
+github.com/graph-gophers/graphql-go v1.10.3/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.4 h1:9ZJYjPEJpcleIKcqysXOo14NLQYwu23fzmKRFpIjPjc=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.4/go.mod h1:0xydIeg2omQ9DH6zYMP24Kk57793rnLUvP8fwdbFvz8=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99 h1:JYghRBlGCZyCF2wNUJ8W0cwaQdtpcssJ4CgC406g+WU=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99/go.mod h1:3bDW6wMZJB7tiONtC/1Xpicra6Wp5GgbTbQWCbI5fkc=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0 h1:Bd7KaOxzULLxtZ/K5s1aLbWhR0+5RToO65TXHsf3bqQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0/go.mod h1:nN7ts3dFXKtCZWc//yfkpcQNKJABg16/uDVAZpLDalo=
 github.com/hashicorp/consul/api v1.11.0/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
 github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -824,8 +820,8 @@ github.com/hashicorp/memberlist v0.2.2/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOn
 github.com/hashicorp/memberlist v0.3.0/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
 github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
 github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
-github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
-github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/hashicorp/vault/api v1.23.0 h1:gXgluBsSECfRWTSW9niY2jwg2e9mMJc4WoHNv4g3h6A=
+github.com/hashicorp/vault/api v1.23.0/go.mod h1:zransKiB9ftp+kgY8ydjnvCU7Wk8i9L0DYWpXeMj9ko=
 github.com/heimdalr/dag v1.5.1 h1:Oug6YdjFpQN1Itrc/deoIDqtWUk4FO96ulod23/TOr8=
 github.com/heimdalr/dag v1.5.1/go.mod h1:lthekrHl01dddmzqyBQ1YZbi7XcVGGzjFo0jIky5knc=
 github.com/helm/helm-mapkubeapis v0.6.1 h1:GDEEe8ol1MiSs4a9TD8LzBb+ftkC+V7M67gkxx7UmAE=
@@ -853,16 +849,16 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
-github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/pgx/v5 v5.11.0 h1:IzBBtyK9AHqf98cctWFifYSci2hgQR/cd56wB4p+ogg=
+github.com/jackc/pgx/v5 v5.11.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 h1:TMtDYDHKYY15rFihtRfck/bfFqNfvcabqvXAFQfAUpY=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267/go.mod h1:h1nSAbGFqGVzn6Jyl1R/iCcBUHN4g+gW1u9CoBTrb9E=
-github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY=
-github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4=
+github.com/jellydator/ttlcache/v3 v3.4.1 h1:bOdXmXiycyK6E6Qjyuj5vl+/vU3SCOoDs8a86NbHjAQ=
+github.com/jellydator/ttlcache/v3 v3.4.1/go.mod h1:j7LO12PNghFg5+0v9budMAT4rDK4JY969jb9vOdOBBk=
 github.com/jeremywohl/flatten v1.0.1 h1:LrsxmB3hfwJuE+ptGOijix1PIfOoKLJ3Uee/mzbgtrs=
 github.com/jeremywohl/flatten v1.0.1/go.mod h1:4AmD/VxjWcI5SRB0n6szE2A6s2fsNHDLO0nAlMHgfLQ=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -895,8 +891,8 @@ github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46 h1:veS9QfglfvqAw
 github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
-github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
+github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
@@ -914,6 +910,7 @@ github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -963,8 +960,8 @@ github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcME
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
 github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-sqlite3 v1.10.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
@@ -1009,8 +1006,8 @@ github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCnd
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -1027,7 +1024,6 @@ github.com/mreiferson/go-httpclient v0.0.0-20160630210159-31f0106b4474/go.mod h1
 github.com/mreiferson/go-httpclient v0.0.0-20201222173833-5e475fde3a4d/go.mod h1:OQA4XLvDbMgS8P0CevmM4m9Q3Jq4phKUzcocxuGJ5m8=
 github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
-github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -1048,17 +1044,16 @@ github.com/np-guard/netpol-analyzer v1.4.4/go.mod h1:T31vBeTIBl1ksQr9NTW5GJBMHpm
 github.com/nwaples/rardecode v1.1.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
 github.com/nwaples/rardecode v1.1.3 h1:cWCaZwfM5H7nAD6PyEdcVnczzV8i/JtotnyW/dD9lEc=
 github.com/nwaples/rardecode v1.1.3/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
-github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=
-github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/oklog/ulid/v2 v2.1.2 h1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec=
+github.com/oklog/ulid/v2 v2.1.2/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
 github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=
 github.com/olekukonko/errors v1.2.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
 github.com/olekukonko/ll v0.1.6 h1:lGVTHO+Qc4Qm+fce/2h2m5y9LvqaW+DCN7xW9hsU3uA=
 github.com/olekukonko/ll v0.1.6/go.mod h1:NVUmjBb/aCtUpjKk75BhWrOlARz3dqsM+OtszpY4o88=
-github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
-github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
-github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/olekukonko/tablewriter v1.1.5 h1:4LoZSfMySpMQY3PT8RWJsJeuEuMIoo9xGRgvmqjg6IQ=
+github.com/olekukonko/tablewriter v1.1.5/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
@@ -1067,16 +1062,15 @@ github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
 github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
 github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
-github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/ginkgo/v2 v2.33.1 h1:62XfWJbEIjPSCSDYrsCPP/SHcmH7O0M8ne8zfqQ2iz4=
+github.com/onsi/ginkgo/v2 v2.33.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
 github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
 github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
@@ -1084,12 +1078,12 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/openshift-online/ocm-api-model/clientapi v0.0.464 h1:MrAdeU7E0ElWu4Ztv7hMRqlzY6cdcQeqWiNaO00n2n4=
-github.com/openshift-online/ocm-api-model/clientapi v0.0.464/go.mod h1:fZwy5HY2URG9nrExvQeXrDU/08TGqZ16f8oymVEN5lo=
-github.com/openshift-online/ocm-api-model/model v0.0.464 h1:aZCIx0+EPZxVSbct4QQ9cSCaI1deoeAhfgwx5CfNl54=
-github.com/openshift-online/ocm-api-model/model v0.0.464/go.mod h1:PQIoq6P8Vlb7goOdRMLK8nJY+B7HH0RTqYAa4kyidTE=
-github.com/openshift-online/ocm-sdk-go v0.1.509 h1:JcmyaaJQslBqe4vIFugV0rQElGLojJSP/lO11moI/Ho=
-github.com/openshift-online/ocm-sdk-go v0.1.509/go.mod h1:h1owsjOKlqLFRgzos5WWa0K0lSr8xRU6P1lF9EG94do=
+github.com/openshift-online/ocm-api-model/clientapi v0.0.470 h1:9oXPeJPc6/L3OaulJySDXzkTEJs+YEndI+HIZvQRLO4=
+github.com/openshift-online/ocm-api-model/clientapi v0.0.470/go.mod h1:fZwy5HY2URG9nrExvQeXrDU/08TGqZ16f8oymVEN5lo=
+github.com/openshift-online/ocm-api-model/model v0.0.470 h1:gnubZARa3aSclaWpVdd4aisOVYN4G2V255SRpyExOf8=
+github.com/openshift-online/ocm-api-model/model v0.0.470/go.mod h1:PQIoq6P8Vlb7goOdRMLK8nJY+B7HH0RTqYAa4kyidTE=
+github.com/openshift-online/ocm-sdk-go v0.1.517 h1:79KiFTqWHds1FanFByIEqo/485VqXB7LHQiN8XOTdJw=
+github.com/openshift-online/ocm-sdk-go v0.1.517/go.mod h1:3rNVzZ86jRbpFtdQUqbdlxmpR+MhKs87szY45bLg3EI=
 github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb h1:iwBR3mzmyE3EMFx7R3CQ9lOccTS0dNht8TW82aGITg0=
 github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
 github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1 h1:Hr/R38eg5ZJXfbiaHumjJIN1buDZwhsm4ys4npVCXH0=
@@ -1104,11 +1098,10 @@ github.com/openshift/runtime-utils v0.0.0-20230921210328-7bdb5b9c177b h1:oXzC1N6
 github.com/openshift/runtime-utils v0.0.0-20230921210328-7bdb5b9c177b/go.mod h1:l9/qeKZuAmYUMl0yicJlbkPGDsIycGhwxOvOAWyaP0E=
 github.com/operator-framework/operator-lib v0.17.0 h1:cbz51wZ9+GpWR1ZYP4CSKSSBxDlWxmmnseaHVZZjZt4=
 github.com/operator-framework/operator-lib v0.17.0/go.mod h1:TGopBxIE8L6E/Cojzo26R3NFp1eNlqhQNmzqhOblaLw=
-github.com/owenrumney/go-sarif v1.1.1/go.mod h1:dNDiPlF04ESR/6fHlPyq7gHKmrM0sHUvAGjsoh8ZH0U=
-github.com/owenrumney/go-sarif/v2 v2.3.3 h1:ubWDJcF5i3L/EIOER+ZyQ03IfplbSU1BLOE26uKQIIU=
-github.com/owenrumney/go-sarif/v2 v2.3.3/go.mod h1:MSqMMx9WqlBSY7pXoOZWgEsVB4FDNfhcaXDA1j6Sr+w=
-github.com/package-url/packageurl-go v0.1.6 h1:YO3p6u1XmCUliivUg/qWphaY8vI6hxSnnPv7Bfg3m5M=
-github.com/package-url/packageurl-go v0.1.6/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
+github.com/owenrumney/go-sarif/v3 v3.3.1 h1:bKY8YnWcY8zYTiGVObC5wZLlfEvMkCxK9XMGXBbzEtQ=
+github.com/owenrumney/go-sarif/v3 v3.3.1/go.mod h1:72MaugkExDexbSauRuPq6BvUAAqAX0TwoNYMIQyZCMw=
+github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY=
+github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
@@ -1119,8 +1112,6 @@ github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
-github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
 github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
 github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
@@ -1149,20 +1140,20 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP
 github.com/prometheus/client_golang v0.9.2/go.mod h1:OsXs2jCmiKlQ1lTBmv21f2mNfw4xf/QclQDMrYNZzcM=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
-github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
-github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_golang v1.25.0 h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=
+github.com/prometheus/client_golang v1.25.0/go.mod h1:j2X/4/kaQHLPnmyEU8zjmkndo1T317VpCIQEml8LTKk=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/common v0.72.1 h1:ZAiQed/nk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=
+github.com/prometheus/common v0.72.1/go.mod h1:1IoBY4IRaJnhs2ESjNzjilP1cJ/P8pimGoomq7zRXrA=
 github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -1170,13 +1161,13 @@ github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
-github.com/quay/claircore v1.5.54 h1:NC7+QfwV8yo/KJ/B8mz1GD8BIG16aIJ3FuHcBTnsjL4=
-github.com/quay/claircore v1.5.54/go.mod h1:hOp0JqY8vOZPdBakFRt3JwG8q4K+gnRkG9RGzt1DoB4=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
+github.com/quay/claircore v1.6.1-0.20260916195820-3902930ff815 h1:jCU2qfY0HKDxhgnsn5tuZ3qaAE/C3r2neX+TYhcJwEo=
+github.com/quay/claircore v1.6.1-0.20260916195820-3902930ff815/go.mod h1:fdao6wPVC6bYZk3DOuUQDGjxhYVL9codeSnmx/nqlo0=
 github.com/quay/claircore/toolkit v1.0.0/go.mod h1:3ELtgf92x7o1JCTSKVOAqhcnCTXc4s5qiGaEDx62i20=
-github.com/quay/claircore/toolkit v1.6.1 h1:a3X1v28n5bo05T94cBlaoPU8xYCErRGPM3l6AlmYWj4=
-github.com/quay/claircore/toolkit v1.6.1/go.mod h1:dTzlp1pgNchc+CN73HJiG9+e0ygU54QPt397eXnGGo4=
+github.com/quay/claircore/toolkit v1.7.0 h1:flobJ7hTofiArNSBs1SKq8vDZ9h57dW02RxLyYn+bMw=
+github.com/quay/claircore/toolkit v1.7.0/go.mod h1:1AzB56krwmcpGUak0hAOVbSrtzGywDQu5OTooDlKcb0=
 github.com/quay/claircore/updater/driver v1.0.0 h1:w7dAUjO3GBK6RjNyTZ2Kwz0l/Wuic3ykKJWPB80uA94=
 github.com/quay/claircore/updater/driver v1.0.0/go.mod h1:My5aY1wBpgxcWaHQZ0VoPmmj/EzuH7fq4ntzJbos4OI=
 github.com/quay/goval-parser v0.8.8 h1:Uf+f9iF2GIR5GPUY2pGoa9il2+4cdES44ZlM0mWm4cA=
@@ -1187,8 +1178,8 @@ github.com/redis/go-redis/extra/rediscmd/v9 v9.5.3 h1:1/BDligzCa40GTllkDnY3Y5DTH
 github.com/redis/go-redis/extra/rediscmd/v9 v9.5.3/go.mod h1:3dZmcLn3Qw6FLlWASn1g4y+YO9ycEFUOM+bhBmzLVKQ=
 github.com/redis/go-redis/extra/redisotel/v9 v9.5.3 h1:kuvuJL/+MZIEdvtb/kTBRiRgYaOmx1l+lYJyVdrRUOs=
 github.com/redis/go-redis/extra/redisotel/v9 v9.5.3/go.mod h1:7f/FMrf5RRRVHXgfk7CzSVzXHiWeuOQUu2bsVqWoa+g=
-github.com/redis/go-redis/v9 v9.20.1 h1:sfCU6A8P3dXbKyWes02uxA2baehGux9dZHfEKtsTB1w=
-github.com/redis/go-redis/v9 v9.20.1/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
+github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
 github.com/remind101/migrate v0.0.0-20170729031349-52c1edff7319 h1:ukjThsA2ou7AmovpwtMVkNQSuoN/v5U16+JomTz3c7o=
 github.com/remind101/migrate v0.0.0-20170729031349-52c1edff7319/go.mod h1:rhSvwcijY9wfmrBYrfCvapX8/xOTV46NAUjBRgUyJqc=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -1196,6 +1187,7 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qq
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
 github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/rubenv/sql-migrate v1.8.1 h1:EPNwCvjAowHI3TnZ+4fQu3a915OpnQoPAjTXCGOy2U0=
@@ -1212,19 +1204,15 @@ github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIH
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
-github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
-github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
-github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
-github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sassoftware/relic/v8 v8.2.0 h1:9/L4S4I6an/JsPNhmcTpqfiOIsLb/iJaePZD1xR+ulE=
+github.com/sassoftware/relic/v8 v8.2.0/go.mod h1:pZy7hLT9WCOKPonV8G/fplvtBLOZd6/kWtKqeHR6nKc=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGvPLoKZLv9YvwPYVr0473BdtFs=
 github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q=
-github.com/segmentio/analytics-go/v3 v3.3.0 h1:8VOMaVGBW03pdBrj1CMFfY9o/rnjJC+1wyQHlVxjw5o=
-github.com/segmentio/analytics-go/v3 v3.3.0/go.mod h1:p8owAF8X+5o27jmvUognuXxdtqvSGtD0ZrfY2kcS9bE=
-github.com/segmentio/backo-go v1.0.1 h1:68RQccglxZeyURy93ASB/2kc9QudzgIDexJ927N++y4=
-github.com/segmentio/backo-go v1.0.1/go.mod h1:9/Rh6yILuLysoQnZ2oNooD2g7aBnvM7r/fNVxRNWfBc=
+github.com/segmentio/analytics-go/v3 v3.4.0 h1:8ACTF5ggK3W70b+kHId5SyxyWGYZ1sdgd/e8tb8jMRM=
+github.com/segmentio/analytics-go/v3 v3.4.0/go.mod h1:l0qTADX69i/7AuXvN3tg0QMfcW4Oe6YN5VgsgqGaAPI=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
@@ -1236,24 +1224,24 @@ github.com/sigstore/cosign/v3 v3.1.3 h1:001JQRI/PJ/5T+g/kJ1KTvKFbb322+fomc+pHDZ/
 github.com/sigstore/cosign/v3 v3.1.3/go.mod h1:DmjtYkWDMdbG26X+QSOPB6QQGkLjRjQCIxxNs6wV6bA=
 github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah1/+7Px7U=
 github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats=
-github.com/sigstore/rekor v1.5.3 h1:0Tyolw3zreRgm7PUW8dccFLXGBThi08278jI8EXNSr4=
-github.com/sigstore/rekor v1.5.3/go.mod h1:h3GK5dDqCcWJJZUJwdpKGSSmEV2GEjPUjJy3WTjBwzA=
+github.com/sigstore/rekor v1.5.4 h1:A9zITTrkRwO+8lfq7L/gBR7rDHHcBQJRI+a0JQo4xDM=
+github.com/sigstore/rekor v1.5.4/go.mod h1:0bcUHhZPlG+RVW1dI/7sdBp0MiVWVzk9h0tgOH/o0Yc=
 github.com/sigstore/rekor-tiles/v2 v2.3.0 h1:HhMgH61UP0t899V8Fjt7pz1YdgOBptbaQdnCF+79cdc=
 github.com/sigstore/rekor-tiles/v2 v2.3.0/go.mod h1:DEFiKSyQ4nF75QRVNdOPaIH3cmvMkO2B6xDZjNYngPc=
 github.com/sigstore/sigstore v1.10.9 h1:7Dcpt+ibnltHQZ8XhaU0dFmhHaf/T491eJfA9WDex4Y=
 github.com/sigstore/sigstore v1.10.9/go.mod h1:LYW9+qH7bK8wZmLm6lPxIC5lkHtkJDCgkqjChzTAIBs=
-github.com/sigstore/sigstore-go v1.2.2 h1:xAJ8hxaoecC0HKBYVbrwUjkeAI+GJYu6vLqbxDlD2Q0=
-github.com/sigstore/sigstore-go v1.2.2/go.mod h1:MIFwBxAHJD+/lKgZzt9n/4Zhq/3T2+EuGX8iGrIsZgU=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.8 h1:tofVQ+UWJgad/69I5zbqxdFCN5gpIn9tRQP7iBzIpBw=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.8/go.mod h1:73AfJE8H6w5KGCFPBu4x/OG+i1Yxgmh0L/FtV7prd88=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.8 h1:8Mt7J36GcUEmbiJaiFhz2tud5ZIgkfVVCe2H/WJCHmw=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.8/go.mod h1:YiTpAsxoWXhF9KlLOVWCh7BckN5cYO8X01WufDq1ido=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.8 h1:MxpAIMZVzn0Tpbarc9ax1I498oQBp7oYSMgoMSsOmKI=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.8/go.mod h1:bnAUEkFNam6STvkVZhptVwWzWR5pS24CEtQ+lhxu7S0=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.8 h1:1DGe4/clcdOnkz5MINEczWlmEvjUtZd+AjPPT/cBhQ8=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.8/go.mod h1:6IDFhpgxtzqbnzrFkyegbj7RfWwKeRrb3/+xAD1Wp+Y=
-github.com/sigstore/timestamp-authority/v2 v2.1.2 h1:7DDhnknLL4w8VwomyvW2W8qblOS9LDR8oihna+jc7Ls=
-github.com/sigstore/timestamp-authority/v2 v2.1.2/go.mod h1:o6rAVZceFyejClIj/uStRNIemP16bVMZtbMmhk6pr0U=
+github.com/sigstore/sigstore-go v1.3.0 h1:hnIMHREyCNTYFtOE1o7ae3Axa9B5W5EjUSBJICP2NBE=
+github.com/sigstore/sigstore-go v1.3.0/go.mod h1:AyRQXfpH89py1twjE3kEZxlRersng90GSYqQV9zGJE8=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9 h1:2NWAU/utJRwzy1OrQurlY3wlDSynyH1rNJS5GgFchrg=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9/go.mod h1:2shgYiPHTzeb5NNEu6okco+LOojMS5n9p/5Wdp0jhGI=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9 h1:zcg/EG6JW/8RSx9T2g5j6zqxplaE4dymmhiFflDE6ks=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9/go.mod h1:e7QngtHib0McuP1C/+Dt9f/7a8ic8FXvPB75OQzWgU4=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9 h1:DG8R4orWDs3l9trp70fLRTgazedEDoAIo/cHEN7Qo0k=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9/go.mod h1:d6oIwQ0YiYHMcFO4xqFcAx5njXwIf0dm5KfdytOar8A=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9 h1:V+spyeSHypvLHSOvPMT+V72dxDlS0LDkDd6lwCsUOXM=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9/go.mod h1:o7u5bQNLqpDQFaST29dpo6P6ihMV+wicwqfMmMW6H3c=
+github.com/sigstore/timestamp-authority/v2 v2.1.3 h1:Fc+LjCTfik1lh3YLkaosENfkXa3R2Y1nswiUKutBdFA=
+github.com/sigstore/timestamp-authority/v2 v2.1.3/go.mod h1:myoFOKJB/u5vNTFwvBBJVkG3NnOBeIJevbfjNeasLjo=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -1289,8 +1277,8 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
-github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
+github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E=
+github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
 github.com/stackrox/docker-registry-client v0.2.0 h1:91TLimNkFgdwO9QF8rUC57DoLGiTAgDKm2KhLI2xkLU=
 github.com/stackrox/docker-registry-client v0.2.0/go.mod h1:4TU+pA11iczIvhtL0own2OJcJXc1o26tBHDivaXhlZU=
 github.com/stackrox/dotnet-scraper v0.0.0-20201023051640-72ef543323dd h1:vEjp7Q66zd4W72//Uk3uyVN50Mh/nFLbN9pb7CVK7mE=
@@ -1326,6 +1314,8 @@ github.com/stackrox/yaml/v3 v3.0.0/go.mod h1:360StwOazy3cplMWHzBAA9y6InmKu/v7WB0
 github.com/stackrox/zap v1.18.2-0.20240314134248-5f932edd0404 h1:j2qhsZjUBpN4yaqEGkNrATdw3fE3vgMrVOhd44cUJDY=
 github.com/stackrox/zap v1.18.2-0.20240314134248-5f932edd0404/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/stolostron/cluster-lifecycle-api v0.0.0-20260330032750-43755d6ceb09 h1:vM6k7Atzuhygf/rTytmRdTEs3HdnIuhkpdKyVrgHX7Q=
+github.com/stolostron/cluster-lifecycle-api v0.0.0-20260330032750-43755d6ceb09/go.mod h1:6V51MeHkiYrmQVSFAhc4rfgZk2/AxtZMNSgNN8DjvRQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -1344,9 +1334,10 @@ github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1F
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
@@ -1356,8 +1347,8 @@ github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qv
 github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
 github.com/theupdateframework/go-tuf/v2 v2.4.2 h1:w7976/W8uTwlsegP5nRymlpjPgrwSh+AXUf85is6nJk=
 github.com/theupdateframework/go-tuf/v2 v2.4.2/go.mod h1:JqBrIUnNLAaNq/8GmBcEMFWfAFBbqp/MkJEJseXKbks=
-github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
-github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
+github.com/tidwall/gjson v1.20.0 h1:+agJ3rEzKcCXKDKo0ml26UROcpcAlnZyjq+TjbY5Fto=
+github.com/tidwall/gjson v1.20.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
@@ -1366,8 +1357,8 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tink-crypto/tink-go-awskms/v3 v3.0.0 h1:XSohRhCkXAVI0iaCnWB/GS05TEmpnKurQmzaY1jzt3Y=
 github.com/tink-crypto/tink-go-awskms/v3 v3.0.0/go.mod h1:+7MXsShLzVbSQ6dI0Pe4JuZM52jD1jQ1itAygd/MDsA=
-github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
-github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0/go.mod h1:jY5YN2BqD/KSCHM9SqZPIpJNG/u3zwfLXHgws4x2IRw=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0 h1:xpI5pnEQ0erFCS3JmcEl7Blluo8ZieEPNOURqy9uD70=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0/go.mod h1:wDDAhjfd1t4TjeJCSsmFK7CARPUs/ITi16ZZ8kmAaFQ=
 github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0 h1:eXuNqgrcYelxU1MVikOJDP3wTS5lvihM4ntoAbAMfvs=
 github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0/go.mod h1:3RhcxAqek6xUlRFmJifvU4CYLZN60KMQdIKqpZAZJG0=
 github.com/tink-crypto/tink-go/v2 v2.7.0 h1:k7QnUXJ1cRDpvoy/5l1FimZqMAArRff8vjUqzi5N04o=
@@ -1391,8 +1382,6 @@ github.com/vbauerster/mpb/v4 v4.12.2 h1:TsBs1nWRYF0m8cUH13pxNhOUqY6yKcOr2PeSYxp2
 github.com/vbauerster/mpb/v4 v4.12.2/go.mod h1:LVRGvMch8T4HQO3eg2pFPsACH9kO/O6fT/7vhGje3QE=
 github.com/vladimirvivien/gexe v0.5.0 h1:AWBVaYnrTsGYBktXvcO0DfWPeSiZxn6mnQ5nvL+A1/A=
 github.com/vladimirvivien/gexe v0.5.0/go.mod h1:3gjgTqE2c0VyHnU5UOIwk7gyNzZDGulPb/DJPgcw64E=
-github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
-github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
 github.com/weppos/publicsuffix-go v0.13.0/go.mod h1:z3LCPQ38eedDQSwmsSRW4Y7t2L8Ln16JPQ02lHAdn5k=
 github.com/weppos/publicsuffix-go v0.40.3-0.20250127173806-e489a31678ca/go.mod h1:43Dfyxu2dpmLg56at26Q4k9gwf3yWSUiwk8kGnwzULk=
 github.com/weppos/publicsuffix-go v0.50.2 h1:KsJFc8IEKTJovM46SRCnGNsM+rFShxcs6VEHjOJcXzE=
@@ -1401,6 +1390,13 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
@@ -1427,7 +1423,6 @@ github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/zalando/go-keyring v0.2.6 h1:r7Yc3+H+Ux0+M72zacZoItR3UDxeWfKTcabvkI8ua9s=
 github.com/zalando/go-keyring v0.2.6/go.mod h1:2TCrxYrbUNYfNS/Kgy/LSrkSQzZ5UPVH85RwfczwvcI=
-github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
 github.com/zmap/rc2 v0.0.0-20131011165748-24b9757f5521/go.mod h1:3YZ9o3WnatTIZhuOtot4IcUfzoKVjUHqu6WALIyI0nE=
 github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248/go.mod h1:3YZ9o3WnatTIZhuOtot4IcUfzoKVjUHqu6WALIyI0nE=
 github.com/zmap/zcertificate v0.0.0-20180516150559-0e3d58b1bac4/go.mod h1:5iU54tB79AMBcySS0R2XIyZBAVmeHranShAFELYx7is=
@@ -1439,8 +1434,8 @@ github.com/zmap/zcrypto v0.0.0-20250129210703-03c45d0bae98/go.mod h1:YTUyN/U1oJ7
 github.com/zmap/zlint/v3 v3.0.0/go.mod h1:paGwFySdHIBEMJ61YjoqT4h7Ge+fdYG4sUQhnTb1lJ8=
 github.com/zmap/zlint/v3 v3.6.6 h1:tH7RJM9bDmh7IonlLEkFIkIn8XDYDYjehhUPgpLVqYA=
 github.com/zmap/zlint/v3 v3.6.6/go.mod h1:6yXG+CBOQBRpMCOnpIVPUUL296m5HYksZC9bj5LZkwE=
-go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
-go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
+go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
+go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
 go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/client/pkg/v3 v3.5.1/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
 go.etcd.io/etcd/client/v2 v2.305.1/go.mod h1:pMEacxZW7o8pg4CrFE7pquyCJJzZvkvdD2RibOCCCGs=
@@ -1455,16 +1450,16 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 h1:dkBzNEAIKADEaFnuESzcXvpd09vxvDZsOjx11gjUqLk=
 go.opentelemetry.io/contrib/bridges/prometheus v0.67.0/go.mod h1:Z5RIwRkZgauOIfnG5IpidvLpERjhTninpP1dTG2jTl4=
-go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=
-go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s=
+go.opentelemetry.io/contrib/detectors/gcp v1.45.0 h1:9jR0ZPRok9ryaOQ2Wx8rg5F7Aon59mxrqbVI60/vlBk=
+go.opentelemetry.io/contrib/detectors/gcp v1.45.0/go.mod h1:VSme3o2fvSg5bVg0dRzyHaj4Z5EVhG+g2Fde6LKzmQA=
 go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 h1:4fnRcNpc6YFtG3zsFw9achKn3XgmxPxuMuqIL5rE8e8=
 go.opentelemetry.io/contrib/exporters/autoexport v0.67.0/go.mod h1:qTvIHMFKoxW7HXg02gm6/Wofhq5p3Ib/A/NNt1EoBSQ=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 h1:B2h3uqicet1CT2N5TOFhS+Gq++9i0/CLmaxvhmhtP5s=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0/go.mod h1:dylvB+ZiiwMvsDij9O84Uy7SijLgHMX4mbkncds+4Sw=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag=
@@ -1473,42 +1468,42 @@ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQ
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
 go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ=
 go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o=
 go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 h1:GJkybS+crDMdExT/BUNCEgfrmfboztcS6PhvSo88HKM=
 go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0/go.mod h1:NuAyxRYIG2lKX3YQkB+83StTxM7s52PUUkRRiC0wnYI=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 h1:mS47AX77OtFfKG4vtp+84kuGSFZHTyxtXIN269vChY0=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0/go.mod h1:PJnsC41lAGncJlPUniSwM81gc80GkgWJWr3cu2nKEtU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.45.0 h1:dm9iyzn6tioYZtwqaiBSU0TSI8Yu/8dTIbfG0+B49DY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.45.0/go.mod h1:xAvxYjYK28qvt+yu4BYZ/zMmAjwMXINXD6JiMyeB8iI=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0 h1:KdRxPiAoMptR3vfWzvjjvutTsSiwbC2uG0496rzZNfo=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0/go.mod h1:K/qSA+3G7Eovxi4K09wzrAgkWRnosS0DAOZeEpve7sM=
 go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4=
 go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
-go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
+go.opentelemetry.io/otel/metric/x v0.68.0 h1:TA/cBT23D3MnxYPwHL7YFOdYGdx0A0v+s7Mzotpd1dU=
+go.opentelemetry.io/otel/metric/x v0.68.0/go.mod h1:agudOmvWhwUTjgibWDzxD2PoWYnpw5Ht5jISYOD2Hd4=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
+go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
 go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko=
 go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
+go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
-go.step.sm/crypto v0.81.0 h1:e+ouzpNt3Xm4dp7HGXhgYB5y4iFik3vh3phHKWmvugU=
-go.step.sm/crypto v0.81.0/go.mod h1:fsTizqQeASjTXnbv9O00XtRlIuXRkCdoRiJNyXGQujc=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
+go.step.sm/crypto v0.87.0 h1:+u0pDz1OV9M/SswA6KtcQ3GSrYMMelbL//0W/ceJVYI=
+go.step.sm/crypto v0.87.0/go.mod h1:gBr1mpMiKs5804/Yt03uAoOBiw3DFxARZnGUKEUO82M=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/atomic v1.12.0 h1:BvcXdFKuviU4fTL/f+SxdQ5qJX/Jix8pAkgdUcb3XOE=
+go.uber.org/atomic v1.12.0/go.mod h1:I6c4cg+6HCxRjfjSsYtApoFILnpc0CGUdGkXVqbYVNk=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
@@ -1517,8 +1512,10 @@ go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
@@ -1538,12 +1535,17 @@ golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1554,8 +1556,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU=
+golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1585,11 +1587,17 @@ golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
-golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1647,12 +1655,17 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1667,11 +1680,15 @@ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1759,28 +1776,38 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
+golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4=
+golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488/go.mod h1:fGb/2+tgXXjhjHsTNdVEEMZNWA0quBnfrO+AfoDSAKw=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1796,13 +1823,17 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1867,9 +1898,16 @@ golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.34.1-0.20250613162507-3f93fece84c7/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
+golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -1917,8 +1955,8 @@ google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdr
 google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU=
 google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
 google.golang.org/api v0.62.0/go.mod h1:dKmwPCydfsad4qCH08MSdgWjfHOyfpd4VtDGgRFdavw=
-google.golang.org/api v0.292.0 h1:Ewiwo/GTtiaPZSNAZQUcWLh8AYDEoPmIXyJfeoTSMHU=
-google.golang.org/api v0.292.0/go.mod h1:07kjmMnFGm2RQuCza2EZM/5N68G/fVvFb1xKjWqoFA0=
+google.golang.org/api v0.301.0 h1:rTvI8szs17R7b09ggb34Bv4XrmFaFl9uCBncgxskqtw=
+google.golang.org/api v0.301.0/go.mod h1:gGUTaOjgsaG/KNyyW1tFO+DSFm3EJw4BwyehlcmDCXs=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1990,12 +2028,12 @@ google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 h1:YJjbgu+dkp5kUJLfpMyCLfBIWZb/FcJyuLeo1gVBOuo=
-google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94/go.mod h1:RRHjglSYABVCWpQ7USCpdfhcd9t4PkajvVwyynZizTc=
-google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772 h1:4namukbyF7JY83aWHQwi9J5ugNTnDReLJ9ZcpqOpRB4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772/go.mod h1:1brfde68Npq6+WA75c1EHWPijZEG1kMus61ygPZfn4A=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU=
+google.golang.org/genproto/googleapis/api v0.0.0-20260921155816-b14227669459 h1:GS9OIt/j7c8bvBjYNgnKQysVfmV7e4jM0H8ZK95G4t8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260921155816-b14227669459/go.mod h1:PX5/4vemwVoXtwEcRDWwcR1/r0qrosfx3qoVADMwnVE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -2024,8 +2062,8 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
-google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
@@ -2042,6 +2080,7 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
@@ -2068,16 +2107,16 @@ gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkep
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
-gorm.io/driver/postgres v1.6.2 h1:BvXQ/cNUg63q5TFNg672DmDcowZSFrNLkkA3Xe6GXq4=
-gorm.io/driver/postgres v1.6.2/go.mod h1:0c4fQA44XhOklXDkgtuKqysHCycTa5i9e3EIpDGCwXk=
+gorm.io/driver/postgres v1.6.3 h1:bAn6O2pUa8LtpWEvL5NFU4+52Tfx8Ut7IVaIacCLcI0=
+gorm.io/driver/postgres v1.6.3/go.mod h1:0c4fQA44XhOklXDkgtuKqysHCycTa5i9e3EIpDGCwXk=
 gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
 gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
 gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo=
 gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-helm.sh/helm/v3 v3.21.3 h1:wkamdwI3liEkW6wI1l9aGqQZGxcTKyt8kx0qJLPcmCg=
-helm.sh/helm/v3 v3.21.3/go.mod h1:iaJ0iNsPoTZl++7h6vzQFyT0VEVtLYJiyRBDkPOOBTs=
+helm.sh/helm/v3 v3.22.0 h1:n1if5iQgHYsujPAcO5oonH/KiSNUmqmUF0iGVjSF3AU=
+helm.sh/helm/v3 v3.22.0/go.mod h1:EVl/147Ai2z13JOykbO1Jn9HRaXyU7uHlbAJmODq/Fg=
 honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -2087,98 +2126,102 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.23.3/go.mod h1:w258XdGyvCmnBj/vGzQMj6kzdufJZVUwEM1U2fRJwSQ=
-k8s.io/api v0.36.3 h1:NxB+05W2UGqXWFXcLO0RB5cnqnUPP5v5sVlaOH0Iz4w=
-k8s.io/api v0.36.3/go.mod h1:JzLQKqRHC5+I8RVj/lS3lCg0mg6nWI9Fo/Sk3ElxHzg=
-k8s.io/apiextensions-apiserver v0.36.3 h1:dPmOAPhwTtqb1bTxbFPsy18KHPhktQeO3WUPXunZIB0=
-k8s.io/apiextensions-apiserver v0.36.3/go.mod h1:KTXFqgXiuw2pRoL+Wpmttqc+up9Xt/GohadPWeLLOa4=
+k8s.io/api v0.37.1 h1:l6N77U7tjwB5L056bgrBTJIEdevac/naBZ3iSvDNfpM=
+k8s.io/api v0.37.1/go.mod h1:zSlbB1YpJ1YQlFVQy20UYll81UJSJJUMLhkhvg6Z78M=
+k8s.io/apiextensions-apiserver v0.37.1 h1:7fIQG8eThDSTVYBWg/DOpI8v5wYfKCo0N8/TDMjj+zY=
+k8s.io/apiextensions-apiserver v0.37.1/go.mod h1:1Q3ujWwHgnhBoGsdmGORflwK1sDFmuaqH1OsMDWk2Gs=
 k8s.io/apimachinery v0.23.3/go.mod h1:BEuFMMBaIbcOqVIJqNZJXGFTP4W6AycEpb5+m/97hrM=
-k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=
-k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=
-k8s.io/apiserver v0.36.3 h1:MGSg2SkdfuytiDEcRylT5mQFmmSsbx90XFUO67Y4bsQ=
-k8s.io/apiserver v0.36.3/go.mod h1:fVH7zv9EUNUA7Fl7LtDKh8aB9W7u1VQPSGtWV5SjUxg=
-k8s.io/cli-runtime v0.36.3 h1:g+eJ+M1sYpnNYp/q5fzaw2KejIL0Q7DH+xFl6YVoL4U=
-k8s.io/cli-runtime v0.36.3/go.mod h1:hZpAqK8nSFXvvLaVCbzUPVp8e9TRLSTCfpNzMt7s3tE=
-k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg=
-k8s.io/client-go v0.36.3/go.mod h1:gcPwr0c87vjjG6HB6pWEqOeuYVoXSsREjzux2j6GF30=
+k8s.io/apimachinery v0.37.1 h1:hGCYyvKHCwtwMitj2vU4vYx0Z16N9GyZk9BBnz0wDAE=
+k8s.io/apimachinery v0.37.1/go.mod h1:jF84AyUi/IRIXRot5f+lm6MpxoWI+F1XgjaMmwCdTFw=
+k8s.io/apiserver v0.37.1 h1:dUsNwjsvItyVKNpC1N0AhQ0OBSiUJKfWz004vPifOe0=
+k8s.io/apiserver v0.37.1/go.mod h1:EWXW6PntGfOC2uD9GGVobnOExgFoX1z0hZo7f7Rs7Ng=
+k8s.io/cli-runtime v0.37.1 h1:3mir5bM4XjMJHW3SMRk++3Ylf4YQne0XFFsW+IGT85U=
+k8s.io/cli-runtime v0.37.1/go.mod h1:g3VQOm71f//aNbp79g0az9jBRTrvPjAHz7WxVysbZ4M=
+k8s.io/client-go v0.37.1 h1:QTv/5ha4jAHtW9qxxVBkQVFBRDb4jHfFopQqqMdc+wM=
+k8s.io/client-go v0.37.1/go.mod h1:dnAPtTnCNY38Ho04D2KdY1F4IKausa9UbqaAZKl60SY=
 k8s.io/code-generator v0.23.3/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
-k8s.io/code-generator v0.36.3 h1:tsiHI6NepXQncnexlTAf52w5VxZ4HYDU4ZqCNLFb9tA=
-k8s.io/code-generator v0.36.3/go.mod h1:Unn13Mp8X+H803jgZi4f4ExxK11aj0llXcSsl++UTkE=
-k8s.io/component-base v0.36.3 h1:vc/UFvPCkW0irPz84LAodAL1j3f4xktPM6dDJIEheAY=
-k8s.io/component-base v0.36.3/go.mod h1:hZbNFG+gCMl9EbykDGEu73feKP9/Cq6JsV4pTo9GTO8=
-k8s.io/component-helpers v0.36.3 h1:hya22S0Mto0SlHaiD4kMIi817f/tK7uTMsShxrDKQaY=
-k8s.io/component-helpers v0.36.3/go.mod h1:QjREK1lOFXR+jxTqzrtHgOtzUc2s9sm8zuFSiK+TW+c=
+k8s.io/code-generator v0.37.1 h1:tvxxAiGc2kMxoGx8HtUacs4cBdl0X5R+auBD2He974U=
+k8s.io/code-generator v0.37.1/go.mod h1:RJepz1uW2WnHEwPDoCGzI3p4V23C7WuUdtqjueDl1uU=
+k8s.io/component-base v0.37.1 h1:93DMmlENnK7gNLkL4pMqLO5M/HVf3p3sM4q/GasLveY=
+k8s.io/component-base v0.37.1/go.mod h1:bBrdziT4dreQG5lzTaPVxBwsZe1oxphG+ZVdD56dQWQ=
+k8s.io/component-helpers v0.37.1 h1:V6ueiH2SBqpZil1X9+uMK8GAwsGYPVfoRN9eA5vY2G8=
+k8s.io/component-helpers v0.37.1/go.mod h1:Ib5+txJA7lG9/xCdRrPshX8GnRRTXPElxtxo+bFQ0Y8=
 k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo v0.0.0-20211129171323-c02415ce4185/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b h1:gMplByicHV/TJBizHd9aVEsTYoJBnnUAT5MHlTkbjhQ=
-k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b/go.mod h1:CgujABENc3KuTrcsdpGmrrASjtQsWCT7R99mEV4U/fM=
+k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 h1:3L6PNkMLXkU/pz3jWzaaIUz0Rs2V9h+5O51AeRC7poc=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3/go.mod h1:yvyl3l9E+UxlqOMUULdKTAYB0rEhsmjr7+2Vb/1pCSo=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
 k8s.io/klog/v2 v2.30.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/klog/v2 v2.40.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk=
-k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk=
 k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 h1:sWu4Td5mgJlwunsUydnhKEAfNUHM7hm1wfKEQmD7G5c=
 k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/kubectl v0.36.3 h1:TesKp+XYQEjPYoFvuobcVnuvira2+/xAVlq//+kksaI=
-k8s.io/kubectl v0.36.3/go.mod h1:W+NEb1CzBGmoaI1Nrpn2ETo9omNBl0AsyxnnMT40N6E=
+k8s.io/kubectl v0.37.1 h1:n1VCIntOJiX943uByXCThSZQmE+4v9jGS8S9u94/aHU=
+k8s.io/kubectl v0.37.1/go.mod h1:66cc4Bz8PxBTxlrHzBuzXEzGIytAnNasKQPeEcpuaV8=
 k8s.io/kubelet v0.32.13 h1:pGSrLTytcmuIlq4yvuRFnF4RdQjQh1FfsmPeRZXDKTo=
 k8s.io/kubelet v0.32.13/go.mod h1:XrwKgyKhVUE8TO/w9Lqq93UTM5W6t7ePItIgjvSmV/4=
-k8s.io/streaming v0.36.3 h1:9rAaqBk0C0Pc7+/fqGekj07NV+/Xrew58p647A0JT8w=
-k8s.io/streaming v0.36.3/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
-k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+k8s.io/streaming v0.37.1 h1:TpzVfQeFuVndn2g9mFqxy1UcUYPwDzqjUmwR/IzJCWc=
+k8s.io/streaming v0.37.1/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU=
 k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-kubevirt.io/api v1.9.0 h1:FWqx9yGk/GHUP5o4IthGXZ8FeAlgVNv2It48wD86UUo=
-kubevirt.io/api v1.9.0/go.mod h1:tFKAVaJMm7bXCMLxOoUdAqBprKAXoCa0sp0gBmnfBgY=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+kubevirt.io/api v1.9.1 h1:kV+n8NPBS0SJ8b6Xm+tPxPgFn3JeQUHmvSQ2SNtu1IU=
+kubevirt.io/api v1.9.1/go.mod h1:tFKAVaJMm7bXCMLxOoUdAqBprKAXoCa0sp0gBmnfBgY=
+kubevirt.io/client-go v1.10.0-beta.0 h1:W0b7BBY4uKCbi+QP22Wpv/MRAmTch9R+3FumXtSlCUA=
+kubevirt.io/client-go v1.10.0-beta.0/go.mod h1:lxFei8lrDf6zbLTzv2jE+O7lQxx32E8LHGmD8Tw4XbE=
 kubevirt.io/containerized-data-importer-api v1.64.0 h1:yBLY6qEogUp8F+XSJvabIkx9uEEDeToYDfRr0mbUxJc=
 kubevirt.io/containerized-data-importer-api v1.64.0/go.mod h1:VGp35wxpLXU18b7cnEpmcThI3AjcZUSfg/Zfql44U4o=
 kubevirt.io/controller-lifecycle-operator-sdk/api v0.2.4 h1:fZYvD3/Vnitfkx6IJxjLAk8ugnZQ7CXVYcRfkSKmuZY=
 kubevirt.io/controller-lifecycle-operator-sdk/api v0.2.4/go.mod h1:018lASpFYBsYN6XwmA2TIrPCx6e0gviTd/ZNtSitKgc=
-modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c=
-modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws=
-modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE=
+modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
+modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
+modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
-modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
+modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA=
-modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
+modernc.org/libc v1.75.6 h1:yKk8qo+Di4gkmvRboK8ocCqH22FiUCR6jRy2OwtCRus=
+modernc.org/libc v1.75.6/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
+modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
-modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
+modernc.org/sqlite v1.58.0 h1:38u40/bwkfM7f0Myhosl+SEMltSDxnGdQf8o6Kjmys0=
+modernc.org/sqlite v1.58.0/go.mod h1:rsD2CckafgObKC4DhBlGBf+RiHxkc3hINGt1Xw32tVY=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-oras.land/oras-go/v2 v2.6.1 h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs=
-oras.land/oras-go/v2 v2.6.1/go.mod h1:dhtFrFOuZuDtAVeZ9FUnaa5zfzplG3ZnFX9/uH1J/Yk=
+oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo=
+oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 h1:hSfpvjjTQXQY2Fol2CS0QHMNs/WI1MOSGzCm1KhM5ec=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
-sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
-sigs.k8s.io/controller-tools v0.21.0 h1:KXDQza3bgjlPY6xLR63tI/40gzjhyUAvkCrwzd2/6cs=
-sigs.k8s.io/controller-tools v0.21.0/go.mod h1:DLIypi3Q2+azVAP8jr/mHXJgveYYHFjhnNOUuBJ10JE=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 h1:/YpDJ4vReG7ZmzSpBGxduXgywWkJU9zHubgJG03MT+Y=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0/go.mod h1:tJo1aepTXyR+8Xs3sUsGBDk4Ub2AM5dPAPKJx0mpm5c=
+sigs.k8s.io/controller-runtime v0.25.2 h1:bEkK3PVOIVK9X8QWLGVhJgmFc++47vfT6wakSzAOLsQ=
+sigs.k8s.io/controller-runtime v0.25.2/go.mod h1:4QqLdT6z/L6Olj8JJCtvztid4/fnIiYsfaTFScegctc=
+sigs.k8s.io/controller-tools v0.22.0 h1:eG3FAVja/KnlXKIWg95udIFz1cMyAtMjP11cqBh3t+k=
+sigs.k8s.io/controller-tools v0.22.0/go.mod h1:VizwUStoZK7rReCj704czGGrB7mLxXTiJSJt7wN5ilI=
 sigs.k8s.io/e2e-framework v0.7.0 h1:AHkySTC6MvnnMbVSxaO4z1m2MhQKNFP+2Ihs5pRNLlM=
 sigs.k8s.io/e2e-framework v0.7.0/go.mod h1:1ZgXkUSjmnf18/JgHZNEATWjv48O5lJm9aI1QIsRdbw=
 sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
@@ -2187,15 +2230,17 @@ sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7
 sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
 sigs.k8s.io/network-policy-api v0.1.5 h1:xyS7VAaM9EfyB428oFk7WjWaCK6B129i+ILUF4C8l6E=
 sigs.k8s.io/network-policy-api v0.1.5/go.mod h1:D7Nkr43VLNd7iYryemnj8qf0N/WjBzTZDxYA+g4u1/Y=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.1/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.2.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
-software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
-software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
+software.sslmate.com/src/go-pkcs12 v0.5.0 h1:EC6R394xgENTpZ4RltKydeDUjtlM5drOYIG9c6TVj2M=
+software.sslmate.com/src/go-pkcs12 v0.5.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
diff --git a/govulncheck-allowlist.json b/govulncheck-allowlist.json
index aa01576ec552e..1ed96ccb6020a 100644
--- a/govulncheck-allowlist.json
+++ b/govulncheck-allowlist.json
@@ -1,10 +1,4 @@
 {
   "exceptions": {
-    "GO-2022-0635": {
-      "reason": "Unused portion of the SDK"
-    },
-    "GO-2022-0646": {
-      "reason": "Unused portion of the SDK"
-    }
   }
 }
diff --git a/image/postgres/Dockerfile b/image/postgres/Dockerfile
index edb3503720933..dd775fda126b7 100644
--- a/image/postgres/Dockerfile
+++ b/image/postgres/Dockerfile
@@ -1,4 +1,4 @@
-ARG PG_VERSION=15
+ARG PG_VERSION=16
 FROM quay.io/sclorg/postgresql-${PG_VERSION}-c9s:latest AS final
 
 USER root
diff --git a/image/postgres/download.sh b/image/postgres/download.sh
index 624b992ee4867..977dfde78cf4f 100755
--- a/image/postgres/download.sh
+++ b/image/postgres/download.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-postgres_major=15
+postgres_major=16
 pg_rhel_major=9
 
 arch="$(uname -m)"
@@ -16,6 +16,7 @@ output_dir="/rpms"
 mkdir $output_dir
 
 if [[ "$arch" == "s390x" ]]; then
+  dnf module enable -y postgresql:16
   dnf install -y --downloadonly --downloaddir=/tmp postgresql postgresql-private-libs postgresql-server postgresql-contrib
   mv /tmp/postgresql-contrib-*.rpm "${output_dir}/postgres-contrib.rpm"
   mv /tmp/postgresql-server-*.rpm "${output_dir}/postgres-server.rpm"
diff --git a/image/postgres/konflux.Dockerfile b/image/postgres/konflux.Dockerfile
index fc1103136d0de..044adaba6addd 100644
--- a/image/postgres/konflux.Dockerfile
+++ b/image/postgres/konflux.Dockerfile
@@ -1,5 +1,5 @@
-ARG PG_VERSION=15
-FROM registry.redhat.io/rhel9/postgresql-${PG_VERSION}:latest@sha256:7194048e972bd3da04a53e3f9537b123eb6b1b2cc3388268896b8923f86e04d4 AS final
+ARG PG_VERSION=16
+FROM registry.redhat.io/rhel9/postgresql-${PG_VERSION}:latest@sha256:791a6f14563178d1bbcd3515bc7dc80c1ae0788a829ff26551cdedbf8f50f0d2 AS final
 
 USER root
 
diff --git a/image/postgres/scripts/docker-entrypoint.sh b/image/postgres/scripts/docker-entrypoint.sh
index 371b5dbd60021..6eafa1e5ac6bb 100755
--- a/image/postgres/scripts/docker-entrypoint.sh
+++ b/image/postgres/scripts/docker-entrypoint.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# This file is from https://github.com/docker-library/postgres/tree/master/15/bookworm
+# This file is from https://github.com/docker-library/postgres/tree/master/16/bookworm
 set -Eeo pipefail
 # TODO swap to -Eeuo pipefail above (after handling all potentially-unset variables)
 
@@ -362,7 +362,7 @@ _main() {
 	### ROX_TLS_MIN_VERSION: passed to ssl_min_protocol_version (e.g. "TLSv1.2", "TLSv1.3").
 	### ROX_TLS_OPENSSL_CIPHERS: colon-separated OpenSSL cipher names
 	###   (e.g. "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384").
-	###   Only affects TLS 1.2; TLS 1.3 ciphers are not configurable in PostgreSQL 15.
+	###   Only affects TLS 1.2; TLS 1.3 ciphers are not configurable in PostgreSQL 16.
 	if [ -n "${ROX_TLS_MIN_VERSION:-}" ]; then
 		set -- "$@" -c "ssl_min_protocol_version=${ROX_TLS_MIN_VERSION}"
 	fi
diff --git a/image/postgres/scripts/init-entrypoint.sh b/image/postgres/scripts/init-entrypoint.sh
index cb4ce80fc7c12..34344f78ab674 100755
--- a/image/postgres/scripts/init-entrypoint.sh
+++ b/image/postgres/scripts/init-entrypoint.sh
@@ -232,7 +232,7 @@ else
                 --new-bindir="${NEW_BINARIES}" \
                 --old-datadir="${PGDATA}" \
                 --new-datadir="${PGDATA_NEW}" \
-                --clone -j 4 -k --check
+                -j 4 -k --check
 
         RESULT=$?
         if [ $RESULT -ne 0 ]; then
@@ -247,7 +247,7 @@ else
                 --new-bindir="${NEW_BINARIES}" \
                 --old-datadir="${PGDATA}" \
                 --new-datadir="${PGDATA_NEW}" \
-                --clone -j 4 -k
+                -j 4 -k
 
         RESULT=$?
         if [ $RESULT -ne 0 ]; then
diff --git a/image/rhel/Dockerfile b/image/rhel/Dockerfile
index ecd99837e048e..770bf1dc49ad4 100644
--- a/image/rhel/Dockerfile
+++ b/image/rhel/Dockerfile
@@ -1,12 +1,16 @@
+ARG PG_VERSION=16
+
 FROM registry.access.redhat.com/ubi9:latest AS ubi-base
 FROM registry.access.redhat.com/ubi9/ubi-micro:latest AS ubi-micro-base
 
 FROM ubi-base AS downloads
 
 ARG DEBUG_BUILD=no
+ARG PG_VERSION
 
 WORKDIR /
 COPY download.sh /download.sh
+COPY signatures/RPM-GPG-KEY-CentOS-Official /tmp/
 RUN /download.sh
 
 FROM ubi-base AS stackrox_data
@@ -39,7 +43,35 @@ RUN rpm --import /tmp/RPM-GPG-KEY-CentOS-Official && \
     dnf clean all --installroot=/out/ && \
     rm -rf /out/var/cache/dnf /out/var/cache/yum
 
-FROM ubi-micro-base
+FROM ubi-micro-base AS runtime-base
+
+ARG PG_VERSION
+
+COPY --from=package_installer /out/ /
+
+# Execute the clients in the final runtime to check their version and libraries.
+RUN set -eu; \
+    for client in pg_dump pg_restore; do \
+        version="$("$client" --version)"; \
+        echo "$version"; \
+        case "$version" in \
+            "$client (PostgreSQL) ${PG_VERSION}."*) ;; \
+            *) echo "Expected PostgreSQL ${PG_VERSION} client: $client" >&2; exit 1 ;; \
+        esac; \
+    done
+
+FROM ubi-base AS cli-tarballs
+
+RUN dnf install -y pigz
+COPY bin/roxctl* /tmp/roxctl/
+RUN cd /tmp/roxctl && \
+    shopt -s nullglob && \
+    for f in roxctl-*; do \
+        [[ -f "$f" && -x "$f" ]] || continue; \
+        tar -I pigz -cvf "${f%.exe}.tar.gz" "$f"; \
+    done
+
+FROM runtime-base
 
 ARG LABEL_VERSION
 ARG LABEL_RELEASE
@@ -62,8 +94,6 @@ ENV PATH="/stackrox:$PATH" \
     ROX_IMAGE_FLAVOR=${ROX_IMAGE_FLAVOR} \
     ROX_PRODUCT_BRANDING=${ROX_PRODUCT_BRANDING}
 
-COPY --from=package_installer /out/ /
-
 COPY static-bin /stackrox/
 COPY --from=downloads /output/go/ /go/
 
@@ -94,9 +124,8 @@ COPY bin/admission-control  /stackrox/bin/admission-control
 COPY bin/config-controller  /stackrox/bin/config-controller
 COPY bin/central-worker     /stackrox/bin/central-worker
 COPY bin/roxagent           /stackrox/bin/roxagent
-COPY bin/roxctl*            /assets/downloads/cli/
-
-RUN ln -s /assets/downloads/cli/roxctl-linux-${TARGET_ARCH} /stackrox/roxctl
+COPY --from=cli-tarballs /tmp/roxctl/roxctl-*.tar.gz /assets/downloads/cli/
+COPY --from=cli-tarballs /tmp/roxctl/roxctl-linux-${TARGET_ARCH} /stackrox/roxctl
 
 EXPOSE 8443
 
diff --git a/image/rhel/README.md b/image/rhel/README.md
index c3283e8a714f3..818126d99469d 100644
--- a/image/rhel/README.md
+++ b/image/rhel/README.md
@@ -3,3 +3,15 @@
 The RedHat based main image is currently used for the RedHat marketplace as well as for DoD customers.
 
 This image is built in opinionated way based on the DoD Centralized Artifacts Repository (DCAR) requirements outlined [here](https://dccscr.dsop.io/dsop/dccscr/tree/master/contributor-onboarding)
+
+## PostgreSQL clients
+
+`Dockerfile` downloads PostgreSQL client RPMs from PGDG for amd64, arm64, and
+ppc64le. For s390x, `download.sh` adds the CentOS Stream 9 AppStream repository
+to its download commands because PGDG does not publish s390x packages and UBI's
+repositories do not provide the PostgreSQL 16 module. The download and runtime
+stages use UBI on every architecture.
+
+`PG_VERSION` selects the client major version. The `runtime-base` stage runs
+`pg_dump` and `pg_restore` and checks their versions in the runtime filesystem,
+so missing libraries or an older client fail the image build.
diff --git a/image/rhel/download.sh b/image/rhel/download.sh
index 82570540b1b49..cbddcdaabef82 100755
--- a/image/rhel/download.sh
+++ b/image/rhel/download.sh
@@ -3,6 +3,7 @@
 set -euo pipefail
 
 arch=$(uname -m)
+postgres_major="${PG_VERSION:-16}"
 goarch="$arch"
 dnf_list_args=()
 if [[ "$arch" == "x86_64" ]]; then
@@ -35,15 +36,17 @@ fi
 mkdir -p "$output_dir/rpms"
 
 if [[ "$arch" == "s390x" ]]; then
-  dnf install -y --downloadonly --downloaddir=/tmp postgresql postgresql-private-libs
+  rpm --import /tmp/RPM-GPG-KEY-CentOS-Official
+  centos_repo="--repofrompath=centos-appstream,https://mirror.stream.centos.org/9-stream/AppStream/${arch}/os/"
+  dnf "$centos_repo" module enable -y "postgresql:${postgres_major}"
+  dnf "$centos_repo" install -y --downloadonly --downloaddir=/tmp postgresql postgresql-private-libs
   mv /tmp/postgresql-private-libs-*.rpm "${output_dir}/rpms/postgres-libs.rpm"
   mv /tmp/postgresql-*.rpm "${output_dir}/rpms/postgres.rpm"
 else
-  postgres_major=15
   pg_rhel_major=9
   postgres_repo_url="https://download.postgresql.org/pub/repos/yum/reporpms/EL-${pg_rhel_major}-${arch}/pgdg-redhat-repo-latest.noarch.rpm"
   dnf install --disablerepo='*' -y "${postgres_repo_url}"
-  postgres_minor=$(dnf list ${dnf_list_args[@]+"${dnf_list_args[@]}"} --disablerepo='*' ""--enablerepo=pgdg${postgres_major} -y postgresql${postgres_major}-server."$arch" | tail -n 1 | awk '{print $2}')
+  postgres_minor=$(dnf list ${dnf_list_args[@]+"${dnf_list_args[@]}"} --disablerepo='*' "--enablerepo=pgdg${postgres_major}" -y "postgresql${postgres_major}-server.${arch}" | tail -n 1 | awk '{print $2}')
   postgres_minor="$postgres_minor.$arch"
 
   postgres_url="https://download.postgresql.org/pub/repos/yum/${postgres_major}/redhat/rhel-${pg_rhel_major}-${arch}"
diff --git a/image/rhel/konflux.Dockerfile b/image/rhel/konflux.Dockerfile
index 9fbb839df271f..c06e1e6500b4d 100644
--- a/image/rhel/konflux.Dockerfile
+++ b/image/rhel/konflux.Dockerfile
@@ -1,9 +1,9 @@
-ARG PG_VERSION=15
+ARG PG_VERSION=16
 
 
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:3ca2c34c83e6563fa574b7c7ecda92a5fdae2ec7a5f37a408e5e383947fb1957 AS go-builder
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:e74b03198cccc24c24a27071ad4d6c2edcfe0bb10c6de99c609ce6e3c06d6d04 AS go-builder
 
-RUN dnf -y install --allowerasing jq
+RUN dnf -y install --allowerasing jq pigz
 
 WORKDIR /go/src/github.com/stackrox/rox/app
 
@@ -36,8 +36,20 @@ RUN mkdir -p image/rhel/docs/api/v1 && \
 
 RUN make copy-go-binaries-to-image-dir
 
+RUN cd /go/src/github.com/stackrox/rox/app/image/rhel/bin && \
+    shopt -s nullglob && \
+    for f in roxctl-*; do \
+        [[ -f "$f" && -x "$f" ]] || continue; \
+        tar -I pigz -cvf "${f%.exe}.tar.gz" "$f"; \
+    done
 
-FROM registry.access.redhat.com/ubi9/nodejs-22@sha256:d1f88101a85776886e459995eacdd7ebaa97c6e0c80b35c5a07a8a7b938ea9a3 as ui-builder
+RUN arch=$(uname -m) ; \
+    case $arch in x86_64) arch=amd64 ;; aarch64) arch=arm64 ;; esac ; \
+    cp /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxctl-linux-${arch} \
+       /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxctl
+
+
+FROM registry.access.redhat.com/ubi9/nodejs-22@sha256:ec6d5fae468462129f094c6c463207bd950c9e2b0023f6c0fd1ae1cbdc5abd3e as ui-builder
 
 WORKDIR /go/src/github.com/stackrox/rox/app
 
@@ -59,9 +71,9 @@ ENV UI_PKG_INSTALL_EXTRA_ARGS="--ignore-scripts"
 RUN make -C ui build
 
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95 AS ubi-micro-base
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:5be877a2a280ae36eb9ab80ca4efb28bbf77c57abbba38137cdc37a03b8465e6 AS ubi-micro-base
 
-FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:bcbf1fe577df63bd975ea19ebae604b5f072e1833b2bde417a0ffd4afd938b96 AS package_installer
+FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:16e9e43d99e181463513cc84a514859b1abb9460f1c4d9e208da4b4e51cd5cc3 AS package_installer
 
 ARG PG_VERSION
 
@@ -97,16 +109,15 @@ COPY --from=ui-builder /go/src/github.com/stackrox/rox/app/ui/build /ui/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/migrator /stackrox/bin/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/central /stackrox/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/compliance /stackrox/bin/
-COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxctl* /assets/downloads/cli/
+COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxctl-*.tar.gz /assets/downloads/cli/
+COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxctl /stackrox/roxctl
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/kubernetes-sensor /stackrox/bin/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/sensor-upgrader /stackrox/bin/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/admission-control /stackrox/bin/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/config-controller /stackrox/bin/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxagent /stackrox/bin/
+COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/central-worker /stackrox/bin/
 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /stackrox/
-RUN GOARCH=$(uname -m) ; \
-    case $GOARCH in x86_64) GOARCH=amd64 ;; aarch64) GOARCH=arm64 ;; esac ; \
-    ln -s /assets/downloads/cli/roxctl-linux-$GOARCH /stackrox/roxctl
 
 ARG BUILD_TAG
 
diff --git a/image/roxctl/konflux.Dockerfile b/image/roxctl/konflux.Dockerfile
index 06c467e9f080f..c52eb5d654c53 100644
--- a/image/roxctl/konflux.Dockerfile
+++ b/image/roxctl/konflux.Dockerfile
@@ -4,7 +4,7 @@
 # - https://issues.redhat.com/browse/RHTAPBUGS-864 - deprecated-base-image-check behaves incorrectly.
 # - https://issues.redhat.com/browse/RHTAPBUGS-865 - openshift-golang-builder is not considered to be a valid base image.
 #
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:3ca2c34c83e6563fa574b7c7ecda92a5fdae2ec7a5f37a408e5e383947fb1957 AS builder
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:e74b03198cccc24c24a27071ad4d6c2edcfe0bb10c6de99c609ce6e3c06d6d04 AS builder
 
 WORKDIR /go/src/github.com/stackrox/rox/app
 
@@ -25,9 +25,9 @@ ENV GOEXPERIMENT=strictfipsruntime
 RUN RACE=0 CGO_ENABLED=1 GOOS=linux GOARCH=$(go env GOARCH) scripts/go-build.sh ./roxctl && \
     cp bin/linux_$(go env GOARCH)/roxctl image/bin/roxctl
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95 AS ubi-micro-base
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:5be877a2a280ae36eb9ab80ca4efb28bbf77c57abbba38137cdc37a03b8465e6 AS ubi-micro-base
 
-FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:bcbf1fe577df63bd975ea19ebae604b5f072e1833b2bde417a0ffd4afd938b96 AS package_installer
+FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:16e9e43d99e181463513cc84a514859b1abb9460f1c4d9e208da4b4e51cd5cc3 AS package_installer
 
 # Copy ubi-micro base to /out/ to preserve its rpmdb
 COPY --from=ubi-micro-base / /out/
@@ -37,7 +37,7 @@ COPY --from=ubi-micro-base / /out/
 # prefetched by Hermeto/Cachi2, instead of installroot's default UBI repos.
 RUN dnf install -y \
     --installroot=/out/ \
-    --releasever=8 \
+    --releasever=9 \
     --setopt=install_weak_deps=False \
     --setopt=reposdir=/etc/yum.repos.d \
     --nodocs \
diff --git a/image/templates/common/setup-scanner.sh b/image/templates/common/setup-scanner.sh
deleted file mode 100755
index eace4888c7d64..0000000000000
--- a/image/templates/common/setup-scanner.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)"
-
-KUBE_COMMAND=${KUBE_COMMAND:-{{.K8sConfig.Command}}}
-NAMESPACE="${ROX_NAMESPACE:-stackrox}"
-
-${KUBE_COMMAND} get namespace "$NAMESPACE" &>/dev/null || ${KUBE_COMMAND} create namespace "$NAMESPACE"
-${KUBE_COMMAND} annotate "namespace/${NAMESPACE}" --overwrite openshift.io/node-selector=""
-
-if ! ${KUBE_COMMAND} get secret/{{.K8sConfig.ScannerSecretName}} -n "$NAMESPACE" > /dev/null; then
-  registry_auth="$("${DIR}/docker-auth.sh" -m k8s "{{.K8sConfig.ScannerRegistry}}")"
-  [[ -n "$registry_auth" ]] || { echo >&2 "Unable to get registry auth info." ; exit 1 ; }
-  ${KUBE_COMMAND} create --namespace "$NAMESPACE" -f - <<EOF
-apiVersion: v1
-data:
-  .dockerconfigjson: ${registry_auth}
-kind: Secret
-metadata:
-  name: {{.K8sConfig.ScannerSecretName}}
-  namespace: "$NAMESPACE"
-  labels:
-    app.kubernetes.io/name: stackrox
-type: kubernetes.io/dockerconfigjson
-EOF
-fi
diff --git a/image/templates/common/setup.sh b/image/templates/common/setup.sh
index 4621967793d60..f0db17b406c7f 100644
--- a/image/templates/common/setup.sh
+++ b/image/templates/common/setup.sh
@@ -39,22 +39,3 @@ metadata:
 type: kubernetes.io/dockerconfigjson
 EOF
 fi
-
-{{ if ne .K8sConfig.ScannerSecretName "stackrox" }}
-if ! ${KUBE_COMMAND} get secret/{{.K8sConfig.ScannerSecretName}} -n "$NAMESPACE" > /dev/null; then
-  registry_auth="$("${DIR}/docker-auth.sh" -m k8s "{{.K8sConfig.ScannerRegistry}}")"
-  [[ -n "$registry_auth" ]] || { echo >&2 "Unable to get registry auth info." ; exit 1 ; }
-  ${KUBE_COMMAND} create --namespace "$NAMESPACE" -f - <<EOF
-apiVersion: v1
-data:
-  .dockerconfigjson: ${registry_auth}
-kind: Secret
-metadata:
-  name: {{.K8sConfig.ScannerSecretName}}
-  namespace: "$NAMESPACE"
-  labels:
-    app.kubernetes.io/name: stackrox
-type: kubernetes.io/dockerconfigjson
-EOF
-fi
-{{ end }}
diff --git a/image/templates/helm/shared/config-templates/scanner-v4/indexer-config.yaml.tpl b/image/templates/helm/shared/config-templates/scanner-v4/indexer-config.yaml.tpl
index c5d28fc97879a..78b2f322eda80 100644
--- a/image/templates/helm/shared/config-templates/scanner-v4/indexer-config.yaml.tpl
+++ b/image/templates/helm/shared/config-templates/scanner-v4/indexer-config.yaml.tpl
@@ -11,7 +11,7 @@ indexer:
   enable: true
   database:
     conn_string: >
-      host=scanner-v4-db.{{ .Release.Namespace }}.svc
+      host=scanner-v4-db.{{ ._rox._namespace }}.svc
       port=5432
       sslrootcert=/run/secrets/stackrox.io/certs/ca.pem
       user=postgres
@@ -29,11 +29,11 @@ indexer:
     password_file: /run/secrets/stackrox.io/secrets/password
   get_layer_timeout: 1m
   {{- if ._rox.env.centralServices }}
-  repository_to_cpe_url: https://central.{{ .Release.Namespace }}.svc/api/extensions/scannerdefinitions?file=repo2cpe
-  name_to_repos_url: https://central.{{ .Release.Namespace }}.svc/api/extensions/scannerdefinitions?file=name2repos
+  repository_to_cpe_url: https://central.{{ ._rox._namespace }}.svc/api/extensions/scannerdefinitions?file=repo2cpe
+  name_to_repos_url: https://central.{{ ._rox._namespace }}.svc/api/extensions/scannerdefinitions?file=name2repos
   {{- else }}
-  repository_to_cpe_url: https://sensor.{{ .Release.Namespace }}.svc/scanner/definitions?file=repo2cpe
-  name_to_repos_url: https://sensor.{{ .Release.Namespace }}.svc/scanner/definitions?file=name2repos
+  repository_to_cpe_url: https://sensor.{{ ._rox._namespace }}.svc/scanner/definitions?file=repo2cpe
+  name_to_repos_url: https://sensor.{{ ._rox._namespace }}.svc/scanner/definitions?file=name2repos
   {{- end }}
   repository_to_cpe_file: /run/mappings/repository-to-cpe.json
   name_to_repos_file: /run/mappings/container-name-repos-map.json
diff --git a/image/templates/helm/shared/config-templates/scanner-v4/matcher-config.yaml.tpl b/image/templates/helm/shared/config-templates/scanner-v4/matcher-config.yaml.tpl
index 95b08b2c5275b..4f0545a43e912 100644
--- a/image/templates/helm/shared/config-templates/scanner-v4/matcher-config.yaml.tpl
+++ b/image/templates/helm/shared/config-templates/scanner-v4/matcher-config.yaml.tpl
@@ -13,7 +13,7 @@ matcher:
   enable: true
   database:
     conn_string: >
-      host=scanner-v4-db.{{ .Release.Namespace }}.svc
+      host=scanner-v4-db.{{ ._rox._namespace }}.svc
       port=5432
       sslrootcert=/run/secrets/stackrox.io/certs/ca.pem
       user=postgres
@@ -29,8 +29,8 @@ matcher:
 {{- end }}
       client_encoding=UTF8
     password_file: /run/secrets/stackrox.io/secrets/password
-  vulnerabilities_url: https://central.{{ .Release.Namespace }}.svc/api/extensions/scannerdefinitions?version=ROX_VULNERABILITY_VERSION
-  indexer_addr: scanner-v4-indexer.{{ .Release.Namespace }}.svc:8443
+  vulnerabilities_url: https://central.{{ ._rox._namespace }}.svc/api/extensions/scannerdefinitions?version=ROX_VULNERABILITY_VERSION
+  indexer_addr: scanner-v4-indexer.{{ ._rox._namespace }}.svc:8443
 log_level: "{{ ._rox.scannerV4.matcher.logLevel }}"
 grpc_listen_addr: 0.0.0.0:8443
 http_listen_addr: 0.0.0.0:9443
diff --git a/image/templates/helm/shared/config-templates/scanner/config.yaml.tpl b/image/templates/helm/shared/config-templates/scanner/config.yaml.tpl
deleted file mode 100644
index 5efc0b979b511..0000000000000
--- a/image/templates/helm/shared/config-templates/scanner/config.yaml.tpl
+++ /dev/null
@@ -1,48 +0,0 @@
-{{- /*
-  This is the configuration file template for Scanner.
-  Except for in extremely rare circumstances, you DO NOT need to modify this file.
-  All config options that are possibly dynamic are templated out and can be modified
-  via `--set`/values-files specified via `-f`.
-     */ -}}
-
-# Configuration file for scanner.
-
-scanner:
-  centralEndpoint: https://central.{{ .Release.Namespace }}.svc
-  sensorEndpoint: https://sensor.{{ .Release.Namespace }}.svc
-  database:
-    # Database driver
-    type: pgsql
-    options:
-      # PostgreSQL Connection string
-      # https://www.postgresql.org/docs/current/static/libpq-connect.html#LIBPQ-CONNSTRING
-      source: host=scanner-db.{{ .Release.Namespace }}.svc port=5432 user=postgres sslmode={{- if eq .Release.Namespace "stackrox" }}verify-full{{- else }}verify-ca{{- end }} statement_timeout=60000
-
-      # Number of elements kept in the cache
-      # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
-      cachesize: 16384
-
-  api:
-    httpsPort: 8080
-    grpcPort: 8443
-
-  updater:
-    # Frequency with which the scanner will poll for vulnerability updates.
-    interval: 5m
-
-  logLevel: {{ ._rox.scanner.logLevel }}
-
-  # The scanner intentionally avoids extracting or analyzing any files
-  # larger than the following default sizes to prevent DoS attacks.
-  # Leave these commented to use a reasonable default.
-
-  # The max size of files in images that are extracted.
-  # Increasing this number increases memory pressure.
-  # maxExtractableFileSizeMB: 200
-  # The max size of ELF executable files that are analyzed.
-  # Increasing this number may increase disk pressure.
-  # maxELFExecutableFileSizeMB: 800
-  # The max size of image file reader buffer. Image file data beyond this limit are overflowed to temporary files on disk.
-  # maxImageFileReaderBufferSizeMB: 100
-
-  exposeMonitoring: false
diff --git a/image/templates/helm/shared/internal/scanner-config-shape.yaml b/image/templates/helm/shared/internal/scanner-config-shape.yaml
deleted file mode 100644
index 1a5d26f857892..0000000000000
--- a/image/templates/helm/shared/internal/scanner-config-shape.yaml
+++ /dev/null
@@ -1,44 +0,0 @@
-scanner:
-  mode: null # string
-  disable: null # bool
-  replicas: null # int
-  logLevel: null # string
-  nodeSelector: null # string | dict
-  dbNodeSelector: null # string | dict
-  tolerations: null # [dict]
-  dbTolerations: null # [dict]
-  hostAliases: null # [dict]
-  dbHostAliases: null # [dict]
-  autoscaling:
-    disable: null # bool
-    minReplicas: null # int
-    maxReplicas: null # int
-  affinity: null # dict
-  priorityClassName: null # string
-  dbPriorityClassName: null # string
-  resources: null # string | dict
-  image:
-    registry: null # string
-    name: null # string
-    tag: null # string
-    fullRef: null # string
-  dbImage:
-    registry: null # string
-    name: null # string
-    tag: null # string
-    fullRef: null # string
-  dbResources: null # string | dict
-  dbPassword:
-    value: null # string
-    generate: null # bool
-  serviceTLS:
-    cert: null # string
-    key: null # string
-    generate: null # bool
-  dbServiceTLS:
-    cert: null # string
-    key: null # string
-    generate: null # bool
-  exposeMonitoring: null # bool
-system:
-  enablePodSecurityPolicies: null # bool
diff --git a/image/templates/helm/shared/templates/02-scanner-00-serviceaccount.yaml b/image/templates/helm/shared/templates/02-scanner-00-serviceaccount.yaml
deleted file mode 100644
index dad761ae15242..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-00-serviceaccount.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable -}}
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: scanner
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "serviceaccount" "scanner") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "serviceaccount" "scanner") | nindent 4 }}
-{{- if ._rox.imagePullSecrets._names }}
-imagePullSecrets:
-{{- range $secretName := ._rox.imagePullSecrets._names }}
-- name: {{ quote $secretName }}
-{{- end }}
-{{- end }}
-
-{{ end -}}
diff --git a/image/templates/helm/shared/templates/02-scanner-01-psps.yaml b/image/templates/helm/shared/templates/02-scanner-01-psps.yaml
deleted file mode 100644
index 23b398c8fa032..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-01-psps.yaml
+++ /dev/null
@@ -1,69 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if and (not ._rox.scanner.disable) ._rox.system.enablePodSecurityPolicies }}
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "srox.globalResourceName" (list . "stackrox-scanner-psp") }}
-  labels:
-    {{- include "srox.labels" (list . "clusterrole" "stackrox-scanner-psp") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "clusterrole" "stackrox-scanner-psp") | nindent 4 }}
-rules:
-- apiGroups:
-  - policy
-  resources:
-  - podsecuritypolicies
-  resourceNames:
-  - {{ include "srox.globalResourceName" (list . "stackrox-scanner") }}
-  verbs:
-  - use
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: stackrox-scanner-psp
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "rolebinding" "stackrox-scanner-psp") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "rolebinding" "stackrox-scanner-psp") | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "srox.globalResourceName" (list . "stackrox-scanner-psp") }}
-subjects:
-  - kind: ServiceAccount
-    name: scanner
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: {{ include "srox.globalResourceName" (list . "stackrox-scanner") }}
-  labels:
-    {{- include "srox.labels" (list . "podsecuritypolicy" "stackrox-scanner") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "podsecuritypolicy" "stackrox-scanner") | nindent 4 }}
-spec:
-  privileged: false
-  allowPrivilegeEscalation: false
-  volumes:
-    - 'configMap'
-    - 'emptyDir'
-    - 'projected'
-    - 'secret'
-    - 'downwardAPI'
-    - 'persistentVolumeClaim'
-  hostNetwork: false
-  hostIPC: false
-  hostPID: false
-  runAsUser:
-    rule: 'RunAsAny'
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'RunAsAny'
-  fsGroup:
-    rule: 'RunAsAny'
-{{- end }}
diff --git a/image/templates/helm/shared/templates/02-scanner-01-security.yaml b/image/templates/helm/shared/templates/02-scanner-01-security.yaml
deleted file mode 100644
index 05ff6f1adeecf..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-01-security.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable }}
-
-{{- if ._rox.env.openshift }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: use-scanner-scc
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "role" "use-scanner-scc") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "role" "use-scanner-scc") | nindent 4 }}
-rules:
-- apiGroups:
-  - security.openshift.io
-  resources:
-  - securitycontextconstraints
-  resourceNames:
-  - nonroot-v2
-  verbs:
-  - use
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: scanner-use-scc
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "rolebinding" "scanner-use-scc") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "rolebinding" "scanner-use-scc") | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: use-scanner-scc
-subjects:
-- kind: ServiceAccount
-  name: scanner
-  namespace: {{ .Release.Namespace }}
-{{- end }}
-
-{{- end }}
diff --git a/image/templates/helm/shared/templates/02-scanner-02-db-password-secret.yaml b/image/templates/helm/shared/templates/02-scanner-02-db-password-secret.yaml
deleted file mode 100644
index c6c0bc176c023..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-02-db-password-secret.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable -}}
-
-{{- if ._rox.scanner._dbPassword -}}
-{{- if not (kindIs "invalid" ._rox.scanner._dbPassword.value) -}}
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: scanner-db-password
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "secret" "scanner-db-password") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "secret" "scanner-db-password") | nindent 4 }}
-    "helm.sh/hook": "pre-install,pre-upgrade"
-    "helm.sh/resource-policy": keep
-type: Opaque
-stringData:
-  password: |
-    {{- ._rox.scanner._dbPassword.value | nindent 4 }}
-
-{{- end -}}
-{{- end -}}
-
-{{ end -}}
diff --git a/image/templates/helm/shared/templates/02-scanner-03-tls-secret.yaml b/image/templates/helm/shared/templates/02-scanner-03-tls-secret.yaml
deleted file mode 100644
index 659d3a1224d04..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-03-tls-secret.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable -}}
-
-{{- if and ._rox.scanner._serviceTLS ._rox._ca -}}
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: scanner-tls
-  namespace: {{ .Release.Namespace }}
-  labels:
-    rhacs.redhat.com/tls: "true"
-    {{- include "srox.labels" (list . "secret" "scanner-tls") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "secret" "scanner-tls") | nindent 4 }}
-    "helm.sh/hook": "pre-install,pre-upgrade"
-    "helm.sh/resource-policy": keep
-type: Opaque
-stringData:
-  ca.pem: |
-    {{- ._rox._ca.Cert | nindent 4 }}
-  cert.pem: |
-    {{- ._rox.scanner._serviceTLS.Cert | nindent 4 }}
-  key.pem: |
-    {{- ._rox.scanner._serviceTLS.Key | nindent 4 }}
-
----
-
-{{- end }}
-
-{{ if and ._rox.scanner._dbServiceTLS ._rox._ca -}}
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: scanner-db-tls
-  namespace: {{ .Release.Namespace }}
-  labels:
-    rhacs.redhat.com/tls: "true"
-    {{- include "srox.labels" (list . "secret" "scanner-db-tls") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "secret" "scanner-db-tls") | nindent 4 }}
-    "helm.sh/hook": "pre-install,pre-upgrade"
-    "helm.sh/resource-policy": "keep"
-type: Opaque
-stringData:
-  ca.pem: |
-    {{- ._rox._ca.Cert | nindent 4 }}
-  cert.pem: |
-    {{- ._rox.scanner._dbServiceTLS.Cert | nindent 4 }}
-  key.pem: |
-    {{- ._rox.scanner._dbServiceTLS.Key | nindent 4 }}
-
-{{- end -}}
-
-{{ end -}}
diff --git a/image/templates/helm/shared/templates/02-scanner-04-scanner-config.yaml b/image/templates/helm/shared/templates/02-scanner-04-scanner-config.yaml
deleted file mode 100644
index 4ed16c779e60b..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-04-scanner-config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable -}}
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: scanner-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "configmap" "scanner-config") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "configmap" "scanner-config") | nindent 4 }}
-data:
-  config.yaml: |
-    {{- tpl (.Files.Get "config-templates/scanner/config.yaml.tpl") . | nindent 4 }}
-
-{{ end -}}
diff --git a/image/templates/helm/shared/templates/02-scanner-05-network-policy.yaml b/image/templates/helm/shared/templates/02-scanner-05-network-policy.yaml
deleted file mode 100644
index a61b59ecbd485..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-05-network-policy.yaml
+++ /dev/null
@@ -1,91 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if ._rox.network.enableNetworkPolicies -}}
-{{- if not ._rox.scanner.disable -}}
-
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: scanner
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "networkpolicy" "scanner") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "networkpolicy" "scanner") | nindent 4 }}
-spec:
-  podSelector:
-    matchLabels:
-      app: scanner
-  ingress:
-  - from:
-    - podSelector:
-        matchLabels:
-          app: central
-    ports:
-    - port: 8080
-      protocol: TCP
-    - port: 8443
-      protocol: TCP
-  - from:
-    - podSelector:
-        matchLabels:
-          app: sensor
-    ports:
-    - port: 8080
-      protocol: TCP
-    - port: 8443
-      protocol: TCP
-  policyTypes:
-    - Ingress
-
----
-
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: scanner-db
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "networkpolicy" "scanner-db") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "networkpolicy" "scanner-db") | nindent 4 }}
-spec:
-  podSelector:
-    matchLabels:
-      app: scanner-db
-  ingress:
-  - from:
-    - podSelector:
-        matchLabels:
-          app: scanner
-    ports:
-    - port: 5432
-      protocol: TCP
-  policyTypes:
-    - Ingress
-
-{{ end -}}
-
-{{ if ._rox.scanner.exposeMonitoring }}
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: scanner-monitoring
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "networkpolicy" "scanner-monitoring") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "networkpolicy" "scanner-monitoring") | nindent 4 }}
-spec:
-  ingress:
-  - ports:
-    - port: 9090
-      protocol: TCP
-  podSelector:
-    matchLabels:
-      app: scanner
-  policyTypes:
-    - Ingress
-{{ end }}
-{{ end }}
diff --git a/image/templates/helm/shared/templates/02-scanner-06-deployment.yaml.htpl b/image/templates/helm/shared/templates/02-scanner-06-deployment.yaml.htpl
deleted file mode 100644
index 00639a70b54ef..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-06-deployment.yaml.htpl
+++ /dev/null
@@ -1,313 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable -}}
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: scanner
-    {{- include "srox.labels" (list . "deployment" "scanner") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "deployment" "scanner") | nindent 4 }}
-spec:
-  {{- if ._rox.scanner.autoscaling.disable }}
-  replicas: {{ ._rox.scanner.replicas }}
-  {{- end }}
-  minReadySeconds: 15
-  selector:
-    matchLabels:
-      app: scanner
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      namespace: {{ .Release.Namespace }}
-      labels:
-        app: scanner
-        {{- include "srox.podLabels" (list . "deployment" "scanner") | nindent 8 }}
-      annotations:
-        {{- include "srox.podAnnotations" (list . "deployment" "scanner") | nindent 8 }}
-        {{- if eq ._rox.env.openshift 4 }}
-        openshift.io/required-scc: nonroot-v2
-        {{- end }}
-    spec:
-      {{- if ._rox.scanner._nodeSelector }}
-      nodeSelector:
-        {{- ._rox.scanner._nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if ._rox.scanner.tolerations }}
-      tolerations:
-        {{- toYaml ._rox.scanner.tolerations | nindent 8 }}
-      {{- end }}
-      {{- if ._rox.scanner.hostAliases }}
-      hostAliases: {{ toYaml ._rox.scanner.hostAliases | nindent 8 }}
-      {{- end }}
-      affinity:
-        {{- toYaml ._rox.scanner.affinity | nindent 8 }}
-      {{- if ._rox.scanner.priorityClassName }}
-      priorityClassName: {{ ._rox.scanner.priorityClassName }}
-      {{- end }}
-      containers:
-      - name: scanner
-        {{ if eq ._rox.scanner.mode "slim" -}}
-        image: {{ ._rox.scanner.slimImage.fullRef | quote }}
-        {{ else }}
-        image: {{ ._rox.scanner.image.fullRef | quote }}
-        {{ end -}}
-        env:
-        - name: ROX_MEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        {{- if ._rox.env.openshift }}
-        - name: ROX_OPENSHIFT_API
-          value: "true"
-        {{- end}}
-        {{- include "srox.envVars" (list . "deployment" "scanner" "scanner") | nindent 8 }}
-        resources:
-          {{- ._rox.scanner._resources | nindent 10 }}
-        command:
-        - /entrypoint.sh
-        ports:
-        - name: https
-          containerPort: 8080
-        - name: grpc
-          containerPort: 8443
-        {{ if ._rox.scanner.exposeMonitoring -}}
-        - name: monitoring
-          containerPort: 9090
-        {{- end}}
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop: ["NET_RAW"]
-          runAsUser: 65534
-        readinessProbe:
-          httpGet:
-            scheme: HTTPS
-            path: /scanner/ping
-            port: 8080
-          timeoutSeconds: 10
-          periodSeconds: 10
-          failureThreshold: 6
-          successThreshold: 1
-        volumeMounts:
-        - name: scanner-etc-ssl-volume
-          mountPath: /etc/ssl
-        - name: scanner-etc-pki-volume
-          mountPath: /etc/pki/ca-trust
-        - name: additional-ca-volume
-          mountPath: /usr/local/share/ca-certificates/
-          readOnly: true
-        - name: scanner-config-volume
-          mountPath: /etc/scanner
-          readOnly: true
-        - name: certs
-          mountPath: /run/secrets/stackrox.io/certs/
-          readOnly: true
-        - name: vuln-temp-db
-          mountPath: /var/lib/stackrox
-        - name: proxy-config-volume
-          mountPath: /run/secrets/stackrox.io/proxy-config/
-          readOnly: true
-        - name: scanner-db-password
-          mountPath: /run/secrets/stackrox.io/secrets
-          readOnly: true
-        {{- include "srox.injectedCABundleVolumeMount" . | nindent 8 }}
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-      serviceAccountName: scanner
-      volumes:
-      - name: additional-ca-volume
-        secret:
-          defaultMode: 420
-          optional: true
-          {{- if eq ._rox.scanner.mode "slim" }}
-          secretName: additional-ca-sensor
-          {{- else }}
-          secretName: additional-ca
-          {{- end }}
-      - name: scanner-etc-ssl-volume
-        emptyDir: {}
-      - name: scanner-etc-pki-volume
-        emptyDir: {}
-      - name: scanner-config-volume
-        configMap:
-          name: scanner-config
-      - name: certs
-        secret:
-          secretName: {{ (default false ._rox._securedClusterCertRefresh) | ternary "tls-cert-scanner" "scanner-tls" }}
-      - name: vuln-temp-db
-        emptyDir: {}
-      - name: proxy-config-volume
-        secret:
-          secretName: proxy-config
-          optional: true
-      - name: scanner-db-password
-        secret:
-          secretName: scanner-db-password
-      {{- include "srox.injectedCABundleVolume" . | nindent 6 }}
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner-db
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: scanner-db
-    {{- include "srox.labels" (list . "deployment" "scanner-db") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "deployment" "scanner-db") | nindent 4 }}
-spec:
-  replicas: 1
-  minReadySeconds: 15
-  selector:
-    matchLabels:
-      app: scanner-db
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      namespace: {{ .Release.Namespace }}
-      labels:
-        app: scanner-db
-        {{- include "srox.podLabels" (list . "deployment" "scanner-db") | nindent 8 }}
-      annotations:
-        {{- include "srox.podAnnotations" (list . "deployment" "scanner-db") | nindent 8 }}
-        {{- if eq ._rox.env.openshift 4 }}
-        openshift.io/required-scc: nonroot-v2
-        {{- end }}
-    spec:
-      {{- if ._rox.scanner._dbNodeSelector }}
-      nodeSelector:
-        {{- ._rox.scanner._dbNodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if ._rox.scanner.dbHostAliases }}
-      hostAliases: {{ toYaml ._rox.scanner.dbHostAliases | nindent 8 }}
-      {{- end }}
-      {{- if ._rox.scanner.dbTolerations }}
-      tolerations:
-        {{- toYaml ._rox.scanner.dbTolerations | nindent 8 }}
-      {{- end }}
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            # ScannerDB is single-homed, so avoid preemptible nodes.
-            - weight: 100
-              preference:
-                matchExpressions:
-                  - key: cloud.google.com/gke-preemptible
-                    operator: NotIn
-                    values:
-                    - "true"
-            - weight: 50
-              preference:
-                matchExpressions:
-                  - key: node-role.kubernetes.io/infra
-                    operator: Exists
-            - weight: 25
-              preference:
-                matchExpressions:
-                  - key: node-role.kubernetes.io/compute
-                    operator: Exists
-            - weight: 100
-              preference:
-                matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: DoesNotExist
-      {{- if ._rox.scanner.dbPriorityClassName }}
-      priorityClassName: {{ ._rox.scanner.dbPriorityClassName }}
-      {{- end }}
-      initContainers:
-      - name: init-db
-        {{ if eq ._rox.scanner.mode "slim" -}}
-        image: {{ ._rox.scanner.slimDBImage.fullRef | quote }}
-        {{ else -}}
-        image: {{ ._rox.scanner.dbImage.fullRef | quote }}
-        {{ end -}}
-        env:
-          - name: POSTGRES_PASSWORD_FILE
-            value: "/run/secrets/stackrox.io/secrets/password"
-          - name: ROX_SCANNER_DB_INIT
-            value: "true"
-        resources:
-          {{- ._rox.scanner._dbResources | nindent 12 }}
-        volumeMounts:
-          - name: scanner-db-data
-            mountPath: /var/lib/postgresql/data
-          - name: certs
-            mountPath: /run/secrets/stackrox.io/certs
-            readOnly: true
-          - name: scanner-db-password
-            mountPath: /run/secrets/stackrox.io/secrets
-            readOnly: true
-        securityContext:
-          allowPrivilegeEscalation: false
-      containers:
-      - name: db
-        {{ if eq ._rox.scanner.mode "slim" -}}
-        image: {{ ._rox.scanner.slimDBImage.fullRef | quote }}
-        {{ else -}}
-        image: {{ ._rox.scanner.dbImage.fullRef | quote }}
-        {{ end -}}
-        env:
-          {{- include "srox.envVars" (list . "deployment" "scanner-db" "db") | nindent 10 }}
-        ports:
-        - name: tcp-postgresql
-          protocol: TCP
-          containerPort: 5432
-        resources:
-          {{- ._rox.scanner._dbResources | nindent 10 }}
-        securityContext:
-          allowPrivilegeEscalation: false
-        volumeMounts:
-          - name: scanner-db-data
-            mountPath: /var/lib/postgresql/data
-          - name: certs
-            mountPath: /run/secrets/stackrox.io/certs
-            readOnly: true
-      serviceAccountName: scanner
-      securityContext:
-        fsGroup: 70
-        runAsGroup: 70
-        runAsNonRoot: true
-        runAsUser: 70
-      volumes:
-      - name: scanner-config-volume
-        configMap:
-          name: scanner-config
-      - name: certs
-        secret:
-          secretName: {{ (default false ._rox._securedClusterCertRefresh) | ternary "tls-cert-scanner-db" "scanner-db-tls" }}
-          defaultMode: 0640
-          items:
-          - key: cert.pem
-            path: server.crt
-          - key: key.pem
-            path: server.key
-          - key: ca.pem
-            path: root.crt
-      - name: scanner-db-data
-        emptyDir: {}
-      - name: scanner-db-password
-        secret:
-          secretName: scanner-db-password
-
-{{ end -}}
diff --git a/image/templates/helm/shared/templates/02-scanner-07-service.yaml b/image/templates/helm/shared/templates/02-scanner-07-service.yaml
deleted file mode 100644
index ca9b921da730b..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-07-service.yaml
+++ /dev/null
@@ -1,51 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable -}}
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: scanner
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "service" "scanner") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "service" "scanner") | nindent 4 }}
-spec:
-  ports:
-    - name: https-scanner
-      port: 8080
-      targetPort: 8080
-    - name: grpcs-scanner
-      port: 8443
-      targetPort: 8443
-    {{ if ._rox.scanner.exposeMonitoring -}}
-    - name: monitoring
-      port: 9090
-      targetPort: monitoring
-    {{- end}}
-  selector:
-    app: scanner
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: scanner-db
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "service" "scanner-db") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "service" "scanner-db") | nindent 4 }}
-spec:
-  ports:
-    - name: tcp-db
-      port: 5432
-      targetPort: 5432
-  selector:
-    app: scanner-db
-  type: ClusterIP
-
-{{ end -}}
diff --git a/image/templates/helm/shared/templates/02-scanner-08-hpa.yaml b/image/templates/helm/shared/templates/02-scanner-08-hpa.yaml
deleted file mode 100644
index c7af476a189f9..0000000000000
--- a/image/templates/helm/shared/templates/02-scanner-08-hpa.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if not ._rox.scanner.disable -}}
-
-{{- if not ._rox.scanner.autoscaling.disable -}}
-apiVersion: autoscaling/v1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: scanner
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "horizontalpodautoscaler" "scanner") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "horizontalpodautoscaler" "scanner") | nindent 4 }}
-spec:
-  minReplicas: {{ ._rox.scanner.autoscaling.minReplicas }}
-  maxReplicas: {{ ._rox.scanner.autoscaling.maxReplicas }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: scanner
-  targetCPUUtilizationPercentage: 150
-{{ end -}}
-
-{{ end -}}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-00-serviceaccount.yaml b/image/templates/helm/shared/templates/02-scanner-v4-00-serviceaccount.yaml
index 7dbce565b4133..101d7a9dbf226 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-00-serviceaccount.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-00-serviceaccount.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: scanner-v4
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "serviceaccount" "scanner-v4") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-01-psps.yaml b/image/templates/helm/shared/templates/02-scanner-v4-01-psps.yaml
index 14e38b4378299..a017ef6b8439d 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-01-psps.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-01-psps.yaml
@@ -24,7 +24,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: stackrox-scanner-v4-psp
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "rolebinding" "stackrox-scanner-v4-psp") | nindent 4 }}
   annotations:
@@ -36,7 +36,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: scanner-v4
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
 
 ---
 
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-01-security.yaml b/image/templates/helm/shared/templates/02-scanner-v4-01-security.yaml
index 79df5bb86ea4a..cded3003a2051 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-01-security.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-01-security.yaml
@@ -9,7 +9,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: use-scanner-v4-scc
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "role" "use-scanner-v4-scc") | nindent 4 }}
   annotations:
@@ -31,7 +31,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: scanner-v4-use-scc
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "rolebinding" "scanner-v4-use-scc") | nindent 4 }}
   annotations:
@@ -43,6 +43,6 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: scanner-v4
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   {{- end }}
 {{- end }}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-02-db-password-secret.yaml b/image/templates/helm/shared/templates/02-scanner-v4-02-db-password-secret.yaml
index a382d3eabfd20..530ba8a4f8650 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-02-db-password-secret.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-02-db-password-secret.yaml
@@ -5,7 +5,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: scanner-v4-db-password
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "secret" "scanner-v4-db-password") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-03-db-tls-secret.yaml b/image/templates/helm/shared/templates/02-scanner-v4-03-db-tls-secret.yaml
index de9eacaccbbf2..f413d00d75a90 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-03-db-tls-secret.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-03-db-tls-secret.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: scanner-v4-db-tls
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     rhacs.redhat.com/tls: "true"
     {{- include "srox.labels" (list . "secret" "scanner-v4-db-tls") | nindent 4 }}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-03-indexer-tls-secret.yaml b/image/templates/helm/shared/templates/02-scanner-v4-03-indexer-tls-secret.yaml
index 215ca93a85cdf..cdf8276c615a1 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-03-indexer-tls-secret.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-03-indexer-tls-secret.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: scanner-v4-indexer-tls
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     rhacs.redhat.com/tls: "true"
     {{- include "srox.labels" (list . "secret" "scanner-v4-indexer-tls") | nindent 4 }}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-03-matcher-tls-secret.yaml b/image/templates/helm/shared/templates/02-scanner-v4-03-matcher-tls-secret.yaml
index 00ed57012ca03..f6909ccaab52c 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-03-matcher-tls-secret.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-03-matcher-tls-secret.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: scanner-v4-matcher-tls
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     rhacs.redhat.com/tls: "true"
     {{- include "srox.labels" (list . "secret" "scanner-v4-matcher-tls") | nindent 4 }}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-04-db-config.yaml b/image/templates/helm/shared/templates/02-scanner-v4-04-db-config.yaml
index 439cfe826963a..79b062cc22a3f 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-04-db-config.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-04-db-config.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: scanner-v4-db-config
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "configmap" "scanner-v4-db-config") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-04-indexer-config.yaml b/image/templates/helm/shared/templates/02-scanner-v4-04-indexer-config.yaml
index 26705b8ec57f6..3efd971e90f5f 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-04-indexer-config.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-04-indexer-config.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: scanner-v4-indexer-config
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "configmap" "scanner-v4-indexer-config") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-04-matcher-config.yaml b/image/templates/helm/shared/templates/02-scanner-v4-04-matcher-config.yaml
index 67043678686b9..bd43e2caa2e6b 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-04-matcher-config.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-04-matcher-config.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: scanner-v4-matcher-config
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "configmap" "scanner-v4-matcher-config") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-05-db-network-policy.yaml b/image/templates/helm/shared/templates/02-scanner-v4-05-db-network-policy.yaml
index 875aba871891a..b91e677bb4528 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-05-db-network-policy.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-05-db-network-policy.yaml
@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: scanner-v4-db
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "networkpolicy" "scanner-v4-db") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-05-indexer-network-policy.yaml b/image/templates/helm/shared/templates/02-scanner-v4-05-indexer-network-policy.yaml
index 460801a9a0aa2..6b11b7a2b34e4 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-05-indexer-network-policy.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-05-indexer-network-policy.yaml
@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: scanner-v4-indexer
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "networkpolicy" "scanner-v4-indexer") | nindent 4 }}
   annotations:
@@ -48,7 +48,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: scanner-v4-indexer-monitoring
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "networkpolicy" "scanner-v4-indexer-monitoring") | nindent 4 }}
   annotations:
@@ -70,7 +70,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: scanner-v4-indexer-monitoring-tls
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "networkpolicy" "scanner-v4-indexer-monitoring-tls") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-05-matcher-network-policy.yaml b/image/templates/helm/shared/templates/02-scanner-v4-05-matcher-network-policy.yaml
index fbc3525042b91..592a1662211e5 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-05-matcher-network-policy.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-05-matcher-network-policy.yaml
@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: scanner-v4-matcher
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "networkpolicy" "scanner-v4-matcher") | nindent 4 }}
   annotations:
@@ -32,7 +32,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: scanner-v4-matcher-monitoring
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "networkpolicy" "scanner-v4-matcher-monitoring") | nindent 4 }}
   annotations:
@@ -54,7 +54,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: scanner-v4-matcher-monitoring-tls
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "networkpolicy" "scanner-v4-matcher-monitoring-tls") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-06-db-pvc.yaml b/image/templates/helm/shared/templates/02-scanner-v4-06-db-pvc.yaml
index 8b276340430a4..59bf3cf7b70fd 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-06-db-pvc.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-06-db-pvc.yaml
@@ -33,7 +33,7 @@ spec:
   accessModes:
   - ReadWriteOnce
   claimRef:
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ quote ._rox._namespace }}
     name: {{ $claimName }}
   {{- toYaml $pvcCfg.volume.volumeSpec | nindent 2 }}
 
@@ -44,7 +44,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: {{ $claimName }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     # this is used for backwards compatibility for operator if there are PVCs without annotation
     # owned by the operator it will assume they belong to the deprecated central-db
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-07-db-deployment.yaml b/image/templates/helm/shared/templates/02-scanner-v4-07-db-deployment.yaml
index f1284e334dc13..e66399b79590e 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-07-db-deployment.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-07-db-deployment.yaml
@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: scanner-v4-db
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     app: scanner-v4-db
     {{- include "srox.labels" (list . "deployment" "scanner-v4-db") | nindent 4 }}
@@ -20,7 +20,7 @@ spec:
     type: Recreate
   template:
     metadata:
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ quote ._rox._namespace }}
       labels:
         app: scanner-v4-db
         {{- include "srox.podLabels" (list . "deployment" "scanner-v4-db") | nindent 8 }}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-07-indexer-deployment.yaml b/image/templates/helm/shared/templates/02-scanner-v4-07-indexer-deployment.yaml
index 997c7bfbdead4..be7afd1b90a12 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-07-indexer-deployment.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-07-indexer-deployment.yaml
@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: scanner-v4-indexer
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     app: scanner-v4-indexer
     {{- include "srox.labels" (list . "deployment" "scanner-v4-indexer") | nindent 4 }}
@@ -22,7 +22,7 @@ spec:
     type: RollingUpdate
   template:
     metadata:
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ quote ._rox._namespace }}
       labels:
         app: scanner-v4-indexer
         {{- include "srox.podLabels" (list . "deployment" "scanner-v4-indexer") | nindent 8 }}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-07-matcher-deployment.yaml b/image/templates/helm/shared/templates/02-scanner-v4-07-matcher-deployment.yaml
index e97876b182606..9e0685786f949 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-07-matcher-deployment.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-07-matcher-deployment.yaml
@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: scanner-v4-matcher
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     app: scanner-v4-matcher
     {{- include "srox.labels" (list . "deployment" "scanner-v4-matcher") | nindent 4 }}
@@ -22,7 +22,7 @@ spec:
     type: RollingUpdate
   template:
     metadata:
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ quote ._rox._namespace }}
       labels:
         app: scanner-v4-matcher
         {{- include "srox.podLabels" (list . "deployment" "scanner-v4-matcher") | nindent 8 }}
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-08-db-service.yaml b/image/templates/helm/shared/templates/02-scanner-v4-08-db-service.yaml
index 58a663f3108a3..39ea7e2b29287 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-08-db-service.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-08-db-service.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: scanner-v4-db
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "service" "scanner-v4-db") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-08-indexer-service.yaml b/image/templates/helm/shared/templates/02-scanner-v4-08-indexer-service.yaml
index 72cbbeb7eb889..0d2a9200e84d5 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-08-indexer-service.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-08-indexer-service.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: scanner-v4-indexer
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "service" "scanner-v4-indexer") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-08-matcher-service.yaml b/image/templates/helm/shared/templates/02-scanner-v4-08-matcher-service.yaml
index 7ce2b8f1d804d..f7a7eb28b5360 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-08-matcher-service.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-08-matcher-service.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: scanner-v4-matcher
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "service" "scanner-v4-matcher") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-09-indexer-hpa.yaml b/image/templates/helm/shared/templates/02-scanner-v4-09-indexer-hpa.yaml
index 91e48325066e7..5658fba13df6c 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-09-indexer-hpa.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-09-indexer-hpa.yaml
@@ -4,7 +4,7 @@ apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
   name: scanner-v4-indexer
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "horizontalpodautoscaler" "scanner-v4-indexer") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/02-scanner-v4-09-matcher-hpa.yaml b/image/templates/helm/shared/templates/02-scanner-v4-09-matcher-hpa.yaml
index d90bfcbd281b5..7b585ca8e454c 100644
--- a/image/templates/helm/shared/templates/02-scanner-v4-09-matcher-hpa.yaml
+++ b/image/templates/helm/shared/templates/02-scanner-v4-09-matcher-hpa.yaml
@@ -4,7 +4,7 @@ apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
   name: scanner-v4-matcher
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ quote ._rox._namespace }}
   labels:
     {{- include "srox.labels" (list . "horizontalpodautoscaler" "scanner-v4-matcher") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/shared/templates/99-scanner-v4-openshift-monitoring.yaml b/image/templates/helm/shared/templates/99-scanner-v4-openshift-monitoring.yaml
index 20359701bab7b..8a68b67dd9759 100644
--- a/image/templates/helm/shared/templates/99-scanner-v4-openshift-monitoring.yaml
+++ b/image/templates/helm/shared/templates/99-scanner-v4-openshift-monitoring.yaml
@@ -22,7 +22,7 @@ spec:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
       certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
       keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
-      serverName: "scanner-v4-indexer.{{ .Release.Namespace }}.svc"
+      serverName: "scanner-v4-indexer.{{ ._rox._namespace }}.svc"
     {{- end }}
     {{- if ._rox.scannerV4._matcherEnabled }}
   - interval: 30s
@@ -33,14 +33,14 @@ spec:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
       certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
       keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
-      serverName: "scanner-v4-matcher.{{ .Release.Namespace }}.svc"
+      serverName: "scanner-v4-matcher.{{ ._rox._namespace }}.svc"
     {{- end }}
   selector:
     matchLabels:
       app.kubernetes.io/component: scanner-v4
   namespaceSelector:
     matchNames:
-    - "{{ .Release.Namespace }}"
+    - "{{ ._rox._namespace }}"
 ---
 {{/* TODO(ROX-22188): Switch to a ClusterRoleBinding to avoid leaking to
      kube-system namespace. */ -}}
@@ -60,6 +60,58 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: scanner-v4
-    namespace: "{{ .Release.Namespace }}"
+    namespace: "{{ ._rox._namespace }}"
   {{- end }}
+{{- /*
+Scanner V4 DB PVC space alerting is evaluated by the platform Prometheus, which
+scrapes the relevant metrics in every namespace.
+The rule is emitted only when the DB is PVC-backed (not for hostPath or
+emptyDir persistence).
+*/}}
+{{- if ._rox.scannerV4._dbEnabled }}
+{{- $scannerV4DBClaimName := "" -}}
+{{- with ._rox.scannerV4.db.persistence._volumeCfg -}}
+{{- with .persistentVolumeClaim -}}
+{{- $scannerV4DBClaimName = .claimName -}}
+{{- end -}}
+{{- end -}}
+{{- if $scannerV4DBClaimName }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: "scanner-v4-db-{{ .Release.Namespace }}"
+  namespace: openshift-monitoring
+  labels:
+    {{- include "srox.labels" (list . "prometheusrule" (print "scanner-v4-db-" .Release.Namespace)) | nindent 4 }}
+  annotations:
+    {{- include "srox.annotations" (list . "prometheusrule" (print "scanner-v4-db-" .Release.Namespace)) | nindent 4 }}
+spec:
+  groups:
+    - name: rhacs.scanner-v4-db
+      rules:
+        - alert: ScannerV4DBPersistentVolumeFillingUp
+          expr: |
+            kubelet_volume_stats_used_bytes{namespace="{{ ._rox._namespace }}", persistentvolumeclaim="{{ $scannerV4DBClaimName }}"}
+              / kubelet_volume_stats_capacity_bytes{namespace="{{ ._rox._namespace }}", persistentvolumeclaim="{{ $scannerV4DBClaimName }}"}
+              > 0.8
+          for: 1h
+          labels:
+            severity: warning
+          annotations:
+            summary: "Scanner V4 DB persistent volume is filling up"
+            description: "The Scanner V4 DB PVC {{ $scannerV4DBClaimName }} in namespace {{ ._rox._namespace }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full (warning threshold 80%)."
+        - alert: ScannerV4DBPersistentVolumeFillingUp
+          expr: |
+            kubelet_volume_stats_used_bytes{namespace="{{ ._rox._namespace }}", persistentvolumeclaim="{{ $scannerV4DBClaimName }}"}
+              / kubelet_volume_stats_capacity_bytes{namespace="{{ ._rox._namespace }}", persistentvolumeclaim="{{ $scannerV4DBClaimName }}"}
+              > 0.9
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Scanner V4 DB persistent volume is almost full"
+            description: "The Scanner V4 DB PVC {{ $scannerV4DBClaimName }} in namespace {{ ._rox._namespace }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full (critical threshold 90%)."
+{{- end }}
+{{- end }}
 {{- end }}
diff --git a/image/templates/helm/shared/templates/_crypto.tpl b/image/templates/helm/shared/templates/_crypto.tpl
index 4ac1face96d6c..28afe0e32dcb5 100644
--- a/image/templates/helm/shared/templates/_crypto.tpl
+++ b/image/templates/helm/shared/templates/_crypto.tpl
@@ -235,7 +235,7 @@
 {{ $ := index . 0 }}
 {{ $out := index . 1 }}
 {{ $svcName := index . 2 }}
-{{ $releaseNS := $.Release.Namespace }}
+{{ $releaseNS := $._rox._namespace }}
 {{ $sans := list }}
 {{ range $ns := list $releaseNS "stackrox" | uniq | sortAlpha }}
   {{ $baseDNS := printf "%s.%s" $svcName $ns }}
diff --git a/image/templates/helm/shared/templates/_metadata.tpl b/image/templates/helm/shared/templates/_metadata.tpl
index dc74c28239993..f77112634b9a2 100644
--- a/image/templates/helm/shared/templates/_metadata.tpl
+++ b/image/templates/helm/shared/templates/_metadata.tpl
@@ -229,23 +229,66 @@
 {{ end }}
 {{ end }}
 
-{{/* Add namespace specific prefixes for global resources to avoid resource name clashes for multi-namespace deployments. */}}
+{{/*
+  Add namespace specific prefixes for global resources to avoid resource name clashes for
+  multi-namespace deployments.
+
+  The separator between the "stackrox" base and the resource-specific suffix is
+  inferred from $name ("-" for "stackrox-foo", ":" for "stackrox:foo"). A name that is
+  exactly "stackrox" (i.e. just the base name, no suffix) is completely replaced with globalPrefix.
+   */}}
 {{- define "srox.globalResourceName" -}}
 {{- $ := index . 0 -}}
 {{- $name := index . 1 -}}
+{{- $separator := "" -}}
 
 {{- if eq $.Release.Namespace "stackrox" -}}
   {{- /* Standard namespace, use resource name as is. */ -}}
   {{- $name -}}
 {{- else -}}
-  {{- /* Add global prefix to resource name. */ -}}
+  {{- /* Infer the separator from $name. */ -}}
   {{- if hasPrefix "stackrox-" $name -}}
-    {{- printf "%s-%s" $._rox.globalPrefix (trimPrefix "stackrox-" $name) -}}
+    {{- $separator = "-" -}}
   {{- else if hasPrefix "stackrox:" $name -}}
-    {{- printf "%s:%s" $._rox.globalPrefix (trimPrefix "stackrox:" $name) -}}
+    {{- $separator = ":" -}}
+  {{- else if eq "stackrox" $name -}}
+    {{/* Keep $separator empty. */}}
   {{- else -}}
     {{- include "srox.fail" (printf "Unknown naming convention for global resource %q." $name) -}}
   {{- end -}}
+  {{- /* Add global prefix to resource name. */ -}}
+  {{- $suffix := trimPrefix (printf "stackrox%s" $separator) $name -}}
+  {{- if not $suffix -}}
+    {{- /* Bare "stackrox" base name: the global prefix already carries the namespace. */ -}}
+    {{- printf "%s" $._rox.globalPrefix -}}
+  {{- else -}}
+    {{- printf "%s%s%s" $._rox.globalPrefix $separator $suffix -}}
+  {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+  srox.optionalGlobalResourceName $ $name
+
+  Opt-in wrapper around srox.globalResourceName: it applies namespace-prefixing to a
+  global (cluster-scoped) resource name only when ._rox.namespacePrefixGlobalResources
+  is set; otherwise the static base $name is returned verbatim. The arguments are
+  forwarded unchanged to srox.globalResourceName.
+
+  This keeps namespace-prefixing of global resources opt-in: names default to stable,
+  static values (production safety) and prefixing can be enabled -- e.g. for tests that
+  deploy multiple secured clusters into different namespaces of the same cluster -- to
+  avoid cluster-scoped resource name clashes. Individual global resources opt in by
+  calling this helper instead of hard-coding a static name. This is deliberately generic
+  so further global resources can adopt it as the need arises.
+   */}}
+{{- define "srox.optionalGlobalResourceName" -}}
+{{- $ := index . 0 -}}
+{{- $name := index . 1 -}}
+{{- if $._rox.namespacePrefixGlobalResources -}}
+  {{- include "srox.globalResourceName" . -}}
+{{- else -}}
+  {{- $name -}}
 {{- end -}}
 {{- end -}}
 
diff --git a/image/templates/helm/shared/templates/_scanner-v4_defaulting.tpl b/image/templates/helm/shared/templates/_scanner-v4_defaulting.tpl
index e1a956cfc7203..dbbba0d2e978c 100644
--- a/image/templates/helm/shared/templates/_scanner-v4_defaulting.tpl
+++ b/image/templates/helm/shared/templates/_scanner-v4_defaulting.tpl
@@ -12,16 +12,7 @@
 {{- $stackroxHelm := index . 3 -}}
 
 {{- if kindIs "invalid" $scannerV4.disable -}}
-  {{/* Scanner V4 neither explicitly enabled or disabled, apply defaulting logic. */}}
-  {{/* By default Scanner V4 will be installed. */}}
+  {{/* Scanner V4 neither explicitly enabled or disabled. Default to enabled. */}}
   {{- $_ := set $scannerV4 "disable" false -}}
-  {{/* Currently there is one exception: when upgrading from a pre-4.8 version, which did not
-       install Scanner V4 by default. */}}
-  {{- $installVersionUnknown := kindIs "invalid" $stackroxHelm.installXYVersion -}}
-  {{- $upgradingFromPre4_8 := or $installVersionUnknown (semverCompare "< 4.8" $stackroxHelm.installXYVersion) -}}
-  {{- if and $helmRelease.IsUpgrade $upgradingFromPre4_8 -}}
-    {{- include "srox.note" (list $ "Scanner V4 disabled by default: this deployment was initially installed before version 4.8.") -}}
-    {{- $_ := set $scannerV4 "disable" true -}}
-  {{- end -}}
 {{- end -}}
 {{- end -}}
diff --git a/image/templates/helm/shared/templates/_scanner-v4_init.tpl.htpl b/image/templates/helm/shared/templates/_scanner-v4_init.tpl.htpl
index 323bfa442fe7f..f529c2a927b60 100644
--- a/image/templates/helm/shared/templates/_scanner-v4_init.tpl.htpl
+++ b/image/templates/helm/shared/templates/_scanner-v4_init.tpl.htpl
@@ -67,7 +67,7 @@
         {{/* And in case scanner V4 was not deployed earlier, we need to make sure that these resources are correctly initialized. */}}
         {{- if $.Release.IsUpgrade -}}
           {{- $lookupOut := dict -}}
-          {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $.Release.Namespace "scanner-v4-indexer-tls") -}}
+          {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $._rox._namespace "scanner-v4-indexer-tls") -}}
           {{- if not $lookupOut.result -}}
             {{/* If generate=null and the resource does not exist yet, attempt to create it. */}}
             {{/* If lookup is not possible (e.g. in the operator), then 'generate' needs to be set correctly. */}}
@@ -87,7 +87,7 @@
       {{/* And in case scanner V4 was not deployed earlier, we need to make sure that these resources are correctly initialized. */}}
       {{- if $.Release.IsUpgrade -}}
         {{- $lookupOut := dict -}}
-        {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $.Release.Namespace "scanner-v4-matcher-tls") -}}
+        {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $._rox._namespace "scanner-v4-matcher-tls") -}}
         {{- if not $lookupOut.result -}}
           {{/* If generate=null and the resource does not exist yet, attempt to create it. */}}
           {{/* If lookup is not possible (e.g. in the operator), then 'generate' needs to be set correctly. */}}
@@ -105,7 +105,7 @@
       {{/* And in case scanner V4 was not deployed earlier, we need to make sure that these resources are correctly initialized. */}}
       {{- if $.Release.IsUpgrade -}}
         {{- $lookupOut := dict -}}
-        {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $.Release.Namespace "scanner-v4-db-tls") -}}
+        {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $._rox._namespace "scanner-v4-db-tls") -}}
         {{- if not $lookupOut.result -}}
           {{/* If generate=null and the resource does not exist yet, attempt to create it. */}}
           {{/* If lookup is not possible (e.g. in the operator), then 'generate' needs to be set correctly. */}}
@@ -117,7 +117,7 @@
       {{/* We need special handling here, because 'generate' will default to 'false' on upgrades. */}}
       {{/* And in case scanner V4 was not deployed earlier, we need to make sure that these resources are correctly initialized. */}}
       {{- $lookupOut := dict -}}
-      {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $.Release.Namespace "scanner-v4-db-password") -}}
+      {{- $_ := include "srox.safeLookup" (list $ $lookupOut "v1" "Secret" $._rox._namespace "scanner-v4-db-password") -}}
       {{- if not $lookupOut.result -}}
         {{/* If generate=null and the resource does not exist yet, attempt to create it. */}}
         {{/* If lookup is not possible (e.g. in the operator), then 'generate' needs to be set correctly. */}}
@@ -139,7 +139,7 @@
   {{/* Special handling for the secured-cluster-services chart in case it gets deployed
        to the same namespace as central-services. */}}
   {{ $centralDeployment := dict }}
-  {{ include "srox.safeLookup" (list $ $centralDeployment "apps/v1" "Deployment" $.Release.Namespace "central") }}
+  {{ include "srox.safeLookup" (list $ $centralDeployment "apps/v1" "Deployment" $._rox._namespace "central") }}
   {{ if $centralDeployment.result }}
     {{ include "srox.note" (list $ "Detected central running in the same namespace. Not deploying scanner-v4-indexer from this chart and configuring sensor to use existing scanner-v4-indexer instance, if any.") }}
     {{ $_ := set $components "indexer" false }}
diff --git a/image/templates/helm/shared/templates/_scanner_init.tpl.htpl b/image/templates/helm/shared/templates/_scanner_init.tpl.htpl
deleted file mode 100644
index 75fbe950aa720..0000000000000
--- a/image/templates/helm/shared/templates/_scanner_init.tpl.htpl
+++ /dev/null
@@ -1,40 +0,0 @@
-{{/*
-  srox.scannerInit . $scannerConfig
-
-  Initializes the scanner configuration. The scanner chart has two modes "full" and
-  "slim".
-  The "full" mode is used for stand-alone deployments, mostly along with StackRox's Central service. In this
-  mode, the image contains vulnerability data and the Helm chart can create its own certificates.
-
-  The "slim" mode is used to deploy Scanner with a smaller image and does not generate TLS certificates,
-  typically deployed within a Secured Cluster to scan images stored in a registry only accessible to the current cluster.
-  The scanner chart defaults to "full" mode if no mode was provided.
-
-  $scannerConfig contains all values which are configured by the user. The structure can be viewed in the according
-  config-shape. See internal/scanner-config-shape.yaml.
-   */}}
-
-{{ define "srox.scannerInit" }}
-
-{{ $ := index . 0 }}
-{{ $scannerCfg := index . 1 }}
-
-{{ if or (eq $scannerCfg.mode "") (eq $scannerCfg.mode "full") }}
-    {{ include "srox.configureImage" (list $ $scannerCfg.image) }}
-    {{ include "srox.configureImage" (list $ $scannerCfg.dbImage) }}
-
-    {{ $scannerCertSpec := dict "CN" "SCANNER_SERVICE: Scanner" "dnsBase" "scanner" }}
-    {{ include "srox.configureCrypto" (list $ "scanner.serviceTLS" $scannerCertSpec) }}
-
-    {{ $scannerDBCertSpec := dict "CN" "SCANNER_DB_SERVICE: Scanner DB" "dnsBase" "scanner-db" }}
-    {{ include "srox.configureCrypto" (list $ "scanner.dbServiceTLS" $scannerDBCertSpec) }}
-{{ else if eq $scannerCfg.mode "slim" }}
-    {{ include "srox.configureImage" (list $ $scannerCfg.slimImage) }}
-    {{ include "srox.configureImage" (list $ $scannerCfg.slimDBImage) }}
-{{ else }}
-    {{ include "srox.fail" (printf "Unknown scanner mode %s" $scannerCfg.mode) }}
-{{ end }}
-
-{{ include "srox.configurePassword" (list $ "scanner.dbPassword") }}
-
-{{ end }}
diff --git a/image/templates/helm/stackrox-central/.helmtplignore.htpl b/image/templates/helm/stackrox-central/.helmtplignore.htpl
index ba663bdcd6c89..abcd039d1936a 100644
--- a/image/templates/helm/stackrox-central/.helmtplignore.htpl
+++ b/image/templates/helm/stackrox-central/.helmtplignore.htpl
@@ -1,11 +1,9 @@
 [< if eq .RenderMode "scannerOnly" >]
 !templates/_*.tpl
-!templates/02-scanner-[0-9]*.yaml
 !templates/02-scanner-v4-*.yaml
 templates/*
 [< else if eq .RenderMode "scannerTLSOnly" >]
 !templates/_*.tpl
-!templates/02-scanner-03-tls-secret.yaml
 templates/*
 [< else if eq .RenderMode "scannerV4TLSOnly" >]
 !templates/_*.tpl
diff --git a/image/templates/helm/stackrox-central/README.md.htpl b/image/templates/helm/stackrox-central/README.md.htpl
index 0512705ac7a59..6fbade7eeacf1 100644
--- a/image/templates/helm/stackrox-central/README.md.htpl
+++ b/image/templates/helm/stackrox-central/README.md.htpl
@@ -1,7 +1,7 @@
 # StackRox Kubernetes Security Platform - Central Services Helm Chart
 
 This Helm chart allows you to deploy the central services of the StackRox
-Kubernetes Security Platform: StackRox Central and StackRox Scanner.
+Kubernetes Security Platform: StackRox Central and Scanner V4.
 
 If you want to install Red Hat Advanced Cluster Security, refer to
 [Installing quickly using Helm charts](https://docs.openshift.com/acs/installing/installing_helm/install-helm-quick.html)
@@ -124,15 +124,6 @@ can be configured via those files:
       loadBalancer:
         enabled: true
   
-  scanner:
-    # Run without StackRox Scanner (NOT RECOMMENDED)
-    disable: true
-
-  scannerV4:
-    # Enable Scanner V4, which will become the default scanner for StackRox.
-    # Note that enabling Scanner V4 while having the StackRox Scanner disabled (scanner.disable=true)
-    # is not a supported configuration.
-    disable: false
   
   customize:
     # Apply the important-service=true label for all objects managed by this chart.
@@ -195,27 +186,15 @@ If, during an upgrade of the Helm release, the Helm chart needs to generate a ne
 some component, it is required to pass in the existing CA, for example by adding
 `-f generated-values.yaml` to the arguments for `helm upgrade`.
 
-### Enabling Scanner V4
+### Scanner V4
 
-Beginning with StackRox 4.4, a new scanner component based on ClairCore named Scanner V4 is integrated.
-In a future version of StackRox, Scanner V4 will become the new default scanner and replace the existing
-scanner named StackRox Scanner. Currently, Scanner V4 is not installed by default, but it
-can be enabled alongside StackRox Scanner using the following Helm chart setting:
+Scanner V4 is the vulnerability scanner for StackRox, based on ClairCore. It is enabled by default
+and can be disabled by setting:
 
 ```
 scannerV4:
-  disable: false
+  disable: true
 ```
-
-To enable Scanner V4 for an existing installation of this chart, the CA certificate
-and its key must be provided to the `helm upgrade` command.
-For example, if the CA was generated ahead of time and injected into the `helm install` command, then
-the `--reuse-values` flag for `helm upgrade` can be used to provide the certificate and key. However, if the CA was
-generated by the Helm chart at installation time, you must retrieve the generated secret
-values from the cluster (see above) and provide those to the `helm upgrade` command.
-
-Note that because Scanner V4 currently runs simultaneously with StackRox Scanner, your
-cluster must have sufficient computing resources available to host both scanner components at the same time.
 The default resource configuration for Scanner V4 components can be found in the file
 internal/defaults.yaml.
 
diff --git a/image/templates/helm/stackrox-central/config/centraldb/postgresql.conf.default b/image/templates/helm/stackrox-central/config/centraldb/postgresql.conf.default
index 6f9ab796c5950..dc29c9af950b7 100644
--- a/image/templates/helm/stackrox-central/config/centraldb/postgresql.conf.default
+++ b/image/templates/helm/stackrox-central/config/centraldb/postgresql.conf.default
@@ -1,6 +1,6 @@
 hba_file = '/etc/stackrox.d/config/pg_hba.conf'
 listen_addresses = '*'
-max_connections = 100
+max_connections = 120
 password_encryption = scram-sha-256
 
 ssl = on
diff --git a/image/templates/helm/stackrox-central/internal/bootstrap-defaults.yaml.tpl b/image/templates/helm/stackrox-central/internal/bootstrap-defaults.yaml.tpl
index 8f8e5590fc3a6..2c9a9ab40d7b4 100644
--- a/image/templates/helm/stackrox-central/internal/bootstrap-defaults.yaml.tpl
+++ b/image/templates/helm/stackrox-central/internal/bootstrap-defaults.yaml.tpl
@@ -11,6 +11,8 @@ allowNonstandardNamespace: false
 allowNonstandardReleaseName: false
 {{- end }}
 
+_namespace: {{ quote .Release.Namespace }}
+
 meta:
   useLookup: true
   fileOverrides: {}
diff --git a/image/templates/helm/stackrox-central/internal/config-shape.yaml b/image/templates/helm/stackrox-central/internal/config-shape.yaml
index 72c34ddb354fc..96dc0fc23ae7c 100644
--- a/image/templates/helm/stackrox-central/internal/config-shape.yaml
+++ b/image/templates/helm/stackrox-central/internal/config-shape.yaml
@@ -86,6 +86,8 @@ central:
     mounts:
       configMaps: null # [string]
       secrets: null # [string]
+  signingKeyBundle:
+    configMapName: null # string
   extraMounts: null # [dict]
   db:
     nodeSelector: null # string | dict
@@ -123,7 +125,7 @@ central:
       none: null # bool
     extraMounts: null # [dict]
 centralWorker:
-  enabled: false # bool
+  enabled: true # bool
   nodeSelector: null # string | dict
   tolerations: null # [dict]
   hostAliases: null # [dict]
@@ -161,18 +163,6 @@ customize:
     podLabels: {} # dict
     podAnnotations: {} # dict
     envVars: {} # dict
-  scanner:
-    labels: {} # dict
-    annotations: {} # dict
-    podLabels: {} # dict
-    podAnnotations: {} # dict
-    envVars: {} # dict
-  scanner-db:
-    labels: {} # dict
-    annotations: {} # dict
-    podLabels: {} # dict
-    podAnnotations: {} # dict
-    envVars: {} # dict
   scanner-v4-indexer:
     labels: {} # dict
     annotations: {} # dict
diff --git a/image/templates/helm/stackrox-central/internal/config.stackrox.io_securitypolicies.yaml b/image/templates/helm/stackrox-central/internal/config.stackrox.io_securitypolicies.yaml
index 6329c0e2b6373..d3a1254eabdb2 100644
--- a/image/templates/helm/stackrox-central/internal/config.stackrox.io_securitypolicies.yaml
+++ b/image/templates/helm/stackrox-central/internal/config.stackrox.io_securitypolicies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.21.0
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: securitypolicies.config.stackrox.io
 spec:
   group: config.stackrox.io
@@ -82,7 +82,11 @@ spec:
                   evaluates.
                 properties:
                   skipContainerTypes:
+                    description: SkipContainerTypes lists container kinds to skip
+                      during evaluation.
                     items:
+                      description: ContainerType lists container kinds a policy may
+                        skip during evaluation.
                       enum:
                       - REGULAR
                       - INIT
@@ -138,6 +142,23 @@ spec:
                               type: object
                           type: object
                       type: object
+                    excludeByKind:
+                      description: ExcludeByKind excludes all workloads of the selected
+                        Kubernetes kinds.
+                      properties:
+                        kinds:
+                          description: Kinds is the list of Kubernetes workload kinds
+                            to exclude.
+                          items:
+                            enum:
+                            - CRON_JOB
+                            - JOB
+                            type: string
+                          minItems: 1
+                          type: array
+                      required:
+                      - kinds
+                      type: object
                     expiration:
                       format: date-time
                       type: string
@@ -149,6 +170,11 @@ spec:
                     name:
                       type: string
                   type: object
+                  x-kubernetes-validations:
+                  - message: at most one of the fields in [deployment excludeByKind]
+                      may be set
+                    rule: (has(self.deployment)?1:0)+(has(self.excludeByKind)?1:0)
+                      <= 1
                 type: array
               isDefault:
                 description: IsDefault is unused
diff --git a/image/templates/helm/stackrox-central/internal/defaults.yaml.htpl b/image/templates/helm/stackrox-central/internal/defaults.yaml.htpl
index 969760137a7c6..79b9ced9d35f6 100644
--- a/image/templates/helm/stackrox-central/internal/defaults.yaml.htpl
+++ b/image/templates/helm/stackrox-central/internal/defaults.yaml.htpl
@@ -92,6 +92,7 @@ defaults:
           memory: "16Gi"
           cpu: "8"
   centralWorker:
+    enabled: true
     affinity:
       nodeAffinity:
         preferredDuringSchedulingIgnoredDuringExecution:
@@ -157,68 +158,6 @@ defaults:
       limits:
         memory: "128Mi"
         cpu: "500m"
-  scanner:
-    disable: false
-    replicas: 3
-    logLevel: INFO
-    mode: full
-
-    autoscaling:
-      disable: false
-      minReplicas: 2
-      maxReplicas: 5
-
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - weight: 100
-          podAffinityTerm:
-            labelSelector:
-              matchLabels:
-                app: scanner
-            topologyKey: kubernetes.io/hostname
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - weight: 50
-          preference:
-            matchExpressions:
-              - key: node-role.kubernetes.io/infra
-                operator: Exists
-        - weight: 25
-          preference:
-            matchExpressions:
-              - key: node-role.kubernetes.io/compute
-                operator: Exists
-        - weight: 100
-          preference:
-            matchExpressions:
-              - key: node-role.kubernetes.io/control-plane
-                operator: DoesNotExist
-
-    resources:
-      requests:
-        memory: "1500Mi"
-        cpu: "1000m"
-      limits:
-        memory: "4Gi"
-        cpu: "2000m"
-
-    image:
-      name: [< required "" .ScannerImageRemote >]
-      tag: [< required "" .ScannerImageTag >]
-
-    dbResources:
-      limits:
-        cpu: "2000m"
-        memory: "4Gi"
-      requests:
-        cpu: "200m"
-        memory: "512Mi"
-
-    dbImage:
-      name: [< required "" .ScannerDBImageRemote >]
-      tag: [< required "" .ScannerImageTag >]
-
   scannerV4:
     image:
       name: [< required "" .ScannerV4ImageRemote >]
diff --git a/image/templates/helm/stackrox-central/internal/expandables.yaml b/image/templates/helm/stackrox-central/internal/expandables.yaml
index 8d9beded19d05..759e3018bd375 100644
--- a/image/templates/helm/stackrox-central/internal/expandables.yaml
+++ b/image/templates/helm/stackrox-central/internal/expandables.yaml
@@ -39,19 +39,6 @@ centralWorker:
 configController:
   nodeSelector: true
   resources: true
-scanner:
-  resources: true
-  dbResources: true
-  nodeSelector: true
-  dbNodeSelector: true
-  dbPassword:
-    value: true
-  serviceTLS:
-    cert: true
-    key: true
-  dbServiceTLS:
-    cert: true
-    key: true
 scannerV4:
   indexer:
     nodeSelector: true
diff --git a/image/templates/helm/stackrox-central/templates/00-stackrox-application.yaml b/image/templates/helm/stackrox-central/templates/00-stackrox-application.yaml
deleted file mode 100644
index 3be046fa21d0c..0000000000000
--- a/image/templates/helm/stackrox-central/templates/00-stackrox-application.yaml
+++ /dev/null
@@ -1,122 +0,0 @@
-{{- include "srox.init" . -}}
-
-{{- if has "app.k8s.io/v1beta1/Application" ._rox._apiServer.apiResources -}}
-apiVersion: app.k8s.io/v1beta1
-kind: Application
-metadata:
-  name: stackrox
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "srox.labels" (list . "application" "stackrox") | nindent 4 }}
-  annotations:
-    {{- include "srox.annotations" (list . "application" "stackrox") | nindent 4 }}
-    {{ if eq ._rox.image.registry "quay.io/stackrox-io" }}
-    kubernetes-engine.cloud.google.com/icon: "data:image/png;base64,{{ .Files.Get "assets/StackRox_icon.png" | b64enc }}"
-    {{ else }}
-    kubernetes-engine.cloud.google.com/icon: "data:image/png;base64,{{ .Files.Get "assets/Red_Hat-Hat_icon.png" | b64enc }}"
-    {{ end }}
-spec:
-  descriptor:
-    type: StackRox
-    version: {{ .Chart.AppVersion | quote }}
-    description: |-
-      StackRox Kubernetes Security Platform
-
-      Version {{ .Chart.AppVersion }}
-
-      ## Thank you for installing StackRox!
-
-      <br>
-
-      #### Support
-
-      [Email support@stackrox.com](mailto:support@stackrox.com?cc=sales@stackrox.com&Subject=StackRox%20Support%20Question&Body=Dear%20StackRox%20support,)
-
-      ## Connecting to StackRox
-
-      <br>
-
-      #### Directly using a Load Balancer
-
-      When deploying StackRox with the `Load Balancer` network configuration, the service can be accessed directly.
-
-      $CONNECT
-
-      #### Tunneling via Port Forward
-
-      When deploying StackRox with the `Node Port` or `None` network configuration, the service must be accessed using a port forward tunnel.
-
-      - Step 1 - Start the port forward tunnel to the StackRox Central service.
-
-      ```
-      $ kubectl -n stackrox port-forward svc/central 8443:443
-      ```
-
-      - Step 2 - In a browser, [visit https://localhost:8443](https://localhost:8443) to access StackRox.
-
-    keywords:
-      - "stackrox"
-      - "kube"
-      - "security"
-    maintainers:
-      - name: StackRox, Inc.
-        url: https://stackrox.com
-    owners:
-      - name: StackRox, Inc.
-        url: https://stackrox.com
-    links:
-      - description: StackRox Help Documentation
-        url: "https://help.stackrox.com"
-
-  info:
-    - name: StackRox namespace
-      value: stackrox
-    - name: StackRox admin username
-      value: "admin"
-
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: stackrox
-
-  componentKinds:
-    - group: ''
-      kind: ConfigMap
-    - group: ''
-      kind: Secret
-    - group: ''
-      kind: PersistentVolumeClaim
-    - group: ''
-      kind: PersistentVolume
-    - group: ''
-      kind: Service
-    - group: ''
-      kind: ServiceAccount
-    - group: rbac.authorization.k8s.io
-      kind: ClusterRole
-    - group: rbac.authorization.k8s.io
-      kind: ClusterRoleBinding
-    - group: apps
-      kind: Deployment
-{{- if ._rox.network.enableNetworkPolicies }}
-    - group: networking.k8s.io
-      kind: NetworkPolicy
-{{- end }}
-    - group: rbac.authorization.k8s.io
-      kind: Role
-    - group: rbac.authorization.k8s.io
-      kind: RoleBinding
-    - group: route.openshift.io
-      kind: Route
-    - group: security.openshift.io
-      kind: SecurityContextConstraints
-    - group: admissionregistration.k8s.io
-      kind: ValidatingWebhookConfiguration
-    - group: autoscaling
-      kind: HorizontalPodAutoscaler
-    - group: storage.k8s.io
-      kind: StorageClass
-{{- if ._rox.system.enablePodSecurityPolicies }}
-    - group: policy
-      kind: PodSecurityPolicy
-{{- end }}
-{{- end }}
diff --git a/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml.htpl b/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml.htpl
index 0c83dce0a216b..a1118f3121512 100644
--- a/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml.htpl
+++ b/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml.htpl
@@ -147,14 +147,13 @@ spec:
         - name: ROX_SCANNER_V4
           value: "true"
         {{- end }}
-        {{- if ._rox._legacyScannerEnabled }}
-        - name: ROX_LEGACY_SCANNER
-          value: "true"
-        {{- else }}
         - name: ROX_LEGACY_SCANNER
           value: "false"
-        {{- end }}
         [<- end >]
+        {{- if ._rox.centralWorker.enabled }}
+        - name: ROX_CENTRAL_WORKER_ENABLED
+          value: "true"
+        {{- end }}
         {{- include "srox.envVars" (list . "deployment" "central" "central") | nindent 8 }}
         volumeMounts:
         - name: varlog
@@ -215,6 +214,11 @@ spec:
           mountPath: /run/secrets/stackrox.io/ocp-tls
           readOnly: true
         {{- end }}
+        {{- if ._rox.central.signingKeyBundle.configMapName }}
+        - name: signing-key-bundle
+          mountPath: /tmp/redhat-signing-keys
+          readOnly: true
+        {{- end }}
         {{- range $extraMount := (default list ._rox.central.extraMounts) }}
         - name: {{ $extraMount.name }}
           {{- $extraMount.mount | toYaml | nindent 10 }}
@@ -307,6 +311,12 @@ spec:
         secret:
           secretName: central-ocp-tls
       {{- end }}
+      {{- if ._rox.central.signingKeyBundle.configMapName }}
+      - name: signing-key-bundle
+        configMap:
+          name: {{ ._rox.central.signingKeyBundle.configMapName }}
+          optional: true
+      {{- end }}
       {{- range $extraMount := (default list ._rox.central.extraMounts) }}
       - name: {{ $extraMount.name }}
         {{- $extraMount.source | toYaml | nindent 8 }}
diff --git a/image/templates/helm/stackrox-central/templates/99-openshift-monitoring.yaml b/image/templates/helm/stackrox-central/templates/99-openshift-monitoring.yaml
index a2a6f28ff73aa..de5e7d80d88d8 100644
--- a/image/templates/helm/stackrox-central/templates/99-openshift-monitoring.yaml
+++ b/image/templates/helm/stackrox-central/templates/99-openshift-monitoring.yaml
@@ -77,6 +77,42 @@ spec:
     matchNames:
       - "{{ .Release.Namespace }}"
 
+{{- if and ._rox.monitoring.openshift.custom ._rox.monitoring.openshift.custom.enabled (not ._rox.env.managedServices) }}
+---
+
+{{- /*
+The ServiceMonitor is placed into the openshift-monitoring namespace to comply with the
+OpenShift monitoring namespace label requirements. This is an exception to the rule
+that leaking resources into system namespaces should be avoided.
+*/}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: "central-ocp-api-monitor-{{ .Release.Namespace }}"
+  namespace: openshift-monitoring
+  labels:
+    {{- include "srox.labels" (list . "servicemonitor" (print "central-ocp-api-monitor-" .Release.Namespace)) | nindent 4 }}
+  annotations:
+    {{- include "srox.annotations" (list . "servicemonitor" (print "central-ocp-api-monitor-" .Release.Namespace)) | nindent 4 }}
+spec:
+  endpoints:
+  - interval: 30s
+    path: /metrics
+    port: https
+    scheme: https
+    tlsConfig:
+      caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
+      serverName: "central-ocp.{{ .Release.Namespace }}.svc"
+  selector:
+    matchLabels:
+      stackrox.io/ocp-api: "true"
+  namespaceSelector:
+    matchNames:
+      - "{{ .Release.Namespace }}"
+
+{{- end }}
 ---
 
 {{- /*
@@ -145,5 +181,43 @@ spec:
               rox_central_secured_vcpus{branding="RHACS"}
             )
           record: rhacs:telemetry:rox_central_secured_vcpus
+{{- /*
+Central DB PVC space alerting is evaluated by the platform Prometheus in
+openshift-monitoring, which scrapes the relevant metrics in every namespace.
+The rule is emitted only when central-db is PVC-backed (not for external,
+hostPath, or emptyDir persistence).
+*/}}
+{{- $centralDBClaimName := "" -}}
+{{- with ._rox.central.db.persistence._volumeCfg -}}
+{{- with .persistentVolumeClaim -}}
+{{- $centralDBClaimName = .claimName -}}
+{{- end -}}
+{{- end -}}
+{{- if $centralDBClaimName }}
+    - name: rhacs.central-db
+      rules:
+        - alert: CentralDBPersistentVolumeFillingUp
+          expr: |
+            kubelet_volume_stats_used_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim="{{ $centralDBClaimName }}"}
+              / kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim="{{ $centralDBClaimName }}"}
+              > 0.8
+          for: 1h
+          labels:
+            severity: warning
+          annotations:
+            summary: "Central DB persistent volume is filling up"
+            description: "The Central DB PVC {{ $centralDBClaimName }} in namespace {{ .Release.Namespace }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full (warning threshold 80%)."
+        - alert: CentralDBPersistentVolumeFillingUp
+          expr: |
+            kubelet_volume_stats_used_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim="{{ $centralDBClaimName }}"}
+              / kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim="{{ $centralDBClaimName }}"}
+              > 0.9
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Central DB persistent volume is almost full"
+            description: "The Central DB PVC {{ $centralDBClaimName }} in namespace {{ .Release.Namespace }} is {{ "{{" }} $value | humanizePercentage {{ "}}" }} full (critical threshold 90%)."
+{{- end }}
 
 {{- end -}}
diff --git a/image/templates/helm/stackrox-central/templates/_init.tpl.htpl b/image/templates/helm/stackrox-central/templates/_init.tpl.htpl
index 3b235a9bb7543..dfce7350839b7 100644
--- a/image/templates/helm/stackrox-central/templates/_init.tpl.htpl
+++ b/image/templates/helm/stackrox-central/templates/_init.tpl.htpl
@@ -43,8 +43,6 @@
 {{- include "srox.checkVersionRequirements" $ -}}
 
 {{ $configShape := $.Files.Get "internal/config-shape.yaml" | fromYaml }}
-{{ $configShapeScanner := $.Files.Get "internal/scanner-config-shape.yaml" | fromYaml }}
-{{ $_ = include "srox.mergeInto" (list $configShape $configShapeScanner) }}
 
 {{ $configShapeScannerV4 := $.Files.Get "internal/scanner-v4-config-shape.yaml" | fromYaml }}
 {{ $_ = include "srox.mergeInto" (list $configShape $configShapeScannerV4) }}
@@ -269,6 +267,7 @@
 {{ $_ = set $env "_proxyConfig" $proxyCfg }}
 {{ $_ = set $._rox "_renderMode" "[< .RenderMode >]" }}
 
+
 {{/*
     Central setup.
    */}}
@@ -278,23 +277,25 @@
 [< end >]
 
 {{/*
-    Scanner setup.
+    Scanner V2 has been removed. Force disable and set legacy flag.
+
+    We detect upgrades from a previous version that had scanner v2 by checking
+    whether the incoming values contain scanner.disable=false. This is the case
+    when --reuse-values carries forward the old chart's default. After the first
+    upgrade with this chart, scanner is overwritten to {disable: true}, so
+    subsequent --reuse-values upgrades will not trigger the note again.
+    (Compare with scanner v4 defaulting, which uses cluster lookups via the
+    stackrox-central-services-helm ConfigMap to detect the install version.)
    */}}
 
-{{ $scannerCfg := $._rox.scanner }}
+{{- if and $._rox.scanner (not (kindIs "invalid" $._rox.scanner.disable)) (not $._rox.scanner.disable) -}}
+  {{- if $.Release.IsUpgrade -}}
+    {{- include "srox.note" (list $ "The legacy Scanner has been removed in this release. Scanner V4 is the sole vulnerability scanner. Existing scanner/scanner-db resources will be removed.") -}}
+  {{- else -}}
+    {{- include "srox.warn" (list $ "The legacy Scanner has been removed. The `scanner.disable` setting is ignored. Scanner V4 is the replacement.") -}}
+  {{- end -}}
+{{- end -}}
 
-{{ if and $scannerCfg.disable (or $.Release.IsInstall $.Release.IsUpgrade) }}
-  {{/* We generally don't recommend customers run without scanner, so show a warning to the user */}}
-  {{ $action := ternary "deploy StackRox Central Services without Scanner" "upgrade StackRox Central Services without Scanner (possibly removing an existing Scanner deployment)" $.Release.IsInstall }}
-  {{ include "srox.warn" (list $ (printf "You have chosen to %s. Certain features dependent on image scanning might not work." $action)) }}
-{{ else if not $scannerCfg.disable }}
-  {{ if and (ne $scannerCfg.mode "full") (ne $scannerCfg.mode "") }}
-    {{ include "srox.fail" (print "Only scanner full mode is allowed in Central. To solve this, set to full mode: scanner.mode=full.") }}
-  {{ end }}
-  {{ include "srox.scannerInit" (list $ $scannerCfg) }}
-{{ end }}
-
-{{ $_ := set $._rox "_legacyScannerEnabled" (not $scannerCfg.disable) }}
 
 {{/*
    ScannerV4 setup.
@@ -303,6 +304,11 @@
 {{ $scannerV4Cfg := $._rox.scannerV4 }}
 {{ include "srox.scannerV4Init" (list $ $scannerV4Cfg) }}
 
+{{/* Warn if scanner v4 disabled. */}}
+{{- if $._rox.scannerV4.disable -}}
+  {{ include "srox.warn" (list $ "You are installing StackRox Central Services without Scanner V4. Vulnerability scanning will not be available.") }}
+{{- end -}}
+
 {{ if $._rox.scannerV4._dbEnabled }}
   {{ include "srox.scannerV4Volume" $ }}
 {{ end }}
diff --git a/image/templates/helm/stackrox-central/values-private.yaml.example b/image/templates/helm/stackrox-central/values-private.yaml.example
index 8576ca85f1e73..9cd7da00a8a4a 100644
--- a/image/templates/helm/stackrox-central/values-private.yaml.example
+++ b/image/templates/helm/stackrox-central/values-private.yaml.example
@@ -144,39 +144,6 @@
 #         <PEM-encoded Central DB cert private key>
 #         -----END RSA PRIVATE KEY-----
 #
-# # Secret configuration options for the StackRox Scanner deployment.
-# scanner:
-#   # The password to be used for authenticating database access. This is not user-relevant
-#   # and only serves to properly secure the database with a pre-shared secret. If this
-#   # setting is omitted, a password will be automatically generated upon initial deployment,
-#   # and the existing password will be used upon upgrades.
-#   dbPassword:
-#     value: <scanner database password value>
-#
-#   # Internal "scanner.stackrox.svc" service TLS certificate for the Scanner deployment.
-#   # Omit to auto-generate (initial deployment) or use existing (upgrade).
-#   serviceTLS:
-#     cert: |
-#       -----BEGIN CERTIFICATE-----
-#       <PEM-encoded Scanner service certificate>
-#       -----END CERTIFICATE-----
-#     key: |
-#       -----BEGIN RSA PRIVATE KEY-----
-#       <PEM-encoded Scanner service cert private key>
-#       -----END RSA PRIVATE KEY-----
-#
-#   # Internal "scanner-db.stackrox" service TLS certificate for the Scanner DB deployment.
-#   # Omit to auto-generate (initial deployment) or use existing (upgrade).
-#   dbServiceTLS:
-#     cert: |
-#       -----BEGIN CERTIFICATE-----
-#       <PEM-encoded Scanner DB service certificate>
-#       -----END CERTIFICATE-----
-#     key: |
-#       -----BEGIN RSA PRIVATE KEY-----
-#       <PEM-encoded Scanner DB service cert private key>
-#       -----END RSA PRIVATE KEY-----
-#
 # # Secret configuration options for the Scanner V4 deployment.
 # scannerV4:
 #   indexer:
diff --git a/image/templates/helm/stackrox-central/values-public.yaml.example.htpl b/image/templates/helm/stackrox-central/values-public.yaml.example.htpl
index d405ac4034bcb..2fe94b736f17c 100644
--- a/image/templates/helm/stackrox-central/values-public.yaml.example.htpl
+++ b/image/templates/helm/stackrox-central/values-public.yaml.example.htpl
@@ -44,7 +44,7 @@
 # image:
 #   # The registry relative to which all image references are resolved, unless
 #   # a specific registry is provided for particular workloads which takes precedence
-#   # (see `central.image`, `db.image`, `scanner.image`, and `scanner.dbImage` below).
+#   # (see `central.image` and `db.image` below).
 #   # This can be just a registry hostname such as `quay.io`, or a registry hostname with
 #   # a "remote" component such as `us.gcr.io/my-stackrox-mirror`.
 #   registry: us.gcr.io/my-stackrox-mirror
@@ -226,8 +226,15 @@
 #       reencrypt:
 #         enabled: true
 #
-#     # Additional volume mounts for the Central container. Only few people will require this.
-#     extraMounts:
+#
+#   # Name of a ConfigMap containing a Red Hat signing key bundle. The bundle must be stored with the key `bundle.json`.
+#   # When set, the ConfigMap is mounted into Central at /tmp/redhat-signing-keys/.
+#   # To rotate keys, update the ConfigMap directly — no helm upgrade needed.
+#   signingKeyBundle:
+#     configMapName: "redhat-signing-key-bundle"
+#
+#   # Additional volume mounts for the Central container. Only few people will require this.
+#   extraMounts:
 #     - name: my-configmap  # the name of the volume
 #       # The source of the volume. This will be embedded as-is in the `volume:` section of the
 #       # pod spec.
@@ -327,127 +334,12 @@
 #               # been created.
 #               pdName: gke-pv
 #
-# # Public configuration options for the StackRox Scanner.
-# scanner:
-#   # disable=true will cause the StackRox Kubernetes Security Platform to be
-#   # deployed without the StackRox Scanner, meaning that certain functionalities
-#   # may not be available. If this setting is changed prior to a `helm upgrade`
-#   # invocation, the existing StackRox scanner deployment will be removed.
-#   disable: false
-#
-#   # The number of replicas for the Scanner deployment. If autoscaling is enabled (see below),
-#   # this determines the initial number of replicas.
-#   replicas: 3
-#
-#   # The log level for the scanner deployment. This typically does not need to be changed.
-#   logLevel: INFO
-#
-#   # If you want to enforce StackRox Scanner to only run on certain nodes, you can specify
-#   # a node selector here to make sure Scanner can only be scheduled on Nodes with the
-#   # given label.
-#   nodeSelector:
-#     # This can contain arbitrary `label-key: label-value` pairs.
-#     role: stackrox-scanner
-#
-#   If the nodes selected by the node selector are tainted, you can specify the corresponding taint tolerations here.
-#   tolerations:
-#     - effect: NoSchedule
-#       key: infra
-#       value: reserved
-#     - effect: NoExecute
-#       key: infra
-#       value: reserved
-#
-#   If scheduling needs specific affinities, you can specify the corresponding affinities here.
-#   affinity:
-#     podAntiAffinity:
-#       preferredDuringSchedulingIgnoredDuringExecution:
-#       - weight: 100
-#         podAffinityTerm:
-#           labelSelector:
-#             matchLabels:
-#               app: scanner
-#           topologyKey: kubernetes.io/hostname
-#     nodeAffinity:
-#       preferredDuringSchedulingIgnoredDuringExecution:
-#       - weight: 50
-#         preference:
-#           matchExpressions:
-#             - key: node-role.kubernetes.io/infra
-#               operator: Exists
-#       - weight: 25
-#         preference:
-#           matchExpressions:
-#             - key: node-role.kubernetes.io/compute
-#               operator: Exists
-#       - weight: 100
-#         preference:
-#           matchExpressions:
-#             - key: node-role.kubernetes.io/control-plane
-#               operator: DoesNotExist
-#
-#   # If you want to enforce StackRox Scanner DB to only run on certain nodes, you can specify
-#   # a node selector here to make sure Scanner DB can only be scheduled on Nodes with the
-#   # given label.
-#   dbNodeSelector:
-#     # This can contain arbitrary `label-key: label-value` pairs.
-#     role: stackrox-scanner-db
-#
-#   If the nodes selected by the node selector are tainted, you can specify the corresponding taint tolerations here.
-#   dbTolerations:
-#     - effect: NoSchedule
-#       key: infra
-#       value: reserved
-#     - effect: NoExecute
-#       key: infra
-#       value: reserved
-#
-#   # Configuration for autoscaling the Scanner deployment.
-#   autoscaling:
-#     # disable=true causes autoscaling to be disabled. All other settings in this section
-#     # will have no effect.
-#     disable: false
-#     # The minimum number of replicas for autoscaling. The following value is the default.
-#     minReplicas: 2
-#     # The maximum number of replicas for autoscaling. The following value is the default.
-#     maxReplicas: 5
-#
-#   # Custom resource overrides for the Scanner deployment.
-#   resources:
-#     requests:
-#       memory: "1500Mi"
-#       cpu: "1000m"
-#     limits:
-#       memory: "4Gi"
-#       cpu: "2000m"
-#
-#   # Custom resource overrides for the Scanner DB deployment.
-#   dbResources:
-#     limits:
-#       cpu: "2000m"
-#       memory: "4Gi"
-#     requests:
-#       cpu: "200m"
-#       memory: "200Mi"
-#
-#   # Custom configuration of the image to be used for the Scanner deployment.
-#   # See `central.image` for a full example.
-#   image:
-#     registry: us.gcr.io/stackrox-scanner-repo
-#     name: scanner  # "scanner" is the default
-#
-#   dbImage:
-#     registry: us.gcr.io/stackrox-scanner-db-repo
-#     name: scanner-db  # "scanner-db" is the default
-#
 # # Public configuration options for Scanner V4.
 # scannerV4:
 #
-#  # If this is set to false, Scanner V4 will be enabled and deployed.
-#  # Note that currently Scanner V4 cannot be used as the only scanner component.
-#  # Instead it must be currently deployed side-by-side with StackRox Scanner (scanner.disable=false).
+#  # If this is set to true, Scanner V4 will not be deployed.
 #  # If it is set to true, no other setting in this section will have any effect.
-#  disable: true
+#  disable: false
 #
 #  # Scanner V4 consists of three components: indexer, matcher and db.
 #
@@ -694,22 +586,6 @@
 #       podAnnotations: {}
 #       envVars: {}
 #
-#   # Extra metadata for the scanner deployment only.
-#   scanner:
-#     labels: {}
-#     annotations: {}
-#     podLabels: {}
-#     podAnnotations: {}
-#     envVars: {}
-#
-#   # Extra metadata for the scanner-db deployment only.
-#   scanner-db:
-#     labels: {}
-#     annotations: {}
-#     podLabels: {}
-#     podAnnotations: {}
-#     envVars: {}
-#
 #   # Extra metadata for all other objects. The keys in the following map can be
 #   # an object name of the form "service/central-loadbalancer", or a reference to all
 #   # objects of a given type in the form "service/*". The values under each key
@@ -738,3 +614,6 @@
 #   # Enables integration with OpenShift platform monitoring.
 #   openshift:
 #     enabled: true
+#     # Enables custom metrics integration.
+#     custom:
+#       enabled: false
diff --git a/image/templates/helm/stackrox-central/values.yaml.htpl b/image/templates/helm/stackrox-central/values.yaml.htpl
index 0be2a28e5d985..5e67c78b7f884 100644
--- a/image/templates/helm/stackrox-central/values.yaml.htpl
+++ b/image/templates/helm/stackrox-central/values.yaml.htpl
@@ -7,18 +7,16 @@
 ## Instead, create a file that contains only those settings you want to override,
 ## and pass it to helm or roxctl via the `-f` parameter.
 ##
-## For example, if you want to disable the deployment of scanner, create a file
+## For example, if you want to disable Scanner V4, create a file
 ## `values-override.yaml` (or any name you choose) with the following contents:
 ##
-##  scanner:
+##  scannerV4:
 ##    disable: true
 ##
-## and then invoke helm by passing `-f values-override.yaml` to
-## `helm install`/`helm upgrade`.
+## and then invoke helm by passing `-f values-override.yaml`
+## to `helm install`/`helm upgrade`.
 ##
-## Alternatively, if you want to override just a few values, you can set them directly
-## via the `--set` command, e.g.,
-##  $ helm install --set scanner.disable=true ...
+## Alternatively, you can set values directly via the `--set` command.
 ##
 ## Note that an arbitrary number of `-f` and `--set` parameters can be combined. It is
 ## generally a good practice to store secret data such as the admin password separate from
@@ -248,78 +246,6 @@ central:
 #        size: null
 #      none: null
 #
-## Configuration options relating to StackRox Scanner.
-#scanner:
-#  # If this is set to true, StackRox will be deployed without scanner. No other setting in this
-#  # section will have any effect.
-#  disable: false
-#
-#  # Default number of scanner replicas created upon startup. The actual number might be higher
-#  # or lower if autoscaling is enabled (see below).
-#  replicas: 3
-#
-#  logLevel: INFO
-#
-#  # Settings related to autoscaling the scanner deployment.
-#  autoscaling:
-#    # If true, autoscaling will be disabled. None of the other settings in this section will
-#    # have any effect.
-#    disable: false
-#    minReplicas: 1
-#    maxReplicas: 5
-#
-#  # Resource settings for the scanner deployment.
-#  resources:
-#    requests:
-#      memory: "1500Mi"
-#      cpu: "1000m"
-#    limits:
-#      memory: "4Gi"
-#      cpu: "2000m"
-#
-#  image:
-#    registry: null
-#    name: scanner
-#    tag: 2.3.2
-#    fullRef: null
-#
-#  dbImage:
-#    registry: null
-#    name: scanner-db
-#    tag: 2.3.2
-#    fullRef: null
-#
-#  # Resource settings for the scanner-db deployment.
-#  dbResources:
-#    limits:
-#      cpu: 2
-#      memory: 4Gi
-#    requests:
-#      cpu: 200m
-#      memory: 200Mi
-#
-#  # The admin password setting for communication with scanner's DB.
-#  # When a value is set explicitly, this is always used, even on upgrade.
-#  # Otherwise, a password will be automatically generated if `generate` is set to true,
-#  # or left unset (null) and the Helm chart is being installed (as opposed to upgraded).
-#  dbPassword:
-#    value: null
-#    generate: null
-#
-#  # Settings for the internal service-to-service TLS certificate used by scanner.
-#  # See the documentation for `ca` at the top level for an explanation.
-#  serviceTLS:
-#    cert: null
-#    key: null
-#    generate: null
-#
-#  # Settings for the internal service-to-service TLS certificate used by scanner-db.
-#  # See the documentation for `ca` at the top level for an explanation.
-#  dbServiceTLS:
-#    cert: null
-#    key: null
-#    generate: null
-#
 ## Configuration options relating to Scanner V4.
 #scannerV4:
 #
@@ -569,3 +495,6 @@ central:
 #  # Enables integration with OpenShift platform monitoring.
 #  openshift:
 #    enabled: true
+#    # Enables custom metrics integration.
+#    custom:
+#      enabled: false
diff --git a/image/templates/helm/stackrox-secured-cluster/.helmtplignore.htpl b/image/templates/helm/stackrox-secured-cluster/.helmtplignore.htpl
index 31b00526c4d30..dd972083f89c9 100644
--- a/image/templates/helm/stackrox-secured-cluster/.helmtplignore.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/.helmtplignore.htpl
@@ -22,13 +22,8 @@ feature-flag-values.yaml
 [<- end >]
 *.swp
 [<- if .KubectlOutput >]
-templates/*scanner*
-internal/scanner-config-shape.yaml
-config-templates/scanner/
-values-scanner.yaml.example
 values-public-scanner-v4.yaml.example
 values-private-scanner-v4.yaml.example
-internal/defaults/70-scanner.yaml
 templates/*scanner-v4*
 internal/*scanner-v4*
 internal/defaults/*scanner-v4*
@@ -38,7 +33,5 @@ templates/00-storage-class.yaml
 [<- end >]
 [</* Ignore all matcher related manifests unconditionally in secured cluster. */>]
 templates/02-scanner-v4-*-matcher*.yaml
-[</* Ignore all other scanner related tls secrets unconditionally in secured cluster. */>]
-templates/02-scanner-03-tls-secret.yaml
 templates/02-scanner-v4-03-db-tls-secret.yaml
 templates/02-scanner-v4-03-indexer-tls-secret.yaml
diff --git a/image/templates/helm/stackrox-secured-cluster/README.md.htpl b/image/templates/helm/stackrox-secured-cluster/README.md.htpl
index 467dd1d844dab..7cd10ae37398b 100644
--- a/image/templates/helm/stackrox-secured-cluster/README.md.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/README.md.htpl
@@ -2,8 +2,7 @@
 
 This Helm chart allows you to deploy the necessary services on a StackRox
 secured cluster: StackRox Sensor, StackRox Collector, and StackRox Admission
-Control. Optionally StackRox Scanner can be deployed, either alone or together
-with the new Scanner V4.
+Control. It also deploys StackRox Scanner V4 by default.
 
 If you want to install Secured Cluster Services for Red Hat Advanced Cluster Security,
 refer to [Installing the secured-cluster-services Helm chart](https://docs.openshift.com/acs/installing/installing_helm/install-helm-quick.html#installing-secured-cluster-services-quickly_acs-install-helm-quick).
@@ -170,9 +169,9 @@ The Secured Cluster Services Helm chart contains example configuration files
 (called `values-public.yaml.example` and `values-private.yaml.example`), that list
 all the available configuration options, along with documentation.
 
-Furthermore, the files `values-scanner.yaml.example`, `values-public-scanner-v4.yaml.example`
+Furthermore, the files `values-public-scanner-v4.yaml.example`
 and `values-private-scanner-v4.yaml.example` list the most commonly used configuration options
-for StackRox Scanner and Scanner V4.
+for Scanner V4.
 
 The following sample configuration file (`secured-cluster.yaml`) uses a few of
 the options which you can configure:
@@ -321,8 +320,7 @@ non-standard environments:
 |`admissionControl.nodeSelector` | Node selector for Admission Control pods placement. | `null` (no placement constraints) |
 |`exposeMonitoring`| This setting controls whether the monitoring port (TCP 9090) should be exposed on the services. | `false` |
 |`env.openshift`| The StackRox Kubernetes Security Platform automatically detects the OpenShift version (`3.x` or `4.x`). Use this parameter to override the automatically detected version number, for example `4`. | `null` |
-|`scanner.disable`| Scan images stored in the cluster's local registries. | `true` |
-|`scannerV4.disable`| Enable Scanner V4. StackRox Scanner must be enabled as well (`scanner.disable=false``). | `true` |
+|`scannerV4.disable`| Enable Scanner V4 for local image scanning. | `false` |
 ### Default resources
 
 Each of the baseline container's default resource settings are defined in the
@@ -337,8 +335,8 @@ paths to the respective defaults for each container that this chart deploys:
 |NodeInventory    |`collector.nodeScanningResources`             |
 |Admission Control|`admissionControl.resources`                  |
 
-Furthermore, default resource settings for StackRox Scanner and Scanner V4 can be
-found in the files `internal/defaults/70-scanner.yaml` and `internal/defaults/70-scanner-v4.yaml`.
+Furthermore, default resource settings for Scanner V4 can be
+found in the file `internal/defaults/70-scanner-v4.yaml`.
 
 ### Customization settings
 
diff --git a/image/templates/helm/stackrox-secured-cluster/feature-flag-values.yaml.htpl b/image/templates/helm/stackrox-secured-cluster/feature-flag-values.yaml.htpl
index 4757ca8d638e8..5e36d45d6e007 100644
--- a/image/templates/helm/stackrox-secured-cluster/feature-flag-values.yaml.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/feature-flag-values.yaml.htpl
@@ -1,10 +1,8 @@
 [<- if .FeatureFlags >]
-[</* There is no value in injecting this feature flag, because the Helm chart
-     will set this flag based on the chart configuration anyway. By excluding it
-     here we get rid of deployment warnings such as these:
-
-       Warning: spec.template.spec.containers[0].env[25].name: duplicate name "ROX_SCANNER_V4" */>]
-[<- $skipFeatureFlags := list "ROX_SCANNER_V4" >]
+[</* The chart already sets these from its own config (scanner V4 enablement,
+     virtualMachines.enabled). Injecting them again would produce duplicate env names,
+     which kubectl apply cannot patch onto an existing Sensor Deployment. */>]
+[<- $skipFeatureFlags := list "ROX_SCANNER_V4" "ROX_VIRTUAL_MACHINES" >]
 envVars:
 [<- $featureFlags := .FeatureFlags >]
 [<- range $flagName := keys $featureFlags | sortAlpha >]
diff --git a/image/templates/helm/stackrox-secured-cluster/internal/config-shape.yaml b/image/templates/helm/stackrox-secured-cluster/internal/config-shape.yaml
index fa41057a3d802..c19237777a1ce 100644
--- a/image/templates/helm/stackrox-secured-cluster/internal/config-shape.yaml
+++ b/image/templates/helm/stackrox-secured-cluster/internal/config-shape.yaml
@@ -46,17 +46,6 @@ image:
     tag: null # string
     fullRef: null # string
     pullPolicy: null # string
-  scanner:
-    registry: null # string
-    name: null # string
-    repository: null # string
-    tag: null # string
-    fullRef: null # string
-  scannerDb:
-    registry: null # string
-    name: null # string
-    tag: null # string
-    fullRef: null # string
   scannerV4:
     registry: null # string
     name: null # string
@@ -193,6 +182,11 @@ customize:
   other: {} # dict
 allowNonstandardNamespace: null # bool
 allowNonstandardReleaseName: null # bool
+# Undocumented, test-only: when true, global (cluster-scoped) resources that opt in via
+# srox.optionalGlobalResourceName get namespace-prefixed names to avoid clashes when
+# multiple secured clusters are deployed into different namespaces of one cluster.
+# Defaults to false so production keeps stable, static names.
+namespacePrefixGlobalResources: null # bool
 enableOpenShiftMonitoring: null # bool
 monitoring:
   openshift:
diff --git a/image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl b/image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl
index 7a2c052b2337a..81335de9dd8cf 100644
--- a/image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl
@@ -9,6 +9,10 @@ createSecrets: true
 
 exposeMonitoring: false
 
+# Undocumented, test-only. Keep global resource names static by default for production
+# safety; see config-shape.yaml and srox.optionalGlobalResourceName.
+namespacePrefixGlobalResources: false
+
 helmManaged: [< not .KubectlOutput >]
 
 [< if .Operator >]
@@ -118,11 +122,11 @@ network:
   enableNetworkPolicies: true
 
 virtualMachines:
-  enabled: false
+  enabled: [< .FeatureFlags.ROX_VIRTUAL_MACHINES >]
   scraper:
     concurrency: 20
     maxResponseSizeKB: 16384
-    pollInterval: "5m"
+    pollInterval: "4h"
 
 enableOpenShiftMonitoring: false
 
diff --git a/image/templates/helm/stackrox-secured-cluster/internal/defaults/50-images.yaml.htpl b/image/templates/helm/stackrox-secured-cluster/internal/defaults/50-images.yaml.htpl
index 01220b514dc68..7b254faf5ac70 100644
--- a/image/templates/helm/stackrox-secured-cluster/internal/defaults/50-images.yaml.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/internal/defaults/50-images.yaml.htpl
@@ -14,13 +14,7 @@ image:
     name: [< required "" .FactImageRemote >]
     tag: [< required "" .FactImageTag >]
   [<- end >]
-  scanner:
-    name: [< required "" .ScannerSlimImageRemote >]
-    tag: [< required "" .ScannerImageTag >]
   [<- if not .KubectlOutput >]
-  scannerDb:
-    name: [< required "" .ScannerDBSlimImageRemote >]
-    tag: [< required "" .ScannerImageTag >]
   scannerV4:
     name: [< required "" .ScannerV4ImageRemote >]
     tag: [< required "" .ScannerV4ImageTag >]
@@ -39,11 +33,7 @@ image:
   fact:
     registry: {{ ._rox.image.registry }}
   [<- end >]
-  scanner:
-    registry: {{ ._rox.image.registry }}
   [<- if not .KubectlOutput >]
-  scannerDb:
-    registry: {{ ._rox.image.registry }}
   scannerV4:
     registry: {{ ._rox.image.registry }}
   scannerV4DB:
@@ -60,11 +50,7 @@ image:
   fact:
     repository: {{ list ._rox.image.fact.registry ._rox.image.fact.name | compact | join "/" }}
   [<- end >]
-  scanner:
-    repository: {{ list ._rox.image.scanner.registry ._rox.image.scanner.name | compact | join "/" }}
   [<- if not .KubectlOutput >]
-  scannerDb:
-    repository: {{ list ._rox.image.scannerDb.registry ._rox.image.scannerDb.name | compact | join "/" }}
   scannerV4:
     repository: {{ list ._rox.image.scannerV4.registry ._rox.image.scannerV4.name | compact | join "/" }}
   scannerV4DB:
@@ -113,11 +99,7 @@ image:
   fact:
     fullRef: "{{ printf "%s:%s" ._rox.image.fact.repository ._rox.image.fact.tag }}"
   [<- end >]
-  scanner:
-    fullRef: "{{ printf "%s:%s" ._rox.image.scanner.repository ._rox.image.scanner.tag }}"
   [<- if not .KubectlOutput >]
-  scannerDb:
-    fullRef: "{{ printf "%s:%s" ._rox.image.scannerDb.repository ._rox.image.scannerDb.tag }}"
   scannerV4:
     fullRef: "{{ printf "%s:%s" ._rox.image.scannerV4.repository ._rox.image.scannerV4.tag }}"
   scannerV4DB:
diff --git a/image/templates/helm/stackrox-secured-cluster/internal/defaults/70-scanner.yaml b/image/templates/helm/stackrox-secured-cluster/internal/defaults/70-scanner.yaml
deleted file mode 100644
index 7ac80ee89e3be..0000000000000
--- a/image/templates/helm/stackrox-secured-cluster/internal/defaults/70-scanner.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-scanner:
-  replicas: 3
-  logLevel: INFO
-  mode: slim
-
-  autoscaling:
-    disable: false
-    minReplicas: 2
-    maxReplicas: 5
-
-  resources:
-    requests:
-      memory: "1500Mi"
-      cpu: "1000m"
-    limits:
-      memory: "4Gi"
-      cpu: "2000m"
-
-  dbResources:
-    limits:
-      cpu: "2000m"
-      memory: "4Gi"
-    requests:
-      cpu: "200m"
-      memory: "512Mi"
-
-  slimImage:
-    name: ""
-    tag: ""
-    fullRef: ""
-    repository: ""
-
-  slimDBImage:
-    name: ""
-    tag: ""
-    fullRef: ""
-    repository: ""
diff --git a/image/templates/helm/stackrox-secured-cluster/internal/expandables.yaml b/image/templates/helm/stackrox-secured-cluster/internal/expandables.yaml
index 4c5ebcc9ae580..d477c4a72aa5a 100644
--- a/image/templates/helm/stackrox-secured-cluster/internal/expandables.yaml
+++ b/image/templates/helm/stackrox-secured-cluster/internal/expandables.yaml
@@ -30,19 +30,6 @@ collector:
   nodeScanningResources: true
   famResources: true
   nodeSelector: true
-scanner:
-  resources: true
-  dbResources: true
-  nodeSelector: true
-  dbNodeSelector: true
-  dbPassword:
-    value: true
-  serviceTLS:
-    cert: true
-    key: true
-  dbServiceTLS:
-    cert: true
-    key: true
 scannerV4:
   indexer:
     nodeSelector: true
diff --git a/image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl b/image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl
index 4314ed69a5add..dbcb084e0455d 100644
--- a/image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl
@@ -37,11 +37,8 @@
 {{ $_ := set $ "_rox" $rox }}
 
 {{ $configShape := $.Files.Get "internal/config-shape.yaml" | fromYaml }}
-{{/* Only merge scanner config shapes if kubectl output is disabled */}}
+{{/* Only merge scanner-v4 config shapes if kubectl output is disabled */}}
 [<- if not .KubectlOutput >]
-  {{ $configShapeScanner := $.Files.Get "internal/scanner-config-shape.yaml" | fromYaml }}
-  {{ $_ = include "srox.mergeInto" (list $configShape $configShapeScanner) }}
-  {{/* Only merge scanner-v4 config shapes if kubectl output is disabled and feature flag is enabled */}}
   {{ $configShapeScannerV4 := $.Files.Get "internal/scanner-v4-config-shape.yaml" | fromYaml }}
   {{ $_ = include "srox.mergeInto" (list $configShape $configShapeScannerV4) }}
 [<- end >]
@@ -149,12 +146,11 @@
 
 [<- if not .KubectlOutput >]
 {{ $_ := include "srox.scannerV4Defaulting" (list $ .Release $._rox.scannerV4 $.stackroxHelm) }}
-{{ include "srox.scannerDefaulting" (list . .Release $._rox.scanner $.stackroxHelm) }}
-{{ if ne $._rox.scanner.mode "slim" }}
-  {{ include "srox.fail" (print "Only scanner slim mode is allowed in Secured Cluster. To solve this, set to slim mode: scanner.mode=slim.") }}
-{{ end }}
-{{ $_ := set $._rox.scanner "slimImage" $._rox.image.scanner }}
-{{ $_ := set $._rox.scanner "slimDBImage" $._rox.image.scannerDb }}
+
+{{/* Scanner V2 has been removed. Warn if a user still tries to enable it. */}}
+{{- if and $._rox.scanner (not (kindIs "invalid" $._rox.scanner.disable)) (not $._rox.scanner.disable) -}}
+  {{- include "srox.warn" (list $ "The legacy Scanner has been removed. The `scanner.disable` setting is ignored. Scanner V4 is the replacement.") -}}
+{{- end -}}
 [<- end >]
 
 {{/* Expand applicable config values */}}
@@ -264,7 +260,6 @@
 {{ include "srox.configureImage" (list $ ._rox.image.main) }}
 {{ include "srox.configureImage" (list $ ._rox.image.collector) }}
 [<- if not .KubectlOutput >]
-{{ include "srox.configureImage" (list $ ._rox.image.scanner) }}
 {{ include "srox.configureImage" (list $ ._rox.image.scannerV4) }}
 [<- end >]
 
@@ -348,24 +343,18 @@ The following block checks for the validity of the provided init bundle. (`helm
   */}}
 
 
-{{ $anyScannerEnabled := or (eq ._rox.scanner.disable false) (eq ._rox.scannerV4.disable false) }}
+{{ $anyScannerEnabled := not ._rox.scannerV4.disable }}
 {{ if $anyScannerEnabled }}
   {{/* Check for sibling central in the same namespace. */}}
   {{ $centralDeployment := dict }}
   {{ include "srox.safeLookup" (list $ $centralDeployment "apps/v1" "Deployment" $.Release.Namespace "central") }}
   {{ if $centralDeployment.result }}
     {{ include "srox.note" (list $ "Detected central running in the same namespace. Not deploying scanner from this chart and configuring sensor to use existing scanner instance, if any.") }}
-    {{ $_ := set $._rox.scanner "disable" true }}
   {{ end }}
 
   {{ $_ := set $._rox.sensor.localImageScanning "enabled" "true" }}
 {{ end }}
 
-{{ if eq ._rox.scanner.disable false }}
-  {{ include "srox.scannerInit" (list $ $._rox.scanner) }}
-  {{ $imagePullSecretNames = append $imagePullSecretNames "stackrox-scanner" }}
-{{ end }}
-
 {{ $scannerV4Cfg := $._rox.scannerV4 }}
 {{ if eq $scannerV4Cfg.disable false }}
   {{/* Copy secured-cluster-style image configuration to what the Scanner V4 configuration machinery expects. */}}
diff --git a/image/templates/helm/stackrox-secured-cluster/templates/_scanner-defaulting.tpl b/image/templates/helm/stackrox-secured-cluster/templates/_scanner-defaulting.tpl
deleted file mode 100644
index fabc13d1887eb..0000000000000
--- a/image/templates/helm/stackrox-secured-cluster/templates/_scanner-defaulting.tpl
+++ /dev/null
@@ -1,29 +0,0 @@
-{{/*
-  srox.scannerDefaulting <Helm .> <Helm .Release> <Scanner configuration> <Stackrox Helm ConfigMap content>
-
-  Encapsulates the Scanner defaulting logic.
-
-  Can be removed later, together with StackRox Scanner.
-*/}}
-
-{{- define "srox.scannerDefaulting" -}}
-
-{{- $ := index . 0 -}}
-{{- $helmRelease := index . 1 -}}
-{{- $scanner := index . 2 -}}
-{{- $stackroxHelm := index . 3 -}}
-
-{{- if kindIs "invalid" $scanner.disable -}}
-  {{/* Scanner neither explicitly enabled or disabled, apply defaulting logic. */}}
-  {{/* By default Scanner will be installed. */}}
-  {{- $_ := set $scanner "disable" false -}}
-  {{/* Currently there is one exception: when upgrading from a pre-4.8 version, which did not
-       install Scanner by default. */}}
-  {{- $installVersionUnknown := kindIs "invalid" $stackroxHelm.installXYVersion -}}
-  {{- $upgradingFromPre4_8 := or $installVersionUnknown (semverCompare "< 4.8" $stackroxHelm.installXYVersion) -}}
-  {{- if and $helmRelease.IsUpgrade $upgradingFromPre4_8 -}}
-    {{- include "srox.note" (list $ "StackRox Scanner disabled by default: this deployment was initially installed before version 4.8.") -}}
-    {{- $_ := set $scanner "disable" true -}}
-  {{- end -}}
-{{- end -}}
-{{- end -}}
diff --git a/image/templates/helm/stackrox-secured-cluster/templates/admission-controller.yaml b/image/templates/helm/stackrox-secured-cluster/templates/admission-controller.yaml
index 0f9fba8ea14ad..5863e9403d24f 100644
--- a/image/templates/helm/stackrox-secured-cluster/templates/admission-controller.yaml
+++ b/image/templates/helm/stackrox-secured-cluster/templates/admission-controller.yaml
@@ -218,7 +218,7 @@ spec:
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
-  name: stackrox
+  name: {{ include "srox.optionalGlobalResourceName" (list . "stackrox") }}
   labels:
     {{- include "srox.labels" (list . "validatingwebhookconfiguration" "stackrox") | nindent 4 }}
   annotations:
diff --git a/image/templates/helm/stackrox-secured-cluster/templates/collector.yaml.htpl b/image/templates/helm/stackrox-secured-cluster/templates/collector.yaml.htpl
index 552f3929366dd..dbe4d1e98476c 100644
--- a/image/templates/helm/stackrox-secured-cluster/templates/collector.yaml.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/templates/collector.yaml.htpl
@@ -175,8 +175,6 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        - name: ROX_CALL_NODE_INVENTORY_ENABLED
-          value: {{ if eq ._rox.env.openshift 4 }}"true"{{ else }}"false"{{ end }}
       {{- if eq ._rox.env.openshift 4 }}
         - name: ROX_NODE_INDEX_HOST_PATH
           value: "/hostindex"
@@ -232,46 +230,12 @@ spec:
         - mountPath: /hostindex/usr/share
           name: usr-share-ro
           readOnly: true
+        - mountPath: /hostindex/usr/lib
+          name: usr-lib-ro
+          readOnly: true
         - mountPath: /tmp
           name: index-volume
       {{- end }}
-      {{- if eq ._rox.env.openshift 4 }}
-      - name: node-inventory
-        image: {{ quote ._rox.image.scanner.fullRef }}
-        imagePullPolicy: IfNotPresent
-        command: ["/scanner", "--nodeinventory", "--config=", ""]
-        ports:
-          - containerPort: 8444
-            name: grpc
-        resources:
-          {{- ._rox.collector._nodeScanningResources | nindent 10 }}
-        securityContext:
-          privileged: true
-        env:
-        - name: ROX_NODE_NAME
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: spec.nodeName
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        {{- include "srox.envVars" (list . "daemonset" "collector" "node-inventory") | nindent 8 }}
-        volumeMounts:
-         - mountPath: /host
-           name: host-root-ro
-           readOnly: true
-           mountPropagation: HostToContainer
-         - mountPath: /tmp/
-           name: tmp-volume
-         - mountPath: /cache
-           name: cache-volume
-      {{- end }}
       volumes:
       - hostPath:
           path: /proc
@@ -321,14 +285,8 @@ spec:
         emptyDir: {}
       - name: etc-pki-volume
         emptyDir: {}
-      - name: tmp-volume
-        emptyDir: {}
       - name: collector-profiles
         emptyDir: {}
-      - name: cache-volume
-        emptyDir:
-          sizeLimit: 200Mi
-
       - name: collector-config
         configMap:
           name: collector-config
diff --git a/image/templates/helm/stackrox-secured-cluster/templates/sensor-netpol.yaml.htpl b/image/templates/helm/stackrox-secured-cluster/templates/sensor-netpol.yaml.htpl
index 00e643e04921b..f9e3b522b4f80 100644
--- a/image/templates/helm/stackrox-secured-cluster/templates/sensor-netpol.yaml.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/templates/sensor-netpol.yaml.htpl
@@ -23,9 +23,6 @@ spec:
           matchLabels:
             app: admission-control
       {{- if ._rox.sensor.localImageScanning.enabled }}
-      - podSelector:
-          matchLabels:
-            app: scanner
       {{- if ._rox.scannerV4._indexerEnabled }}
       - podSelector:
           matchLabels:
diff --git a/image/templates/helm/stackrox-secured-cluster/templates/sensor.yaml.htpl b/image/templates/helm/stackrox-secured-cluster/templates/sensor.yaml.htpl
index fc1d08ed9cedd..3ae137cd892ca 100644
--- a/image/templates/helm/stackrox-secured-cluster/templates/sensor.yaml.htpl
+++ b/image/templates/helm/stackrox-secured-cluster/templates/sensor.yaml.htpl
@@ -221,9 +221,9 @@ spec:
         - name: ROX_OPENSHIFT_API
           value: "true"
         {{- end }}
-        {{- if ._rox.virtualMachines.enabled }}
         - name: ROX_VIRTUAL_MACHINES
-          value: "true"
+          value: {{ quote ._rox.virtualMachines.enabled }}
+        {{- if ._rox.virtualMachines.enabled }}
         - name: ROX_VIRTUAL_MACHINES_SCRAPER_CONCURRENCY
           value: {{ quote ._rox.virtualMachines.scraper.concurrency }}
         - name: ROX_VIRTUAL_MACHINES_PULL_MAX_RESPONSE_SIZE_KB
@@ -233,8 +233,6 @@ spec:
         {{- end }}
         [<- if (not .KubectlOutput) >]
         {{- if ._rox.sensor.localImageScanning.enabled }}
-        - name: ROX_SCANNER_GRPC_ENDPOINT
-          value: {{ printf "scanner.%s.svc:8443" .Release.Namespace }}
         - name: ROX_LOCAL_IMAGE_SCANNING_ENABLED
           value: "true"
         {{- end }}
@@ -242,7 +240,7 @@ spec:
           value: {{ quote ._rox._configFP }}
         {{- if ._rox._scannerV4Enabled }}
         - name: ROX_SCANNER_V4_INDEXER_ENDPOINT
-          value: {{ printf "scanner-v4-indexer.%s.svc:8443" .Release.Namespace }}
+          value: {{ printf "scanner-v4-indexer.%s.svc:8443" ._rox._namespace }}
         - name: ROX_SCANNER_V4
           value: "true"
         {{- end }}
diff --git a/image/templates/helm/stackrox-secured-cluster/values-public-scanner-v4.yaml.example b/image/templates/helm/stackrox-secured-cluster/values-public-scanner-v4.yaml.example
index 18601be563a64..bb2f5cf4b7dfa 100644
--- a/image/templates/helm/stackrox-secured-cluster/values-public-scanner-v4.yaml.example
+++ b/image/templates/helm/stackrox-secured-cluster/values-public-scanner-v4.yaml.example
@@ -20,11 +20,9 @@
 #
 # scannerV4:
 #
-#   # If this is set to false, Scanner V4 will be enabled and deployed.
-#   # Note that currently Scanner V4 cannot be used as the only scanner component.
-#   # Instead it must be currently deployed side-by-side with StackRox Scanner (scanner.disable=false).
+#   # If this is set to true, Scanner V4 will not be deployed.
 #   # If it is set to true, no other setting in this section will have any effect.
-#   disable: true
+#   disable: false
 #
 #   # Scanner V4 consists of three components: indexer, matcher and db.
 #   # But when deployed as part of secured-cluster-services the only components
diff --git a/image/templates/helm/stackrox-secured-cluster/values-scanner.yaml.example b/image/templates/helm/stackrox-secured-cluster/values-scanner.yaml.example
deleted file mode 100644
index f7f3eb61a5f0a..0000000000000
--- a/image/templates/helm/stackrox-secured-cluster/values-scanner.yaml.example
+++ /dev/null
@@ -1,92 +0,0 @@
-# # NOTE:
-# # The Scanner is not available in the secured clusters installed via roxctl.
-#
-# # Public configuration options for the StackRox Scanner:
-# # When installing the Secured Cluster chart, a slim scanner mode is deployed with reduced image caching.
-# # To run the scanner in the secured cluster, you must connect the Scanner to Sensor.
-#
-# # WARNING:
-# # If deployed in the same namespace with Central it is only supported to install Scanner as part of Central's installation.
-# # Sensor will use the existing Scanner to scan for local images.
-#
-# Image configuration for scanner:
-# # For a complete example, see the `values-public.yaml.example` file.
-# image:
-#  # Configuration for the `scanner` image that is used by Scanner.
-#  scanner:
-#    registry: null
-#    name: scanner-slim
-#    tag: null
-#    fullRef: null
-#
-# scanner:
-#   # disable=false Deploys a StackRox Scanner in the secured cluster to allow scanning images
-#   # from the OpenShift Container Platform cluster's local registries.
-#   disable: false
-#
-#   # The number of replicas for the Scanner deployment. If autoscaling is enabled (see below),
-#   # this determines the initial number of replicas.
-#   replicas: 3
-#
-#   # The log level for the scanner deployment. This typically does not need to be changed.
-#   logLevel: INFO
-#
-#   # If you want to enforce StackRox Scanner to only run on certain nodes, you can specify
-#   # a node selector here to make sure Scanner can only be scheduled on Nodes with the
-#   # given label.
-#   nodeSelector:
-#     # This can contain arbitrary `label-key: label-value` pairs.
-#     role: stackrox-scanner
-#
-#   If the nodes selected by the node selector are tainted, you can specify the corresponding taint tolerations here.
-#   tolerations:
-#     - effect: NoSchedule
-#       key: infra
-#       value: reserved
-#     - effect: NoExecute
-#       key: infra
-#       value: reserved
-#
-#   # If you want to enforce StackRox Scanner DB to only run on certain nodes, you can specify
-#   # a node selector here to make sure Scanner DB can only be scheduled on Nodes with the
-#   # given label.
-#   dbNodeSelector:
-#     # This can contain arbitrary `label-key: label-value` pairs.
-#     role: stackrox-scanner-db
-#
-#   If the nodes selected by the node selector are tainted, you can specify the corresponding taint tolerations here.
-#   dbTolerations:
-#     - effect: NoSchedule
-#       key: infra
-#       value: reserved
-#     - effect: NoExecute
-#       key: infra
-#       value: reserved
-#
-#   # Configuration for autoscaling the Scanner deployment.
-#   autoscaling:
-#     # disable=true causes autoscaling to be disabled. All other settings in this section
-#     # will have no effect.
-#     disable: false
-#     # The minimum number of replicas for autoscaling. The following value is the default.
-#     minReplicas: 2
-#     # The maximum number of replicas for autoscaling. The following value is the default.
-#     maxReplicas: 5
-#
-#   # Custom resource overrides for the Scanner deployment.
-#   resources:
-#     requests:
-#       memory: "1500Mi"
-#       cpu: "1000m"
-#     limits:
-#       memory: "4Gi"
-#       cpu: "2000m"
-#
-#   # Custom resource overrides for the Scanner DB deployment.
-#   dbResources:
-#     limits:
-#       cpu: "2000m"
-#       memory: "4Gi"
-#     requests:
-#       cpu: "200m"
-#       memory: "200Mi"
diff --git a/migrator/lock/lock.go b/migrator/lock/lock.go
index fc41a38845b05..6d2d4028eb14c 100644
--- a/migrator/lock/lock.go
+++ b/migrator/lock/lock.go
@@ -7,14 +7,8 @@ import (
 	"github.com/stackrox/rox/pkg/postgres"
 )
 
-const (
-	// migrationAdvisoryLockID is a unique identifier for the migration advisory lock.
-	// This value is arbitrary but must be consistent across all Central instances.
-	migrationAdvisoryLockID int64 = 7_517_845_236_103_920_641
-)
-
 // TryAcquireMigrationLock attempts to acquire the migration advisory lock without blocking.
 // Returns whether the lock was acquired, a release function (nil if not acquired), and any error.
 func TryAcquireMigrationLock(ctx context.Context, pool postgres.DB) (bool, func(), error) {
-	return dblock.TryAcquireAdvisoryLock(ctx, pool, migrationAdvisoryLockID)
+	return dblock.TryAcquireAdvisoryLock(ctx, pool, dblock.MigrationLockID)
 }
diff --git a/migrator/migrations/m_211_to_m_212_admission_control_config/migration_test.go b/migrator/migrations/m_211_to_m_212_admission_control_config/migration_test.go
index 1f3d1e59d47de..7bfbd94cdfe51 100644
--- a/migrator/migrations/m_211_to_m_212_admission_control_config/migration_test.go
+++ b/migrator/migrations/m_211_to_m_212_admission_control_config/migration_test.go
@@ -63,17 +63,17 @@ func (s *migrationTestSuite) TestMigration() {
 		search.NewQueryBuilder().AddExactMatches(search.Cluster, clusters[0].GetName()).ProtoQuery())
 	assert.NoError(s.T(), err)
 
-	assert.EqualValues(s.T(), result[0].HelmConfig.GetDynamicConfig().GetAdmissionControllerConfig().GetScanInline(), false)
-	assert.EqualValues(s.T(), result[0].HelmConfig.GetDynamicConfig().GetAdmissionControllerConfig().GetEnabled(), true)
-	assert.EqualValues(s.T(), result[0].HelmConfig.GetDynamicConfig().GetAdmissionControllerConfig().GetEnforceOnUpdates(), false)
+	assert.EqualValues(s.T(), result[0].GetHelmConfig().GetDynamicConfig().GetAdmissionControllerConfig().GetScanInline(), false)
+	assert.EqualValues(s.T(), result[0].GetHelmConfig().GetDynamicConfig().GetAdmissionControllerConfig().GetEnabled(), true)
+	assert.EqualValues(s.T(), result[0].GetHelmConfig().GetDynamicConfig().GetAdmissionControllerConfig().GetEnforceOnUpdates(), false)
 
 	result, err = store.GetByQuery(s.ctx,
 		search.NewQueryBuilder().AddExactMatches(search.Cluster, clusters[1].GetName()).ProtoQuery())
 	assert.NoError(s.T(), err)
 
-	assert.EqualValues(s.T(), result[0].DynamicConfig.GetAdmissionControllerConfig().GetScanInline(), true)
-	assert.EqualValues(s.T(), result[0].DynamicConfig.GetAdmissionControllerConfig().GetEnabled(), true)
-	assert.EqualValues(s.T(), result[0].DynamicConfig.GetAdmissionControllerConfig().GetEnforceOnUpdates(), true)
+	assert.EqualValues(s.T(), result[0].GetDynamicConfig().GetAdmissionControllerConfig().GetScanInline(), true)
+	assert.EqualValues(s.T(), result[0].GetDynamicConfig().GetAdmissionControllerConfig().GetEnabled(), true)
+	assert.EqualValues(s.T(), result[0].GetDynamicConfig().GetAdmissionControllerConfig().GetEnforceOnUpdates(), true)
 
 }
 
diff --git a/migrator/migrations/m_226_to_m_227_backfill_report_type/migration.go b/migrator/migrations/m_226_to_m_227_backfill_report_type/migration.go
new file mode 100644
index 0000000000000..7ab145932298f
--- /dev/null
+++ b/migrator/migrations/m_226_to_m_227_backfill_report_type/migration.go
@@ -0,0 +1,24 @@
+// Code generated by make bootstrap_migration generator. DO NOT EDIT.
+package m226tom227
+
+import (
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/migrator/migrations"
+	"github.com/stackrox/rox/migrator/types"
+)
+
+const (
+	startSeqNum = 226
+)
+
+var (
+	migration = types.Migration{
+		StartingSeqNum: startSeqNum,
+		VersionAfter:   &storage.Version{SeqNum: int32(startSeqNum + 1)},
+		Run:            migrate,
+	}
+)
+
+func init() {
+	migrations.MustRegisterMigration(migration)
+}
diff --git a/migrator/migrations/m_226_to_m_227_backfill_report_type/migration_impl.go b/migrator/migrations/m_226_to_m_227_backfill_report_type/migration_impl.go
new file mode 100644
index 0000000000000..328466c5b37be
--- /dev/null
+++ b/migrator/migrations/m_226_to_m_227_backfill_report_type/migration_impl.go
@@ -0,0 +1,29 @@
+package m226tom227
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/migrator/migrations/loghelper"
+	"github.com/stackrox/rox/migrator/migrations/m_226_to_m_227_backfill_report_type/schema"
+	"github.com/stackrox/rox/migrator/types"
+	"github.com/stackrox/rox/pkg/postgres/pgutils"
+	"github.com/stackrox/rox/pkg/sac"
+)
+
+var (
+	log = loghelper.LogWrapper{}
+)
+
+func migrate(database *types.Databases) error {
+	ctx := sac.WithAllAccess(context.Background())
+
+	pgutils.CreateTableFromModel(ctx, database.GormDB, schema.CreateTableReportSnapshotsStmt)
+
+	result, err := database.PostgresDB.Exec(ctx, `UPDATE report_snapshots SET type = 0 WHERE type IS NULL`)
+	if err != nil {
+		return errors.Wrap(err, "failed to backfill report_snapshots.type")
+	}
+	log.WriteToStderrf("Backfilled type=0 for %d report snapshots", result.RowsAffected())
+	return nil
+}
diff --git a/migrator/migrations/m_226_to_m_227_backfill_report_type/migration_test.go b/migrator/migrations/m_226_to_m_227_backfill_report_type/migration_test.go
new file mode 100644
index 0000000000000..fe3936fa3a50a
--- /dev/null
+++ b/migrator/migrations/m_226_to_m_227_backfill_report_type/migration_test.go
@@ -0,0 +1,147 @@
+//go:build sql_integration
+
+package m226tom227
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	updatedSchema "github.com/stackrox/rox/migrator/migrations/m_226_to_m_227_backfill_report_type/schema"
+	oldSchema "github.com/stackrox/rox/migrator/migrations/m_226_to_m_227_backfill_report_type/test/schema"
+	pghelper "github.com/stackrox/rox/migrator/migrations/postgreshelper"
+	"github.com/stackrox/rox/migrator/types"
+	"github.com/stackrox/rox/pkg/postgres/pgutils"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stretchr/testify/suite"
+)
+
+type migrationTestSuite struct {
+	suite.Suite
+
+	db  *pghelper.TestPostgres
+	ctx context.Context
+}
+
+func TestMigration(t *testing.T) {
+	suite.Run(t, new(migrationTestSuite))
+}
+
+func (s *migrationTestSuite) SetupSuite() {
+	s.ctx = sac.WithAllAccess(context.Background())
+	s.db = pghelper.ForT(s.T(), false)
+}
+
+func (s *migrationTestSuite) TearDownSuite() {
+	s.db.Teardown(s.T())
+}
+
+func (s *migrationTestSuite) databases() *types.Databases {
+	return &types.Databases{
+		GormDB:     s.db.GetGormDB(),
+		PostgresDB: s.db.DB,
+		DBCtx:      s.ctx,
+	}
+}
+
+func (s *migrationTestSuite) setupPreMigrationTable() {
+	_, err := s.db.DB.Exec(s.ctx, "DROP TABLE IF EXISTS report_snapshots")
+	s.Require().NoError(err)
+	pgutils.CreateTableFromModel(s.ctx, s.db.GetGormDB(), oldSchema.CreateTableReportSnapshotsStmt)
+}
+
+func (s *migrationTestSuite) insertOldSnapshot(name string) {
+	snapshot := oldSchema.ReportSnapshots{
+		ReportID:              uuid.NewV4().String(),
+		ReportConfigurationID: uuid.NewV4().String(),
+		Name:                  name,
+		Serialized:            []byte("{}"),
+	}
+	s.Require().NoError(s.db.GetGormDB().Create(&snapshot).Error)
+}
+
+func (s *migrationTestSuite) typeColumnExists() bool {
+	var exists bool
+	err := s.db.DB.QueryRow(s.ctx, `
+		SELECT EXISTS (
+			SELECT 1 FROM information_schema.columns
+			WHERE table_name = 'report_snapshots' AND column_name = 'type'
+		)
+	`).Scan(&exists)
+	s.Require().NoError(err)
+	return exists
+}
+
+func (s *migrationTestSuite) countWhere(where string) int {
+	var count int
+	s.Require().NoError(s.db.DB.QueryRow(s.ctx, "SELECT COUNT(*) FROM report_snapshots WHERE "+where).Scan(&count))
+	return count
+}
+
+func (s *migrationTestSuite) TestMigration() {
+	s.setupPreMigrationTable()
+	dbs := s.databases()
+
+	const numReports = 3
+	for i := range numReports {
+		s.insertOldSnapshot(fmt.Sprintf("Test Report %d", i+1))
+	}
+
+	s.Require().False(s.typeColumnExists(), "Type column should not exist before migration")
+
+	s.Require().NoError(migration.Run(dbs))
+
+	s.Require().True(s.typeColumnExists(), "Type column should exist after migration")
+	s.Require().Equal(numReports, s.countWhere("type = 0"), "All reports should have type=0 after migration")
+	s.Require().Equal(0, s.countWhere("type IS NULL"), "No reports should have NULL type after migration")
+
+	s.Require().NoError(migration.Run(dbs))
+	s.Require().Equal(numReports, s.countWhere("type = 0"), "Count should remain the same after idempotent run")
+}
+
+func (s *migrationTestSuite) TestMigrationWithMixedData() {
+	s.setupPreMigrationTable()
+	dbs := s.databases()
+
+	s.insertOldSnapshot("Pre-column Report")
+
+	pgutils.CreateTableFromModel(s.ctx, s.db.GetGormDB(), updatedSchema.CreateTableReportSnapshotsStmt)
+
+	vulnerabilityType := int32(storage.ReportSnapshot_VULNERABILITY)
+	nodeVulnerabilityType := int32(storage.ReportSnapshot_NODE_VULNERABILITY)
+	testData := []struct {
+		name string
+		typ  *int32
+	}{
+		{"Null Report 1", nil},
+		{"Existing Report 1", &vulnerabilityType},
+		{"Node Report 1", &nodeVulnerabilityType},
+	}
+	for _, td := range testData {
+		if td.typ == nil {
+			_, err := s.db.DB.Exec(s.ctx, `
+				INSERT INTO report_snapshots (reportid, reportconfigurationid, name, serialized, type)
+				VALUES ($1, $2, $3, $4, NULL)
+			`, uuid.NewV4().String(), uuid.NewV4().String(), td.name, []byte("{}"))
+			s.Require().NoError(err)
+			continue
+		}
+		_, err := s.db.DB.Exec(s.ctx, `
+			INSERT INTO report_snapshots (reportid, reportconfigurationid, name, serialized, type)
+			VALUES ($1, $2, $3, $4, $5)
+		`, uuid.NewV4().String(), uuid.NewV4().String(), td.name, []byte("{}"), *td.typ)
+		s.Require().NoError(err)
+	}
+
+	s.Require().Equal(2, s.countWhere("type IS NULL"))
+	s.Require().Equal(1, s.countWhere("type = 0"))
+	s.Require().Equal(1, s.countWhere("type = 1"))
+
+	s.Require().NoError(migration.Run(dbs))
+
+	s.Require().Equal(0, s.countWhere("type IS NULL"), "No NULL values should remain")
+	s.Require().Equal(3, s.countWhere("type = 0"), "NULL values should be backfilled to 0, existing 0 unchanged")
+	s.Require().Equal(1, s.countWhere("type = 1"), "NODE_VULNERABILITY reports should remain unchanged")
+}
diff --git a/migrator/migrations/m_226_to_m_227_backfill_report_type/schema/report_snapshots.go b/migrator/migrations/m_226_to_m_227_backfill_report_type/schema/report_snapshots.go
new file mode 100644
index 0000000000000..174f4446a4036
--- /dev/null
+++ b/migrator/migrations/m_226_to_m_227_backfill_report_type/schema/report_snapshots.go
@@ -0,0 +1,40 @@
+// Frozen schema for the report_snapshots table after adding the type column.
+
+package schema
+
+import (
+	"time"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/postgres"
+)
+
+var (
+	// CreateTableReportSnapshotsStmt holds the create statement for table `report_snapshots`.
+	CreateTableReportSnapshotsStmt = &postgres.CreateStmts{
+		GormModel: (*ReportSnapshots)(nil),
+		Children:  []*postgres.CreateStmts{},
+	}
+)
+
+const (
+	// ReportSnapshotsTableName specifies the name of the table in postgres.
+	ReportSnapshotsTableName = "report_snapshots"
+)
+
+// ReportSnapshots holds the Gorm model for Postgres table `report_snapshots`.
+type ReportSnapshots struct {
+	ReportID                             string                                  `gorm:"column:reportid;type:uuid;primaryKey"`
+	ReportConfigurationID                string                                  `gorm:"column:reportconfigurationid;type:varchar"`
+	Name                                 string                                  `gorm:"column:name;type:varchar"`
+	Type                                 storage.ReportSnapshot_ReportType       `gorm:"column:type;type:integer"`
+	ReportStatusRunState                 storage.ReportStatus_RunState           `gorm:"column:reportstatus_runstate;type:integer"`
+	ReportStatusQueuedAt                 *time.Time                              `gorm:"column:reportstatus_queuedat;type:timestamp"`
+	ReportStatusCompletedAt              *time.Time                              `gorm:"column:reportstatus_completedat;type:timestamp"`
+	ReportStatusReportRequestType        storage.ReportStatus_RunMethod          `gorm:"column:reportstatus_reportrequesttype;type:integer"`
+	ReportStatusReportNotificationMethod storage.ReportStatus_NotificationMethod `gorm:"column:reportstatus_reportnotificationmethod;type:integer"`
+	RequesterID                          string                                  `gorm:"column:requester_id;type:varchar"`
+	RequesterName                        string                                  `gorm:"column:requester_name;type:varchar"`
+	AreaOfConcern                        string                                  `gorm:"column:areaofconcern;type:varchar"`
+	Serialized                           []byte                                  `gorm:"column:serialized;type:bytea"`
+}
diff --git a/migrator/migrations/m_226_to_m_227_backfill_report_type/test/schema/report_snapshots.go b/migrator/migrations/m_226_to_m_227_backfill_report_type/test/schema/report_snapshots.go
new file mode 100644
index 0000000000000..5fb0e2d02ae81
--- /dev/null
+++ b/migrator/migrations/m_226_to_m_227_backfill_report_type/test/schema/report_snapshots.go
@@ -0,0 +1,39 @@
+// Frozen pre-migration schema for the report_snapshots table (without the type column).
+
+package schema
+
+import (
+	"time"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/postgres"
+)
+
+var (
+	// CreateTableReportSnapshotsStmt holds the create statement for table `report_snapshots` (pre-migration).
+	CreateTableReportSnapshotsStmt = &postgres.CreateStmts{
+		GormModel: (*ReportSnapshots)(nil),
+		Children:  []*postgres.CreateStmts{},
+	}
+)
+
+const (
+	// ReportSnapshotsTableName specifies the name of the table in postgres.
+	ReportSnapshotsTableName = "report_snapshots"
+)
+
+// ReportSnapshots holds the pre-migration Gorm model (no type column).
+type ReportSnapshots struct {
+	ReportID                             string                                  `gorm:"column:reportid;type:uuid;primaryKey"`
+	ReportConfigurationID                string                                  `gorm:"column:reportconfigurationid;type:varchar"`
+	Name                                 string                                  `gorm:"column:name;type:varchar"`
+	ReportStatusRunState                 storage.ReportStatus_RunState           `gorm:"column:reportstatus_runstate;type:integer"`
+	ReportStatusQueuedAt                 *time.Time                              `gorm:"column:reportstatus_queuedat;type:timestamp"`
+	ReportStatusCompletedAt              *time.Time                              `gorm:"column:reportstatus_completedat;type:timestamp"`
+	ReportStatusReportRequestType        storage.ReportStatus_RunMethod          `gorm:"column:reportstatus_reportrequesttype;type:integer"`
+	ReportStatusReportNotificationMethod storage.ReportStatus_NotificationMethod `gorm:"column:reportstatus_reportnotificationmethod;type:integer"`
+	RequesterID                          string                                  `gorm:"column:requester_id;type:varchar"`
+	RequesterName                        string                                  `gorm:"column:requester_name;type:varchar"`
+	AreaOfConcern                        string                                  `gorm:"column:areaofconcern;type:varchar"`
+	Serialized                           []byte                                  `gorm:"column:serialized;type:bytea"`
+}
diff --git a/migrator/migrations/policymigrationhelper/postgres_policy_migrator_test.go b/migrator/migrations/policymigrationhelper/postgres_policy_migrator_test.go
index ea24aabc2dd05..32f545dfaf0e7 100644
--- a/migrator/migrations/policymigrationhelper/postgres_policy_migrator_test.go
+++ b/migrator/migrations/policymigrationhelper/postgres_policy_migrator_test.go
@@ -177,12 +177,12 @@ func (s *postgresPolicyMigratorTestSuite) TestExclusionAreAddedAndRemovedAsNeces
 
 	// Add a bunch of exclusions into the DB
 	policy.Exclusions = []*storage.Exclusion{
-		{Name: "exclusion0", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}},
-		{Name: "exclusion1", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace 1"}}},
-		{Name: "exclusion0", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}},
-		{Name: "exclusion2", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-2"}}},
-		{Name: "exclusion3", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-3"}}},
-		{Name: "exclusion4", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-4"}}},
+		{Name: "exclusion0", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}}},
+		{Name: "exclusion1", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace 1"}}}},
+		{Name: "exclusion0", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}}},
+		{Name: "exclusion2", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-2"}}}},
+		{Name: "exclusion3", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-3"}}}},
+		{Name: "exclusion4", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-4"}}}},
 	}
 
 	s.NoError(s.store.Upsert(s.ctx, policy))
@@ -196,14 +196,14 @@ func (s *postgresPolicyMigratorTestSuite) TestExclusionAreAddedAndRemovedAsNeces
 			FieldsToCompare: []FieldComparator{ExclusionComparator},
 			ToChange: PolicyUpdates{
 				ExclusionsToAdd: []*storage.Exclusion{
-					{Name: "exclusion1-changed", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-1"}}},
-					{Name: "NEW exclusion", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW"}}},
-					{Name: "NEW exclusion2", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW2"}}},
+					{Name: "exclusion1-changed", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-1"}}}},
+					{Name: "NEW exclusion", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW"}}}},
+					{Name: "NEW exclusion2", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW2"}}}},
 				},
 				ExclusionsToRemove: []*storage.Exclusion{
-					{Name: "exclusion1", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace 1"}}},
-					{Name: "exclusion4", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-4"}}},
-					{Name: "exclusion-NaN", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NaN"}}}, // this exclusion doesn't exist so it shouldn't get removed
+					{Name: "exclusion1", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace 1"}}}},
+					{Name: "exclusion4", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-4"}}}},
+					{Name: "exclusion-NaN", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NaN"}}}}, // this exclusion doesn't exist so it shouldn't get removed
 				},
 			},
 		},
@@ -221,13 +221,13 @@ func (s *postgresPolicyMigratorTestSuite) TestExclusionAreAddedAndRemovedAsNeces
 
 	// Policy exclusions should be updated
 	policy.Exclusions = []*storage.Exclusion{
-		{Name: "exclusion0", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}},
-		{Name: "exclusion0", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}},
-		{Name: "exclusion2", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-2"}}},
-		{Name: "exclusion3", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-3"}}},
-		{Name: "exclusion1-changed", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-1"}}},
-		{Name: "NEW exclusion", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW"}}},
-		{Name: "NEW exclusion2", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW2"}}},
+		{Name: "exclusion0", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}}},
+		{Name: "exclusion0", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-0"}}}},
+		{Name: "exclusion2", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-2"}}}},
+		{Name: "exclusion3", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-3"}}}},
+		{Name: "exclusion1-changed", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-1"}}}},
+		{Name: "NEW exclusion", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW"}}}},
+		{Name: "NEW exclusion2", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace-NEW2"}}}},
 	}
 
 	s.comparePolicyWithDB(policyID, policy)
@@ -248,7 +248,7 @@ func testPolicy(id string) *storage.Policy {
 			},
 		},
 		Exclusions: []*storage.Exclusion{
-			{Name: "exclusion name", Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace name"}}},
+			{Name: "exclusion name", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: "namespace name"}}}},
 		},
 	}
 }
@@ -357,7 +357,7 @@ func (s *postgresPolicyMigratorTestSuite) getAllCategories(ctx context.Context)
 	}
 	categoryMap := make(map[string]string, len(categories))
 	for _, c := range categories {
-		categoryMap[c.Name] = c.Id
+		categoryMap[c.GetName()] = c.GetId()
 	}
 	return categoryMap, nil
 }
diff --git a/migrator/runner/all.go b/migrator/runner/all.go
index 36d389254a23f..40cda51fdd633 100644
--- a/migrator/runner/all.go
+++ b/migrator/runner/all.go
@@ -19,4 +19,5 @@ import (
 	_ "github.com/stackrox/rox/migrator/migrations/m_223_to_m_224_add_deployment_type_and_enforcement_count_to_alerts"
 	_ "github.com/stackrox/rox/migrator/migrations/m_224_to_m_225_populate_deployment_containers_imageidv2"
 	_ "github.com/stackrox/rox/migrator/migrations/m_225_to_m_226_drop_unused_child_idx_indexes"
+	_ "github.com/stackrox/rox/migrator/migrations/m_226_to_m_227_backfill_report_type"
 )
diff --git a/operator/Makefile b/operator/Makefile
index a611b46489bb1..1e13f7b7cc243 100755
--- a/operator/Makefile
+++ b/operator/Makefile
@@ -237,15 +237,21 @@ parent-proto-generate: ## Make sure ../generated directory has up-to-date conten
 	[[ $${ROX_OPERATOR_SKIP_PROTO_GENERATED_SRCS:-false} = true ]] || $(MAKE) -C .. proto-generated-srcs
 
 .PHONY: manifests
-manifests: parent-proto-generate controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
+manifests: parent-proto-generate controller-gen go-mod-download ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
 	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
 
 .PHONY: generate
-generate: parent-proto-generate controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
+generate: parent-proto-generate controller-gen go-mod-download ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
 	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
 	# The generated source files might not comply with the current go formatting, so format them explicitly.
 	go fmt ./api/...
 
+.PHONY: go-mod-download
+go-mod-download: ## Download modules we depend on, with retries.
+# Warm up go module cache so that transient network failures do not abort controller-gen.
+# Once downloaded, this command is very quick (~200 ms).
+	go mod download || go mod download || go mod download
+
 .PHONY: fmt
 fmt: ## Run go fmt against code.
 	go fmt ./...
@@ -297,7 +303,7 @@ stackrox-image-pull-secret: ## Create default image pull secret for StackRox ima
 # Create stackrox namespace if not exists.
 	echo '{ "apiVersion": "v1", "kind": "Namespace", "metadata": { "name": "$(NAMESPACE)" } }' | $(PROJECT_DIR)/hack/retry-kubectl.sh apply -f -
 # Create stackrox image pull secret in stackrox namespace.
-	$(PROJECT_DIR)/../deploy/common/pull-secret.sh stackrox quay.io | $(PROJECT_DIR)/hack/retry-kubectl.sh -n "$(NAMESPACE)" apply -f -
+	$(PROJECT_DIR)/../scripts/pull-secret.sh stackrox quay.io | $(PROJECT_DIR)/hack/retry-kubectl.sh -n "$(NAMESPACE)" apply -f -
 
 .PHONY: check-ci-setup
 check-ci-setup: ## Make sure this target is not started in CI environment.
@@ -443,24 +449,18 @@ deploy-previous-via-olm: kuttl bundle-post-process ## Deploy replaced version of
 	set -x ;\
 	KUTTL=$(KUTTL) PATH="$(PROJECT_DIR)/hack:$${PATH}" ./hack/olm-operator-install.sh $(TEST_NAMESPACE) $(INDEX_IMG_BASE) $(INDEX_IMG_TAG) $${replaced_version} $(INSTALL_CHANNEL)
 
-.PHONY: deploy-via-installer
-deploy-via-installer: ## Deploy current version of operator via distribution manifest file.
-	./hack/retry-kubectl.sh </dev/null apply -f dist/install.yaml
-# A hack for the NO_PROXY assertions in the e2e tests.
-	./hack/retry-kubectl.sh </dev/null set env -n $(TEST_NAMESPACE) deployment/rhacs-operator-controller-manager NO_PROXY=127.1.2.3/8
-# Need to hardcode the deployment name here and above, since kubectl barfs on the CRDs in the manifest when working on deployment:
-# $ oc rollout status  -f operator/dist/install.yaml --timeout=300s
-# deployment "rhacs-operator-controller-manager" successfully rolled out
-# unable to decode "operator/dist/install.yaml": no kind "CustomResourceDefinition" is registered for version "apiextensions.k8s.io/v1" in scheme "k8s.io/kubectl/pkg/scheme/scheme.go:28"
-# TODO(ROX-11901): work this around somehow to make it possible to deploy and e2e-test the community build
-	./hack/retry-kubectl.sh </dev/null rollout status deployment -n $(TEST_NAMESPACE) rhacs-operator-controller-manager --timeout=300s
-
 .PHONY: deploy-via-chart
 deploy-via-chart: ## Deploy current version of operator via helm chart produced by the chart target.
-	helm install --create-namespace --namespace $(TEST_NAMESPACE) --wait \
+	helm upgrade --install --create-namespace --namespace $(TEST_NAMESPACE) --wait \
 		--set manager.envOverrides.NO_PROXY=127.1.2.3/8 `# A hack for the NO_PROXY assertions in the e2e tests.` \
 		rhacs-operator ./dist/chart
 
+.PHONY: deploy-previous-via-chart
+deploy-previous-via-chart: kuttl bundle-post-process ## Deploy replaced version of operator image to the cluster using helm chart.
+	$(SILENT)replaced_version=$$(sed -E -n 's/^[[:space:]]*replaces:[[:space:]]*[^.]+\.(.*)$$/\1/p' build/bundle/manifests/rhacs-operator.clusterserviceversion.yaml) ;\
+	set -x ;\
+	TEST_NAMESPACE=$(TEST_NAMESPACE) ./hack/generate-and-install-chart.sh "$${replaced_version}"
+
 .PHONY: upgrade-via-olm
 upgrade-via-olm: kuttl
 	KUTTL=$(KUTTL) PATH="$(PROJECT_DIR)/hack:$${PATH}" ./hack/olm-operator-upgrade.sh $(TEST_NAMESPACE) $(INSTALL_VERSION)
@@ -469,13 +469,6 @@ upgrade-via-olm: kuttl
 upgrade-dirty-tag-via-olm: kuttl
 	KUTTL=$(KUTTL) PATH="$(PROJECT_DIR)/hack:$${PATH}" ./hack/olm-operator-upgrade.sh --allow-dirty-tag $(TEST_NAMESPACE) $(INSTALL_VERSION)
 
-.PHONY: upgrade-via-chart
-upgrade-via-chart:
-# TODO(ROX-33128): drop --take-ownership (and possibly replace with deploy-via-chart) after 4.11 release
-	helm install --take-ownership --namespace $(TEST_NAMESPACE) --wait \
-		--set manager.envOverrides.NO_PROXY=127.1.2.3/8 `# A hack for the NO_PROXY assertions in the e2e tests.` \
-		rhacs-operator ./dist/chart
-
 ##@ Bundle and Index build
 
 .PHONY: bundle
diff --git a/operator/api/v1alpha1/central_types.go b/operator/api/v1alpha1/central_types.go
index 8f9d435da2f05..610b453f0bb94 100644
--- a/operator/api/v1alpha1/central_types.go
+++ b/operator/api/v1alpha1/central_types.go
@@ -33,12 +33,13 @@ type CentralSpec struct {
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Central Component Settings"
 	Central *CentralComponentSpec `json:"central,omitempty"`
 
-	// Settings for the Scanner component, which is responsible for vulnerability scanning of container
-	// images.
-	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=2,displayName="Scanner Component Settings"
+	// Obsolete field. This field will be removed in a future release.
+	// The legacy Scanner has been removed. This field is ignored.
+	//+operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:hidden"}
 	Scanner *ScannerComponentSpec `json:"scanner,omitempty"`
 
-	// Settings for the Scanner V4 component, which can run in addition to the previously existing Scanner components
+	// Settings for the Scanner V4 component
+	// TODO(ROX-36705): renumber order annotations after legacy Scanner field removal
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=3,displayName="Scanner V4 Component Settings"
 	ScannerV4 *ScannerV4Spec `json:"scannerV4,omitempty"`
 
@@ -168,13 +169,20 @@ type CentralComponentSpec struct {
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=7,displayName="Declarative Configuration",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:hidden"}
 	DeclarativeConfiguration *DeclarativeConfiguration `json:"declarativeConfiguration,omitempty"`
 
+	// References a ConfigMap containing the Red Hat signing key bundle (key `bundle.json`).
+	// This allows air-gapped customers to provide or update the signing keys used for
+	// signature verification of Red Hat container images. The ConfigMap is managed
+	// externally; key rotation requires only editing the ConfigMap, not a CR update.
+	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=8,displayName="Signing Key Bundle",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:hidden"}
+	SigningKeyBundle *LocalConfigMapReference `json:"signingKeyBundle,omitempty"`
+
 	// Configures the encryption of notifier secrets stored in the Central DB.
-	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=8,displayName="Notifier Secrets Encryption",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:hidden"}
+	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=9,displayName="Notifier Secrets Encryption",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:hidden"}
 	NotifierSecretsEncryption *NotifierSecretsEncryption `json:"notifierSecretsEncryption,omitempty"`
 
 	// Configures the rollout strategy for the Central deployment.
 	// The default is: Recreate.
-	//+operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Rollout Strategy",order=9
+	//+operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Rollout Strategy",order=10
 	RolloutStrategy *RolloutStrategy `json:"rolloutStrategy,omitempty"`
 
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=99
@@ -569,9 +577,7 @@ type ScannerComponentSpec struct {
 // ScannerV4Spec defines settings for the central "Scanner V4" component.
 type ScannerV4Spec struct {
 	// Can be specified as "Enabled" or "Disabled".
-	// If this field is not specified, the following defaulting takes place:
-	// * for upgrades to 4.8 from previous releases, the default is: Disabled;
-	// * for new installations starting with ACS 4.8, the default is: Enabled.
+	// The default is: Enabled.
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Scanner V4 component"
 	ScannerComponent *ScannerV4ComponentPolicy `json:"scannerComponent,omitempty"`
 
@@ -610,14 +616,6 @@ func (s *ScannerComponentSpec) GetAnalyzer() *ScannerAnalyzerComponent {
 	return s.Analyzer
 }
 
-// IsEnabled checks whether scanner is enabled. This method is safe to be used with nil receivers.
-func (s *ScannerComponentSpec) IsEnabled() bool {
-	if s == nil || s.ScannerComponent == nil {
-		return true // enabled by default
-	}
-	return *s.ScannerComponent == ScannerComponentEnabled
-}
-
 // ScannerComponentPolicy is a type for values of spec.scanner.scannerComponent.
 // +kubebuilder:validation:Enum=Enabled;Disabled
 type ScannerComponentPolicy string
@@ -645,7 +643,7 @@ const (
 // CentralWorkerSpec defines the central-worker configuration.
 type CentralWorkerSpec struct {
 	// If set to true, pruning and reporting jobs run in a separate Deployment.
-	// The default is: false.
+	// The default is: true.
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Enabled"
 	Enabled *bool `json:"enabled,omitempty"`
 
@@ -788,7 +786,7 @@ var (
 
 // IsScannerEnabled returns true if scanner is enabled.
 func (c *Central) IsScannerEnabled() bool {
-	return c.Spec.Scanner.IsEnabled()
+	return false
 }
 
 // IsScannerV4Enabled returns true if Scanner V4 is enabled.
diff --git a/operator/api/v1alpha1/securedcluster_types.go b/operator/api/v1alpha1/securedcluster_types.go
index 50e0c056f3a0f..5dd4fce7fc6b4 100644
--- a/operator/api/v1alpha1/securedcluster_types.go
+++ b/operator/api/v1alpha1/securedcluster_types.go
@@ -69,12 +69,13 @@ type SecuredClusterSpec struct {
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=7,displayName="Process Baselines Settings"
 	ProcessBaselines *ProcessBaselinesSpec `json:"processBaselines,omitempty"`
 
-	// Settings for the Scanner component, which is responsible for vulnerability scanning of container
-	// images stored in a cluster-local image repository.
-	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=8,displayName="Scanner Component Settings"
+	// Obsolete field. This field will be removed in a future release.
+	// The legacy Scanner has been removed. This field is ignored.
+	//+operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:hidden"}
 	Scanner *LocalScannerComponentSpec `json:"scanner,omitempty"`
 
-	// Settings for the Scanner V4 components, which can run in addition to the previously existing Scanner components
+	// Settings for the Scanner V4 components
+	// TODO(ROX-36705): renumber order annotations after legacy Scanner field removal
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=9,displayName="Scanner V4 Component Settings"
 	ScannerV4 *LocalScannerV4ComponentSpec `json:"scannerV4,omitempty"`
 	// Above default is necessary to make the nested default work see: https://github.com/kubernetes-sigs/controller-tools/issues/622
@@ -116,7 +117,7 @@ type SecuredClusterSpec struct {
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,displayName=ProcessIndicators,order=17,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:advanced"}
 	ProcessIndicators *ProcessIndicatorsSpec `json:"processIndicators,omitempty"`
 
-	// Settings for virtual machine scanning (VSOCK RBAC and scraper).
+	// Settings for the virtual machine scraper.
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=18,displayName="Virtual Machines Settings"
 	VirtualMachines *VirtualMachinesSpec `json:"virtualMachines,omitempty"`
 }
@@ -427,10 +428,7 @@ const (
 
 // LocalScannerComponentSpec defines settings for the "scanner" component.
 type LocalScannerComponentSpec struct {
-	// If you do not want to deploy the Red Hat Advanced Cluster Security Scanner, you can disable it here
-	// (not recommended).
-	// If you do so, all the settings in this section will have no effect.
-	// The default is: AutoSense.
+	// Obsolete: The legacy Scanner has been removed. This field is ignored.
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Scanner Component",order=1
 	ScannerComponent *LocalScannerComponentPolicy `json:"scannerComponent,omitempty"`
 
@@ -450,9 +448,7 @@ type LocalScannerV4ComponentSpec struct {
 	// unless there is a Central resource in the same namespace.
 	// In that case typically a central Scanner V4 will be deployed as a component of Central.
 	// A value of "Disabled" means that Scanner V4 should not be installed.
-	// If this field is not specified or set to "Default", the following defaulting takes place:
-	// * for upgrades to 4.8 from previous releases, the default is: Disabled;
-	// * for new installations starting with ACS 4.8, the default is: AutoSense.
+	// The default is: AutoSense.
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Scanner V4 component",order=1
 	ScannerComponent *LocalScannerV4ComponentPolicy `json:"scannerComponent,omitempty"`
 
@@ -545,32 +541,13 @@ func (v ProcessIndicatorConfigSwitch) Pointer() *ProcessIndicatorConfigSwitch {
 	return &v
 }
 
-// VirtualMachinesSpec configures VM scanning and VSOCK RBAC.
+// VirtualMachinesSpec configures virtual machine scanning.
 type VirtualMachinesSpec struct {
-	// Whether virtual machine scanning and VSOCK RBAC are enabled.
-	// The default is: Disabled.
-	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=1,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:select:Enabled","urn:alm:descriptor:com.tectonic.ui:select:Disabled"}
-	Mode *VirtualMachinesMode `json:"mode,omitempty"`
-
 	// Settings for the virtual machine scraper running in Sensor.
-	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=2
+	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=1
 	Scraper *VirtualMachinesScraperSpec `json:"scraper,omitempty"`
 }
 
-// VirtualMachinesMode is the type for spec.virtualMachines.mode.
-// +kubebuilder:validation:Enum=Enabled;Disabled
-type VirtualMachinesMode string
-
-const (
-	VirtualMachinesModeEnabled  VirtualMachinesMode = "Enabled"
-	VirtualMachinesModeDisabled VirtualMachinesMode = "Disabled"
-)
-
-// Pointer returns the given mode value as a pointer, needed in k8s resource structs.
-func (v VirtualMachinesMode) Pointer() *VirtualMachinesMode {
-	return &v
-}
-
 // VirtualMachinesScraperSpec tunes the virtual machine scraper.
 type VirtualMachinesScraperSpec struct {
 	// Maximum number of virtual machines scraped concurrently in each poll cycle.
@@ -589,7 +566,7 @@ type VirtualMachinesScraperSpec struct {
 	// How often the scraper polls virtual machines for new reports.
 	// Minimum interval is 1m; shorter values are rounded up.
 	// Shorter intervals refresh scans more often but increase the load on kubevirt API server.
-	// The default is: 5m.
+	// The default is: 4h.
 	//+kubebuilder:validation:Pattern=`^[0-9]+(m|h)$`
 	//+operator-sdk:csv:customresourcedefinitions:type=spec,order=3
 	PollInterval *string `json:"pollInterval,omitempty"`
diff --git a/operator/api/v1alpha1/zz_generated.deepcopy.go b/operator/api/v1alpha1/zz_generated.deepcopy.go
index af410a3c694d9..00a97401d5ab1 100644
--- a/operator/api/v1alpha1/zz_generated.deepcopy.go
+++ b/operator/api/v1alpha1/zz_generated.deepcopy.go
@@ -217,6 +217,11 @@ func (in *CentralComponentSpec) DeepCopyInto(out *CentralComponentSpec) {
 		*out = new(DeclarativeConfiguration)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.SigningKeyBundle != nil {
+		in, out := &in.SigningKeyBundle, &out.SigningKeyBundle
+		*out = new(LocalConfigMapReference)
+		**out = **in
+	}
 	if in.NotifierSecretsEncryption != nil {
 		in, out := &in.NotifierSecretsEncryption, &out.NotifierSecretsEncryption
 		*out = new(NotifierSecretsEncryption)
@@ -2025,11 +2030,6 @@ func (in *VirtualMachinesScraperSpec) DeepCopy() *VirtualMachinesScraperSpec {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *VirtualMachinesSpec) DeepCopyInto(out *VirtualMachinesSpec) {
 	*out = *in
-	if in.Mode != nil {
-		in, out := &in.Mode, &out.Mode
-		*out = new(VirtualMachinesMode)
-		**out = **in
-	}
 	if in.Scraper != nil {
 		in, out := &in.Scraper, &out.Scraper
 		*out = new(VirtualMachinesScraperSpec)
diff --git a/operator/bundle/manifests/config.stackrox.io_securitypolicies.yaml b/operator/bundle/manifests/config.stackrox.io_securitypolicies.yaml
index 51c227281ddf2..dadcf9abe6338 100644
--- a/operator/bundle/manifests/config.stackrox.io_securitypolicies.yaml
+++ b/operator/bundle/manifests/config.stackrox.io_securitypolicies.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.21.0
+    controller-gen.kubebuilder.io/version: v0.22.0
   labels:
     app: rhacs-operator
   name: securitypolicies.config.stackrox.io
@@ -83,7 +83,11 @@ spec:
                   evaluates.
                 properties:
                   skipContainerTypes:
+                    description: SkipContainerTypes lists container kinds to skip
+                      during evaluation.
                     items:
+                      description: ContainerType lists container kinds a policy may
+                        skip during evaluation.
                       enum:
                       - REGULAR
                       - INIT
@@ -139,6 +143,23 @@ spec:
                               type: object
                           type: object
                       type: object
+                    excludeByKind:
+                      description: ExcludeByKind excludes all workloads of the selected
+                        Kubernetes kinds.
+                      properties:
+                        kinds:
+                          description: Kinds is the list of Kubernetes workload kinds
+                            to exclude.
+                          items:
+                            enum:
+                            - CRON_JOB
+                            - JOB
+                            type: string
+                          minItems: 1
+                          type: array
+                      required:
+                      - kinds
+                      type: object
                     expiration:
                       format: date-time
                       type: string
@@ -150,6 +171,11 @@ spec:
                     name:
                       type: string
                   type: object
+                  x-kubernetes-validations:
+                  - message: at most one of the fields in [deployment excludeByKind]
+                      may be set
+                    rule: (has(self.deployment)?1:0)+(has(self.excludeByKind)?1:0)
+                      <= 1
                 type: array
               isDefault:
                 description: IsDefault is unused
diff --git a/operator/bundle/manifests/platform.stackrox.io_centrals.yaml b/operator/bundle/manifests/platform.stackrox.io_centrals.yaml
index 5ed63ce403b9b..3474ec526ae09 100644
--- a/operator/bundle/manifests/platform.stackrox.io_centrals.yaml
+++ b/operator/bundle/manifests/platform.stackrox.io_centrals.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.21.0
+    controller-gen.kubebuilder.io/version: v0.22.0
   labels:
     app: rhacs-operator
   name: centrals.platform.stackrox.io
@@ -601,6 +601,19 @@ spec:
                     - Recreate
                     - RollingUpdate
                     type: string
+                  signingKeyBundle:
+                    description: |-
+                      References a ConfigMap containing the Red Hat signing key bundle (key `bundle.json`).
+                      This allows air-gapped customers to provide or update the signing keys used for
+                      signature verification of Red Hat container images. The ConfigMap is managed
+                      externally; key rotation requires only editing the ConfigMap, not a CR update.
+                    properties:
+                      name:
+                        description: The name of the referenced config map.
+                        type: string
+                    required:
+                    - name
+                    type: object
                   telemetry:
                     description: |-
                       Configures telemetry settings for Central. If enabled, Central transmits telemetry and diagnostic
@@ -1595,7 +1608,7 @@ spec:
                   enabled:
                     description: |-
                       If set to true, pruning and reporting jobs run in a separate Deployment.
-                      The default is: false.
+                      The default is: true.
                     type: boolean
                   hostAliases:
                     description: HostAliases allows configuring additional hostnames
@@ -1985,7 +1998,9 @@ spec:
                               description: Selects a key of a ConfigMap.
                               properties:
                                 key:
-                                  description: The key to select.
+                                  description: |-
+                                    The key to select from the ConfigMap's Data field.
+                                    Keys in the BinaryData field are not currently propagated to container env vars.
                                   type: string
                                 name:
                                   default: ""
@@ -2256,8 +2271,8 @@ spec:
                 type: array
               scanner:
                 description: |-
-                  Settings for the Scanner component, which is responsible for vulnerability scanning of container
-                  images.
+                  Obsolete field. This field will be removed in a future release.
+                  The legacy Scanner has been removed. This field is ignored.
                 properties:
                   analyzer:
                     description: Settings pertaining to the analyzer deployment, such
@@ -2589,8 +2604,7 @@ spec:
                     type: string
                 type: object
               scannerV4:
-                description: Settings for the Scanner V4 component, which can run
-                  in addition to the previously existing Scanner components
+                description: Settings for the Scanner V4 component
                 properties:
                   db:
                     description: Settings pertaining to the DB deployment.
@@ -3118,9 +3132,7 @@ spec:
                   scannerComponent:
                     description: |-
                       Can be specified as "Enabled" or "Disabled".
-                      If this field is not specified, the following defaulting takes place:
-                      * for upgrades to 4.8 from previous releases, the default is: Disabled;
-                      * for new installations starting with ACS 4.8, the default is: Enabled.
+                      The default is: Enabled.
                     enum:
                     - Default
                     - Enabled
diff --git a/operator/bundle/manifests/platform.stackrox.io_securedclusters.yaml b/operator/bundle/manifests/platform.stackrox.io_securedclusters.yaml
index f6d944598bb7b..9c168a70ee06e 100644
--- a/operator/bundle/manifests/platform.stackrox.io_securedclusters.yaml
+++ b/operator/bundle/manifests/platform.stackrox.io_securedclusters.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.21.0
+    controller-gen.kubebuilder.io/version: v0.22.0
   labels:
     app: rhacs-operator
   name: securedclusters.platform.stackrox.io
@@ -401,7 +401,9 @@ spec:
                               description: Selects a key of a ConfigMap.
                               properties:
                                 key:
-                                  description: The key to select.
+                                  description: |-
+                                    The key to select from the ConfigMap's Data field.
+                                    Keys in the BinaryData field are not currently propagated to container env vars.
                                   type: string
                                 name:
                                   default: ""
@@ -1032,8 +1034,8 @@ spec:
                 type: string
               scanner:
                 description: |-
-                  Settings for the Scanner component, which is responsible for vulnerability scanning of container
-                  images stored in a cluster-local image repository.
+                  Obsolete field. This field will be removed in a future release.
+                  The legacy Scanner has been removed. This field is ignored.
                 properties:
                   analyzer:
                     description: Settings pertaining to the analyzer deployment, such
@@ -1339,19 +1341,15 @@ spec:
                         type: array
                     type: object
                   scannerComponent:
-                    description: |-
-                      If you do not want to deploy the Red Hat Advanced Cluster Security Scanner, you can disable it here
-                      (not recommended).
-                      If you do so, all the settings in this section will have no effect.
-                      The default is: AutoSense.
+                    description: 'Obsolete: The legacy Scanner has been removed. This
+                      field is ignored.'
                     enum:
                     - AutoSense
                     - Disabled
                     type: string
                 type: object
               scannerV4:
-                description: Settings for the Scanner V4 components, which can run
-                  in addition to the previously existing Scanner components
+                description: Settings for the Scanner V4 components
                 properties:
                   db:
                     description: Settings pertaining to the DB deployment.
@@ -1717,9 +1715,7 @@ spec:
                       unless there is a Central resource in the same namespace.
                       In that case typically a central Scanner V4 will be deployed as a component of Central.
                       A value of "Disabled" means that Scanner V4 should not be installed.
-                      If this field is not specified or set to "Default", the following defaulting takes place:
-                      * for upgrades to 4.8 from previous releases, the default is: Disabled;
-                      * for new installations starting with ACS 4.8, the default is: AutoSense.
+                      The default is: AutoSense.
                     enum:
                     - Default
                     - AutoSense
@@ -1884,17 +1880,8 @@ spec:
                     type: array
                 type: object
               virtualMachines:
-                description: Settings for virtual machine scanning (VSOCK RBAC and
-                  scraper).
+                description: Settings for the virtual machine scraper.
                 properties:
-                  mode:
-                    description: |-
-                      Whether virtual machine scanning and VSOCK RBAC are enabled.
-                      The default is: Disabled.
-                    enum:
-                    - Enabled
-                    - Disabled
-                    type: string
                   scraper:
                     description: Settings for the virtual machine scraper running
                       in Sensor.
@@ -1919,7 +1906,7 @@ spec:
                           How often the scraper polls virtual machines for new reports.
                           Minimum interval is 1m; shorter values are rounded up.
                           Shorter intervals refresh scans more often but increase the load on kubevirt API server.
-                          The default is: 5m.
+                          The default is: 4h.
                         pattern: ^[0-9]+(m|h)$
                         type: string
                     type: object
diff --git a/operator/bundle/manifests/rhacs-operator.clusterserviceversion.yaml b/operator/bundle/manifests/rhacs-operator.clusterserviceversion.yaml
index 5737c974e0cbd..daada4042163d 100644
--- a/operator/bundle/manifests/rhacs-operator.clusterserviceversion.yaml
+++ b/operator/bundle/manifests/rhacs-operator.clusterserviceversion.yaml
@@ -84,12 +84,7 @@ spec:
           - description: Settings for the Central component, which is responsible for all user interaction.
             displayName: Central Component Settings
             path: central
-          - description: |-
-              Settings for the Scanner component, which is responsible for vulnerability scanning of container
-              images.
-            displayName: Scanner Component Settings
-            path: scanner
-          - description: Settings for the Scanner V4 component, which can run in addition to the previously existing Scanner components
+          - description: Settings for the Scanner V4 component
             displayName: Scanner V4 Component Settings
             path: scannerV4
           - description: Settings related to outgoing network traffic.
@@ -142,6 +137,13 @@ spec:
             path: misc
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:hidden
+          - description: |-
+              Obsolete field. This field will be removed in a future release.
+              The legacy Scanner has been removed. This field is ignored.
+            displayName: Scanner
+            path: scanner
+            x-descriptors:
+              - urn:alm:descriptor:com.tectonic.ui:hidden
           - description: |-
               Specify a secret that contains the administrator password in the "password" data item.
               If omitted, the operator will auto-generate a password and store it in the "password" item
@@ -181,6 +183,15 @@ spec:
             path: central.declarativeConfiguration
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:hidden
+          - description: |-
+              References a ConfigMap containing the Red Hat signing key bundle (key `bundle.json`).
+              This allows air-gapped customers to provide or update the signing keys used for
+              signature verification of Red Hat container images. The ConfigMap is managed
+              externally; key rotation requires only editing the ConfigMap, not a CR update.
+            displayName: Signing Key Bundle
+            path: central.signingKeyBundle
+            x-descriptors:
+              - urn:alm:descriptor:com.tectonic.ui:hidden
           - description: Configures the encryption of notifier secrets stored in the Central DB.
             displayName: Notifier Secrets Encryption
             path: central.notifierSecretsEncryption
@@ -480,6 +491,11 @@ spec:
             path: central.persistence.persistentVolumeClaim.storageClassName
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:hidden
+          - description: The name of the referenced config map.
+            displayName: Name
+            path: central.signingKeyBundle.name
+            x-descriptors:
+              - urn:alm:descriptor:io.kubernetes:ConfigMap
           - description: |-
               Specifies whether Telemetry is enabled.
               The default is: true.
@@ -500,7 +516,7 @@ spec:
             path: central.telemetry.storage.key
           - description: |-
               If set to true, pruning and reporting jobs run in a separate Deployment.
-              The default is: false.
+              The default is: true.
             displayName: Enabled
             path: centralWorker.enabled
           - description: |-
@@ -761,9 +777,7 @@ spec:
             path: scanner.monitoring.exposeEndpoint
           - description: |-
               Can be specified as "Enabled" or "Disabled".
-              If this field is not specified, the following defaulting takes place:
-              * for upgrades to 4.8 from previous releases, the default is: Disabled;
-              * for new installations starting with ACS 4.8, the default is: Enabled.
+              The default is: Enabled.
             displayName: Scanner V4 component
             path: scannerV4.scannerComponent
           - description: Settings pertaining to the indexer deployment.
@@ -1020,12 +1034,7 @@ spec:
           - description: Settings relating to process baselines.
             displayName: Process Baselines Settings
             path: processBaselines
-          - description: |-
-              Settings for the Scanner component, which is responsible for vulnerability scanning of container
-              images stored in a cluster-local image repository.
-            displayName: Scanner Component Settings
-            path: scanner
-          - description: Settings for the Scanner V4 components, which can run in addition to the previously existing Scanner components
+          - description: Settings for the Scanner V4 components
             displayName: Scanner V4 Component Settings
             path: scannerV4
           - description: Settings related to Transport Layer Security, such as Certificate Authorities.
@@ -1066,7 +1075,7 @@ spec:
             path: processIndicators
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:advanced
-          - description: Settings for virtual machine scanning (VSOCK RBAC and scraper).
+          - description: Settings for the virtual machine scraper.
             displayName: Virtual Machines Settings
             path: virtualMachines
           - description: |-
@@ -1076,6 +1085,13 @@ spec:
             path: misc
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:hidden
+          - description: |-
+              Obsolete field. This field will be removed in a future release.
+              The legacy Scanner has been removed. This field is ignored.
+            displayName: Scanner
+            path: scanner
+            x-descriptors:
+              - urn:alm:descriptor:com.tectonic.ui:hidden
           - description: |-
               Set to Disabled to disable policy enforcement for the admission controller. This is not recommended.
               On upgrades to 4.9 from previous releases, defaults to Enabled only if at least one of listenOnCreates or listenOnUpdates is true.
@@ -1358,11 +1374,7 @@ spec:
           - description: A regex specifying namespaces whose process indicators should not be persisted.
             displayName: Exclude Namespace Regex
             path: processIndicators.excludeNamespaceRegex
-          - description: |-
-              If you do not want to deploy the Red Hat Advanced Cluster Security Scanner, you can disable it here
-              (not recommended).
-              If you do so, all the settings in this section will have no effect.
-              The default is: AutoSense.
+          - description: 'Obsolete: The legacy Scanner has been removed. This field is ignored.'
             displayName: Scanner Component
             path: scanner.scannerComponent
           - description: Settings pertaining to the analyzer deployment, such as for autoscaling.
@@ -1445,9 +1457,7 @@ spec:
               unless there is a Central resource in the same namespace.
               In that case typically a central Scanner V4 will be deployed as a component of Central.
               A value of "Disabled" means that Scanner V4 should not be installed.
-              If this field is not specified or set to "Default", the following defaulting takes place:
-              * for upgrades to 4.8 from previous releases, the default is: Disabled;
-              * for new installations starting with ACS 4.8, the default is: AutoSense.
+              The default is: AutoSense.
             displayName: Scanner V4 component
             path: scannerV4.scannerComponent
           - description: Settings pertaining to the indexer deployment.
@@ -1607,14 +1617,6 @@ spec:
           - description: Allows you to specify additional trusted Root CAs.
             displayName: Additional CAs
             path: tls.additionalCAs
-          - description: |-
-              Whether virtual machine scanning and VSOCK RBAC are enabled.
-              The default is: Disabled.
-            displayName: Mode
-            path: virtualMachines.mode
-            x-descriptors:
-              - urn:alm:descriptor:com.tectonic.ui:select:Enabled
-              - urn:alm:descriptor:com.tectonic.ui:select:Disabled
           - description: Settings for the virtual machine scraper running in Sensor.
             displayName: Scraper
             path: virtualMachines.scraper
@@ -1633,7 +1635,7 @@ spec:
               How often the scraper polls virtual machines for new reports.
               Minimum interval is 1m; shorter values are rounded up.
               Shorter intervals refresh scans more often but increase the load on kubevirt API server.
-              The default is: 5m.
+              The default is: 4h.
             displayName: Poll Interval
             path: virtualMachines.scraper.pollInterval
         statusDescriptors:
@@ -1690,7 +1692,7 @@ spec:
 
     2. **Secured Cluster Services** - Secured cluster services are placed on each cluster you manage and report back to Central. These services allow users to enforce policies and monitor your OpenShift and Kubernetes clusters. Secured Cluster Services come as two Deployments (Sensor and Admission Controller) and one DaemonSet (Collector).
 
-    **Console Plugin (Tech Preview):** RHACS provides a dynamic plugin that displays vulnerability management information in the OpenShift web console. Install a SecuredCluster to deploy the plugin. Enable the plugin by selecting *Operators* > *Installed Operators* or by modifying the console Operator configuration.
+    **Console Plugin:** RHACS provides a dynamic plugin that displays vulnerability management information in the OpenShift web console. Install a SecuredCluster to deploy the plugin. Enable the plugin by selecting *Operators* > *Installed Operators* or by modifying the console Operator configuration.
     **Important:** The Console Plugin requires OpenShift 4.19 or later.
 
     ### Central Services Explained
@@ -1699,8 +1701,10 @@ spec:
     | :------------------------------- | :-------------- | :-------------- |
     | Central                          | Deployment      | Users interact with Red Hat Advanced Cluster Security through the user interface or APIs on Central. Central also sends notifications for violations and interacts with integrations. |
     | Central DB                       | Deployment      | Central DB is a PostgreSQL-based persistent storage for the data collected and managed by Central. |
-    | Scanner                          | Deployment      | Scanner is a Red Hat developed and certified image scanner. Scanner analyzes and reports vulnerabilities for images. Scanner uses HPA to scale the number of replicas based on workload. |
-    | Scanner DB                       | Deployment      | Scanner DB is a cache for vulnerability definitions to serve vulnerability scanning use cases throughout the software development life cycle. |
+    | Scanner V4 Indexer               | Deployment      | Scanner V4 Indexer analyzes container image layers and creates an index of packages and files. Scanner V4 Indexer uses Horizontal Pod Autoscaler (HPA) to scale the number of replicas based on workload. |
+    | Scanner V4 Matcher               | Deployment      | Scanner V4 Matcher matches indexed image content in vulnerability databases to identify security issues. Scanner V4 Matcher uses HPA to scale the number of replicas based on workload. |
+    | Scanner V4 DB                    | Deployment      | Scanner V4 DB is a PostgreSQL-based persistent storage for indexed image data and vulnerability definitions. |
+    | Config Controller                | Deployment      | Config Controller watches SecurityPolicy custom resources and reconciles them with Central to manage security policies declaratively. |
 
     ### Secured Cluster Services Explained
 
@@ -1709,6 +1713,8 @@ spec:
     | Sensor                           | Deployment      | Sensor analyzes and monitors Kubernetes in secured clusters. |
     | Collector                        | DaemonSet       | Analyzes and monitors container activity on Kubernetes nodes.|
     | Admission Controller             | Deployment      | ValidatingWebhookConfiguration for enforcing policies in the deploy lifecycle. |
+    | Scanner V4 Indexer               | Deployment      | Scanner V4 Indexer analyzes container image layers and creates an index of packages and files. Scanner V4 Indexer uses HPA to scale the number of replicas based on workload. |
+    | Scanner V4 DB                    | Deployment      | Scanner V4 DB is a PostgreSQL-based persistent storage for indexed image data. |
 
     ### Central Custom Resource
 
@@ -1819,10 +1825,6 @@ spec:
                       - --leader-elect
                     env:
                       - name: RELATED_IMAGE_MAIN
-                      - name: RELATED_IMAGE_SCANNER
-                      - name: RELATED_IMAGE_SCANNER_SLIM
-                      - name: RELATED_IMAGE_SCANNER_DB
-                      - name: RELATED_IMAGE_SCANNER_DB_SLIM
                       - name: RELATED_IMAGE_COLLECTOR
                       - name: RELATED_IMAGE_FACT
                       - name: RELATED_IMAGE_ROXCTL
@@ -1929,7 +1931,7 @@ spec:
     - risk
   links:
     - name: Red Hat Advanced Cluster Security Documentation
-      url: https://docs.openshift.com/acs/welcome/
+      url: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes
     - name: DataSheet
       url: https://www.redhat.com/en/resources/advanced-cluster-security-for-kubernetes-datasheet
     - name: Support Policy
diff --git a/operator/bundle_helpers/pkg/csv/patcher_test.go b/operator/bundle_helpers/pkg/csv/patcher_test.go
index 6083e23deee88..098cb0beada0e 100644
--- a/operator/bundle_helpers/pkg/csv/patcher_test.go
+++ b/operator/bundle_helpers/pkg/csv/patcher_test.go
@@ -20,7 +20,6 @@ func mustReadValues(t *testing.T, s string) chartutil.Values {
 
 func TestPatchCSV_BasicVersionPatching(t *testing.T) {
 	t.Setenv("RELATED_IMAGE_MAIN", "quay.io/rhacs-eng/main:4.0.0")
-	t.Setenv("RELATED_IMAGE_SCANNER", "quay.io/rhacs-eng/scanner:4.0.0")
 
 	input := mustReadValues(t, `
 metadata:
@@ -54,7 +53,6 @@ spec:
 
 func TestPatchCSV_ReplacesVersionCalculation(t *testing.T) {
 	t.Setenv("RELATED_IMAGE_MAIN", "quay.io/rhacs-eng/main:4.0.0")
-	t.Setenv("RELATED_IMAGE_SCANNER", "quay.io/rhacs-eng/scanner:4.0.0")
 
 	input := mustReadValues(t, `
 metadata:
@@ -80,8 +78,8 @@ spec:
 
 func TestInjectRelatedImageEnvVars(t *testing.T) {
 	t.Setenv("RELATED_IMAGE_MAIN", "quay.io/rhacs-eng/main:4.5.0")
-	t.Setenv("RELATED_IMAGE_SCANNER", "quay.io/rhacs-eng/scanner:4.5.0")
-	t.Setenv("RELATED_IMAGE_SCANNER_DB", "quay.io/rhacs-eng/scanner-db:4.5.0")
+	t.Setenv("RELATED_IMAGE_SCANNER_V4", "quay.io/rhacs-eng/scanner-v4:4.5.0")
+	t.Setenv("RELATED_IMAGE_SCANNER_V4_DB", "quay.io/rhacs-eng/scanner-v4-db:4.5.0")
 
 	spec := mustReadValues(t, `
 install:
@@ -93,8 +91,8 @@ install:
             containers:
             - env:
               - name: RELATED_IMAGE_MAIN
-              - name: RELATED_IMAGE_SCANNER
-              - name: RELATED_IMAGE_SCANNER_DB
+              - name: RELATED_IMAGE_SCANNER_V4
+              - name: RELATED_IMAGE_SCANNER_V4_DB
 `)
 
 	err := injectRelatedImageEnvVars(spec)
@@ -108,8 +106,8 @@ install:
 	env := container["env"].([]any)
 
 	assert.Equal(t, "quay.io/rhacs-eng/main:4.5.0", env[0].(map[string]any)["value"])
-	assert.Equal(t, "quay.io/rhacs-eng/scanner:4.5.0", env[1].(map[string]any)["value"])
-	assert.Equal(t, "quay.io/rhacs-eng/scanner-db:4.5.0", env[2].(map[string]any)["value"])
+	assert.Equal(t, "quay.io/rhacs-eng/scanner-v4:4.5.0", env[1].(map[string]any)["value"])
+	assert.Equal(t, "quay.io/rhacs-eng/scanner-v4-db:4.5.0", env[2].(map[string]any)["value"])
 }
 
 func TestInjectRelatedImageEnvVars_MissingEnvVar(t *testing.T) {
@@ -162,7 +160,7 @@ install:
 
 func TestConstructRelatedImages_MultipleEnvVars(t *testing.T) {
 	t.Setenv("RELATED_IMAGE_MAIN", "quay.io/rhacs-eng/main:4.5.0")
-	t.Setenv("RELATED_IMAGE_SCANNER", "quay.io/rhacs-eng/scanner:4.5.0")
+	t.Setenv("RELATED_IMAGE_SCANNER_V4", "quay.io/rhacs-eng/scanner-v4:4.5.0")
 
 	spec := map[string]any{}
 	managerImage := "quay.io/rhacs-eng/rhacs-operator:4.5.0"
@@ -173,7 +171,7 @@ func TestConstructRelatedImages_MultipleEnvVars(t *testing.T) {
 	// Verify relatedImages was created
 	relatedImages, ok := spec["relatedImages"].([]map[string]any)
 	require.True(t, ok, "relatedImages should be a []map[string]any")
-	require.GreaterOrEqual(t, len(relatedImages), 3, "should have at least 3 entries (main, scanner, manager)")
+	require.GreaterOrEqual(t, len(relatedImages), 3, "should have at least 3 entries (main, scanner_v4, manager)")
 
 	// Find entries by name
 	imagesByName := make(map[string]string)
@@ -185,7 +183,7 @@ func TestConstructRelatedImages_MultipleEnvVars(t *testing.T) {
 
 	// Verify entries
 	assert.Equal(t, "quay.io/rhacs-eng/main:4.5.0", imagesByName["main"])
-	assert.Equal(t, "quay.io/rhacs-eng/scanner:4.5.0", imagesByName["scanner"])
+	assert.Equal(t, "quay.io/rhacs-eng/scanner-v4:4.5.0", imagesByName["scanner_v4"])
 	assert.Equal(t, "quay.io/rhacs-eng/rhacs-operator:4.5.0", imagesByName["manager"])
 }
 
@@ -215,7 +213,7 @@ func TestConstructRelatedImages_NoEnvVars(t *testing.T) {
 }
 
 func TestConstructRelatedImages_NameTransformation(t *testing.T) {
-	t.Setenv("RELATED_IMAGE_SCANNER_DB_SLIM", "quay.io/rhacs-eng/scanner-db-slim:4.5.0")
+	t.Setenv("RELATED_IMAGE_SCANNER_V4_DB", "quay.io/rhacs-eng/scanner-v4-db:4.5.0")
 
 	spec := map[string]any{}
 	managerImage := "quay.io/rhacs-eng/rhacs-operator:4.5.0"
@@ -230,13 +228,13 @@ func TestConstructRelatedImages_NameTransformation(t *testing.T) {
 	// Find the scanner_db_slim entry
 	found := false
 	for _, img := range relatedImages {
-		if img["name"].(string) == "scanner_db_slim" {
+		if img["name"].(string) == "scanner_v4_db" {
 			found = true
-			assert.Equal(t, "quay.io/rhacs-eng/scanner-db-slim:4.5.0", img["image"])
+			assert.Equal(t, "quay.io/rhacs-eng/scanner-v4-db:4.5.0", img["image"])
 			break
 		}
 	}
-	assert.True(t, found, "should have scanner_db_slim entry with lowercase name")
+	assert.True(t, found, "should have scanner_v4_db entry with lowercase name")
 }
 
 func TestPatchCSV_EnrichesSecurityPolicyCRD(t *testing.T) {
diff --git a/operator/cmd/main.go b/operator/cmd/main.go
index 55537fdbeb212..fdcb412405a44 100644
--- a/operator/cmd/main.go
+++ b/operator/cmd/main.go
@@ -20,10 +20,12 @@ import (
 	"context"
 	"crypto/tls"
 	"flag"
+	"fmt"
 	"os"
 	"strconv"
 	"time"
 
+	"github.com/go-logr/logr"
 	"github.com/go-logr/zapr"
 	configv1 "github.com/openshift/api/config/v1"
 	consolev1 "github.com/openshift/api/console/v1"
@@ -73,7 +75,6 @@ const (
 )
 
 var (
-	setupLog                   = ctrl.Log.WithName("setup")
 	scheme                     = runtime.NewScheme()
 	enableProfiling            = env.RegisterBooleanSetting("ENABLE_PROFILING", false)
 	profilingThresholdFraction = env.RegisterSetting("PROFILING_THRESHOLD_FRACTION", env.WithDefault("0.8"))
@@ -113,25 +114,27 @@ func init() {
 
 func main() {
 	if err := run(); err != nil {
-		setupLog.Error(err, "fatal error")
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
 	}
 }
 
-func run() error {
-	setupLog.Info("Starting RHACS Operator", "version", version.GetMainVersion())
+type runtimeConfig struct {
+	metricsAddr          string
+	enableLeaderElection bool
+	probeAddr            string
+	enableHTTP2          bool
+}
 
-	var metricsAddr string
-	var enableLeaderElection bool
-	var probeAddr string
-	var enableHTTP2 bool
+func run() error {
+	var config runtimeConfig
 
-	flag.StringVar(&metricsAddr, "metrics-bind-address", "0.0.0.0:8443", "The address the metric endpoint binds to.")
-	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
-	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
+	flag.StringVar(&config.metricsAddr, "metrics-bind-address", "0.0.0.0:8443", "The address the metric endpoint binds to.")
+	flag.StringVar(&config.probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
+	flag.BoolVar(&config.enableLeaderElection, "leader-elect", false,
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
-	flag.BoolVar(&enableHTTP2, "enable-http2", enableHTTP2, "If HTTP/2 should be enabled for the metrics server.")
+	flag.BoolVar(&config.enableHTTP2, "enable-http2", false, "If HTTP/2 should be enabled for the metrics server.")
 
 	opts := zap.Options{
 		Development: !buildinfo.ReleaseBuild,
@@ -141,13 +144,20 @@ func run() error {
 
 	zapLogger := zap.NewRaw(zap.UseFlagOptions(&opts))
 	ctrl.SetLogger(zapr.NewLogger(zapLogger))
+	setupLog := ctrl.Log.WithName("setup")
 	restore, err := rawZap.RedirectStdLogAt(zapLogger, zapcore.DebugLevel)
 	if err != nil {
 		return errors.Wrap(err, "unable to redirect std log")
 	}
 	defer restore()
 
-	clusterTLSProfile, tlsOpts, err := buildMetricsServerTLSOpts(enableHTTP2)
+	return runWithLogger(setupLog, config)
+}
+
+func runWithLogger(setupLog logr.Logger, config runtimeConfig) error {
+	setupLog.Info("Starting RHACS Operator", "version", version.GetMainVersion())
+
+	clusterTLSProfile, tlsOpts, err := buildMetricsServerTLSOpts(setupLog, config.enableHTTP2)
 	if err != nil {
 		return err
 	}
@@ -165,7 +175,7 @@ func run() error {
 	mgr, err := ctrl.NewManager(utils.GetRHACSConfigOrDie(), ctrl.Options{
 		Scheme: scheme,
 		Metrics: server.Options{
-			BindAddress:    metricsAddr,
+			BindAddress:    config.metricsAddr,
 			SecureServing:  true,
 			FilterProvider: filters.WithAuthenticationAndAuthorization,
 			TLSOpts:        tlsOpts,
@@ -183,8 +193,8 @@ func run() error {
 				},
 			},
 		},
-		HealthProbeBindAddress: probeAddr,
-		LeaderElection:         enableLeaderElection,
+		HealthProbeBindAddress: config.probeAddr,
+		LeaderElection:         config.enableLeaderElection,
 		LeaderElectionID:       "bf7ea6a2.stackrox.io",
 	})
 	if err != nil {
@@ -280,7 +290,7 @@ func run() error {
 // buildMetricsServerTLSOpts reads the cluster TLS profile and returns the
 // TLS options for the Operator's metrics server along with the cluster profile
 // for later use by the watcher and operand enricher.
-func buildMetricsServerTLSOpts(enableHTTP2 bool) (*tlsprofile.ClusterTLSProfile, []func(c *tls.Config), error) {
+func buildMetricsServerTLSOpts(setupLog logr.Logger, enableHTTP2 bool) (*tlsprofile.ClusterTLSProfile, []func(c *tls.Config), error) {
 	bootstrapClient, err := ctrlClient.New(utils.GetRHACSConfigOrDie(), ctrlClient.Options{Scheme: scheme})
 	if err != nil {
 		return nil, nil, errors.Wrap(err, "unable to create bootstrap client for TLS profile")
diff --git a/operator/config/crd/bases/platform.stackrox.io_centrals.yaml b/operator/config/crd/bases/platform.stackrox.io_centrals.yaml
index 6daa3a06e0a21..57482b2ae2c29 100644
--- a/operator/config/crd/bases/platform.stackrox.io_centrals.yaml
+++ b/operator/config/crd/bases/platform.stackrox.io_centrals.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.21.0
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: centrals.platform.stackrox.io
 spec:
   group: platform.stackrox.io
@@ -600,6 +600,19 @@ spec:
                     - Recreate
                     - RollingUpdate
                     type: string
+                  signingKeyBundle:
+                    description: |-
+                      References a ConfigMap containing the Red Hat signing key bundle (key `bundle.json`).
+                      This allows air-gapped customers to provide or update the signing keys used for
+                      signature verification of Red Hat container images. The ConfigMap is managed
+                      externally; key rotation requires only editing the ConfigMap, not a CR update.
+                    properties:
+                      name:
+                        description: The name of the referenced config map.
+                        type: string
+                    required:
+                    - name
+                    type: object
                   telemetry:
                     description: |-
                       Configures telemetry settings for Central. If enabled, Central transmits telemetry and diagnostic
@@ -1594,7 +1607,7 @@ spec:
                   enabled:
                     description: |-
                       If set to true, pruning and reporting jobs run in a separate Deployment.
-                      The default is: false.
+                      The default is: true.
                     type: boolean
                   hostAliases:
                     description: HostAliases allows configuring additional hostnames
@@ -1984,7 +1997,9 @@ spec:
                               description: Selects a key of a ConfigMap.
                               properties:
                                 key:
-                                  description: The key to select.
+                                  description: |-
+                                    The key to select from the ConfigMap's Data field.
+                                    Keys in the BinaryData field are not currently propagated to container env vars.
                                   type: string
                                 name:
                                   default: ""
@@ -2255,8 +2270,8 @@ spec:
                 type: array
               scanner:
                 description: |-
-                  Settings for the Scanner component, which is responsible for vulnerability scanning of container
-                  images.
+                  Obsolete field. This field will be removed in a future release.
+                  The legacy Scanner has been removed. This field is ignored.
                 properties:
                   analyzer:
                     description: Settings pertaining to the analyzer deployment, such
@@ -2588,8 +2603,7 @@ spec:
                     type: string
                 type: object
               scannerV4:
-                description: Settings for the Scanner V4 component, which can run
-                  in addition to the previously existing Scanner components
+                description: Settings for the Scanner V4 component
                 properties:
                   db:
                     description: Settings pertaining to the DB deployment.
@@ -3117,9 +3131,7 @@ spec:
                   scannerComponent:
                     description: |-
                       Can be specified as "Enabled" or "Disabled".
-                      If this field is not specified, the following defaulting takes place:
-                      * for upgrades to 4.8 from previous releases, the default is: Disabled;
-                      * for new installations starting with ACS 4.8, the default is: Enabled.
+                      The default is: Enabled.
                     enum:
                     - Default
                     - Enabled
diff --git a/operator/config/crd/bases/platform.stackrox.io_securedclusters.yaml b/operator/config/crd/bases/platform.stackrox.io_securedclusters.yaml
index e6992fb604ca3..6b2b3c02d80d3 100644
--- a/operator/config/crd/bases/platform.stackrox.io_securedclusters.yaml
+++ b/operator/config/crd/bases/platform.stackrox.io_securedclusters.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.21.0
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: securedclusters.platform.stackrox.io
 spec:
   group: platform.stackrox.io
@@ -400,7 +400,9 @@ spec:
                               description: Selects a key of a ConfigMap.
                               properties:
                                 key:
-                                  description: The key to select.
+                                  description: |-
+                                    The key to select from the ConfigMap's Data field.
+                                    Keys in the BinaryData field are not currently propagated to container env vars.
                                   type: string
                                 name:
                                   default: ""
@@ -1031,8 +1033,8 @@ spec:
                 type: string
               scanner:
                 description: |-
-                  Settings for the Scanner component, which is responsible for vulnerability scanning of container
-                  images stored in a cluster-local image repository.
+                  Obsolete field. This field will be removed in a future release.
+                  The legacy Scanner has been removed. This field is ignored.
                 properties:
                   analyzer:
                     description: Settings pertaining to the analyzer deployment, such
@@ -1338,19 +1340,15 @@ spec:
                         type: array
                     type: object
                   scannerComponent:
-                    description: |-
-                      If you do not want to deploy the Red Hat Advanced Cluster Security Scanner, you can disable it here
-                      (not recommended).
-                      If you do so, all the settings in this section will have no effect.
-                      The default is: AutoSense.
+                    description: 'Obsolete: The legacy Scanner has been removed. This
+                      field is ignored.'
                     enum:
                     - AutoSense
                     - Disabled
                     type: string
                 type: object
               scannerV4:
-                description: Settings for the Scanner V4 components, which can run
-                  in addition to the previously existing Scanner components
+                description: Settings for the Scanner V4 components
                 properties:
                   db:
                     description: Settings pertaining to the DB deployment.
@@ -1716,9 +1714,7 @@ spec:
                       unless there is a Central resource in the same namespace.
                       In that case typically a central Scanner V4 will be deployed as a component of Central.
                       A value of "Disabled" means that Scanner V4 should not be installed.
-                      If this field is not specified or set to "Default", the following defaulting takes place:
-                      * for upgrades to 4.8 from previous releases, the default is: Disabled;
-                      * for new installations starting with ACS 4.8, the default is: AutoSense.
+                      The default is: AutoSense.
                     enum:
                     - Default
                     - AutoSense
@@ -1883,17 +1879,8 @@ spec:
                     type: array
                 type: object
               virtualMachines:
-                description: Settings for virtual machine scanning (VSOCK RBAC and
-                  scraper).
+                description: Settings for the virtual machine scraper.
                 properties:
-                  mode:
-                    description: |-
-                      Whether virtual machine scanning and VSOCK RBAC are enabled.
-                      The default is: Disabled.
-                    enum:
-                    - Enabled
-                    - Disabled
-                    type: string
                   scraper:
                     description: Settings for the virtual machine scraper running
                       in Sensor.
@@ -1918,7 +1905,7 @@ spec:
                           How often the scraper polls virtual machines for new reports.
                           Minimum interval is 1m; shorter values are rounded up.
                           Shorter intervals refresh scans more often but increase the load on kubevirt API server.
-                          The default is: 5m.
+                          The default is: 4h.
                         pattern: ^[0-9]+(m|h)$
                         type: string
                     type: object
diff --git a/operator/config/manager/manager.yaml b/operator/config/manager/manager.yaml
index f76b3eb173abd..3f9b9e5a52d7a 100644
--- a/operator/config/manager/manager.yaml
+++ b/operator/config/manager/manager.yaml
@@ -60,10 +60,6 @@ spec:
         - --leader-elect
         env:
         - name: RELATED_IMAGE_MAIN ## tags: uses-main-tag,image-name=main
-        - name: RELATED_IMAGE_SCANNER
-        - name: RELATED_IMAGE_SCANNER_SLIM
-        - name: RELATED_IMAGE_SCANNER_DB
-        - name: RELATED_IMAGE_SCANNER_DB_SLIM
         - name: RELATED_IMAGE_COLLECTOR
         - name: RELATED_IMAGE_FACT
         - name: RELATED_IMAGE_ROXCTL
diff --git a/operator/config/manifests/bases/rhacs-operator.clusterserviceversion.yaml b/operator/config/manifests/bases/rhacs-operator.clusterserviceversion.yaml
index 6304b985d2ac0..54cbf3652418e 100644
--- a/operator/config/manifests/bases/rhacs-operator.clusterserviceversion.yaml
+++ b/operator/config/manifests/bases/rhacs-operator.clusterserviceversion.yaml
@@ -126,7 +126,7 @@ spec:
         path: central.telemetry.storage.endpoint
       - description: |-
           If set to true, pruning and reporting jobs run in a separate Deployment.
-          The default is: false.
+          The default is: true.
         displayName: Enabled
         path: centralWorker.enabled
       - description: |-
@@ -244,9 +244,7 @@ spec:
         path: scannerV4.monitoring.exposeEndpoint
       - description: |-
           Can be specified as "Enabled" or "Disabled".
-          If this field is not specified, the following defaulting takes place:
-          * for upgrades to 4.8 from previous releases, the default is: Disabled;
-          * for new installations starting with ACS 4.8, the default is: Enabled.
+          The default is: Enabled.
         displayName: Scanner V4 component
         path: scannerV4.scannerComponent
       - description: |-
@@ -331,11 +329,6 @@ spec:
           All values are strings but are converted into appropriate type based on schema.
         displayName: Value
         path: overlays[0].patches[0].value
-      - description: |-
-          Settings for the Scanner component, which is responsible for vulnerability scanning of container
-          images.
-        displayName: Scanner Component Settings
-        path: scanner
       - description: Settings pertaining to the analyzer deployment, such as for autoscaling.
         displayName: Analyzer
         path: scanner.analyzer
@@ -445,8 +438,7 @@ spec:
         path: scanner.db
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:fieldDependency:.scannerComponent:Enabled
-      - description: Settings for the Scanner V4 component, which can run in addition
-          to the previously existing Scanner components
+      - description: Settings for the Scanner V4 component
         displayName: Scanner V4 Component Settings
         path: scannerV4
       - description: |-
@@ -570,10 +562,13 @@ spec:
         path: customize
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-      - description: Configures the encryption of notifier secrets stored in the Central
-          DB.
-        displayName: Notifier Secrets Encryption
-        path: central.notifierSecretsEncryption
+      - description: |-
+          References a ConfigMap containing the Red Hat signing key bundle (key `bundle.json`).
+          This allows air-gapped customers to provide or update the signing keys used for
+          signature verification of Red Hat container images. The ConfigMap is managed
+          externally; key rotation requires only editing the ConfigMap, not a CR update.
+        displayName: Signing Key Bundle
+        path: central.signingKeyBundle
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:hidden
       - description: Overlays
@@ -581,16 +576,22 @@ spec:
         path: overlays
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - description: |-
-          Configures the rollout strategy for the Central deployment.
-          The default is: Recreate.
-        displayName: Rollout Strategy
-        path: central.rolloutStrategy
+      - description: Configures the encryption of notifier secrets stored in the Central
+          DB.
+        displayName: Notifier Secrets Encryption
+        path: central.notifierSecretsEncryption
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:hidden
       - description: Monitoring configuration.
         displayName: Monitoring
         path: monitoring
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
+      - description: |-
+          Configures the rollout strategy for the Central deployment.
+          The default is: Recreate.
+        displayName: Rollout Strategy
+        path: central.rolloutStrategy
       - description: Network configuration.
         displayName: Network
         path: network
@@ -925,6 +926,11 @@ spec:
         path: central.persistence.persistentVolumeClaim.storageClassName
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: The name of the referenced config map.
+        displayName: Name
+        path: central.signingKeyBundle.name
+        x-descriptors:
+        - urn:alm:descriptor:io.kubernetes:ConfigMap
       - description: The name of the referenced secret.
         displayName: Name
         path: imagePullSecrets[0].name
@@ -937,6 +943,13 @@ spec:
         path: misc
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: |-
+          Obsolete field. This field will be removed in a future release.
+          The legacy Scanner has been removed. This field is ignored.
+        displayName: Scanner
+        path: scanner
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:hidden
       - description: Allows you to specify additional trusted Root CAs.
         displayName: Additional CAs
         path: tls.additionalCAs
@@ -1086,11 +1099,8 @@ spec:
           The default is: Enabled.
         displayName: Autoscaling
         path: scanner.analyzer.scaling.autoScaling
-      - description: |-
-          If you do not want to deploy the Red Hat Advanced Cluster Security Scanner, you can disable it here
-          (not recommended).
-          If you do so, all the settings in this section will have no effect.
-          The default is: AutoSense.
+      - description: 'Obsolete: The legacy Scanner has been removed. This field is
+          ignored.'
         displayName: Scanner Component
         path: scanner.scannerComponent
       - description: |-
@@ -1131,19 +1141,12 @@ spec:
           unless there is a Central resource in the same namespace.
           In that case typically a central Scanner V4 will be deployed as a component of Central.
           A value of "Disabled" means that Scanner V4 should not be installed.
-          If this field is not specified or set to "Default", the following defaulting takes place:
-          * for upgrades to 4.8 from previous releases, the default is: Disabled;
-          * for new installations starting with ACS 4.8, the default is: AutoSense.
+          The default is: AutoSense.
         displayName: Scanner V4 component
         path: scannerV4.scannerComponent
-      - description: |-
-          Whether virtual machine scanning and VSOCK RBAC are enabled.
-          The default is: Disabled.
-        displayName: Mode
-        path: virtualMachines.mode
-        x-descriptors:
-        - urn:alm:descriptor:com.tectonic.ui:select:Enabled
-        - urn:alm:descriptor:com.tectonic.ui:select:Disabled
+      - description: Settings for the virtual machine scraper running in Sensor.
+        displayName: Scraper
+        path: virtualMachines.scraper
       - description: |-
           Maximum number of virtual machines scraped concurrently in each poll cycle.
           The default is: 20.
@@ -1227,9 +1230,6 @@ spec:
           The default is: 3.
         displayName: Default Replicas
         path: scannerV4.indexer.scaling.replicas
-      - description: Settings for the virtual machine scraper running in Sensor.
-        displayName: Scraper
-        path: virtualMachines.scraper
       - description: |-
           Maximum response size in KB from a virtual machine agent.
           Responses larger than this are rejected and that virtual machine is skipped until the next poll.
@@ -1306,7 +1306,7 @@ spec:
           How often the scraper polls virtual machines for new reports.
           Minimum interval is 1m; shorter values are rounded up.
           Shorter intervals refresh scans more often but increase the load on kubevirt API server.
-          The default is: 5m.
+          The default is: 4h.
         displayName: Poll Interval
         path: virtualMachines.scraper.pollInterval
       - description: |-
@@ -1376,13 +1376,7 @@ spec:
       - description: Settings relating to process baselines.
         displayName: Process Baselines Settings
         path: processBaselines
-      - description: |-
-          Settings for the Scanner component, which is responsible for vulnerability scanning of container
-          images stored in a cluster-local image repository.
-        displayName: Scanner Component Settings
-        path: scanner
-      - description: Settings for the Scanner V4 components, which can run in addition
-          to the previously existing Scanner components
+      - description: Settings for the Scanner V4 components
         displayName: Scanner V4 Component Settings
         path: scannerV4
       - description: Settings related to Transport Layer Security, such as Certificate
@@ -1426,7 +1420,7 @@ spec:
         path: processIndicators
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-      - description: Settings for virtual machine scanning (VSOCK RBAC and scraper).
+      - description: Settings for the virtual machine scraper.
         displayName: Virtual Machines Settings
         path: virtualMachines
       - description: |-
@@ -1640,6 +1634,13 @@ spec:
         path: misc
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: |-
+          Obsolete field. This field will be removed in a future release.
+          The legacy Scanner has been removed. This field is ignored.
+        displayName: Scanner
+        path: scanner
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:hidden
       - description: Allows you to specify additional trusted Root CAs.
         displayName: Additional CAs
         path: tls.additionalCAs
@@ -1695,7 +1696,7 @@ spec:
 
     2. **Secured Cluster Services** - Secured cluster services are placed on each cluster you manage and report back to Central. These services allow users to enforce policies and monitor your OpenShift and Kubernetes clusters. Secured Cluster Services come as two Deployments (Sensor and Admission Controller) and one DaemonSet (Collector).
 
-    **Console Plugin (Tech Preview):** RHACS provides a dynamic plugin that displays vulnerability management information in the OpenShift web console. Install a SecuredCluster to deploy the plugin. Enable the plugin by selecting *Operators* > *Installed Operators* or by modifying the console Operator configuration.
+    **Console Plugin:** RHACS provides a dynamic plugin that displays vulnerability management information in the OpenShift web console. Install a SecuredCluster to deploy the plugin. Enable the plugin by selecting *Operators* > *Installed Operators* or by modifying the console Operator configuration.
     **Important:** The Console Plugin requires OpenShift 4.19 or later.
 
     ### Central Services Explained
@@ -1704,8 +1705,10 @@ spec:
     | :------------------------------- | :-------------- | :-------------- |
     | Central                          | Deployment      | Users interact with Red Hat Advanced Cluster Security through the user interface or APIs on Central. Central also sends notifications for violations and interacts with integrations. |
     | Central DB                       | Deployment      | Central DB is a PostgreSQL-based persistent storage for the data collected and managed by Central. |
-    | Scanner                          | Deployment      | Scanner is a Red Hat developed and certified image scanner. Scanner analyzes and reports vulnerabilities for images. Scanner uses HPA to scale the number of replicas based on workload. |
-    | Scanner DB                       | Deployment      | Scanner DB is a cache for vulnerability definitions to serve vulnerability scanning use cases throughout the software development life cycle. |
+    | Scanner V4 Indexer               | Deployment      | Scanner V4 Indexer analyzes container image layers and creates an index of packages and files. Scanner V4 Indexer uses Horizontal Pod Autoscaler (HPA) to scale the number of replicas based on workload. |
+    | Scanner V4 Matcher               | Deployment      | Scanner V4 Matcher matches indexed image content in vulnerability databases to identify security issues. Scanner V4 Matcher uses HPA to scale the number of replicas based on workload. |
+    | Scanner V4 DB                    | Deployment      | Scanner V4 DB is a PostgreSQL-based persistent storage for indexed image data and vulnerability definitions. |
+    | Config Controller                | Deployment      | Config Controller watches SecurityPolicy custom resources and reconciles them with Central to manage security policies declaratively. |
 
     ### Secured Cluster Services Explained
 
@@ -1714,6 +1717,8 @@ spec:
     | Sensor                           | Deployment      | Sensor analyzes and monitors Kubernetes in secured clusters. |
     | Collector                        | DaemonSet       | Analyzes and monitors container activity on Kubernetes nodes.|
     | Admission Controller             | Deployment      | ValidatingWebhookConfiguration for enforcing policies in the deploy lifecycle. |
+    | Scanner V4 Indexer               | Deployment      | Scanner V4 Indexer analyzes container image layers and creates an index of packages and files. Scanner V4 Indexer uses HPA to scale the number of replicas based on workload. |
+    | Scanner V4 DB                    | Deployment      | Scanner V4 DB is a PostgreSQL-based persistent storage for indexed image data. |
 
     ### Central Custom Resource
 
@@ -1773,7 +1778,7 @@ spec:
   - risk
   links:
   - name: Red Hat Advanced Cluster Security Documentation
-    url: https://docs.openshift.com/acs/welcome/
+    url: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes
   - name: DataSheet
     url: https://www.redhat.com/en/resources/advanced-cluster-security-for-kubernetes-datasheet
   - name: Support Policy
diff --git a/operator/config/ui-metadata/bases/rhacs-operator.clusterserviceversion.yaml b/operator/config/ui-metadata/bases/rhacs-operator.clusterserviceversion.yaml
index e14968528e1ee..cdd078d494257 100644
--- a/operator/config/ui-metadata/bases/rhacs-operator.clusterserviceversion.yaml
+++ b/operator/config/ui-metadata/bases/rhacs-operator.clusterserviceversion.yaml
@@ -65,7 +65,7 @@ spec:
 
     2. **Secured Cluster Services** - Secured cluster services are placed on each cluster you manage and report back to Central. These services allow users to enforce policies and monitor your OpenShift and Kubernetes clusters. Secured Cluster Services come as two Deployments (Sensor and Admission Controller) and one DaemonSet (Collector).
 
-    **Console Plugin (Tech Preview):** RHACS provides a dynamic plugin that displays vulnerability management information in the OpenShift web console. Install a SecuredCluster to deploy the plugin. Enable the plugin by selecting *Operators* > *Installed Operators* or by modifying the console Operator configuration.
+    **Console Plugin:** RHACS provides a dynamic plugin that displays vulnerability management information in the OpenShift web console. Install a SecuredCluster to deploy the plugin. Enable the plugin by selecting *Operators* > *Installed Operators* or by modifying the console Operator configuration.
     **Important:** The Console Plugin requires OpenShift 4.19 or later.
 
     ### Central Services Explained
@@ -74,8 +74,10 @@ spec:
     | :------------------------------- | :-------------- | :-------------- |
     | Central                          | Deployment      | Users interact with Red Hat Advanced Cluster Security through the user interface or APIs on Central. Central also sends notifications for violations and interacts with integrations. |
     | Central DB                       | Deployment      | Central DB is a PostgreSQL-based persistent storage for the data collected and managed by Central. |
-    | Scanner                          | Deployment      | Scanner is a Red Hat developed and certified image scanner. Scanner analyzes and reports vulnerabilities for images. Scanner uses HPA to scale the number of replicas based on workload. |
-    | Scanner DB                       | Deployment      | Scanner DB is a cache for vulnerability definitions to serve vulnerability scanning use cases throughout the software development life cycle. |
+    | Scanner V4 Indexer               | Deployment      | Scanner V4 Indexer analyzes container image layers and creates an index of packages and files. Scanner V4 Indexer uses Horizontal Pod Autoscaler (HPA) to scale the number of replicas based on workload. |
+    | Scanner V4 Matcher               | Deployment      | Scanner V4 Matcher matches indexed image content in vulnerability databases to identify security issues. Scanner V4 Matcher uses HPA to scale the number of replicas based on workload. |
+    | Scanner V4 DB                    | Deployment      | Scanner V4 DB is a PostgreSQL-based persistent storage for indexed image data and vulnerability definitions. |
+    | Config Controller                | Deployment      | Config Controller watches SecurityPolicy custom resources and reconciles them with Central to manage security policies declaratively. |
 
     ### Secured Cluster Services Explained
 
@@ -84,6 +86,8 @@ spec:
     | Sensor                           | Deployment      | Sensor analyzes and monitors Kubernetes in secured clusters. |
     | Collector                        | DaemonSet       | Analyzes and monitors container activity on Kubernetes nodes.|
     | Admission Controller             | Deployment      | ValidatingWebhookConfiguration for enforcing policies in the deploy lifecycle. |
+    | Scanner V4 Indexer               | Deployment      | Scanner V4 Indexer analyzes container image layers and creates an index of packages and files. Scanner V4 Indexer uses HPA to scale the number of replicas based on workload. |
+    | Scanner V4 DB                    | Deployment      | Scanner V4 DB is a PostgreSQL-based persistent storage for indexed image data. |
 
     ### Central Custom Resource
 
@@ -139,7 +143,7 @@ spec:
   - risk
   links:
   - name: Red Hat Advanced Cluster Security Documentation
-    url: https://docs.openshift.com/acs/welcome/
+    url: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes
   - name: DataSheet
     url: https://www.redhat.com/en/resources/advanced-cluster-security-for-kubernetes-datasheet
   - name: Support Policy
diff --git a/operator/hack/generate-and-install-chart.sh b/operator/hack/generate-and-install-chart.sh
new file mode 100755
index 0000000000000..0399249b1be1b
--- /dev/null
+++ b/operator/hack/generate-and-install-chart.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Install previous operator version to test upgrades to latest version using helm chart.
+set -euo pipefail
+
+if [[ -z ${1:-} ]]; then
+    echo >&2 "Usage: $0 <version>"
+    echo >&2 "Example: $0 4.11.2"
+    echo >&2 "Note: <version> may optionally include the leading 'v'"
+    exit 1
+fi
+
+# Strip optional leading 'v'.
+version="${1#v}"
+
+# The rhacs-eng chart is not preserved anywhere on releases, so we produce it on the fly.
+dir="$(mktemp -d)"
+echo >&2 "Deploying operator version ${version} from a temporary checkout at ${dir}"
+
+git worktree add "${dir}" "${version}"
+trap 'git worktree remove --force "${dir}"' EXIT
+
+# Warm up go module cache so that transient network failures do not abort controller-gen.
+# TODO: this command can be removed once the version we upgrade from runs go-mod-download internally.
+(cd "${dir}"; go mod download || go mod download || go mod download)
+make -C "${dir}/operator" chart deploy-via-chart VERSION="${version}"
diff --git a/operator/hack/install-4.10.sh b/operator/hack/install-4.10.sh
deleted file mode 100755
index 3c1ec9cc64728..0000000000000
--- a/operator/hack/install-4.10.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-# Temporary script to install 4.10 operator to test upgrades to latest version using helm chart.
-# Operator is not supported downstream on non-OpenShift platforms before 4.11, but this lets us roughly test
-# the upgrade path from the upstream tech preview in 4.10 to the helm chart.
-# TODO(ROX-33128): delete and just use helm after release 4.11 ships
-set -euo pipefail
-
-version="4.10.0"
-
-dir="$(mktemp -d)"
-echo >&2 "Deploying operator version ${version} from a temporary checkout at ${dir}"
-
-git worktree add "${dir}" "${version}"
-trap 'git worktree remove --force "${dir}"' EXIT
-
-cd "${dir}"
-export VERSION="${version}" ROX_PRODUCT_BRANDING=RHACS_BRANDING
-make -C operator/ build-installer deploy-via-installer TEST_NAMESPACE="rhacs-operator-system"
diff --git a/operator/hack/upgrade-autoselect.sh b/operator/hack/upgrade-autoselect.sh
index 1dea066a2a1f5..ff7228e5daec4 100755
--- a/operator/hack/upgrade-autoselect.sh
+++ b/operator/hack/upgrade-autoselect.sh
@@ -9,7 +9,7 @@ openshift*)
   target="upgrade-via-olm"
   ;;
 *)
-  target="upgrade-via-chart"
+  target="deploy-via-chart"
   ;;
 esac
 make -C "${ROOT_DIR}/operator" "${target}" "$@"
diff --git a/operator/internal/central/defaults/scanner_v4.go b/operator/internal/central/defaults/scanner_v4.go
index eb1dfc449200c..0fc0ed97f515d 100644
--- a/operator/internal/central/defaults/scanner_v4.go
+++ b/operator/internal/central/defaults/scanner_v4.go
@@ -1,11 +1,8 @@
 package defaults
 
 import (
-	"reflect"
-
 	"github.com/go-logr/logr"
 	platform "github.com/stackrox/rox/operator/api/v1alpha1"
-	"github.com/stackrox/rox/operator/internal/common"
 )
 
 var (
@@ -16,14 +13,11 @@ var (
 )
 
 // Only returns Enabled or Disabled.
-// Derive component policy based on status Defaults and spec.
-// This will be called from the preExtension to record the current setting.
+// Scanner V4 is now always on (the legacy Scanner has been removed), so we default to
+// Enabled unless the user explicitly set Disabled in the CR spec.
 //
 // Second return value is `true`, if defaulting has been applied due to lack of explicit setting.
-func CentralScannerV4ComponentPolicy(logger logr.Logger, status *platform.CentralStatus, annotations map[string]string, spec *platform.ScannerV4Spec) (platform.ScannerV4ComponentPolicy, bool) {
-	defaultForUpgrades := platform.ScannerV4Disabled
-	defaultForNewInstallations := platform.ScannerV4Enabled
-
+func CentralScannerV4ComponentPolicy(logger logr.Logger, _ *platform.CentralStatus, _ map[string]string, spec *platform.ScannerV4Spec) (platform.ScannerV4ComponentPolicy, bool) {
 	if spec != nil && spec.ScannerComponent != nil {
 		comp := *spec.ScannerComponent
 		if comp == platform.ScannerV4ComponentEnabled || comp == platform.ScannerV4ComponentDisabled {
@@ -32,48 +26,7 @@ func CentralScannerV4ComponentPolicy(logger logr.Logger, status *platform.Centra
 		}
 	}
 
-	// User is relying on defaulting.
-	// This includes the case spec.ScannerComponent == "Default".
-
-	// A default entry exists already, use recorded value.
-	recordedValue := platform.ScannerV4ComponentPolicy(annotations[common.FeatureDefaultKeyScannerV4])
-	if recordedValue == platform.ScannerV4Enabled || recordedValue == platform.ScannerV4Disabled {
-		logger.Info("using previously recorded ScannerV4 componentPolicy", "componentPolicy", recordedValue)
-		return recordedValue, true
-	}
-
-	// No or unexpected default set in the annotations.
-
-	if isNewInstallation(status) {
-		logger.Info("Assuming new installation due to incomplete status.")
-		return defaultForNewInstallations, true
-	}
-
-	// Upgrade.
-	logger.Info("assuming upgrade")
-
-	if annotations[common.FeatureDefaultKeyScannerV4] == "" {
-		// No entry in the statusDefaults yet -> preserve defaulting behavior of versions which did not populate
-		// statusDefaults with a ScannerV4ComponentPolicy.
-		logger.Info("empty feature-default annotation, using default ScannerV4 componentPolicy for upgrades",
-			"componentPolicy", defaultForUpgrades)
-		return defaultForUpgrades, true
-	}
-
-	// This should not happen, since we only store Enabled|Disabled, but just in case something unexpected happened
-	// and we need to make some decisions...
-	logger.Info("detected unexpected ScannerV4 componentPolicy in feature-default annotation, using default componentPolicy for upgrades",
-		"unexpectedComponentPolicy", recordedValue,
-		"componentPolicy", defaultForUpgrades)
-	return defaultForUpgrades, true
-}
-
-// isNewInstallation checks if this is a new installation based on the status.
-func isNewInstallation(status *platform.CentralStatus) bool {
-	// The ProductVersion is only set post installation.
-	return status == nil ||
-		reflect.DeepEqual(status, &platform.CentralStatus{}) ||
-		status.ProductVersion == ""
+	return platform.ScannerV4Enabled, true
 }
 
 func centralScannerV4Defaulting(logger logr.Logger, status *platform.CentralStatus, annotations map[string]string, spec *platform.CentralSpec, defaults *platform.CentralSpec) error {
@@ -84,12 +37,8 @@ func centralScannerV4Defaulting(logger logr.Logger, status *platform.CentralStat
 		return nil
 	}
 
-	// User is relying on defaults. Set in-memory default and persist corresponding annotation.
-
-	if annotations[common.FeatureDefaultKeyScannerV4] != string(componentPolicy) {
-		// Update feature default setting.
-		annotations[common.FeatureDefaultKeyScannerV4] = string(componentPolicy)
-	}
+	// User is relying on defaults. Set in-memory default only.
+	// We no longer persist the annotation to support downgrade scenarios.
 
 	if defaults.ScannerV4 == nil {
 		defaults.ScannerV4 = &platform.ScannerV4Spec{}
diff --git a/operator/internal/central/defaults/static.go b/operator/internal/central/defaults/static.go
index cb709e7174381..3bb381ca7e2a9 100644
--- a/operator/internal/central/defaults/static.go
+++ b/operator/internal/central/defaults/static.go
@@ -41,16 +41,6 @@ var staticDefaults = platform.CentralSpec{
 			Enabled: new(true),
 		},
 	},
-	Scanner: &platform.ScannerComponentSpec{
-		Analyzer: &platform.ScannerAnalyzerComponent{
-			Scaling: &platform.ScannerComponentScaling{
-				AutoScaling: new(platform.ScannerAutoScalingEnabled),
-				Replicas:    new(int32(3)),
-				MinReplicas: new(int32(2)),
-				MaxReplicas: new(int32(5)),
-			},
-		},
-	},
 	ScannerV4: &platform.ScannerV4Spec{
 		// ScannerComponent field is set using a dedicated defaulting flow.
 		Indexer: &platform.ScannerV4Component{
@@ -89,7 +79,7 @@ var staticDefaults = platform.CentralSpec{
 		Policies: new(platform.NetworkPoliciesEnabled),
 	},
 	CentralWorker: &platform.CentralWorkerSpec{
-		Enabled: new(false),
+		Enabled: new(true),
 	},
 	ConfigAsCode: &platform.ConfigAsCodeSpec{
 		ComponentPolicy: new(platform.ConfigAsCodeComponentEnabled),
diff --git a/operator/internal/central/extensions/reconcile_defaulting_test.go b/operator/internal/central/extensions/reconcile_defaulting_test.go
index c715de8623e48..d5a6433747205 100644
--- a/operator/internal/central/extensions/reconcile_defaulting_test.go
+++ b/operator/internal/central/extensions/reconcile_defaulting_test.go
@@ -40,17 +40,11 @@ func TestReconcileScannerV4FeatureDefaultsExtension(t *testing.T) {
 			Spec:            platform.CentralSpec{},
 			Status:          platform.CentralStatus{},
 			ExpectedDefault: &platform.ScannerV4Enabled,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentEnabled),
-			},
 		},
-		"upgrade: disabled by default": {
+		"upgrade: enabled by default": {
 			Spec:            platform.CentralSpec{},
 			Status:          postInstallStatus,
-			ExpectedDefault: &platform.ScannerV4Disabled,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
-			},
+			ExpectedDefault: &platform.ScannerV4Enabled,
 		},
 		"install: enabled explicitly": {
 			Spec: platform.CentralSpec{
@@ -70,43 +64,24 @@ func TestReconcileScannerV4FeatureDefaultsExtension(t *testing.T) {
 			Status:          platform.CentralStatus{},
 			ExpectedDefault: nil,
 		},
-		"upgrade: pick up previously persisted default (Enabled)": {
-			Status: postInstallStatus,
-			Annotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentEnabled),
-			},
-			ExpectedDefault: &platform.ScannerV4Enabled,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentEnabled),
-			},
-		},
-		"upgrade: pick up previously persisted default (Disabled)": {
+		"upgrade: previously persisted annotation is ignored": {
 			Status: postInstallStatus,
 			Annotations: map[string]string{
 				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
 			},
-			ExpectedDefault: &platform.ScannerV4Disabled,
+			ExpectedDefault: &platform.ScannerV4Enabled,
 			ExpectedAnnotations: map[string]string{
 				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
 			},
 		},
-		"upgrade: ignoring bogus persisted default": {
+		"upgrade: bogus persisted annotation is ignored": {
 			Status: postInstallStatus,
 			Annotations: map[string]string{
 				common.FeatureDefaultKeyScannerV4: "foo",
 			},
-			ExpectedDefault: &platform.ScannerV4Disabled,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
-			},
-		},
-		"previously persisted default is picked up even if status is empty": {
-			Annotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
-			},
-			ExpectedDefault: &platform.ScannerV4Disabled,
+			ExpectedDefault: &platform.ScannerV4Enabled,
 			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
+				common.FeatureDefaultKeyScannerV4: "foo",
 			},
 		},
 	}
diff --git a/operator/internal/central/extensions/reconcile_scanner_db_password.go b/operator/internal/central/extensions/reconcile_scanner_db_password.go
index 6993ea93c34c6..cf69923258aff 100644
--- a/operator/internal/central/extensions/reconcile_scanner_db_password.go
+++ b/operator/internal/central/extensions/reconcile_scanner_db_password.go
@@ -15,10 +15,6 @@ var (
 	_ commonExtensions.ScannerBearingCustomResource = (*platform.Central)(nil)
 )
 
-const (
-	scannerDBPasswordKey = `password`
-)
-
 // ReconcileScannerDBPasswordExtension returns an extension that takes care of creating the scanner-db-password
 // secret ahead of time.
 func ReconcileScannerDBPasswordExtension(client ctrlClient.Client, direct ctrlClient.Reader) extensions.ReconcileExtension {
diff --git a/operator/internal/central/extensions/reconcile_scanner_db_password_test.go b/operator/internal/central/extensions/reconcile_scanner_db_password_test.go
index d39aa2d9e6bb3..582a812fbee11 100644
--- a/operator/internal/central/extensions/reconcile_scanner_db_password_test.go
+++ b/operator/internal/central/extensions/reconcile_scanner_db_password_test.go
@@ -2,19 +2,12 @@ package extensions
 
 import (
 	"testing"
-	"time"
 
-	"github.com/stackrox/rox/operator/internal/types"
 	"github.com/stackrox/rox/operator/internal/utils/testutils"
-	"github.com/stretchr/testify/assert"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-func verifyScannerDBPassword(t *testing.T, data types.SecretDataMap, _ *time.Time) {
-	assert.NotEmpty(t, data[scannerDBPasswordKey])
-}
-
 func TestReconcileScannerDBPassword(t *testing.T) {
 	existingScannerDBPassword := &v1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
@@ -37,52 +30,21 @@ func TestReconcileScannerDBPassword(t *testing.T) {
 	}
 
 	cases := map[string]secretReconciliationTestCase{
-		"When no db password secret exists and scanner is disabled, no secrets should be created": {
-			Spec:                   basicSpecWithScanner(false, false),
-			ExpectedCreatedSecrets: nil,
-		},
-		"When no db password secret exists and scanner is enabled, a managed secret should be created": {
-			Spec: basicSpecWithScanner(true, false),
-			ExpectedCreatedSecrets: map[string]secretVerifyFunc{
-				"scanner-db-password": verifyScannerDBPassword,
-			},
-		},
-		"When no db password secret exists and scanner is enabled, and the CR is being deleted, no secrets should be created": {
+		"Scanner v2 is removed, no secrets should be created regardless of spec": {
 			Spec:                   basicSpecWithScanner(true, false),
-			Deleted:                true,
 			ExpectedCreatedSecrets: nil,
 		},
-		"When an unmanaged db password secret exists and scanner is enabled, no secrets should be created or deleted": {
-			Spec:                   basicSpecWithScanner(true, false),
-			Existing:               []*v1.Secret{existingScannerDBPassword},
-			ExpectedCreatedSecrets: nil,
-		},
-		"When an unmanaged db password secret exists and scanner is disabled, the secret should be left intact": {
+		"When no db password secret exists and scanner is disabled, no secrets should be created": {
 			Spec:                   basicSpecWithScanner(false, false),
-			Existing:               []*v1.Secret{existingScannerDBPassword},
 			ExpectedCreatedSecrets: nil,
 		},
-		"When an unmanaged db password secret exists and scanner is enabled, and the CR is being deleted, the secret should be left intact": {
+		"When an unmanaged db password secret exists, the secret should be left intact": {
 			Spec:                   basicSpecWithScanner(true, false),
-			Deleted:                true,
 			Existing:               []*v1.Secret{existingScannerDBPassword},
 			ExpectedCreatedSecrets: nil,
 		},
-
-		// Malformed pre-existing secret
-		"When a malformed unmanaged secret exists, an error is expected": {
-			Spec:          basicSpecWithScanner(true, false),
-			Existing:      []*v1.Secret{existingMalformedScannerDBPassword},
-			ExpectedError: "scanner-db-password secret must contain a non-empty",
-		},
-		"When a malformed unmanaged secret exists, no error is expected": {
-			Spec:                   basicSpecWithScanner(false, false),
-			Existing:               []*v1.Secret{existingMalformedScannerDBPassword},
-			ExpectedCreatedSecrets: nil,
-		},
-		"When a malformed unmanaged secret exists, and the CR is being deleted, no error is expected": {
+		"When a malformed unmanaged secret exists, no error is expected because scanner v2 is disabled": {
 			Spec:                   basicSpecWithScanner(true, false),
-			Deleted:                true,
 			Existing:               []*v1.Secret{existingMalformedScannerDBPassword},
 			ExpectedCreatedSecrets: nil,
 		},
diff --git a/operator/internal/central/extensions/reconcile_tls.go b/operator/internal/central/extensions/reconcile_tls.go
index ed383ac1754b9..03292619ec1ab 100644
--- a/operator/internal/central/extensions/reconcile_tls.go
+++ b/operator/internal/central/extensions/reconcile_tls.go
@@ -92,13 +92,6 @@ func (r *createCentralTLSExtensionRun) Execute(ctx context.Context) error {
 		return errors.Wrap(err, "reconciling central-db-tls secret failed")
 	}
 
-	if err := r.reconcileScannerTLSSecret(ctx); err != nil {
-		return errors.Wrap(err, "reconciling scanner-tls secret failed")
-	}
-	if err := r.reconcileScannerDBTLSSecret(ctx); err != nil {
-		return errors.Wrap(err, "reconciling scanner-db-tls secret failed")
-	}
-
 	if err := r.reconcileScannerV4IndexerTLSSecret(ctx); err != nil {
 		return errors.Wrap(err, "reconciling scanner-v4-indexer-tls secret")
 	}
@@ -348,20 +341,6 @@ func (r *createCentralTLSExtensionRun) reconcileCentralDBTLSSecret(ctx context.C
 	return r.DeleteSecret(ctx, "central-db-tls")
 }
 
-func (r *createCentralTLSExtensionRun) reconcileScannerTLSSecret(ctx context.Context) error {
-	if r.centralObj.Spec.Scanner.IsEnabled() {
-		return r.EnsureSecret(ctx, "scanner-tls", r.validateScannerTLSData, r.generateScannerTLSData, commonLabels.TLSSecretLabels())
-	}
-	return r.DeleteSecret(ctx, "scanner-tls")
-}
-
-func (r *createCentralTLSExtensionRun) reconcileScannerDBTLSSecret(ctx context.Context) error {
-	if r.centralObj.Spec.Scanner.IsEnabled() {
-		return r.EnsureSecret(ctx, "scanner-db-tls", r.validateScannerDBTLSData, r.generateScannerDBTLSData, commonLabels.TLSSecretLabels())
-	}
-	return r.DeleteSecret(ctx, "scanner-db-tls")
-}
-
 func (r *createCentralTLSExtensionRun) reconcileScannerV4IndexerTLSSecret(ctx context.Context) error {
 	if r.centralObj.Spec.ScannerV4.IsEnabled() {
 		return r.EnsureSecret(ctx, "scanner-v4-indexer-tls", r.validateScannerV4IndexerTLSData, r.generateScannerV4IndexerTLSData, commonLabels.TLSSecretLabels())
@@ -445,22 +424,6 @@ func (r *createCentralTLSExtensionRun) generateServiceTLSData(subj mtls.Subject,
 	return nil
 }
 
-func (r *createCentralTLSExtensionRun) validateScannerTLSData(fileMap types.SecretDataMap, _ bool) error {
-	return r.validateServiceTLSData(storage.ServiceType_SCANNER_SERVICE, "", fileMap)
-}
-
-func (r *createCentralTLSExtensionRun) generateScannerTLSData(_ types.SecretDataMap) (types.SecretDataMap, error) {
-	fileMap := make(types.SecretDataMap, numServiceCertDataEntries)
-	if err := r.generateServiceTLSData(mtls.ScannerSubject, "", fileMap); err != nil {
-		return nil, err
-	}
-	return fileMap, nil
-}
-
-func (r *createCentralTLSExtensionRun) validateScannerDBTLSData(fileMap types.SecretDataMap, _ bool) error {
-	return r.validateServiceTLSData(storage.ServiceType_SCANNER_DB_SERVICE, "", fileMap)
-}
-
 func (r *createCentralTLSExtensionRun) validateCentralDBTLSData(fileMap types.SecretDataMap, _ bool) error {
 	return r.validateServiceTLSData(storage.ServiceType_CENTRAL_DB_SERVICE, "", fileMap)
 }
@@ -477,14 +440,6 @@ func (r *createCentralTLSExtensionRun) validateScannerV4DBTLSData(fileMap types.
 	return r.validateServiceTLSData(storage.ServiceType_SCANNER_V4_DB_SERVICE, "", fileMap)
 }
 
-func (r *createCentralTLSExtensionRun) generateScannerDBTLSData(_ types.SecretDataMap) (types.SecretDataMap, error) {
-	fileMap := make(types.SecretDataMap, numServiceCertDataEntries)
-	if err := r.generateServiceTLSData(mtls.ScannerDBSubject, "", fileMap); err != nil {
-		return nil, err
-	}
-	return fileMap, nil
-}
-
 func (r *createCentralTLSExtensionRun) generateCentralDBTLSData(_ types.SecretDataMap) (types.SecretDataMap, error) {
 	fileMap := make(types.SecretDataMap, numServiceCertDataEntries)
 	if err := r.generateServiceTLSData(mtls.CentralDBSubject, "", fileMap); err != nil {
diff --git a/operator/internal/central/extensions/reconcile_tls_ca_rotation_test.go b/operator/internal/central/extensions/reconcile_tls_ca_rotation_test.go
index 83b1af3056051..64dc6938ac3ef 100644
--- a/operator/internal/central/extensions/reconcile_tls_ca_rotation_test.go
+++ b/operator/internal/central/extensions/reconcile_tls_ca_rotation_test.go
@@ -88,8 +88,6 @@ func TestCentralCARotation(t *testing.T) {
 
 	commonSecrets := map[string]secretVerifyFunc{
 		"central-db-tls":         verifyCentralServiceCert(storage.ServiceType_CENTRAL_DB_SERVICE),
-		"scanner-tls":            verifyCentralServiceCert(storage.ServiceType_SCANNER_SERVICE),
-		"scanner-db-tls":         verifyCentralServiceCert(storage.ServiceType_SCANNER_DB_SERVICE),
 		"scanner-v4-indexer-tls": verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_INDEXER_SERVICE),
 		"scanner-v4-matcher-tls": verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_MATCHER_SERVICE),
 		"scanner-v4-db-tls":      verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_DB_SERVICE),
diff --git a/operator/internal/central/extensions/reconcile_tls_test.go b/operator/internal/central/extensions/reconcile_tls_test.go
index 8bec27366c749..76e6594ae75ee 100644
--- a/operator/internal/central/extensions/reconcile_tls_test.go
+++ b/operator/internal/central/extensions/reconcile_tls_test.go
@@ -257,8 +257,6 @@ func TestCreateCentralTLS(t *testing.T) {
 			ExpectedCreatedSecrets: map[string]secretVerifyFunc{
 				"central-tls":            verifyCentralCert,
 				"central-db-tls":         verifyCentralServiceCert(storage.ServiceType_CENTRAL_DB_SERVICE),
-				"scanner-tls":            verifyCentralServiceCert(storage.ServiceType_SCANNER_SERVICE),
-				"scanner-db-tls":         verifyCentralServiceCert(storage.ServiceType_SCANNER_DB_SERVICE),
 				"scanner-v4-indexer-tls": verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_INDEXER_SERVICE),
 				"scanner-v4-matcher-tls": verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_MATCHER_SERVICE),
 				"scanner-v4-db-tls":      verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_DB_SERVICE),
@@ -295,8 +293,6 @@ func TestCreateCentralTLS(t *testing.T) {
 			Spec:     basicSpecWithScanner(true, true),
 			Existing: []*v1.Secret{existingCentral, existingCentralDB},
 			ExpectedCreatedSecrets: map[string]secretVerifyFunc{
-				"scanner-tls":            verifyCentralServiceCert(storage.ServiceType_SCANNER_SERVICE),
-				"scanner-db-tls":         verifyCentralServiceCert(storage.ServiceType_SCANNER_DB_SERVICE),
 				"scanner-v4-indexer-tls": verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_INDEXER_SERVICE),
 				"scanner-v4-matcher-tls": verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_MATCHER_SERVICE),
 				"scanner-v4-db-tls":      verifyCentralServiceCert(storage.ServiceType_SCANNER_V4_DB_SERVICE),
@@ -326,16 +322,6 @@ func TestCreateCentralTLS(t *testing.T) {
 			InterceptedK8sAPICalls: creatingSecretFails("central-db-tls"),
 			ExpectedError:          "reconciling central-db-tls secret",
 		},
-		"When creating a new scanner-tls secret fails, an error should be returned": {
-			Spec:                   basicSpecWithScanner(true, false),
-			InterceptedK8sAPICalls: creatingSecretFails("scanner-tls"),
-			ExpectedError:          "reconciling scanner-tls secret",
-		},
-		"When creating a new scanner-db-tls secret fails, an error should be returned": {
-			Spec:                   basicSpecWithScanner(true, false),
-			InterceptedK8sAPICalls: creatingSecretFails("scanner-db-tls"),
-			ExpectedError:          "reconciling scanner-db-tls secret",
-		},
 		"When creating a new scanner-v4-indexer-tls secret fails, an error should be returned": {
 			Spec:                   basicSpecWithScanner(false, true),
 			InterceptedK8sAPICalls: creatingSecretFails("scanner-v4-indexer-tls"),
@@ -361,16 +347,6 @@ func TestCreateCentralTLS(t *testing.T) {
 			InterceptedK8sAPICalls: gettingSecretFails("central-db-tls"),
 			ExpectedError:          "reconciling central-db-tls secret",
 		},
-		"When getting an existing scanner-tls secret fails with a non-404 error, an error should be returned": {
-			Spec:                   basicSpecWithScanner(true, false),
-			InterceptedK8sAPICalls: gettingSecretFails("scanner-tls"),
-			ExpectedError:          "reconciling scanner-tls secret",
-		},
-		"When getting an existing scanner-db-tls secret fails with a non-404 error, an error should be returned": {
-			Spec:                   basicSpecWithScanner(true, false),
-			InterceptedK8sAPICalls: gettingSecretFails("scanner-db-tls"),
-			ExpectedError:          "reconciling scanner-db-tls secret",
-		},
 		"When getting an existing scanner-v4-indexer-tls secret fails with a non-404 error, an error should be returned": {
 			Spec:                   basicSpecWithScanner(false, true),
 			InterceptedK8sAPICalls: gettingSecretFails("scanner-v4-indexer-tls"),
@@ -408,12 +384,6 @@ func TestCreateCentralTLS(t *testing.T) {
 			ExistingManaged:        []*v1.Secret{existingCentralDB},
 			InterceptedK8sAPICalls: secretIsAlreadyDeleted("central-db-tls"),
 		},
-		"When deleting an existing scanner-tls secret fails, an error should be returned": {
-			Deleted:                true,
-			ExistingManaged:        []*v1.Secret{existingScanner},
-			InterceptedK8sAPICalls: deletingSecretFails("scanner-tls"),
-			ExpectedError:          "reconciling scanner-tls secret",
-		},
 		"When deleting an existing scanner-v4-indexer-tls secret fails, an error should be returned": {
 			Deleted:                true,
 			ExistingManaged:        []*v1.Secret{existingScannerV4Indexer},
@@ -432,22 +402,6 @@ func TestCreateCentralTLS(t *testing.T) {
 			InterceptedK8sAPICalls: deletingSecretFails("scanner-v4-db-tls"),
 			ExpectedError:          "reconciling scanner-v4-db-tls secret",
 		},
-		"When deleting an existing scanner-tls secret fails with a 404, an error should not be returned because the secret is likely to be already deleted": {
-			Deleted:                true,
-			ExistingManaged:        []*v1.Secret{existingScanner},
-			InterceptedK8sAPICalls: secretIsAlreadyDeleted("scanner-tls"),
-		},
-		"When deleting an existing scanner-db-tls secret fails, an error should be returned": {
-			Deleted:                true,
-			ExistingManaged:        []*v1.Secret{existingScannerDB},
-			InterceptedK8sAPICalls: deletingSecretFails("scanner-db-tls"),
-			ExpectedError:          "reconciling scanner-db-tls secret",
-		},
-		"When deleting an existing scanner-db-tls secret fails with a 404, an error should not be returned because the secret is likely to be already deleted": {
-			Deleted:                true,
-			ExistingManaged:        []*v1.Secret{existingScannerDB},
-			InterceptedK8sAPICalls: secretIsAlreadyDeleted("scanner-db-tls"),
-		},
 	}
 
 	for name, c := range cases {
@@ -1058,8 +1012,6 @@ func Test_createCentralTLSExtensionRun_validateServiceTLSData(t *testing.T) {
 	}
 
 	subjects := []mtls.Subject{
-		mtls.ScannerSubject,
-		mtls.ScannerDBSubject,
 		mtls.CentralDBSubject,
 	}
 
@@ -1209,10 +1161,6 @@ func Test_createCentralTLSExtensionRun_validateServiceTLSData(t *testing.T) {
 						currentTime: time.Now(),
 					}
 					switch subject {
-					case mtls.ScannerSubject:
-						tt.assert(t, r.validateScannerTLSData(tt.fileMap, true))
-					case mtls.ScannerDBSubject:
-						tt.assert(t, r.validateScannerDBTLSData(tt.fileMap, true))
 					case mtls.CentralDBSubject:
 						tt.assert(t, r.validateCentralDBTLSData(tt.fileMap, true))
 					}
diff --git a/operator/internal/central/values/translation/image_overrides.go b/operator/internal/central/values/translation/image_overrides.go
index d6d563b1e972d..4715f359f812a 100644
--- a/operator/internal/central/values/translation/image_overrides.go
+++ b/operator/internal/central/values/translation/image_overrides.go
@@ -6,8 +6,6 @@ var (
 	imageOverrides = images.Overrides{
 		images.Main:        "central.image.fullRef",
 		images.CentralDB:   "central.db.image.fullRef",
-		images.Scanner:     "scanner.image.fullRef",
-		images.ScannerDB:   "scanner.dbImage.fullRef",
 		images.ScannerV4DB: "scannerV4.db.image.fullRef",
 		images.ScannerV4:   "scannerV4.image.fullRef",
 	}
diff --git a/operator/internal/central/values/translation/translation.go b/operator/internal/central/values/translation/translation.go
index f011e180b52aa..165db9a81de50 100644
--- a/operator/internal/central/values/translation/translation.go
+++ b/operator/internal/central/values/translation/translation.go
@@ -113,7 +113,6 @@ func (t Translator) translate(ctx context.Context, c platform.Central) (chartuti
 	}
 
 	v.AddChild("central", central)
-	v.AddChild("scanner", getCentralScannerComponentValues(c.Spec.Scanner, deploymentDefaults))
 	v.AddChild("scannerV4", getCentralScannerV4ComponentValues(ctx, c.Spec.ScannerV4, c.GetNamespace(), t.client, deploymentDefaults))
 	v.AddChild("customize", &customize)
 
@@ -271,6 +270,12 @@ func getCentralComponentValues(ctx context.Context, c *platform.CentralComponent
 
 	cv.AddChild("declarativeConfiguration", getDeclarativeConfigurationValues(c.DeclarativeConfiguration))
 
+	if c.SigningKeyBundle != nil && c.SigningKeyBundle.Name != "" {
+		signingKeyBundle := translation.NewValuesBuilder()
+		signingKeyBundle.SetStringValue("configMapName", c.SigningKeyBundle.Name)
+		cv.AddChild("signingKeyBundle", &signingKeyBundle)
+	}
+
 	if c.GetNotifierSecretsEncryptionEnabled() {
 		notifierSecretsEncryption := translation.NewValuesBuilder()
 		notifierSecretsEncryption.SetBoolValue("enabled", true)
@@ -370,23 +375,6 @@ func getDeclarativeConfigurationValues(c *platform.DeclarativeConfiguration) *tr
 	return &declarativeConfig
 }
 
-func getCentralScannerComponentValues(s *platform.ScannerComponentSpec, defaults translation.SchedulingConstraints) *translation.ValuesBuilder {
-	if s == nil && !defaults.IsSet() {
-		return nil
-	}
-	if s == nil {
-		s = &platform.ScannerComponentSpec{}
-	}
-
-	sv := translation.NewValuesBuilder()
-	translation.SetScannerComponentDisableValue(&sv, s.ScannerComponent)
-	translation.SetScannerAnalyzerValues(&sv, s.GetAnalyzer(), defaults)
-	translation.SetScannerDBValues(&sv, s.DB, defaults)
-	sv.SetBoolValue("exposeMonitoring", s.Monitoring.IsEnabled())
-
-	return &sv
-}
-
 func getCentralScannerV4ComponentValues(ctx context.Context, s *platform.ScannerV4Spec, namespace string, client ctrlClient.Client, defaults translation.SchedulingConstraints) *translation.ValuesBuilder {
 	if s == nil && !defaults.IsSet() {
 		return nil
diff --git a/operator/internal/central/values/translation/translation_deployment_defaults_test.go b/operator/internal/central/values/translation/translation_deployment_defaults_test.go
index 7ff3b2a9b0914..5830c05c6a2bc 100644
--- a/operator/internal/central/values/translation/translation_deployment_defaults_test.go
+++ b/operator/internal/central/values/translation/translation_deployment_defaults_test.go
@@ -17,8 +17,6 @@ func TestDeploymentDefaults(t *testing.T) {
 	componentPaths := []testingUtils.ComponentPath{
 		{Name: "central", NodeSelectorPath: "central.nodeSelector", TolerationsPath: "central.tolerations"},
 		{Name: "central-db", NodeSelectorPath: "central.db.nodeSelector", TolerationsPath: "central.db.tolerations"},
-		{Name: "scanner", NodeSelectorPath: "scanner.nodeSelector", TolerationsPath: "scanner.tolerations"},
-		{Name: "scanner-db", NodeSelectorPath: "scanner.dbNodeSelector", TolerationsPath: "scanner.dbTolerations"},
 		{Name: "scannerV4-indexer", NodeSelectorPath: "scannerV4.indexer.nodeSelector", TolerationsPath: "scannerV4.indexer.tolerations"},
 		{Name: "scannerV4-matcher", NodeSelectorPath: "scannerV4.matcher.nodeSelector", TolerationsPath: "scannerV4.matcher.tolerations"},
 		{Name: "scannerV4-db", NodeSelectorPath: "scannerV4.db.nodeSelector", TolerationsPath: "scannerV4.db.tolerations"},
diff --git a/operator/internal/central/values/translation/translation_test.go b/operator/internal/central/values/translation/translation_test.go
index ad618191b9c97..b6f63d7f40e49 100644
--- a/operator/internal/central/values/translation/translation_test.go
+++ b/operator/internal/central/values/translation/translation_test.go
@@ -243,6 +243,41 @@ func TestTranslate(t *testing.T) {
 			},
 		},
 
+		"signing key bundle with empty name is not emitted": {
+			args: args{
+				c: platform.Central{
+					Spec: platform.CentralSpec{
+						Central: &platform.CentralComponentSpec{
+							SigningKeyBundle: &platform.LocalConfigMapReference{
+								Name: "",
+							},
+						},
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: "stackrox",
+					},
+				},
+				pvcs: []*corev1.PersistentVolumeClaim{defaultPvc},
+			},
+			want: chartutil.Values{
+				"monitoring": map[string]interface{}{
+					"openshift": map[string]interface{}{
+						"enabled": true,
+					},
+				},
+				"central": map[string]interface{}{
+					"exposeMonitoring": false,
+					"db": map[string]interface{}{
+						"persistence": map[string]interface{}{
+							"persistentVolumeClaim": map[string]interface{}{
+								"createClaim": false,
+							},
+						},
+					},
+				},
+			},
+		},
+
 		"empty spec no pvc": {
 			args: args{
 				c: platform.Central{
@@ -389,6 +424,9 @@ func TestTranslate(t *testing.T) {
 									},
 								},
 							},
+							SigningKeyBundle: &platform.LocalConfigMapReference{
+								Name: "redhat-signing-key-bundle",
+							},
 							NotifierSecretsEncryption: &platform.NotifierSecretsEncryption{
 								Enabled: pointer.Bool(true),
 							},
@@ -652,6 +690,9 @@ func TestTranslate(t *testing.T) {
 							},
 						},
 					},
+					"signingKeyBundle": map[string]interface{}{
+						"configMapName": "redhat-signing-key-bundle",
+					},
 					"notifierSecretsEncryption": map[string]interface{}{
 						"enabled": true,
 					},
@@ -683,64 +724,6 @@ func TestTranslate(t *testing.T) {
 						},
 					},
 				},
-				"scanner": map[string]interface{}{
-					"disable":  false,
-					"replicas": int32(7),
-					"autoscaling": map[string]interface{}{
-						"disable":     false,
-						"minReplicas": int32(6),
-						"maxReplicas": int32(8),
-					},
-					"nodeSelector": map[string]string{
-						"scanner-node-selector-label1": "scanner-node-selector-value1",
-						"scanner-node-selector-label2": "scanner-node-selector-value2",
-					},
-					"tolerations": []map[string]interface{}{
-						{
-							"key":      "node.stackrox.io",
-							"operator": "Equal",
-							"value":    "false",
-						}, {
-							"key":      "node-role.kubernetes.io/infra",
-							"operator": "Exists",
-						},
-					},
-					"dbNodeSelector": map[string]string{
-						"scanner-db-node-selector-label1": "scanner-db-node-selector-value1",
-						"scanner-db-node-selector-label2": "scanner-db-node-selector-value2",
-					},
-					"dbTolerations": []map[string]interface{}{
-						{
-							"key":      "node.stackrox.io",
-							"operator": "Equal",
-							"value":    "false",
-						}, {
-							"key":      "node-role.kubernetes.io/infra",
-							"operator": "Exists",
-						},
-					},
-					"resources": map[string]interface{}{
-						"limits": map[string]interface{}{
-							"cpu":    "50",
-							"memory": "60",
-						},
-						"requests": map[string]interface{}{
-							"cpu":    "70",
-							"memory": "80",
-						},
-					},
-					"dbResources": map[string]interface{}{
-						"limits": map[string]interface{}{
-							"cpu":    "90",
-							"memory": "100",
-						},
-						"requests": map[string]interface{}{
-							"cpu":    "110",
-							"memory": "120",
-						},
-					},
-					"exposeMonitoring": true,
-				},
 				"scannerV4": map[string]interface{}{
 					"disable": false,
 					"indexer": map[string]interface{}{
@@ -1275,9 +1258,6 @@ func TestTranslate(t *testing.T) {
 						},
 					},
 				},
-				"scanner": map[string]interface{}{
-					"exposeMonitoring": false,
-				},
 			},
 		},
 
diff --git a/operator/internal/common/defaulting_test_helpers/helpers.go b/operator/internal/common/defaulting_test_helpers/helpers.go
index dc3de191a2537..2b07cb49c6201 100644
--- a/operator/internal/common/defaulting_test_helpers/helpers.go
+++ b/operator/internal/common/defaulting_test_helpers/helpers.go
@@ -53,6 +53,9 @@ func CheckStruct(t *testing.T, s any, schema chartutil.Values) {
 				switch field.Type().Elem().Kind() {
 				case reflect.Struct:
 					if field.IsNil() {
+						if isObsoleteField(fieldSchema) {
+							t.Skipf("skipping obsolete field")
+						}
 						// Operator code provides no defaults for this subtree.
 						// Make sure the schema does not mention defaults either.
 						checkObjectNoDefaults(t, fieldSchema)
@@ -74,6 +77,15 @@ func CheckStruct(t *testing.T, s any, schema chartutil.Values) {
 	}
 }
 
+func isObsoleteField(schema chartutil.Values) bool {
+	desc, err := schema.PathValue("description")
+	if err != nil {
+		return false
+	}
+	s, ok := desc.(string)
+	return ok && strings.HasPrefix(s, "Obsolete field.")
+}
+
 func requireNoDefaultProperty(t *testing.T, schema chartutil.Values) {
 	require.NotContainsf(t, schema, "default", "expected schema to not define a default value, but got %v", schema["default"])
 }
diff --git a/operator/internal/images/env.go b/operator/internal/images/env.go
index 97b6c5138a0f2..4cd2d68272902 100644
--- a/operator/internal/images/env.go
+++ b/operator/internal/images/env.go
@@ -4,14 +4,10 @@ import "github.com/stackrox/rox/pkg/env"
 
 // Environment variable settings for related image overrides.
 var (
-	Main          = env.RegisterSetting("RELATED_IMAGE_MAIN")
-	CentralDB     = env.RegisterSetting("RELATED_IMAGE_CENTRAL_DB")
-	Scanner       = env.RegisterSetting("RELATED_IMAGE_SCANNER")
-	ScannerSlim   = env.RegisterSetting("RELATED_IMAGE_SCANNER_SLIM")
-	ScannerDB     = env.RegisterSetting("RELATED_IMAGE_SCANNER_DB")
-	ScannerSlimDB = env.RegisterSetting("RELATED_IMAGE_SCANNER_DB_SLIM")
-	Collector     = env.RegisterSetting("RELATED_IMAGE_COLLECTOR")
-	ScannerV4DB   = env.RegisterSetting("RELATED_IMAGE_SCANNER_V4_DB")
-	ScannerV4     = env.RegisterSetting("RELATED_IMAGE_SCANNER_V4")
-	Fact          = env.RegisterSetting("RELATED_IMAGE_FACT")
+	Main        = env.RegisterSetting("RELATED_IMAGE_MAIN")
+	CentralDB   = env.RegisterSetting("RELATED_IMAGE_CENTRAL_DB")
+	Collector   = env.RegisterSetting("RELATED_IMAGE_COLLECTOR")
+	ScannerV4DB = env.RegisterSetting("RELATED_IMAGE_SCANNER_V4_DB")
+	ScannerV4   = env.RegisterSetting("RELATED_IMAGE_SCANNER_V4")
+	Fact        = env.RegisterSetting("RELATED_IMAGE_FACT")
 )
diff --git a/operator/internal/images/overrides_test.go b/operator/internal/images/overrides_test.go
index 99c8a82d25652..7de72717b6959 100644
--- a/operator/internal/images/overrides_test.go
+++ b/operator/internal/images/overrides_test.go
@@ -10,14 +10,14 @@ import (
 
 func TestToValues(t *testing.T) {
 	testOverrides := Overrides{
-		Main:      "central.image.fullRef",
-		Scanner:   "scanner.image.fullRef",
-		ScannerDB: "scanner.dbImage.fullRef",
+		Main:        "central.image.fullRef",
+		ScannerV4:   "scannerV4.image.fullRef",
+		ScannerV4DB: "scannerV4.db.image.fullRef",
 	}
 
 	t.Setenv(Main.EnvVar(), "override-main")
-	t.Setenv(Scanner.EnvVar(), "")
-	t.Setenv(ScannerDB.EnvVar(), "")
+	t.Setenv(ScannerV4.EnvVar(), "")
+	t.Setenv(ScannerV4DB.EnvVar(), "")
 
 	vals, err := testOverrides.ToValues()
 	require.NoError(t, err)
diff --git a/operator/internal/reconciler/reconciler_factory.go b/operator/internal/reconciler/reconciler_factory.go
index 5f15d564c4b17..e511338a233e5 100644
--- a/operator/internal/reconciler/reconciler_factory.go
+++ b/operator/internal/reconciler/reconciler_factory.go
@@ -94,6 +94,10 @@ func SetupReconcilerWithManager(mgr ctrl.Manager, gvk schema.GroupVersionKind, c
 				return confighash.NewPodTemplateAnnotationPostRenderer(kubeClient, obj, renderCache)
 			},
 		),
+		// Disable rollbacks here. Failed installs/upgrades leave the release in a failed state.
+		// Recovery happens by correcting the spec so subsequent reconcile attempts succeed.
+		// See also https://github.com/operator-framework/helm-operator-plugins/issues/421.
+		client.WithFailureRollbacks(false),
 	}
 
 	actionClientGetter, err := client.NewActionClientGetter(actionConfigGetter, opts...)
diff --git a/operator/internal/securedcluster/defaults/scanner_v4.go b/operator/internal/securedcluster/defaults/scanner_v4.go
index bdef23f31fded..ba19b067cd591 100644
--- a/operator/internal/securedcluster/defaults/scanner_v4.go
+++ b/operator/internal/securedcluster/defaults/scanner_v4.go
@@ -3,7 +3,6 @@ package defaults
 import (
 	"github.com/go-logr/logr"
 	platform "github.com/stackrox/rox/operator/api/v1alpha1"
-	"github.com/stackrox/rox/operator/internal/common"
 )
 
 var (
@@ -14,14 +13,11 @@ var (
 )
 
 // Only returns AutoSense or Disabled.
-// Derive component policy based on status Defaults and spec.
-// This will be called from the preExtension to record the current setting.
+// Scanner V4 is now always on (the legacy Scanner has been removed), so we default to
+// AutoSense unless the user explicitly set Disabled in the CR spec.
 //
 // Second return value is `true`, if defaulting has been applied due to lack of explicit setting.
-func SecuredClusterScannerV4ComponentPolicy(logger logr.Logger, status *platform.SecuredClusterStatus, annotations map[string]string, spec *platform.LocalScannerV4ComponentSpec) (platform.LocalScannerV4ComponentPolicy, bool) {
-	defaultForUpgrades := platform.LocalScannerV4Disabled
-	defaultForNewInstallations := platform.LocalScannerV4AutoSense
-
+func SecuredClusterScannerV4ComponentPolicy(logger logr.Logger, _ *platform.SecuredClusterStatus, _ map[string]string, spec *platform.LocalScannerV4ComponentSpec) (platform.LocalScannerV4ComponentPolicy, bool) {
 	if spec != nil && spec.ScannerComponent != nil {
 		comp := *spec.ScannerComponent
 		if comp == platform.LocalScannerV4AutoSense || comp == platform.LocalScannerV4Disabled {
@@ -30,41 +26,7 @@ func SecuredClusterScannerV4ComponentPolicy(logger logr.Logger, status *platform
 		}
 	}
 
-	// User is relying on defaulting.
-	// This includes the case spec.ScannerComponent == "Default".
-
-	// A default entry exists already, use recorded value.
-	recordedValue := platform.LocalScannerV4ComponentPolicy(annotations[common.FeatureDefaultKeyScannerV4])
-	if recordedValue == platform.LocalScannerV4AutoSense || recordedValue == platform.LocalScannerV4Disabled {
-		logger.Info("using previously recorded componentPolicy", "componentPolicy", recordedValue)
-		return recordedValue, true
-	}
-
-	// No or unexpected default set in the annotations.
-
-	if isNewInstallation(status) {
-		// Install / Green field.
-		logger.Info("assuming new installation due to empty status.")
-		return defaultForNewInstallations, true
-	}
-
-	// Upgrade.
-	logger.Info("assuming upgrade")
-
-	if annotations[common.FeatureDefaultKeyScannerV4] == "" {
-		// No entry in the statusDefaults yet -> preserve defaulting behavior of versions which did not populate
-		// statusDefaults with a ScannerV4ComponentPolicy.
-		logger.Info("empty feature-default annotation, using default componentPolicy for upgrades",
-			"componentPolicy", defaultForUpgrades)
-		return defaultForUpgrades, true
-	}
-
-	// This should not happen, since we only store |Disabled, but just in case something unexpected happened
-	// and we need to make some decisions...
-	logger.Info("detected unexpected componentPolicy in feature-default annotation, using default componentPolicy for upgrades",
-		"unexpectedComponentPolicy", recordedValue,
-		"componentPolicy", defaultForUpgrades)
-	return defaultForUpgrades, true
+	return platform.LocalScannerV4AutoSense, true
 }
 
 func securedClusterScannerV4Defaulting(logger logr.Logger, status *platform.SecuredClusterStatus, annotations map[string]string, spec *platform.SecuredClusterSpec, defaults *platform.SecuredClusterSpec) error {
@@ -75,12 +37,8 @@ func securedClusterScannerV4Defaulting(logger logr.Logger, status *platform.Secu
 		return nil
 	}
 
-	// User is relying on defaults. Set in-memory default and persist corresponding annotation.
-
-	if annotations[common.FeatureDefaultKeyScannerV4] != string(componentPolicy) {
-		// Update feature default setting.
-		annotations[common.FeatureDefaultKeyScannerV4] = string(componentPolicy)
-	}
+	// User is relying on defaults. Set in-memory default only.
+	// We no longer persist the annotation to support downgrade scenarios.
 
 	if defaults.ScannerV4 == nil {
 		defaults.ScannerV4 = &platform.LocalScannerV4ComponentSpec{}
diff --git a/operator/internal/securedcluster/defaults/static.go b/operator/internal/securedcluster/defaults/static.go
index 50400eb29344b..99d4d8d215667 100644
--- a/operator/internal/securedcluster/defaults/static.go
+++ b/operator/internal/securedcluster/defaults/static.go
@@ -30,17 +30,6 @@ var staticDefaults = platform.SecuredClusterSpec{
 	ProcessBaselines: &platform.ProcessBaselinesSpec{
 		AutoLock: platform.ProcessBaselinesAutoLockModeDisabled.Pointer(),
 	},
-	Scanner: &platform.LocalScannerComponentSpec{
-		ScannerComponent: platform.LocalScannerComponentAutoSense.Pointer(),
-		Analyzer: &platform.ScannerAnalyzerComponent{
-			Scaling: &platform.ScannerComponentScaling{
-				AutoScaling: new(platform.ScannerAutoScalingEnabled),
-				Replicas:    new(int32(3)),
-				MinReplicas: new(int32(2)),
-				MaxReplicas: new(int32(5)),
-			},
-		},
-	},
 	ScannerV4: &platform.LocalScannerV4ComponentSpec{
 		// ScannerComponent field is set using a dedicated defaulting flow.
 		Indexer: &platform.ScannerV4Component{
@@ -77,11 +66,10 @@ var staticDefaults = platform.SecuredClusterSpec{
 		ExcludeOpenshiftNs: platform.ProcessIndicatorConfigDisabled.Pointer(),
 	},
 	VirtualMachines: &platform.VirtualMachinesSpec{
-		Mode: platform.VirtualMachinesModeDisabled.Pointer(),
 		Scraper: &platform.VirtualMachinesScraperSpec{
 			Concurrency:       new(int32(20)),
 			MaxResponseSizeKB: new(int32(16384)),
-			PollInterval:      new("5m"),
+			PollInterval:      new("4h"),
 		},
 	},
 }
diff --git a/operator/internal/securedcluster/extensions/reconcile_defaulting_test.go b/operator/internal/securedcluster/extensions/reconcile_defaulting_test.go
index 70ad6bffa17ce..bdc924c48f82f 100644
--- a/operator/internal/securedcluster/extensions/reconcile_defaulting_test.go
+++ b/operator/internal/securedcluster/extensions/reconcile_defaulting_test.go
@@ -292,17 +292,11 @@ func TestReconcileScannerV4FeatureDefaultsExtension(t *testing.T) {
 			Spec:            platform.SecuredClusterSpec{},
 			Status:          platform.SecuredClusterStatus{},
 			ExpectedDefault: &platform.LocalScannerV4AutoSense,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.LocalScannerV4AutoSense),
-			},
 		},
-		"upgrade: disabled by default": {
+		"upgrade: auto-sense by default": {
 			Spec:            platform.SecuredClusterSpec{},
 			Status:          postInstallStatus,
-			ExpectedDefault: &platform.LocalScannerV4Disabled,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
-			},
+			ExpectedDefault: &platform.LocalScannerV4AutoSense,
 		},
 		"install: auto-sense explicitly": {
 			Spec: platform.SecuredClusterSpec{
@@ -322,47 +316,26 @@ func TestReconcileScannerV4FeatureDefaultsExtension(t *testing.T) {
 			Status:          platform.SecuredClusterStatus{},
 			ExpectedDefault: nil,
 		},
-		"upgrade: pick up previously persisted default (AutoSense)": {
-			Spec:   platform.SecuredClusterSpec{},
-			Status: postInstallStatus,
-			Annotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.LocalScannerV4AutoSense),
-			},
-			ExpectedDefault: &platform.LocalScannerV4AutoSense,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.LocalScannerV4AutoSense),
-			},
-		},
-		"upgrade: pick up previously persisted default (Disabled)": {
+		"upgrade: previously persisted annotation is ignored": {
 			Spec:   platform.SecuredClusterSpec{},
 			Status: postInstallStatus,
 			Annotations: map[string]string{
 				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
 			},
-			ExpectedDefault: &platform.LocalScannerV4Disabled,
+			ExpectedDefault: &platform.LocalScannerV4AutoSense,
 			ExpectedAnnotations: map[string]string{
 				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
 			},
 		},
-		"upgrade: ignoring bogus persisted default": {
+		"upgrade: bogus persisted annotation is ignored": {
 			Spec:   platform.SecuredClusterSpec{},
 			Status: postInstallStatus,
 			Annotations: map[string]string{
 				common.FeatureDefaultKeyScannerV4: "foo",
 			},
-			ExpectedDefault: &platform.LocalScannerV4Disabled,
-			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
-			},
-		},
-		"previously persisted default is picked up even if status is empty": {
-			Spec: platform.SecuredClusterSpec{},
-			Annotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
-			},
-			ExpectedDefault: &platform.LocalScannerV4Disabled,
+			ExpectedDefault: &platform.LocalScannerV4AutoSense,
 			ExpectedAnnotations: map[string]string{
-				common.FeatureDefaultKeyScannerV4: string(platform.ScannerV4ComponentDisabled),
+				common.FeatureDefaultKeyScannerV4: "foo",
 			},
 		},
 	}
diff --git a/operator/internal/securedcluster/scanner/auto_sense.go b/operator/internal/securedcluster/scanner/auto_sense.go
index 4c9a6b0c3250d..73f44b18ed12b 100644
--- a/operator/internal/securedcluster/scanner/auto_sense.go
+++ b/operator/internal/securedcluster/scanner/auto_sense.go
@@ -18,14 +18,11 @@ type AutoSenseResult struct {
 	EnableLocalImageScanning bool
 }
 
-// AutoSenseLocalScannerConfig detects whether the local scanner should be deployed and/or used by sensor.
-// Takes into account the setting in provided SecuredCluster CR as well as the presence of a Central instance in the same namespace.
-// Modifies the provided SecuredCluster object to set a default Spec.Scanner if missing.
-func AutoSenseLocalScannerConfig(ctx context.Context, client ctrlClient.Client, s platform.SecuredCluster) (AutoSenseResult, error) {
-	SetScannerDefaults(&s.Spec)
-	scannerComponent := *s.Spec.Scanner.ScannerComponent
-
-	return autoSenseScanner(ctx, client, scannerComponent, s.Namespace)
+// AutoSenseLocalScannerConfig returns a disabled legacy Scanner result.
+// The legacy Scanner has been removed; this function is kept for callers that
+// gate scanner-db-password secret cleanup on the auto-sense result.
+func AutoSenseLocalScannerConfig(_ context.Context, _ ctrlClient.Client, _ platform.SecuredCluster) (AutoSenseResult, error) {
+	return AutoSenseResult{}, nil
 }
 
 // AutoSenseLocalScannerV4Config detects whether the local Scanner V4 should be deployed and/or used by sensor.
@@ -44,17 +41,6 @@ func AutoSenseLocalScannerV4Config(ctx context.Context, client ctrlClient.Client
 
 }
 
-func autoSenseScanner(ctx context.Context, client ctrlClient.Client, scannerComponent platform.LocalScannerComponentPolicy, namespace string) (AutoSenseResult, error) {
-	switch scannerComponent {
-	case platform.LocalScannerComponentAutoSense:
-		return autoSense(ctx, client, namespace)
-	case platform.LocalScannerComponentDisabled:
-		return AutoSenseResult{}, nil
-	}
-
-	return AutoSenseResult{}, errors.Errorf("invalid scannerComponent setting: %q", scannerComponent)
-}
-
 func autoSenseScannerV4(ctx context.Context, client ctrlClient.Client, deploymentPolicy platform.LocalScannerV4ComponentPolicy, namespace string) (AutoSenseResult, error) {
 	switch deploymentPolicy {
 	case platform.LocalScannerV4ComponentAutoSense:
diff --git a/operator/internal/securedcluster/scanner/auto_sense_test.go b/operator/internal/securedcluster/scanner/auto_sense_test.go
index c541b2f1db1e4..8e91ce05f964e 100644
--- a/operator/internal/securedcluster/scanner/auto_sense_test.go
+++ b/operator/internal/securedcluster/scanner/auto_sense_test.go
@@ -18,16 +18,16 @@ var securedCluster = platform.SecuredCluster{
 	},
 }
 
-func TestAutoSenseLocalScannerSupportShouldBeEnabled(t *testing.T) {
+func TestAutoSenseLocalScannerAlwaysReturnsDisabled(t *testing.T) {
 	client := testutils.NewFakeClientBuilder(t, testutils.ValidClusterVersion).Build()
 
 	config, err := AutoSenseLocalScannerConfig(context.Background(), client, securedCluster)
 	require.NoError(t, err)
-	assert.True(t, config.EnableLocalImageScanning)
-	assert.True(t, config.DeployScannerResources)
+	assert.False(t, config.EnableLocalImageScanning)
+	assert.False(t, config.DeployScannerResources)
 }
 
-func TestAutoSenseIsDisabledWithCentralPresentShouldBeDisabled(t *testing.T) {
+func TestAutoSenseLocalScannerIgnoresCentralPresence(t *testing.T) {
 	client := testutils.NewFakeClientBuilder(t, testutils.ValidClusterVersion, &platform.Central{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: testutils.TestNamespace,
@@ -38,11 +38,11 @@ func TestAutoSenseIsDisabledWithCentralPresentShouldBeDisabled(t *testing.T) {
 
 	config, err := AutoSenseLocalScannerConfig(context.Background(), client, securedCluster)
 	require.NoError(t, err)
-	assert.False(t, config.DeployScannerResources, "Expected Scanner resource deployment to be disabled if Central is present")
-	assert.True(t, config.EnableLocalImageScanning, "Expected Local Image Scanning feature to be enabled.")
+	assert.False(t, config.DeployScannerResources)
+	assert.False(t, config.EnableLocalImageScanning)
 }
 
-func TestAutoSenseIsEnabledWithCentralInADifferentNamespace(t *testing.T) {
+func TestAutoSenseLocalScannerIgnoresCentralInDifferentNamespace(t *testing.T) {
 	client := testutils.NewFakeClientBuilder(t, testutils.ValidClusterVersion, &platform.Central{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: "another-namespace",
@@ -53,6 +53,6 @@ func TestAutoSenseIsEnabledWithCentralInADifferentNamespace(t *testing.T) {
 
 	config, err := AutoSenseLocalScannerConfig(context.Background(), client, securedCluster)
 	require.NoError(t, err)
-	require.True(t, config.DeployScannerResources)
-	require.True(t, config.EnableLocalImageScanning)
+	assert.False(t, config.DeployScannerResources)
+	assert.False(t, config.EnableLocalImageScanning)
 }
diff --git a/operator/internal/securedcluster/scanner/defaults.go b/operator/internal/securedcluster/scanner/defaults.go
deleted file mode 100644
index a23cd9b60cffb..0000000000000
--- a/operator/internal/securedcluster/scanner/defaults.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package scanner
-
-import platform "github.com/stackrox/rox/operator/api/v1alpha1"
-
-// SetScannerDefaults makes sure that spec.Scanner and spec.Scanner.ScannerComponent are not nil.
-func SetScannerDefaults(spec *platform.SecuredClusterSpec) {
-	if spec.Scanner == nil {
-		spec.Scanner = &platform.LocalScannerComponentSpec{}
-	}
-	if spec.Scanner.ScannerComponent == nil {
-		spec.Scanner.ScannerComponent = platform.LocalScannerComponentAutoSense.Pointer()
-	}
-}
diff --git a/operator/internal/securedcluster/values/translation/image_overrides.go b/operator/internal/securedcluster/values/translation/image_overrides.go
index b80c19695677e..9b60dbc43c859 100644
--- a/operator/internal/securedcluster/values/translation/image_overrides.go
+++ b/operator/internal/securedcluster/values/translation/image_overrides.go
@@ -4,12 +4,10 @@ import "github.com/stackrox/rox/operator/internal/images"
 
 var (
 	imageOverrides = images.Overrides{
-		images.Main:          "image.main.fullRef",
-		images.Collector:     "image.collector.fullRef",
-		images.ScannerSlim:   "image.scanner.fullRef",
-		images.ScannerSlimDB: "image.scannerDb.fullRef",
-		images.ScannerV4DB:   "image.scannerV4DB.fullRef",
-		images.ScannerV4:     "image.scannerV4.fullRef",
-		images.Fact:          "image.fact.fullRef",
+		images.Main:        "image.main.fullRef",
+		images.Collector:   "image.collector.fullRef",
+		images.ScannerV4DB: "image.scannerV4DB.fullRef",
+		images.ScannerV4:   "image.scannerV4.fullRef",
+		images.Fact:        "image.fact.fullRef",
 	}
 )
diff --git a/operator/internal/securedcluster/values/translation/translation.go b/operator/internal/securedcluster/values/translation/translation.go
index 7b7775466adb5..f5a99086a15a4 100644
--- a/operator/internal/securedcluster/values/translation/translation.go
+++ b/operator/internal/securedcluster/values/translation/translation.go
@@ -40,6 +40,14 @@ const (
 
 	legacyCollectionKernelModule = "KernelModule"
 	legacyCollectionEBPF         = "EBPF"
+
+	// namespacePrefixGlobalResourcesAnnotation is an undocumented, test-only annotation.
+	// When set to "true" it enables namespace-prefixing of global (cluster-scoped)
+	// resource names in the secured-cluster chart (see srox.optionalGlobalResourceName),
+	// so that multiple secured clusters can be deployed into different namespaces of the
+	// same cluster without cluster-scoped resource name clashes. It defaults to off, so
+	// production keeps stable, static names. Deliberately kept out of the CRD schema.
+	namespacePrefixGlobalResourcesAnnotation = "platform.stackrox.io/namespace-prefix-global-resources"
 )
 
 var (
@@ -100,8 +108,6 @@ func (t Translator) translate(ctx context.Context, sc platform.SecuredCluster) (
 	if err := platform.MergeSecuredClusterDefaultsIntoSpec(&sc); err != nil {
 		return nil, err
 	}
-	scanner.SetScannerDefaults(&sc.Spec)
-
 	v := translation.NewValuesBuilder()
 
 	if sc.Spec.ClusterName != nil {
@@ -109,6 +115,17 @@ func (t Translator) translate(ctx context.Context, sc platform.SecuredCluster) (
 	}
 	v.SetStringMap("clusterLabels", sc.Spec.ClusterLabels)
 
+	if annotationValue, ok := sc.GetAnnotations()[namespacePrefixGlobalResourcesAnnotation]; ok {
+		namespacePrefix, err := strconv.ParseBool(annotationValue)
+		if err != nil {
+			return nil, fmt.Errorf("invalid annotation value %q for annotation %s",
+				annotationValue, namespacePrefixGlobalResourcesAnnotation)
+		}
+		if namespacePrefix {
+			v.SetBoolValue("namespacePrefixGlobalResources", true)
+		}
+	}
+
 	if sc.Spec.CentralEndpoint != nil && *sc.Spec.CentralEndpoint != "" {
 		v.SetStringValue("centralEndpoint", *sc.Spec.CentralEndpoint)
 	}
@@ -123,17 +140,12 @@ func (t Translator) translate(ctx context.Context, sc platform.SecuredCluster) (
 		return nil, err
 	}
 
-	scannerAutoSenseConfig, err := scanner.AutoSenseLocalScannerConfig(ctx, t.client, sc)
-	if err != nil {
-		return nil, err
-	}
-
 	scannerV4AutoSenseConfig, err := scanner.AutoSenseLocalScannerV4Config(ctx, t.client, sc)
 	if err != nil {
 		return nil, err
 	}
 
-	v.AddChild("sensor", t.getSensorValues(sc.Spec.Sensor, scannerAutoSenseConfig, scannerV4AutoSenseConfig, deploymentDefaults))
+	v.AddChild("sensor", t.getSensorValues(sc.Spec.Sensor, scannerV4AutoSenseConfig, deploymentDefaults))
 	v.AddChild("admissionControl", t.getAdmissionControlValues(sc.Spec.AdmissionControl, deploymentDefaults))
 
 	if sc.Spec.AuditLogs != nil {
@@ -144,7 +156,6 @@ func (t Translator) translate(ctx context.Context, sc platform.SecuredCluster) (
 		v.AddChild("collector", t.getCollectorValues(sc.Spec.PerNode))
 	}
 
-	v.AddChild("scanner", t.getLocalScannerComponentValues(sc, scannerAutoSenseConfig, deploymentDefaults))
 	v.AddChild("scannerV4", t.getLocalScannerV4ComponentValues(ctx, sc, scannerV4AutoSenseConfig, deploymentDefaults))
 
 	customize.AddAllFrom(translation.GetCustomize(sc.Spec.Customize))
@@ -303,10 +314,10 @@ func (t Translator) checkInitBundleSecret(ctx context.Context, sc platform.Secur
 	return nil
 }
 
-func (t Translator) getSensorValues(sensor *platform.SensorComponentSpec, scannerAutosense scanner.AutoSenseResult, scannerV4Autosense scanner.AutoSenseResult, defaults translation.SchedulingConstraints) *translation.ValuesBuilder {
+func (t Translator) getSensorValues(sensor *platform.SensorComponentSpec, scannerV4Autosense scanner.AutoSenseResult, defaults translation.SchedulingConstraints) *translation.ValuesBuilder {
 	sv := translation.NewValuesBuilder()
 
-	if scannerAutosense.EnableLocalImageScanning || scannerV4Autosense.EnableLocalImageScanning {
+	if scannerV4Autosense.EnableLocalImageScanning {
 		sv.SetPathValue("localImageScanning.enabled", strconv.FormatBool(true))
 	}
 
@@ -500,17 +511,6 @@ func (t Translator) getFAMContainerValues(famContainerSpec *platform.FAMContaine
 	return &cv
 }
 
-func (t Translator) getLocalScannerComponentValues(securedCluster platform.SecuredCluster, config scanner.AutoSenseResult, defaults translation.SchedulingConstraints) *translation.ValuesBuilder {
-	sv := translation.NewValuesBuilder()
-	s := securedCluster.Spec.Scanner
-
-	sv.SetBoolValue("disable", !config.DeployScannerResources)
-	translation.SetScannerAnalyzerValues(&sv, s.Analyzer, defaults)
-	translation.SetScannerDBValues(&sv, s.DB, defaults)
-
-	return &sv
-}
-
 func (t Translator) getLocalScannerV4ComponentValues(ctx context.Context, securedCluster platform.SecuredCluster, config scanner.AutoSenseResult, defaults translation.SchedulingConstraints) *translation.ValuesBuilder {
 	s := securedCluster.Spec.ScannerV4
 	if s == nil && !defaults.IsSet() {
@@ -623,16 +623,6 @@ func getVirtualMachinesValues(vm *platform.VirtualMachinesSpec) *translation.Val
 		return nil
 	}
 	cv := translation.NewValuesBuilder()
-	if vm.Mode != nil {
-		switch *vm.Mode {
-		case platform.VirtualMachinesModeEnabled:
-			cv.SetBoolValue("enabled", true)
-		case platform.VirtualMachinesModeDisabled:
-			cv.SetBoolValue("enabled", false)
-		default:
-			return cv.SetError(fmt.Errorf("invalid virtual machines mode %q", *vm.Mode))
-		}
-	}
 	// Scraper is always set by static defaulting; omit helm values when unset.
 	if vm.Scraper != nil {
 		sv := translation.NewValuesBuilder()
diff --git a/operator/internal/securedcluster/values/translation/translation_test.go b/operator/internal/securedcluster/values/translation/translation_test.go
index d2d28393f425a..b7e8246fc1b60 100644
--- a/operator/internal/securedcluster/values/translation/translation_test.go
+++ b/operator/internal/securedcluster/values/translation/translation_test.go
@@ -41,8 +41,6 @@ func TestTranslation(t *testing.T) {
 }
 
 func (s *TranslationTestSuite) TestImageOverrides() {
-	s.T().Setenv(images.ScannerSlim.EnvVar(), "stackrox/scanner:1.0.0")
-	s.T().Setenv(images.ScannerSlimDB.EnvVar(), "stackrox/scanner-db:1.0.0")
 	s.T().Setenv(images.ScannerV4DB.EnvVar(), "stackrox/scanner-v4-db:1.0.0")
 	s.T().Setenv(images.ScannerV4.EnvVar(), "stackrox/scanner-v4:1.0.0")
 
@@ -61,14 +59,6 @@ func (s *TranslationTestSuite) TestImageOverrides() {
 	vals, err := translator.Translate(context.Background(), u)
 	s.Require().NoError(err)
 
-	scannerImage, err := vals.PathValue("image.scanner.fullRef")
-	s.Require().NoError(err)
-	s.Equal("stackrox/scanner:1.0.0", scannerImage)
-
-	scannerDbImage, err := vals.PathValue("image.scannerDb.fullRef")
-	s.Require().NoError(err)
-	s.Equal("stackrox/scanner-db:1.0.0", scannerDbImage)
-
 	scannerV4DbImage, err := vals.PathValue("image.scannerV4DB.fullRef")
 	s.Require().NoError(err)
 	s.Equal("stackrox/scanner-v4-db:1.0.0", scannerV4DbImage)
@@ -149,9 +139,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
 				"scannerV4": map[string]interface{}{
 					"disable": false,
 					"db": map[string]interface{}{
@@ -195,9 +182,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
 				"scannerV4": map[string]interface{}{
 					"disable": false,
 					"db": map[string]interface{}{
@@ -242,17 +226,9 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
 				"scannerV4": map[string]interface{}{
 					"disable": true,
 				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -274,14 +250,31 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
+				"monitoring": map[string]interface{}{
+					"openshift": map[string]interface{}{
+						"enabled": true,
+					},
 				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
+			},
+		},
+		"namespace-prefix-global-resources annotation enabled": {
+			args: args{
+				client: newDefaultFakeClient(t),
+				sc: platform.SecuredCluster{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace:   "stackrox",
+						Annotations: map[string]string{namespacePrefixGlobalResourcesAnnotation: "true"},
+					},
+					Spec: platform.SecuredClusterSpec{
+						ClusterName: new("test-cluster"),
 					},
 				},
+			},
+			want: chartutil.Values{
+				"clusterName":                    "test-cluster",
+				"ca":                             map[string]string{"cert": "ca central content"},
+				"createSecrets":                  false,
+				"namespacePrefixGlobalResources": true,
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -309,9 +302,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": true,
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -342,9 +332,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
 				"scannerV4": map[string]interface{}{
 					"disable": false,
 					"db": map[string]interface{}{
@@ -379,14 +366,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -734,75 +713,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"auditLogs": map[string]interface{}{
 					"disableCollection": false,
 				},
-				"scanner": map[string]interface{}{
-					"disable":  false,
-					"replicas": int32(7),
-					"autoscaling": map[string]interface{}{
-						"disable":     false,
-						"minReplicas": int32(6),
-						"maxReplicas": int32(8),
-					},
-					"nodeSelector": map[string]string{
-						"scanner-node-selector-label1": "scanner-node-selector-value1",
-						"scanner-node-selector-label2": "scanner-node-selector-value2",
-					},
-					"tolerations": []map[string]interface{}{
-						{
-							"key":      "node.stackrox.io",
-							"operator": "Equal",
-							"value":    "false",
-						}, {
-							"key":      "node-role.kubernetes.io/infra",
-							"operator": "Exists",
-						},
-					},
-					"hostAliases": []map[string]interface{}{
-						{
-							"ip":        "127.0.0.1",
-							"hostnames": []string{"scanner.com"},
-						},
-					},
-					"dbNodeSelector": map[string]string{
-						"scanner-db-node-selector-label1": "scanner-db-node-selector-value1",
-						"scanner-db-node-selector-label2": "scanner-db-node-selector-value2",
-					},
-					"dbTolerations": []map[string]interface{}{
-						{
-							"key":      "node.stackrox.io",
-							"operator": "Equal",
-							"value":    "false",
-						}, {
-							"key":      "node-role.kubernetes.io/infra",
-							"operator": "Exists",
-						},
-					},
-					"dbHostAliases": []map[string]interface{}{
-						{
-							"ip":        "127.0.0.1",
-							"hostnames": []string{"scanner-db.com"},
-						},
-					},
-					"resources": map[string]interface{}{
-						"limits": map[string]interface{}{
-							"cpu":    "50",
-							"memory": "60",
-						},
-						"requests": map[string]interface{}{
-							"cpu":    "70",
-							"memory": "80",
-						},
-					},
-					"dbResources": map[string]interface{}{
-						"limits": map[string]interface{}{
-							"cpu":    "90",
-							"memory": "100",
-						},
-						"requests": map[string]interface{}{
-							"cpu":    "110",
-							"memory": "120",
-						},
-					},
-				},
 				"scannerV4": map[string]interface{}{
 					"disable": false,
 					"indexer": map[string]interface{}{
@@ -955,14 +865,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 					"forceCollectionMethod": true,
 					"collectionMethod":      "CORE_BPF",
 				},
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -987,14 +889,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -1022,14 +916,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -1057,14 +943,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
@@ -1075,16 +953,14 @@ func (s *TranslationTestSuite) TestTranslate() {
 				},
 			},
 		},
-		"virtual machines enabled": {
+		// getVirtualMachinesValues(nil) omits the virtualMachines helm key.
+		"virtual machines spec nil": {
 			args: args{
 				client: newDefaultFakeClient(t),
 				sc: platform.SecuredCluster{
 					ObjectMeta: metav1.ObjectMeta{Namespace: "stackrox"},
 					Spec: platform.SecuredClusterSpec{
 						ClusterName: new("test-cluster"),
-						VirtualMachines: &platform.VirtualMachinesSpec{
-							Mode: platform.VirtualMachinesModeEnabled.Pointer(),
-						},
 					},
 				},
 			},
@@ -1092,25 +968,16 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
 					},
 				},
-				"virtualMachines": map[string]interface{}{
-					"enabled": true,
-				},
 			},
 		},
-		"virtual machines disabled": {
+		// Scraper knobs are forwarded; Helm virtualMachines.enabled is omitted
+		// so it follows ROX_VIRTUAL_MACHINES.
+		"virtual machines scraper defaults": {
 			args: args{
 				client: newDefaultFakeClient(t),
 				sc: platform.SecuredCluster{
@@ -1118,7 +985,11 @@ func (s *TranslationTestSuite) TestTranslate() {
 					Spec: platform.SecuredClusterSpec{
 						ClusterName: new("test-cluster"),
 						VirtualMachines: &platform.VirtualMachinesSpec{
-							Mode: platform.VirtualMachinesModeDisabled.Pointer(),
+							Scraper: &platform.VirtualMachinesScraperSpec{
+								Concurrency:       new(int32(20)),
+								MaxResponseSizeKB: new(int32(16384)),
+								PollInterval:      new("4h"),
+							},
 						},
 					},
 				},
@@ -1127,52 +998,16 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
 					},
 				},
 				"virtualMachines": map[string]interface{}{
-					"enabled": false,
-				},
-			},
-		},
-		// Unreachable in production: static.go's defaulting flow always fills in
-		// Mode: Disabled before translate() runs. Kept to pin translate()'s own
-		// nil-handling in isolation.
-		"virtual machines unset": {
-			args: args{
-				client: newDefaultFakeClient(t),
-				sc: platform.SecuredCluster{
-					ObjectMeta: metav1.ObjectMeta{Namespace: "stackrox"},
-					Spec: platform.SecuredClusterSpec{
-						ClusterName: new("test-cluster"),
-					},
-				},
-			},
-			want: chartutil.Values{
-				"clusterName":   "test-cluster",
-				"ca":            map[string]string{"cert": "ca central content"},
-				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
-				"monitoring": map[string]interface{}{
-					"openshift": map[string]interface{}{
-						"enabled": true,
+					"scraper": map[string]interface{}{
+						"concurrency":       int32(20),
+						"maxResponseSizeKB": int32(16384),
+						"pollInterval":      "4h",
 					},
 				},
 			},
@@ -1185,7 +1020,6 @@ func (s *TranslationTestSuite) TestTranslate() {
 					Spec: platform.SecuredClusterSpec{
 						ClusterName: new("test-cluster"),
 						VirtualMachines: &platform.VirtualMachinesSpec{
-							Mode: platform.VirtualMachinesModeEnabled.Pointer(),
 							Scraper: &platform.VirtualMachinesScraperSpec{
 								Concurrency:       new(int32(5)),
 								MaxResponseSizeKB: new(int32(1024)),
@@ -1199,21 +1033,12 @@ func (s *TranslationTestSuite) TestTranslate() {
 				"clusterName":   "test-cluster",
 				"ca":            map[string]string{"cert": "ca central content"},
 				"createSecrets": false,
-				"scanner": map[string]interface{}{
-					"disable": false,
-				},
-				"sensor": map[string]interface{}{
-					"localImageScanning": map[string]string{
-						"enabled": "true",
-					},
-				},
 				"monitoring": map[string]interface{}{
 					"openshift": map[string]interface{}{
 						"enabled": true,
 					},
 				},
 				"virtualMachines": map[string]interface{}{
-					"enabled": true,
 					"scraper": map[string]interface{}{
 						"concurrency":       int32(5),
 						"maxResponseSizeKB": int32(1024),
@@ -1586,8 +1411,6 @@ func TestDeploymentDefaults(t *testing.T) {
 	componentPaths := []testingUtils.ComponentPath{
 		{Name: "sensor", NodeSelectorPath: "sensor.nodeSelector", TolerationsPath: "sensor.tolerations"},
 		{Name: "admissionControl", NodeSelectorPath: "admissionControl.nodeSelector", TolerationsPath: "admissionControl.tolerations"},
-		{Name: "scanner", NodeSelectorPath: "scanner.nodeSelector", TolerationsPath: "scanner.tolerations"},
-		{Name: "scanner-db", NodeSelectorPath: "scanner.dbNodeSelector", TolerationsPath: "scanner.dbTolerations"},
 		{Name: "scannerV4-indexer", NodeSelectorPath: "scannerV4.indexer.nodeSelector", TolerationsPath: "scannerV4.indexer.tolerations"},
 		{Name: "scannerV4-db", NodeSelectorPath: "scannerV4.db.nodeSelector", TolerationsPath: "scannerV4.db.tolerations"},
 	}
diff --git a/operator/konflux.Dockerfile b/operator/konflux.Dockerfile
index c7a0ef7a1ac86..a0e2da48c3cb4 100644
--- a/operator/konflux.Dockerfile
+++ b/operator/konflux.Dockerfile
@@ -1,4 +1,4 @@
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:3ca2c34c83e6563fa574b7c7ecda92a5fdae2ec7a5f37a408e5e383947fb1957 AS builder
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:e74b03198cccc24c24a27071ad4d6c2edcfe0bb10c6de99c609ce6e3c06d6d04 AS builder
 
 WORKDIR /go/src/github.com/stackrox/rox/app
 
@@ -17,10 +17,10 @@ ENV CI=1 GOFLAGS="" CGO_ENABLED=1
 RUN GOOS=linux GOARCH=$(go env GOARCH) scripts/go-build-file.sh operator/cmd/main.go image/bin/operator
 
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95 AS ubi-micro-base
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:5be877a2a280ae36eb9ab80ca4efb28bbf77c57abbba38137cdc37a03b8465e6 AS ubi-micro-base
 
 
-FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:bcbf1fe577df63bd975ea19ebae604b5f072e1833b2bde417a0ffd4afd938b96 AS package_installer
+FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:16e9e43d99e181463513cc84a514859b1abb9460f1c4d9e208da4b4e51cd5cc3 AS package_installer
 
 # Copy ubi-micro base to /out/ to preserve its rpmdb
 COPY --from=ubi-micro-base / /out/
@@ -30,7 +30,7 @@ COPY --from=ubi-micro-base / /out/
 # prefetched by Hermeto/Cachi2, instead of installroot's default UBI repos.
 RUN dnf install -y \
     --installroot=/out/ \
-    --releasever=8 \
+    --releasever=9 \
     --setopt=install_weak_deps=False \
     --setopt=reposdir=/etc/yum.repos.d \
     --nodocs \
diff --git a/operator/konflux.bundle.Dockerfile b/operator/konflux.bundle.Dockerfile
index c121f5fd68352..aee48825bd605 100644
--- a/operator/konflux.bundle.Dockerfile
+++ b/operator/konflux.bundle.Dockerfile
@@ -1,4 +1,4 @@
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:3ca2c34c83e6563fa574b7c7ecda92a5fdae2ec7a5f37a408e5e383947fb1957 AS builder
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:e74b03198cccc24c24a27071ad4d6c2edcfe0bb10c6de99c609ce6e3c06d6d04 AS builder
 
 COPY . /stackrox
 WORKDIR /stackrox/operator
@@ -13,22 +13,6 @@ ARG RELATED_IMAGE_MAIN
 ENV RELATED_IMAGE_MAIN=$RELATED_IMAGE_MAIN
 RUN echo "Checking required RELATED_IMAGE_MAIN"; [[ "${RELATED_IMAGE_MAIN}" != "" ]]
 
-ARG RELATED_IMAGE_SCANNER
-ENV RELATED_IMAGE_SCANNER=$RELATED_IMAGE_SCANNER
-RUN echo "Checking required RELATED_IMAGE_SCANNER"; [[ "${RELATED_IMAGE_SCANNER}" != "" ]]
-
-ARG RELATED_IMAGE_SCANNER_DB
-ENV RELATED_IMAGE_SCANNER_DB=$RELATED_IMAGE_SCANNER_DB
-RUN echo "Checking required RELATED_IMAGE_SCANNER_DB"; [[ "${RELATED_IMAGE_SCANNER_DB}" != "" ]]
-
-ARG RELATED_IMAGE_SCANNER_SLIM
-ENV RELATED_IMAGE_SCANNER_SLIM=$RELATED_IMAGE_SCANNER_SLIM
-RUN echo "Checking required RELATED_IMAGE_SCANNER_SLIM"; [[ "${RELATED_IMAGE_SCANNER_SLIM}" != "" ]]
-
-ARG RELATED_IMAGE_SCANNER_DB_SLIM
-ENV RELATED_IMAGE_SCANNER_DB_SLIM=$RELATED_IMAGE_SCANNER_DB_SLIM
-RUN echo "Checking required RELATED_IMAGE_SCANNER_DB_SLIM"; [[ "${RELATED_IMAGE_SCANNER_DB_SLIM}" != "" ]]
-
 ARG RELATED_IMAGE_SCANNER_V4
 ENV RELATED_IMAGE_SCANNER_V4=$RELATED_IMAGE_SCANNER_V4
 RUN echo "Checking required RELATED_IMAGE_SCANNER_V4"; [[ "${RELATED_IMAGE_SCANNER_V4}" != "" ]]
diff --git a/operator/tests/central/central-basic/100-assert.yaml b/operator/tests/central/central-basic/100-assert.yaml
index 7fa834ae794e3..28c2acde04e7b 100644
--- a/operator/tests/central/central-basic/100-assert.yaml
+++ b/operator/tests/central/central-basic/100-assert.yaml
@@ -18,28 +18,6 @@ spec:
 ---
 apiVersion: apps/v1
 kind: Deployment
-metadata:
-  name: scanner
-spec:
-  template:
-    spec:
-      hostAliases:
-      - ip: "127.0.0.1"
-        hostnames: ["scanner.com"]
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner-db
-spec:
-  template:
-    spec:
-      hostAliases:
-      - ip: "127.0.0.1"
-        hostnames: ["scanner-db.com"]
----
-apiVersion: apps/v1
-kind: Deployment
 metadata:
   name: scanner-v4-matcher
 spec:
diff --git a/operator/tests/central/central-basic/100-set-host-aliases.yaml b/operator/tests/central/central-basic/100-set-host-aliases.yaml
index fa98030f67bfe..ae0c9ec653848 100644
--- a/operator/tests/central/central-basic/100-set-host-aliases.yaml
+++ b/operator/tests/central/central-basic/100-set-host-aliases.yaml
@@ -18,16 +18,6 @@ spec:
       hostAliases:
         - ip: "127.0.0.1"
           hostnames: ["central-db.com"]
-  scanner:
-    scannerComponent: Enabled
-    analyzer:
-      hostAliases:
-        - ip: "127.0.0.1"
-          hostnames: ["scanner.com"]
-    db:
-      hostAliases:
-        - ip: "127.0.0.1"
-          hostnames: [ "scanner-db.com" ]
   scannerV4:
     # Explicitly enable, scannerV4 is currenlty opt-in
     scannerComponent: Enabled
diff --git a/operator/tests/central/central-basic/101-unset-host-aliases.yaml b/operator/tests/central/central-basic/101-unset-host-aliases.yaml
index f046ee3e42440..e7a29cb5bebf1 100644
--- a/operator/tests/central/central-basic/101-unset-host-aliases.yaml
+++ b/operator/tests/central/central-basic/101-unset-host-aliases.yaml
@@ -14,11 +14,6 @@ spec:
     hostAliases: []
     db:
       hostAliases: []
-  scanner:
-    analyzer:
-      hostAliases: []
-    db:
-      hostAliases: []
   scannerV4:
     indexer:
       hostAliases: []
diff --git a/operator/tests/central/central-misc/010-central-cr.yaml b/operator/tests/central/central-misc/010-central-cr.yaml
index 8531547de6f08..ba0832de471f9 100644
--- a/operator/tests/central/central-misc/010-central-cr.yaml
+++ b/operator/tests/central/central-misc/010-central-cr.yaml
@@ -58,23 +58,3 @@ spec:
         limits:
           cpu: "1000m"
           memory: "2500Mi"
-  scanner:
-    analyzer:
-      scaling:
-        autoScaling: Disabled
-        replicas: 1
-      resources:
-        requests:
-          memory: 500Mi
-          cpu: 500m
-        limits:
-          memory: 2500Mi
-          cpu: 2000m
-    db:
-      resources:
-        requests:
-          cpu: 400m
-          memory: 512Mi
-        limits:
-          cpu: 2000m
-          memory: 4Gi
diff --git a/operator/tests/central/central-misc/061-assert.yaml b/operator/tests/central/central-misc/061-assert.yaml
index 566109da993d2..551e7b8c05a6a 100644
--- a/operator/tests/central/central-misc/061-assert.yaml
+++ b/operator/tests/central/central-misc/061-assert.yaml
@@ -41,38 +41,3 @@ spec:
       app: central
   policyTypes:
   - Ingress
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner
-spec:
-  template:
-    spec:
-      containers:
-      - name: scanner
-        ports:
-        - containerPort: 8080
-          name: https
-          protocol: TCP
-        - containerPort: 8443
-          name: grpc
-          protocol: TCP
-        - containerPort: 9090
-          name: monitoring
-          protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: scanner-monitoring
-spec:
-  ingress:
-  - ports:
-    - port: 9090
-      protocol: TCP
-  podSelector:
-    matchLabels:
-      app: scanner
-  policyTypes:
-  - Ingress
diff --git a/operator/tests/central/central-misc/061-set-expose-monitoring.yaml b/operator/tests/central/central-misc/061-set-expose-monitoring.yaml
index 9ee4a4dd56ca3..82ab582f905fa 100644
--- a/operator/tests/central/central-misc/061-set-expose-monitoring.yaml
+++ b/operator/tests/central/central-misc/061-set-expose-monitoring.yaml
@@ -13,6 +13,3 @@ spec:
   central:
     monitoring:
       exposeEndpoint: Enabled
-  scanner:
-    monitoring:
-      exposeEndpoint: Enabled
diff --git a/operator/tests/central/central-misc/063-assert.yaml b/operator/tests/central/central-misc/063-assert.yaml
index 72f00717eb874..5e71983b56a93 100644
--- a/operator/tests/central/central-misc/063-assert.yaml
+++ b/operator/tests/central/central-misc/063-assert.yaml
@@ -13,20 +13,3 @@ spec:
         - containerPort: 8443
           name: api
           protocol: TCP
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner
-spec:
-  template:
-    spec:
-      containers:
-      - name: scanner
-        ports:
-        - containerPort: 8080
-          name: https
-          protocol: TCP
-        - containerPort: 8443
-          name: grpc
-          protocol: TCP
diff --git a/operator/tests/central/central-misc/063-unset-expose-monitoring.yaml b/operator/tests/central/central-misc/063-unset-expose-monitoring.yaml
index f21f394a15f09..956f981b0ec99 100644
--- a/operator/tests/central/central-misc/063-unset-expose-monitoring.yaml
+++ b/operator/tests/central/central-misc/063-unset-expose-monitoring.yaml
@@ -13,9 +13,6 @@ spec:
   central:
     monitoring:
       exposeEndpoint: Disabled
-  scanner:
-    monitoring:
-      exposeEndpoint: Disabled
   monitoring:
     openshift:
       enabled: false
diff --git a/operator/tests/central/central-misc/080-assert-non-openshift.yaml b/operator/tests/central/central-misc/080-assert-non-openshift.yaml
index 042020db7ed22..2f0a7e5508697 100644
--- a/operator/tests/central/central-misc/080-assert-non-openshift.yaml
+++ b/operator/tests/central/central-misc/080-assert-non-openshift.yaml
@@ -50,6 +50,8 @@ spec:
             - name: ROX_SCANNER_V4
               value: "true"
             - name: ROX_LEGACY_SCANNER
+              value: "false"
+            - name: ROX_CENTRAL_WORKER_ENABLED
               value: "true"
             - name: NO_PROXY
               valueFrom:
diff --git a/operator/tests/central/central-misc/080-assert-openshift.yaml b/operator/tests/central/central-misc/080-assert-openshift.yaml
index 6df9d7f8c3dba..ae04ed59c1774 100644
--- a/operator/tests/central/central-misc/080-assert-openshift.yaml
+++ b/operator/tests/central/central-misc/080-assert-openshift.yaml
@@ -54,6 +54,8 @@ spec:
             - name: ROX_SCANNER_V4
               value: "true"
             - name: ROX_LEGACY_SCANNER
+              value: "false"
+            - name: ROX_CENTRAL_WORKER_ENABLED
               value: "true"
             - name: NO_PROXY
               valueFrom:
diff --git a/operator/tests/central/central-misc/081-assert-non-openshift.yaml b/operator/tests/central/central-misc/081-assert-non-openshift.yaml
index fa1f691109048..c65e401e52019 100644
--- a/operator/tests/central/central-misc/081-assert-non-openshift.yaml
+++ b/operator/tests/central/central-misc/081-assert-non-openshift.yaml
@@ -46,6 +46,8 @@ spec:
             - name: ROX_SCANNER_V4
               value: "true"
             - name: ROX_LEGACY_SCANNER
+              value: "false"
+            - name: ROX_CENTRAL_WORKER_ENABLED
               value: "true"
             - name: NO_PROXY
               valueFrom:
diff --git a/operator/tests/central/central-misc/081-assert-openshift.yaml b/operator/tests/central/central-misc/081-assert-openshift.yaml
index 5aafe7bebc004..1e5773a8454ed 100644
--- a/operator/tests/central/central-misc/081-assert-openshift.yaml
+++ b/operator/tests/central/central-misc/081-assert-openshift.yaml
@@ -50,6 +50,8 @@ spec:
             - name: ROX_SCANNER_V4
               value: "true"
             - name: ROX_LEGACY_SCANNER
+              value: "false"
+            - name: ROX_CENTRAL_WORKER_ENABLED
               value: "true"
             - name: NO_PROXY
               valueFrom:
diff --git a/operator/tests/common/central-cr-assert.yaml b/operator/tests/common/central-cr-assert.yaml
index d6f72187f13f8..29bc666be20d1 100644
--- a/operator/tests/common/central-cr-assert.yaml
+++ b/operator/tests/common/central-cr-assert.yaml
@@ -10,12 +10,6 @@ collectors:
 - type: pod
   selector: app=config-controller
   tail: -1
-- type: pod
-  selector: app=scanner
-  tail: -1
-- type: pod
-  selector: app=scanner-db
-  tail: -1
 - type: pod
   selector: app=scanner-v4-indexer
   tail: -1
@@ -28,8 +22,6 @@ collectors:
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=central
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=central-db
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=config-controller
-- command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner
-- command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-db
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-v4-indexer
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-v4-matcher
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-v4-db
@@ -82,20 +74,6 @@ status:
 ---
 apiVersion: apps/v1
 kind: Deployment
-metadata:
-  name: scanner
-status:
-  availableReplicas: 1
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner-db
-status:
-  availableReplicas: 1
----
-apiVersion: apps/v1
-kind: Deployment
 metadata:
   name: scanner-v4-indexer
 status:
diff --git a/operator/tests/common/central-cr-with-scanner-v4-enabled-explicitly.yaml b/operator/tests/common/central-cr-with-scanner-v4-enabled-explicitly.yaml
index bb115f6b6788a..7345fb54af22c 100644
--- a/operator/tests/common/central-cr-with-scanner-v4-enabled-explicitly.yaml
+++ b/operator/tests/common/central-cr-with-scanner-v4-enabled-explicitly.yaml
@@ -61,26 +61,6 @@ spec:
         limits:
           cpu: "1000m"
           memory: "2500Mi"
-  scanner:
-    analyzer:
-      scaling:
-        autoScaling: Disabled
-        replicas: 1
-      resources:
-        requests:
-          memory: 500Mi
-          cpu: 500m
-        limits:
-          memory: 2500Mi
-          cpu: 2000m
-    db:
-      resources:
-        requests:
-          cpu: 400m
-          memory: 512Mi
-        limits:
-          cpu: 2000m
-          memory: 4Gi
 ---
 apiVersion: v1
 kind: Secret
diff --git a/operator/tests/common/central-cr-without-scanner-v4-assert.yaml b/operator/tests/common/central-cr-without-scanner-v4-assert.yaml
index 7da05dab2f885..37851c7188821 100644
--- a/operator/tests/common/central-cr-without-scanner-v4-assert.yaml
+++ b/operator/tests/common/central-cr-without-scanner-v4-assert.yaml
@@ -7,16 +7,8 @@ collectors:
 - type: pod
   selector: app=central-db
   tail: -1
-- type: pod
-  selector: app=scanner
-  tail: -1
-- type: pod
-  selector: app=scanner-db
-  tail: -1
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=central
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=central-db
-- command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner
-- command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-db
 timeout: 1500
 resourceRefs:
 - apiVersion: platform.stackrox.io/v1alpha1
@@ -47,20 +39,6 @@ metadata:
 status:
   availableReplicas: 1
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner
-status:
-  availableReplicas: 1
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner-db
-status:
-  availableReplicas: 1
----
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
diff --git a/operator/tests/common/central-cr-without-scanner-v4.yaml b/operator/tests/common/central-cr-without-scanner-v4.yaml
index b9fbf96557aa1..e95d6817cfed5 100644
--- a/operator/tests/common/central-cr-without-scanner-v4.yaml
+++ b/operator/tests/common/central-cr-without-scanner-v4.yaml
@@ -61,26 +61,6 @@ spec:
         limits:
           cpu: "1000m"
           memory: "2500Mi"
-  scanner:
-    analyzer:
-      scaling:
-        autoScaling: Disabled
-        replicas: 1
-      resources:
-        requests:
-          memory: 500Mi
-          cpu: 500m
-        limits:
-          memory: 2500Mi
-          cpu: 2000m
-    db:
-      resources:
-        requests:
-          cpu: 400m
-          memory: 512Mi
-        limits:
-          cpu: 2000m
-          memory: 4Gi
 ---
 apiVersion: v1
 kind: Secret
diff --git a/operator/tests/common/central-cr.yaml b/operator/tests/common/central-cr.yaml
index 53a1c9fc8978a..8f6db6ec98d8e 100644
--- a/operator/tests/common/central-cr.yaml
+++ b/operator/tests/common/central-cr.yaml
@@ -60,6 +60,13 @@ spec:
         limits:
           cpu: "1000m"
           memory: "2500Mi"
+  # NOTE: Unlike the other central-cr*.yaml copies, this file intentionally keeps spec.scanner,
+  # so the "keep central-misc/010-central-cr.yaml in sync" note above does not apply to it.
+  # TODO(ROX-36705): spec.scanner configures the removed Scanner V2. It is kept here (and only
+  # here) because the operator upgrade test reuses this file via a symlink as its pre-upgrade CR,
+  # where the previous released operator still deploys Scanner V2. It is an obsolete-but-tolerated
+  # field that the current operator ignores, so it is harmless for the non-upgrade suites that also
+  # use this file. Remove once the oldest upgrade-from operator version no longer deploys Scanner V2.
   scanner:
     analyzer:
       scaling:
diff --git a/operator/tests/common/config-hash-assert.envsubst.yaml b/operator/tests/common/config-hash-assert.envsubst.yaml
index 2bbc5377a8210..efec9277e8240 100644
--- a/operator/tests/common/config-hash-assert.envsubst.yaml
+++ b/operator/tests/common/config-hash-assert.envsubst.yaml
@@ -21,26 +21,6 @@ spec:
 ---
 apiVersion: apps/v1
 kind: Deployment
-metadata:
-  name: scanner
-spec:
-  template:
-    metadata:
-      annotations:
-        app.stackrox.io/config-hash: ${CONFIG_HASH}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner-db
-spec:
-  template:
-    metadata:
-      annotations:
-        app.stackrox.io/config-hash: ${CONFIG_HASH}
----
-apiVersion: apps/v1
-kind: Deployment
 metadata:
   name: scanner-v4-indexer
 spec:
diff --git a/operator/tests/common/image-pull-secrets.yaml b/operator/tests/common/image-pull-secrets.yaml
index 0a0a21fd5ebf4..98145fd926f3b 100644
--- a/operator/tests/common/image-pull-secrets.yaml
+++ b/operator/tests/common/image-pull-secrets.yaml
@@ -6,7 +6,7 @@ commands:
     set -eu # shell in CI does not grok -o pipefail
     secret=$(mktemp)
     registry_hostname=quay.io
-    ../../../../deploy/common/pull-secret.sh e2e-test-pull-secret ${registry_hostname} > $secret
+    ../../../../scripts/pull-secret.sh e2e-test-pull-secret ${registry_hostname} > $secret
     retry-kubectl.sh -n $NAMESPACE apply -f $secret
     echo "Created pull secret for ${registry_hostname} in $NAMESPACE"
     rm $secret
diff --git a/operator/tests/common/pods-debug.yaml b/operator/tests/common/pods-debug.yaml
index 4b46ab2bf5ca0..bb60dc117b504 100644
--- a/operator/tests/common/pods-debug.yaml
+++ b/operator/tests/common/pods-debug.yaml
@@ -10,12 +10,6 @@ collectors:
 - type: pod
   selector: app=config-controller
   tail: -1
-- type: pod
-  selector: app=scanner
-  tail: -1
-- type: pod
-  selector: app=scanner-db
-  tail: -1
 - type: pod
   selector: app=scanner-v4-indexer
   tail: -1
@@ -28,8 +22,6 @@ collectors:
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=central
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=central-db
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=config-controller
-- command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner
-- command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-db
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-v4-indexer
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-v4-matcher
 - command: retry-kubectl.sh describe pod -n $NAMESPACE -l app=scanner-v4-db
diff --git a/operator/tests/common/secured-cluster-cr-assert-no-scanner-v4.yaml b/operator/tests/common/secured-cluster-cr-assert-no-scanner-v4.yaml
index e020ddbb0827a..4a25bd5a43139 100644
--- a/operator/tests/common/secured-cluster-cr-assert-no-scanner-v4.yaml
+++ b/operator/tests/common/secured-cluster-cr-assert-no-scanner-v4.yaml
@@ -52,13 +52,6 @@ metadata:
 status:
   availableReplicas: 3
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: scanner
-status:
-  availableReplicas: 1
----
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/operator/tests/common/secured-cluster-cr-assert.yaml b/operator/tests/common/secured-cluster-cr-assert.yaml
index 57d121a0e0e1b..8c9998ac28c85 100644
--- a/operator/tests/common/secured-cluster-cr-assert.yaml
+++ b/operator/tests/common/secured-cluster-cr-assert.yaml
@@ -61,13 +61,6 @@ status:
 ---
 apiVersion: apps/v1
 kind: Deployment
-metadata:
-  name: scanner
-status:
-  availableReplicas: 1
----
-apiVersion: apps/v1
-kind: Deployment
 metadata:
   name: scanner-v4-db
 status:
diff --git a/operator/tests/reconcile/reconcile_suite_test.go b/operator/tests/reconcile/reconcile_suite_test.go
index e95a6d6d01c1a..c85f88b4764f8 100644
--- a/operator/tests/reconcile/reconcile_suite_test.go
+++ b/operator/tests/reconcile/reconcile_suite_test.go
@@ -7,6 +7,8 @@ import (
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	versionTestutils "github.com/stackrox/rox/pkg/version/testutils"
+	"go.uber.org/zap/zapcore"
 	apiextv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -24,14 +26,16 @@ var (
 )
 
 func TestReconcileExtensions(t *testing.T) {
+	versionTestutils.SetExampleVersion(t)
 	RegisterFailHandler(Fail)
 	RunSpecs(t, "Reconcile Extensions Suite")
 }
 
 var _ = BeforeSuite(func() {
-	logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true)))
+	logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true), zap.Level(zapcore.InfoLevel)))
 	testEnv = &envtest.Environment{
 		AttachControlPlaneOutput: false, // set to true to see kube-apiserver and etcd logs
+		CRDDirectoryPaths:        []string{"../../config/crd/bases"},
 	}
 
 	var err error
diff --git a/operator/tests/reconcile/rollback_test.go b/operator/tests/reconcile/rollback_test.go
new file mode 100644
index 0000000000000..71ff26e0b9f7f
--- /dev/null
+++ b/operator/tests/reconcile/rollback_test.go
@@ -0,0 +1,244 @@
+package reconcile
+
+import (
+	"context"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	helmClient "github.com/operator-framework/helm-operator-plugins/pkg/client"
+	"helm.sh/helm/v3/pkg/release"
+	corev1 "k8s.io/api/core/v1"
+	apiErrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/metrics/server"
+
+	"github.com/stackrox/rox/image"
+	platform "github.com/stackrox/rox/operator/api/v1alpha1"
+	centralTranslation "github.com/stackrox/rox/operator/internal/central/values/translation"
+	stackroxReconciler "github.com/stackrox/rox/operator/internal/reconciler"
+	"github.com/stackrox/rox/pkg/uuid"
+)
+
+var _ = Describe("Upgrade failure with rollbacks disabled", func() {
+	const (
+		centralName = "test-central"
+	)
+
+	var (
+		namespace             = "upgrade-failure-test-" + uuid.NewV4().String()[0:6]
+		namespacedCentralName = types.NamespacedName{Namespace: namespace, Name: centralName}
+
+		mgr    manager.Manager
+		ctx    context.Context
+		cancel context.CancelFunc
+	)
+
+	BeforeEach(func() {
+		s := runtime.NewScheme()
+		Expect(clientgoscheme.AddToScheme(s)).To(Succeed())
+		Expect(platform.AddToScheme(s)).To(Succeed())
+
+		var err error
+		mgr, err = manager.New(cfg, manager.Options{
+			Scheme:  s,
+			Metrics: server.Options{BindAddress: "0"},
+		})
+		Expect(err).NotTo(HaveOccurred())
+
+		translator := centralTranslation.New(mgr.GetClient())
+		Expect(stackroxReconciler.SetupReconcilerWithManager(
+			mgr, platform.CentralGVK, image.CentralServicesChartPrefix,
+			translator, nil,
+		)).To(Succeed())
+
+		ctx, cancel = context.WithCancel(context.Background())
+		go func() {
+			defer GinkgoRecover()
+			Expect(mgr.Start(ctx)).To(Succeed())
+		}()
+
+		ns := corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: namespace}}
+		Expect(mgr.GetClient().Create(ctx, &ns)).To(Succeed())
+	})
+
+	AfterEach(func() {
+		By("ensuring Central CR and test namespace is deleted")
+		ns := corev1.Namespace{}
+		if err := mgr.GetAPIReader().Get(ctx, types.NamespacedName{Name: namespace}, &ns); err == nil {
+			central := &platform.Central{}
+			if err := mgr.GetAPIReader().Get(ctx, namespacedCentralName, central); err == nil {
+				By("deleting finalizers")
+				central.SetFinalizers([]string{})
+				Expect(mgr.GetClient().Update(ctx, central)).To(Succeed())
+				By("marking CR for deletion")
+				Expect(mgr.GetClient().Delete(ctx, central)).To(Succeed())
+				By("ensuring CR is gone")
+				central := platform.Central{}
+				Eventually(func(g Gomega) {
+					g.Expect(mgr.GetAPIReader().Get(ctx, namespacedCentralName, &central)).
+						To(MatchError(apiErrors.IsNotFound, "IsNotFound"))
+				}, 10*time.Second, 1*time.Second).To(Succeed())
+			}
+			By("cleaning up test namespace")
+			Expect(mgr.GetClient().Delete(ctx, &ns)).To(Succeed())
+		}
+
+		cancel() // Stops manager.
+	})
+
+	It("should not attempt rollback after a failed upgrade, preserving PVCs", func() {
+		pvcName := types.NamespacedName{Namespace: namespace, Name: "scanner-v4-db"}
+		var pvcUid types.UID
+		central := &platform.Central{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      centralName,
+				Namespace: namespace,
+			},
+			Spec: platform.CentralSpec{
+				ScannerV4: &platform.ScannerV4Spec{
+					ScannerComponent: new(platform.ScannerV4ComponentEnabled),
+				},
+			},
+		}
+
+		By("creating a Central CR with Scanner V4 enabled")
+		createCentral(mgr, ctx, central)
+
+		By("waiting for initial install to complete")
+		waitForInstall(mgr, ctx, namespacedCentralName)
+
+		By("simulating PVC binding by setting spec.volumeName")
+		simulatePVCBinding(mgr, ctx, pvcName, &pvcUid)
+
+		By("applying an invalid overlay to trigger upgrade failure")
+		applyInvalidOverlay(mgr, ctx, namespacedCentralName)
+
+		By("waiting for upgrade failure without rollback attempt")
+		waitForUpgradeFailure(mgr, ctx, namespacedCentralName)
+
+		By("verifying no rollback revision in Helm release history")
+		verifyNoRollbackRevision(mgr, ctx, central, centralName)
+
+		By("repairing the custom resource, which failed reconciliation")
+		repairCR(mgr, ctx, central, namespacedCentralName)
+
+		By("waiting for reconciliation to succeed again")
+		waitForRecovery(mgr, ctx, namespacedCentralName)
+
+		By("verifying PVC is still intact")
+		verifyPVCIntact(mgr, ctx, pvcName, pvcUid)
+	})
+})
+
+func createCentral(mgr manager.Manager, ctx context.Context, central *platform.Central) {
+	Expect(mgr.GetClient().Create(ctx, central)).To(Succeed())
+}
+
+func waitForInstall(mgr manager.Manager, ctx context.Context, key types.NamespacedName) {
+	Eventually(func(g Gomega) {
+		c := &platform.Central{}
+		g.Expect(mgr.GetAPIReader().Get(ctx, key, c)).To(Succeed())
+		g.Expect(c.GetCondition(platform.ConditionDeployed)).To(
+			SatisfyAll(Not(BeNil()), HaveField("Status", Equal(platform.StatusTrue))),
+			"Deployed condition should be True after successful install")
+	}, 30*time.Second, 2*time.Second).Should(Succeed())
+}
+
+func simulatePVCBinding(mgr manager.Manager, ctx context.Context, pvcName types.NamespacedName, pvcUid *types.UID) {
+	Eventually(func(g Gomega) {
+		pvc := &corev1.PersistentVolumeClaim{}
+		g.Expect(mgr.GetAPIReader().Get(ctx, pvcName, pvc)).To(Succeed())
+		pvc.Spec.VolumeName = "fake-pv"
+		g.Expect(mgr.GetClient().Update(ctx, pvc)).To(Succeed())
+		*pvcUid = pvc.GetUID()
+	}, 10*time.Second, 1*time.Second).Should(Succeed())
+}
+
+func applyInvalidOverlay(mgr manager.Manager, ctx context.Context, key types.NamespacedName) {
+	Eventually(func(g Gomega) {
+		c := &platform.Central{}
+		g.Expect(mgr.GetAPIReader().Get(ctx, key, c)).To(Succeed())
+		c.Spec.Overlays = []*platform.K8sObjectOverlay{
+			{
+				APIVersion: "v1",
+				Kind:       "ConfigMap",
+				Name:       "scanner-v4-matcher-config",
+				Patches: []*platform.K8sObjectOverlayPatch{
+					{
+						Path:  `data.config\.yaml`,
+						Value: "matcher:\n  vulnerabilities_url: \"https://bad\"", // This will be unmarshalled as a map.
+					},
+				},
+			},
+		}
+		g.Expect(mgr.GetClient().Update(ctx, c)).To(Succeed())
+	}, 30*time.Second, 1*time.Second).Should(Succeed())
+}
+
+func waitForUpgradeFailure(mgr manager.Manager, ctx context.Context, key types.NamespacedName) {
+	Eventually(func(g Gomega) {
+		c := &platform.Central{}
+		g.Expect(mgr.GetAPIReader().Get(ctx, key, c)).To(Succeed())
+
+		releaseFailed := c.GetCondition(platform.ConditionReleaseFailed)
+		irreconcilable := c.GetCondition(platform.ConditionIrreconcilable)
+
+		g.Expect(releaseFailed).To(SatisfyAll(Not(BeNil()), HaveField("Status", Equal(platform.StatusTrue))),
+			"ReleaseFailed condition should be True")
+		g.Expect(irreconcilable).To(SatisfyAll(Not(BeNil()), HaveField("Status", Equal(platform.StatusTrue))),
+			"Irreconcilable condition should be True")
+	}, 30*time.Second, 1*time.Second).Should(Succeed())
+}
+
+func verifyNoRollbackRevision(mgr manager.Manager, ctx context.Context, central *platform.Central, releaseName string) {
+	actionConfigGetter, err := helmClient.NewActionConfigGetter(mgr.GetConfig(), mgr.GetRESTMapper())
+	Expect(err).NotTo(HaveOccurred())
+	acfg, err := actionConfigGetter.ActionConfigFor(ctx, central)
+	Expect(err).NotTo(HaveOccurred())
+	history, err := acfg.Releases.History(releaseName)
+	Expect(err).NotTo(HaveOccurred())
+	for _, rel := range history {
+		Expect(rel.Info.Status).NotTo(Equal(release.StatusPendingRollback),
+			"release v%d should not have pending-rollback status", rel.Version)
+		Expect(rel.Info.Description).NotTo(MatchRegexp(`(?i)rollback`),
+			"release v%d description %q suggests a rollback was attempted", rel.Version, rel.Info.Description)
+	}
+}
+
+func repairCR(mgr manager.Manager, ctx context.Context, central *platform.Central, key types.NamespacedName) {
+	Eventually(func(g Gomega) {
+		g.Expect(mgr.GetAPIReader().Get(ctx, key, central)).To(Succeed())
+		central.Spec.Overlays = []*platform.K8sObjectOverlay{}
+		g.Expect(mgr.GetClient().Update(ctx, central)).To(Succeed())
+	}, 10*time.Second, 1*time.Second).Should(Succeed())
+}
+
+func waitForRecovery(mgr manager.Manager, ctx context.Context, key types.NamespacedName) {
+	Eventually(func(g Gomega) {
+		c := &platform.Central{}
+		g.Expect(mgr.GetAPIReader().Get(ctx, key, c)).To(Succeed())
+
+		releaseFailed := c.GetCondition(platform.ConditionReleaseFailed)
+		irreconcilable := c.GetCondition(platform.ConditionIrreconcilable)
+
+		g.Expect(c.GetCondition(platform.ConditionDeployed)).To(
+			SatisfyAll(Not(BeNil()), HaveField("Status", Equal(platform.StatusTrue))),
+			"Deployed condition should be True again")
+		g.Expect(releaseFailed).To(SatisfyAny(BeNil(), HaveField("Status", Equal(platform.StatusFalse))),
+			"ReleaseFailed condition should be nil or False")
+		g.Expect(irreconcilable).To(SatisfyAny(BeNil(), HaveField("Status", Equal(platform.StatusFalse))),
+			"Irreconcilable condition should be nil or False")
+	}, 2*time.Minute, 2*time.Second).Should(Succeed())
+}
+
+func verifyPVCIntact(mgr manager.Manager, ctx context.Context, pvcName types.NamespacedName, pvcUid types.UID) {
+	pvc := &corev1.PersistentVolumeClaim{}
+	Expect(mgr.GetAPIReader().Get(ctx, pvcName, pvc)).To(Succeed())
+	Expect(pvc.Spec.VolumeName).To(Equal("fake-pv"))
+	Expect(pvc.GetUID()).To(Equal(pvcUid))
+}
diff --git a/operator/tests/run.sh b/operator/tests/run.sh
index 7aa223b5d6ce6..2f87498cc12a9 100755
--- a/operator/tests/run.sh
+++ b/operator/tests/run.sh
@@ -39,12 +39,12 @@ _EO_KUTTL_HELP_
                    "${kuttl_help}" \
                    "make" "-C" "operator" "deploy-previous-via-olm" TEST_NAMESPACE="rhacs-operator-system"
    else
-        # TODO(ROX-33128): change to use helm after release 4.11
         junit_wrap deploy-previous-operator \
-                   "Deploy version 4.10 of the operator using install manifest." \
+                   "Deploy previous version of the operator using helm chart." \
                    "${kuttl_help}" \
-                   ./operator/hack/install-4.10.sh
-        info "Preparing operator helm chart"
+                   "env" "ROX_PRODUCT_BRANDING=RHACS_BRANDING" \
+                   "make" "-C" "operator" "deploy-previous-via-chart" TEST_NAMESPACE="rhacs-operator-system"
+        info "Preparing current operator helm chart"
         junit_wrap prepare-operator-helm-chart \
                    "Prepare operator helm chart." \
                    "${kuttl_help}" \
diff --git a/operator/tests/securedcluster/sc-basic/012-assert-image-pull-secret-refs.yaml b/operator/tests/securedcluster/sc-basic/012-assert-image-pull-secret-refs.yaml
index f934aa3c284ed..27f0c82281980 100644
--- a/operator/tests/securedcluster/sc-basic/012-assert-image-pull-secret-refs.yaml
+++ b/operator/tests/securedcluster/sc-basic/012-assert-image-pull-secret-refs.yaml
@@ -24,13 +24,6 @@ imagePullSecrets:
 ---
 apiVersion: v1
 kind: ServiceAccount
-metadata:
-  name: scanner
-imagePullSecrets:
-- name: "e2e-test-pull-secret"
----
-apiVersion: v1
-kind: ServiceAccount
 metadata:
   name: admission-control
 imagePullSecrets:
diff --git a/operator/tests/securedcluster/sc-basic/013-assert-image-pull-secret-refs.yaml b/operator/tests/securedcluster/sc-basic/013-assert-image-pull-secret-refs.yaml
index 72ede52e9ad34..41316a8b579d5 100644
--- a/operator/tests/securedcluster/sc-basic/013-assert-image-pull-secret-refs.yaml
+++ b/operator/tests/securedcluster/sc-basic/013-assert-image-pull-secret-refs.yaml
@@ -26,14 +26,6 @@ imagePullSecrets:
 ---
 apiVersion: v1
 kind: ServiceAccount
-metadata:
-  name: scanner
-imagePullSecrets:
-- name: "e2e-test-pull-secret"
-- name: "stackrox"
----
-apiVersion: v1
-kind: ServiceAccount
 metadata:
   name: admission-control
 imagePullSecrets:
diff --git a/operator/tests/securedcluster/sc-basic/014-assert-image-pull-secret-refs.yaml b/operator/tests/securedcluster/sc-basic/014-assert-image-pull-secret-refs.yaml
index 292ce5bd9df10..af0f3ce0421bf 100644
--- a/operator/tests/securedcluster/sc-basic/014-assert-image-pull-secret-refs.yaml
+++ b/operator/tests/securedcluster/sc-basic/014-assert-image-pull-secret-refs.yaml
@@ -26,14 +26,6 @@ imagePullSecrets:
 ---
 apiVersion: v1
 kind: ServiceAccount
-metadata:
-  name: scanner
-imagePullSecrets:
-- name: "e2e-test-pull-secret"
-- name: "stackrox"
----
-apiVersion: v1
-kind: ServiceAccount
 metadata:
   name: admission-control
 imagePullSecrets:
diff --git a/operator/tests/securedcluster/sc-basic/015-assert-image-pull-secret-refs.yaml b/operator/tests/securedcluster/sc-basic/015-assert-image-pull-secret-refs.yaml
index 1ee283d4d6ce1..c284c155b214e 100644
--- a/operator/tests/securedcluster/sc-basic/015-assert-image-pull-secret-refs.yaml
+++ b/operator/tests/securedcluster/sc-basic/015-assert-image-pull-secret-refs.yaml
@@ -28,15 +28,6 @@ imagePullSecrets:
 ---
 apiVersion: v1
 kind: ServiceAccount
-metadata:
-  name: scanner
-imagePullSecrets:
-- name: "e2e-test-pull-secret"
-- name: "stackrox"
-- name: "stackrox-scanner"
----
-apiVersion: v1
-kind: ServiceAccount
 metadata:
   name: admission-control
 imagePullSecrets:
diff --git a/operator/tests/securedcluster/sc-basic/910-assert-openshift.yaml b/operator/tests/securedcluster/sc-basic/910-assert-openshift.yaml
index 5e0d4033c8475..bd55d6a624b09 100644
--- a/operator/tests/securedcluster/sc-basic/910-assert-openshift.yaml
+++ b/operator/tests/securedcluster/sc-basic/910-assert-openshift.yaml
@@ -5,13 +5,15 @@ testRunSelector:
   matchLabels:
     openshift: "true"
 ---
-# The central CR and its operands are gone in previous step.
-# However, the SecuredCluster reconciler should notice Central disappearing and
-# create a local scanner now that the central scanner is gone.
+# The central CR and its operands are gone in the previous step.
+# However, the SecuredCluster reconciler should notice Central disappearing and keep a
+# local Scanner V4 indexer for delegated scanning now that the central scanner is gone.
+# (The indexer is the Scanner V4 component that runs on the secured-cluster side; the
+# matcher is Central-only.)
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: scanner
-# We do not assert anything about the status, since - with Central gone - scanner
-# might not be able to become healthy. Even if it does, we are only interested
-# in testing that the SecuredCluster reconciler was triggered correctly here.
+  name: scanner-v4-indexer
+# We do not assert anything about the status, since - with Central gone - the indexer
+# might not be able to become healthy. Even if it does, we are only interested in testing
+# that the SecuredCluster reconciler was triggered correctly here.
diff --git a/operator/tests/securedcluster/sc-basic/910-errors-non-openshift.yaml b/operator/tests/securedcluster/sc-basic/910-errors-non-openshift.yaml
index bbcb364783614..349460e86c88b 100644
--- a/operator/tests/securedcluster/sc-basic/910-errors-non-openshift.yaml
+++ b/operator/tests/securedcluster/sc-basic/910-errors-non-openshift.yaml
@@ -5,11 +5,14 @@ testRunSelector:
   matchLabels:
     openshift: "false"
 ---
-# The central CR and its operands are gone in previous step.
-# On platforms where local scanner is not supported (i.e. on non-OpenShift ones)
-# the reconciler should NOT create a local scanner now that the central scanner is gone.
-# So we have this errors file to make sure it is gone and not re-created.
+# The central CR and its operands are gone in the previous step.
+# On platforms where local (delegated) scanning is not supported (i.e. non-OpenShift ones)
+# the reconciler should NOT create a local Scanner V4 indexer now that the central scanner
+# is gone. So we have this errors file to make sure it is gone and not re-created.
+#
+# TODO(ROX-36705): Need to re-evaluate this, given that delegated scanning is not restricted
+# to OpenShift.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: scanner
+  name: scanner-v4-indexer
diff --git a/operator/tests/securedcluster/sc-basic/910-errors.yaml b/operator/tests/securedcluster/sc-basic/910-errors.yaml
new file mode 100644
index 0000000000000..26c908add1fe7
--- /dev/null
+++ b/operator/tests/securedcluster/sc-basic/910-errors.yaml
@@ -0,0 +1,18 @@
+# The central CR and its operands are gone in the previous step.
+# Scanner V2 - including the secured-cluster "local scanner" that the reconciler used to
+# create on OpenShift once the central scanner was gone - has been removed, so the
+# SecuredCluster reconciler must NOT create a "scanner" deployment on any platform.
+# The Scanner V4 matcher only ever runs on the Central side (the indexer is the
+# delegated-scanning component on the secured-cluster side, checked by the
+# 910-assert-openshift / 910-errors-non-openshift files), so it must not appear on the
+# secured-cluster side either.
+# This errors file makes sure neither is present or re-created, on any platform.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: scanner
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: scanner-v4-matcher
diff --git a/operator/tests/upgrade/upgrade/010-assert-central-cr-with-pre-4-9-admission-controller-config.yaml b/operator/tests/upgrade/upgrade/010-assert-central-cr-with-pre-4-9-admission-controller-config.yaml
index 3d8dcd5f73bb9..86775486af31c 100644
--- a/operator/tests/upgrade/upgrade/010-assert-central-cr-with-pre-4-9-admission-controller-config.yaml
+++ b/operator/tests/upgrade/upgrade/010-assert-central-cr-with-pre-4-9-admission-controller-config.yaml
@@ -42,6 +42,11 @@ metadata:
 status:
   availableReplicas: 3
 ---
+# Scanner V2 (the "scanner" deployment) is still expected here because this step runs against
+# the *previous released* operator, before the upgrade in step 020. The current operator no
+# longer deploys Scanner V2.
+# TODO(ROX-36705): Remove this Scanner V2 deployment assertion once the oldest supported
+# upgrade-from operator version (see hack/upgrade-autoselect.sh) no longer deploys Scanner V2.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/operator/tests/upgrade/upgrade/033-errors.yaml b/operator/tests/upgrade/upgrade/033-errors.yaml
new file mode 100644
index 0000000000000..abf0dc24af83f
--- /dev/null
+++ b/operator/tests/upgrade/upgrade/033-errors.yaml
@@ -0,0 +1,21 @@
+# After upgrading to an operator that no longer ships Scanner V2, the leftover Scanner V2
+# operands from the pre-upgrade installation must be cleaned up. Verify that the scanner and
+# scanner-db Deployments and the scanner-db-password Secret are gone.
+#
+# Note: scanner-tls / scanner-db-tls are intentionally NOT checked here. Those secrets are
+# extension-managed and only removed when the Central CR is deleted (see reconcile_tls.go and
+# the delete-central-errors step), not during an upgrade.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: scanner
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: scanner-db
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: scanner-db-password
diff --git a/operator/tools/controller-gen/go.mod b/operator/tools/controller-gen/go.mod
index 5acc2fc959bab..1896df6710f05 100644
--- a/operator/tools/controller-gen/go.mod
+++ b/operator/tools/controller-gen/go.mod
@@ -2,31 +2,31 @@ module github.com/stackrox/rox/operator/tools/controller-gen
 
 go 1.26.3
 
-require sigs.k8s.io/controller-tools v0.21.0
+require sigs.k8s.io/controller-tools v0.22.0
 
 require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-openapi/jsonpointer v0.23.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.5 // indirect
-	github.com/go-openapi/swag v0.26.0 // indirect
-	github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
-	github.com/go-openapi/swag/conv v0.26.0 // indirect
-	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
-	github.com/go-openapi/swag/loading v0.26.0 // indirect
-	github.com/go-openapi/swag/mangling v0.26.0 // indirect
-	github.com/go-openapi/swag/netutils v0.26.0 // indirect
-	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
-	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
-	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -35,27 +35,25 @@ require (
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/mod v0.39.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.36.0 // indirect
-	k8s.io/apiextensions-apiserver v0.36.0 // indirect
-	k8s.io/apimachinery v0.36.0 // indirect
-	k8s.io/code-generator v0.36.0 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b // indirect
+	k8s.io/api v0.37.0 // indirect
+	k8s.io/apiextensions-apiserver v0.37.0 // indirect
+	k8s.io/apimachinery v0.37.0 // indirect
+	k8s.io/code-generator v0.37.0 // indirect
+	k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 // indirect
-	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/operator/tools/controller-gen/go.sum b/operator/tools/controller-gen/go.sum
index 88ed54599b220..74c70924ce78c 100644
--- a/operator/tools/controller-gen/go.sum
+++ b/operator/tools/controller-gen/go.sum
@@ -1,7 +1,9 @@
 cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
-github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
-github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -11,7 +13,6 @@ github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F9
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -20,69 +21,67 @@ github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fsnotify/fsnotify v1.10.0 h1:Xx/5Ydg9CeBDX/wi4VJqStNtohYjitZhhlHt4h3St1M=
-github.com/fsnotify/fsnotify v1.10.0/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
 github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
-github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
-github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=
-github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
-github.com/go-openapi/swag v0.26.0 h1:GVDXCmfvhfu1BxiHo8/FA+BbKmhecHnG3varjON5/RI=
-github.com/go-openapi/swag v0.26.0/go.mod h1:82g3193sZJRbocs7bNCqGfIgq8pkuwVwCfhKIRlEQF0=
-github.com/go-openapi/swag/cmdutils v0.26.0 h1:iowihOcvq7y4egO8cOq0dmfohz6wfeQ63U1EnuhO2TU=
-github.com/go-openapi/swag/cmdutils v0.26.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
-github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I=
-github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE=
-github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU=
-github.com/go-openapi/swag/fileutils v0.26.0/go.mod h1:0WDJ7lp67eNjPMO50wAWYlKvhOb6CQ37rzR7wrgI8Tc=
-github.com/go-openapi/swag/jsonname v0.26.0 h1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w=
-github.com/go-openapi/swag/jsonname v0.26.0/go.mod h1:urBBR8bZNoDYGr653ynhIx+gTeIz0ARZxHkAPktJK2M=
-github.com/go-openapi/swag/jsonutils v0.26.0 h1:FawFML2iAXsPqmERscuMPIHmFsoP1tOqWkxBaKNMsnA=
-github.com/go-openapi/swag/jsonutils v0.26.0/go.mod h1:2VmA0CJlyFqgawOaPI9psnjFDqzyivIqLYN34t9p91E=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0 h1:apqeINu/ICHouqiRZbyFvuDge5jCmmLTqGQ9V95EaOM=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0/go.mod h1:AyM6QT8uz5IdKxk5akv0y6u4QvcL9GWERt0Jx/F/R8Y=
-github.com/go-openapi/swag/loading v0.26.0 h1:Apg6zaKhCJurpJer0DCxq99qwmhFddBhaMX7kilDcko=
-github.com/go-openapi/swag/loading v0.26.0/go.mod h1:dBxQ/6V2uBaAQdevN18VELE6xSpJWZxLX4txe12JwDg=
-github.com/go-openapi/swag/mangling v0.26.0 h1:Du2YC4YLA/Y5m/YKQd7AnY5qq0wRKSFZTTt8ktFaXcQ=
-github.com/go-openapi/swag/mangling v0.26.0/go.mod h1:jifS7W9vbg+pw63bT+GI53otluMQL3CeemuyCHKwVx0=
-github.com/go-openapi/swag/netutils v0.26.0 h1:CmZp+ZT7HrmFwrC3GdGsXBq2+42T1bjKBapcqVpIs3c=
-github.com/go-openapi/swag/netutils v0.26.0/go.mod h1:5iK+Ok3ZohWWex1C50BFTPexi03UaPwjW4Oj8kgrpwo=
-github.com/go-openapi/swag/stringutils v0.26.0 h1:qZQngLxs5s7SLijc3N2ZO+fUq2o8LjuWAASSrJuh+xg=
-github.com/go-openapi/swag/stringutils v0.26.0/go.mod h1:sWn5uY+QIIspwPhvgnqJsH8xqFT2ZbYcvbcFanRyhFE=
-github.com/go-openapi/swag/typeutils v0.26.0 h1:2kdEwdiNWy+JJdOvu5MA2IIg2SylWAFuuyQIKYybfq4=
-github.com/go-openapi/swag/typeutils v0.26.0/go.mod h1:oovDuIUvTrEHVMqWilQzKzV4YlSKgyZmFh7AlfABNVE=
-github.com/go-openapi/swag/yamlutils v0.26.0 h1:H7O8l/8NJJQ/oiReEN+oMpnGMyt8G0hl460nRZxhLMQ=
-github.com/go-openapi/swag/yamlutils v0.26.0/go.mod h1:1evKEGAtP37Pkwcc7EWMF0hedX0/x3Rkvei2wtG/TbU=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 h1:5zRca5jw7lzVREKCZVNBpysDNBjj74rBh0N2BGQbSR0=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2/go.mod h1:XVevPw5hUXuV+5AkI1u1PeAm27EQVrhXTTCPAF85LmE=
-github.com/go-openapi/testify/v2 v2.4.2 h1:tiByHpvE9uHrrKjOszax7ZvKB7QOgizBWGBLuq0ePx4=
-github.com/go-openapi/testify/v2 v2.4.2/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
 github.com/gobuffalo/flect v1.0.3/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
-github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
-github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
+github.com/google/cel-go v0.29.2 h1:ZtDxkeiMmz0mxbKDYiNkE5Lk7V5edMRcaaDf2jX002k=
+github.com/google/cel-go v0.29.2/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -95,33 +94,27 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/gomega v1.40.0 h1:Vtol0e1MghCD2ZVIilPDIg44XSL9l2QAn8ZNaljWcJc=
-github.com/onsi/gomega v1.40.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.43.0 h1:VlG/1FxqNxhSO+lq/OHBNaaqwiBK/mO8JbVkX9Y+FeU=
+github.com/onsi/gomega v1.43.0/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
+github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
+github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
-github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -135,102 +128,97 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c=
-go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 h1:QKdN8ly8zEMrByybbQgv8cWBcdAarwmIPZ6FThrWXJs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0/go.mod h1:bTdK1nhqF76qiPoCCdyFIV+N/sRHYXYCTQc+3VCi3MI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 h1:DvJDOPmSWQHWywQS6lKL+pb8s3gBLOZUtw4N+mavW1I=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0/go.mod h1:EtekO9DEJb4/jRyN4v4Qjc2yA7AtfCBuz2FynRUWTXs=
-go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ=
-go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps=
-go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
-go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
-go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0=
-go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis=
-go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
-go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
-golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.36.0 h1:SgqDhZzHdOtMk40xVSvCXkP9ME0H05hPM3p9AB1kL80=
-k8s.io/api v0.36.0/go.mod h1:m1LVrGPNYax5NBHdO+QuAedXyuzTt4RryI/qnmNvs34=
-k8s.io/apiextensions-apiserver v0.36.0 h1:Wt7E8J+VBCbj4FjiBfDTK/neXDDjyJVJc7xfuOHImZ0=
-k8s.io/apiextensions-apiserver v0.36.0/go.mod h1:kGDjH0msuiIB3tgsYRV0kS9GqpMYMUsQ3GHv7TApyug=
-k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
-k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
-k8s.io/apiserver v0.36.0 h1:Jg5OFAENUACByUCg15CmhZAYrr5ZyJ+jodyA1mHl3YE=
-k8s.io/apiserver v0.36.0/go.mod h1:mHvwdHf+qKEm+1/hYm756SV+oREOKSPnsjagOpx6Vho=
-k8s.io/client-go v0.36.0 h1:pOYi7C4RHChYjMiHpZSpSbIM6ZxVbRXBy7CuiIwqA3c=
-k8s.io/client-go v0.36.0/go.mod h1:ZKKcpwF0aLYfkHFCjillCKaTK/yBkEDHTDXCFY6AS9Y=
-k8s.io/code-generator v0.36.0 h1:XWAkrhnArm0VWMmSFO7kyB+wE2LROwep7hEH0GPGkqA=
-k8s.io/code-generator v0.36.0/go.mod h1:Tr2UhfBRdlyRoadfob9aPCmmGe8PUs5XPK9MEJ2nx+w=
-k8s.io/component-base v0.36.0 h1:hFjEktssxiJhrK1zfybkH4kJOi8iZuF+mIDCqS5+jRo=
-k8s.io/component-base v0.36.0/go.mod h1:JZvIfcNHk+uck+8LhJzhSBtydWXaZNQwX2OdL+Mnwsk=
-k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b h1:gMplByicHV/TJBizHd9aVEsTYoJBnnUAT5MHlTkbjhQ=
-k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b/go.mod h1:CgujABENc3KuTrcsdpGmrrASjtQsWCT7R99mEV4U/fM=
+k8s.io/api v0.37.0 h1:Z//Vj9N7RA/yS2sDmxyeo7h+RR4zbUrd2vrd3Z0TbB4=
+k8s.io/api v0.37.0/go.mod h1:LKXgcJWMc+f4OLbP5SFR8rulEg07zZhpi/zMULiBImk=
+k8s.io/apiextensions-apiserver v0.37.0 h1:zRMQ3+/LIE5oZ0tVvXwYHC+dIkSP5cjNWju7AZU1LOI=
+k8s.io/apiextensions-apiserver v0.37.0/go.mod h1:HU0PfSBwchHL5iDau6jjt9zU6ryWkDDlaVUiq91NK80=
+k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0=
+k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE=
+k8s.io/apiserver v0.37.0 h1:TXg7OxsOWrAH8J4Zi/gBAZuMw1Dfdd+6cca2h4qjRqo=
+k8s.io/apiserver v0.37.0/go.mod h1:OddHDF4gy9qyIb8o/3+qaeP6S0vEObWLgOygVqXksv0=
+k8s.io/client-go v0.37.0 h1:nsN31fy8wBySuZ+QRnKmrjRSQLOG2rvoGN0tKd12zhQ=
+k8s.io/client-go v0.37.0/go.mod h1:FcGqw+Ll/gNQiq+nPGY1Oyt9y7SgDh1d3MW3RFDEbn0=
+k8s.io/code-generator v0.37.0 h1:AC915wukzlVHHODAQYxvQ25WKibPh95faJ2kxf8dzuo=
+k8s.io/code-generator v0.37.0/go.mod h1:qg7E/uDlyvevVRL1V8+h2z9UWmi/8gxaRka/lVXUBdk=
+k8s.io/component-base v0.37.0 h1:3SdSa4+itMdFTDFTeR8CxKGmSTSMXFlKL4ky8OqjguM=
+k8s.io/component-base v0.37.0/go.mod h1:LjOebp4R9y6LODWZQv102ZQxGheLcDO2ZJLAw6bbh4I=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 h1:3L6PNkMLXkU/pz3jWzaaIUz0Rs2V9h+5O51AeRC7poc=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3/go.mod h1:yvyl3l9E+UxlqOMUULdKTAYB0rEhsmjr7+2Vb/1pCSo=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 h1:sWu4Td5mgJlwunsUydnhKEAfNUHM7hm1wfKEQmD7G5c=
-k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 h1:hSfpvjjTQXQY2Fol2CS0QHMNs/WI1MOSGzCm1KhM5ec=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-tools v0.21.0 h1:KXDQza3bgjlPY6xLR63tI/40gzjhyUAvkCrwzd2/6cs=
-sigs.k8s.io/controller-tools v0.21.0/go.mod h1:DLIypi3Q2+azVAP8jr/mHXJgveYYHFjhnNOUuBJ10JE=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 h1:/YpDJ4vReG7ZmzSpBGxduXgywWkJU9zHubgJG03MT+Y=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0/go.mod h1:tJo1aepTXyR+8Xs3sUsGBDk4Ub2AM5dPAPKJx0mpm5c=
+sigs.k8s.io/controller-tools v0.22.0 h1:eG3FAVja/KnlXKIWg95udIFz1cMyAtMjP11cqBh3t+k=
+sigs.k8s.io/controller-tools v0.22.0/go.mod h1:VizwUStoZK7rReCj704czGGrB7mLxXTiJSJt7wN5ilI=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/operator/tools/crdify/config.yaml b/operator/tools/crdify/config.yaml
index dc75d2e5504c9..e0fae3db71b86 100644
--- a/operator/tools/crdify/config.yaml
+++ b/operator/tools/crdify/config.yaml
@@ -1,4 +1,7 @@
+# Please order alphabetically by name
 validations:
+  - name: description
+    enforcement: Warn
   - name: enum
     enforcement: Error
     configuration:
diff --git a/operator/tools/envtest/go.mod b/operator/tools/envtest/go.mod
index b09764af31e09..61430b14f0fbd 100644
--- a/operator/tools/envtest/go.mod
+++ b/operator/tools/envtest/go.mod
@@ -2,7 +2,7 @@ module github.com/stackrox/rox/operator/tools/envtest
 
 go 1.26.3
 
-require sigs.k8s.io/controller-runtime/tools/setup-envtest v0.24.1
+require sigs.k8s.io/controller-runtime/tools/setup-envtest v0.25.1
 
 require (
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -11,7 +11,7 @@ require (
 	github.com/spf13/pflag v1.0.10 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/operator/tools/envtest/go.sum b/operator/tools/envtest/go.sum
index 2c1eb021c9a07..83ff5ea829f9d 100644
--- a/operator/tools/envtest/go.sum
+++ b/operator/tools/envtest/go.sum
@@ -30,31 +30,29 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
 go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
-k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
-sigs.k8s.io/controller-runtime/tools/setup-envtest v0.24.1 h1:l2AjyGE/PWub6EB165ij4/bpCK0TlY5NlhzIHfmGvmg=
-sigs.k8s.io/controller-runtime/tools/setup-envtest v0.24.1/go.mod h1:wpkYufRHTSw9ABET21/PkEL7kdGnmiZJ6o72t9p/1I8=
+k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0=
+k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE=
+sigs.k8s.io/controller-runtime/tools/setup-envtest v0.25.1 h1:OYp0AfSZ1zr338OwcQC4PsyBuaHjkgHEfPuNFTFqw2Y=
+sigs.k8s.io/controller-runtime/tools/setup-envtest v0.25.1/go.mod h1:q4i4kLTq6J6o29RUAQieHH8LS5knNkpgalnBhvrLp/8=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/operator/tools/kubebuilder/go.mod b/operator/tools/kubebuilder/go.mod
index 0225addfc86f7..adba09128eb2b 100644
--- a/operator/tools/kubebuilder/go.mod
+++ b/operator/tools/kubebuilder/go.mod
@@ -2,7 +2,7 @@ module github.com/stackrox/rox/operator/tools/kubebuilder
 
 go 1.26.3
 
-require sigs.k8s.io/kubebuilder/v4 v4.15.0
+require sigs.k8s.io/kubebuilder/v4 v4.16.0
 
 require (
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
@@ -10,7 +10,6 @@ require (
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/spf13/afero v1.15.0 // indirect
@@ -18,19 +17,19 @@ require (
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/tools v0.46.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/apimachinery v0.36.2 // indirect
+	k8s.io/apimachinery v0.37.0 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260414162039-ec9c827d403f // indirect
-	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/operator/tools/kubebuilder/go.sum b/operator/tools/kubebuilder/go.sum
index 7577d7cafe457..c18e6f79e30c3 100644
--- a/operator/tools/kubebuilder/go.sum
+++ b/operator/tools/kubebuilder/go.sum
@@ -1,7 +1,6 @@
 github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
 github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -27,27 +26,19 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/onsi/ginkgo/v2 v2.30.0 h1:zxM/9XneXFIy64j6/wAmBIX4zRC7Hu6U8XFNZvDnCQc=
-github.com/onsi/ginkgo/v2 v2.30.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
-github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.43.0 h1:VlG/1FxqNxhSO+lq/OHBNaaqwiBK/mO8JbVkX9Y+FeU=
+github.com/onsi/gomega v1.43.0/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
@@ -69,43 +60,42 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
-golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
-golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ=
-k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4=
+k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0=
+k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260414162039-ec9c827d403f h1:4Qiq0YAoQATdgmHALJWz9rJ4fj20pB3xebpB4CFNhYM=
-k8s.io/kube-openapi v0.0.0-20260414162039-ec9c827d403f/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/kubebuilder/v4 v4.15.0 h1:LiTS6XCCmhxS0P7OXwpVqcoywlvbF3yK8G+tZjZF62A=
-sigs.k8s.io/kubebuilder/v4 v4.15.0/go.mod h1:3Q0bwaT7zJg9V1wSqYOCClA29iAYkR9CVe+iqMuBg1w=
+sigs.k8s.io/kubebuilder/v4 v4.16.0 h1:ay3e//yOWy2Jmi3JZnF8esrtCi0+/6jiPXiRtmW0Wu8=
+sigs.k8s.io/kubebuilder/v4 v4.16.0/go.mod h1:ghrV2jGJIxjPVnzALWGVZyfpzIMzpMnN/LcYg7pZuZc=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/operator/tools/kustomize/go.mod b/operator/tools/kustomize/go.mod
index d3f33a6e89ea5..2ab7c7f278b5c 100644
--- a/operator/tools/kustomize/go.mod
+++ b/operator/tools/kustomize/go.mod
@@ -1,36 +1,31 @@
 module github.com/stackrox/rox/operator/tools/kustomize
 
-go 1.26.3
+go 1.27.0
 
-require sigs.k8s.io/kustomize/kustomize/v5 v5.8.1
+require sigs.k8s.io/kustomize/kustomize/v5 v5.8.3
 
 require (
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-errors/errors v1.4.2 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
-	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go.yaml.in/yaml/v3 v3.0.3 // indirect
-	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 // indirect
-	sigs.k8s.io/kustomize/api v0.21.1 // indirect
-	sigs.k8s.io/kustomize/cmd/config v0.21.1 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
-	sigs.k8s.io/yaml v1.5.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 // indirect
+	sigs.k8s.io/kustomize/api v0.21.3 // indirect
+	sigs.k8s.io/kustomize/cmd/config v0.21.3 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.21.3 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/operator/tools/kustomize/go.sum b/operator/tools/kustomize/go.sum
index ce3be4ca9c359..12247c596d1ac 100644
--- a/operator/tools/kustomize/go.sum
+++ b/operator/tools/kustomize/go.sum
@@ -1,83 +1,60 @@
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
-github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
+github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
-go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
 gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
@@ -85,19 +62,19 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 h1:hcha5B1kVACrLujCKLbr8XWMxCxzQx42DY8QKYJrDLg=
-k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7/go.mod h1:GewRfANuJ70iYzvn+i4lezLDAFzvjxZYK1gn1lWcfas=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
-sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
-sigs.k8s.io/kustomize/cmd/config v0.21.1 h1:/gxf3J1rQD9nfuL8fHlrTLeUL+JHWbK44eOnXJDYx0M=
-sigs.k8s.io/kustomize/cmd/config v0.21.1/go.mod h1:7yEFYBJyBJlpZQ50VaRGQRtFMn3Vzn9Fb2wts4TCok4=
-sigs.k8s.io/kustomize/kustomize/v5 v5.8.1 h1:Pgsg5psubpVEy7Nf6S89PARg5VmmWUC1l9dC6Dl4PG0=
-sigs.k8s.io/kustomize/kustomize/v5 v5.8.1/go.mod h1:0vFa5pQ/elNEQMyiAJuGku9rhAMzz7u9+61hRqFKiwY=
-sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
-sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
-sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
-sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=
+k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 h1:Fe0G8t8FaMDn2lpat0IHu3X9lHrVyGzDxhhCwKXKp28=
+k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926/go.mod h1:3e2VxsK2svhjvkNik92kYU1a5kgau5tZeAuEWwoN4q0=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/kustomize/api v0.21.3 h1:DXGrbifGrAd+7AQ75Kx/tVhr+RLMCZFfAYl61HOR3T0=
+sigs.k8s.io/kustomize/api v0.21.3/go.mod h1:JKlHjHXGh54cdoWVdKNqDscFzPb9z+sBk9upy9PBh6k=
+sigs.k8s.io/kustomize/cmd/config v0.21.3 h1:/G7n3/SM3o5IxVxHY3+3/qPBliMtE5UcMAzbabkBuM4=
+sigs.k8s.io/kustomize/cmd/config v0.21.3/go.mod h1:BFUnlKdjh9rfFkgb5HWi6xmhsW6ybqW/JsV6Y1cZmK0=
+sigs.k8s.io/kustomize/kustomize/v5 v5.8.3 h1:SJXKgCEb4Ru+8PrhwQ+ORAASc2rPWBneHjh4fKTXPWY=
+sigs.k8s.io/kustomize/kustomize/v5 v5.8.3/go.mod h1:goZZjpeux35r4u4E3BPtetYBYcj6Vi5xQtpABCPF9Nk=
+sigs.k8s.io/kustomize/kyaml v0.21.3 h1:4ygzLsc8B1ep9dFuEivrJ2lFIAglL19dhPrWp1ioceY=
+sigs.k8s.io/kustomize/kyaml v0.21.3/go.mod h1:HrAVNlYyEphOlRCcaSIQziGR+0ehwx6Xp1ucUrpC6hs=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/operator/tools/kuttl/go.mod b/operator/tools/kuttl/go.mod
index 78782800d13cc..efd998592d696 100644
--- a/operator/tools/kuttl/go.mod
+++ b/operator/tools/kuttl/go.mod
@@ -2,7 +2,7 @@ module github.com/stackrox/rox/operator/tools/kuttl
 
 go 1.26.3
 
-require github.com/kudobuilder/kuttl v0.26.0
+require github.com/kudobuilder/kuttl v0.27.0
 
 require (
 	al.essio.dev/pkg/shellescape v1.5.1 // indirect
@@ -22,31 +22,31 @@ require (
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/dustin/go-humanize v1.1.0 // indirect
 	github.com/dustinkirkland/golang-petname v0.0.0-20191129215211-8e5a1ed0cff0 // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.10.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.23.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.5 // indirect
-	github.com/go-openapi/swag v0.26.0 // indirect
-	github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
-	github.com/go-openapi/swag/conv v0.26.0 // indirect
-	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
-	github.com/go-openapi/swag/loading v0.26.0 // indirect
-	github.com/go-openapi/swag/mangling v0.26.0 // indirect
-	github.com/go-openapi/swag/netutils v0.26.0 // indirect
-	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
-	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
-	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
-	github.com/google/cel-go v0.29.0 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
+	github.com/google/cel-go v0.31.0 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -57,21 +57,22 @@ require (
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
-	github.com/moby/moby/client v0.4.1 // indirect
+	github.com/moby/moby/api v1.56.0 // indirect
+	github.com/moby/moby/client v0.6.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/onsi/gomega v1.40.0 // indirect
+	github.com/onsi/ginkgo/v2 v2.32.1 // indirect
+	github.com/onsi/gomega v1.43.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_golang v1.24.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/common v0.70.0 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
@@ -79,42 +80,42 @@ require (
 	github.com/thoas/go-funk v0.9.3 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.36.0 // indirect
-	k8s.io/apiextensions-apiserver v0.36.0 // indirect
-	k8s.io/apimachinery v0.36.0 // indirect
-	k8s.io/client-go v0.36.0 // indirect
+	k8s.io/api v0.37.0 // indirect
+	k8s.io/apiextensions-apiserver v0.37.0 // indirect
+	k8s.io/apimachinery v0.37.0 // indirect
+	k8s.io/client-go v0.37.0 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 // indirect
-	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
-	sigs.k8s.io/controller-runtime v0.24.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
+	sigs.k8s.io/controller-runtime v0.25.1 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/kind v0.31.0 // indirect
+	sigs.k8s.io/kind v0.33.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/operator/tools/kuttl/go.sum b/operator/tools/kuttl/go.sum
index 57a9d9a3222f9..6d90ca396d9c2 100644
--- a/operator/tools/kuttl/go.sum
+++ b/operator/tools/kuttl/go.sum
@@ -35,8 +35,8 @@ github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf
 github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
+github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/dustinkirkland/golang-petname v0.0.0-20191129215211-8e5a1ed0cff0 h1:90Ly+6UfUypEF6vvvW5rQIv9opIL8CbmW9FT20LDQoY=
 github.com/dustinkirkland/golang-petname v0.0.0-20191129215211-8e5a1ed0cff0/go.mod h1:V+Qd57rJe8gd4eiGzZyg4h54VLHmYVVw54iMnlAMrF8=
 github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
@@ -54,50 +54,50 @@ github.com/fsnotify/fsnotify v1.10.0/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxv
 github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
 github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
-github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
-github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=
-github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
-github.com/go-openapi/swag v0.26.0 h1:GVDXCmfvhfu1BxiHo8/FA+BbKmhecHnG3varjON5/RI=
-github.com/go-openapi/swag v0.26.0/go.mod h1:82g3193sZJRbocs7bNCqGfIgq8pkuwVwCfhKIRlEQF0=
-github.com/go-openapi/swag/cmdutils v0.26.0 h1:iowihOcvq7y4egO8cOq0dmfohz6wfeQ63U1EnuhO2TU=
-github.com/go-openapi/swag/cmdutils v0.26.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
-github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I=
-github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE=
-github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU=
-github.com/go-openapi/swag/fileutils v0.26.0/go.mod h1:0WDJ7lp67eNjPMO50wAWYlKvhOb6CQ37rzR7wrgI8Tc=
-github.com/go-openapi/swag/jsonname v0.26.0 h1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w=
-github.com/go-openapi/swag/jsonname v0.26.0/go.mod h1:urBBR8bZNoDYGr653ynhIx+gTeIz0ARZxHkAPktJK2M=
-github.com/go-openapi/swag/jsonutils v0.26.0 h1:FawFML2iAXsPqmERscuMPIHmFsoP1tOqWkxBaKNMsnA=
-github.com/go-openapi/swag/jsonutils v0.26.0/go.mod h1:2VmA0CJlyFqgawOaPI9psnjFDqzyivIqLYN34t9p91E=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0 h1:apqeINu/ICHouqiRZbyFvuDge5jCmmLTqGQ9V95EaOM=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0/go.mod h1:AyM6QT8uz5IdKxk5akv0y6u4QvcL9GWERt0Jx/F/R8Y=
-github.com/go-openapi/swag/loading v0.26.0 h1:Apg6zaKhCJurpJer0DCxq99qwmhFddBhaMX7kilDcko=
-github.com/go-openapi/swag/loading v0.26.0/go.mod h1:dBxQ/6V2uBaAQdevN18VELE6xSpJWZxLX4txe12JwDg=
-github.com/go-openapi/swag/mangling v0.26.0 h1:Du2YC4YLA/Y5m/YKQd7AnY5qq0wRKSFZTTt8ktFaXcQ=
-github.com/go-openapi/swag/mangling v0.26.0/go.mod h1:jifS7W9vbg+pw63bT+GI53otluMQL3CeemuyCHKwVx0=
-github.com/go-openapi/swag/netutils v0.26.0 h1:CmZp+ZT7HrmFwrC3GdGsXBq2+42T1bjKBapcqVpIs3c=
-github.com/go-openapi/swag/netutils v0.26.0/go.mod h1:5iK+Ok3ZohWWex1C50BFTPexi03UaPwjW4Oj8kgrpwo=
-github.com/go-openapi/swag/stringutils v0.26.0 h1:qZQngLxs5s7SLijc3N2ZO+fUq2o8LjuWAASSrJuh+xg=
-github.com/go-openapi/swag/stringutils v0.26.0/go.mod h1:sWn5uY+QIIspwPhvgnqJsH8xqFT2ZbYcvbcFanRyhFE=
-github.com/go-openapi/swag/typeutils v0.26.0 h1:2kdEwdiNWy+JJdOvu5MA2IIg2SylWAFuuyQIKYybfq4=
-github.com/go-openapi/swag/typeutils v0.26.0/go.mod h1:oovDuIUvTrEHVMqWilQzKzV4YlSKgyZmFh7AlfABNVE=
-github.com/go-openapi/swag/yamlutils v0.26.0 h1:H7O8l/8NJJQ/oiReEN+oMpnGMyt8G0hl460nRZxhLMQ=
-github.com/go-openapi/swag/yamlutils v0.26.0/go.mod h1:1evKEGAtP37Pkwcc7EWMF0hedX0/x3Rkvei2wtG/TbU=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 h1:5zRca5jw7lzVREKCZVNBpysDNBjj74rBh0N2BGQbSR0=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2/go.mod h1:XVevPw5hUXuV+5AkI1u1PeAm27EQVrhXTTCPAF85LmE=
-github.com/go-openapi/testify/v2 v2.4.2 h1:tiByHpvE9uHrrKjOszax7ZvKB7QOgizBWGBLuq0ePx4=
-github.com/go-openapi/testify/v2 v2.4.2/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/google/cel-go v0.29.0 h1:fEG+Ja3YRwNOqnQxTyJwoByAUAvTuxUGiro/jhrm4F4=
-github.com/google/cel-go v0.29.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
+github.com/google/cel-go v0.31.0 h1:H0bhpFTqOvmHrBGrWKp7ZlhBm5Hh8PYUEXnwxT1LL7A=
+github.com/google/cel-go v0.31.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -105,8 +105,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -117,14 +117,14 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
+github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kudobuilder/kuttl v0.26.0 h1:8PXqnuismPqmxk5yslqfCezXLfkCbR+PIqz8KDzuo7M=
-github.com/kudobuilder/kuttl v0.26.0/go.mod h1:jsTOHjoskFIcrkIWnLjAztV5n86o+YqUOjgTK/5lKsc=
+github.com/kudobuilder/kuttl v0.27.0 h1:Dc+h0OaoLSaNdSt0caMtHFr0mvdhz7flDuZzq1k1wuU=
+github.com/kudobuilder/kuttl v0.27.0/go.mod h1:mpoA6IwOP7pe3hxGO5ojVcpbE6KphWTn7QNN9qpZaWw=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -135,10 +135,10 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ=
+github.com/moby/moby/api v1.56.0/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
+github.com/moby/moby/client v0.6.0 h1:AJjEB21QPbXSXjDsZorFBoDZPhMrfbpaPLgSMAW9Bgs=
+github.com/moby/moby/client v0.6.0/go.mod h1:OCo00wNRyA3m4lmJ228W3JbyCN4ZNNYjpOXiJydBdcQ=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -147,10 +147,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.27.4 h1:fcEcQW/A++6aZAZQNUmNjvA9PSOzefMJBerHJ4t8v8Y=
-github.com/onsi/ginkgo/v2 v2.27.4/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
-github.com/onsi/gomega v1.40.0 h1:Vtol0e1MghCD2ZVIilPDIg44XSL9l2QAn8ZNaljWcJc=
-github.com/onsi/gomega v1.40.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.43.0 h1:VlG/1FxqNxhSO+lq/OHBNaaqwiBK/mO8JbVkX9Y+FeU=
+github.com/onsi/gomega v1.43.0/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -162,14 +162,14 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
+github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
+github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -183,30 +183,30 @@ github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/thoas/go-funk v0.9.3 h1:7+nAEx3kn5ZJcnDm2Bh23N2yOtweO14bi//dvRtgLpw=
 github.com/thoas/go-funk v0.9.3/go.mod h1:+IWnUfUmFO1+WVYQWQtIJHeRRdaIyyYglZN7xzUPe4Q=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -215,37 +215,38 @@ go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
 go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
-golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
-golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -262,31 +263,31 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-k8s.io/api v0.36.0 h1:SgqDhZzHdOtMk40xVSvCXkP9ME0H05hPM3p9AB1kL80=
-k8s.io/api v0.36.0/go.mod h1:m1LVrGPNYax5NBHdO+QuAedXyuzTt4RryI/qnmNvs34=
-k8s.io/apiextensions-apiserver v0.36.0 h1:Wt7E8J+VBCbj4FjiBfDTK/neXDDjyJVJc7xfuOHImZ0=
-k8s.io/apiextensions-apiserver v0.36.0/go.mod h1:kGDjH0msuiIB3tgsYRV0kS9GqpMYMUsQ3GHv7TApyug=
-k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
-k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
-k8s.io/client-go v0.36.0 h1:pOYi7C4RHChYjMiHpZSpSbIM6ZxVbRXBy7CuiIwqA3c=
-k8s.io/client-go v0.36.0/go.mod h1:ZKKcpwF0aLYfkHFCjillCKaTK/yBkEDHTDXCFY6AS9Y=
+k8s.io/api v0.37.0 h1:Z//Vj9N7RA/yS2sDmxyeo7h+RR4zbUrd2vrd3Z0TbB4=
+k8s.io/api v0.37.0/go.mod h1:LKXgcJWMc+f4OLbP5SFR8rulEg07zZhpi/zMULiBImk=
+k8s.io/apiextensions-apiserver v0.37.0 h1:zRMQ3+/LIE5oZ0tVvXwYHC+dIkSP5cjNWju7AZU1LOI=
+k8s.io/apiextensions-apiserver v0.37.0/go.mod h1:HU0PfSBwchHL5iDau6jjt9zU6ryWkDDlaVUiq91NK80=
+k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0=
+k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE=
+k8s.io/client-go v0.37.0 h1:nsN31fy8wBySuZ+QRnKmrjRSQLOG2rvoGN0tKd12zhQ=
+k8s.io/client-go v0.37.0/go.mod h1:FcGqw+Ll/gNQiq+nPGY1Oyt9y7SgDh1d3MW3RFDEbn0=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 h1:sWu4Td5mgJlwunsUydnhKEAfNUHM7hm1wfKEQmD7G5c=
-k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
-sigs.k8s.io/controller-runtime v0.24.0 h1:Ck6N2LdS8Lovy1o25BB4r1xjvLEKUl1s2o9kU+KWDE4=
-sigs.k8s.io/controller-runtime v0.24.0/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
+sigs.k8s.io/controller-runtime v0.25.1 h1:BKgU9OeE8xv8EbbM8cY0NVzTQs35rokkdq1jh12fMb4=
+sigs.k8s.io/controller-runtime v0.25.1/go.mod h1:4QqLdT6z/L6Olj8JJCtvztid4/fnIiYsfaTFScegctc=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/kind v0.31.0 h1:UcT4nzm+YM7YEbqiAKECk+b6dsvc/HRZZu9U0FolL1g=
-sigs.k8s.io/kind v0.31.0/go.mod h1:FSqriGaoTPruiXWfRnUXNykF8r2t+fHtK0P0m1AbGF8=
+sigs.k8s.io/kind v0.33.0 h1:AjvDv3vOygb/VKLVQW87lfktIBzkxR8Ump9DjxC8+Lk=
+sigs.k8s.io/kind v0.33.0/go.mod h1:FSqriGaoTPruiXWfRnUXNykF8r2t+fHtK0P0m1AbGF8=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/operator/tools/operator-sdk/go.mod b/operator/tools/operator-sdk/go.mod
index b414d606b1a0c..6c414de8ca28a 100644
--- a/operator/tools/operator-sdk/go.mod
+++ b/operator/tools/operator-sdk/go.mod
@@ -5,7 +5,7 @@ go 1.26.3
 require github.com/operator-framework/operator-sdk v1.42.3
 
 require (
-	cel.dev/expr v0.25.1 // indirect
+	cel.dev/expr v0.25.2 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
@@ -28,7 +28,7 @@ require (
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
 	github.com/containerd/cgroups/v3 v3.1.2 // indirect
-	github.com/containerd/containerd v1.7.33 // indirect
+	github.com/containerd/containerd v1.7.36 // indirect
 	github.com/containerd/containerd/api v1.10.0 // indirect
 	github.com/containerd/continuity v0.4.5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
@@ -62,10 +62,10 @@ require (
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
-	github.com/go-git/go-git/v5 v5.19.1 // indirect
+	github.com/go-git/go-git/v5 v5.19.2 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.22.4 // indirect
 	github.com/go-openapi/jsonreference v0.21.4 // indirect
@@ -91,7 +91,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/cel-go v0.29.0 // indirect
+	github.com/google/cel-go v0.31.0 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-containerregistry v0.21.5 // indirect
@@ -135,7 +135,7 @@ require (
 	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -194,33 +194,33 @@ require (
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.podman.io/common v0.66.1 // indirect
 	go.podman.io/image/v5 v5.38.0 // indirect
 	go.podman.io/storage v1.61.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.48.0 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260511170946-3700d4141b60 // indirect
-	google.golang.org/grpc v1.82.1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -239,7 +239,7 @@ require (
 	k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
 	k8s.io/kubectl v0.35.1 // indirect
 	k8s.io/utils v0.0.0-20260108192941-914a6e750570 // indirect
-	oras.land/oras-go/v2 v2.6.0 // indirect
+	oras.land/oras-go/v2 v2.6.2 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
 	sigs.k8s.io/controller-runtime v0.23.1 // indirect
 	sigs.k8s.io/controller-tools v0.20.0 // indirect
diff --git a/operator/tools/operator-sdk/go.sum b/operator/tools/operator-sdk/go.sum
index b435790cea172..790d026981d54 100644
--- a/operator/tools/operator-sdk/go.sum
+++ b/operator/tools/operator-sdk/go.sum
@@ -1,5 +1,5 @@
-cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
-cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
+cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
@@ -58,8 +58,8 @@ github.com/clipperhouse/uax29/v2 v2.6.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsV
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/containerd/cgroups/v3 v3.1.2 h1:OSosXMtkhI6Qove637tg1XgK4q+DhR0mX8Wi8EhrHa4=
 github.com/containerd/cgroups/v3 v3.1.2/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
-github.com/containerd/containerd v1.7.33 h1:iAkYGC/ifR/V+0eR4iXWHNGYUF0DF2PmGV5iz4Irj5M=
-github.com/containerd/containerd v1.7.33/go.mod h1:gSbSCVjPCdkfJCjyrzz7aRC+xFlqVbatNpfHfVCYGUM=
+github.com/containerd/containerd v1.7.36 h1:HyMsOG5kmp1LQsGzqwI6Ts06T4VpYZbszfDZYB0bW5w=
+github.com/containerd/containerd v1.7.36/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ=
 github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o=
 github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
@@ -154,15 +154,15 @@ github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66D
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
 github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
-github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
-github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -239,8 +239,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.29.0 h1:fEG+Ja3YRwNOqnQxTyJwoByAUAvTuxUGiro/jhrm4F4=
-github.com/google/cel-go v0.29.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
+github.com/google/cel-go v0.31.0 h1:H0bhpFTqOvmHrBGrWKp7ZlhBm5Hh8PYUEXnwxT1LL7A=
+github.com/google/cel-go v0.31.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -356,8 +356,8 @@ github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9Kou
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -527,8 +527,8 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 h1:deI9UQMoGFgrg5iLPgzueqFPHevDl+28YKfSpPTI6rY=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0/go.mod h1:PFx9NgpNUKXdf7J4Q3agRxMs3Y07QhTCVipKmLsMKnU=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag=
@@ -537,10 +537,10 @@ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdK
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
@@ -553,18 +553,18 @@ go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1J
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs=
 go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4=
 go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
 go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko=
 go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.podman.io/common v0.66.1 h1:zDyd4HhVgQAN8LupBHCnhtM3FEOJ9DwmThjulXZq2qA=
 go.podman.io/common v0.66.1/go.mod h1:aNd2a0S7pY+fx1X5kpQYuF4hbwLU8ZOccuVrhu7h1Xc=
 go.podman.io/image/v5 v5.38.0 h1:aUKrCANkPvze1bnhLJsaubcfz0d9v/bSDLnwsXJm6G4=
@@ -589,8 +589,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
@@ -604,8 +604,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -622,8 +622,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -638,8 +638,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -656,8 +656,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -667,8 +667,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -678,8 +678,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -694,8 +694,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -713,17 +713,17 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
 google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
-google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
-google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260511170946-3700d4141b60 h1:seT2EwLWM78plQ7wcDfuWBc/4FAEAXDDiaSol4ku4qo=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260511170946-3700d4141b60/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:FarXi840EJWSHYTN3ERkADbPWjl307+FGrA22KAVjjc=
+google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -780,8 +780,8 @@ k8s.io/kubectl v0.35.1 h1:zP3Er8C5i1dcAFUMh9Eva0kVvZHptXIn/+8NtRWMxwg=
 k8s.io/kubectl v0.35.1/go.mod h1:cQ2uAPs5IO/kx8R5s5J3Ihv3VCYwrx0obCXum0CvnXo=
 k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY=
 k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
-oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
+oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo=
+oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 h1:hSfpvjjTQXQY2Fol2CS0QHMNs/WI1MOSGzCm1KhM5ec=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/controller-runtime v0.23.1 h1:TjJSM80Nf43Mg21+RCy3J70aj/W6KyvDtOlpKf+PupE=
diff --git a/operator/tools/yq/go.mod b/operator/tools/yq/go.mod
index 2e37eb540e772..ae946785ad2b6 100644
--- a/operator/tools/yq/go.mod
+++ b/operator/tools/yq/go.mod
@@ -2,13 +2,14 @@ module github.com/stackrox/rox/operator/tools/yq
 
 go 1.26.3
 
-require github.com/mikefarah/yq/v4 v4.53.3
+require github.com/mikefarah/yq/v4 v4.54.1
 
 require (
 	github.com/a8m/envsubst v1.4.3 // indirect
 	github.com/agext/levenshtein v1.2.1 // indirect
 	github.com/alecthomas/participle/v2 v2.1.4 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/elliotchance/orderedmap v1.8.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
@@ -16,23 +17,23 @@ require (
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.25.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
-	github.com/magiconair/properties v1.8.10 // indirect
+	github.com/magiconair/properties v1.18.12 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/yuin/gopher-lua v1.1.2 // indirect
-	github.com/zclconf/go-cty v1.18.1 // indirect
-	go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect
-	golang.org/x/mod v0.36.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	github.com/zclconf/go-cty v1.19.0 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 )
diff --git a/operator/tools/yq/go.sum b/operator/tools/yq/go.sum
index 1597a5ce1c948..81dbe3c8b66ed 100644
--- a/operator/tools/yq/go.sum
+++ b/operator/tools/yq/go.sum
@@ -6,10 +6,12 @@ github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8v
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/participle/v2 v2.1.4 h1:W/H79S8Sat/krZ3el6sQMvMaahJ+XcM9WSI2naI7w2U=
 github.com/alecthomas/participle/v2 v2.1.4/go.mod h1:8tqVbpTX20Ru4NfYQgZf4mP18eXPTBViyMWiArNEgGI=
-github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
-github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/repr v0.5.4 h1:OVP7JEcuzU9CCDsT6STCr3rg17oQfWILtPWd2EG0uN4=
+github.com/alecthomas/repr v0.5.4/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/apparentlymart/go-textseg/v17 v17.0.1 h1:bpMXRgQ5cEoRNuQke1a80/Nl6w3G5eoIbWo9f3gXkAs=
+github.com/apparentlymart/go-textseg/v17 v17.0.1/go.mod h1:fa8X4jgGeevslICIY6LcdjkSecWnXmYd9Lk34z/VxZs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -30,26 +32,26 @@ github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
-github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
+github.com/hashicorp/hcl/v2 v2.25.0 h1:HmmQVYRny4MaBo4b20TjmL46wyuUxpnMWkPZ4+NTbWk=
+github.com/hashicorp/hcl/v2 v2.25.0/go.mod h1:vR+FKETxoZAmRlHgFfKmuqivj+C4Izm/c66XkmZ3r7M=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
-github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
-github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/magiconair/properties v1.18.12 h1:sT9zQpvTB3B4gzrX0tmZNTEaGyg8Zw55MFYRE32Mr9I=
+github.com/magiconair/properties v1.18.12/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mikefarah/yq/v4 v4.53.3 h1:S0kwPkINdOjgPskW5CfYTGo/Vt7c3gUnUkKSp7CNqD0=
-github.com/mikefarah/yq/v4 v4.53.3/go.mod h1:4mvgujMtSAB3lA27+lwg8eIud/4QUQw2/1rLbxgiauw=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mikefarah/yq/v4 v4.54.1 h1:wFk+RhKFcx6fU6tkjC9z069vLTL4uDoXi9R4SytFB8s=
+github.com/mikefarah/yq/v4 v4.54.1/go.mod h1:2s/axTs7Quuo86zZrkN/2QjflxEtFay8aynJsuNT6Mw=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -65,26 +67,25 @@ github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5Cc
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
 github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=
-github.com/zclconf/go-cty v1.18.1 h1:yEGE8M4iIZlyKQURZNb2SnEyZlZHUcBCnx6KF81KuwM=
-github.com/zclconf/go-cty v1.18.1/go.mod h1:qpnV6EDNgC1sns/AleL1fvatHw72j+S+nS+MJ+T2CSg=
+github.com/zclconf/go-cty v1.19.0 h1:IV8WdqYZc2c5rLX9bEoLNXKojBAp0MZPBHMIrCoa/s4=
+github.com/zclconf/go-cty v1.19.0/go.mod h1:12W89jGn3JCOIQi7infWr9m80rOkb5RNYJqXMZcN4c8=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
-go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/pkg/auth/authproviders/identity.go b/pkg/auth/authproviders/identity.go
index 844419c7087d9..2e2307e5fb4b8 100644
--- a/pkg/auth/authproviders/identity.go
+++ b/pkg/auth/authproviders/identity.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stackrox/rox/pkg/auth/permissions/utils"
 	"github.com/stackrox/rox/pkg/auth/tokens"
 	"github.com/stackrox/rox/pkg/auth/user"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/protoconv"
 )
 
@@ -44,6 +45,22 @@ func CreateRoleBasedIdentity(ctx context.Context, provider Provider, authResp *A
 	if err != nil {
 		return nil, err
 	}
+	if features.ACMAccessControlDelegation.Enabled() &&
+		isACMRoleDelegationProvider(provider) &&
+		len(resolvedRoles) == 0 {
+		// At the point of writing, the only use for the resolved roles
+		// is to filter away users with no roles.
+		// The generated user identity is used to log successful login attempts.
+		// TODO: Find a cleaner way to bypass the "no user role check",
+		// and provide a loggable user identity.
+		fakeRole := &tokens.InternalRole{
+			RoleName: "dummy role with no access",
+			Permissions: map[storage.Access][]string{
+				storage.Access_NO_ACCESS: {"dummy-resource"},
+			},
+		}
+		resolvedRoles = append(resolvedRoles, fakeRole)
+	}
 	return &v1.AuthStatus{
 		Id: &v1.AuthStatus_UserId{
 			UserId: authResp.Claims.UserID,
diff --git a/pkg/auth/authproviders/openshift/backend_factory_impl.go b/pkg/auth/authproviders/openshift/backend_factory_impl.go
index 32d411075fa46..8008cc7a6edd8 100644
--- a/pkg/auth/authproviders/openshift/backend_factory_impl.go
+++ b/pkg/auth/authproviders/openshift/backend_factory_impl.go
@@ -7,13 +7,19 @@ import (
 
 	"github.com/stackrox/rox/pkg/auth/authproviders"
 	"github.com/stackrox/rox/pkg/auth/authproviders/idputil"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/httputil"
+	"github.com/stackrox/rox/pkg/maputil"
 )
 
 const (
 	// TypeName is the standard type name for OpenShift auth providers.
 	TypeName = "openshift"
 
+	// TypeNameWithACMAccessControlDelegation is the type name for OpenShift auth providers
+	// with role resolution from ACM.
+	TypeNameWithACMAccessControlDelegation = authproviders.OpenShiftTypeNameWithACMAccessControlDelegation
+
 	callbackRelativePath = "callback"
 )
 
@@ -35,6 +41,15 @@ func NewFactory(urlPathPrefix string) authproviders.BackendFactory {
 	}
 }
 
+// NewFactoryWithACMAccessControlDelegation creates a new factory for OpenShift oauth authprovider backends.
+func NewFactoryWithACMAccessControlDelegation(urlPathPrefix string) authproviders.BackendFactory {
+	urlPathPrefix = strings.TrimRight(urlPathPrefix, "/") + "/"
+	return &factory{
+		callbackURLPath: urlPathPrefix + callbackRelativePath,
+		newBackend:      newBackendWithACMAccessControlDelegation,
+	}
+}
+
 func (f *factory) CreateBackend(_ context.Context, id string, _ []string, config map[string]string, _ map[string]string) (authproviders.Backend, error) {
 	return f.newBackend(id, f.callbackURLPath, config)
 }
@@ -62,10 +77,26 @@ func (f *factory) ResolveProviderAndClientState(state string) (string, string, e
 }
 
 func (f *factory) RedactConfig(config map[string]string) map[string]string {
+	if features.ACMAccessControlDelegation.Enabled() {
+		if config[ClientSecretConfigKey] != "" {
+			config = maputil.ShallowClone(config)
+			config[ClientSecretConfigKey] = "*****"
+		}
+	}
 	return config
 }
 
-func (f *factory) MergeConfig(newConfig, _ map[string]string) map[string]string {
+func (f *factory) MergeConfig(newConfig, oldConfig map[string]string) map[string]string {
+	if features.ACMAccessControlDelegation.Enabled() {
+		mergedCfg := maputil.ShallowClone(oldConfig)
+		if newConfig[ClientNameConfigKey] != "" {
+			mergedCfg[ClientNameConfigKey] = newConfig[ClientNameConfigKey]
+		}
+		if newConfig[ClientSecretConfigKey] != "" {
+			mergedCfg[ClientSecretConfigKey] = newConfig[ClientSecretConfigKey]
+		}
+		return mergedCfg
+	}
 	return newConfig
 }
 
diff --git a/pkg/auth/authproviders/openshift/backend_impl.go b/pkg/auth/authproviders/openshift/backend_impl.go
index c88d8e54fa176..ec3f56cb9666e 100644
--- a/pkg/auth/authproviders/openshift/backend_impl.go
+++ b/pkg/auth/authproviders/openshift/backend_impl.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stackrox/rox/pkg/auth/authproviders/openshift/internal/dexconnector"
 	"github.com/stackrox/rox/pkg/auth/tokens"
 	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/grpc/requestinfo"
 	"github.com/stackrox/rox/pkg/httputil"
 	"github.com/stackrox/rox/pkg/logging"
@@ -24,6 +25,11 @@ const (
 	roxTokenExpiration = 5 * time.Minute
 )
 
+const (
+	ClientNameConfigKey   = "client_name"
+	ClientSecretConfigKey = "client_secret"
+)
+
 // This is the location for CA files which shall be used for certificate validation within
 // openshift auth. In addition to the CA files here, the system's trusted root CAs will be used as well.
 // The path may or may not exist depending on cluster state & configuration.
@@ -55,7 +61,9 @@ type callbackAndRefreshConnector interface {
 
 type backend struct {
 	id                      string
+	config                  map[string]string
 	baseRedirectURLPath     string
+	connectorFactory        func() (callbackAndRefreshConnector, error)
 	openshiftConnector      callbackAndRefreshConnector
 	openshiftConnectorMutex sync.Mutex
 }
@@ -80,6 +88,7 @@ func newBackend(id string, callbackURLPath string, _ map[string]string) (*backen
 	b := &backend{
 		id:                  id,
 		baseRedirectURLPath: callbackURLPath,
+		connectorFactory:    createOpenshiftConnector,
 		openshiftConnector:  openshiftConnector,
 	}
 
@@ -92,6 +101,31 @@ func newBackend(id string, callbackURLPath string, _ map[string]string) (*backen
 	return b, nil
 }
 
+func newBackendWithACMAccessControlDelegation(id string, callbackURLPath string, config map[string]string) (*backend, error) {
+	openshiftConnector, err := createOpenshiftConnectorForACMAccessControlDelegation(config)
+	if err != nil {
+		return nil, err
+	}
+
+	b := &backend{
+		id:                  id,
+		config:              config,
+		baseRedirectURLPath: callbackURLPath,
+		connectorFactory: func() (callbackAndRefreshConnector, error) {
+			return createOpenshiftConnectorForACMAccessControlDelegation(config)
+		},
+		openshiftConnector: openshiftConnector,
+	}
+
+	// Register backend for notification on openshift certificate updates.
+	// And refresh connection to OpenShift in case certificates changed
+	// between the backend creation and its registration.
+	registerBackend(b)
+	b.recreateOpenshiftConnector()
+
+	return b, nil
+}
+
 func createOpenshiftConnector() (callbackAndRefreshConnector, error) {
 	settings, err := getOpenShiftSettings()
 	if err != nil {
@@ -105,7 +139,32 @@ func createOpenshiftConnector() (callbackAndRefreshConnector, error) {
 		TrustedCertPool: settings.trustedCertPool,
 	}
 
-	openshiftConnector, err := dexCfg.Open()
+	openshiftConnector, err := dexCfg.Open([]string{"user:info"})
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create dex openshiftConnector for OpenShift's OAuth Server")
+	}
+
+	return openshiftConnector, nil
+}
+
+func createOpenshiftConnectorForACMAccessControlDelegation(config map[string]string) (callbackAndRefreshConnector, error) {
+	if config[ClientNameConfigKey] == "" || config[ClientSecretConfigKey] == "" {
+		return nil, errors.New("ACM access control delegation requires both client name and client secret")
+	}
+
+	certPool, err := getSystemCertPoolWithAdditionalCA(serviceOperatorCAPath, internalServicesCAPath, injectedCAPath)
+	if err != nil {
+		return nil, err
+	}
+
+	dexCfg := dexconnector.Config{
+		Issuer:          openshiftAPIUrl,
+		ClientID:        config[ClientNameConfigKey],
+		ClientSecret:    config[ClientSecretConfigKey],
+		TrustedCertPool: certPool,
+	}
+
+	openshiftConnector, err := dexCfg.Open([]string{"user:info", "user:full"})
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create dex openshiftConnector for OpenShift's OAuth Server")
 	}
@@ -115,6 +174,9 @@ func createOpenshiftConnector() (callbackAndRefreshConnector, error) {
 
 // There is no config but static settings instead.
 func (b *backend) Config() map[string]string {
+	if features.ACMAccessControlDelegation.Enabled() {
+		return b.config
+	}
 	return nil
 }
 
@@ -197,7 +259,7 @@ func (b *backend) Validate(_ context.Context, _ *tokens.Claims) error {
 }
 
 func (b *backend) recreateOpenshiftConnector() {
-	openshiftConnector, err := createOpenshiftConnector()
+	openshiftConnector, err := b.connectorFactory()
 	if err != nil {
 		log.Errorw("failed to create updated dex openshiftConnector for OpenShift's OAuth Server with new CAs, "+
 			"new certs will not be applied. This may lead to unwanted TLS connection issues.", logging.Err(err))
diff --git a/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go b/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go
index 453905cd4cb58..f20554073be8a 100644
--- a/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go
+++ b/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go
@@ -90,7 +90,7 @@ func (e *oauth2Error) Error() string {
 
 // Open returns a openshiftConnector which can be used to login users through an
 // upstream OpenShift OAuth2 server.
-func (c *Config) Open() (*openshiftConnector, error) {
+func (c *Config) Open(oauth2Scopes []string) (*openshiftConnector, error) {
 	ctx, cancel := context.WithCancel(context.Background())
 
 	httpClient, err := newHTTPClient(c.TrustedCertPool)
@@ -135,7 +135,7 @@ func (c *Config) Open() (*openshiftConnector, error) {
 	openshiftConnector.oauth2Config = &oauth2.Config{
 		ClientID:     c.ClientID,
 		ClientSecret: c.ClientSecret,
-		Scopes:       []string{"user:info"},
+		Scopes:       oauth2Scopes,
 		Endpoint: oauth2.Endpoint{
 			AuthURL:  metadata.Auth,
 			TokenURL: metadata.Token,
diff --git a/pkg/auth/authproviders/openshift/testutils.go b/pkg/auth/authproviders/openshift/testutils.go
index a4334afb07a04..5222779298749 100644
--- a/pkg/auth/authproviders/openshift/testutils.go
+++ b/pkg/auth/authproviders/openshift/testutils.go
@@ -24,7 +24,10 @@ func newTestBackend(_ testing.TB) newBackendFunc {
 		b := &backend{
 			id:                  id,
 			baseRedirectURLPath: callbackURL,
-			openshiftConnector:  nil,
+			connectorFactory: func() (callbackAndRefreshConnector, error) {
+				return nil, nil
+			},
+			openshiftConnector: nil,
 		}
 		registerBackend(b)
 		return b, nil
diff --git a/pkg/auth/authproviders/provider_options.go b/pkg/auth/authproviders/provider_options.go
index e7896739add1b..5409952ada564 100644
--- a/pkg/auth/authproviders/provider_options.go
+++ b/pkg/auth/authproviders/provider_options.go
@@ -166,3 +166,18 @@ func WithVisibility(visibility storage.Traits_Visibility) ProviderOption {
 		return nil
 	}
 }
+
+// WithOrigin sets the origin for the auth provider.
+func WithOrigin(origin storage.Traits_Origin) ProviderOption {
+	return func(pr *providerImpl) error {
+		if pr.storedInfo == nil {
+			return errox.InvariantViolation.CausedBy("no storage data for auth provider")
+		}
+		if pr.storedInfo.GetTraits() != nil {
+			pr.storedInfo.Traits.Origin = origin
+		} else {
+			pr.storedInfo.Traits = &storage.Traits{Origin: origin}
+		}
+		return nil
+	}
+}
diff --git a/pkg/auth/authproviders/registry_httphandler_test.go b/pkg/auth/authproviders/registry_httphandler_test.go
index 460d65df493c2..892d800b22677 100644
--- a/pkg/auth/authproviders/registry_httphandler_test.go
+++ b/pkg/auth/authproviders/registry_httphandler_test.go
@@ -24,6 +24,7 @@ import (
 	perm "github.com/stackrox/rox/pkg/auth/permissions"
 	"github.com/stackrox/rox/pkg/auth/tokens"
 	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/grpc/requestinfo"
 	"github.com/stackrox/rox/pkg/protocompat"
 	"github.com/stackrox/rox/pkg/testutils/roletest"
@@ -51,18 +52,14 @@ func (s *registryProviderCallbackTestSuite) SetupTest() {
 	testAuthProviderStore := &tstAuthProviderStore{}
 	testRoleMapperFactory := &tstRoleMapperFactory{}
 	testTokenIssuerFactory := &tstTokenIssuerFactory{}
-	s.registry = &registryImpl{
-		ServeMux:      http.NewServeMux(),
-		urlPathPrefix: "sssotest",
-		redirectURL:   "dummyredirect",
-		store:         testAuthProviderStore,
-		issuerFactory: testTokenIssuerFactory,
-
-		backendFactories: make(map[string]BackendFactory),
-		providers:        make(map[string]Provider),
-
-		roleMapperFactory: testRoleMapperFactory,
-	}
+	s.registry = NewStoreBackedRegistry(
+		"ssotest",
+		"dummyredirect",
+		testAuthProviderStore,
+		testTokenIssuerFactory,
+		testRoleMapperFactory,
+		nil,
+	).(*registryImpl)
 	s.ctx = context.Background()
 	err := s.registry.RegisterBackendFactory(s.ctx, dummyProviderType, newTestAuthProviderBackendFactory)
 	s.Require().NoError(err, "backend registration at SetupTest should not trigger errors")
@@ -298,6 +295,33 @@ func (s *registryProviderCallbackTestSuite) TestAuthenticationIssuesTokenForUser
 		"callback activated for user with valid roles should issue a token")
 }
 
+func (s *registryProviderCallbackTestSuite) TestAuthenticationIssuesTokenForUserWithRolesIsNotImpactedByACMDelegation() {
+	s.T().Setenv(features.ACMAccessControlDelegation.EnvVar(), "true")
+	urlPrefix := s.registry.providersURLPrefix()
+	req, err := http.NewRequest(http.MethodGet, urlPrefix+dummyProviderType+"/callback", strings.NewReader(""))
+	s.Require().NoError(err, "error creating http request")
+	clientState, err := idputil.AttachStateOrEmpty("", false, "")
+	s.Require().NoError(err, "error attaching state")
+	testAuthProviderBackendFactory.registerProcessResponse(dummyProviderType, clientState, nil)
+	authRsp := generateAuthResponse(testUserWithAdminRole, nil)
+	testAuthProviderBackend.registerProcessHTTPResponse(authRsp, nil)
+	adminRole := roletest.NewResolvedRoleWithDenyAll(testUserWithAdminRole, nil)
+	rolemapping := make(map[string][]perm.ResolvedRole)
+	rolemapping[testUserWithAdminRole] = []perm.ResolvedRole{adminRole}
+	testRoleMapper.registerRoleMapping(rolemapping)
+	s.registry.providersHTTPHandler(s.writer, req)
+	s.Equal(http.StatusSeeOther, s.writer.Code, "callback activated for user with valid roles should trigger redirect")
+	responseHeaders := s.writer.Header()
+	redirectURL, err := url.Parse(responseHeaders.Get("Location"))
+	s.Require().NoErrorf(err, "error parsing query %s", responseHeaders.Get("Location"))
+	redirectURLFragments, err := url.ParseQuery(redirectURL.Fragment)
+	s.Require().NoErrorf(err, "error parsing query %s", redirectURL.Fragment)
+	s.Equal(s.registry.redirectURL, redirectURL.Path, "callback activated for user with valid roles "+
+		"should redirect to the registry redirect URL")
+	s.Equal(testDummyTokenData, redirectURLFragments.Get("token"),
+		"callback activated for user with valid roles should issue a token")
+}
+
 func (s *registryProviderCallbackTestSuite) setupRoxctlAuthenticatedUser() {
 	authRsp := generateAuthResponse(testUserWithAdminRole, nil)
 	testAuthProviderBackend.registerProcessHTTPResponse(authRsp, nil)
diff --git a/pkg/auth/authproviders/registry_impl.go b/pkg/auth/authproviders/registry_impl.go
index 36e101a3861be..2e01d81d1a329 100644
--- a/pkg/auth/authproviders/registry_impl.go
+++ b/pkg/auth/authproviders/registry_impl.go
@@ -2,6 +2,7 @@ package authproviders
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"strings"
@@ -11,9 +12,18 @@ import (
 	"github.com/stackrox/rox/pkg/auth/permissions"
 	"github.com/stackrox/rox/pkg/auth/tokens"
 	"github.com/stackrox/rox/pkg/errox"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/externalrolebroker"
+	"github.com/stackrox/rox/pkg/sac/externalrolebroker/acm"
 	"github.com/stackrox/rox/pkg/sync"
+	"golang.org/x/oauth2"
+	"k8s.io/client-go/rest"
+)
+
+const (
+	OpenShiftTypeNameWithACMAccessControlDelegation = "openshift-with-acm-roles"
 )
 
 var (
@@ -24,7 +34,14 @@ var (
 // NewStoreBackedRegistry creates a new auth provider registry that is backed by a store. It also can handle HTTP requests,
 // where every incoming HTTP request URL is expected to refer to a path under `urlPathPrefix`. The redirect URL for
 // clients upon successful/failed authentication is `clientRedirectURL`.
-func NewStoreBackedRegistry(urlPathPrefix string, redirectURL string, store Store, tokenIssuerFactory tokens.IssuerFactory, roleMapperFactory permissions.RoleMapperFactory) Registry {
+func NewStoreBackedRegistry(
+	urlPathPrefix string,
+	redirectURL string,
+	store Store,
+	tokenIssuerFactory tokens.IssuerFactory,
+	roleMapperFactory permissions.RoleMapperFactory,
+	clusterResolver tokens.ClusterResolver,
+) Registry {
 	urlPathPrefix = strings.TrimRight(urlPathPrefix, "/") + "/"
 	registry := &registryImpl{
 		ServeMux:      http.NewServeMux(),
@@ -37,6 +54,8 @@ func NewStoreBackedRegistry(urlPathPrefix string, redirectURL string, store Stor
 		providers:        make(map[string]Provider),
 
 		roleMapperFactory: roleMapperFactory,
+
+		clusterResolver: clusterResolver,
 	}
 
 	return registry
@@ -56,12 +75,15 @@ type registryImpl struct {
 	mutex            sync.RWMutex
 
 	roleMapperFactory permissions.RoleMapperFactory
+
+	clusterResolver tokens.ClusterResolver
 }
 
 func (r *registryImpl) Init() error {
 	r.providers = make(map[string]Provider)
 	err := r.store.ForEachAuthProvider(sac.WithAllAccess(context.Background()), func(storedValue *storage.AuthProvider) error {
 		// Construct the options for the provider, using the stored definition, and the defaults for previously stored objects.
+		//nolint:prealloc // Preallocating would not improve performance here
 		options := []ProviderOption{
 			WithStorageView(storedValue),
 			WithAttributeVerifier(storedValue),
@@ -350,6 +372,45 @@ func (r *registryImpl) issueTokenForResponse(ctx context.Context, provider Provi
 		tokenOpts = append(tokenOpts, tokens.WithExpiry(authResp.Expiration))
 	}
 	tokenOpts = append(tokenOpts, authResp.ExtraOpts...)
+	if features.ACMAccessControlDelegation.Enabled() {
+		roxClaims := tokens.RoxClaims{}
+		switch provider.Type() {
+		case OpenShiftTypeNameWithACMAccessControlDelegation:
+			roles, err := getRolesForOpenshiftResponse(ctx, authResp, r.clusterResolver)
+			if err != nil {
+				return nil, nil, err
+			}
+			roxClaims.InternalRoles = roles
+		default:
+			roxClaims.ExternalUser = authResp.Claims
+		}
+		token, err := provider.Issuer().Issue(ctx, roxClaims, tokenOpts...)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		var refreshCookie *http.Cookie
+		if authResp.RefreshToken != "" {
+			cookieData := refreshTokenCookieData{
+				ProviderType:     provider.Type(),
+				ProviderID:       provider.ID(),
+				RefreshTokenData: authResp.RefreshTokenData,
+			}
+			if encodedData, err := cookieData.Encode(); err != nil {
+				log.Errorf("failed to encode refresh token cookie data: %v", err)
+			} else {
+				refreshCookie = &http.Cookie{
+					Name:     RefreshTokenCookieName,
+					Value:    encodedData,
+					Path:     r.sessionURLPrefix(),
+					HttpOnly: true,
+					Secure:   true,
+					SameSite: http.SameSiteStrictMode,
+				}
+			}
+		}
+		return token, refreshCookie, nil
+	}
 	token, err := provider.Issuer().Issue(ctx, tokens.RoxClaims{ExternalUser: authResp.Claims}, tokenOpts...)
 	if err != nil {
 		return nil, nil, err
@@ -377,3 +438,47 @@ func (r *registryImpl) issueTokenForResponse(ctx context.Context, provider Provi
 	}
 	return token, refreshCookie, nil
 }
+
+func getRolesForOpenshiftResponse(
+	ctx context.Context,
+	authResp *AuthResponse,
+	clusterIDResolver tokens.ClusterResolver,
+) ([]*tokens.InternalRole, error) {
+	if authResp == nil {
+		return nil, errox.InvalidArgs.CausedBy("auth response should not be nil")
+	}
+	// Extract OpenShift Auth token
+	var tokenData oauth2.Token
+	err := json.Unmarshal([]byte(authResp.RefreshTokenData.RefreshToken), &tokenData)
+	if err != nil {
+		return nil, errox.InvalidArgs.CausedByf("failed to parse token: %v", err)
+	}
+	// Retrieve OpenShift cluster config
+	cfg, err := rest.InClusterConfig()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to get cluster config")
+	}
+	// Enrich the config with the OpenShift Auth Token
+	cfg.BearerToken = tokenData.AccessToken
+	// Clear BearerTokenFile so that BearerToken takes precedence.
+	// InClusterConfig() sets BearerTokenFile to the service account token,
+	// which would override the user's OAuth token we just set.
+	cfg.BearerTokenFile = ""
+	acmClientObj, err := acm.NewClientForConfig(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to instantiate ACM client")
+	}
+	roles, err := externalrolebroker.GetResolvedRolesFromACM(ctx, acmClientObj, clusterIDResolver)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to fetch role information")
+	}
+	return roles, nil
+}
+
+func isACMRoleDelegationProvider(provider Provider) bool {
+	switch provider.Type() {
+	case OpenShiftTypeNameWithACMAccessControlDelegation:
+		return true
+	}
+	return false
+}
diff --git a/pkg/auth/permissions/utils/role.go b/pkg/auth/permissions/utils/role.go
index 10dbae16aa404..15e9a8d7b127b 100644
--- a/pkg/auth/permissions/utils/role.go
+++ b/pkg/auth/permissions/utils/role.go
@@ -8,7 +8,7 @@ import (
 
 // Converts a slice of ResourceWithAccess to a slice of *v1.Permission.
 func resourcesWithAccessToPermissions(resourceWithAccess ...permissions.ResourceWithAccess) []*v1.Permission {
-	var perms []*v1.Permission
+	perms := make([]*v1.Permission, 0, len(resourceWithAccess))
 	for _, rAndA := range resourceWithAccess {
 		perms = append(perms, &v1.Permission{
 			Resource: string(rAndA.Resource.GetResource()),
diff --git a/pkg/auth/tokens/internal_role.go b/pkg/auth/tokens/internal_role.go
index ab2ceb96c6503..59f68ccf39344 100644
--- a/pkg/auth/tokens/internal_role.go
+++ b/pkg/auth/tokens/internal_role.go
@@ -1,12 +1,16 @@
 package tokens
 
 import (
+	"context"
 	"encoding/json"
 	"slices"
 	"strings"
 
+	"github.com/pkg/errors"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/sac/resources"
 	"github.com/stackrox/rox/pkg/set"
 )
 
@@ -193,3 +197,90 @@ func (r *InternalRole) GetAccessScope() *storage.SimpleAccessScope {
 		},
 	}
 }
+
+//go:generate mockgen-wrapper
+type ClusterResolver interface {
+	GetClusterID(ctx context.Context, name string) (string, bool, error)
+}
+
+// NewInternalRoleFromPermissionsAndScope instantiates an InternalRole object
+// based on the input PermissionSet and AccessScope.
+func NewInternalRoleFromPermissionsAndScope(
+	ctx context.Context,
+	roleName string,
+	permissions *storage.PermissionSet,
+	scope *storage.SimpleAccessScope,
+	clusterIDResolver ClusterResolver,
+) (*InternalRole, error) {
+	if clusterIDResolver == nil {
+		return nil, errors.New("missing cluster ID resolver")
+	}
+
+	output := &InternalRole{
+		RoleName: roleName,
+	}
+
+	// Fill permission set
+	reversedPermissionSet := make(map[storage.Access]set.StringSet)
+	for permission, access := range permissions.GetResourceToAccess() {
+		if _, accessFound := reversedPermissionSet[access]; !accessFound {
+			reversedPermissionSet[access] = set.NewStringSet()
+		}
+		permissionsForAccess := reversedPermissionSet[access]
+		permissionsForAccess.Add(permission)
+	}
+	output.Permissions = make(map[storage.Access][]string)
+	for access, permissionSet := range reversedPermissionSet {
+		output.Permissions[access] = permissionSet.AsSortedSlice(func(i, j string) bool {
+			return i < j
+		})
+	}
+
+	// Elevate to READ on Cluster resources solely for name-to-ID resolution; this does not expand the caller's derived permissions.
+	clusterIDResolutionCtx := sac.WithGlobalAccessScopeChecker(
+		ctx,
+		sac.AllowFixedScopes(
+			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
+			sac.ResourceScopeKeys(resources.Cluster),
+		),
+	)
+	// Resolve cluster scope
+	output.Clusters = make(ClusterScopes)
+	for _, clusterID := range scope.GetRules().GetIncludedClusterIds() {
+		if clusterID == "" {
+			continue
+		}
+		output.Clusters[clusterID] = []string{"*"}
+	}
+	for _, clusterName := range scope.GetRules().GetIncludedClusters() {
+		clusterID, found, err := clusterIDResolver.GetClusterID(clusterIDResolutionCtx, clusterName)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to resolve cluster ID")
+		}
+		if !found || clusterID == "" {
+			continue
+		}
+		output.Clusters[clusterID] = []string{"*"}
+	}
+	for _, namespaceRule := range scope.GetRules().GetIncludedNamespaces() {
+		ns := namespaceRule.GetNamespaceName()
+		clusterID := namespaceRule.GetClusterId()
+		if clusterID == "" {
+			clusterName := namespaceRule.GetClusterName()
+			idForName, found, err := clusterIDResolver.GetClusterID(clusterIDResolutionCtx, clusterName)
+			if err != nil {
+				return nil, errors.Wrap(err, "failed to resolve cluster ID")
+			}
+			if !found {
+				continue
+			}
+			clusterID = idForName
+		}
+		if clusterID == "" {
+			continue
+		}
+		output.Clusters[clusterID] = append(output.Clusters[clusterID], ns)
+	}
+
+	return output, nil
+}
diff --git a/pkg/auth/tokens/internal_role_test.go b/pkg/auth/tokens/internal_role_test.go
index 298d5ca30881c..bb590d64d4363 100644
--- a/pkg/auth/tokens/internal_role_test.go
+++ b/pkg/auth/tokens/internal_role_test.go
@@ -1,9 +1,11 @@
 package tokens
 
 import (
+	"context"
 	"encoding/json"
 	"testing"
 
+	"github.com/pkg/errors"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/fixtures/fixtureconsts"
 	"github.com/stackrox/rox/pkg/protoassert"
@@ -378,3 +380,443 @@ func TestInternalRoleJSONEncoding(t *testing.T) {
 		})
 	}
 }
+
+// mockClusterResolver is a test implementation of ClusterResolver
+type mockClusterResolver struct {
+	clusters map[string]string // map of cluster name -> cluster ID
+	err      error             // error to return from GetClusterID
+}
+
+func (m *mockClusterResolver) GetClusterID(ctx context.Context, name string) (string, bool, error) {
+	if m.err != nil {
+		return "", false, m.err
+	}
+	id, found := m.clusters[name]
+	return id, found, nil
+}
+
+func TestNewInternalRoleFromPermissionsAndScope(t *testing.T) {
+	const deploymentResource = "Deployment"
+	const imageResource = "Image"
+	const namespaceA = "namespace-a"
+	const namespaceB = "namespace-b"
+	const clusterNameDev = "dev-cluster"
+	const clusterNameProd = "prod-cluster"
+
+	for name, tc := range map[string]struct {
+		roleName      string
+		permissions   *storage.PermissionSet
+		scope         *storage.SimpleAccessScope
+		resolver      ClusterResolver
+		expectedRole  *InternalRole
+		expectedError string
+	}{
+		"Nil resolver returns error": {
+			roleName: "test-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{},
+			},
+			resolver:      nil,
+			expectedError: "missing cluster ID resolver",
+		},
+		"Empty permissions and scope": {
+			roleName: "empty-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{},
+			},
+			resolver: &mockClusterResolver{clusters: map[string]string{}},
+			expectedRole: &InternalRole{
+				RoleName:    "empty-role",
+				Permissions: map[storage.Access][]string{},
+				Clusters:    ClusterScopes{},
+			},
+		},
+		"Role with read permissions only": {
+			roleName: "reader-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+					imageResource:      storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{},
+			},
+			resolver: &mockClusterResolver{clusters: map[string]string{}},
+			expectedRole: &InternalRole{
+				RoleName: "reader-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource, imageResource},
+				},
+				Clusters: ClusterScopes{},
+			},
+		},
+		"Role with write permissions only": {
+			roleName: "writer-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_WRITE_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{},
+			},
+			resolver: &mockClusterResolver{clusters: map[string]string{}},
+			expectedRole: &InternalRole{
+				RoleName: "writer-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_WRITE_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{},
+			},
+		},
+		"Role with mixed read and write permissions": {
+			roleName: "mixed-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+					imageResource:      storage.Access_READ_WRITE_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{},
+			},
+			resolver: &mockClusterResolver{clusters: map[string]string{}},
+			expectedRole: &InternalRole{
+				RoleName: "mixed-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS:       {deploymentResource},
+					storage.Access_READ_WRITE_ACCESS: {imageResource},
+				},
+				Clusters: ClusterScopes{},
+			},
+		},
+		"Scope with cluster IDs only": {
+			roleName: "cluster-id-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedClusterIds: []string{fixtureconsts.Cluster1, fixtureconsts.Cluster2},
+				},
+			},
+			resolver: &mockClusterResolver{clusters: map[string]string{}},
+			expectedRole: &InternalRole{
+				RoleName: "cluster-id-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{
+					fixtureconsts.Cluster1: {"*"},
+					fixtureconsts.Cluster2: {"*"},
+				},
+			},
+		},
+		"Scope with cluster names that resolve": {
+			roleName: "cluster-name-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedClusters: []string{clusterNameDev, clusterNameProd},
+				},
+			},
+			resolver: &mockClusterResolver{
+				clusters: map[string]string{
+					clusterNameDev:  fixtureconsts.Cluster1,
+					clusterNameProd: fixtureconsts.Cluster2,
+				},
+			},
+			expectedRole: &InternalRole{
+				RoleName: "cluster-name-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{
+					fixtureconsts.Cluster1: {"*"},
+					fixtureconsts.Cluster2: {"*"},
+				},
+			},
+		},
+		"Scope with cluster names that don't resolve are skipped": {
+			roleName: "missing-cluster-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedClusters: []string{clusterNameDev, "unknown-cluster"},
+				},
+			},
+			resolver: &mockClusterResolver{
+				clusters: map[string]string{
+					clusterNameDev: fixtureconsts.Cluster1,
+					// "unknown-cluster" not in map
+				},
+			},
+			expectedRole: &InternalRole{
+				RoleName: "missing-cluster-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{
+					fixtureconsts.Cluster1: {"*"},
+					// unknown-cluster is skipped
+				},
+			},
+		},
+		"Cluster name resolution error propagates": {
+			roleName: "error-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedClusters: []string{clusterNameDev},
+				},
+			},
+			resolver: &mockClusterResolver{
+				err: errors.New("resolver error"),
+			},
+			expectedError: "failed to resolve cluster ID",
+		},
+		"Scope with namespace rules using cluster IDs": {
+			roleName: "namespace-id-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+						{
+							ClusterId:     fixtureconsts.Cluster1,
+							NamespaceName: namespaceA,
+						},
+						{
+							ClusterId:     fixtureconsts.Cluster1,
+							NamespaceName: namespaceB,
+						},
+					},
+				},
+			},
+			resolver: &mockClusterResolver{clusters: map[string]string{}},
+			expectedRole: &InternalRole{
+				RoleName: "namespace-id-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{
+					fixtureconsts.Cluster1: {namespaceA, namespaceB},
+				},
+			},
+		},
+		"Scope with namespace rules using cluster names": {
+			roleName: "namespace-name-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+						{
+							ClusterName:   clusterNameDev,
+							NamespaceName: namespaceA,
+						},
+						{
+							ClusterName:   clusterNameProd,
+							NamespaceName: namespaceB,
+						},
+					},
+				},
+			},
+			resolver: &mockClusterResolver{
+				clusters: map[string]string{
+					clusterNameDev:  fixtureconsts.Cluster1,
+					clusterNameProd: fixtureconsts.Cluster2,
+				},
+			},
+			expectedRole: &InternalRole{
+				RoleName: "namespace-name-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{
+					fixtureconsts.Cluster1: {namespaceA},
+					fixtureconsts.Cluster2: {namespaceB},
+				},
+			},
+		},
+		"Namespace with unresolved cluster name is skipped": {
+			roleName: "namespace-missing-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+						{
+							ClusterName:   clusterNameDev,
+							NamespaceName: namespaceA,
+						},
+						{
+							ClusterName:   "unknown-cluster",
+							NamespaceName: namespaceB,
+						},
+					},
+				},
+			},
+			resolver: &mockClusterResolver{
+				clusters: map[string]string{
+					clusterNameDev: fixtureconsts.Cluster1,
+					// "unknown-cluster" not in map
+				},
+			},
+			expectedRole: &InternalRole{
+				RoleName: "namespace-missing-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{
+					fixtureconsts.Cluster1: {namespaceA},
+					// namespace with unknown cluster is skipped
+				},
+			},
+		},
+		"Namespace cluster name resolution error propagates": {
+			roleName: "namespace-error-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+						{
+							ClusterName:   clusterNameDev,
+							NamespaceName: namespaceA,
+						},
+					},
+				},
+			},
+			resolver: &mockClusterResolver{
+				err: errors.New("namespace resolver error"),
+			},
+			expectedError: "failed to resolve cluster ID",
+		},
+		"Mixed scope with cluster IDs, cluster names, and namespace rules": {
+			roleName: "complex-scope-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+					imageResource:      storage.Access_READ_WRITE_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedClusterIds: []string{fixtureconsts.Cluster1},
+					IncludedClusters:   []string{clusterNameProd},
+					IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+						{
+							ClusterId:     fixtureconsts.Cluster3,
+							NamespaceName: namespaceA,
+						},
+					},
+				},
+			},
+			resolver: &mockClusterResolver{
+				clusters: map[string]string{
+					clusterNameProd: fixtureconsts.Cluster2,
+				},
+			},
+			expectedRole: &InternalRole{
+				RoleName: "complex-scope-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS:       {deploymentResource},
+					storage.Access_READ_WRITE_ACCESS: {imageResource},
+				},
+				Clusters: ClusterScopes{
+					fixtureconsts.Cluster1: {"*"},
+					fixtureconsts.Cluster2: {"*"},
+					fixtureconsts.Cluster3: {namespaceA},
+				},
+			},
+		},
+		"Namespace appends to existing cluster scope": {
+			roleName: "namespace-append-role",
+			permissions: &storage.PermissionSet{
+				ResourceToAccess: map[string]storage.Access{
+					deploymentResource: storage.Access_READ_ACCESS,
+				},
+			},
+			scope: &storage.SimpleAccessScope{
+				Rules: &storage.SimpleAccessScope_Rules{
+					IncludedClusterIds: []string{fixtureconsts.Cluster1},
+					IncludedNamespaces: []*storage.SimpleAccessScope_Rules_Namespace{
+						{
+							ClusterId:     fixtureconsts.Cluster1,
+							NamespaceName: namespaceA,
+						},
+					},
+				},
+			},
+			resolver: &mockClusterResolver{clusters: map[string]string{}},
+			expectedRole: &InternalRole{
+				RoleName: "namespace-append-role",
+				Permissions: map[storage.Access][]string{
+					storage.Access_READ_ACCESS: {deploymentResource},
+				},
+				Clusters: ClusterScopes{
+					// Cluster1 has both wildcard and namespace - appended
+					fixtureconsts.Cluster1: {"*", namespaceA},
+				},
+			},
+		},
+	} {
+		t.Run(name, func(it *testing.T) {
+			ctx := context.Background()
+			role, err := NewInternalRoleFromPermissionsAndScope(
+				ctx,
+				tc.roleName,
+				tc.permissions,
+				tc.scope,
+				tc.resolver,
+			)
+
+			if tc.expectedError != "" {
+				assert.Error(it, err)
+				assert.Contains(it, err.Error(), tc.expectedError)
+				return
+			}
+
+			assert.NoError(it, err)
+			assert.Equal(it, tc.expectedRole.RoleName, role.RoleName)
+			assert.Equal(it, tc.expectedRole.Permissions, role.Permissions)
+			assert.Equal(it, tc.expectedRole.Clusters, role.Clusters)
+		})
+	}
+}
diff --git a/pkg/auth/tokens/mocks/internal_role.go b/pkg/auth/tokens/mocks/internal_role.go
new file mode 100644
index 0000000000000..c1869b3987c09
--- /dev/null
+++ b/pkg/auth/tokens/mocks/internal_role.go
@@ -0,0 +1,57 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: internal_role.go
+//
+// Generated by this command:
+//
+//	mockgen -package mocks -destination mocks/internal_role.go -source internal_role.go
+//
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockClusterResolver is a mock of ClusterResolver interface.
+type MockClusterResolver struct {
+	ctrl     *gomock.Controller
+	recorder *MockClusterResolverMockRecorder
+	isgomock struct{}
+}
+
+// MockClusterResolverMockRecorder is the mock recorder for MockClusterResolver.
+type MockClusterResolverMockRecorder struct {
+	mock *MockClusterResolver
+}
+
+// NewMockClusterResolver creates a new mock instance.
+func NewMockClusterResolver(ctrl *gomock.Controller) *MockClusterResolver {
+	mock := &MockClusterResolver{ctrl: ctrl}
+	mock.recorder = &MockClusterResolverMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockClusterResolver) EXPECT() *MockClusterResolverMockRecorder {
+	return m.recorder
+}
+
+// GetClusterID mocks base method.
+func (m *MockClusterResolver) GetClusterID(ctx context.Context, name string) (string, bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterID", ctx, name)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetClusterID indicates an expected call of GetClusterID.
+func (mr *MockClusterResolverMockRecorder) GetClusterID(ctx, name any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterID", reflect.TypeOf((*MockClusterResolver)(nil).GetClusterID), ctx, name)
+}
diff --git a/pkg/booleanpolicy/evaluator/base_evaluators.go b/pkg/booleanpolicy/evaluator/base_evaluators.go
index 78fec49431158..d187c64eb5a64 100644
--- a/pkg/booleanpolicy/evaluator/base_evaluators.go
+++ b/pkg/booleanpolicy/evaluator/base_evaluators.go
@@ -252,7 +252,7 @@ func generateTimestampMatcher(value string, matchAll bool) (baseMatcherAndExtrac
 		}
 	}
 	return func(instance reflect.Value) []valueMatchedPair {
-		ts, ok := instance.Interface().(*protocompat.Timestamp)
+		ts, ok := reflect.TypeAssert[*protocompat.Timestamp](instance)
 		if !ok {
 			return nil
 		}
@@ -335,7 +335,7 @@ func generateBoolMatcher(value string, _ reflect.Type, matchAll bool) (baseMatch
 }
 
 func generateIntMatcher(value string, fieldType reflect.Type, matchAll bool) (baseMatcherAndExtractor, error) {
-	if enum, ok := reflect.Zero(fieldType).Interface().(protoreflect.ProtoEnum); ok {
+	if enum, ok := reflect.TypeAssert[protoreflect.ProtoEnum](reflect.Zero(fieldType)); ok {
 		return generateEnumMatcher(value, enum, matchAll)
 	}
 	if matchAll && value != "" {
diff --git a/pkg/booleanpolicy/evaluator/path_evaluators.go b/pkg/booleanpolicy/evaluator/path_evaluators.go
index 39d1688a81a11..58b4a0915d3ca 100644
--- a/pkg/booleanpolicy/evaluator/path_evaluators.go
+++ b/pkg/booleanpolicy/evaluator/path_evaluators.go
@@ -61,7 +61,9 @@ func takeInterfaceMetaStep(metaStep pathutil.MetaStep, evaluator fieldEvaluator)
 	return fieldEvaluatorFunc(func(value pathutil.AugmentedValue) (*fieldResult, bool) {
 		underlying := value.Underlying()
 		if underlying.IsNil() {
-			return nil, false
+			// Unset protobuf oneof (e.g. Scanner V4 not-fixable CVE: no fixed_by).
+			// Evaluate against the field zero value so empty-string queries can match.
+			return evaluator.Evaluate(value.WithUnderlying(reflect.Zero(metaStep.Type)))
 		}
 		nextValue := value.Elem()
 		if nextValue.Underlying().Kind() == reflect.Pointer {
diff --git a/pkg/booleanpolicy/evaluator/pathutil/augmented_obj.go b/pkg/booleanpolicy/evaluator/pathutil/augmented_obj.go
index 7f01338de7f50..2b1a8266b62b9 100644
--- a/pkg/booleanpolicy/evaluator/pathutil/augmented_obj.go
+++ b/pkg/booleanpolicy/evaluator/pathutil/augmented_obj.go
@@ -110,6 +110,10 @@ type AugmentedValue interface {
 	// It panics if Index(i) on the reflect.Value panics.
 	Index(int) AugmentedValue
 	PathFromRoot() *Path
+	// WithUnderlying returns a copy of this value with a different underlying
+	// reflect.Value, keeping the path from root and augment tree. Used when a
+	// protobuf oneof is unset so empty-string queries can still match.
+	WithUnderlying(newVal reflect.Value) AugmentedValue
 }
 
 type augmentedValue struct {
@@ -134,6 +138,12 @@ func (v *augmentedValue) Underlying() reflect.Value {
 	return v.underlying
 }
 
+func (v *augmentedValue) WithUnderlying(newVal reflect.Value) AugmentedValue {
+	cp := *v
+	cp.underlying = newVal
+	return &cp
+}
+
 func (v *augmentedValue) TakeStep(metaStep MetaStep) (AugmentedValue, bool) {
 	var newUnderlying reflect.Value
 	var found bool
diff --git a/pkg/booleanpolicy/evaluator/pathutil/augmented_obj_test.go b/pkg/booleanpolicy/evaluator/pathutil/augmented_obj_test.go
index 02693afaff65a..0b058afa45df8 100644
--- a/pkg/booleanpolicy/evaluator/pathutil/augmented_obj_test.go
+++ b/pkg/booleanpolicy/evaluator/pathutil/augmented_obj_test.go
@@ -1,6 +1,7 @@
 package pathutil
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -21,6 +22,11 @@ func TestAugmentedObj(t *testing.T) {
 	value := o.Value()
 	assert.Equal(t, topLevelObj, value.Underlying().Interface())
 
+	zeroed := value.WithUnderlying(reflect.ValueOf(""))
+	assert.Equal(t, "", zeroed.Underlying().Interface())
+	assert.Equal(t, value.PathFromRoot().String(), zeroed.PathFromRoot().String())
+	assert.Equal(t, topLevelObj, value.Underlying().Interface())
+
 	intObjValue, found := value.TakeStep(MetaStep{FieldName: "IntObj"})
 	assert.True(t, found)
 	assert.Equal(t, intObj, intObjValue.Underlying().Interface())
diff --git a/pkg/booleanpolicy/field_metadata.go b/pkg/booleanpolicy/field_metadata.go
index c6b3d88faa372..a25ee5c02a467 100644
--- a/pkg/booleanpolicy/field_metadata.go
+++ b/pkg/booleanpolicy/field_metadata.go
@@ -456,6 +456,16 @@ func initializeFieldMetadata() FieldMetadata {
 		[]RuntimeFieldType{}, negationForbidden, operatorsForbidden,
 		imageEnrichmentRequired)
 
+	f.registerFieldMetadataRegex(fieldnames.CisaKev,
+		querybuilders.ForCisaKev(),
+		violationmessages.VulnContextFields,
+		func(*validateConfiguration) *regexp.Regexp {
+			return booleanValueRegex
+		},
+		[]storage.EventSource{storage.EventSource_NOT_APPLICABLE},
+		[]RuntimeFieldType{}, negationForbidden, operatorsForbidden,
+		imageEnrichmentRequired)
+
 	f.registerFieldMetadataRegex(fieldnames.FixedBy,
 		querybuilders.ForFixedBy(),
 		violationmessages.VulnContextFields,
diff --git a/pkg/booleanpolicy/fieldnames/list.go b/pkg/booleanpolicy/fieldnames/list.go
index 8d221a60af76d..1ed39f99083fb 100644
--- a/pkg/booleanpolicy/fieldnames/list.go
+++ b/pkg/booleanpolicy/fieldnames/list.go
@@ -13,6 +13,7 @@ var (
 	AutomountServiceAccountToken   = newFieldName("Automount Service Account Token")
 	CVE                            = newFieldName("CVE")
 	CVSS                           = newFieldName("CVSS")
+	CisaKev                        = newFieldName("CISA KEV")
 	ContainerCPULimit              = newFieldName("Container CPU Limit")
 	ContainerCPURequest            = newFieldName("Container CPU Request")
 	ContainerMemLimit              = newFieldName("Container Memory Limit")
diff --git a/pkg/booleanpolicy/image_criteria_test.go b/pkg/booleanpolicy/image_criteria_test.go
index 17872b6ae139e..3bd89e42d5d6d 100644
--- a/pkg/booleanpolicy/image_criteria_test.go
+++ b/pkg/booleanpolicy/image_criteria_test.go
@@ -178,6 +178,191 @@ func (suite *ImageCriteriaTestSuite) TestFixableAndFixTimestampAvailableCriteria
 
 }
 
+func (suite *ImageCriteriaTestSuite) TestFixableCriteriaWithUnsetFixedBy() {
+	dep := &storage.Deployment{
+		Id: "MIXEDFIXABLEDEPID",
+		Containers: []*storage.Container{
+			{
+				Name:  "nginx",
+				Image: &storage.ContainerImage{Id: "MIXEDFIXABLESHA"},
+			},
+		},
+	}
+
+	img := &storage.Image{
+		Id:   "MIXEDFIXABLESHA",
+		Name: &storage.ImageName{FullName: "mixed-fixable"},
+		Scan: &storage.ImageScan{
+			Components: []*storage.EmbeddedImageScanComponent{
+				{Name: "openssl", Version: "1.2", Vulns: []*storage.EmbeddedVulnerability{
+					{
+						Cve:        "CVE-FIXABLE",
+						Cvss:       9,
+						Severity:   storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
+						SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "v1.2"},
+					},
+					{
+						Cve:      "CVE-UNFIXABLE",
+						Cvss:     8,
+						Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
+						// Scanner V4 leaves the oneof unset when there is no fix.
+					},
+					{
+						Cve:        "CVE-EMPTY-FIXEDBY",
+						Cvss:       7,
+						Severity:   storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY,
+						SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{},
+					},
+				}},
+			},
+		},
+	}
+	suite.addDepAndImages(dep, img)
+
+	allCVEs := []string{"CVE-FIXABLE", "CVE-UNFIXABLE", "CVE-EMPTY-FIXEDBY"}
+
+	for name, tc := range map[string]struct {
+		policy       *storage.Policy
+		expectedCVEs []string
+	}{
+		"fixable true matches only CVEs with a fix version": {
+			policy:       policyWithSingleKeyValue(fieldnames.Fixable, "true", false),
+			expectedCVEs: []string{"CVE-FIXABLE"},
+		},
+		"fixable false matches unset and empty FixedBy": {
+			policy:       policyWithSingleKeyValue(fieldnames.Fixable, "false", false),
+			expectedCVEs: []string{"CVE-UNFIXABLE", "CVE-EMPTY-FIXEDBY"},
+		},
+		"negated Fixed By matches not-fixable CVEs": {
+			policy:       policyWithSingleKeyValue(fieldnames.FixedBy, "v1.2", true),
+			expectedCVEs: []string{"CVE-UNFIXABLE", "CVE-EMPTY-FIXEDBY"},
+		},
+		"fixable false combined with CVE stays linked to that CVE": {
+			policy: policyWithGroups(storage.EventSource_NOT_APPLICABLE,
+				policyGroupWithSingleKeyValue(fieldnames.Fixable, "false", false),
+				policyGroupWithSingleKeyValue(fieldnames.CVE, "CVE-UNFIXABLE", false),
+			),
+			expectedCVEs: []string{"CVE-UNFIXABLE"},
+		},
+		// Default policy "Fixable CVSS >= 7" stores Fixed By: .*, rewritten to .+ at match time.
+		"fixed by .* with CVSS >= 7 still matches only the fixable CVE": {
+			policy: policyWithGroups(storage.EventSource_NOT_APPLICABLE,
+				policyGroupWithSingleKeyValue(fieldnames.FixedBy, ".*", false),
+				policyGroupWithSingleKeyValue(fieldnames.CVSS, ">= 7", false),
+			),
+			expectedCVEs: []string{"CVE-FIXABLE"},
+		},
+	} {
+		suite.Run(name, func() {
+			expected := set.NewFrozenStringSet(tc.expectedCVEs...)
+
+			depMatcher, err := BuildDeploymentMatcher(tc.policy)
+			suite.Require().NoError(err)
+			depViolations, err := depMatcher.MatchDeployment(nil, enhancedDeployment(dep, suite.getImagesForDeployment(dep)))
+			suite.Require().NoError(err)
+			assertFixableCVEMatches(suite.T(), depViolations, allCVEs, expected)
+
+			imgMatcher, err := BuildImageMatcher(tc.policy)
+			suite.Require().NoError(err)
+			imgViolations, err := imgMatcher.MatchImage(nil, img)
+			suite.Require().NoError(err)
+			assertFixableCVEMatches(suite.T(), imgViolations, allCVEs, expected)
+		})
+	}
+}
+
+// TestCustomerFixableNotYetFixableOnMixedCVEDeployment reproduces the customer-reported regression where a
+// "Fixable → CVE is not yet fixable" policy (fieldnames.Fixable = "false") returned no violations in Policy
+// Preview even when the deployment's image contained unfixable CVEs (SetFixedBy unset, Scanner V4 style).
+// The test runs both the fixable=true and fixable=false policies against the same single deployment so that the
+// side-by-side comparison that exposed the bug is explicit.
+func (suite *ImageCriteriaTestSuite) TestCustomerFixableNotYetFixableOnMixedCVEDeployment() {
+	const (
+		fixableCVE   = "CVE-CUSTOMER-FIXABLE"
+		unfixableCVE = "CVE-CUSTOMER-UNFIXABLE"
+	)
+
+	dep := &storage.Deployment{
+		Id: "CUSTMIXEDDEPID",
+		Containers: []*storage.Container{
+			{
+				Name:  "app",
+				Image: &storage.ContainerImage{Id: "CUSTMIXEDIMGSHA"},
+			},
+		},
+	}
+
+	img := &storage.Image{
+		Id:   "CUSTMIXEDIMGSHA",
+		Name: &storage.ImageName{FullName: "registry.example.com/app:latest"},
+		Scan: &storage.ImageScan{
+			Components: []*storage.EmbeddedImageScanComponent{
+				{Name: "openssl", Version: "3.0", Vulns: []*storage.EmbeddedVulnerability{
+					{
+						Cve:        fixableCVE,
+						Cvss:       9,
+						Severity:   storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
+						SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "v1.2"},
+					},
+					{
+						Cve:      unfixableCVE,
+						Cvss:     8,
+						Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
+						// Scanner V4 leaves SetFixedBy nil when no fix is available.
+					},
+				}},
+			},
+		},
+	}
+	suite.addDepAndImages(dep, img)
+
+	ed := enhancedDeployment(dep, suite.getImagesForDeployment(dep))
+
+	suite.Run("fixable=true matches only the fixable CVE", func() {
+		matcher, err := BuildDeploymentMatcher(policyWithSingleKeyValue(fieldnames.Fixable, "true", false))
+		suite.Require().NoError(err)
+		violations, err := matcher.MatchDeployment(nil, ed)
+		suite.Require().NoError(err)
+		suite.Require().Len(violations.AlertViolations, 1)
+		suite.Contains(violations.AlertViolations[0].GetMessage(), fixableCVE,
+			"fixable=true must produce a violation for the fixable CVE")
+		suite.NotContains(violations.AlertViolations[0].GetMessage(), unfixableCVE,
+			"fixable=true must not mention the unfixable CVE")
+	})
+
+	suite.Run("fixable=false matches only the not-yet-fixable CVE (regression)", func() {
+		matcher, err := BuildDeploymentMatcher(policyWithSingleKeyValue(fieldnames.Fixable, "false", false))
+		suite.Require().NoError(err)
+		violations, err := matcher.MatchDeployment(nil, ed)
+		suite.Require().NoError(err)
+		suite.Require().Len(violations.AlertViolations, 1,
+			"fixable=false must produce exactly one violation for the CVE with no fix (was zero before the fix)")
+		suite.Contains(violations.AlertViolations[0].GetMessage(), unfixableCVE,
+			"fixable=false must produce a violation for the not-yet-fixable CVE")
+		suite.NotContains(violations.AlertViolations[0].GetMessage(), fixableCVE,
+			"fixable=false must not mention the fixable CVE")
+	})
+}
+
+func assertFixableCVEMatches(t *testing.T, violations Violations, allCVEs []string, expected set.FrozenStringSet) {
+	t.Helper()
+	require.Len(t, violations.AlertViolations, expected.Cardinality())
+	for _, cve := range allCVEs {
+		var found bool
+		for _, v := range violations.AlertViolations {
+			if strings.Contains(v.GetMessage(), cve) {
+				found = true
+				break
+			}
+		}
+		if expected.Contains(cve) {
+			assert.True(t, found, "expected a violation mentioning %s, got %v", cve, violations.AlertViolations)
+			continue
+		}
+		assert.False(t, found, "did not expect a violation mentioning %s, got %v", cve, violations.AlertViolations)
+	}
+}
+
 func (suite *ImageCriteriaTestSuite) TestDaysSinceCVEPublishedCriteria() {
 	heartbleedDep := &storage.Deployment{
 		Id: "HEARTBLEEDDEPID",
diff --git a/pkg/booleanpolicy/query_to_field_value_mappers.go b/pkg/booleanpolicy/query_to_field_value_mappers.go
index 92164a4d1e8d7..7700f4b9e74ed 100644
--- a/pkg/booleanpolicy/query_to_field_value_mappers.go
+++ b/pkg/booleanpolicy/query_to_field_value_mappers.go
@@ -165,7 +165,7 @@ func invertBooleanMap(searchTerms []string) ([]string, bool) {
 }
 
 func leftRightCompoundMap(searchTerms []string) ([]string, bool) {
-	var mustBeCompound []string
+	mustBeCompound := make([]string, 0, len(searchTerms))
 	for _, term := range searchTerms {
 		if !strings.Contains(term, "=") {
 			term = term + "="
diff --git a/pkg/booleanpolicy/querybuilders/special_cases.go b/pkg/booleanpolicy/querybuilders/special_cases.go
index ae398dfefd805..a2ce136a87c1d 100644
--- a/pkg/booleanpolicy/querybuilders/special_cases.go
+++ b/pkg/booleanpolicy/querybuilders/special_cases.go
@@ -196,6 +196,17 @@ func mapFixedByValue(s string) string {
 	return valueToStringRegex(s)
 }
 
+// ForCisaKev returns a query builder for whether a CVE is in the CISA KEV catalog.
+func ForCisaKev() QueryBuilder {
+	return wrapForVulnMgmt(func(group *storage.PolicyGroup) []*query.FieldQuery {
+		return []*query.FieldQuery{
+			fieldQueryFromGroup(group, search.CisaKev, func(s string) string {
+				return s
+			}),
+		}
+	})
+}
+
 // ForImageSignatureVerificationStatus returns a query builder for Image
 // Signature Verification Status.
 func ForImageSignatureVerificationStatus() QueryBuilder {
diff --git a/pkg/booleanpolicy/violationmessages/printer.go b/pkg/booleanpolicy/violationmessages/printer.go
index 34a72e30b3bb5..04b574754cebf 100644
--- a/pkg/booleanpolicy/violationmessages/printer.go
+++ b/pkg/booleanpolicy/violationmessages/printer.go
@@ -41,6 +41,7 @@ var (
 		fieldnames.EnvironmentVariable:            {{required: set.NewStringSet(augmentedobjs.EnvironmentVarCustomTag), printerFuncKey: printer.EnvKey}},
 		fieldnames.ExposedNodePort:                {{required: set.NewStringSet(search.ExposedNodePort.String()), printerFuncKey: printer.NodePortKey}},
 		fieldnames.ExposedPort:                    {{required: set.NewStringSet(search.Port.String()), printerFuncKey: printer.PortKey}},
+		fieldnames.CisaKev:                        {{required: set.NewStringSet(search.CVE.String()), printerFuncKey: printer.CveKey}},
 		fieldnames.Fixable:                        {{required: set.NewStringSet(search.CVE.String()), printerFuncKey: printer.CveKey}},
 		fieldnames.FixedBy:                        {{required: set.NewStringSet(search.CVE.String()), printerFuncKey: printer.CveKey}},
 		fieldnames.HostIPC:                        {{required: set.NewStringSet(search.HostIPC.String()), printerFuncKey: printer.HostIPCKey}},
diff --git a/pkg/centralsensor/caps_list.go b/pkg/centralsensor/caps_list.go
index 26f34c65e40f8..e594c6fd237bf 100644
--- a/pkg/centralsensor/caps_list.go
+++ b/pkg/centralsensor/caps_list.go
@@ -105,4 +105,13 @@ const (
 	// InitContainerSupport identifies the capability of Sensor to extract init containers from pod specs
 	// and of Central to handle init container data in deployments.
 	InitContainerSupport = "InitContainerSupport"
+
+	// VirtualMachineTelemetryCap lets Central distinguish "VM scanning off on
+	// a new Sensor" from "old Sensor that predates VM telemetry fields."
+	VirtualMachineTelemetryCap SensorCapability = "VirtualMachineTelemetry"
+
+	// WorkloadKindExclusionCap identifies the capability of Sensor to honor
+	// Exclusion.exclude_by_kind rules. Central strips those rules when syncing
+	// policies to Sensors that lack this capability.
+	WorkloadKindExclusionCap SensorCapability = "WorkloadKindExclusion"
 )
diff --git a/pkg/certgen/scanner.go b/pkg/certgen/scanner.go
index 546777fc3b1be..0d136202c456e 100644
--- a/pkg/certgen/scanner.go
+++ b/pkg/certgen/scanner.go
@@ -8,6 +8,7 @@ import (
 // The issued cert and key are added to the passed in fileMap.
 // It is extracted out to avoid duplicating the generating code and the file names between central and roxctl,
 // and is not intended to be more generally reusable.
+// TODO(ROX-36705): To remove.
 func IssueScannerCerts(fileMap map[string][]byte, ca mtls.CA, opts ...mtls.IssueCertOption) error {
 	return IssueOtherServiceCerts(fileMap, ca, []mtls.Subject{mtls.ScannerSubject, mtls.ScannerDBSubject}, opts...)
 }
diff --git a/pkg/clientconn/roxctl_command_header.go b/pkg/clientconn/roxctl_command_header.go
index 80dd0bddb54d5..16750449bc5dc 100644
--- a/pkg/clientconn/roxctl_command_header.go
+++ b/pkg/clientconn/roxctl_command_header.go
@@ -12,3 +12,8 @@ const RoxctlCommandIndexHeader = "Rh-Roxctl-Command-Index"
 // ExecutionEnvironment is the HTTP header name with the custom execution
 // environment string. Can be supplied by roxctl, or any other API client.
 const ExecutionEnvironment = "Rh-Execution-Environment"
+
+// CentralVersionHeader is the gRPC response metadata key carrying the
+// Central version. Set by Central for authenticated requests so that
+// clients (e.g. roxctl) can detect version skew without an extra RPC.
+const CentralVersionHeader = "Rh-Central-Version"
diff --git a/pkg/cloudproviders/gcp/auth/cred_manager_impl.go b/pkg/cloudproviders/gcp/auth/cred_manager_impl.go
index f7d28696c813e..c90549952271a 100644
--- a/pkg/cloudproviders/gcp/auth/cred_manager_impl.go
+++ b/pkg/cloudproviders/gcp/auth/cred_manager_impl.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"bytes"
 	"context"
+	"slices"
 
 	artifactv1 "cloud.google.com/go/artifactregistry/apiv1"
 	securitycenterv1 "cloud.google.com/go/securitycenter/apiv1"
@@ -108,9 +109,11 @@ func (c *gcpCredentialsManagerImpl) GetCredentials(ctx context.Context) (*google
 		)
 	}
 
-	scopes := []string{storagev1.CloudPlatformScope}
-	scopes = append(scopes, artifactv1.DefaultAuthScopes()...)
-	scopes = append(scopes, securitycenterv1.DefaultAuthScopes()...)
+	scopes := slices.Concat(
+		[]string{storagev1.CloudPlatformScope},
+		artifactv1.DefaultAuthScopes(),
+		securitycenterv1.DefaultAuthScopes(),
+	)
 
 	c.mutex.RLock()
 	defer c.mutex.RUnlock()
diff --git a/pkg/clusterhealth/status.go b/pkg/clusterhealth/status.go
index 1d451ca4aaf36..a5fe930db215d 100644
--- a/pkg/clusterhealth/status.go
+++ b/pkg/clusterhealth/status.go
@@ -121,6 +121,16 @@ func PopulateLocalScannerStatus(localScannerHealthInfo *storage.ScannerHealthInf
 		return storage.ClusterHealthStatus_UNINITIALIZED
 	}
 
+	// A non-nil ScannerHealthInfo means local image scanning is enabled on the secured
+	// cluster. If Sensor could not gather scanner health it reports the reason(s) via
+	// StatusErrors and leaves the pod counts unset, e.g. a misconfiguration (local scanning
+	// enabled but Scanner V4 is not) or a missing scanner deployment. Reporting UNHEALTHY
+	// distinguishes this "enabled but broken" state from the "not installed" case above and
+	// surfaces the problem to the user.
+	if len(localScannerHealthInfo.GetStatusErrors()) > 0 {
+		return storage.ClusterHealthStatus_UNHEALTHY
+	}
+
 	desiredPods := localScannerHealthInfo.GetTotalDesiredAnalyzerPods()
 	readyPods := localScannerHealthInfo.GetTotalReadyAnalyzerPods()
 
diff --git a/pkg/clusterhealth/status_test.go b/pkg/clusterhealth/status_test.go
index 440e0537497b9..4f6228e4cc3bb 100644
--- a/pkg/clusterhealth/status_test.go
+++ b/pkg/clusterhealth/status_test.go
@@ -270,3 +270,88 @@ func TestOverallHealth(t *testing.T) {
 		})
 	}
 }
+
+func TestPopulateLocalScannerStatus(t *testing.T) {
+	cases := map[string]struct {
+		scannerHealthInfo *storage.ScannerHealthInfo
+		expected          storage.ClusterHealthStatus_HealthStatusLabel
+	}{
+		"nil: local scanning not enabled (optional component)": {
+			scannerHealthInfo: nil,
+			expected:          storage.ClusterHealthStatus_UNINITIALIZED,
+		},
+		"status errors: enabled but misconfigured (no scanner v4)": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{
+				StatusErrors: []string{"local image scanning is enabled but Scanner V4 is not enabled"},
+			},
+			expected: storage.ClusterHealthStatus_UNHEALTHY,
+		},
+		"status errors take precedence over pod counts": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{
+				StatusErrors:                []string{"unable to find scanner deployment"},
+				TotalDesiredAnalyzerPodsOpt: analyzerPodsDesired(3),
+				TotalReadyAnalyzerPodsOpt:   analyzerPodsReady(3),
+				TotalReadyDbPodsOpt:         dbPodsReady(1),
+			},
+			expected: storage.ClusterHealthStatus_UNHEALTHY,
+		},
+		"no pod counts, no errors: uninitialized": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{},
+			expected:          storage.ClusterHealthStatus_UNINITIALIZED,
+		},
+		"desired analyzer pods zero: uninitialized": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{
+				TotalDesiredAnalyzerPodsOpt: analyzerPodsDesired(0),
+				TotalReadyAnalyzerPodsOpt:   analyzerPodsReady(0),
+			},
+			expected: storage.ClusterHealthStatus_UNINITIALIZED,
+		},
+		"no ready db pods: unhealthy": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{
+				TotalDesiredAnalyzerPodsOpt: analyzerPodsDesired(3),
+				TotalReadyAnalyzerPodsOpt:   analyzerPodsReady(3),
+				TotalReadyDbPodsOpt:         dbPodsReady(0),
+			},
+			expected: storage.ClusterHealthStatus_UNHEALTHY,
+		},
+		"all analyzer and db pods ready: healthy": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{
+				TotalDesiredAnalyzerPodsOpt: analyzerPodsDesired(3),
+				TotalReadyAnalyzerPodsOpt:   analyzerPodsReady(3),
+				TotalReadyDbPodsOpt:         dbPodsReady(1),
+			},
+			expected: storage.ClusterHealthStatus_HEALTHY,
+		},
+		"some analyzer pods not ready: degraded": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{
+				TotalDesiredAnalyzerPodsOpt: analyzerPodsDesired(3),
+				TotalReadyAnalyzerPodsOpt:   analyzerPodsReady(2),
+				TotalReadyDbPodsOpt:         dbPodsReady(1),
+			},
+			expected: storage.ClusterHealthStatus_DEGRADED,
+		},
+		"most analyzer pods not ready: unhealthy": {
+			scannerHealthInfo: &storage.ScannerHealthInfo{
+				TotalDesiredAnalyzerPodsOpt: analyzerPodsDesired(3),
+				TotalReadyAnalyzerPodsOpt:   analyzerPodsReady(1),
+				TotalReadyDbPodsOpt:         dbPodsReady(1),
+			},
+			expected: storage.ClusterHealthStatus_UNHEALTHY,
+		},
+	}
+	for name, c := range cases {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, c.expected, PopulateLocalScannerStatus(c.scannerHealthInfo))
+		})
+	}
+}
+
+func analyzerPodsDesired(num int32) *storage.ScannerHealthInfo_TotalDesiredAnalyzerPods {
+	return &storage.ScannerHealthInfo_TotalDesiredAnalyzerPods{TotalDesiredAnalyzerPods: num}
+}
+func analyzerPodsReady(num int32) *storage.ScannerHealthInfo_TotalReadyAnalyzerPods {
+	return &storage.ScannerHealthInfo_TotalReadyAnalyzerPods{TotalReadyAnalyzerPods: num}
+}
+func dbPodsReady(num int32) *storage.ScannerHealthInfo_TotalReadyDbPods {
+	return &storage.ScannerHealthInfo_TotalReadyDbPods{TotalReadyDbPods: num}
+}
diff --git a/pkg/compliance/checks/common/file.go b/pkg/compliance/checks/common/file.go
index de59f5050ad2a..76ead2f4361e5 100644
--- a/pkg/compliance/checks/common/file.go
+++ b/pkg/compliance/checks/common/file.go
@@ -34,7 +34,7 @@ func RecursiveOwnershipCheckIfDirExists(dir, user, group string) *standards.Chec
 
 // CheckRecursiveOwnership checks the files against the passed user and group
 func CheckRecursiveOwnership(f *compliance.File, user, group string) []*storage.ComplianceResultValue_Evidence {
-	var results []*storage.ComplianceResultValue_Evidence
+	var results []*storage.ComplianceResultValue_Evidence //nolint:prealloc // recursive function with unpredictable size
 	results = append(results, ownershipCheck(f, user, group)...)
 	for _, f := range f.GetChildren() {
 		results = append(results, CheckRecursiveOwnership(f, user, group)...)
diff --git a/pkg/concurrency/value_stream.go b/pkg/concurrency/value_stream.go
index 354be592cb9d3..c106a7d9faafb 100644
--- a/pkg/concurrency/value_stream.go
+++ b/pkg/concurrency/value_stream.go
@@ -101,7 +101,7 @@ func (i *valueStreamIterBase[T]) Done() <-chan struct{} {
 	return i.nextC
 }
 
-func (*valueStreamIterBase[T]) isValueStreamIter(T) {} //nolint:unused // This is required for generic magic
+func (*valueStreamIterBase[T]) isValueStreamIter(T) {}
 
 type valueStreamStrictIter[T any] struct {
 	valueStreamIterBase[T]
diff --git a/pkg/dblock/lock_ids.go b/pkg/dblock/lock_ids.go
index 8514ec0552d59..496f15210b408 100644
--- a/pkg/dblock/lock_ids.go
+++ b/pkg/dblock/lock_ids.go
@@ -3,6 +3,7 @@ package dblock
 // Advisory lock IDs are random int64 values generated via crypto/rand.
 // New IDs must not collide with existing ones.
 const (
+	MigrationLockID       int64 = 7_517_845_236_103_920_641
 	PruningGCLockID       int64 = 7_293_581_046_138_294_017
 	ReportSchedulerLockID int64 = 4_618_739_250_183_647_293
 )
diff --git a/pkg/declarativeconfig/context.go b/pkg/declarativeconfig/context.go
index b507bbc34d561..658247c115a93 100644
--- a/pkg/declarativeconfig/context.go
+++ b/pkg/declarativeconfig/context.go
@@ -10,6 +10,7 @@ type originCheckerKey struct{}
 
 const allowOnlyDeclarativeOperations = 0
 const allowModifyDeclarativeOrImperative = 1
+const allowDefaultOperations = 2
 
 // WithModifyDeclarativeResource returns a context that is a child of the given context and allows to modify
 // proto messages with the traits origin == DECLARATIVE.
@@ -23,6 +24,13 @@ func WithModifyDeclarativeOrImperative(ctx context.Context) context.Context {
 	return context.WithValue(ctx, originCheckerKey{}, allowModifyDeclarativeOrImperative)
 }
 
+// WithModifyDefaultResource returns a context that allows creating and modifying
+// proto messages with the traits origin == DEFAULT. This is intended for internal
+// seeding of system-managed objects that should not be user-modifiable.
+func WithModifyDefaultResource(ctx context.Context) context.Context {
+	return context.WithValue(ctx, originCheckerKey{}, allowDefaultOperations)
+}
+
 // ResourceWithTraits is a common interface for proto messages containing storage.Traits.
 type ResourceWithTraits interface {
 	GetTraits() *storage.Traits
@@ -37,11 +45,14 @@ func HasModifyDeclarativeResourceKey(ctx context.Context) bool {
 
 // CanModifyResource returns whether context holder is allowed to modify resource.
 func CanModifyResource(ctx context.Context, resource ResourceWithTraits) bool {
-	if ctx.Value(originCheckerKey{}) == allowOnlyDeclarativeOperations {
+	switch ctx.Value(originCheckerKey{}) {
+	case allowOnlyDeclarativeOperations:
 		return IsDeclarativeOrigin(resource)
-	}
-	if ctx.Value(originCheckerKey{}) == allowModifyDeclarativeOrImperative {
+	case allowModifyDeclarativeOrImperative:
 		return IsDeclarativeOrigin(resource) || IsImperativeOrigin(resource) || IsEphemeralOrigin(resource)
+	case allowDefaultOperations:
+		return IsDefaultOrigin(resource)
+	default:
+		return IsImperativeOrigin(resource) || IsEphemeralOrigin(resource)
 	}
-	return IsImperativeOrigin(resource) || IsEphemeralOrigin(resource)
 }
diff --git a/pkg/declarativeconfig/context_test.go b/pkg/declarativeconfig/context_test.go
index fd850da97f5b4..8444aedc0de60 100644
--- a/pkg/declarativeconfig/context_test.go
+++ b/pkg/declarativeconfig/context_test.go
@@ -24,6 +24,7 @@ func TestContext(t *testing.T) {
 	ctx := context.Background()
 	declarativeCtx := WithModifyDeclarativeResource(ctx)
 	declarativeOrImperativeCtx := WithModifyDeclarativeOrImperative(ctx)
+	defaultCtx := WithModifyDefaultResource(ctx)
 	// 1.1. empty context can modify imperative origin
 	assert.True(t, CanModifyResource(ctx, imperativeResource))
 	// 1.2. empty context can modify ephemeral origin
@@ -48,4 +49,10 @@ func TestContext(t *testing.T) {
 	assert.True(t, CanModifyResource(declarativeOrImperativeCtx, ephemeralResource))
 	// 9. context.WithModifyDeclarativeOrImperative can't modify default origin
 	assert.False(t, CanModifyResource(declarativeOrImperativeCtx, defaultResource))
+	// 10. context.WithModifyDefaultResource can modify default origin
+	assert.True(t, CanModifyResource(defaultCtx, defaultResource))
+	// 11.1. context.WithModifyDefaultResource can't modify imperative origin
+	assert.False(t, CanModifyResource(defaultCtx, imperativeResource))
+	// 11.2. context.WithModifyDefaultResource can't modify declarative origin
+	assert.False(t, CanModifyResource(defaultCtx, declarativeResource))
 }
diff --git a/pkg/declarativeconfig/origin.go b/pkg/declarativeconfig/origin.go
index f23b14a6a7cd0..7b406e0a7bd37 100644
--- a/pkg/declarativeconfig/origin.go
+++ b/pkg/declarativeconfig/origin.go
@@ -28,3 +28,8 @@ func IsEphemeralOrigin(resource ResourceWithTraits) bool {
 func IsImperativeOrigin(resource ResourceWithTraits) bool {
 	return resource.GetTraits().GetOrigin() == storage.Traits_IMPERATIVE
 }
+
+// IsDefaultOrigin returns whether origin of resource is default or not.
+func IsDefaultOrigin(resource ResourceWithTraits) bool {
+	return resource.GetTraits().GetOrigin() == storage.Traits_DEFAULT
+}
diff --git a/pkg/declarativeconfig/transform/access_scope.go b/pkg/declarativeconfig/transform/access_scope.go
index 82e41c474edbf..8ca08527b1d96 100644
--- a/pkg/declarativeconfig/transform/access_scope.go
+++ b/pkg/declarativeconfig/transform/access_scope.go
@@ -87,7 +87,7 @@ func includedNamespacesFromScopeConfig(scope *declarativeconfig.AccessScope) []*
 }
 
 func labelSelectorsFromScopeConfig(labelSelectors []declarativeconfig.LabelSelector) ([]*storage.SetBasedLabelSelector, error) {
-	var setBasedLabelSelectors []*storage.SetBasedLabelSelector
+	setBasedLabelSelectors := make([]*storage.SetBasedLabelSelector, 0, len(labelSelectors))
 	var labelSelectorErrs *multierror.Error
 	for _, ls := range labelSelectors {
 		reqs := make([]*storage.SetBasedLabelSelector_Requirement, 0, len(ls.Requirements))
diff --git a/pkg/delegatedregistry/delegator.go b/pkg/delegatedregistry/delegator.go
index a22466ebb3f50..0b22df893ad40 100644
--- a/pkg/delegatedregistry/delegator.go
+++ b/pkg/delegatedregistry/delegator.go
@@ -28,5 +28,5 @@ type Delegator interface {
 
 	// ValidateCluster returns nil if a cluster is a valid target for delegation, returns an
 	// error otherwise.
-	ValidateCluster(clusterID string) error
+	ValidateCluster(ctx context.Context, clusterID string) error
 }
diff --git a/pkg/delegatedregistry/mocks/delegator.go b/pkg/delegatedregistry/mocks/delegator.go
index b9e01fe6b7022..6caf1c8279489 100644
--- a/pkg/delegatedregistry/mocks/delegator.go
+++ b/pkg/delegatedregistry/mocks/delegator.go
@@ -88,15 +88,15 @@ func (mr *MockDelegatorMockRecorder) GetDelegateClusterID(ctx, imgName any) *gom
 }
 
 // ValidateCluster mocks base method.
-func (m *MockDelegator) ValidateCluster(clusterID string) error {
+func (m *MockDelegator) ValidateCluster(ctx context.Context, clusterID string) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ValidateCluster", clusterID)
+	ret := m.ctrl.Call(m, "ValidateCluster", ctx, clusterID)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // ValidateCluster indicates an expected call of ValidateCluster.
-func (mr *MockDelegatorMockRecorder) ValidateCluster(clusterID any) *gomock.Call {
+func (mr *MockDelegatorMockRecorder) ValidateCluster(ctx, clusterID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateCluster", reflect.TypeOf((*MockDelegator)(nil).ValidateCluster), clusterID)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateCluster", reflect.TypeOf((*MockDelegator)(nil).ValidateCluster), ctx, clusterID)
 }
diff --git a/pkg/detection/compiled_policy.go b/pkg/detection/compiled_policy.go
index 9fedc810495f5..351f03c45caf6 100644
--- a/pkg/detection/compiled_policy.go
+++ b/pkg/detection/compiled_policy.go
@@ -9,9 +9,12 @@ import (
 	"github.com/stackrox/rox/pkg/booleanpolicy/augmentedobjs"
 	"github.com/stackrox/rox/pkg/booleanpolicy/filter"
 	"github.com/stackrox/rox/pkg/booleanpolicy/policyfields"
+	"github.com/stackrox/rox/pkg/features"
+	"github.com/stackrox/rox/pkg/kubernetes"
 	"github.com/stackrox/rox/pkg/policies"
 	"github.com/stackrox/rox/pkg/regexutils"
 	"github.com/stackrox/rox/pkg/scopecomp"
+	"github.com/stackrox/rox/pkg/set"
 )
 
 // CompiledPolicy is a compiled policy, which means it can match a policy, as well as check whether a policy is applicable.
@@ -46,11 +49,14 @@ func newCompiledPolicy(policy *storage.Policy, clusterLabelProvider scopecomp.Cl
 
 	exclusions := make([]*compiledExclusion, 0, len(policy.GetExclusions()))
 	for _, w := range policy.GetExclusions() {
-		w, err := newCompiledExclusion(w)
+		if w.GetExcludeByKind() != nil && !features.PolicyWorkloadKindExclusion.Enabled() {
+			continue
+		}
+		cx, err := newCompiledExclusion(w)
 		if err != nil {
 			return nil, errors.Wrapf(err, "compiling exclusion list %+v for policy %s", w, policy.GetName())
 		}
-		exclusions = append(exclusions, w)
+		exclusions = append(exclusions, cx)
 	}
 
 	scopes := make([]*scopecomp.CompiledScope, 0, len(policy.GetScope()))
@@ -477,6 +483,7 @@ type compiledExclusion struct {
 	exclusion             *storage.Exclusion
 	deploymentNameMatcher regexutils.StringMatcher
 	cs                    *scopecomp.CompiledScope
+	excludedKinds         set.Set[string]
 }
 
 type alwaysFalseMatcher struct{}
@@ -489,6 +496,18 @@ func newCompiledExclusion(exclusion *storage.Exclusion) (*compiledExclusion, err
 	cx := &compiledExclusion{
 		exclusion: exclusion,
 	}
+	if exclusion.GetExcludeByKind() != nil {
+		if features.PolicyWorkloadKindExclusion.Enabled() {
+			excludedKinds, err := kubernetesKindsForExcludeByKind(exclusion.GetExcludeByKind())
+			if err != nil {
+				return nil, err
+			}
+			cx.excludedKinds = excludedKinds
+		} else {
+			cx.excludedKinds = set.NewSet[string]()
+		}
+		return cx, nil
+	}
 	if name := exclusion.GetDeployment().GetName(); name != "" {
 		deploymentNameMatcher, err := regexutils.CompileWholeStringMatcher(name, regexutils.Flags{CaseInsensitive: true})
 		if err != nil {
@@ -514,11 +533,23 @@ func newCompiledExclusion(exclusion *storage.Exclusion) (*compiledExclusion, err
 	return cx, nil
 }
 
+// appliesToDeployments reports whether the exclusion can match a deployment.
+// Image-only exclusions are applied to images, so they must not match deployments or audit events.
+// Without this check, the nil deployment scope matches everything and the exclusion turns the policy off for every deployment.
+// Kind exclusions have no deployment matcher, but they still apply to deployments of the selected kinds.
+func (cw *compiledExclusion) appliesToDeployments() bool {
+	return cw.exclusion.GetDeployment() != nil || cw.excludedKinds != nil
+}
+
 func (cw *compiledExclusion) MatchesDeployment(ctx context.Context, deployment *storage.Deployment) bool {
-	if exclusionIsExpired(cw.exclusion) {
+	if !cw.appliesToDeployments() || exclusionIsExpired(cw.exclusion) {
 		return false
 	}
 
+	if cw.excludedKinds != nil {
+		return cw.excludedKinds.Contains(deployment.GetType())
+	}
+
 	if cw.deploymentNameMatcher != nil && !cw.deploymentNameMatcher.MatchString(deployment.GetName()) {
 		return false
 	}
@@ -527,7 +558,11 @@ func (cw *compiledExclusion) MatchesDeployment(ctx context.Context, deployment *
 }
 
 func (cw *compiledExclusion) MatchesAuditEvent(ctx context.Context, auditEvent *storage.KubernetesEvent) bool {
-	if exclusionIsExpired(cw.exclusion) {
+	if !cw.appliesToDeployments() || exclusionIsExpired(cw.exclusion) {
+		return false
+	}
+	// Kind exclusions apply to workload detections, not audit-log events.
+	if cw.excludedKinds != nil {
 		return false
 	}
 	if !cw.cs.MatchesAuditEvent(ctx, auditEvent) {
@@ -536,6 +571,25 @@ func (cw *compiledExclusion) MatchesAuditEvent(ctx context.Context, auditEvent *
 	return true
 }
 
+func kubernetesKindsForExcludeByKind(excludeByKind *storage.Exclusion_ExcludeByKind) (set.Set[string], error) {
+	kinds := excludeByKind.GetKinds()
+	if len(kinds) == 0 {
+		return nil, errors.New("exclude_by_kind must specify at least one workload kind")
+	}
+	kubernetesKinds := set.NewSet[string]()
+	for _, kind := range kinds {
+		switch kind {
+		case storage.Exclusion_CRON_JOB:
+			kubernetesKinds.Add(kubernetes.CronJob)
+		case storage.Exclusion_JOB:
+			kubernetesKinds.Add(kubernetes.Job)
+		default:
+			return nil, errors.Errorf("exclude_by_kind contains unknown workload kind %s", kind)
+		}
+	}
+	return kubernetesKinds, nil
+}
+
 // Predicate for deployments.
 type deploymentPredicate struct {
 	exclusions []*compiledExclusion
diff --git a/pkg/detection/compiled_policy_test.go b/pkg/detection/compiled_policy_test.go
index f50720961ee0a..4ea21b0d5e949 100644
--- a/pkg/detection/compiled_policy_test.go
+++ b/pkg/detection/compiled_policy_test.go
@@ -6,10 +6,13 @@ import (
 	"testing"
 
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/booleanpolicy"
 	"github.com/stackrox/rox/pkg/booleanpolicy/fieldnames"
 	"github.com/stackrox/rox/pkg/booleanpolicy/policyversion"
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/fixtures"
+	"github.com/stackrox/rox/pkg/kubernetes"
+	"github.com/stackrox/rox/pkg/testutils"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -64,9 +67,20 @@ func TestCompiledPolicyScopesAndExclusions(t *testing.T) {
 		{
 			desc:          "only stackrox ns, but app=stackrox excluded",
 			scopes:        []*storage.Scope{stackRoxNSScope},
-			exclusions:    []*storage.Exclusion{{Deployment: &storage.Exclusion_Deployment{Scope: appStackRoxScope}}},
+			exclusions:    []*storage.Exclusion{{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: appStackRoxScope}}}},
 			shouldApplyTo: []*storage.Deployment{stackRoxNSDep},
 		},
+		{
+			desc:          "image-only exclusion does not exclude any deployment",
+			exclusions:    []*storage.Exclusion{{Image: &storage.Exclusion_Image{Name: "docker.io/library/unrelated"}}},
+			shouldApplyTo: []*storage.Deployment{stackRoxNSDep, defaultNSDep, appStackRoxDep},
+		},
+		{
+			desc:          "only stackrox ns, with an image-only exclusion",
+			scopes:        []*storage.Scope{stackRoxNSScope},
+			exclusions:    []*storage.Exclusion{{Image: &storage.Exclusion_Image{Name: "docker.io/library/unrelated"}}},
+			shouldApplyTo: []*storage.Deployment{stackRoxNSDep, appStackRoxDep},
+		},
 		{
 			desc:          "only default ns",
 			scopes:        []*storage.Scope{defaultNSScope},
@@ -94,6 +108,60 @@ func TestCompiledPolicyScopesAndExclusions(t *testing.T) {
 	}
 }
 
+func TestCompiledPolicyWorkloadKindExclusion(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.PolicyWorkloadKindExclusion, true)
+
+	cronJob := newDeployment("CRONJOB")
+	cronJob.Name = "batch-cron"
+	cronJob.Type = kubernetes.CronJob
+	regular := newDeployment("DEPLOYMENT")
+	regular.Name = "web"
+	regular.Type = kubernetes.Deployment
+
+	policy := constructPolicy(nil, []*storage.Exclusion{
+		{
+			Matcher: &storage.Exclusion_ExcludeByKind_{
+				ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+					Kinds: []storage.Exclusion_WorkloadKind{storage.Exclusion_CRON_JOB},
+				},
+			},
+		},
+		{
+			Matcher: &storage.Exclusion_Deployment_{
+				Deployment: &storage.Exclusion_Deployment{Name: regular.GetName()},
+			},
+		},
+	})
+	compiled, err := CompilePolicy(policy, nil, nil)
+	require.NoError(t, err)
+	assert.False(t, compiled.AppliesTo(context.Background(), cronJob))
+	assert.False(t, compiled.AppliesTo(context.Background(), regular))
+
+	other := newDeployment("OTHER")
+	other.Name = "other"
+	other.Type = kubernetes.DaemonSet
+	assert.True(t, compiled.AppliesTo(context.Background(), other))
+}
+
+func TestCompiledPolicyWorkloadKindExclusionFlagOff(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.PolicyWorkloadKindExclusion, false)
+
+	cronJob := newDeployment("CRONJOB")
+	cronJob.Type = kubernetes.CronJob
+	policy := constructPolicy(nil, []*storage.Exclusion{
+		{
+			Matcher: &storage.Exclusion_ExcludeByKind_{
+				ExcludeByKind: &storage.Exclusion_ExcludeByKind{
+					Kinds: []storage.Exclusion_WorkloadKind{storage.Exclusion_CRON_JOB},
+				},
+			},
+		},
+	})
+	compiled, err := CompilePolicy(policy, nil, nil)
+	require.NoError(t, err)
+	assert.True(t, compiled.AppliesTo(context.Background(), cronJob))
+}
+
 // TestProcessAndFileAccessMatchers verifies that when a policy contains both Process and FileAccess fields,
 // only the file access matcher is created, not both matchers.
 func TestProcessAndFileAccessMatchers(t *testing.T) {
@@ -276,3 +344,115 @@ func TestProcessAndFileAccessMatchers(t *testing.T) {
 		})
 	}
 }
+
+func initAndRegularDeployment() (*storage.Deployment, []*storage.Image) {
+	dep := &storage.Deployment{
+		Id:        "dep",
+		Name:      "dep",
+		Namespace: "ns",
+		Containers: []*storage.Container{
+			{
+				Name:            "init-setup",
+				Type:            storage.ContainerType_INIT,
+				SecurityContext: &storage.SecurityContext{Privileged: true},
+				Image:           &storage.ContainerImage{Id: "init-img", Name: &storage.ImageName{FullName: "busybox:latest"}},
+			},
+			{
+				Name:            "app",
+				Type:            storage.ContainerType_REGULAR,
+				SecurityContext: &storage.SecurityContext{},
+				Image:           &storage.ContainerImage{Id: "app-img", Name: &storage.ImageName{FullName: "nginx:1.25"}},
+			},
+		},
+	}
+	images := []*storage.Image{
+		{Id: "init-img", Name: &storage.ImageName{FullName: "busybox:latest"}},
+		{Id: "app-img", Name: &storage.ImageName{FullName: "nginx:1.25"}},
+	}
+	return dep, images
+}
+
+func TestEvaluationFilterSkipsContainers(t *testing.T) {
+	t.Setenv(features.EvaluationFilter.EnvVar(), "true")
+
+	dep, images := initAndRegularDeployment()
+	ed := booleanpolicy.EnhancedDeployment{Deployment: dep, Images: images}
+
+	skipInit := &storage.EvaluationFilter{
+		SkipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
+	}
+	privilegedPolicy := &storage.Policy{
+		PolicyVersion:   policyversion.CurrentVersion().String(),
+		Name:            "privileged",
+		LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_DEPLOY},
+		PolicySections: []*storage.PolicySection{{
+			PolicyGroups: []*storage.PolicyGroup{{
+				FieldName: fieldnames.PrivilegedContainer,
+				Values:    []*storage.PolicyValue{{Value: "true"}},
+			}},
+		}},
+		EvaluationFilter: skipInit,
+	}
+
+	compiled, err := CompilePolicy(privilegedPolicy, nil, nil)
+	require.NoError(t, err)
+
+	violations, err := compiled.MatchAgainstDeployment(nil, ed)
+	require.NoError(t, err)
+	assert.Empty(t, violations.AlertViolations, "privileged init container is skipped")
+
+	dep.Containers[0].SecurityContext.Privileged = false
+	dep.Containers[1].SecurityContext.Privileged = true
+	violations, err = compiled.MatchAgainstDeployment(nil, ed)
+	require.NoError(t, err)
+	require.Len(t, violations.AlertViolations, 1)
+	assert.Contains(t, violations.AlertViolations[0].GetMessage(), "app")
+
+	skipRegular := privilegedPolicy.CloneVT()
+	skipRegular.EvaluationFilter.SkipContainerTypes = []storage.ContainerType{storage.ContainerType_REGULAR}
+	compiled, err = CompilePolicy(skipRegular, nil, nil)
+	require.NoError(t, err)
+	violations, err = compiled.MatchAgainstDeployment(nil, ed)
+	require.NoError(t, err)
+	assert.Empty(t, violations.AlertViolations, "privileged regular container is skipped")
+
+	dep.Containers[0].SecurityContext.Privileged = true
+	dep.Containers[1].SecurityContext.Privileged = false
+	violations, err = compiled.MatchAgainstDeployment(nil, ed)
+	require.NoError(t, err)
+	require.Len(t, violations.AlertViolations, 1)
+	assert.Contains(t, violations.AlertViolations[0].GetMessage(), "init-setup")
+
+	unfiltered := privilegedPolicy.CloneVT()
+	unfiltered.EvaluationFilter = nil
+	compiled, err = CompilePolicy(unfiltered, nil, nil)
+	require.NoError(t, err)
+	violations, err = compiled.MatchAgainstDeployment(nil, ed)
+	require.NoError(t, err)
+	require.NotEmpty(t, violations.AlertViolations)
+	assert.Contains(t, violations.AlertViolations[0].GetMessage(), "init-setup")
+
+	processPolicy := &storage.Policy{
+		PolicyVersion:   policyversion.CurrentVersion().String(),
+		Name:            "process",
+		LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_RUNTIME},
+		EventSource:     storage.EventSource_DEPLOYMENT_EVENT,
+		PolicySections: []*storage.PolicySection{{
+			PolicyGroups: []*storage.PolicyGroup{{
+				FieldName: fieldnames.ProcessName,
+				Values:    []*storage.PolicyValue{{Value: "bash"}},
+			}},
+		}},
+		EvaluationFilter: skipInit,
+	}
+	compiled, err = CompilePolicy(processPolicy, nil, nil)
+	require.NoError(t, err)
+
+	appProcess := &storage.ProcessIndicator{
+		ContainerName: "app",
+		Signal:        &storage.ProcessSignal{Name: "bash", ExecFilePath: "/bin/bash"},
+	}
+	violations, err = compiled.MatchAgainstDeploymentAndProcess(nil, ed, appProcess, true)
+	require.NoError(t, err)
+	assert.NotNil(t, violations.ProcessViolation)
+}
diff --git a/pkg/detection/deploytime/detector_impl_test.go b/pkg/detection/deploytime/detector_impl_test.go
new file mode 100644
index 0000000000000..377ebbc6d353e
--- /dev/null
+++ b/pkg/detection/deploytime/detector_impl_test.go
@@ -0,0 +1,138 @@
+package deploytime
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/booleanpolicy"
+	"github.com/stackrox/rox/pkg/booleanpolicy/fieldnames"
+	"github.com/stackrox/rox/pkg/booleanpolicy/policyversion"
+	"github.com/stackrox/rox/pkg/detection"
+	"github.com/stackrox/rox/pkg/protocompat"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	excludedImage   = "registry.example.com/team/legacy-app:1.0"
+	vulnerableImage = "registry.example.com/team/payments:2.3"
+)
+
+// oldCriticalCVEPolicy mirrors a "Block Critical CVE older than 180 days" policy that runs at
+// both the build and deploy stages and excludes a single image.
+func oldCriticalCVEPolicy(exclusions ...*storage.Exclusion) *storage.Policy {
+	return &storage.Policy{
+		Id:              "old-critical-cve",
+		Name:            "Block Critical CVE older than 180 days",
+		PolicyVersion:   policyversion.CurrentVersion().String(),
+		Severity:        storage.Severity_CRITICAL_SEVERITY,
+		LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_BUILD, storage.LifecycleStage_DEPLOY},
+		Exclusions:      exclusions,
+		PolicySections: []*storage.PolicySection{{
+			PolicyGroups: []*storage.PolicyGroup{
+				{FieldName: fieldnames.Severity, Values: []*storage.PolicyValue{{Value: "CRITICAL"}}},
+				{FieldName: fieldnames.DaysSinceImageFirstDiscovered, Values: []*storage.PolicyValue{{Value: "180"}}},
+			},
+		}},
+	}
+}
+
+func imageExclusion(fullName string) *storage.Exclusion {
+	return &storage.Exclusion{Image: &storage.Exclusion_Image{Name: fullName}}
+}
+
+func imageWithOldCriticalCVE(t *testing.T, fullName string) *storage.Image {
+	firstSeen, err := protocompat.ConvertTimeToTimestampOrError(time.Now().AddDate(0, 0, -365))
+	require.NoError(t, err)
+	return &storage.Image{
+		Id:   fullName + "-sha",
+		Name: &storage.ImageName{FullName: fullName},
+		Scan: &storage.ImageScan{
+			Components: []*storage.EmbeddedImageScanComponent{{
+				Name:    "openssl",
+				Version: "1.0.1",
+				Vulns: []*storage.EmbeddedVulnerability{{
+					Cve:                  "CVE-2014-0160",
+					Severity:             storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
+					FirstImageOccurrence: firstSeen,
+				}},
+			}},
+		},
+	}
+}
+
+func deploymentRunning(name string, image *storage.Image) booleanpolicy.EnhancedDeployment {
+	return booleanpolicy.EnhancedDeployment{
+		Deployment: &storage.Deployment{
+			Id:        name + "-id",
+			Name:      name,
+			Namespace: "shop",
+			ClusterId: "cluster-1",
+			Containers: []*storage.Container{{
+				Name:  name,
+				Image: &storage.ContainerImage{Id: image.GetId(), Name: image.GetName()},
+			}},
+		},
+		Images: []*storage.Image{image},
+	}
+}
+
+func detectorFor(t *testing.T, policy *storage.Policy) Detector {
+	policySet := detection.NewPolicySet(nil, nil)
+	require.NoError(t, policySet.UpsertPolicy(policy))
+	return NewDetector(policySet)
+}
+
+// TestImageExclusionDoesNotDisableDeployTimeDetection reproduces the customer report: adding an
+// image exclusion to a build and deploy policy stopped the policy from alerting on every deployment,
+// including deployments that do not run the excluded image.
+func TestImageExclusionDoesNotDisableDeployTimeDetection(t *testing.T) {
+	ctx := context.Background()
+	payments := deploymentRunning("payments", imageWithOldCriticalCVE(t, vulnerableImage))
+
+	t.Run("without an exclusion, the vulnerable deployment alerts", func(t *testing.T) {
+		alerts, err := detectorFor(t, oldCriticalCVEPolicy()).Detect(ctx, payments)
+		require.NoError(t, err)
+		assert.Len(t, alerts, 1)
+	})
+
+	t.Run("with an image exclusion, a deployment that does not run the excluded image still alerts", func(t *testing.T) {
+		policy := oldCriticalCVEPolicy(imageExclusion(excludedImage))
+		alerts, err := detectorFor(t, policy).Detect(ctx, payments)
+		require.NoError(t, err)
+		require.Len(t, alerts, 1)
+		assert.Equal(t, "payments", alerts[0].GetDeployment().GetName())
+	})
+
+	t.Run("with an image exclusion, a deployment running the excluded image still alerts", func(t *testing.T) {
+		// Image exclusions only apply at build time, so a deployment running the excluded image is
+		// still evaluated at deploy time.
+		legacy := deploymentRunning("legacy-app", imageWithOldCriticalCVE(t, excludedImage))
+		policy := oldCriticalCVEPolicy(imageExclusion(excludedImage))
+		alerts, err := detectorFor(t, policy).Detect(ctx, legacy)
+		require.NoError(t, err)
+		require.Len(t, alerts, 1)
+		assert.Equal(t, "legacy-app", alerts[0].GetDeployment().GetName())
+	})
+
+	t.Run("a deployment exclusion still skips the named deployment", func(t *testing.T) {
+		policy := oldCriticalCVEPolicy(&storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: "payments"}}})
+		alerts, err := detectorFor(t, policy).Detect(ctx, payments)
+		require.NoError(t, err)
+		assert.Empty(t, alerts)
+	})
+}
+
+// TestImageExclusionStillAppliesAtBuildTime checks that the fix does not change build-time
+// behavior: the excluded image is skipped, other images are still checked.
+func TestImageExclusionStillAppliesAtBuildTime(t *testing.T) {
+	ctx := context.Background()
+	policy := oldCriticalCVEPolicy(imageExclusion(excludedImage))
+	compiled, err := detection.CompilePolicy(policy, nil, nil)
+	require.NoError(t, err)
+
+	assert.False(t, compiled.AppliesTo(ctx, imageWithOldCriticalCVE(t, excludedImage)))
+	assert.True(t, compiled.AppliesTo(ctx, imageWithOldCriticalCVE(t, vulnerableImage)))
+}
diff --git a/pkg/detection/exclusion_test.go b/pkg/detection/exclusion_test.go
index f075901acf537..c96474e6189bc 100644
--- a/pkg/detection/exclusion_test.go
+++ b/pkg/detection/exclusion_test.go
@@ -6,8 +6,11 @@ import (
 	"time"
 
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/fixtures"
+	"github.com/stackrox/rox/pkg/kubernetes"
 	"github.com/stackrox/rox/pkg/protoconv"
+	"github.com/stackrox/rox/pkg/testutils"
 	"github.com/stackrox/rox/pkg/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -31,9 +34,7 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: fixtures.GetDeployment().GetName()},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: fixtures.GetDeployment().GetName()}}},
 				},
 			},
 			shouldMatch: true,
@@ -43,9 +44,7 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: "nginx.*"},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: "nginx.*"}}},
 				},
 			},
 			shouldMatch: true,
@@ -55,9 +54,7 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: "nginy.*"},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: "nginy.*"}}},
 				},
 			},
 			shouldMatch: false,
@@ -67,9 +64,7 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: "ngin\\K"},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: "ngin\\K"}}},
 				},
 			},
 			shouldMatch: false,
@@ -79,12 +74,8 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: fixtures.GetDeployment().GetName()},
-					},
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: uuid.NewV4().String()},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: fixtures.GetDeployment().GetName()}}},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: uuid.NewV4().String()}}},
 				},
 			},
 			shouldMatch: true,
@@ -94,9 +85,7 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: uuid.NewV4().String()},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: uuid.NewV4().String()}}},
 				},
 			},
 			shouldMatch: false,
@@ -106,9 +95,7 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: fixtures.GetDeployment().GetNamespace()}},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: fixtures.GetDeployment().GetNamespace()}}}},
 				},
 			},
 			shouldMatch: true,
@@ -116,10 +103,20 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 		{
 			name:       "Scoped excluded scope with wrong name",
 			deployment: fixtures.GetDeployment(),
+			policy: &storage.Policy{
+				Exclusions: []*storage.Exclusion{
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: uuid.NewV4().String()}}}},
+				},
+			},
+			shouldMatch: false,
+		},
+		{
+			name:       "Image-only exclusion does not match deployments",
+			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
 					{
-						Deployment: &storage.Exclusion_Deployment{Scope: &storage.Scope{Namespace: uuid.NewV4().String()}},
+						Image: &storage.Exclusion_Image{Name: "docker.io/library/nginx"},
 					},
 				},
 			},
@@ -130,9 +127,7 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 			deployment: fixtures.GetDeployment(),
 			policy: &storage.Policy{
 				Exclusions: []*storage.Exclusion{
-					{
-						Deployment: &storage.Exclusion_Deployment{Name: uuid.NewV4().String(), Scope: &storage.Scope{Namespace: fixtures.GetDeployment().GetNamespace()}},
-					},
+					{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: uuid.NewV4().String(), Scope: &storage.Scope{Namespace: fixtures.GetDeployment().GetNamespace()}}}},
 				},
 			},
 			shouldMatch: false,
@@ -168,6 +163,126 @@ func TestMatchesDeploymentExclusion(t *testing.T) {
 	}
 }
 
+func TestMatchesWorkloadKindExclusion(t *testing.T) {
+	cronJob := fixtures.GetDeployment()
+	cronJob.Type = kubernetes.CronJob
+	job := fixtures.GetDeployment()
+	job.Type = kubernetes.Job
+	deployment := fixtures.GetDeployment()
+	deployment.Type = kubernetes.Deployment
+
+	kindExclusion := func(kinds ...storage.Exclusion_WorkloadKind) *storage.Exclusion {
+		return &storage.Exclusion{
+			Matcher: &storage.Exclusion_ExcludeByKind_{
+				ExcludeByKind: &storage.Exclusion_ExcludeByKind{Kinds: kinds},
+			},
+		}
+	}
+	nameExclusion := func(name string) *storage.Exclusion {
+		return &storage.Exclusion{
+			Matcher: &storage.Exclusion_Deployment_{
+				Deployment: &storage.Exclusion_Deployment{Name: name},
+			},
+		}
+	}
+
+	compile := func(t *testing.T, exclusions ...*storage.Exclusion) []*compiledExclusion {
+		t.Helper()
+		compiled := make([]*compiledExclusion, 0, len(exclusions))
+		for _, exclusion := range exclusions {
+			cw, err := newCompiledExclusion(exclusion)
+			require.NoError(t, err)
+			compiled = append(compiled, cw)
+		}
+		return compiled
+	}
+
+	t.Run("flag off does not exclude by kind", func(t *testing.T) {
+		testutils.MustUpdateFeature(t, features.PolicyWorkloadKindExclusion, false)
+		compiled := compile(t, kindExclusion(storage.Exclusion_CRON_JOB, storage.Exclusion_JOB))
+		assert.False(t, deploymentMatchesExclusions(context.Background(), cronJob, compiled))
+		assert.False(t, deploymentMatchesExclusions(context.Background(), job, compiled))
+		assert.False(t, deploymentMatchesExclusions(context.Background(), deployment, compiled))
+	})
+
+	testutils.MustUpdateFeature(t, features.PolicyWorkloadKindExclusion, true)
+
+	cases := map[string]struct {
+		exclusions  []*storage.Exclusion
+		workload    *storage.Deployment
+		shouldMatch bool
+	}{
+		"cronjob matches cronjob kind": {
+			exclusions:  []*storage.Exclusion{kindExclusion(storage.Exclusion_CRON_JOB)},
+			workload:    cronJob,
+			shouldMatch: true,
+		},
+		"deployment does not match cronjob kind": {
+			exclusions:  []*storage.Exclusion{kindExclusion(storage.Exclusion_CRON_JOB)},
+			workload:    deployment,
+			shouldMatch: false,
+		},
+		"job matches job and cronjob kinds": {
+			exclusions:  []*storage.Exclusion{kindExclusion(storage.Exclusion_CRON_JOB, storage.Exclusion_JOB)},
+			workload:    job,
+			shouldMatch: true,
+		},
+		"OR with name/scope exclusion": {
+			exclusions: []*storage.Exclusion{
+				kindExclusion(storage.Exclusion_JOB),
+				nameExclusion(deployment.GetName()),
+			},
+			workload:    deployment,
+			shouldMatch: true,
+		},
+		"kind exclusion does not match unrelated name": {
+			exclusions:  []*storage.Exclusion{kindExclusion(storage.Exclusion_JOB)},
+			workload:    deployment,
+			shouldMatch: false,
+		},
+	}
+
+	for name, c := range cases {
+		t.Run(name, func(t *testing.T) {
+			compiled := compile(t, c.exclusions...)
+			got := deploymentMatchesExclusions(context.Background(), c.workload, compiled)
+			assert.Equal(t, c.shouldMatch, got)
+			if c.shouldMatch {
+				for _, exclusion := range c.exclusions {
+					exclusion.Expiration = protoconv.MustConvertTimeToTimestamp(time.Now().Add(-1 * time.Hour))
+				}
+				assert.False(t, deploymentMatchesExclusions(context.Background(), c.workload, compiled))
+			}
+		})
+	}
+
+	for name, tc := range map[string]struct {
+		kinds       []storage.Exclusion_WorkloadKind
+		errContains string
+	}{
+		"empty kind list is rejected": {
+			errContains: "at least one workload kind",
+		},
+		"unknown kind is rejected": {
+			kinds:       []storage.Exclusion_WorkloadKind{storage.Exclusion_WorkloadKind(99)},
+			errContains: "unknown workload kind",
+		},
+		"mixed valid and unknown kinds are rejected": {
+			kinds:       []storage.Exclusion_WorkloadKind{storage.Exclusion_JOB, storage.Exclusion_WorkloadKind(99)},
+			errContains: "unknown workload kind",
+		},
+		"UNSPECIFIED is rejected": {
+			kinds:       []storage.Exclusion_WorkloadKind{storage.Exclusion_WORKLOAD_KIND_UNSPECIFIED},
+			errContains: "unknown workload kind",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := newCompiledExclusion(kindExclusion(tc.kinds...))
+			require.ErrorContains(t, err, tc.errContains)
+		})
+	}
+}
+
 func TestMatchesImageExclusion(t *testing.T) {
 	cases := []struct {
 		name        string
@@ -243,8 +358,18 @@ func TestMatchesImageExclusion(t *testing.T) {
 				}
 				assert.True(t, matchesImageExclusion(c.image, c.policy))
 			}
-			c.policy.Exclusions = append(c.policy.Exclusions, &storage.Exclusion{Deployment: &storage.Exclusion_Deployment{Name: "BLAH"}})
+			c.policy.Exclusions = append(c.policy.Exclusions, &storage.Exclusion{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{Name: "BLAH"}}})
 			assert.Equal(t, c.shouldMatch, got)
 		})
 	}
 }
+
+func TestImageOnlyExclusionDoesNotMatchAuditEvent(t *testing.T) {
+	cx, err := newCompiledExclusion(&storage.Exclusion{Image: &storage.Exclusion_Image{Name: "docker.io/library/nginx"}})
+	require.NoError(t, err)
+
+	auditEvent := &storage.KubernetesEvent{
+		Object: &storage.KubernetesEvent_Object{Name: "my-secret", Namespace: "default", ClusterId: "cluster-1"},
+	}
+	assert.False(t, auditEventMatchesExclusions(context.Background(), auditEvent, []*compiledExclusion{cx}))
+}
diff --git a/pkg/env/central_worker.go b/pkg/env/central_worker.go
index 0ae359772f14e..a46f152ec891b 100644
--- a/pkg/env/central_worker.go
+++ b/pkg/env/central_worker.go
@@ -1,5 +1,6 @@
 package env
 
 var (
-	CentralWorkerEnabled = RegisterBooleanSetting("ROX_CENTRAL_WORKER_ENABLED", false)
+	CentralWorkerEnabled            = RegisterBooleanSetting("ROX_CENTRAL_WORKER_ENABLED", false)
+	CentralWorkerResyncIntervalMins = RegisterIntegerSetting("ROX_WORKER_RESYNC_INTERVAL_MINUTES", 5).WithMinimum(1)
 )
diff --git a/pkg/env/node_scan.go b/pkg/env/node_scan.go
index d2c30b8fb1c91..9de0722e86daa 100644
--- a/pkg/env/node_scan.go
+++ b/pkg/env/node_scan.go
@@ -18,8 +18,8 @@ var (
 	// scanning wait time.
 	NodeScanningMaxInitialWait = registerDurationSetting("ROX_NODE_SCANNING_MAX_INITIAL_WAIT", 5*time.Minute)
 
-	// NodeInventoryContainerEnabled is used to tell compliance whether a connection to the node-inventory container should be attempted
-	NodeInventoryContainerEnabled = RegisterBooleanSetting("ROX_CALL_NODE_INVENTORY_ENABLED", true)
+	// NodeInventoryContainerEnabled gates whether compliance connects to the node-inventory container.
+	NodeInventoryContainerEnabled = RegisterPermanentBooleanSetting("ROX_CALL_NODE_INVENTORY_ENABLED", false)
 
 	// NodeAnalysisDeadline is a time in which node-inventory component should reply to compliance
 	NodeAnalysisDeadline = registerDurationSetting("ROX_NODE_SCANNING_DEADLINE", 30*time.Second)
diff --git a/pkg/env/postgres_query.go b/pkg/env/postgres_query.go
index 3c9d1e1178d36..0805ff8d63a15 100644
--- a/pkg/env/postgres_query.go
+++ b/pkg/env/postgres_query.go
@@ -6,4 +6,8 @@ var (
 	// Values below this threshold use IN for better plan quality; values at or
 	// above use ANY to avoid the 65535 parameter limit.
 	PostgresParameterThreshold = RegisterIntegerSetting("ROX_POSTGRES_PARAMETER_THRESHOLD", 100)
+
+	// PostgresDefaultCursorBatchSize sets the number of rows fetched per FETCH in server-side
+	// cursor queries. Lower values reduce memory usage; higher values reduce round-trips.
+	PostgresDefaultCursorBatchSize = RegisterIntegerSetting("ROX_POSTGRES_CURSOR_BATCH_SIZE", 1000)
 )
diff --git a/pkg/env/process_filter.go b/pkg/env/process_filter.go
index 2629d025ec4d7..02dca0d77d4ab 100644
--- a/pkg/env/process_filter.go
+++ b/pkg/env/process_filter.go
@@ -25,6 +25,7 @@ var (
 	// An empty array "[]" means only unique processes are tracked without argument tracking.
 	// This setting can be overridden by ROX_PROCESS_FILTER_MODE presets.
 	// Default: [8,6,4,2]
+	// TODO(janisz): change maximum element Value to 255 to avoid implicit clamping in filter.go
 	ProcessFilterFanOutLevels = RegisterIntegerArraySetting(
 		"ROX_PROCESS_FILTER_FAN_OUT_LEVELS",
 		[]int{8, 6, 4, 2},
diff --git a/pkg/env/signature.go b/pkg/env/signature.go
index dedf96c06bea9..4f3d498686d8b 100644
--- a/pkg/env/signature.go
+++ b/pkg/env/signature.go
@@ -8,7 +8,8 @@ var (
 
 	// RedHatSigningKeyBundleURL is the remote URL of the key bundle JSON.
 	// If empty, the key bundle updater does not start.
-	RedHatSigningKeyBundleURL = RegisterSetting("ROX_REDHAT_SIGNING_KEY_BUNDLE_URL", AllowEmpty())
+	RedHatSigningKeyBundleURL = RegisterSetting("ROX_REDHAT_SIGNING_KEY_BUNDLE_URL",
+		WithDefault("https://definitions.stackrox.io/signing-keys/bundle.json"), AllowEmpty())
 
 	// RedHatSigningKeyUpdateInterval controls how often the updater re-downloads the bundle.
 	RedHatSigningKeyUpdateInterval = registerDurationSetting("ROX_REDHAT_SIGNING_KEY_UPDATE_INTERVAL", 4*time.Hour)
@@ -16,4 +17,13 @@ var (
 	// RedHatSigningKeyWatchInterval controls how often the watcher polls the key bundle file.
 	// Set to 0 to disable the watcher entirely.
 	RedHatSigningKeyWatchInterval = registerDurationSetting("ROX_REDHAT_SIGNING_KEY_WATCH_INTERVAL", 4*time.Hour, WithDurationZeroAllowed())
+
+	// ImageSignatureVerificationTimeout bounds how long the enricher waits for signature verification
+	// of a single image against all configured signature integrations.
+	// Keyless (cosign) verification performs remote RPCs (fetching the Sigstore TUF trust root and
+	// Fulcio/Rekor material, and querying the transparency log), which can take several seconds,
+	// especially on the first call before the TUF root is cached or when the Sigstore CDN is slow.
+	// The default is generous enough to accommodate keyless verification while still bounding the
+	// enrichment hot path.
+	ImageSignatureVerificationTimeout = registerDurationSetting("ROX_IMAGE_SIGNATURE_VERIFICATION_TIMEOUT", 30*time.Second)
 )
diff --git a/pkg/env/virtualmachine.go b/pkg/env/virtualmachine.go
index 8bb5899cd1b48..3c260afaa2dfb 100644
--- a/pkg/env/virtualmachine.go
+++ b/pkg/env/virtualmachine.go
@@ -58,7 +58,7 @@ var (
 
 	// VirtualMachinesScraperPollInterval defines how often the pull-mode scraper
 	// polls VMs for new reports.
-	VirtualMachinesScraperPollInterval = registerDurationSetting("ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL", 5*time.Minute)
+	VirtualMachinesScraperPollInterval = registerDurationSetting("ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL", 4*time.Hour)
 
 	// VirtualMachinesScraperTickInterval is how often VMScraper considers due VMs.
 	// Independent of retry backoff so operators can slow the ticker without
@@ -70,8 +70,8 @@ var (
 	// min(poll interval, 30m).
 	VirtualMachinesScraperInitialBackoff = registerDurationSetting("ROX_VIRTUAL_MACHINES_SCRAPER_INITIAL_BACKOFF", 10*time.Second)
 
-	// VirtualMachinesScraperPerVMTimeout defines the per-VM deadline for dialing
-	// and pulling a report in a single scrape cycle.
+	// VirtualMachinesScraperPerVMTimeout is the deadline for one Sensor-to-agent
+	// call (GetReport or a mapping sync). Doing both can take twice as long.
 	VirtualMachinesScraperPerVMTimeout = registerDurationSetting("ROX_VIRTUAL_MACHINES_SCRAPER_PER_VM_TIMEOUT", 30*time.Second)
 
 	// VirtualMachinesScraperMandatoryRefreshInterval defines the maximum age of a VM's last forwarded
@@ -80,4 +80,16 @@ var (
 	// vulnerability definitions, mirroring ROX_REPROCESSING_INTERVAL and ROX_NODE_SCANNING_INTERVAL's
 	// role for image and node scanning.
 	VirtualMachinesScraperMandatoryRefreshInterval = registerDurationSetting("ROX_VIRTUAL_MACHINES_SCRAPER_MANDATORY_REFRESH_INTERVAL", 4*time.Hour)
+
+	// VirtualMachinesScraperSteadySpreadFraction is the fraction of the poll interval used as the
+	// one-sided post-poll random band W for cadence reschedule (nextAttemptAt =
+	// now + pollInterval + U(0, W)). Default 2/3. Internal Sensor env only; not Operator/Helm-exposed.
+	// Valid range is [0.01, 1] so W is not effectively zero; out-of-range values fall back to the default.
+	VirtualMachinesScraperSteadySpreadFraction = RegisterFloatSetting("ROX_VIRTUAL_MACHINES_SCRAPER_STEADY_SPREAD_FRACTION", 2.0/3).
+							WithMinimum(0.01).WithMaximum(1)
+
+	// VirtualMachinesAgentStaleAfter is the GetVM Active window after the last
+	// successful scrape. Default 12h is larger than one healthy poll cycle
+	// (4h + up to 2/3 spread ≈ 6.7h), so one retryable VSOCK miss stays Active.
+	VirtualMachinesAgentStaleAfter = registerDurationSetting("ROX_VIRTUAL_MACHINES_AGENT_STALE_AFTER", 12*time.Hour)
 )
diff --git a/pkg/env/vulnerability_management.go b/pkg/env/vulnerability_management.go
index a8e7148254558..b8a8708401515 100644
--- a/pkg/env/vulnerability_management.go
+++ b/pkg/env/vulnerability_management.go
@@ -1,5 +1,7 @@
 package env
 
+import "time"
+
 var (
 	// ReportExecutionMaxConcurrency sets the maximum number vulnerability reports that can run in parallel
 	ReportExecutionMaxConcurrency = RegisterIntegerSetting("ROX_REPORT_EXECUTION_MAX_CONCURRENCY", 5)
@@ -22,4 +24,13 @@ var (
 
 	// ReportMissedScheduleRecovery enables recovery of missed scheduled reports on startup
 	ReportMissedScheduleRecovery = RegisterBooleanSetting("ROX_REPORT_MISSED_SCHEDULE_RECOVERY", true)
+
+	// PruneV1Images controls whether V1 image pruning is active
+	PruneV1Images = RegisterBooleanSetting("ROX_PRUNE_V1_IMAGES", true)
+
+	// V1ImagePruneInterval is how often the V1 image pruning cycle runs
+	V1ImagePruneInterval = registerDurationSetting("ROX_V1_IMAGE_PRUNE_INTERVAL", 6*time.Hour)
+
+	// V1ImagePruneBatchSize is the number of V1 images to process per pruning cycle
+	V1ImagePruneBatchSize = RegisterIntegerSetting("ROX_V1_IMAGE_PRUNE_BATCH_SIZE", 500).WithMinimum(1).WithMaximum(10000)
 )
diff --git a/pkg/features/features.go b/pkg/features/features.go
index d2f2d1e4356fd..e90aef28ef887 100644
--- a/pkg/features/features.go
+++ b/pkg/features/features.go
@@ -54,8 +54,9 @@ func sortEnvVars() []string {
 
 // LogFeatureFlags logs the global state of all features flags.
 func LogFeatureFlags() {
-	data := []interface{}{}
-	for _, envVar := range sortEnvVars() {
+	sortedVars := sortEnvVars()
+	data := make([]interface{}, 0, len(sortedVars))
+	for _, envVar := range sortedVars {
 		flag := Flags[envVar]
 		data = append(data, logging.Any(flag.EnvVar(), flag.Enabled()))
 	}
diff --git a/pkg/features/list.go b/pkg/features/list.go
index 51afb53e39134..c2d19ebbf9269 100644
--- a/pkg/features/list.go
+++ b/pkg/features/list.go
@@ -15,9 +15,6 @@ var (
 	// ClusterAwareDeploymentCheck enables roxctl deployment check to check deployments on the cluster level.
 	ClusterAwareDeploymentCheck = registerFeature("Enables cluster level check for the 'roxctl deployment check' command.", "ROX_CLUSTER_AWARE_DEPLOYMENT_CHECK", enabled)
 
-	// PolicyCriteriaModal enables a modal for selecting policy criteria when editing a policy
-	PolicyCriteriaModal = registerFeature("Enable modal to select policy criteria when editing a policy", "ROX_POLICY_CRITERIA_MODAL")
-
 	// SensorDeploymentBuildOptimization enables a performance improvement by skipping deployments processing when no dependency or spec changed
 	SensorDeploymentBuildOptimization = registerFeature("Enables a performance improvement by skipping deployments processing when no dependency or spec changed", "ROX_DEPLOYMENT_BUILD_OPTIMIZATION", enabled)
 
@@ -36,6 +33,12 @@ var (
 	// ComplianceRemediationV2 enables the remediation feature of the compliance v2 integration.
 	ComplianceRemediationV2 = registerFeature("Enable Compliance Remediation feature", "ROX_COMPLIANCE_REMEDIATION", enabled)
 
+	// ComplianceSurfaceStaleData gates surfacing stale compliance data in Coverage views (ROX-35712). Default off.
+	ComplianceSurfaceStaleData = registerFeature("Surface stale compliance data in Coverage views", "ROX_COMPLIANCE_SURFACE_STALE_DATA")
+
+	// ComplianceCustomNodeRoles gates configurable node roles in compliance scan configurations (ROX-34167). Default off.
+	ComplianceCustomNodeRoles = registerFeature("Enable configurable node roles in compliance scan configurations", "ROX_COMPLIANCE_CUSTOM_NODE_ROLES")
+
 	// SensorAggregateDeploymentReferenceOptimization enables a performance improvement by aggregating deployment references when the same reference is queued for processing
 	SensorAggregateDeploymentReferenceOptimization = registerFeature("Enables a performance improvement by aggregating deployment references when the same reference is queued for processing", "ROX_AGGREGATE_DEPLOYMENT_REFERENCE_OPTIMIZATION", enabled)
 
@@ -99,10 +102,7 @@ var (
 	// KnownExploitedVulnerabilities enables support for CISA Known Exploited Vulnerabilities (KEV) data.
 	//
 	// This must be enabled in Central and Scanner V4 Matcher to have any effect.
-	KnownExploitedVulnerabilities = registerFeature("Display CISA Known Exploited Vulnerabilities (KEV) data", "ROX_CISA_KEV")
-
-	// Display Compliance Dashboard (Deprecated) in user interface (not displayed by default starting in 4.11 release).
-	DeprecatedComplianceDashboard = registerFeature("Display Compliance Dashboard (Deprecated) in user interface", "ROX_DEPRECATED_COMPLIANCE_DASHBOARD")
+	KnownExploitedVulnerabilities = registerFeature("Display CISA Known Exploited Vulnerabilities (KEV) data", "ROX_CISA_KEV", enabled)
 
 	// SensitiveFileActivity enables monitoring of sensitive files.
 	SensitiveFileActivity = registerFeature("Enable sensitive file monitoring", "ROX_SENSITIVE_FILE_ACTIVITY", enabled)
@@ -128,11 +128,14 @@ var (
 	// VulnerabilityReportsEnhancedFiltering enables filtering similar to view-based reports in scheduled vulnerability reports
 	VulnerabilityReportsEnhancedFiltering = registerFeature("Enables filtering similar to view-based reports in scheduled vulnerability reports", "ROX_VULNERABILITY_REPORTS_ENHANCED_FILTERING", enabled)
 
+	// VulnerabilityReportStreamingDownload enables streaming downloadable vulnerability reports directly to blob storage.
+	VulnerabilityReportStreamingDownload = registerFeature("Enables streaming downloadable vulnerability reports to blob storage", "ROX_VULNERABILITY_REPORT_STREAMING_DOWNLOAD", enabled)
+
 	// NodeVulnerabilityReports enables interface for (future) node vulnerability reports to develop in parallel with image vulnerability reports
-	NodeVulnerabilityReports = registerFeature("Enables interface for scheduled node vulnerability reports", "ROX_NODE_VULNERABILITY_REPORTS")
+	NodeVulnerabilityReports = registerFeature("Enables interface for scheduled node vulnerability reports", "ROX_NODE_VULNERABILITY_REPORTS", enabled)
 
 	// VirtualMachinesEnhancedDataModel enables usage of the enhanced and more flexible data model
-	VirtualMachinesEnhancedDataModel = registerFeature("Enables virtual machine enhanced data model", "ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL")
+	VirtualMachinesEnhancedDataModel = registerFeature("Enables virtual machine enhanced data model", "ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL", enabled)
 
 	// InitContainerSupport enables extraction, scanning, and evaluation of init containers in deployments.
 	InitContainerSupport = registerFeature("Enable init container support", "ROX_INIT_CONTAINER_SUPPORT", enabled)
@@ -143,14 +146,20 @@ var (
 	// EvaluationFilter enables evaluation filtering in policy evaluation.
 	EvaluationFilter = registerFeature("Enable evaluation filtering in policy evaluation", "ROX_EVALUATION_FILTER", enabled)
 
+	// PolicyWorkloadKindExclusion enables excluding all workloads of selected Kubernetes kinds (Job, CronJob) from a policy.
+	PolicyWorkloadKindExclusion = registerFeature("Enable excluding all workloads of a given kind from a policy", "ROX_POLICY_WORKLOAD_KIND_EXCLUSION")
+
 	// UISecretsPageMigration enables the secrets list page under the Risk section
 	UISecretsPageMigration = registerFeature("Display secrets list page under Risk section", "ROX_UI_SECRETS_PAGE_MIGRATION")
 
-	// SensorCompatibilityStatus enables sensor compatibility status UI in place of sensor upgrade status
-	SensorCompatibilityStatus = registerFeature("Display sensor compatibility status instead of sensor upgrade status", "ROX_SENSOR_COMPATIBILITY_STATUS")
+	// LegacyScanner enables Scanner V2 integration. Off by default; locked in release builds.
+	LegacyScanner = registerFeature("Enable legacy scanner (Scanner V2) integration", "ROX_LEGACY_SCANNER", unchangeableInProd)
 
-	// LegacyScanner enables the legacy scanner (Scanner V2) integration.
-	LegacyScanner = registerFeature("Enable legacy scanner (Scanner V2) integration", "ROX_LEGACY_SCANNER", enabled)
+	// ACMAccessControlDelegation enables AuthProviders with role lookup delegation to ACM access control information.
+	ACMAccessControlDelegation = registerFeature("Enable ACS access control integration with Red Hat Advanced Cluster Management", "ROX_ACM_ACCESS_CONTROL_DELEGATION")
+
+	// LightspeedRiskSummary enables Lightspeed AI risk summary
+	LightspeedRiskSummary = registerFeature("Enable Lightspeed AI risk summary", "ROX_LIGHTSPEED_RISK_SUMMARY", enabled)
 )
 
 // The following feature flags are related to Scanner V4.
@@ -190,13 +199,14 @@ var (
 	// This must be set in Scanner V4 Indexer to have any effect.
 	ScannerV4MavenSearch = registerFeature("Enables Scanner V4 to reach out to ROX_SCANNER_V4_MAVEN_SEARCH_URL for additional information about Java packages", "ROX_SCANNER_V4_MAVEN_SEARCH")
 
-	VirtualMachines = registerFeature("Enables virtual machine management", "ROX_VIRTUAL_MACHINES")
+	// VirtualMachines gates VM inventory, scanning, and VSOCK RBAC in Sensor.
+	VirtualMachines = registerFeature("Enables virtual machine management", "ROX_VIRTUAL_MACHINES", enabled)
 
 	// ScannerV4StoreExternalIndexReports enables storing index reports from delegated scans to Central's Scanner V4 Indexer.
 	ScannerV4StoreExternalIndexReports = registerFeature("Enables storing index reports from delegated scans to Central's Scanner V4 Indexer", "ROX_SCANNER_V4_STORE_EXTERNAL_INDEX_REPORTS", enabled)
 
 	// SBOMScanning enables matching vulnerabilities to components found in Red Hat produced SBOMs.
-	SBOMScanning = registerFeature("Enables matching vulnerabilities to components found in Red Hat produced SBOMs", "ROX_SBOM_SCANNING")
+	SBOMScanning = registerFeature("Enables matching vulnerabilities to components found in Red Hat produced SBOMs", "ROX_SBOM_SCANNING", enabled)
 
 	// SensorInformerWatchdog enables periodic logging of sensor informers that are stuck or have not synced.
 	SensorInformerWatchdog = registerFeature("Sensor informer watchdog logging", "ROX_SENSOR_INFORMER_WATCHDOG", enabled)
@@ -206,4 +216,7 @@ var (
 
 	// ScannerV4Dedupe de-duplicates packages and vulnerabilities from appearing in scan results.
 	ScannerV4Dedupe = registerFeature("Deduplicate packages and vulnerabilities found in Scanner V4 results.", "ROX_SCANNER_V4_DEDUPE", enabled)
+
+	// ScannerV4SuppressOSVWithRedHatVEX suppresses OSV.dev vulnerabilities when a corresponding Red Hat VEX assertion exists.
+	ScannerV4SuppressOSVWithRedHatVEX = registerFeature("Scanner V4 will suppress OSV.dev vulnerabilities when a corresponding Red Hat VEX assertion exists", "ROX_SCANNER_V4_SUPPRESS_OSV_WITH_RED_HAT_VEX", enabled)
 )
diff --git a/pkg/filedownloader/filedownloader.go b/pkg/filedownloader/filedownloader.go
index 5bce79ea4a66d..1343e736df5de 100644
--- a/pkg/filedownloader/filedownloader.go
+++ b/pkg/filedownloader/filedownloader.go
@@ -224,7 +224,7 @@ func (d *Downloader) doDownload(ctx context.Context) error {
 		return fmt.Errorf("response body exceeds maximum size of %d bytes", d.maxSize)
 	}
 
-	if err := atomicWriteFile(d.filePath, body); err != nil {
+	if err := AtomicWriteFile(d.filePath, body); err != nil {
 		return fmt.Errorf("writing file: %w", err)
 	}
 
@@ -232,7 +232,10 @@ func (d *Downloader) doDownload(ctx context.Context) error {
 	return nil
 }
 
-func atomicWriteFile(path string, data []byte) error {
+// AtomicWriteFile writes data to path via a temp file plus rename, so
+// concurrent readers never observe a partially written file. Creates
+// path's parent directory (mode 0700) if it does not already exist.
+func AtomicWriteFile(path string, data []byte) error {
 	dir := filepath.Dir(path)
 	if err := os.MkdirAll(dir, 0700); err != nil {
 		return fmt.Errorf("creating directory %q: %w", dir, err)
diff --git a/pkg/filedownloader/filedownloader_test.go b/pkg/filedownloader/filedownloader_test.go
index ce6a673f3e283..3bff6e5547e6f 100644
--- a/pkg/filedownloader/filedownloader_test.go
+++ b/pkg/filedownloader/filedownloader_test.go
@@ -268,7 +268,7 @@ func TestAtomicWriteFile(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "output.json")
 
-	require.NoError(t, atomicWriteFile(path, []byte("hello")))
+	require.NoError(t, AtomicWriteFile(path, []byte("hello")))
 
 	data, err := os.ReadFile(path)
 	require.NoError(t, err)
@@ -283,7 +283,7 @@ func TestAtomicWriteFile_CreatesParentDirectory(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "nested", "output.json")
 
-	require.NoError(t, atomicWriteFile(path, []byte("hello")))
+	require.NoError(t, AtomicWriteFile(path, []byte("hello")))
 
 	data, err := os.ReadFile(path)
 	require.NoError(t, err)
diff --git a/pkg/fixtures/vmindexreport/generator.go b/pkg/fixtures/vmindexreport/generator.go
index 0be8e171d8fa9..ca2fb65136cbe 100644
--- a/pkg/fixtures/vmindexreport/generator.go
+++ b/pkg/fixtures/vmindexreport/generator.go
@@ -10,7 +10,6 @@ import (
 	"strings"
 
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
-	v1 "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
 )
 
 const (
@@ -165,14 +164,6 @@ func NewGeneratorWithSeed(numPackages int, seed int64) *Generator {
 	}
 }
 
-// GenerateV1IndexReport creates a fake v1.IndexReport (used by Sensor for sending to Central).
-func (g *Generator) GenerateV1IndexReport(vsockCID uint32) *v1.IndexReport {
-	return &v1.IndexReport{
-		VsockCid: fmt.Sprintf("%d", vsockCID),
-		IndexV4:  g.GenerateV4IndexReport(),
-	}
-}
-
 // GenerateV4IndexReport creates a fake v4.IndexReport (used by Scanner V4).
 func (g *Generator) GenerateV4IndexReport() *v4.IndexReport {
 	return &v4.IndexReport{
diff --git a/pkg/gjson/row.go b/pkg/gjson/row.go
index 4fa289f9a06a2..601c9b33f589b 100644
--- a/pkg/gjson/row.go
+++ b/pkg/gjson/row.go
@@ -486,7 +486,7 @@ func (ct *columnTree) createColumnFromColumnNodes(columnIndex int) []string {
 		return nodes[i].index < nodes[j].index
 	})
 
-	var column []string
+	var column []string //nolint:prealloc // size depends on duplicateElems calls, unpredictable
 	for _, node := range nodes {
 		amount := node.countLeafNodes(0)
 
diff --git a/pkg/glob/pattern.go b/pkg/glob/pattern.go
index 3f4009ddd3134..a89e0eeb7fe0b 100644
--- a/pkg/glob/pattern.go
+++ b/pkg/glob/pattern.go
@@ -19,7 +19,7 @@ func (p *Pattern) Compile() error {
 	return err
 }
 
-func (p *Pattern) compile() (glob.Glob, error) {
+func (p *Pattern) compile() (*glob.Pattern, error) {
 	g, err := glob.Compile(string(*p))
 	if err != nil {
 		return nil, errors.WithMessagef(err, "failed to compile %q", string(*p))
@@ -36,7 +36,7 @@ func (p *Pattern) Match(s string) bool {
 			return false
 		}
 	}
-	return v.(glob.Glob).Match(s)
+	return v.(*glob.Pattern).Match(s)
 }
 
 func (p Pattern) Ptr() *Pattern {
diff --git a/pkg/grpc/server.go b/pkg/grpc/server.go
index 1840da72286b5..fbfa7f58d037f 100644
--- a/pkg/grpc/server.go
+++ b/pkg/grpc/server.go
@@ -365,7 +365,8 @@ func (a *apiImpl) muxer(localConn *grpc.ClientConn) http.Handler {
 		preAuthHTTPInterceptors = append(preAuthHTTPInterceptors, a.config.RateLimiter.GetHTTPInterceptor())
 	}
 
-	contextUpdaters := []contextutil.ContextUpdater{authn.ContextUpdater(a.config.IdentityExtractors...)}
+	contextUpdaters := make([]contextutil.ContextUpdater, 0, 1+len(a.config.PreAuthContextEnrichers))
+	contextUpdaters = append(contextUpdaters, authn.ContextUpdater(a.config.IdentityExtractors...))
 	contextUpdaters = append(contextUpdaters, a.config.PreAuthContextEnrichers...)
 	preAuthHTTPInterceptors = append(preAuthHTTPInterceptors, contextutil.HTTPInterceptor(contextUpdaters...))
 
diff --git a/pkg/grpc/versionheader/interceptor.go b/pkg/grpc/versionheader/interceptor.go
new file mode 100644
index 0000000000000..98bc6b08bed29
--- /dev/null
+++ b/pkg/grpc/versionheader/interceptor.go
@@ -0,0 +1,27 @@
+package versionheader
+
+import (
+	"context"
+
+	"github.com/stackrox/rox/pkg/clientconn"
+	"github.com/stackrox/rox/pkg/grpc/authn"
+	"github.com/stackrox/rox/pkg/version"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+// CentralVersionServerInterceptor returns a gRPC unary server interceptor that sets the
+// Central version in the response header for authenticated requests.
+func CentralVersionServerInterceptor() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		setVersionHeader(ctx)
+		return handler(ctx, req)
+	}
+}
+
+func setVersionHeader(ctx context.Context) {
+	if authn.IdentityFromContextOrNil(ctx) == nil {
+		return
+	}
+	_ = grpc.SetHeader(ctx, metadata.Pairs(clientconn.CentralVersionHeader, version.GetMainVersion()))
+}
diff --git a/pkg/helm/charts/meta.go b/pkg/helm/charts/meta.go
index 2d70deea56ceb..8e30e94cc98ab 100644
--- a/pkg/helm/charts/meta.go
+++ b/pkg/helm/charts/meta.go
@@ -20,11 +20,6 @@ type MetaValues struct {
 	FactRegistry                     string
 	FactImageRemote                  string
 	FactImageTag                     string
-	ScannerImageRemote               string
-	ScannerSlimImageRemote           string
-	ScannerImageTag                  string
-	ScannerDBImageRemote             string
-	ScannerDBSlimImageRemote         string
 	ScannerV4ImageRemote             string
 	ScannerV4DBImageRemote           string
 	ScannerV4ImageTag                string
@@ -69,33 +64,28 @@ type MetaValues struct {
 // GetMetaValuesForFlavor are the default meta values for rendering the StackRox charts in production.
 func GetMetaValuesForFlavor(imageFlavor defaults.ImageFlavor) *MetaValues {
 	metaValues := MetaValues{
-		Versions:                 imageFlavor.Versions,
-		MainRegistry:             imageFlavor.MainRegistry,
-		ImageRemote:              imageFlavor.MainImageName,
-		ImageTag:                 imageFlavor.MainImageTag,
-		CentralDBImageTag:        imageFlavor.CentralDBImageTag,
-		CentralDBImageRemote:     imageFlavor.CentralDBImageName,
-		CollectorRegistry:        imageFlavor.CollectorRegistry,
-		CollectorImageRemote:     imageFlavor.CollectorImageName,
-		CollectorImageTag:        imageFlavor.CollectorImageTag,
-		FactRegistry:             imageFlavor.FactRegistry,
-		FactImageRemote:          imageFlavor.FactImageName,
-		FactImageTag:             imageFlavor.FactImageTag,
-		ScannerImageRemote:       imageFlavor.ScannerImageName,
-		ScannerSlimImageRemote:   imageFlavor.ScannerSlimImageName,
-		ScannerImageTag:          imageFlavor.ScannerImageTag,
-		ScannerDBImageRemote:     imageFlavor.ScannerDBImageName,
-		ScannerDBSlimImageRemote: imageFlavor.ScannerDBSlimImageName,
-		ScannerV4ImageRemote:     imageFlavor.ScannerV4ImageName,
-		ScannerV4DBImageRemote:   imageFlavor.ScannerV4DBImageName,
-		ScannerV4ImageTag:        imageFlavor.ScannerV4ImageTag,
-		RenderMode:               "renderAll",
-		ChartRepo:                imageFlavor.ChartRepo,
-		ImagePullSecrets:         imageFlavor.ImagePullSecrets,
-		Operator:                 false,
-		ReleaseBuild:             buildinfo.ReleaseBuild,
-		FeatureFlags:             features.GetFeatureFlagsAsGenericMap(),
-		TelemetryEnabled:         true,
+		Versions:               imageFlavor.Versions,
+		MainRegistry:           imageFlavor.MainRegistry,
+		ImageRemote:            imageFlavor.MainImageName,
+		ImageTag:               imageFlavor.MainImageTag,
+		CentralDBImageTag:      imageFlavor.CentralDBImageTag,
+		CentralDBImageRemote:   imageFlavor.CentralDBImageName,
+		CollectorRegistry:      imageFlavor.CollectorRegistry,
+		CollectorImageRemote:   imageFlavor.CollectorImageName,
+		CollectorImageTag:      imageFlavor.CollectorImageTag,
+		FactRegistry:           imageFlavor.FactRegistry,
+		FactImageRemote:        imageFlavor.FactImageName,
+		FactImageTag:           imageFlavor.FactImageTag,
+		ScannerV4ImageRemote:   imageFlavor.ScannerV4ImageName,
+		ScannerV4DBImageRemote: imageFlavor.ScannerV4DBImageName,
+		ScannerV4ImageTag:      imageFlavor.ScannerV4ImageTag,
+		RenderMode:             "renderAll",
+		ChartRepo:              imageFlavor.ChartRepo,
+		ImagePullSecrets:       imageFlavor.ImagePullSecrets,
+		Operator:               false,
+		ReleaseBuild:           buildinfo.ReleaseBuild,
+		FeatureFlags:           features.GetFeatureFlagsAsGenericMap(),
+		TelemetryEnabled:       true,
 
 		AutoSensePodSecurityPolicies: true,
 	}
diff --git a/pkg/helm/charts/meta_test.go b/pkg/helm/charts/meta_test.go
index ed519d25bd3f6..6fc69592c3d3e 100644
--- a/pkg/helm/charts/meta_test.go
+++ b/pkg/helm/charts/meta_test.go
@@ -29,8 +29,6 @@ func TestRequiredMetaValuesArePresent(t *testing.T) {
 			assert.NotEmpty(t, metaVals.CollectorRegistry)
 			assert.NotEmpty(t, metaVals.CollectorImageRemote)
 			assert.NotEmpty(t, metaVals.CollectorImageTag)
-			assert.NotEmpty(t, metaVals.ScannerImageRemote)
-			assert.NotEmpty(t, metaVals.ScannerImageTag)
 			assert.NotEmpty(t, metaVals.ScannerV4ImageRemote)
 			assert.NotEmpty(t, metaVals.ScannerV4DBImageRemote)
 			assert.NotEmpty(t, metaVals.ScannerV4ImageTag)
@@ -39,8 +37,6 @@ func TestRequiredMetaValuesArePresent(t *testing.T) {
 
 			assert.NotEmpty(t, metaVals.Versions.ChartVersion)
 			assert.NotEmpty(t, metaVals.Versions.MainVersion)
-			// TODO: replace this with the check of the scanner tag once we migrate to it instead of version.
-			assert.NotEmpty(t, metaVals.Versions.ScannerVersion)
 			assert.Len(t, metaVals.FeatureFlags, len(features.Flags))
 		})
 	}
diff --git a/pkg/helm/charts/tests/centralservices/base_suite_test.go b/pkg/helm/charts/tests/centralservices/base_suite_test.go
index e1da27eab219c..91a163712ac25 100644
--- a/pkg/helm/charts/tests/centralservices/base_suite_test.go
+++ b/pkg/helm/charts/tests/centralservices/base_suite_test.go
@@ -26,7 +26,6 @@ var (
 			Revision:  1,
 			IsInstall: true,
 		},
-		APIVersions: append(chartutil.DefaultVersionSet, "app.k8s.io/v1beta1/Application"),
 	}
 
 	// A values YAML that sets all generatable values explicitly, and causes all
diff --git a/pkg/helm/charts/tests/centralservices/flavor/flavor_test.go b/pkg/helm/charts/tests/centralservices/flavor/flavor_test.go
index b105a1066645f..97dc8de19a6bf 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/flavor_test.go
+++ b/pkg/helm/charts/tests/centralservices/flavor/flavor_test.go
@@ -17,19 +17,14 @@ const testDir = "testdata/helmtest"
 
 func customFlavor(t *testing.T) defaults.ImageFlavor {
 	return defaults.ImageFlavor{
-		MainRegistry:           "example.io",
-		MainImageName:          "custom-main",
-		MainImageTag:           "1.2.3",
-		CentralDBImageName:     "custom-central-db",
-		CentralDBImageTag:      "1.2.4",
-		ScannerImageName:       "custom-scanner",
-		ScannerSlimImageName:   "scanner-slim",
-		ScannerImageTag:        "3.2.1",
-		ScannerDBSlimImageName: "scanner-slim",
-		ScannerDBImageName:     "custom-scanner-db",
-		ScannerV4ImageName:     "custom-scanner-v4",
-		ScannerV4DBImageName:   "custom-scanner-v4-db",
-		ScannerV4ImageTag:      "4.2.1",
+		MainRegistry:         "example.io",
+		MainImageName:        "custom-main",
+		MainImageTag:         "1.2.3",
+		CentralDBImageName:   "custom-central-db",
+		CentralDBImageTag:    "1.2.4",
+		ScannerV4ImageName:   "custom-scanner-v4",
+		ScannerV4DBImageName: "custom-scanner-v4-db",
+		ScannerV4ImageTag:    "4.2.1",
 
 		ChartRepo: defaults.ChartRepo{
 			URL:     "url",
@@ -47,7 +42,7 @@ func TestOverriddenTagsAreRenderedInTheChart(t *testing.T) {
 	helmChartTestUtils.RunHelmTestSuite(t, testDir, image.CentralServicesChartPrefix, helmChartTestUtils.RunHelmTestSuiteOpts{
 		MetaValuesOverridesFunc: func(values *charts.MetaValues) {
 			values.ImageTag = "custom-main"
-			values.ScannerImageTag = "custom-scanner"
+			values.ScannerV4ImageTag = "custom-scanner"
 		},
 		HelmTestOpts: []helmTest.LoaderOpt{helmTest.WithAdditionalTestDirs(path.Join(testDir, "override"))},
 	})
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/custom/custom.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/custom/custom.test.yaml
index c22fa09bf02b5..360caf1b98a81 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/custom/custom.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/custom/custom.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: validate image defaults
   expect: |
     assertCentral("example.io/custom-main:1.2.3")
-    assertScanner("example.io/custom-scanner:3.2.1")
-    assertScannerDB("example.io/custom-scanner-db:3.2.1")
+    assertScanner("example.io/custom-scanner-v4:4.2.1")
+    assertScannerDB("example.io/custom-scanner-v4-db:4.2.1")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml
index ebdce7fe2a282..93ca4d84c139d 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: validate image defaults
   expect: |
     assertCentral("quay.io/rhacs-eng/main:3.0.99.0")
-    assertScanner("quay.io/rhacs-eng/scanner:99.9.9")
-    assertScannerDB("quay.io/rhacs-eng/scanner-db:99.9.9")
+    assertScanner("quay.io/rhacs-eng/scanner-v4:3.0.99.0")
+    assertScannerDB("quay.io/rhacs-eng/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml
index fef3a240e82fa..93ca4d84c139d 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: validate image defaults
   expect: |
     assertCentral("quay.io/rhacs-eng/main:3.0.99.0")
-    assertScanner("quay.io/rhacs-eng/scanner:3.0.99.0")
-    assertScannerDB("quay.io/rhacs-eng/scanner-db:3.0.99.0")
+    assertScanner("quay.io/rhacs-eng/scanner-v4:3.0.99.0")
+    assertScannerDB("quay.io/rhacs-eng/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml
index 7ec503546df38..441b3125a4a7c 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: validate image defaults
   expect: |
     assertCentral("quay.io/stackrox-io/main:3.0.99.0")
-    assertScanner("quay.io/stackrox-io/scanner:99.9.9")
-    assertScannerDB("quay.io/stackrox-io/scanner-db:99.9.9")
+    assertScanner("quay.io/stackrox-io/scanner-v4:3.0.99.0")
+    assertScannerDB("quay.io/stackrox-io/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml
index 57b4950e7242e..441b3125a4a7c 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: validate image defaults
   expect: |
     assertCentral("quay.io/stackrox-io/main:3.0.99.0")
-    assertScanner("quay.io/stackrox-io/scanner:3.0.99.0")
-    assertScannerDB("quay.io/stackrox-io/scanner-db:3.0.99.0")
+    assertScanner("quay.io/stackrox-io/scanner-v4:3.0.99.0")
+    assertScannerDB("quay.io/stackrox-io/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/override/override.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/override/override.test.yaml
index 8d83e17d83abb..a7e0d3863b808 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/override/override.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/override/override.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: should use custom tag
   expect: |
     assertCentral("test.registry/main:custom-main")
-    assertScanner("test.registry/scanner:custom-scanner")
-    assertScannerDB("test.registry/scanner-db:custom-scanner")
+    assertScanner("test.registry/scanner-v4:custom-scanner")
+    assertScannerDB("test.registry/scanner-v4-db:custom-scanner")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml
index bcbd11a72a0a2..9d944dfb68803 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: validate image defaults
   expect: |
     assertCentral("registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9:3.0.99.0")
-    assertScanner("registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9:3.0.99.0")
-    assertScannerDB("registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9:3.0.99.0")
+    assertScanner("registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel9:3.0.99.0")
+    assertScannerDB("registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9:3.0.99.0")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml
index 5ad1abca7c817..5ecbd5071070d 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml
@@ -2,5 +2,5 @@ tests:
 - name: validate image defaults
   expect: |
     assertCentral("stackrox.io/main:3.0.99.0")
-    assertScanner("stackrox.io/scanner:3.0.99.0")
-    assertScannerDB("stackrox.io/scanner-db:3.0.99.0")
+    assertScanner("stackrox.io/scanner-v4:3.0.99.0")
+    assertScannerDB("stackrox.io/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/suite.yaml b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/suite.yaml
index df86ede27ba52..c036f28423f5d 100644
--- a/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/suite.yaml
+++ b/pkg/helm/charts/tests/centralservices/flavor/testdata/helmtest/suite.yaml
@@ -6,10 +6,13 @@ defs: |
     container(.deployments.central; "central") | assertThat(.image == name);
 
   def assertScanner(name):
-    container(.deployments.scanner; "scanner") | assertThat(.image == name);
+    [
+      (container(.deployments["scanner-v4-indexer"]; "indexer") | assertThat(.image == name)),
+      (container(.deployments["scanner-v4-matcher"]; "matcher") | assertThat(.image == name))
+    ][];
 
   def assertScannerDB(name):
-    container(.deployments["scanner-db"]; "db") | assertThat(.image == name);
+    container(.deployments["scanner-v4-db"]; "db") | assertThat(.image == name);
 
 server:
   visibleSchemas:
@@ -40,13 +43,6 @@ values:
       serviceTLS:
         cert: "Central DB cert"
         key: "Central DB key"
-  scanner:
-    serviceTLS:
-      cert: "Scanner cert"
-      key: "Scanner key"
-    dbServiceTLS:
-      cert: "ScannerDB cert"
-      key: "ScannerDB key"
   scannerV4:
     # Setting certificate and key to dummy values, otherwise an attempt is made to generate the certificates, which would fail.
     indexer:
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest-truncation/chart-label-truncation.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest-truncation/chart-label-truncation.test.yaml
index ead8e88ddbb0c..8c3b204814e22 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest-truncation/chart-label-truncation.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest-truncation/chart-label-truncation.test.yaml
@@ -23,12 +23,12 @@ tests:
     chartLabel(.services.central) | length | assertThat(. <= 63)
     chartLabel(.services.central) | assertThat(test("[a-zA-Z0-9]$"))
 
-- name: Scanner deployment has valid truncated chart label
+- name: Scanner V4 indexer deployment has valid truncated chart label
   expect: |
-    chartLabel(.deployments.scanner) | length | assertThat(. <= 63)
-    chartLabel(.deployments.scanner) | assertThat(test("[a-zA-Z0-9]$"))
+    chartLabel(.deployments["scanner-v4-indexer"]) | length | assertThat(. <= 63)
+    chartLabel(.deployments["scanner-v4-indexer"]) | assertThat(test("[a-zA-Z0-9]$"))
 
-- name: Scanner service has valid truncated chart label
+- name: Scanner V4 indexer service has valid truncated chart label
   expect: |
-    chartLabel(.services.scanner) | length | assertThat(. <= 63)
-    chartLabel(.services.scanner) | assertThat(test("[a-zA-Z0-9]$"))
+    chartLabel(.services["scanner-v4-indexer"]) | length | assertThat(. <= 63)
+    chartLabel(.services["scanner-v4-indexer"]) | assertThat(test("[a-zA-Z0-9]$"))
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/central-worker.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/central-worker.test.yaml
new file mode 100644
index 0000000000000..ce2ae05e8ad72
--- /dev/null
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/central-worker.test.yaml
@@ -0,0 +1,29 @@
+values:
+  imagePullSecrets:
+    allowNone: true
+tests:
+- name: "central-worker is enabled by default"
+  expect: |
+    .deployments["central-worker"] | assertThat(. != null)
+    .serviceaccounts["central-worker"] | assertThat(. != null)
+    container(.deployments["central-worker"]; "central-worker") | .command | assertThat(. == ["/stackrox/central-worker"])
+    container(.deployments["central-worker"]; "central-worker") | .env[] | select(.name == "ROX_CENTRAL_WORKER_ENABLED") | assertThat(.value == "true")
+    container(.deployments.central; "central") | .env[] | select(.name == "ROX_CENTRAL_WORKER_ENABLED") | assertThat(.value == "true")
+  tests:
+  - name: "with network policies"
+    values:
+      network:
+        enableNetworkPolicies: true
+    expect: |
+      .networkpolicys["central-worker"] | assertThat(. != null)
+      .networkpolicys["central-db"].spec.ingress[].from[].podSelector.matchLabels.app | select(. == "central-worker") | assertThat(. == "central-worker")
+
+- name: "central-worker can be disabled"
+  values:
+    centralWorker:
+      enabled: false
+  expect: |
+    .deployments["central-worker"] | assertThat(. == null)
+    .serviceaccounts["central-worker"] | assertThat(. == null)
+    .networkpolicys["central-worker"] | assertThat(. == null)
+    [container(.deployments.central; "central") | .env[] | select(.name == "ROX_CENTRAL_WORKER_ENABLED")] | assertThat(length == 0)
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/central.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/central.test.yaml
index b3d7a0e5a6d35..a64123372839c 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/central.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/central.test.yaml
@@ -111,21 +111,21 @@ tests:
   expect: |
     envVars(.deployments.central; "central") | assertThat(has("ROX_TENANT_ID") == false)
 
-- name: ROX_LEGACY_SCANNER should be true by default
+- name: ROX_LEGACY_SCANNER should be false
   expect: |
-    envVars(.deployments.central; "central")["ROX_LEGACY_SCANNER"] | assertThat(. == "true")
+    envVars(.deployments.central; "central")["ROX_LEGACY_SCANNER"] | assertThat(. == "false")
 
-- name: ROX_LEGACY_SCANNER should be false when scanner is disabled
+- name: ROX_LEGACY_SCANNER should be false even with scanner.disable false
   set:
-    scanner.disable: true
+    scanner.disable: false
   expect: |
     envVars(.deployments.central; "central")["ROX_LEGACY_SCANNER"] | assertThat(. == "false")
 
-- name: ROX_LEGACY_SCANNER should be true when scanner is explicitly enabled
+- name: ROX_LEGACY_SCANNER should be false with scanner.disable true
   set:
-    scanner.disable: false
+    scanner.disable: true
   expect: |
-    envVars(.deployments.central; "central")["ROX_LEGACY_SCANNER"] | assertThat(. == "true")
+    envVars(.deployments.central; "central")["ROX_LEGACY_SCANNER"] | assertThat(. == "false")
 
 - name: Central deployment has secure container security context
   expect: |
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/default-labels.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/default-labels.test.yaml
index fd73a69f9a464..aa004c255c590 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/default-labels.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/default-labels.test.yaml
@@ -14,9 +14,9 @@ tests:
     labels(.deployments.central) | ."app.kubernetes.io/name" | assertThat(. == "stackrox")
     labels(.deployments.central) | ."app.kubernetes.io/component" | assertThat(. == "central")
 
-- name: Scanner
+- name: Scanner V4
   expect: |
-    labels(.services.scanner) | ."app.kubernetes.io/name" | assertThat(. == "stackrox")
-    labels(.services.scanner) | ."app.kubernetes.io/component" | assertThat(. == "scanner")
-    labels(.deployments.scanner) | ."app.kubernetes.io/name" | assertThat(. == "stackrox")
-    labels(.deployments.scanner) | ."app.kubernetes.io/component" | assertThat(. == "scanner")
+    labels(.services["scanner-v4-indexer"]) | ."app.kubernetes.io/name" | assertThat(. == "stackrox")
+    labels(.services["scanner-v4-indexer"]) | ."app.kubernetes.io/component" | assertThat(. == "scanner-v4")
+    labels(.deployments["scanner-v4-indexer"]) | ."app.kubernetes.io/name" | assertThat(. == "stackrox")
+    labels(.deployments["scanner-v4-indexer"]) | ."app.kubernetes.io/component" | assertThat(. == "scanner-v4")
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/host-aliases.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/host-aliases.test.yaml
index c97bcd5bd3171..f1f63734f9ebe 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/host-aliases.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/host-aliases.test.yaml
@@ -3,15 +3,10 @@ values:
     allowNone: true
 tests:
 - name: "with default settings"
-  values:
-    scannerV4:
-      disable: false
   expect: |
     .deployments.central.spec.template.spec.hostAliases | assertThat(. == null)
     .deployments["config-controller"].spec.template.spec.hostAliases | assertThat(. == null)
     .deployments["central-db"].spec.template.spec.hostAliases | assertThat(. == null)
-    .deployments.scanner.spec.template.spec.hostAliases | assertThat(. == null)
-    .deployments["scanner-db"].spec.template.spec.hostAliases | assertThat(. == null)
     .deployments["scanner-v4-indexer"].spec.template.spec.hostAliases | assertThat(. == null)
     .deployments["scanner-v4-matcher"].spec.template.spec.hostAliases | assertThat(. == null)
     .deployments["scanner-v4-db"].spec.template.spec.hostAliases | assertThat(. == null)
@@ -53,35 +48,9 @@ tests:
     .deployments["config-controller"].spec.template.spec.hostAliases[0].hostnames | assertThat(length == 2)
     .deployments["config-controller"].spec.template.spec.hostAliases[0].hostnames[0] | assertThat(. == "foo.local")
     .deployments["config-controller"].spec.template.spec.hostAliases[0].hostnames[1] | assertThat(. == "bar.local")
-- name: "with scanner host aliases"
-  values:
-    scanner:
-      hostAliases:
-      - ip: "127.0.0.1"
-        hostnames: ["foo.local", "bar.local"]
-  expect: |
-    .deployments.scanner.spec.template.spec.hostAliases | assertThat(length == 1)
-    .deployments.scanner.spec.template.spec.hostAliases[0].ip | assertThat(. == "127.0.0.1")
-    .deployments.scanner.spec.template.spec.hostAliases[0].hostnames | assertThat(length == 2)
-    .deployments.scanner.spec.template.spec.hostAliases[0].hostnames[0] | assertThat(. == "foo.local")
-    .deployments.scanner.spec.template.spec.hostAliases[0].hostnames[1] | assertThat(. == "bar.local")
-- name: "with scanner db host aliases"
-  values:
-    scanner:
-      dbHostAliases:
-      - ip: "127.0.0.1"
-        hostnames: [ "foo.local", "bar.local" ]
-  expect: |
-    .deployments.scanner.spec.template.spec.hostAliases | assertThat(. == null)
-    .deployments["scanner-db"].spec.template.spec.hostAliases | assertThat(length == 1)
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].ip | assertThat(. == "127.0.0.1")
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].hostnames | assertThat(length == 2)
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].hostnames[0] | assertThat(. == "foo.local")
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].hostnames[1] | assertThat(. == "bar.local")
 - name: "with scannerV4 indexer host aliases"
   values:
     scannerV4:
-      disable: false
       indexer:
           hostAliases:
           - ip: "127.0.0.1"
@@ -95,7 +64,6 @@ tests:
 - name: "with scannerV4 matcher host aliases"
   values:
     scannerV4:
-      disable: false
       matcher:
         hostAliases:
         - ip: "127.0.0.1"
@@ -109,7 +77,6 @@ tests:
 - name: "with scannerV4 db host aliases"
   values:
     scannerV4:
-      disable: false
       db:
         hostAliases:
         - ip: "127.0.0.1"
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/image-pull-secrets-legacy.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/image-pull-secrets-legacy.test.yaml
index f14bd7e8f8b6b..40618de43f354 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/image-pull-secrets-legacy.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/image-pull-secrets-legacy.test.yaml
@@ -37,7 +37,6 @@ expect: |
   # Ensure that default service accounts are always referenced in the correct fashion in the non-error case
   assumeThat(.error == null) | .serviceaccounts["central"] | saRefersTo(["stackrox", "stackrox-scanner"])
   assumeThat(.error == null) | .serviceaccounts["central-db"] | saRefersTo(["stackrox", "stackrox-scanner"])
-  assumeThat(.error == null) | .serviceaccounts["scanner"] | saRefersTo(["stackrox", "stackrox-scanner"])
 
 tests:
 - name: "with no image pull secret creation"
@@ -50,7 +49,6 @@ tests:
     expect: |
       .serviceaccounts["central"] | saOnlyRefersTo(["stackrox", "stackrox-scanner"])
       .serviceaccounts["central-db"] | saOnlyRefersTo(["stackrox", "stackrox-scanner"])
-      .serviceaccounts["scanner"] | saOnlyRefersTo(["stackrox", "stackrox-scanner"])
   - name: "with default setting of allowNone=false"
     tests:
     - name: "should fail with no extra secrets"
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/monitoring.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/monitoring.test.yaml
index bb6031e7ef67e..1c3ee7ea26aa5 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/monitoring.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/monitoring.test.yaml
@@ -1,8 +1,6 @@
 values:
   imagePullSecrets:
     allowNone: true
-  scannerV4:
-    disable: false
 tests:
 - name: Central monitoring should not be exposed by default
   expect: |
@@ -22,24 +20,6 @@ tests:
       ]
     .networkpolicys["central-monitoring"] | assertThat(. != null)
 
-- name: Scanner monitoring should not be exposed by default
-  expect: |
-    [.deployments.scanner.spec.template.spec.containers[0].ports[] | select(.containerPort == 9090)] | assertThat(length == 0)
-    [.services.scanner.spec.ports[] | select(.port == 9090)] | assertThat(length == 0)
-    .networkpolicys["scanner-monitoring"] | assertThat(. == null)
-
-- name: Scanner monitoring should be exposed when enabled
-  set:
-    scanner.exposeMonitoring: true
-  expect: |
-    .deployments.scanner.spec.template.spec.containers[0].ports[] | select(.containerPort == 9090)
-      | assertThat(.name == "monitoring")
-    .services.scanner.spec.ports[] | select(.port == 9090) | [
-        assertThat(.targetPort == "monitoring"),
-        assertThat(.name == "monitoring")
-      ]
-    .networkpolicys["scanner-monitoring"] | assertThat(. != null)
-
 - name: Scanner V4 monitoring should not be exposed by default
   expect: |
     [.deployments["scanner-v4-indexer"].spec.template.spec.containers[0].ports[] | select(.containerPort == 9090)] | assertThat(length == 0)
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/node-selector.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/node-selector.test.yaml
index 10227e04b10df..0de0f6d0119d5 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/node-selector.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/node-selector.test.yaml
@@ -6,8 +6,6 @@ tests:
   expect: |
     .deployments.central.spec.template.spec.nodeSelector | assertThat(. == null)
     .deployments["config-controller"].spec.template.spec.nodeSelector | assertThat(. == null)
-    .deployments.scanner.spec.template.spec.nodeSelector | assertThat(. == null)
-    .deployments["scanner-db"].spec.template.spec.nodeSelector | assertThat(. == null)
 
 - name: "with empty string settings"
   values:
@@ -15,14 +13,9 @@ tests:
       nodeSelector: ""
     configController:
       nodeSelector: ""
-    scanner:
-      nodeSelector: ""
-      dbNodeSelector: ""
   expect: |
     .deployments.central.spec.template.spec.nodeSelector | assertThat(. == null)
     .deployments["config-controller"].spec.template.spec.nodeSelector | assertThat(. == null)
-    .deployments.scanner.spec.template.spec.nodeSelector | assertThat(. == null)
-    .deployments["scanner-db"].spec.template.spec.nodeSelector | assertThat(. == null)
 
 - name: "with empty dict settings"
   values:
@@ -30,22 +23,15 @@ tests:
       nodeSelector: {}
     configController:
       nodeSelector: {}
-    scanner:
-      nodeSelector: {}
-      dbNodeSelector: {}
   expect: |
     .deployments.central.spec.template.spec.nodeSelector | assertThat(length == 0)
     .deployments["config-controller"].spec.template.spec.nodeSelector | assertThat(length == 0)
-    .deployments.scanner.spec.template.spec.nodeSelector | assertThat(length == 0)
-    .deployments["scanner-db"].spec.template.spec.nodeSelector | assertThat(length == 0)
 
 - name: "with populated settings"
   expect: |
     .deployments.central.spec.template.spec.nodeSelector | assertThat(.role == "central")
     .deployments["config-controller"].spec.template.spec.nodeSelector | assertThat(.role == "config-controller")
-    .deployments.scanner.spec.template.spec.nodeSelector | assertThat(.role == "scanner")
-    .deployments["scanner-db"].spec.template.spec.nodeSelector | assertThat(.role == "scanner-db")
-    [.deployments.central, .deployments["config-controller"], .deployments.scanner, .deployments["scanner-db"]][] |
+    [.deployments.central, .deployments["config-controller"]][] |
       .spec.template.spec.nodeSelector | assertThat(.foo == "bar")
 
   tests:
@@ -59,13 +45,6 @@ tests:
         nodeSelector:
           foo: bar
           role: "config-controller"
-      scanner:
-        nodeSelector:
-          foo: bar
-          role: scanner
-        dbNodeSelector:
-          foo: bar
-          role: "scanner-db"
   - name: "via strings"
     values:
       central:
@@ -76,10 +55,3 @@ tests:
         nodeSelector: |
           foo: bar
           role: "config-controller"
-      scanner:
-        nodeSelector: |
-          foo: bar
-          role: scanner
-        dbNodeSelector: |
-          foo: bar
-          role: "scanner-db"
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-monitoring.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-monitoring.test.yaml
index a9b75d76642e6..fb1f3ab3d3756 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-monitoring.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-monitoring.test.yaml
@@ -54,6 +54,120 @@ tests:
     env.openshift: 4
   tests: *enabled-test
 
+- name: "Central DB PVC space alerts"
+  set:
+    monitoring.openshift.enabled: true
+    env.openshift: 4
+  tests:
+    - name: "warning and critical alerts are created"
+      expect: |
+        .prometheusrules["central-telemeter-stackrox"].spec.groups |
+          assertThat(any(.[]; .name == "rhacs.central-db"))
+        .prometheusrules["central-telemeter-stackrox"].spec.groups[] |
+          select(.name == "rhacs.central-db") | .rules | [
+            assertThat(length == 2),
+            assertThat(all(.[]; .alert == "CentralDBPersistentVolumeFillingUp")),
+            assertThat(any(.[]; .labels.severity == "warning")),
+            assertThat(any(.[]; .labels.severity == "critical"))
+          ]
+        .prometheusrules["central-telemeter-stackrox"].spec.groups[] |
+          select(.name == "rhacs.central-db") | .rules[] |
+          select(.labels.severity == "warning") |
+          assertThat(.expr | contains("persistentvolumeclaim=\"central-db\"") and contains("> 0.8"))
+
+    - name: "custom claim name is honoured"
+      set:
+        central.db.persistence.persistentVolumeClaim.claimName: my-central-db
+      expect: |
+        .prometheusrules["central-telemeter-stackrox"].spec.groups[] |
+          select(.name == "rhacs.central-db") | .rules[0] |
+          assertThat(.expr | contains("persistentvolumeclaim=\"my-central-db\""))
+
+    - name: "omitted when central-db is not PVC-backed"
+      set:
+        central.db.persistence.hostPath: /var/lib/central-db-test
+      expect: |
+        .prometheusrules["central-telemeter-stackrox"].spec.groups |
+          assertThat(all(.[]; .name != "rhacs.central-db"))
+
+- name: "Scanner V4 DB PVC space alerts"
+  set:
+    monitoring.openshift.enabled: true
+    env.openshift: 4
+    scannerV4:
+      disable: false
+  tests:
+    - name: "warning and critical alerts are created"
+      expect: |
+        .prometheusrules["scanner-v4-db-stackrox"].spec.groups |
+          assertThat(any(.[]; .name == "rhacs.scanner-v4-db"))
+        .prometheusrules["scanner-v4-db-stackrox"].spec.groups[] |
+          select(.name == "rhacs.scanner-v4-db") | .rules | [
+            assertThat(length == 2),
+            assertThat(all(.[]; .alert == "ScannerV4DBPersistentVolumeFillingUp")),
+            assertThat(any(.[]; .labels.severity == "warning")),
+            assertThat(any(.[]; .labels.severity == "critical"))
+          ]
+        .prometheusrules["scanner-v4-db-stackrox"].spec.groups[] |
+          select(.name == "rhacs.scanner-v4-db") | .rules[] |
+          select(.labels.severity == "warning") |
+          assertThat(.expr | contains("persistentvolumeclaim=\"scanner-v4-db\"") and contains("> 0.8"))
+
+    - name: "custom claim name is honoured"
+      set:
+        scannerV4.db.persistence.persistentVolumeClaim.claimName: my-scanner-v4-db
+      expect: |
+        .prometheusrules["scanner-v4-db-stackrox"].spec.groups[] |
+          select(.name == "rhacs.scanner-v4-db") | .rules[0] |
+          assertThat(.expr | contains("persistentvolumeclaim=\"my-scanner-v4-db\""))
+
+    - name: "omitted when scanner-v4-db is not PVC-backed"
+      set:
+        scannerV4.db.persistence.none: true
+      expect: |
+        .prometheusrules["scanner-v4-db-stackrox"] | assertThat(. == null)
+
+    - name: "omitted when Scanner V4 is disabled"
+      set:
+        scannerV4.disable: true
+      expect: |
+        .prometheusrules["scanner-v4-db-stackrox"] | assertThat(. == null)
+
+- name: "Custom metrics"
+  set:
+    env.openshift: 4
+  tests:
+    - name: "openshift metrics disabled"
+      expect: |
+        .servicemonitors["central-ocp-api-monitor-stackrox"] | assertThat(. == null)
+
+    - name: "custom metrics disabled"
+      set:
+        monitoring.openshift.enabled: true
+      expect: |
+        .servicemonitors["central-ocp-api-monitor-stackrox"] | assertThat(. == null)
+
+    - name: "custom metrics enabled"
+      set:
+        monitoring.openshift.enabled: true
+        monitoring.openshift.custom.enabled: true
+      expect: |
+        .servicemonitors["central-ocp-api-monitor-stackrox"] | [
+            assertThat(.metadata.namespace == "openshift-monitoring"),
+            assertThat(.spec.endpoints[].port == "https"),
+            assertThat(.spec.endpoints[].path == "/metrics"),
+            assertThat(.spec.endpoints[].scheme == "https"),
+            assertThat(.spec.endpoints[].tlsConfig.caFile == "/etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt")
+          ]
+
+    - name: "custom metrics disabled on managed services"
+      set:
+        monitoring.openshift.enabled: true
+        monitoring.openshift.custom.enabled: true
+        env.managedServices: true
+      expect: |
+        .servicemonitors["central-ocp-api-monitor-stackrox"] | assertThat(. == null)
+
 - name: "When enabled with Scanner V4"
   set:
     monitoring.openshift.enabled: true
@@ -146,6 +260,7 @@ tests:
         .rolebindings["central-prometheus-k8s"] | assertThat(. == null)
         .rolebindings["rhacs-central-auth-reader-stackrox"] | assertThat(. == null)
         .servicemonitors["central-monitor-stackrox"] | assertThat(. == null)
+        .servicemonitors["central-ocp-api-monitor-stackrox"] | assertThat(. == null)
         .services["central-ocp"] | assertThat(. == null)
 
     - name: "secure metrics endpoint is disabled"
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/priority-class-name.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/priority-class-name.test.yaml
index ca907d8af3554..32b4217062519 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/priority-class-name.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/priority-class-name.test.yaml
@@ -7,8 +7,6 @@ tests:
     .deployments.central.spec.template.spec.priorityClassName | assertThat(. == null)
     .deployments["central-db"].spec.template.spec.priorityClassName | assertThat(. == null)
     .deployments["config-controller"].spec.template.spec.priorityClassName | assertThat(. == null)
-    .deployments.scanner.spec.template.spec.priorityClassName | assertThat(. == null)
-    .deployments["scanner-db"].spec.template.spec.priorityClassName | assertThat(. == null)
 
 - name: "with empty string settings"
   values:
@@ -18,15 +16,10 @@ tests:
         priorityClassName: ""
     configController:
       priorityClassName: ""
-    scanner:
-      priorityClassName: ""
-      dbPriorityClassName: ""
   expect: |
     .deployments.central.spec.template.spec.priorityClassName | assertThat(. == null)
     .deployments["central-db"].spec.template.spec.priorityClassName | assertThat(. == null)
     .deployments["config-controller"].spec.template.spec.priorityClassName | assertThat(. == null)
-    .deployments.scanner.spec.template.spec.priorityClassName | assertThat(. == null)
-    .deployments["scanner-db"].spec.template.spec.priorityClassName | assertThat(. == null)
 
 - name: "with populated settings"
   values:
@@ -36,12 +29,7 @@ tests:
         priorityClassName: "central-db"
     configController:
       priorityClassName: "config-controller"
-    scanner:
-      priorityClassName: "scanner"
-      dbPriorityClassName: "scanner-db"
   expect: |
     .deployments.central.spec.template.spec.priorityClassName | assertThat(. == "central")
     .deployments["central-db"].spec.template.spec.priorityClassName | assertThat(. == "central-db")
     .deployments["config-controller"].spec.template.spec.priorityClassName | assertThat(. == "config-controller")
-    .deployments.scanner.spec.template.spec.priorityClassName | assertThat(. == "scanner")
-    .deployments["scanner-db"].spec.template.spec.priorityClassName | assertThat(. == "scanner-db")
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner-v4.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner-v4.test.yaml
index e34ebf1c84dd0..d0ef5623f7292 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner-v4.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner-v4.test.yaml
@@ -105,13 +105,6 @@ tests:
     expect: |
       .notes | assertThat(match("Scanner V4: +enabled"))
       .notes | assertThat(match("Scanner V4 is enabled and the following Scanner V4 components will be deployed: indexer and matcher"))
-# This test can be deleted once the scanner V2 is removed.
-- name: "enabling scanner V4 keeps scanner V2 enabled"
-  set:
-    scannerV4.disable: false
-  expect:
-    .deployments["scanner"] | assertThat(. != null)
-
 - name: "scanner with default settings"
   set:
     scannerV4.disable: false
@@ -256,17 +249,9 @@ tests:
       .deployments["scanner-v4-matcher"] | assertThat(. != null)
       .deployments["scanner-v4-db"] | assertThat(. != null)
     tests:
-    - name: "on new installation with scanner V2 defaults"
-      release: { "isInstall": true, "isUpgrade": false }
-    - name: "on new installation with scanner V2 enabled explicitly"
-      release: { "isInstall": true, "isUpgrade": false }
-      set:
-        scannerV2.disable: false
-    - name: "on new installation with scanner V2 disabled explicitly"
+    - name: "on new installation"
       release: { "isInstall": true, "isUpgrade": false }
-      set:
-        scanner.disable: true
-    - name: "on upgrade from >= 4.8"
+    - name: "on upgrade"
       release: { "isInstall": false, "isUpgrade": true }
       server:
         objects:
@@ -298,45 +283,14 @@ tests:
             ca.pem: ""
             cert.pem: ""
             key.pem: ""
-      tests:
-      - name: "from 4.8"
-        server:
-          objects:
-          - apiVersion: v1
-            kind: ConfigMap
-            metadata:
-              name: stackrox-central-helm
-              namespace: stackrox
-            data:
-              installXYVersion: "4.8"
-      - name: "from 4.9"
-        server:
-          objects:
-          - apiVersion: v1
-            kind: ConfigMap
-            metadata:
-              name: stackrox-central-helm
-              namespace: stackrox
-            data:
-              installXYVersion: "4.9"
-  - name: "not installed"
-    expect: |
-      .deployments["scanner-v4-indexer"] | assertThat(. == null)
-      .deployments["scanner-v4-matcher"] | assertThat(. == null)
-      .deployments["scanner-v4-db"] | assertThat(. == null)
-    tests:
-    - name: "on upgrade from pre-4.8"
-      release: { "isInstall": false, "isUpgrade": true }
 
-- name: "Scanner V4 can be disabled without impacting Scanner V2"
+- name: "Scanner V4 can be disabled"
   set:
     scannerV4.disable: true
   expect: |
     .deployments["scanner-v4-indexer"] | assertThat(. == null)
     .deployments["scanner-v4-matcher"] | assertThat(. == null)
     .deployments["scanner-v4-db"] | assertThat(. == null)
-    .deployments["scanner"] | assertThat(. != null)
-    .deployments["scanner-db"] | assertThat(. != null)
 
 - name: "indexer should allow ingress from central, sensor, and matcher when deployed as a central-service"
   set:
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner.test.yaml
index 18b29c6312380..855ba6189d06b 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner.test.yaml
@@ -4,146 +4,24 @@ values:
     key: ""
   imagePullSecrets:
     allowNone: true
-  scanner:
-    serviceTLS:
-      cert: ""
-      key: ""
-    dbServiceTLS:
-      cert: ""
-      key: ""
   monitoring:
     openshift:
       enabled: false
 tests:
-- name: "scanner with default settings"
-  expect: |
-    .serviceaccounts["scanner"] | assertThat(. != null)
-    .secrets["scanner-db-password"].stringData.password | assertThat(length != 0)
-    .configmaps["scanner-config"].data.["config.yaml"] | assertThat(length != 0)
-    .deployments["scanner-db"].spec.template.spec.affinity.nodeAffinity | .preferredDuringSchedulingIgnoredDuringExecution | assertThat(length == 4)
-    .deployments["scanner"].spec.template.spec.affinity.nodeAffinity | .preferredDuringSchedulingIgnoredDuringExecution | assertThat(length == 3)
-    verifyNodeAffinities(.deployments["scanner"])
-    verifyNodeAffinities(.deployments["scanner-db"])
-    .networkpolicys["scanner"] | assertThat(. != null)
-    .networkpolicys["scanner-db"] | assertThat(. != null)
-    .deployments["scanner"] | assertThat(. != null)
-    .deployments["scanner-db"] | assertThat(. != null)
-    .services["scanner"] | assertThat(. != null)
-    .services["scanner-db"] | assertThat(. != null)
-    .deployments["scanner"].spec.template.spec.volumes[] | select(.name == "additional-ca-volume") | assertThat(.secret.secretName == "additional-ca")
-  tests:
-  - name: "in full mode"
-    expect: |
-      .secrets["scanner-tls"].stringData | assertThat(.["cert.pem"] | contains("BEGIN CERTIFICATE"))
-      .secrets["scanner-db-tls"].stringData | assertThat(.["key.pem"] | contains("BEGIN RSA PRIVATE KEY"))
-      .deployments["scanner"].spec.template.spec.containers[0].image | assertThat(contains("slim") == false)
-      .deployments["scanner-db"].spec.template.spec.containers[0].image | assertThat(contains("slim") == false)
-    tests:
-    - name: "as default"
-    - name: "with explicit setting"
-      set:
-        scanner.mode: full
-    - name: "with empty setting"
-      set:
-        scanner.mode: ""
-
-- name: "scanner with deprecated PodSecurityPolicies disabled"
-  values:
-    system:
-      enablePodSecurityPolicies: false
-  expect: |
-    .podsecuritypolicys["stackrox-scanner"] | assertThat(. == null)
-    .rolebindings["stackrox-scanner-psp"] | assertThat(. == null)
-    .clusterroles["stackrox-scanner-psp"] | assertThat(. == null)
-
-- name: "scanner with deprecated PodSecurityPolicies enabled"
-  values:
-    system:
-      enablePodSecurityPolicies: true
-  expect: |
-    .podsecuritypolicys["stackrox-scanner"] | assertThat(. != null)
-    .rolebindings["stackrox-scanner-psp"] | assertThat(. != null)
-    .clusterroles["stackrox-scanner-psp"] | assertThat(. != null)
-
-- name: "scanner with network policies enabled"
-  set:
-    network.enableNetworkPolicies: true
-  expect: |
-    .networkpolicys["scanner"] | assertThat(. != null)
-    .networkpolicys["scanner-db"] | assertThat(. != null)
-
-- name: "scanner with network policies disabled"
-  set:
-    network.enableNetworkPolicies: false
+- name: "scanner v2 is not deployed"
   expect: |
+    .deployments["scanner"] | assertThat(. == null)
+    .deployments["scanner-db"] | assertThat(. == null)
+    .services["scanner"] | assertThat(. == null)
+    .services["scanner-db"] | assertThat(. == null)
+    .serviceaccounts["scanner"] | assertThat(. == null)
     .networkpolicys["scanner"] | assertThat(. == null)
     .networkpolicys["scanner-db"] | assertThat(. == null)
-
-- name: "configured scanner"
-  values:
-    scanner:
-      replicas: 5
-      autoscaling:
-        minReplicas: 50
-        maxReplicas: 100
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 50
-              preference:
-                matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: Exists
-  expect: |
-    .deployments["scanner"].spec.template.spec.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution | assertThat(length == 1)
-    .horizontalpodautoscalers["scanner"].spec.minReplicas | assertThat(. == 50)
-    .horizontalpodautoscalers["scanner"].spec.maxReplicas | assertThat(. == 100)
-
-- name: "disable scanner cert generation"
-  set:
-    scanner.serviceTLS.generate: false
-    scanner.dbServiceTLS.generate: false
-  expect: |
-    .secrets["scanner-tls"].stringData | assertThat(.["cert.pem"] | length == 0)
-    .secrets["scanner-db-tls"].stringData | assertThat(.["key.pem"] | length == 0)
-
-- name: "scanner with OpenShift 4 and default SCCs"
-  server:
-    visibleSchemas:
-    - openshift-4.12
-    availableSchemas:
-    - openshift-4.12
-  values:
-    env:
-      openshift: 4
-  expect: |
-    .roles["use-scanner-scc"] | .rules[0].resourceNames[0] | assertThat(contains("nonroot-v2"))
-    .rolebindings["scanner-use-scc"] | assertThat(. != null)
-    .deployments["scanner-db"].spec.template.spec.affinity.nodeAffinity | .preferredDuringSchedulingIgnoredDuringExecution | assertThat(length == 4)
-    .deployments["scanner"].spec.template.spec.affinity.nodeAffinity | .preferredDuringSchedulingIgnoredDuringExecution | assertThat(length == 3)
-    verifyNodeAffinities(.deployments["scanner"])
-    verifyNodeAffinities(.deployments["scanner-db"])
-    .networkpolicys["scanner"].spec.ingress | assertThat(length == 2)
-    .networkpolicys["scanner"].spec.ingress[0] | .ports | assertThat(length == 2)
-    .networkpolicys["scanner"].spec.ingress[1] | .from[0].podSelector.matchLabels.app | assertThat(. == "sensor")
-    .networkpolicys["scanner"].spec.ingress[1] | .ports | assertThat(length == 2)
-
-- name: "Installation fails with slim mode"
-  values:
-    scanner:
-      mode: slim
-  expectError: true
-  expect: |
-    .error | assertThat(contains("set to full mode: scanner.mode=full"))
-
-- name: "Scanner deployment has secure container security context"
-  expect: |
-    .deployments["scanner"].spec.template.spec.containers[] | select(.name == "scanner") | .securityContext.allowPrivilegeEscalation | assertThat(. == false)
-
-- name: "Scanner DB has secure container security context"
-  expect: |
-    .deployments["scanner-db"].spec.template.spec.containers[] | select(.name == "db") | .securityContext.allowPrivilegeEscalation | assertThat(. == false)
-
-- name: "Scanner DB init container has secure container security context"
-  expect: |
-    .deployments["scanner-db"].spec.template.spec.initContainers[] | select(.name == "init-db") | .securityContext.allowPrivilegeEscalation | assertThat(. == false)
+  tests:
+  - name: "with default settings"
+  - name: "when scanner.disable is explicitly set to false"
+    set:
+      scanner.disable: false
+  - name: "when scanner.disable is explicitly set to true"
+    set:
+      scanner.disable: true
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/signing-key-bundle.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/signing-key-bundle.test.yaml
new file mode 100644
index 0000000000000..e18cf885cb404
--- /dev/null
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/signing-key-bundle.test.yaml
@@ -0,0 +1,31 @@
+values:
+  imagePullSecrets:
+    allowNone: true
+tests:
+- name: "No signing key bundle by default"
+  expect: |
+    [.deployments.central.spec.template.spec.containers[0].volumeMounts[]
+      | select(.name == "signing-key-bundle")] | assertThat(length == 0)
+    [.deployments.central.spec.template.spec.volumes[]
+      | select(.name == "signing-key-bundle")] | assertThat(length == 0)
+
+- name: "Setting signingKeyBundle.configMapName adds volume and volumeMount"
+  values:
+    central:
+      signingKeyBundle:
+        configMapName: "redhat-signing-key-bundle"
+  expect: |
+    .deployments.central.spec.template.spec.containers[0].volumeMounts[]
+      | select(.name == "signing-key-bundle") | assertThat(. != null)
+    .deployments.central.spec.template.spec.containers[0].volumeMounts[]
+      | select(.name == "signing-key-bundle") | assertThat(.readOnly == true)
+    .deployments.central.spec.template.spec.containers[0].volumeMounts[]
+      | select(.name == "signing-key-bundle") | assertThat(.mountPath == "/tmp/redhat-signing-keys")
+    .deployments.central.spec.template.spec.volumes[] | select(.name == "signing-key-bundle")
+     | assertThat(. != null)
+    .deployments.central.spec.template.spec.volumes[] | select(.name == "signing-key-bundle")
+     | assertThat(.configMap != null)
+    .deployments.central.spec.template.spec.volumes[] | select(.name == "signing-key-bundle")
+     | assertThat(.configMap.name == "redhat-signing-key-bundle")
+    .deployments.central.spec.template.spec.volumes[] | select(.name == "signing-key-bundle")
+     | assertThat(.configMap.optional == true)
diff --git a/pkg/helm/charts/tests/centralservices/testdata/helmtest/tolerations.test.yaml b/pkg/helm/charts/tests/centralservices/testdata/helmtest/tolerations.test.yaml
index 310e9110378aa..ff0eb91391c63 100644
--- a/pkg/helm/charts/tests/centralservices/testdata/helmtest/tolerations.test.yaml
+++ b/pkg/helm/charts/tests/centralservices/testdata/helmtest/tolerations.test.yaml
@@ -13,9 +13,6 @@ tests:
       tolerations: ""
     configController:
       tolerations: ""
-    scanner:
-      tolerations: ""
-      dbTolerations: ""
   expect: |
     .deployments.central.spec.template.spec.tolerations | assertThat(. == null)
     .deployments["config-controller"].spec.template.spec.tolerations | assertThat(. == null)
@@ -26,14 +23,9 @@ tests:
       tolerations: {}
     configController:
       tolerations: {}
-    scanner:
-      tolerations: {}
-      dbTolerations: {}
   expect: |
     .deployments.central.spec.template.spec.tolerations | assertThat(length == 0)
     .deployments["config-controller"].spec.template.spec.tolerations | assertThat(length == 0)
-    .deployments.scanner.spec.template.spec.tolerations | assertThat(length == 0)
-    .deployments["scanner-db"].spec.template.spec.tolerations | assertThat(length == 0)
 
 - name: "with populated settings via dictionary"
   values:
@@ -49,19 +41,6 @@ tests:
         operator: "Exists"
       - key: "node-role.kubernetes.io/control-plane"
         operator: "Exists"
-    scanner:
-      tolerations:
-      - key: "node-role.kubernetes.io/infra"
-        operator: "Exists"
-      - key: "node-role.kubernetes.io/control-plane"
-        operator: "Exists"
-      dbTolerations:
-      - key: "node-role.kubernetes.io/infra"
-        operator: "Exists"
-      - key: "node-role.kubernetes.io/control-plane"
-        operator: "Exists"
   expect: |
     .deployments.central.spec.template.spec.tolerations | assertThat(length == 2)
     .deployments["config-controller"].spec.template.spec.tolerations | assertThat(length == 2)
-    .deployments.scanner.spec.template.spec.tolerations | assertThat(length == 2)
-    .deployments["scanner-db"].spec.template.spec.tolerations | assertThat(length == 2)
diff --git a/pkg/helm/charts/tests/securedclusterservices/base_suite_test.go b/pkg/helm/charts/tests/securedclusterservices/base_suite_test.go
index c2ebfdb4461a5..98cb4bf010421 100644
--- a/pkg/helm/charts/tests/securedclusterservices/base_suite_test.go
+++ b/pkg/helm/charts/tests/securedclusterservices/base_suite_test.go
@@ -25,7 +25,6 @@ var (
 			Revision:  1,
 			IsInstall: true,
 		},
-		APIVersions: append(chartutil.DefaultVersionSet, "app.k8s.io/v1beta1/Application"),
 	}
 
 	// A values YAML that sets all generatable values explicitly, and causes all
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/flavor_test.go b/pkg/helm/charts/tests/securedclusterservices/flavor/flavor_test.go
index 1159f0b54004f..8d64d1232e0de 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/flavor_test.go
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/flavor_test.go
@@ -22,7 +22,7 @@ func TestOverriddenTagsAreRenderedInTheChart(t *testing.T) {
 			values.ClusterName = "test"
 			values.ImageTag = "custom-main"
 			values.CollectorImageTag = "custom-collector"
-			values.ScannerImageTag = "custom-scanner"
+			values.ScannerV4ImageTag = "custom-scanner"
 		},
 		HelmTestOpts: []helmTest.LoaderOpt{helmTest.WithAdditionalTestDirs(path.Join(testDir, "override"))},
 	})
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml
index 3817dff108f7d..2e6ebea995edc 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml
@@ -17,7 +17,7 @@ tests:
     availableSchemas:
     - openshift-4.12
   set:
-    scanner.disable: false
+    scannerV4.disable: false
   expect: |
-    assertScannerIs("quay.io/rhacs-eng/scanner-slim:99.9.9")
-    assertScannerDBIs("quay.io/rhacs-eng/scanner-db-slim:99.9.9")
+    assertScannerIs("quay.io/rhacs-eng/scanner-v4:3.0.99.0")
+    assertScannerDBIs("quay.io/rhacs-eng/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml
index 779cd36600b16..ceacb4bad117a 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml
@@ -11,7 +11,7 @@ tests:
     availableSchemas:
     - openshift-4.12
   set:
-    scanner.disable: false
+    scannerV4.disable: false
   expect: |
-    assertScannerIs("quay.io/rhacs-eng/scanner-slim:3.0.99.0")
-    assertScannerDBIs("quay.io/rhacs-eng/scanner-db-slim:3.0.99.0")
+    assertScannerIs("quay.io/rhacs-eng/scanner-v4:3.0.99.0")
+    assertScannerDBIs("quay.io/rhacs-eng/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml
index 07fb6e0f41eaa..4cad35e21e70f 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml
@@ -11,7 +11,7 @@ tests:
     availableSchemas:
     - openshift-4.12
   set:
-    scanner.disable: false
+    scannerV4.disable: false
   expect: |
-    assertScannerIs("quay.io/stackrox-io/scanner-slim:99.9.9")
-    assertScannerDBIs("quay.io/stackrox-io/scanner-db-slim:99.9.9")
+    assertScannerIs("quay.io/stackrox-io/scanner-v4:3.0.99.0")
+    assertScannerDBIs("quay.io/stackrox-io/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml
index 8ddf26e966cfd..9b7e3c7b42b23 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml
@@ -11,7 +11,7 @@ tests:
     availableSchemas:
     - openshift-4.12
   set:
-    scanner.disable: false
+    scannerV4.disable: false
   expect: |
-    assertScannerIs("quay.io/stackrox-io/scanner-slim:3.0.99.0")
-    assertScannerDBIs("quay.io/stackrox-io/scanner-db-slim:3.0.99.0")
+    assertScannerIs("quay.io/stackrox-io/scanner-v4:3.0.99.0")
+    assertScannerDBIs("quay.io/stackrox-io/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/override/override.test.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/override/override.test.yaml
index fef5e5bec62ff..a2cc77ac74ca5 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/override/override.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/override/override.test.yaml
@@ -11,8 +11,8 @@ tests:
     availableSchemas:
     - openshift-4.12
   set:
-    scanner.disable: false
+    scannerV4.disable: false
   expect: |
-    .deployments["scanner-db"] | toyaml | print
-    assertScannerIs("test.registry/scanner-slim:custom-scanner")
-    assertScannerDBIs("test.registry/scanner-db-slim:custom-scanner")
+    .deployments["scanner-v4-db"] | toyaml | print
+    assertScannerIs("test.registry/scanner-v4:custom-scanner")
+    assertScannerDBIs("test.registry/scanner-v4-db:custom-scanner")
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml
index 196f45525d3da..4ba06c0bba403 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml
@@ -11,7 +11,7 @@ tests:
     availableSchemas:
     - openshift-4.12
   set:
-    scanner.disable: false
+    scannerV4.disable: false
   expect: |
-    assertScannerIs("registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9:3.0.99.0")
-    assertScannerDBIs("registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9:3.0.99.0")
+    assertScannerIs("registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel9:3.0.99.0")
+    assertScannerDBIs("registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9:3.0.99.0")
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml
index 613f3a5ea1a1b..f7beadb61b806 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml
@@ -11,7 +11,7 @@ tests:
     availableSchemas:
     - openshift-4.12
   set:
-    scanner.disable: false
+    scannerV4.disable: false
   expect: |
-    assertScannerIs("stackrox.io/scanner-slim:3.0.99.0")
-    assertScannerDBIs("stackrox.io/scanner-db-slim:3.0.99.0")
+    assertScannerIs("stackrox.io/scanner-v4:3.0.99.0")
+    assertScannerDBIs("stackrox.io/scanner-v4-db:3.0.99.0")
diff --git a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/suite.yaml b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/suite.yaml
index 4eccacda06282..9eddcbc390b34 100644
--- a/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/suite.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/suite.yaml
@@ -14,10 +14,10 @@ defs: |
     container(.daemonsets.collector; "collector") | assertThat(.image == name);
 
   def assertScannerIs(name):
-    container(.deployments.scanner; "scanner") | assertThat(.image == name);
+    container(.deployments["scanner-v4-indexer"]; "indexer") | assertThat(.image == name);
 
   def assertScannerDBIs(name):
-    container(.deployments["scanner-db"]; "db") | assertThat(.image == name);
+    container(.deployments["scanner-v4-db"]; "db") | assertThat(.image == name);
 server:
   visibleSchemas:
   - kubernetes-1.20.2
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/collector-compliance.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/collector-compliance.test.yaml
index 754730bfcf9b5..f9fb72c1d42f2 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/collector-compliance.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/collector-compliance.test.yaml
@@ -6,6 +6,31 @@ values:
   imagePullSecrets:
     allowNone: true
 tests:
+- name: "does not set Scanner V2 node inventory env (Go default is off)"
+  expect: |
+    envVars(.daemonsets.collector; "compliance") | assertThat(has("ROX_CALL_NODE_INVENTORY_ENABLED") == false)
+  tests:
+  - name: "on kubernetes"
+  - name: "on OpenShift 4"
+    server:
+      visibleSchemas:
+      - openshift-4.12
+      availableSchemas:
+      - openshift-4.12
+- name: "does not set node index host path on kubernetes"
+  expect: |
+    envVars(.daemonsets.collector; "compliance") | assertThat(has("ROX_NODE_INDEX_HOST_PATH") == false)
+    [container(.daemonsets.collector; "compliance") | .volumeMounts[] | select(.mountPath | startswith("/hostindex"))] | length | assertThat(. == 0)
+- name: "OpenShift 4 indexes /hostindex with usr/share and usr/lib RPM paths"
+  server:
+    visibleSchemas:
+    - openshift-4.12
+    availableSchemas:
+    - openshift-4.12
+  expect: |
+    envVars(.daemonsets.collector; "compliance")["ROX_NODE_INDEX_HOST_PATH"] | assertThat(. == "/hostindex")
+    [container(.daemonsets.collector; "compliance") | .volumeMounts[] | select(.mountPath == "/hostindex/usr/share")] | length | assertThat(. == 1)
+    [container(.daemonsets.collector; "compliance") | .volumeMounts[] | select(.mountPath == "/hostindex/usr/lib")] | length | assertThat(. == 1)
 - name: "test securityContext"
   tests:
   - name: "by default seLinuxOptions are enabled and use container_runtime_t as container runtime"
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/host-aliases.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/host-aliases.test.yaml
index 3ed742cf3690f..22c2d79fe237d 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/host-aliases.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/host-aliases.test.yaml
@@ -41,32 +41,6 @@ tests:
     .deployments["admission-control"].spec.template.spec.hostAliases[0].hostnames | assertThat(length == 2)
     .deployments["admission-control"].spec.template.spec.hostAliases[0].hostnames[0] | assertThat(. == "foo.local")
     .deployments["admission-control"].spec.template.spec.hostAliases[0].hostnames[1] | assertThat(. == "bar.local")
-- name: "with scanner host aliases"
-  values:
-    scanner:
-      disable: false
-      hostAliases:
-      - ip: "127.0.0.1"
-        hostnames: [ "foo.local", "bar.local" ]
-  expect: |
-    .deployments.scanner.spec.template.spec.hostAliases | assertThat(length == 1)
-    .deployments.scanner.spec.template.spec.hostAliases[0].ip | assertThat(. == "127.0.0.1")
-    .deployments.scanner.spec.template.spec.hostAliases[0].hostnames | assertThat(length == 2)
-    .deployments.scanner.spec.template.spec.hostAliases[0].hostnames[0] | assertThat(. == "foo.local")
-    .deployments.scanner.spec.template.spec.hostAliases[0].hostnames[1] | assertThat(. == "bar.local")
-- name: "with scanner db host aliases"
-  values:
-    scanner:
-      disable: false
-      dbHostAliases:
-      - ip: "127.0.0.1"
-        hostnames: [ "foo.local", "bar.local" ]
-  expect: |
-    .deployments["scanner-db"].spec.template.spec.hostAliases | assertThat(length == 1)
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].ip | assertThat(. == "127.0.0.1")
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].hostnames | assertThat(length == 2)
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].hostnames[0] | assertThat(. == "foo.local")
-    .deployments["scanner-db"].spec.template.spec.hostAliases[0].hostnames[1] | assertThat(. == "bar.local")
 - name: "with scanner V4 db host aliases"
   values:
     scannerV4:
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/image-pull-secrets.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/image-pull-secrets.test.yaml
index f7818b8765444..8bf544cb9fb31 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/image-pull-secrets.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/image-pull-secrets.test.yaml
@@ -19,29 +19,13 @@ expect: |
   assumeThat(.error == null) | .serviceaccounts["collector"] | saNotRefersTo(["stackrox", "stackrox-scanner", "collector-stackrox"])
   assumeThat(.error == null) | .serviceaccounts["sensor"] | saNotRefersTo(["stackrox", "stackrox-scanner", "collector-stackrox"])
   assumeThat(.error == null) | .serviceaccounts["admission-control"] | saNotRefersTo(["stackrox", "stackrox-scanner", "collector-stackrox"])
-  assumeThat(.error == null) | .serviceaccounts["scanner"] | saNotRefersTo(["stackrox", "stackrox-scanner", "collector-stackrox"])
 
   # Ensure that sensor and admission-control secrets do not reference the collector secrets in the non-error case.
 
   assumeThat(.error == null) | .serviceaccounts["sensor"] | saNotRefersTo(["secured-cluster-services-collector", "collector-stackrox"])
   assumeThat(.error == null) | .serviceaccounts["admission-control"] | saNotRefersTo(["secured-cluster-services-collector", "collector-stackrox"])
-  assumeThat(.error == null) | .serviceaccounts["scanner"] | saNotRefersTo(["secured-cluster-services-collector", "collector-stackrox"])
 
 tests:
-- name: "scanner service account references image pull secrets if scanner V4 is disabled"
-  values:
-    scanner:
-      disable: false
-    scannerV4:
-      disable: true
-  tests:
-  - name: "if image pull secrets are specified"
-    values:
-      imagePullSecrets:
-        username: euler
-        password: "0.57721"
-    expect: |
-      .serviceaccounts["scanner"] | saRefersTo(["secured-cluster-services-main"])
 - name: "with no image pull secret creation"
   expect: |
     .secrets?["secured-cluster-services-main"]? | assertThat(. == null)
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/openshift-monitoring.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/openshift-monitoring.test.yaml
index f10712e50aaf9..2cea2a231037f 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/openshift-monitoring.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/openshift-monitoring.test.yaml
@@ -124,6 +124,72 @@ tests:
           ]
         .networkpolicys["scanner-v4-indexer-monitoring-tls"] | assertThat(. != null)
 
+- name: "Scanner V4 DB PVC space alerts"
+  set:
+    monitoring.openshift.enabled: true
+    env.openshift: 4
+    scannerV4.disable: false
+  tests:
+    # Scanner V4 DB in the secured cluster only uses a PVC when a default
+    # StorageClass is present; otherwise it falls back to emptyDir and no PVC
+    # alert should be emitted.
+    - name: "warning and critical alerts are created when PVC-backed"
+      server:
+        objects:
+        - apiVersion: storage.k8s.io/v1
+          kind: StorageClass
+          metadata:
+            name: def-sc
+            annotations:
+              storageclass.kubernetes.io/is-default-class: true
+      expect: |
+        .prometheusrules["scanner-v4-db-stackrox"].spec.groups |
+          assertThat(any(.[]; .name == "rhacs.scanner-v4-db"))
+        .prometheusrules["scanner-v4-db-stackrox"].spec.groups[] |
+          select(.name == "rhacs.scanner-v4-db") | .rules | [
+            assertThat(length == 2),
+            assertThat(all(.[]; .alert == "ScannerV4DBPersistentVolumeFillingUp")),
+            assertThat(any(.[]; .labels.severity == "warning")),
+            assertThat(any(.[]; .labels.severity == "critical"))
+          ]
+        .prometheusrules["scanner-v4-db-stackrox"].spec.groups[] |
+          select(.name == "rhacs.scanner-v4-db") | .rules[] |
+          select(.labels.severity == "warning") |
+          assertThat(.expr | contains("persistentvolumeclaim=\"scanner-v4-db\"") and contains("> 0.8"))
+
+    - name: "alerts target the PVC namespace when overridden"
+      release:
+        namespace: default
+      set:
+        meta.namespaceOverride: my-stackrox
+        allowNonstandardNamespace: true
+      server:
+        objects:
+        - apiVersion: storage.k8s.io/v1
+          kind: StorageClass
+          metadata:
+            name: def-sc
+            annotations:
+              storageclass.kubernetes.io/is-default-class: true
+      expect: |
+        .persistentvolumeclaims["scanner-v4-db"].metadata.namespace | assertThat(. == "my-stackrox")
+        .prometheusrules["scanner-v4-db-default"].spec.groups[] |
+          select(.name == "rhacs.scanner-v4-db") | .rules[] | [
+            assertThat(.expr | contains("kubelet_volume_stats_used_bytes{namespace=\"my-stackrox\"")),
+            assertThat(.expr | contains("kubelet_volume_stats_capacity_bytes{namespace=\"my-stackrox\"")),
+            assertThat(.annotations.description | contains("in namespace my-stackrox"))
+          ]
+
+    - name: "omitted when scanner-v4-db falls back to emptyDir (no default StorageClass)"
+      expect: |
+        .prometheusrules["scanner-v4-db-stackrox"] | assertThat(. == null)
+
+    - name: "omitted when Scanner V4 is disabled"
+      set:
+        scannerV4.disable: true
+      expect: |
+        .prometheusrules["scanner-v4-db-stackrox"] | assertThat(. == null)
+
 - name: "When enabled via default value"
   set:
     env.openshift: 4
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml
index 337d30dec6a90..cbf66a721e85d 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml
@@ -8,26 +8,23 @@ server:
   availableSchemas:
   - openshift-4.12
 tests:
-- name: "scanner with default settings is in slim mode"
+- name: "scanner v2 is not deployed"
   set:
     imagePullSecrets.allowNone: true
-    scanner.disable: false
   expect: |
-    container(.deployments["scanner"]; "scanner").image | contains("slim")
-    container(.deployments["scanner-db"]; "db").image | contains("slim")
-    envVars(.deployments.sensor; "sensor")["ROX_LOCAL_IMAGE_SCANNING_ENABLED"] | assertThat(. == "true")
-    .deployments.["scanner"].spec.template.spec.volumes[] | select(.name == "additional-ca-volume") | assertThat(.secret.secretName == "additional-ca-sensor")
+    .deployments["scanner"] | assertThat(. == null)
+    .deployments["scanner-db"] | assertThat(. == null)
+    .serviceaccounts["scanner"] | assertThat(. == null)
   tests:
-  - name: "on openshift 4"
-
-- name: "scanner is enabled by default"
-  set:
-    imagePullSecrets.allowNone: true
-  expect: |
-    .deployments["scanner"] | assertThat(. != null)
-    .deployments["scanner-db"] | assertThat(. != null)
-    .serviceaccounts["scanner"] | assertThat(. != null)
+  - name: "with default settings"
+  - name: "when scanner.disable is explicitly set to false"
+    set:
+      scanner.disable: false
+  - name: "when scanner.disable is explicitly set to true"
+    set:
+      scanner.disable: true
 
+# TODO(ROX-36705): Reorganize tests: move V4 related tests to dedicated file.
 - name: "scanner V4 is enabled by default"
   set:
     imagePullSecrets.allowNone: true
@@ -36,122 +33,10 @@ tests:
     .deployments["scanner-v4-db"] | assertThat(. != null)
     .serviceaccounts["scanner-v4"] | assertThat(. != null)
 
-
-- name: "scanner can override image config"
-  set:
-    imagePullSecrets.allowNone: true
-    scanner.disable: false
-  expect: |
-    container(.deployments["scanner"]; "scanner") | assertThat(.image == "custom.io/custom-scanner:1.2.3")
-    container(.deployments["scanner-db"]; "db") | assertThat(.image == "custom.io/custom-scanner-db:1.2.3")
-  tests:
-  - name: "with fullref"
-    values:
-      image:
-        scanner:
-          fullRef: "custom.io/custom-scanner:1.2.3"
-        scannerDb:
-          fullRef: "custom.io/custom-scanner-db:1.2.3"
-  - name: "with separate parts"
-    values:
-      image:
-        scanner:
-          tag: 1.2.3
-          registry: custom.io
-          name: custom-scanner
-        scannerDb:
-          tag: 1.2.3
-          registry: custom.io
-          name: custom-scanner-db
-
-- name: "scanner accepts connections from sensor when scanner slim is enabled"
-  set:
-    imagePullSecrets.allowNone: true
-    scanner.disable: false
-    scanner.mode: "slim"
-    network.enableNetworkPolicies: true
-  expect: |
-    .networkpolicys["scanner"].spec.ingress | assertThat(length == 2)
-    .networkpolicys["scanner"].spec.ingress[1] | .from[0].podSelector.matchLabels.app | assertThat(. == "sensor")
-
-- name: "Network policies are disabled"
-  set:
-    imagePullSecrets.allowNone: true
-    scanner.disable: false
-    scanner.mode: "slim"
-    network.enableNetworkPolicies: false
-  expect: |
-    .networkpolicys["scanner"] | assertThat(. == null)
-
-- name: "scanner slim service account can access image pull secrets"
-  server:
-    objects:
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: stackrox
-        namespace: stackrox
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: stackrox-scanner
-        namespace: stackrox
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: collector-stackrox
-        namespace: stackrox
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: secured-cluster-services-main
-        namespace: stackrox
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: secured-cluster-services-collector
-        namespace: stackrox
-  set:
-    scanner.disable: false
-    scanner.mode: "slim"
-  expect: |
-    assumeThat(.error == null) | .serviceaccounts["scanner"] | saRefersTo(["secured-cluster-services-main", "stackrox", "stackrox-scanner"])
-    assumeThat(.error == null) | .serviceaccounts["scanner"] | saNotRefersTo(["secured-cluster-services-collector", "collector-stackrox"])
-  tests:
-  - name: "when authenticating in image registry with user and password"
-    set:
-      imagePullSecrets.username: "imagePullUser"
-      imagePullSecrets.password: "imagePullPassword"
-    expect: |
-      .serviceaccounts["scanner"] | saOnlyRefersTo(["secured-cluster-services-main", "stackrox", "stackrox-scanner"])
-      .secrets["secured-cluster-services-main"] | assertThat(. != null)
-  - name: "when username/password are not provided, no secret is created"
-    expect: .secrets["secured-cluster-services-main"] | assertThat(. == null)
-    tests:
-    - name: "by default (allowNone is false), chart fails"
-      expectError: true
-      expect: |
-        .error | assertThat(contains("You have not specified any image pull secrets, and no existing image pull secrets were automatically inferred."))
-    - name: "when allowNone is true"
-      set:
-        imagePullSecrets.allowNone: true
-      expect: .serviceaccounts["scanner"] | saOnlyRefersTo(["secured-cluster-services-main", "stackrox", "stackrox-scanner"])
-    - name: "when using existing secrets"
-      set:
-        imagePullSecrets.useExisting: "existing-secret1; existing-secret2"
-      expect: |
-        .serviceaccounts["scanner"] | saOnlyRefersTo([
-          "secured-cluster-services-main", "stackrox", "stackrox-scanner", "existing-secret1", "existing-secret2"])
-
 - name: "sensor only connects to local scanner when it is enabled"
   set:
     imagePullSecrets.allowNone: true
   tests:
-  - name: "local scanner enabled"
-    set:
-      scanner.disable: false
-    expect: |
-      envVars(.deployments.sensor; "sensor")["ROX_LOCAL_IMAGE_SCANNING_ENABLED"] | assertThat(. == "true")
   - name: "local scanner enabled"
     set:
       scannerV4.disable: false
@@ -159,41 +44,6 @@ tests:
       envVars(.deployments.sensor; "sensor")["ROX_LOCAL_IMAGE_SCANNING_ENABLED"] | assertThat(. == "true")
   - name: "local scanner disabled"
     set:
-      scanner.disable: true
       scannerV4.disable: true
     expect: |
       envVars(.deployments.sensor; "sensor")| assertThat(has("ROX_LOCAL_IMAGE_SCANNING_ENABLED") == false)
-
-- name: "sensor connects to local scanner using the correct GRPC endpoint"
-  release:
-    namespace: custom-ns
-  set:
-    imagePullSecrets.allowNone: true
-    allowNonstandardNamespace: true
-    scanner.disable: false
-  expect: |
-    .deployments["sensor"].spec.template.spec.containers[0].env[] |
-      select(.name == "ROX_SCANNER_GRPC_ENDPOINT") | assertThat(.value == "scanner.custom-ns.svc:8443")
-
-- name: "Test customize for local scanner"
-  values:
-    imagePullSecrets:
-      allowNone: true
-    scanner:
-      disable: false
-    customize:
-      envVars:
-        FOO: bar
-  expect: |
-    envVars(.deployments.scanner; "scanner")["FOO"] | assertThat(. == "bar")
-
-- name: "Installation fails in full mode"
-  values:
-    imagePullSecrets:
-      allowNone: true
-    scanner:
-      disable: false
-      mode: full
-  expectError: true
-  expect: |
-    .error | assertThat(contains("set to slim mode: scanner.mode=slim"))
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-v4.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-v4.test.yaml
index 9004d4c8b9b09..d886a13aa4ee0 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-v4.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-v4.test.yaml
@@ -23,7 +23,6 @@ tests:
 - name: "scanner v4 with default settings with indexer enabled"
   set:
     imagePullSecrets.allowNone: true
-    scanner.disable: false
     scannerV4.disable: false
   expect: |
     container(.deployments["scanner-v4-indexer"]; "indexer") | assertThat (. != null)
@@ -41,58 +40,13 @@ tests:
     .deployments["scanner-v4-indexer"] | assertThat(. != null)
     .deployments["scanner-v4-db"] | assertThat(. != null)
 
-- name: "scanner V4 should not be installed by default for upgrades from < 4.8"
+- name: "scanner V4 should be installed by default for upgrades"
   release: { "isInstall": false, "isUpgrade": true}
   set:
     imagePullSecrets.allowNone: true
   expect: |
-    .deployments["scanner-v4-indexer"] | assertThat(. == null)
-    .deployments["scanner-v4-db"] | assertThat(. == null)
-
-- name: "scanner V2 should be installed by default for new installations"
-  release: { "isInstall": true, "isUpgrade": false }
-  set:
-    imagePullSecrets.allowNone: true
-  expect: |
-    .deployments["scanner"] | assertThat(. != null)
-    .deployments["scanner-db"] | assertThat(. != null)
-
-- name: "scanner V2 should be not installed by default for upgrades from < 4.8"
-  release: { "isInstall": false, "isUpgrade": true}
-  set:
-    imagePullSecrets.allowNone: true
-  expect: |
-    .deployments["scanner"] | assertThat(. == null)
-    .deployments["scanner-db"] | assertThat(. == null)
-
-- name: "scanner V2 should be installed by default for upgrades from >= 4.8"
-  release: { "isInstall": false, "isUpgrade": true}
-  set:
-    imagePullSecrets.allowNone: true
-  expect: |
-    .deployments["scanner"] | assertThat(. != null)
-    .deployments["scanner-db"] | assertThat(. != null)
-  tests:
-  - name: "from 4.8"
-    server:
-      objects:
-      - apiVersion: v1
-        kind: ConfigMap
-        metadata:
-          name: stackrox-secured-cluster-helm
-          namespace: stackrox
-        data:
-          installXYVersion: "4.8"
-  - name: "from 4.9"
-    server:
-      objects:
-      - apiVersion: v1
-        kind: ConfigMap
-        metadata:
-          name: stackrox-secured-cluster-helm
-          namespace: stackrox
-        data:
-          installXYVersion: "4.9"
+    .deployments["scanner-v4-indexer"] | assertThat(. != null)
+    .deployments["scanner-v4-db"] | assertThat(. != null)
 
 - name: "scanner V4 enabled should only deploy indexer and db"
   set:
@@ -188,7 +142,6 @@ tests:
         namespace: stackrox
   set:
     scannerV4.disable: false
-    scanner.disable: true
   expect: |
     assumeThat(.error == null) | .serviceaccounts["scanner-v4"] | saRefersTo(["secured-cluster-services-main", "stackrox", "stackrox-scanner-v4"])
     assumeThat(.error == null) | .serviceaccounts["scanner-v4"] | saNotRefersTo(["secured-cluster-services-collector", "collector-stackrox"])
@@ -240,28 +193,18 @@ tests:
     expect: |
       envVars(.deployments.sensor; "sensor")["ROX_LOCAL_IMAGE_SCANNING_ENABLED"] | assertThat(. == "true")
     tests:
-    - name: "if only StackRox Scanner is enabled"
+    - name: "if Scanner V4 is enabled"
       set:
-        scanner.disable: false
-        scannerV4.disable: true
-    - name: "if both scanners are enabled"
-      set:
-        scanner.disable: false
         scannerV4.disable: false
     - name: "if localImageScanningScanner is enabled"
       set:
         sensor.localImageScanning.enabled: true
-    - name: "if StackRox Scanner is disabled and Scanner V4 is enabled"
-      set:
-        scanner.disable: true
-        scannerV4.disable: false
   - name: "disabled"
     expect: |
       envVars(.deployments.sensor; "sensor")["ROX_LOCAL_IMAGE_SCANNING_ENABLED"] | assertThat(. != "true")
     tests:
-    - name: "if both scanners are disabled"
+    - name: "if Scanner V4 is disabled"
       set:
-        scanner.disable: true
         scannerV4.disable: true
 - name: "sensor connects to local scanner using the correct gRPC endpoint"
   release:
@@ -286,21 +229,10 @@ tests:
   expect: |
     envVars(.deployments["scanner-v4-indexer"]; "indexer")["FOO"] | assertThat(. == "bar")
 
-- name: "Disabling scanner V2 does not automatically enable scanner V4 as well"
-  values:
-    scanner:
-      disable: true
-    imagePullSecrets:
-      allowNone: true
-  expect: |
-    .deployments["scanner-v4-indexer"] | assertThat(. != null)
-
-- name: "Enabling scanner v2 does not enable scanner v4 if it has been explicitly disabled"
+- name: "Scanner V4 can be explicitly disabled"
   values:
     scannerV4:
       disable: true
-    scanner:
-      disable: false
     imagePullSecrets:
       allowNone: true
   expect: |
@@ -435,8 +367,6 @@ tests:
   values:
     imagePullSecrets:
       allowNone: true
-    scanner:
-      disable: false
   tests:
   - name: "reference to Scanner V4 if Scanner V4 is not disabled"
     expect: |
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/sensor-netpol.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/sensor-netpol.test.yaml
index 1681e1c5421a3..16ece6cbcefee 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/sensor-netpol.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/sensor-netpol.test.yaml
@@ -7,7 +7,6 @@ values:
 tests:
 - name: sensor should not allow any scanner traffic if scanner is disabled
   set:
-    scanner.disable: true
     scannerV4.disable: true
   expect: |
     .networkpolicys["sensor"].spec.ingress | assertThat(length == 2)
@@ -16,29 +15,17 @@ tests:
     .networkpolicys["sensor"].spec.ingress[0] | .from[1].podSelector.matchLabels.service | assertThat(. == "collector")
     .networkpolicys["sensor"].spec.ingress[0] | .from[2].podSelector.matchLabels.app | assertThat(. == "admission-control")
 
-- name: sensor should allow scanner traffic when enabled
-  set:
-    sensor.localImageScanning.enabled: true
-  expect: |
-    .networkpolicys["sensor"].spec.ingress | assertThat(length == 2)
-    .networkpolicys["sensor"].spec.ingress[0].from | assertThat(length == 5)
-    .networkpolicys["sensor"].spec.ingress[0] | .from[0].podSelector.matchLabels.app | assertThat(. == "collector")
-    .networkpolicys["sensor"].spec.ingress[0] | .from[1].podSelector.matchLabels.service | assertThat(. == "collector")
-    .networkpolicys["sensor"].spec.ingress[0] | .from[2].podSelector.matchLabels.app | assertThat(. == "admission-control")
-    .networkpolicys["sensor"].spec.ingress[0] | .from[3].podSelector.matchLabels.app | assertThat(. == "scanner")
-
 - name: sensor should allow scanner v4 traffic when enabled
   set:
     sensor.localImageScanning.enabled: true
     scannerV4.disable: false
   expect: |
     .networkpolicys["sensor"].spec.ingress | assertThat(length == 2)
-    .networkpolicys["sensor"].spec.ingress[0].from | assertThat(length == 5)
+    .networkpolicys["sensor"].spec.ingress[0].from | assertThat(length == 4)
     .networkpolicys["sensor"].spec.ingress[0] | .from[0].podSelector.matchLabels.app | assertThat(. == "collector")
     .networkpolicys["sensor"].spec.ingress[0] | .from[1].podSelector.matchLabels.service | assertThat(. == "collector")
     .networkpolicys["sensor"].spec.ingress[0] | .from[2].podSelector.matchLabels.app | assertThat(. == "admission-control")
-    .networkpolicys["sensor"].spec.ingress[0] | .from[3].podSelector.matchLabels.app | assertThat(. == "scanner")
-    .networkpolicys["sensor"].spec.ingress[0] | .from[4].podSelector.matchLabels.app | assertThat(. == "scanner-v4-indexer")
+    .networkpolicys["sensor"].spec.ingress[0] | .from[3].podSelector.matchLabels.app | assertThat(. == "scanner-v4-indexer")
 
 - name: "network policies enabled"
   set:
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/upgrade.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/upgrade.test.yaml
index d6a979c0f2fc4..c3fa7f4751718 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/upgrade.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/upgrade.test.yaml
@@ -1,4 +1,6 @@
 values:
+  scannerV4:
+    disable: false
   imagePullSecrets:
     allowNone: true
 release:
@@ -22,3 +24,29 @@ tests:
     meta.namespaceOverride: my-stackrox
   expect: |
     verifyNamespace("my-stackrox")
+- name: "should honor the namespace override for scanner V4 indexer endpoint"
+  release:
+    namespace: default
+  set:
+    meta.namespaceOverride: my-stackrox
+  expect: |
+    envVars(.deployments.sensor; "sensor")["ROX_SCANNER_V4_INDEXER_ENDPOINT"]
+      | assertThat(. == "scanner-v4-indexer.my-stackrox.svc:8443")
+- name: "should honor the namespace override for scanner V4 monitoring"
+  server:
+    availableSchemas:
+    - openshift-4.12
+    - com.coreos
+  release:
+    namespace: default
+  set:
+    meta.namespaceOverride: my-stackrox
+    env.openshift: 4
+    monitoring.openshift.enabled: true
+  expect: |
+    .servicemonitors["scanner-v4-monitor-default"]
+      | assertThat(.spec.namespaceSelector.matchNames[0] == "my-stackrox")
+    .servicemonitors["scanner-v4-monitor-default"]
+      | .spec.endpoints[] | .tlsConfig.serverName | assertThat(endswith(".my-stackrox.svc"))
+    .rolebindings["rhacs-scanner-v4-auth-reader-default"]
+      | .subjects[] | select(.name == "scanner-v4") | assertThat(.namespace == "my-stackrox")
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/virtual-machines.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/virtual-machines.test.yaml
index 1dd127096f1b0..7e9c158080dbf 100644
--- a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/virtual-machines.test.yaml
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/virtual-machines.test.yaml
@@ -3,14 +3,15 @@ values:
     allowNone: true
 
 tests:
-- name: "virtual machine VSOCK RBAC and env var are absent by default"
+- name: "virtual machine scanning is enabled by default"
   expect: |
-    .clusterroles["stackrox:vsock-access"] | assertThat(. == null)
-    .clusterrolebindings["stackrox:vsock-access-binding"] | assertThat(. == null)
-    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES"] | assertThat(. == null)
-    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_CONCURRENCY"] | assertThat(. == null)
-    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_PULL_MAX_RESPONSE_SIZE_KB"] | assertThat(. == null)
-    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL"] | assertThat(. == null)
+    .clusterroles["stackrox:vsock-access"] | assertThat(. != null)
+    .clusterrolebindings["stackrox:vsock-access-binding"] | assertThat(. != null)
+    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES"] | assertThat(. == "true")
+    [container(.deployments.sensor; "sensor") | .env[] | select(.name == "ROX_VIRTUAL_MACHINES")] | length | assertThat(. == 1)
+    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_CONCURRENCY"] | assertThat(. == "20")
+    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_PULL_MAX_RESPONSE_SIZE_KB"] | assertThat(. == "16384")
+    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL"] | assertThat(. == "4h")
 
 - name: "virtual machine VSOCK RBAC and env var are created when enabled"
   set:
@@ -19,9 +20,10 @@ tests:
     .clusterroles["stackrox:vsock-access"] | assertThat(. != null)
     .clusterrolebindings["stackrox:vsock-access-binding"] | assertThat(. != null)
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES"] | assertThat(. == "true")
+    [container(.deployments.sensor; "sensor") | .env[] | select(.name == "ROX_VIRTUAL_MACHINES")] | length | assertThat(. == 1)
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_CONCURRENCY"] | assertThat(. == "20")
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_PULL_MAX_RESPONSE_SIZE_KB"] | assertThat(. == "16384")
-    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL"] | assertThat(. == "5m")
+    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL"] | assertThat(. == "4h")
 
 - name: "virtual machine scraper knobs can be customized when enabled"
   set:
@@ -34,13 +36,14 @@ tests:
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_PULL_MAX_RESPONSE_SIZE_KB"] | assertThat(. == "1024")
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL"] | assertThat(. == "1m")
 
-- name: "virtual machine VSOCK RBAC and env var are absent when explicitly disabled"
+- name: "virtual machine VSOCK RBAC is absent and the feature flag is off when explicitly disabled"
   set:
     virtualMachines.enabled: false
   expect: |
     .clusterroles["stackrox:vsock-access"] | assertThat(. == null)
     .clusterrolebindings["stackrox:vsock-access-binding"] | assertThat(. == null)
-    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES"] | assertThat(. == null)
+    envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES"] | assertThat(. == "false")
+    [container(.deployments.sensor; "sensor") | .env[] | select(.name == "ROX_VIRTUAL_MACHINES")] | length | assertThat(. == 1)
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_CONCURRENCY"] | assertThat(. == null)
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_PULL_MAX_RESPONSE_SIZE_KB"] | assertThat(. == null)
     envVars(.deployments.sensor; "sensor")["ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL"] | assertThat(. == null)
diff --git a/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/vwc-global-name.test.yaml b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/vwc-global-name.test.yaml
new file mode 100644
index 0000000000000..fa547c87e89ca
--- /dev/null
+++ b/pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/vwc-global-name.test.yaml
@@ -0,0 +1,42 @@
+name: "Test ValidatingWebhookConfiguration global resource naming"
+values:
+  imagePullSecrets:
+    allowNone: true
+
+defs: |
+  def vwcNames:
+    (.validatingwebhookconfigurations // {}) | keys;
+
+tests:
+# By default namespacePrefixGlobalResources is false, so the base name is kept static
+# ("stackrox") regardless of namespace, for production safety.
+- name: base name is static in the standard namespace
+  expect: |
+    vwcNames | assertThat(. == ["stackrox"])
+
+- name: base name stays static in a non-standard namespace when prefixing is disabled
+  release:
+    namespace: custom-ns
+  set:
+    allowNonstandardNamespace: true
+  expect: |
+    vwcNames | assertThat(. == ["stackrox"])
+
+# When namespacePrefixGlobalResources is enabled the name is namespace-prefixed to avoid
+# clashes across multiple secured clusters in different namespaces of the same cluster.
+- name: base name is used verbatim in the standard namespace even when prefixing is enabled
+  set:
+    namespacePrefixGlobalResources: true
+  expect: |
+    vwcNames | assertThat(. == ["stackrox"])
+
+- name: base name is namespace-prefixed in a non-standard namespace when prefixing is enabled
+  release:
+    namespace: custom-ns
+  set:
+    allowNonstandardNamespace: true
+    namespacePrefixGlobalResources: true
+  expect: |
+    # A bare "stackrox" base name (no suffix) must not trigger the "Unknown naming
+    # convention" failure; the global prefix already carries the namespace.
+    vwcNames | assertThat(. == ["stackrox-custom-ns"])
diff --git a/pkg/helm/config/roundtrip_test.go b/pkg/helm/config/roundtrip_test.go
index 03206e561c8b3..597e0114bd355 100644
--- a/pkg/helm/config/roundtrip_test.go
+++ b/pkg/helm/config/roundtrip_test.go
@@ -30,7 +30,6 @@ var (
 			Revision:  1,
 			IsInstall: true,
 		},
-		APIVersions: chartutil.DefaultVersionSet,
 	}
 )
 
diff --git a/pkg/helm/util/render.go b/pkg/helm/util/render.go
index 78e9f953d88cf..a12ed1668ae82 100644
--- a/pkg/helm/util/render.go
+++ b/pkg/helm/util/render.go
@@ -17,8 +17,6 @@ type Options struct {
 	ReleaseOptions chartutil.ReleaseOptions
 	KubeVersion    string
 	HelmVersion    string
-
-	APIVersions chartutil.VersionSet
 }
 
 // Render renders a chart locally, like renderutil.Render, but its options struct allows specifying
@@ -38,10 +36,6 @@ func Render(c *chart.Chart, values chartutil.Values, opts Options) (map[string]s
 		HelmVersion: chartutil.DefaultCapabilities.HelmVersion,
 	}
 
-	if opts.APIVersions != nil {
-		caps.APIVersions = opts.APIVersions
-	}
-
 	if opts.KubeVersion != "" {
 		kv, verErr := semver.NewVersion(opts.KubeVersion)
 		if verErr != nil {
diff --git a/pkg/images/defaults/flavor.go b/pkg/images/defaults/flavor.go
index ad47ec1793aaa..0978da9737412 100644
--- a/pkg/images/defaults/flavor.go
+++ b/pkg/images/defaults/flavor.go
@@ -83,13 +83,6 @@ type ImageFlavor struct {
 	FactImageName string
 	FactImageTag  string
 
-	// ScannerImageTag is used for all scanner* images (scanner, scanner-db, scanner-slim and scanner-db-slim)
-	ScannerImageTag        string
-	ScannerImageName       string
-	ScannerSlimImageName   string
-	ScannerDBImageName     string
-	ScannerDBSlimImageName string
-
 	// ScannerV4ImageTag is used for all scanner-v4* images (scanner-v4, scanner-v4-db)
 	ScannerV4ImageTag    string
 	ScannerV4ImageName   string
@@ -123,12 +116,6 @@ func DevelopmentBuildImageFlavor() ImageFlavor {
 		FactImageName: "fact",
 		FactImageTag:  v.FactVersion,
 
-		ScannerImageName:       "scanner",
-		ScannerSlimImageName:   "scanner-slim",
-		ScannerImageTag:        v.ScannerVersion,
-		ScannerDBImageName:     "scanner-db",
-		ScannerDBSlimImageName: "scanner-db-slim",
-
 		ScannerV4ImageName:   "scanner-v4",
 		ScannerV4DBImageName: "scanner-v4-db",
 		// Scanner v4 is released along with the main image, so the tags are expected to be the same.
@@ -163,12 +150,6 @@ func RHACSReleaseImageFlavor() ImageFlavor {
 		FactImageName: "rhacs-fact-rhel9",
 		FactImageTag:  v.FactVersion,
 
-		ScannerImageName:       "rhacs-scanner-rhel9",
-		ScannerSlimImageName:   "rhacs-scanner-slim-rhel9",
-		ScannerImageTag:        v.ScannerVersion,
-		ScannerDBImageName:     "rhacs-scanner-db-rhel9",
-		ScannerDBSlimImageName: "rhacs-scanner-db-slim-rhel9",
-
 		ScannerV4ImageName:   "rhacs-scanner-v4-rhel9",
 		ScannerV4DBImageName: "rhacs-scanner-v4-db-rhel9",
 		// Scanner v4 is released along with the main image, so the tags are expected to be the same.
@@ -212,12 +193,6 @@ func OpenSourceImageFlavor() ImageFlavor {
 		FactImageName: "fact",
 		FactImageTag:  v.FactVersion,
 
-		ScannerImageName:       "scanner",
-		ScannerSlimImageName:   "scanner-slim",
-		ScannerImageTag:        v.ScannerVersion,
-		ScannerDBImageName:     "scanner-db",
-		ScannerDBSlimImageName: "scanner-db-slim",
-
 		ScannerV4ImageName:   "scanner-v4",
 		ScannerV4DBImageName: "scanner-v4-db",
 		// Scanner v4 is released along with the main image, so the tags are expected to be the same.
@@ -311,21 +286,6 @@ func (f *ImageFlavor) IsImageDefaultMain(img *storage.ImageName) bool {
 	return f.MainImageNoTag() == overrideImageNoTag
 }
 
-// ScannerImage is the container image reference (full name) for the scanner image.
-func (f *ImageFlavor) ScannerImage() string {
-	return fmt.Sprintf("%s/%s:%s", f.MainRegistry, f.ScannerImageName, f.ScannerImageTag)
-}
-
-// ScannerSlimImage is the container image reference (full name) for the scanner-slim image.
-func (f *ImageFlavor) ScannerSlimImage() string {
-	return fmt.Sprintf("%s/%s:%s", f.MainRegistry, f.ScannerSlimImageName, f.ScannerImageTag)
-}
-
-// ScannerDBImage is the container image reference (full name) for the scanner-db image.
-func (f *ImageFlavor) ScannerDBImage() string {
-	return fmt.Sprintf("%s/%s:%s", f.MainRegistry, f.ScannerDBImageName, f.ScannerImageTag)
-}
-
 // ScannerV4Image is the container image reference (full name) for the scanner-v4 image.
 func (f *ImageFlavor) ScannerV4Image() string {
 	return fmt.Sprintf("%s/%s:%s", f.MainRegistry, f.ScannerV4ImageName, f.ScannerV4ImageTag)
diff --git a/pkg/images/defaults/flavor_test.go b/pkg/images/defaults/flavor_test.go
index 4f87fbc812926..1411fbd00b4cd 100644
--- a/pkg/images/defaults/flavor_test.go
+++ b/pkg/images/defaults/flavor_test.go
@@ -117,15 +117,12 @@ func (s *imageFlavorTestSuite) TestOpenSourceImageFlavorDevReleaseTags() {
 		s.Equal(f.MainImageTag, "3.0.99.0")
 		s.Equal(f.CentralDBImageTag, "3.0.99.0")
 		s.Equal(f.CollectorImageTag, "3.0.99.0")
-		s.Equal(f.ScannerImageTag, "3.0.99.0")
 
 	} else {
 		// Original tags are used
 		s.Equal(f.MainImageTag, "3.0.99.0")
 		s.Equal(f.CentralDBImageTag, "3.0.99.0")
 		s.Equal(f.CollectorImageTag, "99.9.9")
-		s.Equal(f.ScannerImageTag, "99.9.9")
-
 	}
 }
 
diff --git a/pkg/images/defaults/testutils/flavor.go b/pkg/images/defaults/testutils/flavor.go
index 5d60121f7afed..0dddbc8eba2f2 100644
--- a/pkg/images/defaults/testutils/flavor.go
+++ b/pkg/images/defaults/testutils/flavor.go
@@ -13,25 +13,20 @@ import (
 func MakeImageFlavorForTest(t *testing.T) defaults.ImageFlavor {
 	testutils.MustBeInTest(t)
 	return defaults.ImageFlavor{
-		MainRegistry:           "test.registry",
-		MainImageName:          "main",
-		MainImageTag:           "1.2.3",
-		CentralDBImageTag:      "1.2.4",
-		CentralDBImageName:     "central-db",
-		CollectorRegistry:      "test.registry",
-		CollectorImageName:     "collector",
-		CollectorImageTag:      "3.2.1",
-		FactRegistry:           "test.registry",
-		FactImageName:          "fact",
-		FactImageTag:           "0.1.0",
-		ScannerImageName:       "scanner",
-		ScannerSlimImageName:   "scanner-slim",
-		ScannerImageTag:        "2.2.2",
-		ScannerDBImageName:     "scanner-db",
-		ScannerDBSlimImageName: "scanner-db-slim",
-		ScannerV4ImageName:     "scanner-v4",
-		ScannerV4DBImageName:   "scanner-v4-db",
-		ScannerV4ImageTag:      "1.2.3", // Match MainVersion
+		MainRegistry:         "test.registry",
+		MainImageName:        "main",
+		MainImageTag:         "1.2.3",
+		CentralDBImageTag:    "1.2.4",
+		CentralDBImageName:   "central-db",
+		CollectorRegistry:    "test.registry",
+		CollectorImageName:   "collector",
+		CollectorImageTag:    "3.2.1",
+		FactRegistry:         "test.registry",
+		FactImageName:        "fact",
+		FactImageTag:         "0.1.0",
+		ScannerV4ImageName:   "scanner-v4",
+		ScannerV4DBImageName: "scanner-v4-db",
+		ScannerV4ImageTag:    "1.2.3", // Match MainVersion
 		ChartRepo: defaults.ChartRepo{
 			URL:     "some.url/path/to/chart",
 			IconURL: "some.url/path/to/icon.png",
@@ -42,7 +37,6 @@ func MakeImageFlavorForTest(t *testing.T) defaults.ImageFlavor {
 		Versions: version.Versions{
 			CollectorVersion: "3.2.1",
 			MainVersion:      "1.2.3",
-			ScannerVersion:   "2.2.2",
 			ChartVersion:     "1.23.4",
 			FactVersion:      "0.1.0",
 		},
diff --git a/pkg/images/enricher/enricher_impl.go b/pkg/images/enricher/enricher_impl.go
index 3356441902d7e..3e773a97b9992 100644
--- a/pkg/images/enricher/enricher_impl.go
+++ b/pkg/images/enricher/enricher_impl.go
@@ -118,7 +118,7 @@ func (e *enricherImpl) EnrichWithVulnerabilities(image *storage.Image, component
 
 	return EnrichmentResult{
 		ScanResult: ScanNotDone,
-	}, errors.New("no image vulnerability retrievers are integrated")
+	}, noMatchingScannerErr(components.ScannerType())
 }
 
 func (e *enricherImpl) enrichWithVulnerabilities(scannerName string, dataSource *storage.DataSource, scanner scannerTypes.ImageVulnerabilityGetter,
@@ -158,7 +158,7 @@ func (e *enricherImpl) delegateEnrichImage(ctx context.Context, enrichCtx Enrich
 		clusterID, shouldDelegate, err = e.scanDelegator.GetDelegateClusterID(ctx, image.GetName())
 	} else {
 		// A cluster ID has been passed to the enricher, determine if it's valid for delegation.
-		err = e.scanDelegator.ValidateCluster(enrichCtx.ClusterID)
+		err = e.scanDelegator.ValidateCluster(ctx, enrichCtx.ClusterID)
 		shouldDelegate = true
 	}
 
@@ -814,10 +814,12 @@ func (e *enricherImpl) enrichWithSignatureVerificationData(ctx context.Context,
 		return false, nil
 	}
 
-	// Timeout is based on benchmark test result for 200 integrations with 1 config each (roughly 0.1 sec) + a grace
-	// timeout on top. Currently, signature verification is done without remote RPCs, this will need to be
-	// changed accordingly when RPCs are required (i.e. cosign keyless).
-	verifySignatureCtx, cancel := context.WithTimeout(ctx, 1*time.Second)
+	// Bound the time spent verifying signatures for a single image against all configured integrations.
+	// Public-key verification is local and fast, but keyless (cosign) verification performs remote RPCs
+	// (Sigstore TUF trust root, Fulcio/Rekor material, transparency log lookups) and can take several
+	// seconds. The timeout is configurable via ROX_IMAGE_SIGNATURE_VERIFICATION_TIMEOUT so it can be
+	// tuned for slow Sigstore infrastructure without silently marking valid signatures as unverified.
+	verifySignatureCtx, cancel := context.WithTimeout(ctx, env.ImageSignatureVerificationTimeout.DurationSetting())
 	defer cancel()
 
 	res := e.signatureVerifier(verifySignatureCtx, sigIntegrations, img)
diff --git a/pkg/images/enricher/enricher_impl_test.go b/pkg/images/enricher/enricher_impl_test.go
index fafafab6b74a7..24658b4757270 100644
--- a/pkg/images/enricher/enricher_impl_test.go
+++ b/pkg/images/enricher/enricher_impl_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/stackrox/rox/generated/storage"
 	delegatorMocks "github.com/stackrox/rox/pkg/delegatedregistry/mocks"
+	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/images/integration"
@@ -1048,6 +1049,46 @@ func TestEnrichWithSignatureVerificationData_Failure(t *testing.T) {
 	assert.False(t, updated)
 }
 
+// TestEnrichWithSignatureVerificationData_Timeout verifies that the signature verification
+// context is bounded by ROX_IMAGE_SIGNATURE_VERIFICATION_TIMEOUT. This guards against
+// regressing to a timeout too short for keyless (remote-RPC) verification, which caused valid
+// keyless Sigstore signatures to be marked unverified (ROX-36605).
+func TestEnrichWithSignatureVerificationData_Timeout(t *testing.T) {
+	// Use an arbitrary, non-default value so the assertion proves the deadline is driven by the
+	// env var rather than by the 30s default (or the old hardcoded 1s).
+	const timeout = 17 * time.Second
+	t.Setenv(env.ImageSignatureVerificationTimeout.EnvVar(), timeout.String())
+
+	var deadline time.Time
+	haveDeadline := false
+	e := enricherImpl{
+		signatureIntegrationGetter: fakeSignatureIntegrationGetter("verifier1", false),
+		signatureVerifier: func(ctx context.Context, _ []*storage.SignatureIntegration,
+			_ *storage.Image) []*storage.ImageSignatureVerificationResult {
+			deadline, haveDeadline = ctx.Deadline()
+			return []*storage.ImageSignatureVerificationResult{
+				createSignatureVerificationResult("verifier1",
+					storage.ImageSignatureVerificationResult_VERIFIED, "test:1.0"),
+			}
+		},
+	}
+	img := &storage.Image{Id: "id", Name: &storage.ImageName{FullName: "test:1.0"},
+		Signature: &storage.ImageSignature{Signatures: []*storage.Signature{createSignature("sig1", "payload1")}}}
+
+	// The verifier is a stub that returns immediately, so this call does not wait for the timeout;
+	// it only checks the deadline the enricher put on the verification context.
+	start := time.Now()
+	updated, err := e.enrichWithSignatureVerificationData(emptyCtx,
+		EnrichmentContext{FetchOpt: ForceRefetch}, img)
+	require.NoError(t, err)
+	assert.True(t, updated)
+	require.True(t, haveDeadline, "verification context should carry a deadline")
+	// The deadline must be start+timeout. A 1s tolerance absorbs the negligible work between
+	// capturing start and creating the context; it is unrelated to the old hardcoded 1s timeout.
+	assert.WithinDuration(t, start.Add(timeout), deadline, time.Second,
+		"verification deadline should reflect ROX_IMAGE_SIGNATURE_VERIFICATION_TIMEOUT")
+}
+
 func TestDelegateEnrichImage(t *testing.T) {
 	deleEnrichCtx := EnrichmentContext{Delegable: true}
 	e := enricherImpl{
@@ -1138,7 +1179,7 @@ func TestDelegateEnrichImage(t *testing.T) {
 	t.Run("delegate enrich success with cluster id provided", func(t *testing.T) {
 		setup(t)
 		fakeImage := &storage.Image{}
-		dele.EXPECT().ValidateCluster("cluster-id").Return(nil)
+		dele.EXPECT().ValidateCluster(emptyCtx, "cluster-id").Return(nil)
 		dele.EXPECT().DelegateScanImage(emptyCtx, gomock.Any(), "cluster-id", "", gomock.Any()).Return(fakeImage, nil)
 
 		deleEnrichCtx := EnrichmentContext{Delegable: true, ClusterID: "cluster-id"}
@@ -1151,7 +1192,7 @@ func TestDelegateEnrichImage(t *testing.T) {
 	t.Run("delegate enrich error with cluster id provided", func(t *testing.T) {
 		setup(t)
 		fakeImage := &storage.Image{}
-		dele.EXPECT().ValidateCluster("cluster-id").Return(errBroken)
+		dele.EXPECT().ValidateCluster(emptyCtx, "cluster-id").Return(errBroken)
 		deleEnrichCtx := EnrichmentContext{Delegable: true, ClusterID: "cluster-id"}
 
 		should, err := e.delegateEnrichImage(emptyCtx, deleEnrichCtx, fakeImage)
diff --git a/pkg/images/enricher/enricher_v2_impl.go b/pkg/images/enricher/enricher_v2_impl.go
index 38c0d5a0b052f..df8b3a70969bf 100644
--- a/pkg/images/enricher/enricher_v2_impl.go
+++ b/pkg/images/enricher/enricher_v2_impl.go
@@ -108,7 +108,26 @@ func (e *enricherV2Impl) EnrichWithVulnerabilities(imageV2 *storage.ImageV2, com
 
 	return EnrichmentResult{
 		ScanResult: ScanNotDone,
-	}, errors.New("no image vulnerability retrievers are integrated")
+	}, noMatchingScannerErr(components.ScannerType())
+}
+
+func noMatchingScannerErr(requiredType string) error {
+	return errors.Errorf(
+		"this scan request was produced by %s, but no scanner of that type is integrated",
+		scannerTypeDescription(requiredType))
+}
+
+// scannerTypeDescription returns a human-friendly name for a scanner type
+// string
+func scannerTypeDescription(scannerType string) string {
+	switch scannerType {
+	case scannerTypes.Clairify:
+		return "the legacy StackRox Scanner"
+	case scannerTypes.ScannerV4:
+		return "Scanner V4"
+	default:
+		return fmt.Sprintf("a scanner of type %q", scannerType)
+	}
 }
 
 func (e *enricherV2Impl) enrichWithVulnerabilities(scannerName string, dataSource *storage.DataSource, scanner scannerTypes.ImageVulnerabilityGetter,
@@ -149,7 +168,7 @@ func (e *enricherV2Impl) delegateEnrichImage(ctx context.Context, enrichCtx Enri
 		clusterID, shouldDelegate, err = e.scanDelegator.GetDelegateClusterID(ctx, imageV2.GetName())
 	} else {
 		// A cluster ID has been passed to the enricher, determine if it's valid for delegation.
-		err = e.scanDelegator.ValidateCluster(enrichCtx.ClusterID)
+		err = e.scanDelegator.ValidateCluster(ctx, enrichCtx.ClusterID)
 		shouldDelegate = true
 	}
 
@@ -794,10 +813,12 @@ func (e *enricherV2Impl) enrichWithSignatureVerificationData(ctx context.Context
 		return false, nil
 	}
 
-	// Timeout is based on benchmark test result for 200 integrations with 1 config each (roughly 0.1 sec) + a grace
-	// timeout on top. Currently, signature verification is done without remote RPCs, this will need to be
-	// changed accordingly when RPCs are required (i.e. cosign keyless).
-	verifySignatureCtx, cancel := context.WithTimeout(ctx, 1*time.Second)
+	// Bound the time spent verifying signatures for a single image against all configured integrations.
+	// Public-key verification is local and fast, but keyless (cosign) verification performs remote RPCs
+	// (Sigstore TUF trust root, Fulcio/Rekor material, transparency log lookups) and can take several
+	// seconds. The timeout is configurable via ROX_IMAGE_SIGNATURE_VERIFICATION_TIMEOUT so it can be
+	// tuned for slow Sigstore infrastructure without silently marking valid signatures as unverified.
+	verifySignatureCtx, cancel := context.WithTimeout(ctx, env.ImageSignatureVerificationTimeout.DurationSetting())
 	defer cancel()
 
 	res := e.signatureVerifier(verifySignatureCtx, sigIntegrations, utils.ConvertToV1(imgV2))
diff --git a/pkg/images/enricher/enricher_v2_impl_test.go b/pkg/images/enricher/enricher_v2_impl_test.go
index e1655968a992f..1976852d1bc3b 100644
--- a/pkg/images/enricher/enricher_v2_impl_test.go
+++ b/pkg/images/enricher/enricher_v2_impl_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/stackrox/rox/generated/storage"
 	delegatorMocks "github.com/stackrox/rox/pkg/delegatedregistry/mocks"
+	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/images/integration"
@@ -508,6 +509,51 @@ func TestCVESuppressionV2(t *testing.T) {
 	assert.Equal(t, storage.VulnerabilityState_DEFERRED, img.GetScan().GetComponents()[0].GetVulns()[0].GetState())
 }
 
+// TestEnrichImageV2_ScanStatsRecomputedOnNewScan reproduces the exact object flow used
+// by the image reprocessor (central/reprocessor/reprocessor.go): an ImageV2 fetched
+// from the datastore (so ScanStats is already populated from its previous scan) is
+// passed into EnrichImage, which finds a genuinely new scan. ScanStats must be
+// recomputed to match the new scan (ROX-36389).
+func TestEnrichImageV2_ScanStatsRecomputedOnNewScan(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.FlattenImageData, true)
+	ctrl := gomock.NewController(t)
+
+	fsr := newFakeRegistryScanner(opts{})
+	registrySet := registryMocks.NewMockSet(ctrl)
+	registrySet.EXPECT().IsEmpty().Return(false).AnyTimes()
+	registrySet.EXPECT().GetAllUnique().Return([]types.ImageRegistry{fsr}).AnyTimes()
+
+	scannerSet := scannerMocks.NewMockSet(ctrl)
+	scannerSet.EXPECT().IsEmpty().Return(false).AnyTimes()
+	scannerSet.EXPECT().GetAll().Return([]scannertypes.ImageScannerWithDataSource{fsr}).AnyTimes()
+
+	set := mocks.NewMockSet(ctrl)
+	set.EXPECT().RegistrySet().Return(registrySet).AnyTimes()
+	set.EXPECT().ScannerSet().Return(scannerSet).AnyTimes()
+
+	mockReporter := reporterMocks.NewMockReporter(ctrl)
+	mockReporter.EXPECT().UpdateIntegrationHealthAsync(gomock.Any()).AnyTimes()
+
+	enricherImpl := newEnricherV2(set, mockReporter)
+
+	img := &storage.ImageV2{
+		Id:        utils.NewImageV2ID(&storage.ImageName{Registry: "reg", FullName: "reg"}, "sha"),
+		Digest:    "sha",
+		Name:      &storage.ImageName{Registry: "reg", FullName: "reg"},
+		ScanStats: &storage.ImageV2_ScanStats{CveCount: 99},
+	}
+
+	results, err := enricherImpl.EnrichImage(emptyCtx, EnrichmentContext{}, img)
+	require.NoError(t, err)
+	assert.True(t, results.ImageUpdated)
+
+	// The fake scanner always returns a scan with exactly 1 CVE.
+	require.Len(t, img.GetScan().GetComponents(), 1)
+	require.Len(t, img.GetScan().GetComponents()[0].GetVulns(), 1)
+
+	assert.Equal(t, int32(1), img.GetScanStats().GetCveCount())
+}
+
 func TestZeroIntegrationsV2(t *testing.T) {
 	testutils.MustUpdateFeature(t, features.FlattenImageData, true)
 	ctrl := gomock.NewController(t)
@@ -1026,6 +1072,51 @@ func TestEnrichWithSignatureVerificationDataV2_Failure(t *testing.T) {
 	assert.False(t, updated)
 }
 
+// TestEnrichWithSignatureVerificationDataV2_Timeout verifies that the signature verification
+// context is bounded by ROX_IMAGE_SIGNATURE_VERIFICATION_TIMEOUT for the V2 (flattened image
+// data) path. This guards against regressing to a timeout too short for keyless (remote-RPC)
+// verification, which caused valid keyless Sigstore signatures to be marked unverified
+// (ROX-36605).
+func TestEnrichWithSignatureVerificationDataV2_Timeout(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.FlattenImageData, true)
+	// Use an arbitrary, non-default value so the assertion proves the deadline is driven by the
+	// env var rather than by the 30s default (or the old hardcoded 1s).
+	const timeout = 17 * time.Second
+	t.Setenv(env.ImageSignatureVerificationTimeout.EnvVar(), timeout.String())
+
+	var deadline time.Time
+	haveDeadline := false
+	e := enricherV2Impl{
+		signatureIntegrationGetter: fakeSignatureIntegrationGetter("verifier1", false),
+		signatureVerifier: func(ctx context.Context, _ []*storage.SignatureIntegration,
+			_ *storage.Image) []*storage.ImageSignatureVerificationResult {
+			deadline, haveDeadline = ctx.Deadline()
+			return []*storage.ImageSignatureVerificationResult{
+				createSignatureVerificationResult("verifier1",
+					storage.ImageSignatureVerificationResult_VERIFIED, "test:1.0"),
+			}
+		},
+	}
+	img := &storage.ImageV2{
+		Id:        utils.NewImageV2ID(&storage.ImageName{FullName: "test:1.0"}, "sha"),
+		Digest:    "sha",
+		Name:      &storage.ImageName{FullName: "test:1.0"},
+		Signature: &storage.ImageSignature{Signatures: []*storage.Signature{createSignature("sig1", "payload1")}}}
+
+	// The verifier is a stub that returns immediately, so this call does not wait for the timeout;
+	// it only checks the deadline the enricher put on the verification context.
+	start := time.Now()
+	updated, err := e.enrichWithSignatureVerificationData(emptyCtx,
+		EnrichmentContext{FetchOpt: ForceRefetch}, img)
+	require.NoError(t, err)
+	assert.True(t, updated)
+	require.True(t, haveDeadline, "verification context should carry a deadline")
+	// The deadline must be start+timeout. A 1s tolerance absorbs the negligible work between
+	// capturing start and creating the context; it is unrelated to the old hardcoded 1s timeout.
+	assert.WithinDuration(t, start.Add(timeout), deadline, time.Second,
+		"verification deadline should reflect ROX_IMAGE_SIGNATURE_VERIFICATION_TIMEOUT")
+}
+
 func TestDelegateEnrichImageV2(t *testing.T) {
 	testutils.MustUpdateFeature(t, features.FlattenImageData, true)
 	deleEnrichCtx := EnrichmentContext{Delegable: true}
@@ -1118,7 +1209,7 @@ func TestDelegateEnrichImageV2(t *testing.T) {
 	t.Run("delegate enrich success with cluster id provided", func(t *testing.T) {
 		setup(t)
 		fakeImage := &storage.ImageV2{}
-		dele.EXPECT().ValidateCluster("cluster-id").Return(nil)
+		dele.EXPECT().ValidateCluster(emptyCtx, "cluster-id").Return(nil)
 		dele.EXPECT().DelegateScanImageV2(emptyCtx, gomock.Any(), "cluster-id", "", gomock.Any()).Return(fakeImage, nil)
 
 		deleEnrichCtx := EnrichmentContext{Delegable: true, ClusterID: "cluster-id"}
@@ -1131,7 +1222,7 @@ func TestDelegateEnrichImageV2(t *testing.T) {
 	t.Run("delegate enrich error with cluster id provided", func(t *testing.T) {
 		setup(t)
 		fakeImage := &storage.ImageV2{}
-		dele.EXPECT().ValidateCluster("cluster-id").Return(errBroken)
+		dele.EXPECT().ValidateCluster(emptyCtx, "cluster-id").Return(errBroken)
 		deleEnrichCtx := EnrichmentContext{Delegable: true, ClusterID: "cluster-id"}
 
 		should, err := e.delegateEnrichImage(emptyCtx, deleEnrichCtx, fakeImage)
@@ -1461,6 +1552,105 @@ func TestForceRefetchMetadataOnly_Predicates(t *testing.T) {
 		"ForceRefetchMetadataOnly must not force refetch of cached DB values")
 }
 
+func TestScannerTypeDescription(t *testing.T) {
+	cases := map[string]struct {
+		scannerType string
+		expected    string
+	}{
+		"legacy StackRox Scanner": {
+			scannerType: scannertypes.Clairify,
+			expected:    "the legacy StackRox Scanner",
+		},
+		"Scanner V4": {
+			scannerType: scannertypes.ScannerV4,
+			expected:    "Scanner V4",
+		},
+		"unknown scanner type": {
+			scannerType: "some-future-scanner",
+			expected:    `a scanner of type "some-future-scanner"`,
+		},
+	}
+
+	for name, c := range cases {
+		t.Run(name, func(t *testing.T) {
+			got := scannerTypeDescription(c.scannerType)
+			assert.Equal(t, c.expected, got)
+			// Internal-only names must never leak into user-facing text.
+			assert.NotContains(t, got, "V2")
+		})
+	}
+}
+
+func TestNoMatchingScannerErr(t *testing.T) {
+	cases := map[string]struct {
+		requiredType string
+		// mustContain lists substrings the error message must include.
+		mustContain []string
+	}{
+		"legacy scan but no matching scanner integrated": {
+			requiredType: scannertypes.Clairify,
+			mustContain: []string{
+				"the legacy StackRox Scanner",
+				"integrated",
+			},
+		},
+		"Scanner V4 scan but no matching scanner integrated": {
+			requiredType: scannertypes.ScannerV4,
+			mustContain: []string{
+				"Scanner V4",
+				"integrated",
+			},
+		},
+	}
+
+	for name, c := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := noMatchingScannerErr(c.requiredType)
+			require.Error(t, err)
+
+			for _, substr := range c.mustContain {
+				assert.Contains(t, err.Error(), substr)
+			}
+			// Internal-only names must never leak into user-facing text.
+			assert.NotContains(t, err.Error(), "V2")
+		})
+	}
+}
+
+// TestEnrichWithVulnerabilitiesNoMatchingScannerV2 verifies the reachable case
+// where scanners are integrated (so scanners.IsEmpty() is false) but none matches
+// the scanner type that produced the scan (fakeScanner has type "type", not the
+// clairify type the scan components indicate).
+func TestEnrichWithVulnerabilitiesNoMatchingScannerV2(t *testing.T) {
+	ctrl := gomock.NewController(t)
+
+	fsr := newFakeRegistryScanner(opts{})
+	scannerSet := scannerMocks.NewMockSet(ctrl)
+	scannerSet.EXPECT().IsEmpty().Return(false).AnyTimes()
+	scannerSet.EXPECT().GetAll().Return([]scannertypes.ImageScannerWithDataSource{fsr}).AnyTimes()
+
+	set := mocks.NewMockSet(ctrl)
+	set.EXPECT().ScannerSet().Return(scannerSet).AnyTimes()
+
+	mockReporter := reporterMocks.NewMockReporter(ctrl)
+	enricher := newEnricherV2(set, mockReporter)
+
+	img := &storage.ImageV2{
+		Id:     utils.NewImageV2ID(&storage.ImageName{Registry: "reg", FullName: "reg"}, "sha"),
+		Digest: "sha",
+		Name:   &storage.ImageName{Registry: "reg", FullName: "reg"},
+	}
+	// Empty indexer version => the components indicate the legacy (clairify) scanner.
+	components := scannertypes.NewScanComponents("", nil, nil)
+
+	result, err := enricher.EnrichWithVulnerabilities(img, components, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "the legacy StackRox Scanner")
+	assert.Contains(t, err.Error(), "integrated")
+	assert.Equal(t, ScanNotDone, result.ScanResult)
+	assert.False(t, result.ImageUpdated)
+}
+
 func newEnricherV2(set *mocks.MockSet, mockReporter *reporterMocks.MockReporter) ImageEnricherV2 {
 	return NewV2(&fakeCVESuppressorV2{}, nil, set, pkgMetrics.CentralSubsystem,
 		newCache(),
diff --git a/pkg/images/utils/convert_utils.go b/pkg/images/utils/convert_utils.go
index 489d4464f9886..f0afcdde1cea4 100644
--- a/pkg/images/utils/convert_utils.go
+++ b/pkg/images/utils/convert_utils.go
@@ -48,7 +48,7 @@ func ConvertToV1(image *storage.ImageV2, names ...*storage.ImageName) *storage.I
 
 // ConvertNotesToV1 converts a list of storage.ImageV2_Note to a list of storage.Image_Note.
 func ConvertNotesToV1(notes []storage.ImageV2_Note) []storage.Image_Note {
-	res := make([]storage.Image_Note, 0)
+	res := make([]storage.Image_Note, 0, len(notes))
 	for _, note := range notes {
 		res = append(res, storage.Image_Note(note.Number()))
 	}
@@ -110,7 +110,7 @@ func convertToV2(image *storage.Image, nameOverride *storage.ImageName) *storage
 }
 
 func ConvertNotesToV2(notes []storage.Image_Note) []storage.ImageV2_Note {
-	res := make([]storage.ImageV2_Note, 0)
+	res := make([]storage.ImageV2_Note, 0, len(notes))
 	for _, note := range notes {
 		res = append(res, storage.ImageV2_Note(note.Number()))
 	}
diff --git a/pkg/images/utils/test/utils_test.go b/pkg/images/utils/test/utils_test.go
index dd2764f687aea..116dba67278a1 100644
--- a/pkg/images/utils/test/utils_test.go
+++ b/pkg/images/utils/test/utils_test.go
@@ -606,6 +606,38 @@ func TestFillScanStatsV2(t *testing.T) {
 	}
 }
 
+// TestFilterSuppressedCVEsNoCloneV2 confirms that filtering out suppressed CVEs also
+// updates ScanStats to match (ROX-36389).
+func TestFilterSuppressedCVEsNoCloneV2(t *testing.T) {
+	testutils.MustUpdateFeature(t, features.FlattenImageData, true)
+
+	image := &storage.ImageV2{
+		Id:     utils.NewImageV2ID(&storage.ImageName{Registry: "reg", FullName: "reg"}, "sha"),
+		Digest: "sha",
+		Name:   &storage.ImageName{Registry: "reg", FullName: "reg"},
+		Scan: &storage.ImageScan{
+			Components: []*storage.EmbeddedImageScanComponent{
+				{
+					Vulns: []*storage.EmbeddedVulnerability{
+						{Cve: "cve-1", Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY},
+						{Cve: "cve-2", Severity: storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY, State: storage.VulnerabilityState_DEFERRED},
+					},
+				},
+			},
+		},
+		// ScanStats reflects the unfiltered scan, as it would for an image already
+		// fetched from the datastore before filtering.
+		ScanStats: &storage.ImageV2_ScanStats{CveCount: 2},
+	}
+
+	utils.FilterSuppressedCVEsNoCloneV2(image)
+
+	if assert.Len(t, image.GetScan().GetComponents()[0].GetVulns(), 1) {
+		assert.Equal(t, "cve-1", image.GetScan().GetComponents()[0].GetVulns()[0].GetCve())
+	}
+	assert.Equal(t, int32(1), image.GetScanStats().GetCveCount())
+}
+
 func TestStripDatasourceNoClone(t *testing.T) {
 	original := &storage.ImageScan{
 		Components: []*storage.EmbeddedImageScanComponent{
diff --git a/pkg/images/utils/utils.go b/pkg/images/utils/utils.go
index 8e920cb41becf..2722e81ffde0d 100644
--- a/pkg/images/utils/utils.go
+++ b/pkg/images/utils/utils.go
@@ -397,9 +397,6 @@ func FillScanStatsV2(i *storage.ImageV2) {
 	if i.GetScan() == nil {
 		return
 	}
-	if i.GetScanStats() != nil {
-		return
-	}
 	i.ScanStats = &storage.ImageV2_ScanStats{}
 	i.GetScanStats().ComponentCount = int32(len(i.GetScan().GetComponents()))
 
diff --git a/pkg/k8sintrospect/redact.go b/pkg/k8sintrospect/redact.go
index 13f70b0590d28..2e688e829cfed 100644
--- a/pkg/k8sintrospect/redact.go
+++ b/pkg/k8sintrospect/redact.go
@@ -4,6 +4,18 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 
+const redactedValue = "***REDACTED***"
+
+// sensitiveSecretAnnotations enumerates annotation keys whose values may contain
+// sensitive data and therefore must be redacted before a secret is included in a
+// diagnostic bundle. Unlike the secret `data` field, these values are not covered
+// by the data redaction below.
+var sensitiveSecretAnnotations = []string{
+	// OpenShift stores a plaintext copy of the service account token in this
+	// annotation on the generated dockercfg secrets (ROX-36824).
+	"openshift.io/token-secret.value",
+}
+
 // RedactGeneric removes fields we don't care about for any object type. This includes:
 // - the `kubectl.kubernetes.io/last-applied-configuration`
 // - the selfLink field (this is not object-specific and fully captured by name, namespace, and kind)
@@ -23,11 +35,28 @@ func RedactSecret(secret *unstructured.Unstructured) {
 	if found && err == nil {
 		redactedStringData := make(map[string]string, len(dataMap))
 		for key := range dataMap {
-			redactedStringData[key] = "***REDACTED***"
+			redactedStringData[key] = redactedValue
 		}
 		_ = unstructured.SetNestedStringMap(secret.UnstructuredContent(), redactedStringData, "stringData")
 	}
 	unstructured.RemoveNestedField(secret.UnstructuredContent(), "data")
+
+	// Some secrets carry sensitive values in their annotations (e.g. the plaintext
+	// service account token OpenShift stores on dockercfg secrets). Redact those
+	// values while keeping the annotation key, so the bundle still shows the
+	// annotation was present.
+	if annotations := secret.GetAnnotations(); len(annotations) > 0 {
+		modified := false
+		for _, key := range sensitiveSecretAnnotations {
+			if _, ok := annotations[key]; ok {
+				annotations[key] = redactedValue
+				modified = true
+			}
+		}
+		if modified {
+			secret.SetAnnotations(annotations)
+		}
+	}
 }
 
 // FilterOutServiceAccountSecrets filters out secrets that are associated with a Kubernetes service account.
diff --git a/pkg/k8sintrospect/redact_test.go b/pkg/k8sintrospect/redact_test.go
index f0f1a6c43e82b..1a95f70322edf 100644
--- a/pkg/k8sintrospect/redact_test.go
+++ b/pkg/k8sintrospect/redact_test.go
@@ -86,3 +86,42 @@ func TestRedactSecret(t *testing.T) {
 	assert.Equal(t, redactedSecret.StringData, expectedStringData)
 	assert.Empty(t, redactedSecret.Data)
 }
+
+func TestRedactSecretSensitiveAnnotations(t *testing.T) {
+	secret := v1.Secret{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Secret",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "stackrox",
+			Name:      "builder-dockercfg-abcde",
+			Annotations: map[string]string{
+				"openshift.io/token-secret.value":    "test-only-placeholder-token-not-a-real-secret",
+				"openshift.io/token-secret.name":     "builder-token-abcde",
+				"kubernetes.io/service-account.name": "builder",
+			},
+		},
+		Type: v1.SecretTypeDockercfg,
+		Data: map[string][]byte{
+			".dockercfg": []byte(`{"registry":{"auth":"c2VjcmV0"}}`),
+		},
+	}
+
+	var unstructuredSecret unstructured.Unstructured
+	require.NoError(t, scheme.Scheme.Convert(&secret, &unstructuredSecret, nil))
+
+	RedactSecret(&unstructuredSecret)
+
+	var redactedSecret v1.Secret
+	require.NoError(t, scheme.Scheme.Convert(&unstructuredSecret, &redactedSecret, nil))
+
+	// The sensitive token annotation value must be redacted...
+	assert.Equal(t, "***REDACTED***", redactedSecret.Annotations["openshift.io/token-secret.value"])
+	// ...while non-sensitive annotations are preserved verbatim.
+	assert.Equal(t, "builder-token-abcde", redactedSecret.Annotations["openshift.io/token-secret.name"])
+	assert.Equal(t, "builder", redactedSecret.Annotations["kubernetes.io/service-account.name"])
+	// The data field is still redacted as before.
+	assert.Empty(t, redactedSecret.Data)
+	assert.Equal(t, "***REDACTED***", redactedSecret.StringData[".dockercfg"])
+}
diff --git a/pkg/k8srbac/policy_rule_field_set.go b/pkg/k8srbac/policy_rule_field_set.go
index 5120ad2a5d4fd..d375098118b53 100644
--- a/pkg/k8srbac/policy_rule_field_set.go
+++ b/pkg/k8srbac/policy_rule_field_set.go
@@ -1,6 +1,8 @@
 package k8srbac
 
 import (
+	"slices"
+
 	"github.com/stackrox/rox/generated/storage"
 )
 
@@ -36,9 +38,7 @@ func (k *policyRuleFieldSet) Merge(to, from *storage.PolicyRule) bool {
 		} else if fIndex == len(k.fields)-1 { // all but last field.
 			matchFields = k.fields[:len(k.fields)-1]
 		} else { // all but some middle field.
-			matchFields = make([]PolicyRuleField, fIndex)
-			copy(matchFields, k.fields[:fIndex])
-			matchFields = append(matchFields, k.fields[fIndex+1:]...)
+			matchFields = slices.Concat(k.fields[:fIndex], k.fields[fIndex+1:])
 		}
 		if NewPolicyRuleFieldSet(matchFields...).Equals(to, from) {
 			mergeField.Merge(to, from)
diff --git a/pkg/migrations/internal/seq_num.go b/pkg/migrations/internal/seq_num.go
index 9caca7a322b45..27c34574712f8 100644
--- a/pkg/migrations/internal/seq_num.go
+++ b/pkg/migrations/internal/seq_num.go
@@ -5,5 +5,5 @@ var (
 	// CurrentDBVersionSeqNum is the current DB version number.
 	// This must be incremented every time we write a migration.
 	// It is a shared constant between central and the migrator binary.
-	CurrentDBVersionSeqNum = 226
+	CurrentDBVersionSeqNum = 227
 )
diff --git a/pkg/migrations/release_version.go b/pkg/migrations/release_version.go
new file mode 100644
index 0000000000000..31182bb6b3d40
--- /dev/null
+++ b/pkg/migrations/release_version.go
@@ -0,0 +1,9 @@
+package migrations
+
+//go:generate go run ../../tools/generate-helpers/release-versions
+
+// ReleaseVersion records a stream's initial-release database sequence (GA, or latest RC until GA).
+type ReleaseVersion struct {
+	Version  string
+	Sequence int
+}
diff --git a/pkg/migrations/release_versions.go b/pkg/migrations/release_versions.go
new file mode 100644
index 0000000000000..f787dccd185fb
--- /dev/null
+++ b/pkg/migrations/release_versions.go
@@ -0,0 +1,16 @@
+// Code generated by release-versions. DO NOT EDIT.
+
+package migrations
+
+var releaseVersions = []ReleaseVersion{
+	{Version: "4.4", Sequence: 199},
+	{Version: "4.5", Sequence: 205},
+	{Version: "4.6", Sequence: 209},
+	{Version: "4.7", Sequence: 209},
+	{Version: "4.8", Sequence: 211},
+	{Version: "4.9", Sequence: 213},
+	{Version: "4.10", Sequence: 220},
+	{Version: "4.11", Sequence: 225},
+	{Version: "5.0", Sequence: 227},
+	{Version: "5.1", Sequence: 227},
+}
diff --git a/pkg/mocks/github.com/jackc/pgx/v5/mocks/rows.go b/pkg/mocks/github.com/jackc/pgx/v5/mocks/rows.go
index 0f84d8ac25317..64eec106df3ec 100644
--- a/pkg/mocks/github.com/jackc/pgx/v5/mocks/rows.go
+++ b/pkg/mocks/github.com/jackc/pgx/v5/mocks/rows.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgtype"
 )
 
 // This file was copied and fixed
@@ -150,7 +151,7 @@ type Rows struct {
 // to be used as sql driver.Rows.
 // Use Sqlmock.NewRows instead if using a custom converter
 func NewRows(columns []string) *Rows {
-	var coldefs []pgconn.FieldDescription
+	coldefs := make([]pgconn.FieldDescription, 0, len(columns))
 	for _, column := range columns {
 		coldefs = append(coldefs, pgconn.FieldDescription{Name: column})
 	}
@@ -221,6 +222,10 @@ func (rs *rowSets) Conn() *pgx.Conn {
 	return nil
 }
 
+func (rs *rowSets) TypeMap() *pgtype.Map {
+	return nil
+}
+
 func convert(rows ...*Rows) pgx.Rows {
 	defs := 0
 	sets := make([]*Rows, len(rows))
diff --git a/pkg/mtls/README.md b/pkg/mtls/README.md
index fd669de21665f..e601bbdedbf30 100644
--- a/pkg/mtls/README.md
+++ b/pkg/mtls/README.md
@@ -1,6 +1,13 @@
 # TLS certificates in StackRox
 
-This document covers **StackRox internal CA mTLS** only.
+This document covers TLS certificate management in StackRox, primarily the internal CA and mTLS.
+
+> **IMPORTANT — Rules for new TLS code:**
+>
+> 1. Changes that affect the TLS architecture MUST be reflected in this README.
+> 2. New servers and client connections MUST hot-reload certificates (use
+>    `certwatch` or `GetCertificate`/`GetClientCertificate` callbacks). Do NOT
+>    add process-lifetime caches for leaf certs.
 
 ## Architecture
 
@@ -8,7 +15,7 @@ This document covers **StackRox internal CA mTLS** only.
   from the client TLS certificate for RPC authorization.
 - Exceptions (TLS but not mTLS): Postgres connections, config-controller.
 - Internal CA: self-signed, 5-year validity, stored in `central-tls` secret.
-  Only Central and the Operator have the CA private key.
+  Only Central and the Operator have access to the CA private key.
 - Leaf certs: 1-year validity, per-service secrets. SANs match service DNS names.
   - Central side: `<service>-tls` (e.g. `central-tls`, `scanner-tls`, `central-db-tls`)
   - Secured Cluster side: `tls-cert-<service>` (e.g. `tls-cert-sensor`, `tls-cert-collector`)
@@ -45,52 +52,47 @@ This document covers **StackRox internal CA mTLS** only.
 - Sensor cert refresh (TLS challenge + CA bundle): `sensor/kubernetes/certrefresh/`
 - Postgres DB cert reload (Central DB, Scanner V4 DB): `image/postgres/scripts/cert-watcher.sh`, `image/templates/helm/shared/templates/_cert-watcher.tpl`
 
-### Central has four independent cert-handling paths
+### Central has three independent cert-handling paths
 
 1. **TLS manager** (`TLSConfigHolder`) — incoming connections. Composes default cert (watched) + internal cert (watched) + OpenShift cert (watched, if configured) + sync.Once trust roots.
+   - **OpenShift service-serving TLS** (`central/tlsconfig/openshift_tls.go`) — on OpenShift, watches certs issued for the `central-ocp` Service. Loaded into the TLS manager and presented via SNI on the same `:8443` listener alongside the StackRox internal cert.
 2. **Outbound client connections** (`clientconn.TLSConfig`) — reads leaf cert from disk on each TLS handshake, trust pool from `mtls.CACert()`.
 3. **TLS challenge endpoint** (`central/metadata/service`) — reads primary leaf via certwatch, issues secondary leaf with short validity and auto-renewal, reads CA via `mtls.CACert()`.
-4. **OpenShift service-serving TLS** (`central/tlsconfig/openshift_tls.go`) — on OpenShift, watches certs issued for the `central-ocp` Service. Presented via SNI on the same `:8443` listener alongside the StackRox internal cert.
 
 ## Certificate caching
 
-The following certificates are currently known to be cached at start-up and not reloaded:
-
-- CA material (`CACert()`, `SecondaryCACert()`, `CAForSigning()`, etc.) in `pkg/mtls/crypto.go`: `sync.Once`, never refreshed. Intentional — the Operator restarts all pods on CA change.
+- CA certificates are cached at start-up and not reloaded (`CACert()`, `SecondaryCACert()`, `CAForSigning()`, etc.) in `pkg/mtls/crypto.go`: `sync.Once`. The Operator restarts all pods on CA change. Possible improvement: hot reloading CAs would reduce downtime due to pods restarts (this happens only every 1-3 years though).
 
 ## Certificate management — who manages what
 
-- **Central side**: the Operator manages all TLS secrets, creates the CA,
-  issues leaf certs, renews them at half validity, and handles CA rotation.
-- **Secured Cluster side**: Sensor requests new certs from Central via the
-  cert refresh API and writes them to local Kubernetes secrets. During CA
-  rotation, Sensor and the Operator work together: Sensor writes both CAs
-  (learned from Central) into a CA bundle ConfigMap (`tls-ca-bundle`), and the
-  Operator watches it to update the `caBundle` field on the admission
-  controller's `ValidatingWebhookConfiguration`. This is why full CA rotation
-  requires the Operator on the Secured Cluster side.
+- **Central side**: the Operator manages all TLS secrets, creates the CA, issues leaf certs, renews them at half validity, and handles CA rotation.
+- **Secured Cluster side**: Sensor requests new certs from Central via the cert refresh API and writes them to local Kubernetes secrets. During CA rotation, Sensor and the Operator work together: Sensor writes both CAs (learned from Central) into a CA bundle ConfigMap (`tls-ca-bundle`), and the Operator watches it to update the `caBundle` field on the admission controller's `ValidatingWebhookConfiguration`. This is why full CA rotation requires the Operator also on the Secured Cluster side.
 
 ## CA rotation
 
-- Operator-only feature (since 4.9). Phases: AddSecondary (year 3), PromoteSecondary (year 4), DeleteSecondary (year 5).
-- Dual-CA awareness is limited to: Operator, Central, Sensor, admission controller ValidatingWebhookConfiguration.
-- All other intra-cluster components only know a single CA. The Operator restarts them on CA change via a pod template annotation hash that includes the CA PEM (`confighash.ComputeCAHash`).
-- This was deliberate: the CA rotation problem is primarily Central↔Sensor (cross-cluster). Intra-cluster services can be restarted together.
+- Operator-only feature (since 4.9). Orchestrated by the Operator on the Central side through phases: AddSecondary (year 3), PromoteSecondary (year 4), DeleteSecondary (year 5).
+- Propagated to Secured Clusters via the cert refresh API and the TLSChallenge endpoint.
+- The original design was for only Sensor and Central (the deployment) to be dual-CA aware. In practice, various corner cases led to most deployments gaining dual-CA awareness.
+- Current state: Operator, all Central CR components (except legacy Scanner V2), Sensor, and admission controller on the SecuredCluster CR side are dual-CA aware.
+- The Operator restarts all Central and SecuredCluster CR pods when a CA change occurs.
 
 ### Which CA signs what
 
 - Central services: always signed by primary CA.
 - Secured Cluster services: signed by newer CA if Sensor supports rotation; by Sensor's trusted CA (via fingerprint) for Helm clusters; by primary CA otherwise.
 
-### Helm-managed Secured Clusters (partial CA rotation support)
+### Legacy Helm-managed Secured Clusters (partial CA rotation support)
 
 - Can connect to a rotated Central (Sensor discovers new CA via TLSChallenge).
-- Cannot restart pods on CA change (no Operator).
-- Cannot update ValidatingWebhookConfiguration caBundle (no Operator to watch the CA bundle ConfigMap).
+- However cannot update CA, because they:
+  - cannot restart pods on CA change (no Operator)
+  - cannot update ValidatingWebhookConfiguration caBundle (no Operator to watch the CA bundle ConfigMap).
 
 ## TLS challenge endpoint (/v1/tls-challenge)
 
-- Unauthenticated endpoint. Sensor sends challenge token, Central returns signed TrustInfo.
+- Unauthenticated endpoint, called by Sensor before establishing its main mTLS connection to Central, to bootstrap TLS trust. Sensor sends challenge token, Central returns signed TrustInfo.
+- Original purpose: allows Sensor to discover Central's internal CA cert when Sensor cannot validate the certificate that Central presents, e.g when Central uses a custom default certificate. (This endpoint does not help when Central cannot receive Sensor's client certificate.)
+- Extended in 4.9 for CA rotation: response includes both primary and secondary cert chains. This is how Sensor (on a different cluster) discovers the new CA — it verifies the response using the CA it already trusts, then adds the other CA to its trust pool.
 - Response includes: primary cert chain, secondary cert chain (if present), additional CAs, default TLS leaf cert.
 - Signed with both primary and secondary leaf certs. Sensor verifies one signature and trusts all certs in the response (trust delegation).
 - Secondary leaf cert: issued in memory from secondary CA with ~3-hour validity, auto-renewed before expiry.
diff --git a/pkg/netutil/cidr.go b/pkg/netutil/cidr.go
index 67f6cef698d02..67d5b97923fba 100644
--- a/pkg/netutil/cidr.go
+++ b/pkg/netutil/cidr.go
@@ -2,6 +2,7 @@ package netutil
 
 import (
 	"net"
+	"slices"
 
 	"github.com/stackrox/rox/pkg/utils"
 )
@@ -16,9 +17,7 @@ func MustParseCIDR(cidr string) *net.IPNet {
 
 // IsIPNetOverlapingPrivateRange checks if network overlaps with private subnets
 func IsIPNetOverlapingPrivateRange(ipNet *net.IPNet) bool {
-	var privateSubnets []*net.IPNet
-	privateSubnets = append(privateSubnets, IPv4PrivateNetworks...)
-	privateSubnets = append(privateSubnets, IPv6PrivateNetworks...)
+	privateSubnets := slices.Concat(IPv4PrivateNetworks, IPv6PrivateNetworks)
 	return AnyOverlap(ipNet, privateSubnets)
 }
 
diff --git a/pkg/netutil/private_subnet.go b/pkg/netutil/private_subnet.go
index 7345ce0912b85..ed50802a3b989 100644
--- a/pkg/netutil/private_subnet.go
+++ b/pkg/netutil/private_subnet.go
@@ -1,6 +1,8 @@
 package netutil
 
-import "net"
+import (
+	"net"
+)
 
 var (
 	// IPv4PrivateNetworks holds RFC1918 addresses plus other reserved IPv4 ranges.
@@ -44,11 +46,10 @@ var (
 
 // GetPrivateSubnets returns a slice of IPv4 and IPv6 addresses considered as private ranges including localhost addresses.
 func GetPrivateSubnets() []*net.IPNet {
-	var subnets []*net.IPNet
-	subnets = append(subnets, IPv4PrivateNetworks...)
-	subnets = append(subnets, IPv4LocalHost)
-	subnets = append(subnets, IPv6PrivateNetworks...)
-	subnets = append(subnets, IPv6LocalHost)
-	subnets = append(subnets, IPv4MappedIPv6Loopback)
-	return subnets
+	result := make([]*net.IPNet, 0, len(IPv4PrivateNetworks)+len(IPv6PrivateNetworks)+3)
+	result = append(result, IPv4PrivateNetworks...)
+	result = append(result, IPv4LocalHost)
+	result = append(result, IPv6PrivateNetworks...)
+	result = append(result, IPv6LocalHost, IPv4MappedIPv6Loopback)
+	return result
 }
diff --git a/pkg/networkgraph/tree/radix.go b/pkg/networkgraph/tree/radix.go
index 3af1768dbf0a3..369ca078e19eb 100644
--- a/pkg/networkgraph/tree/radix.go
+++ b/pkg/networkgraph/tree/radix.go
@@ -2,6 +2,7 @@ package tree
 
 import (
 	"net"
+	"slices"
 
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/generated/storage"
@@ -175,10 +176,9 @@ func (t *nRadixTree) getSuccessorWithValsNoLock(startNode *nRadixNode, curr *nRa
 		return []*storage.NetworkEntityInfo{curr.value}
 	}
 
-	var ret []*storage.NetworkEntityInfo
-	ret = append(ret, t.getSuccessorWithValsNoLock(startNode, curr.left)...)
-	ret = append(ret, t.getSuccessorWithValsNoLock(startNode, curr.right)...)
-	return ret
+	left := t.getSuccessorWithValsNoLock(startNode, curr.left)
+	right := t.getSuccessorWithValsNoLock(startNode, curr.right)
+	return slices.Concat(left, right)
 }
 
 func (t *nRadixTree) Get(key string) *storage.NetworkEntityInfo {
diff --git a/pkg/nodes/converter/convert_utils_test.go b/pkg/nodes/converter/convert_utils_test.go
index 1136a85dad5ec..2dd9b18d72c86 100644
--- a/pkg/nodes/converter/convert_utils_test.go
+++ b/pkg/nodes/converter/convert_utils_test.go
@@ -23,6 +23,7 @@ func TestNodeVulnConv(t *testing.T) {
 	nodeVuln.CveBaseInfo.Epss = nil
 	nodeVuln.CveBaseInfo.Exploit = nil
 	nodeVuln.CveBaseInfo.CisaKev = false
+	nodeVuln.CveBaseInfo.KnownRansomwareCampaign = false
 	embedvuln := EmbeddedVulnerabilityToNodeVulnerability(vuln)
 	protoassert.Equal(t, nodeVuln, embedvuln)
 }
diff --git a/pkg/nodes/enricher/enricher_impl.go b/pkg/nodes/enricher/enricher_impl.go
index 18016b2c10f36..45a7780a74418 100644
--- a/pkg/nodes/enricher/enricher_impl.go
+++ b/pkg/nodes/enricher/enricher_impl.go
@@ -100,11 +100,13 @@ func (e *enricherImpl) enrichWithScan(node *storage.Node, nodeInventory *storage
 		return errorList.ToError()
 	}
 
+	skippedScannerTypes := make([]string, 0, len(scanners))
 	for _, scanner := range scanners {
 		// Prevent unnecessary scanner calls - v4 only works on indexReports, v2/Clairify only on nodeInventory.
 		// If both, indexReport and nodeInventory, are unset, we do not skip to keep the legacy NodeScan v1 working.
 		if (scanner.GetNodeScanner().Type() == types.ScannerV4 && indexReport == nil && nodeInventory != nil) ||
 			(scanner.GetNodeScanner().Type() == types.Clairify && nodeInventory == nil && indexReport != nil) {
+			skippedScannerTypes = append(skippedScannerTypes, scanner.GetNodeScanner().Type())
 			continue
 		}
 		log.Debugf("Enriching Node with Scanner %s / %s", scanner.GetNodeScanner().Type(), scanner.GetNodeScanner().Name())
@@ -115,6 +117,21 @@ func (e *enricherImpl) enrichWithScan(node *storage.Node, nodeInventory *storage
 		return nil
 	}
 
+	// Only warn for the v4/nodeindex path (indexReport != nil). A v4-only Central that still receives
+	// legacy v2 NodeInventory reports would otherwise log this on every such report indefinitely - benign
+	// noise, since v2-on-a-v4-only-Central is an expected transitional state. When an IndexReport arrives and
+	// every registered scanner was still skipped, ScannerV4 is not registered and the node scan silently
+	// never refreshes - the condition worth surfacing.
+	if indexReport != nil && errorList.Empty() && len(skippedScannerTypes) == len(scanners) {
+		// node.Scan is left completely untouched by this call (this is NOT surfaced as an error - ToError()
+		// returns nil below), so the caller will upsert whatever scan the node already had. That upsert looks
+		// identical to a successful no-op scan refresh in logs/metrics downstream.
+		log.Warnf("No applicable node scanner ran for node %s:%s (inventory=%t, indexReport=%t); registered "+
+			"scanner types were all skipped as inapplicable: %v. The node's existing scan, if any, was not "+
+			"refreshed by this call.",
+			node.GetClusterName(), node.GetName(), nodeInventory != nil, indexReport != nil, skippedScannerTypes)
+	}
+
 	return errorList.ToError()
 }
 
diff --git a/pkg/nodes/enricher/enricher_impl_test.go b/pkg/nodes/enricher/enricher_impl_test.go
index eadf5d83e449f..ecbbf9077b4fd 100644
--- a/pkg/nodes/enricher/enricher_impl_test.go
+++ b/pkg/nodes/enricher/enricher_impl_test.go
@@ -6,14 +6,29 @@ import (
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/fixtures/fixtureconsts"
+	"github.com/stackrox/rox/pkg/logging"
 	pkgMetrics "github.com/stackrox/rox/pkg/metrics"
 	"github.com/stackrox/rox/pkg/scanners/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
 	"golang.org/x/sync/semaphore"
 )
 
+const allSkippedWarnSnippet = "No applicable node scanner ran"
+
+// swapObservedLogger replaces the package-level logger with an observer-backed one at Warn level and
+// returns the observed logs plus a restore func. Lets us assert exactly which diagnostic warnings fire.
+func swapObservedLogger(t *testing.T) *observer.ObservedLogs {
+	core, logs := observer.New(zap.WarnLevel)
+	orig := log
+	log = &logging.LoggerImpl{InnerLogger: zap.New(core).Sugar()}
+	t.Cleanup(func() { log = orig })
+	return logs
+}
+
 var _ types.NodeScannerWithDataSource = (*fakeNodeScannerWithDataSource)(nil)
 
 type fakeNodeScannerWithDataSource struct {
@@ -22,12 +37,14 @@ type fakeNodeScannerWithDataSource struct {
 
 type opts struct {
 	requestedScan bool
+	scannerType   string
 }
 
 func newFakeNodeScannerWithDataSource(opts opts) types.NodeScannerWithDataSource {
 	return &fakeNodeScannerWithDataSource{
 		nodeScanner: &fakeNodeScanner{
 			requestedScan: opts.requestedScan,
+			scannerType:   opts.scannerType,
 		},
 	}
 }
@@ -44,6 +61,7 @@ var _ types.NodeScanner = (*fakeNodeScanner)(nil)
 
 type fakeNodeScanner struct {
 	requestedScan bool
+	scannerType   string
 }
 
 func (*fakeNodeScanner) MaxConcurrentNodeScanSemaphore() *semaphore.Weighted {
@@ -96,7 +114,10 @@ func (*fakeNodeScanner) TestNodeScanner() error {
 	return nil
 }
 
-func (*fakeNodeScanner) Type() string {
+func (f *fakeNodeScanner) Type() string {
+	if f.scannerType != "" {
+		return f.scannerType
+	}
 	return "type"
 }
 
@@ -261,6 +282,61 @@ func TestZeroIntegrations(t *testing.T) {
 	assert.Equal(t, expectedErrMsg, err.Error())
 }
 
+// TestEnrichWithScan_AllScannersSkippedWarning validates the ROX-36432 diagnostic: when an IndexReport
+// arrives but every registered scanner is inapplicable (no ScannerV4 registered), we warn - and, per
+// review, only for the v4/nodeindex path (indexReport != nil), not for benign v2-on-a-v4-only-Central.
+func TestEnrichWithScan_AllScannersSkippedWarning(t *testing.T) {
+	node := &storage.Node{Id: fixtureconsts.Node1, ClusterName: "cluster", Name: "node"}
+
+	newEnricher := func(scanner types.NodeScannerWithDataSource) *enricherImpl {
+		return &enricherImpl{
+			cves: &fakeCVESuppressor{},
+			scanners: map[string]types.NodeScannerWithDataSource{
+				scanner.GetNodeScanner().Type(): scanner,
+			},
+			metrics: newMetrics(pkgMetrics.CentralSubsystem),
+		}
+	}
+
+	t.Run("warns when only v2 registered and an IndexReport arrives", func(t *testing.T) {
+		logs := swapObservedLogger(t)
+		clairify := newFakeNodeScannerWithDataSource(opts{scannerType: types.Clairify})
+		e := newEnricher(clairify)
+		testNode := node.CloneVT()
+
+		err := e.enrichWithScan(testNode, nil, &v4.IndexReport{})
+		require.NoError(t, err)
+		assert.Nil(t, testNode.GetScan(), "node scan must be left untouched when every scanner is skipped")
+		assert.Len(t, logs.FilterMessageSnippet(allSkippedWarnSnippet).All(), 1)
+	})
+
+	t.Run("does not warn on the v2 path (indexReport == nil)", func(t *testing.T) {
+		logs := swapObservedLogger(t)
+		// Only ScannerV4 registered; a v2 NodeInventory arrives - v4 is skipped, all skipped, but the gate
+		// (indexReport != nil) must suppress the warning.
+		v4Scanner := newFakeNodeScannerWithDataSource(opts{scannerType: types.ScannerV4})
+		e := newEnricher(v4Scanner)
+		testNode := node.CloneVT()
+
+		err := e.enrichWithScan(testNode, &storage.NodeInventory{}, nil)
+		require.NoError(t, err)
+		assert.Empty(t, logs.FilterMessageSnippet(allSkippedWarnSnippet).All(),
+			"must not warn for the routine v2-on-a-v4-only-Central case")
+	})
+
+	t.Run("does not warn when a scanner actually runs", func(t *testing.T) {
+		logs := swapObservedLogger(t)
+		v4Scanner := newFakeNodeScannerWithDataSource(opts{scannerType: types.ScannerV4})
+		e := newEnricher(v4Scanner)
+		testNode := node.CloneVT()
+
+		err := e.enrichWithScan(testNode, nil, &v4.IndexReport{})
+		require.NoError(t, err)
+		assert.NotNil(t, testNode.GetScan(), "scanner should have populated the scan")
+		assert.Empty(t, logs.FilterMessageSnippet(allSkippedWarnSnippet).All())
+	})
+}
+
 func TestFillScanStatsWithPostgres(t *testing.T) {
 	cases := []struct {
 		node                 *storage.Node
diff --git a/pkg/policyutils/exclusions_test.go b/pkg/policyutils/exclusions_test.go
index c5af2b5742431..ff7c7a218f1dd 100644
--- a/pkg/policyutils/exclusions_test.go
+++ b/pkg/policyutils/exclusions_test.go
@@ -33,8 +33,7 @@ func TestDeploymentExclusionToQuery_NoDeploymentExclusions(t *testing.T) {
 func TestDeploymentExclusionToQuery_MalformedDeploymentExclusion(t *testing.T) {
 	q := DeploymentExclusionToQuery([]*storage.Exclusion{
 		{
-			Name:       "myExcludedScope",
-			Deployment: &storage.Exclusion_Deployment{},
+			Name: "myExcludedScope", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{}},
 		},
 	})
 	protoassert.Equal(t, q, search.MatchNoneQuery())
@@ -43,10 +42,9 @@ func TestDeploymentExclusionToQuery_MalformedDeploymentExclusion(t *testing.T) {
 func TestDeploymentExclusionToQuery_NamedDeploymentExclusion(t *testing.T) {
 	q := DeploymentExclusionToQuery([]*storage.Exclusion{
 		{
-			Name: "myExcludedScope",
-			Deployment: &storage.Exclusion_Deployment{
+			Name: "myExcludedScope", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
 				Name: "blessed-deployment",
-			},
+			}},
 		},
 	})
 	protoassert.Equal(t, q, search.NewQueryBuilder().AddExactMatches(search.DeploymentName, "blessed-deployment").ProtoQuery())
@@ -55,12 +53,11 @@ func TestDeploymentExclusionToQuery_NamedDeploymentExclusion(t *testing.T) {
 func TestDeploymentExclusionToQuery_ScopedDeploymentExclusion(t *testing.T) {
 	q := DeploymentExclusionToQuery([]*storage.Exclusion{
 		{
-			Name: "myExcludedScope",
-			Deployment: &storage.Exclusion_Deployment{
+			Name: "myExcludedScope", Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
 				Scope: &storage.Scope{
 					Cluster: "blessed-cluster-id",
 				},
-			},
+			}},
 		},
 	})
 	protoassert.Equal(t, q, search.NewQueryBuilder().AddExactMatches(search.ClusterID, "blessed-cluster-id").ProtoQuery())
diff --git a/pkg/postgres/notify/channels.go b/pkg/postgres/notify/channels.go
index 7401e1e3a0797..bd3b19acae705 100644
--- a/pkg/postgres/notify/channels.go
+++ b/pkg/postgres/notify/channels.go
@@ -1,6 +1,7 @@
 package notify
 
 const (
+	NotifierChanged        = "notifier_changed"
 	ReportConfigChanged    = "report_config_changed"
 	ReportRequestSubmitted = "report_request_submitted"
 	ReportRequestCancelled = "report_request_cancelled"
diff --git a/pkg/postgres/pgadmin/admin_utils.go b/pkg/postgres/pgadmin/admin_utils.go
index 1de44acc1480d..36cc0eff5b156 100644
--- a/pkg/postgres/pgadmin/admin_utils.go
+++ b/pkg/postgres/pgadmin/admin_utils.go
@@ -57,15 +57,11 @@ func DropDB(sourceMap map[string]string, adminConfig *postgres.Config, databaseN
 		utils.Should(errors.New("unexpected call, should not try to drop a database from an external Postgres."))
 	}
 
-	// Set the options for pg_dump from the connection config
-	options := []string{
-		"-f",
-		"--if-exists",
-		databaseName,
-	}
-
-	// Get the common DB connection info
-	options = append(options, GetConnectionOptions(adminConfig)...)
+	// Set the options for dropdb including the connection config
+	connectionOptions := GetConnectionOptions(adminConfig)
+	options := make([]string, 0, 3+len(connectionOptions))
+	options = append(options, "-f", "--if-exists", databaseName)
+	options = append(options, connectionOptions...)
 
 	cmd := exec.Command("dropdb", options...)
 
@@ -87,15 +83,11 @@ func CreateDB(sourceMap map[string]string, adminConfig *postgres.Config, dbTempl
 
 	log.Infof("CreateDB %q", dbName)
 
-	// Set the options for pg_dump from the connection config
-	options := []string{
-		"-T",
-		dbTemplate,
-		dbName,
-	}
-
-	// Get the common DB connection info
-	options = append(options, GetConnectionOptions(adminConfig)...)
+	// Set the options for createdb including the connection config
+	connectionOptions := GetConnectionOptions(adminConfig)
+	options := make([]string, 0, 3+len(connectionOptions))
+	options = append(options, "-T", dbTemplate, dbName)
+	options = append(options, connectionOptions...)
 
 	cmd := exec.Command("createdb", options...)
 
diff --git a/pkg/postgres/schema/all.go b/pkg/postgres/schema/all.go
index 184770ff0f887..c28e328b9c0b0 100644
--- a/pkg/postgres/schema/all.go
+++ b/pkg/postgres/schema/all.go
@@ -67,7 +67,7 @@ func getAllRegisteredTablesInOrder() []*registeredTable {
 	}
 	slices.Sort(tables)
 
-	var rts []*registeredTable
+	var rts []*registeredTable //nolint:prealloc // recursive with unpredictable size
 	for _, table := range tables {
 		rts = append(rts, getRegisteredTablesFor(visited, table)...)
 	}
@@ -174,7 +174,7 @@ func GetAllIndexDefinitions() []*postgres.IndexDefinition {
 }
 
 func flattenIndexes(stmt *postgres.CreateStmts) []*postgres.IndexDefinition {
-	var result []*postgres.IndexDefinition
+	var result []*postgres.IndexDefinition //nolint:prealloc // recursive index flattening, unpredictable size
 	result = append(result, stmt.Indexes...)
 	for _, child := range stmt.Children {
 		result = append(result, flattenIndexes(child)...)
diff --git a/pkg/postgres/schema/cluster_cves.go b/pkg/postgres/schema/cluster_cves.go
index e29ab8335b394..daeda1489767a 100644
--- a/pkg/postgres/schema/cluster_cves.go
+++ b/pkg/postgres/schema/cluster_cves.go
@@ -52,17 +52,18 @@ const (
 
 // ClusterCves holds the Gorm model for Postgres table `cluster_cves`.
 type ClusterCves struct {
-	ID                             string                        `gorm:"column:id;type:varchar;primaryKey"`
-	CveBaseInfoCve                 string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
-	CveBaseInfoPublishedOn         *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
-	CveBaseInfoCreatedAt           *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
-	CveBaseInfoEpssEpssProbability float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
-	CveBaseInfoCisaKev             bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
-	Cvss                           float32                       `gorm:"column:cvss;type:numeric"`
-	Severity                       storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
-	ImpactScore                    float32                       `gorm:"column:impactscore;type:numeric"`
-	Snoozed                        bool                          `gorm:"column:snoozed;type:bool"`
-	SnoozeExpiry                   *time.Time                    `gorm:"column:snoozeexpiry;type:timestamp"`
-	Type                           storage.CVE_CVEType           `gorm:"column:type;type:integer"`
-	Serialized                     []byte                        `gorm:"column:serialized;type:bytea"`
+	ID                                 string                        `gorm:"column:id;type:varchar;primaryKey"`
+	CveBaseInfoCve                     string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
+	CveBaseInfoPublishedOn             *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
+	CveBaseInfoCreatedAt               *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
+	CveBaseInfoEpssEpssProbability     float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
+	CveBaseInfoCisaKev                 bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
+	CveBaseInfoKnownRansomwareCampaign bool                          `gorm:"column:cvebaseinfo_knownransomwarecampaign;type:bool"`
+	Cvss                               float32                       `gorm:"column:cvss;type:numeric"`
+	Severity                           storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
+	ImpactScore                        float32                       `gorm:"column:impactscore;type:numeric"`
+	Snoozed                            bool                          `gorm:"column:snoozed;type:bool"`
+	SnoozeExpiry                       *time.Time                    `gorm:"column:snoozeexpiry;type:timestamp"`
+	Type                               storage.CVE_CVEType           `gorm:"column:type;type:integer"`
+	Serialized                         []byte                        `gorm:"column:serialized;type:bytea"`
 }
diff --git a/pkg/postgres/schema/image_cves_v2.go b/pkg/postgres/schema/image_cves_v2.go
index 3b179ba5a313c..b9ae2d99564a4 100644
--- a/pkg/postgres/schema/image_cves_v2.go
+++ b/pkg/postgres/schema/image_cves_v2.go
@@ -71,28 +71,30 @@ const (
 
 // ImageCvesV2 holds the Gorm model for Postgres table `image_cves_v2`.
 type ImageCvesV2 struct {
-	ID                             string                        `gorm:"column:id;type:varchar;primaryKey"`
-	ImageID                        string                        `gorm:"column:imageid;type:varchar"`
-	CveBaseInfoCve                 string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
-	CveBaseInfoPublishedOn         *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
-	CveBaseInfoCreatedAt           *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
-	CveBaseInfoEpssEpssProbability float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
-	CveBaseInfoCisaKev             bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
-	Cvss                           float32                       `gorm:"column:cvss;type:numeric"`
-	Severity                       storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
-	ImpactScore                    float32                       `gorm:"column:impactscore;type:numeric"`
-	Nvdcvss                        float32                       `gorm:"column:nvdcvss;type:numeric"`
-	FirstImageOccurrence           *time.Time                    `gorm:"column:firstimageoccurrence;type:timestamp"`
-	State                          storage.VulnerabilityState    `gorm:"column:state;type:integer"`
-	IsFixable                      bool                          `gorm:"column:isfixable;type:bool"`
-	FixedBy                        string                        `gorm:"column:fixedby;type:varchar"`
-	ComponentID                    string                        `gorm:"column:componentid;type:varchar"`
-	AdvisoryName                   string                        `gorm:"column:advisory_name;type:varchar"`
-	AdvisoryLink                   string                        `gorm:"column:advisory_link;type:varchar"`
-	ImageIDV2                      string                        `gorm:"column:imageidv2;type:varchar"`
-	FixAvailableTimestamp          *time.Time                    `gorm:"column:fixavailabletimestamp;type:timestamp"`
-	Serialized                     []byte                        `gorm:"column:serialized;type:bytea"`
-	ImagesRef                      Images                        `gorm:"foreignKey:imageid;references:id;belongsTo;constraint:OnDelete:CASCADE"`
-	ImageComponentV2Ref            ImageComponentV2              `gorm:"foreignKey:componentid;references:id;belongsTo;constraint:OnDelete:CASCADE"`
-	ImagesV2Ref                    ImagesV2                      `gorm:"foreignKey:imageidv2;references:id;belongsTo;constraint:OnDelete:CASCADE"`
+	ID                                 string                        `gorm:"column:id;type:varchar;primaryKey"`
+	ImageID                            string                        `gorm:"column:imageid;type:varchar"`
+	CveBaseInfoCve                     string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
+	CveBaseInfoPublishedOn             *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
+	CveBaseInfoCreatedAt               *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
+	CveBaseInfoEpssEpssProbability     float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
+	CveBaseInfoCisaKev                 bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
+	CveBaseInfoKnownRansomwareCampaign bool                          `gorm:"column:cvebaseinfo_knownransomwarecampaign;type:bool"`
+	Cvss                               float32                       `gorm:"column:cvss;type:numeric"`
+	Severity                           storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
+	ImpactScore                        float32                       `gorm:"column:impactscore;type:numeric"`
+	Nvdcvss                            float32                       `gorm:"column:nvdcvss;type:numeric"`
+	FirstImageOccurrence               *time.Time                    `gorm:"column:firstimageoccurrence;type:timestamp"`
+	State                              storage.VulnerabilityState    `gorm:"column:state;type:integer"`
+	IsFixable                          bool                          `gorm:"column:isfixable;type:bool"`
+	FixedBy                            string                        `gorm:"column:fixedby;type:varchar"`
+	ComponentID                        string                        `gorm:"column:componentid;type:varchar"`
+	AdvisoryName                       string                        `gorm:"column:advisory_name;type:varchar"`
+	AdvisoryLink                       string                        `gorm:"column:advisory_link;type:varchar"`
+	ImageIDV2                          string                        `gorm:"column:imageidv2;type:varchar"`
+	FixAvailableTimestamp              *time.Time                    `gorm:"column:fixavailabletimestamp;type:timestamp"`
+	Origin                             storage.VulnOrigin            `gorm:"column:origin;type:integer"`
+	Serialized                         []byte                        `gorm:"column:serialized;type:bytea"`
+	ImagesRef                          Images                        `gorm:"foreignKey:imageid;references:id;belongsTo;constraint:OnDelete:CASCADE"`
+	ImageComponentV2Ref                ImageComponentV2              `gorm:"foreignKey:componentid;references:id;belongsTo;constraint:OnDelete:CASCADE"`
+	ImagesV2Ref                        ImagesV2                      `gorm:"foreignKey:imageidv2;references:id;belongsTo;constraint:OnDelete:CASCADE"`
 }
diff --git a/pkg/postgres/schema/node_cves.go b/pkg/postgres/schema/node_cves.go
index f3e716f52758c..e47421853ae26 100644
--- a/pkg/postgres/schema/node_cves.go
+++ b/pkg/postgres/schema/node_cves.go
@@ -55,19 +55,20 @@ const (
 
 // NodeCves holds the Gorm model for Postgres table `node_cves`.
 type NodeCves struct {
-	ID                             string                        `gorm:"column:id;type:varchar;primaryKey"`
-	CveBaseInfoCve                 string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
-	CveBaseInfoPublishedOn         *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
-	CveBaseInfoCreatedAt           *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
-	CveBaseInfoEpssEpssProbability float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
-	CveBaseInfoCisaKev             bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
-	OperatingSystem                string                        `gorm:"column:operatingsystem;type:varchar"`
-	Cvss                           float32                       `gorm:"column:cvss;type:numeric"`
-	Severity                       storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
-	ImpactScore                    float32                       `gorm:"column:impactscore;type:numeric"`
-	Snoozed                        bool                          `gorm:"column:snoozed;type:bool"`
-	SnoozeExpiry                   *time.Time                    `gorm:"column:snoozeexpiry;type:timestamp"`
-	Orphaned                       bool                          `gorm:"column:orphaned;type:bool"`
-	OrphanedTime                   *time.Time                    `gorm:"column:orphanedtime;type:timestamp"`
-	Serialized                     []byte                        `gorm:"column:serialized;type:bytea"`
+	ID                                 string                        `gorm:"column:id;type:varchar;primaryKey"`
+	CveBaseInfoCve                     string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
+	CveBaseInfoPublishedOn             *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
+	CveBaseInfoCreatedAt               *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
+	CveBaseInfoEpssEpssProbability     float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
+	CveBaseInfoCisaKev                 bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
+	CveBaseInfoKnownRansomwareCampaign bool                          `gorm:"column:cvebaseinfo_knownransomwarecampaign;type:bool"`
+	OperatingSystem                    string                        `gorm:"column:operatingsystem;type:varchar"`
+	Cvss                               float32                       `gorm:"column:cvss;type:numeric"`
+	Severity                           storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
+	ImpactScore                        float32                       `gorm:"column:impactscore;type:numeric"`
+	Snoozed                            bool                          `gorm:"column:snoozed;type:bool"`
+	SnoozeExpiry                       *time.Time                    `gorm:"column:snoozeexpiry;type:timestamp"`
+	Orphaned                           bool                          `gorm:"column:orphaned;type:bool"`
+	OrphanedTime                       *time.Time                    `gorm:"column:orphanedtime;type:timestamp"`
+	Serialized                         []byte                        `gorm:"column:serialized;type:bytea"`
 }
diff --git a/pkg/postgres/schema/report_snapshots.go b/pkg/postgres/schema/report_snapshots.go
index dd5f4894b17a8..b5e815fc90eb4 100644
--- a/pkg/postgres/schema/report_snapshots.go
+++ b/pkg/postgres/schema/report_snapshots.go
@@ -55,6 +55,7 @@ type ReportSnapshots struct {
 	ReportID                             string                                  `gorm:"column:reportid;type:uuid;primaryKey"`
 	ReportConfigurationID                string                                  `gorm:"column:reportconfigurationid;type:varchar"`
 	Name                                 string                                  `gorm:"column:name;type:varchar"`
+	Type                                 storage.ReportSnapshot_ReportType       `gorm:"column:type;type:integer"`
 	ReportStatusRunState                 storage.ReportStatus_RunState           `gorm:"column:reportstatus_runstate;type:integer"`
 	ReportStatusQueuedAt                 *time.Time                              `gorm:"column:reportstatus_queuedat;type:timestamp"`
 	ReportStatusCompletedAt              *time.Time                              `gorm:"column:reportstatus_completedat;type:timestamp"`
diff --git a/pkg/postgres/schema/virtual_machine_cvev2.go b/pkg/postgres/schema/virtual_machine_cvev2.go
index 1f7a689e20858..8119584863c06 100644
--- a/pkg/postgres/schema/virtual_machine_cvev2.go
+++ b/pkg/postgres/schema/virtual_machine_cvev2.go
@@ -68,24 +68,25 @@ const (
 
 // VirtualMachineCvev2 holds the Gorm model for Postgres table `virtual_machine_cvev2`.
 type VirtualMachineCvev2 struct {
-	ID                             string                        `gorm:"column:id;type:uuid;primaryKey"`
-	VmV2ID                         string                        `gorm:"column:vmv2id;type:uuid"`
-	VmComponentID                  string                        `gorm:"column:vmcomponentid;type:uuid"`
-	CveBaseInfoCve                 string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
-	CveBaseInfoPublishedOn         *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
-	CveBaseInfoCreatedAt           *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
-	CveBaseInfoEpssEpssProbability float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
-	CveBaseInfoCisaKev             bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
-	PreferredCvss                  float32                       `gorm:"column:preferredcvss;type:numeric"`
-	Severity                       storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
-	ImpactScore                    float32                       `gorm:"column:impactscore;type:numeric"`
-	Nvdcvss                        float32                       `gorm:"column:nvdcvss;type:numeric"`
-	IsFixable                      bool                          `gorm:"column:isfixable;type:bool"`
-	FixedBy                        string                        `gorm:"column:fixedby;type:varchar"`
-	EpssProbability                float32                       `gorm:"column:epssprobability;type:numeric"`
-	AdvisoryName                   string                        `gorm:"column:advisory_name;type:varchar"`
-	AdvisoryLink                   string                        `gorm:"column:advisory_link;type:varchar"`
-	Serialized                     []byte                        `gorm:"column:serialized;type:bytea"`
-	VirtualMachineV2Ref            VirtualMachineV2              `gorm:"foreignKey:vmv2id;references:id;belongsTo;constraint:OnDelete:CASCADE"`
-	VirtualMachineComponentV2Ref   VirtualMachineComponentV2     `gorm:"foreignKey:vmcomponentid;references:id;belongsTo;constraint:OnDelete:CASCADE"`
+	ID                                 string                        `gorm:"column:id;type:uuid;primaryKey"`
+	VmV2ID                             string                        `gorm:"column:vmv2id;type:uuid"`
+	VmComponentID                      string                        `gorm:"column:vmcomponentid;type:uuid"`
+	CveBaseInfoCve                     string                        `gorm:"column:cvebaseinfo_cve;type:varchar"`
+	CveBaseInfoPublishedOn             *time.Time                    `gorm:"column:cvebaseinfo_publishedon;type:timestamp"`
+	CveBaseInfoCreatedAt               *time.Time                    `gorm:"column:cvebaseinfo_createdat;type:timestamp"`
+	CveBaseInfoEpssEpssProbability     float32                       `gorm:"column:cvebaseinfo_epss_epssprobability;type:numeric"`
+	CveBaseInfoCisaKev                 bool                          `gorm:"column:cvebaseinfo_cisakev;type:bool"`
+	CveBaseInfoKnownRansomwareCampaign bool                          `gorm:"column:cvebaseinfo_knownransomwarecampaign;type:bool"`
+	PreferredCvss                      float32                       `gorm:"column:preferredcvss;type:numeric"`
+	Severity                           storage.VulnerabilitySeverity `gorm:"column:severity;type:integer"`
+	ImpactScore                        float32                       `gorm:"column:impactscore;type:numeric"`
+	Nvdcvss                            float32                       `gorm:"column:nvdcvss;type:numeric"`
+	IsFixable                          bool                          `gorm:"column:isfixable;type:bool"`
+	FixedBy                            string                        `gorm:"column:fixedby;type:varchar"`
+	EpssProbability                    float32                       `gorm:"column:epssprobability;type:numeric"`
+	AdvisoryName                       string                        `gorm:"column:advisory_name;type:varchar"`
+	AdvisoryLink                       string                        `gorm:"column:advisory_link;type:varchar"`
+	Serialized                         []byte                        `gorm:"column:serialized;type:bytea"`
+	VirtualMachineV2Ref                VirtualMachineV2              `gorm:"foreignKey:vmv2id;references:id;belongsTo;constraint:OnDelete:CASCADE"`
+	VirtualMachineComponentV2Ref       VirtualMachineComponentV2     `gorm:"foreignKey:vmcomponentid;references:id;belongsTo;constraint:OnDelete:CASCADE"`
 }
diff --git a/pkg/postgres/schema/virtual_machine_v2.go b/pkg/postgres/schema/virtual_machine_v2.go
index 6890bb907818b..0c8a2f4df4253 100644
--- a/pkg/postgres/schema/virtual_machine_v2.go
+++ b/pkg/postgres/schema/virtual_machine_v2.go
@@ -56,13 +56,14 @@ const (
 
 // VirtualMachineV2 holds the Gorm model for Postgres table `virtual_machine_v2`.
 type VirtualMachineV2 struct {
-	ID          string                         `gorm:"column:id;type:uuid;primaryKey"`
-	Name        string                         `gorm:"column:name;type:varchar"`
-	Namespace   string                         `gorm:"column:namespace;type:varchar"`
-	ClusterID   string                         `gorm:"column:clusterid;type:uuid"`
-	ClusterName string                         `gorm:"column:clustername;type:varchar"`
-	GuestOs     string                         `gorm:"column:guestos;type:varchar"`
-	State       storage.VirtualMachineV2_State `gorm:"column:state;type:integer"`
-	LastUpdated *time.Time                     `gorm:"column:lastupdated;type:timestamptz"`
-	Serialized  []byte                         `gorm:"column:serialized;type:bytea"`
+	ID               string                         `gorm:"column:id;type:uuid;primaryKey"`
+	Name             string                         `gorm:"column:name;type:varchar"`
+	Namespace        string                         `gorm:"column:namespace;type:varchar"`
+	ClusterID        string                         `gorm:"column:clusterid;type:uuid"`
+	ClusterName      string                         `gorm:"column:clustername;type:varchar"`
+	GuestOs          string                         `gorm:"column:guestos;type:varchar"`
+	State            storage.VirtualMachineV2_State `gorm:"column:state;type:integer"`
+	LastUpdated      *time.Time                     `gorm:"column:lastupdated;type:timestamptz"`
+	LastAgentContact *time.Time                     `gorm:"column:lastagentcontact;type:timestamptz"`
+	Serialized       []byte                         `gorm:"column:serialized;type:bytea"`
 }
diff --git a/pkg/postgres/walker/walker.go b/pkg/postgres/walker/walker.go
index 42ced81fa6442..fb79783ca2119 100644
--- a/pkg/postgres/walker/walker.go
+++ b/pkg/postgres/walker/walker.go
@@ -3,6 +3,7 @@ package walker
 import (
 	"fmt"
 	"reflect"
+	"slices"
 	"strings"
 
 	"github.com/stackrox/rox/pkg/postgres"
@@ -82,7 +83,7 @@ func addCommonFields(s *Schema, parentPrimaryKeys ...Field) {
 		}
 	} else {
 		// Child table: add parent FK fields and idx column.
-		var additionalFields []Field
+		additionalFields := make([]Field, 0, len(parentPrimaryKeys)+1)
 		for _, parentPrimaryKey := range parentPrimaryKeys {
 			var columnNameInChild string
 			var columnNameInChildForCodeVariables string
@@ -114,7 +115,7 @@ func addCommonFields(s *Schema, parentPrimaryKeys ...Field) {
 			})
 		}
 		additionalFields = append(additionalFields, getIdxField(s))
-		s.Fields = append(additionalFields, s.Fields...)
+		s.Fields = slices.Concat(additionalFields, s.Fields)
 	}
 
 	if len(s.Children) > 0 {
@@ -356,7 +357,7 @@ func tableName(parent, child string) string {
 }
 
 func typeIsEnum(typ reflect.Type) bool {
-	enum, ok := reflect.Zero(typ).Interface().(protoreflect.ProtoEnum)
+	enum, ok := reflect.TypeAssert[protoreflect.ProtoEnum](reflect.Zero(typ))
 	if !ok {
 		return false
 	}
diff --git a/pkg/printers/sarif.go b/pkg/printers/sarif.go
index e1188b3dea0d2..d1de4b365a5a7 100644
--- a/pkg/printers/sarif.go
+++ b/pkg/printers/sarif.go
@@ -5,8 +5,8 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/owenrumney/go-sarif/v2/sarif"
-	"github.com/pkg/errors"
+	"github.com/owenrumney/go-sarif/v3/pkg/report"
+	"github.com/owenrumney/go-sarif/v3/pkg/report/v210/sarif"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/gjson"
@@ -125,58 +125,54 @@ func (s *SarifPrinter) Print(object interface{}, out io.Writer) error {
 		WithVersion(version.GetMainVersion()).
 		WithFullName("roxctl command line utility")
 
-	report, err := sarif.New(sarif.Version210)
-	if err != nil {
-		return errors.Wrap(err, "creating sarif report")
-	}
+	sarifReport := report.NewV210Report()
 
 	for _, entry := range sarifEntries {
 		s.addEntry(run, entry)
 	}
 
-	report.AddRun(run)
-	return report.PrettyWrite(out)
+	sarifReport.AddRun(run)
+	return sarifReport.PrettyWrite(out)
 }
 
 func (s *SarifPrinter) addEntry(run *sarif.Run, entry sarifEntry) {
 	rule := run.AddRule(entry.ruleID)
 	rule.WithName(s.reportType).
 		// Setting the description is also setting the title displayed in GitHub.
-		WithShortDescription(sarif.NewMultiformatMessageString(entry.ruleID)).
-		WithFullDescription(sarif.NewMultiformatMessageString(entry.ruleID)).
-		WithHelp(sarif.NewMultiformatMessageString(entry.help))
+		WithShortDescription(sarif.NewMultiformatMessageString().WithText(entry.ruleID)).
+		WithFullDescription(sarif.NewMultiformatMessageString().WithText(entry.ruleID)).
+		WithHelp(sarif.NewMultiformatMessageString().WithText(entry.help))
 
 	if entry.helpLink != "" {
 		rule.WithHelpURI(entry.helpLink)
 	}
 
-	properties := sarif.Properties{
+	properties := sarif.NewPropertyBag().
 		// Precision very-high ensures this violation is shown first within GitHub.
-		"precision": "very-high",
+		Add("precision", "very-high").
 		// Tags allow filtering, which is desirable to have.
-		"tags": []string{
+		WithTags([]string{
 			utils.IfThenElse(s.reportType == SarifVulnerabilityReport, "security", "policy-violation"),
 			entry.severity,
-		},
-	}
+		})
+
 	// For vulnerability reports, generated the security severity based of the severity reported.
 	if s.reportType == SarifVulnerabilityReport {
-		properties["security-severity"] = toSecuritySeverity(entry.severity)
+		properties.Add("security-severity", toSecuritySeverity(entry.severity))
 	}
 	rule.WithProperties(properties)
 
-	run.AddResult(sarif.NewRuleResult(entry.ruleID).
+	run.CreateResultForRule(entry.ruleID).
 		WithLevel(toSarifLevel(entry.severity)).
 		// Reusing the help here, since the help includes remediation information.
 		WithMessage(sarif.NewMessage().WithText(entry.help)).
 		WithLocations([]*sarif.Location{
-			{
-				PhysicalLocation: &sarif.PhysicalLocation{
-					ArtifactLocation: sarif.NewArtifactLocation().WithUri(s.entity),
-					Region:           sarif.NewSimpleRegion(1, 1),
-				},
-			},
-		}))
+			sarif.NewLocationWithPhysicalLocation(
+				sarif.NewPhysicalLocation().
+					WithArtifactLocation(sarif.NewArtifactLocation().WithURI(s.entity)).
+					WithRegion(sarif.NewSimpleRegion(1, 1)),
+			),
+		})
 }
 
 func sarifEntriesFromJSONObject(jsonObject interface{}, pathExpressions map[string]string) ([]sarifEntry, error) {
diff --git a/pkg/printers/sarif_test.go b/pkg/printers/sarif_test.go
index 0fe19b6db5d3b..35d41a8e07802 100644
--- a/pkg/printers/sarif_test.go
+++ b/pkg/printers/sarif_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/owenrumney/go-sarif/v3/pkg/report/v210/sarif"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/version"
 	"github.com/stretchr/testify/assert"
@@ -75,11 +76,63 @@ func TestSarifPrinter_Print_Success(t *testing.T) {
 	err = printer.Print(obj, &out)
 	require.NoError(t, err)
 
+	// Strict parsing preserves null arrays so validation checks the emitted output.
+	report, err := sarif.FromString(out.String(), sarif.WithStrictValidation())
+	require.NoError(t, err)
+	assert.NoError(t, report.Validate())
+
 	// Since the report contains the version, replace it specifically here.
 	exp, err := regexp.Compile(fmt.Sprintf(`"version": "%s"`, version.GetMainVersion()))
 	require.NoError(t, err)
 	output := exp.ReplaceAllString(out.String(), `"version": ""`)
-	assert.Equal(t, string(expectedOutput), output)
+	assert.JSONEq(t, string(expectedOutput), output)
+}
+
+func TestSarifPrinter_Print_RuleIndexes(t *testing.T) {
+	for name, tc := range map[string]struct {
+		ruleIDs []string
+		indexes []int
+	}{
+		"distinct rules": {
+			ruleIDs: []string{"A", "B", "C"},
+			indexes: []int{0, 1, 2},
+		},
+		"repeated rule": {
+			ruleIDs: []string{"A", "B", "A", "C"},
+			indexes: []int{0, 1, 0, 2},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			obj := &testObject{}
+			for _, ruleID := range tc.ruleIDs {
+				obj.Violations = append(obj.Violations, violation{
+					ID:       ruleID,
+					Reason:   "remediation",
+					Severity: "IMPORTANT",
+				})
+			}
+			printer := NewSarifPrinter(map[string]string{
+				SarifRuleJSONPathExpressionKey:     "violations.#.id",
+				SarifHelpJSONPathExpressionKey:     "violations.#.reason",
+				SarifSeverityJSONPathExpressionKey: "violations.#.severity",
+			}, "docker.io/nginx:1.19", SarifPolicyReport)
+			var out strings.Builder
+			require.NoError(t, printer.Print(obj, &out))
+			report, err := sarif.FromString(out.String(), sarif.WithStrictValidation())
+			require.NoError(t, err)
+			assert.NoError(t, report.Validate())
+			require.Len(t, report.Runs, 1)
+			run := report.Runs[0]
+			require.Len(t, run.Tool.Driver.Rules, 3)
+			require.Len(t, run.Results, len(tc.ruleIDs))
+			for i, result := range run.Results {
+				assert.Equal(t, tc.indexes[i], result.RuleIndex)
+				require.GreaterOrEqual(t, result.RuleIndex, 0)
+				require.Less(t, result.RuleIndex, len(run.Tool.Driver.Rules))
+				assert.Equal(t, result.RuleID, run.Tool.Driver.Rules[result.RuleIndex].ID)
+			}
+		})
+	}
 }
 
 func TestSarifPrinter_Print_EmptyViolations(t *testing.T) {
@@ -98,9 +151,14 @@ func TestSarifPrinter_Print_EmptyViolations(t *testing.T) {
 	err = printer.Print(obj, &out)
 	require.NoError(t, err)
 
+	// Strict parsing preserves null arrays so validation checks the emitted output.
+	report, err := sarif.FromString(out.String(), sarif.WithStrictValidation())
+	require.NoError(t, err)
+	assert.NoError(t, report.Validate())
+
 	// Since the report contains the version, replace it specifically here.
 	exp, err := regexp.Compile(fmt.Sprintf(`"version": "%s"`, version.GetMainVersion()))
 	require.NoError(t, err)
 	output := exp.ReplaceAllString(out.String(), `"version": ""`)
-	assert.Equal(t, string(expectedOutput), output)
+	assert.JSONEq(t, string(expectedOutput), output)
 }
diff --git a/pkg/printers/testdata/empty_sarif_report.json b/pkg/printers/testdata/empty_sarif_report.json
index 12a809e7d2a13..3d7731ab0b0a6 100644
--- a/pkg/printers/testdata/empty_sarif_report.json
+++ b/pkg/printers/testdata/empty_sarif_report.json
@@ -1,10 +1,40 @@
 {
   "version": "2.1.0",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+  "properties": {},
   "runs": [
     {
+      "addresses": [],
+      "graphs": [],
+      "invocations": [],
+      "language": "en-US",
+      "logicalLocations": [],
+      "newlineSequences": [
+        "\r\n",
+        "\n"
+      ],
+      "policies": [],
+      "redactionTokens": [],
+      "runAggregates": [],
+      "taxonomies": [],
+      "threadFlowLocations": [],
+      "translations": [],
+      "versionControlProvenance": [],
+      "webRequests": [],
+      "webResponses": [],
       "tool": {
+        "extensions": [],
         "driver": {
+          "contents": [
+            "localizedData",
+            "nonLocalizedData"
+          ],
+          "isComprehensive": false,
+          "language": "en-US",
+          "locations": [],
+          "notifications": [],
+          "supportedTaxonomies": [],
+          "taxa": [],
           "fullName": "roxctl command line utility",
           "informationUri": "https://github.com/stackrox/stackrox",
           "name": "roxctl",
diff --git a/pkg/printers/testdata/sarif_report.json b/pkg/printers/testdata/sarif_report.json
index f397ad866c0d6..3b6c3aad03213 100644
--- a/pkg/printers/testdata/sarif_report.json
+++ b/pkg/printers/testdata/sarif_report.json
@@ -1,15 +1,46 @@
 {
+  "properties": {},
   "version": "2.1.0",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
   "runs": [
     {
+      "addresses": [],
+      "graphs": [],
+      "invocations": [],
+      "language": "en-US",
+      "logicalLocations": [],
+      "newlineSequences": [
+        "\r\n",
+        "\n"
+      ],
+      "policies": [],
+      "redactionTokens": [],
+      "runAggregates": [],
+      "taxonomies": [],
+      "threadFlowLocations": [],
+      "translations": [],
+      "versionControlProvenance": [],
+      "webRequests": [],
+      "webResponses": [],
       "tool": {
+        "extensions": [],
         "driver": {
+          "contents": [
+            "localizedData",
+            "nonLocalizedData"
+          ],
+          "isComprehensive": false,
+          "language": "en-US",
+          "locations": [],
+          "notifications": [],
+          "supportedTaxonomies": [],
+          "taxa": [],
           "fullName": "roxctl command line utility",
           "informationUri": "https://github.com/stackrox/stackrox",
           "name": "roxctl",
           "rules": [
             {
+              "relationships": [],
               "id": "first-violation",
               "name": "PolicyViolations",
               "shortDescription": {
@@ -30,6 +61,7 @@
               }
             },
             {
+              "relationships": [],
               "id": "second-violation",
               "name": "PolicyViolations",
               "shortDescription": {
@@ -50,6 +82,7 @@
               }
             },
             {
+              "relationships": [],
               "id": "third-violation",
               "name": "PolicyViolations",
               "shortDescription": {
@@ -75,19 +108,37 @@
       },
       "results": [
         {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "rank": -1,
+          "relatedLocations": [],
+          "stacks": [],
+          "taxa": [],
           "ruleId": "first-violation",
           "ruleIndex": 0,
           "level": "error",
           "message": {
+            "arguments": [],
             "text": "something about misconfiguration"
           },
           "locations": [
             {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "relationships": [],
               "physicalLocation": {
                 "artifactLocation": {
+                  "index": -1,
                   "uri": "docker.io/nginx:1.19"
                 },
                 "region": {
+                  "byteOffset": -1,
+                  "charOffset": -1,
                   "startLine": 1,
                   "endLine": 1
                 }
@@ -96,19 +147,37 @@
           ]
         },
         {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "rank": -1,
+          "relatedLocations": [],
+          "stacks": [],
+          "taxa": [],
           "ruleId": "second-violation",
           "ruleIndex": 1,
           "level": "note",
           "message": {
+            "arguments": [],
             "text": "something about vulnerabilities"
           },
           "locations": [
             {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "relationships": [],
               "physicalLocation": {
                 "artifactLocation": {
+                  "index": -1,
                   "uri": "docker.io/nginx:1.19"
                 },
                 "region": {
+                  "byteOffset": -1,
+                  "charOffset": -1,
                   "startLine": 1,
                   "endLine": 1
                 }
@@ -117,19 +186,37 @@
           ]
         },
         {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "rank": -1,
+          "relatedLocations": [],
+          "stacks": [],
+          "taxa": [],
           "ruleId": "third-violation",
           "ruleIndex": 2,
           "level": "error",
           "message": {
+            "arguments": [],
             "text": "something about secrets"
           },
           "locations": [
             {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "relationships": [],
               "physicalLocation": {
                 "artifactLocation": {
+                  "index": -1,
                   "uri": "docker.io/nginx:1.19"
                 },
                 "region": {
+                  "byteOffset": -1,
+                  "charOffset": -1,
                   "startLine": 1,
                   "endLine": 1
                 }
diff --git a/pkg/process/filter/filter.go b/pkg/process/filter/filter.go
index 6b24970b5d95b..d07e3581dede1 100644
--- a/pkg/process/filter/filter.go
+++ b/pkg/process/filter/filter.go
@@ -1,6 +1,7 @@
 package filter
 
 import (
+	"fmt"
 	"hash"
 	"strings"
 	"unsafe"
@@ -11,6 +12,7 @@ import (
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/stringutils"
 	"github.com/stackrox/rox/pkg/sync"
+	"github.com/stackrox/rox/pkg/utils"
 )
 
 // BinaryHash represents a 64-bit hash for memory-efficient key storage.
@@ -95,23 +97,41 @@ type Filter interface {
 	DeleteByPod(pod *storage.Pod)
 }
 
+type child struct {
+	hash BinaryHash
+	node *level
+}
+
 type level struct {
 	hits     int
-	children map[BinaryHash]*level
+	children []child
 }
 
 func newLevel() *level {
-	return &level{
-		children: make(map[BinaryHash]*level),
+	return &level{}
+}
+
+func (l *level) findChild(h BinaryHash) *level {
+	for _, c := range l.children {
+		if c.hash == h {
+			return c.node
+		}
 	}
+	return nil
 }
 
+// containerNode is the per-container root of the filter tree, keyed by process
+// executable path. The process layer is unbounded (Sensor sets maxUniqueProcesses
+// to math.MaxInt), so a map keeps lookup and insertion O(1); argument levels below
+// each process are bounded by fanOut and use slices (see level).
+type containerNode = map[BinaryHash]*level
+
 type filterImpl struct {
-	maxExactPathMatches int   // maximum number of exact path (same pod + container and same process and args) matches to tolerate
-	maxUniqueProcesses  int   // maximum number of unique process exec file paths
-	maxFanOut           []int // maximum fan out starting at the process level
+	maxExactPathMatches int     // maximum number of exact path (same pod + container and same process and args) matches to tolerate
+	maxUniqueProcesses  int     // maximum number of unique process exec file paths
+	maxFanOut           []uint8 // maximum fan out starting at the process level
 
-	containersInDeployment map[string]map[string]*level
+	containersInDeployment map[string]map[string]containerNode
 	rootLock               sync.Mutex
 
 	// Hash instance for computing BinaryHash keys
@@ -138,14 +158,14 @@ func (f *filterImpl) siftNoLock(level *level, args []string, levelNum int) bool
 	// 2. Using BinaryHash as map key is reducing memory requirements for the filter
 	argHash := hashString(f.h, truncated)
 
-	nextLevel := level.children[argHash]
+	nextLevel := level.findChild(argHash)
 	if nextLevel == nil {
 		// If this level has already hit its max fan out then return false
-		if len(level.children) >= f.maxFanOut[levelNum] {
+		if len(level.children) >= int(f.maxFanOut[levelNum]) {
 			return false
 		}
 		nextLevel = newLevel()
-		level.children[argHash] = nextLevel
+		level.children = append(level.children, child{hash: argHash, node: nextLevel})
 	}
 
 	return f.siftNoLock(nextLevel, args[1:], levelNum+1)
@@ -153,26 +173,40 @@ func (f *filterImpl) siftNoLock(level *level, args []string, levelNum int) bool
 
 // NewFilter returns an empty filter to start loading processes into
 func NewFilter(maxExactPathMatches, maxUniqueProcesses int, fanOut []int) Filter {
+	maxFanOut := make([]uint8, len(fanOut))
+	for i, v := range fanOut {
+		if v < 1 {
+			// Guard the boundary: uint8(negative) wraps to a large value (e.g. -1 -> 255).
+			// Mirror the env layer's MinimumElementValue(1) so invalid values cannot become max fan out.
+			utils.Should(fmt.Errorf("fanOut[%d]=%d is below minimum, clamping to 1", i, v))
+			v = 1
+		}
+		if v > 255 {
+			utils.Should(fmt.Errorf("ROX_PROCESS_FILTER_FAN_OUT_LEVELS[%d]=%d exceeds uint8 max, clamping to 255", i, v))
+			v = 255
+		}
+		maxFanOut[i] = uint8(v)
+	}
 	return &filterImpl{
 		maxExactPathMatches: maxExactPathMatches,
 		maxUniqueProcesses:  maxUniqueProcesses,
-		maxFanOut:           fanOut,
+		maxFanOut:           maxFanOut,
 
-		containersInDeployment: make(map[string]map[string]*level),
+		containersInDeployment: make(map[string]map[string]containerNode),
 		h:                      xxhash.New(),
 	}
 }
 
-func (f *filterImpl) getOrAddRootLevelNoLock(indicator *storage.ProcessIndicator) *level {
+func (f *filterImpl) getOrAddRootLevelNoLock(indicator *storage.ProcessIndicator) containerNode {
 	containerMap := f.containersInDeployment[indicator.GetDeploymentId()]
 	if containerMap == nil {
-		containerMap = make(map[string]*level)
+		containerMap = make(map[string]containerNode)
 		f.containersInDeployment[indicator.GetDeploymentId()] = containerMap
 	}
 
 	rootLevel := containerMap[indicator.GetSignal().GetContainerId()]
 	if rootLevel == nil {
-		rootLevel = newLevel()
+		rootLevel = make(containerNode)
 		containerMap[indicator.GetSignal().GetContainerId()] = rootLevel
 	}
 
@@ -192,13 +226,13 @@ func (f *filterImpl) Add(indicator *storage.ProcessIndicator) bool {
 	execFilePathHash := hashString(f.h, execFilePath)
 
 	// Handle the process level independently as we will never reject a new process
-	processLevel := rootLevel.children[execFilePathHash]
+	processLevel := rootLevel[execFilePathHash]
 	if processLevel == nil {
-		if len(rootLevel.children) >= f.maxUniqueProcesses {
+		if len(rootLevel) >= f.maxUniqueProcesses {
 			return false
 		}
 		processLevel = newLevel()
-		rootLevel.children[execFilePathHash] = processLevel
+		rootLevel[execFilePathHash] = processLevel
 	}
 
 	return f.siftNoLock(processLevel, strings.Fields(indicator.GetSignal().GetArgs()), 0)
diff --git a/pkg/process/filter/filter_bench_test.go b/pkg/process/filter/filter_bench_test.go
index fd98f09ab560e..518a8bca24f81 100644
--- a/pkg/process/filter/filter_bench_test.go
+++ b/pkg/process/filter/filter_bench_test.go
@@ -2,51 +2,108 @@ package filter
 
 import (
 	"fmt"
-	"runtime"
+	"math"
 	"testing"
 
 	"github.com/stackrox/rox/generated/storage"
 )
 
-// BenchmarkAdd measures performance of adding process indicators
 func BenchmarkAdd(b *testing.B) {
-	filter := NewFilter(100, 1000, []int{100, 100, 100})
-
-	// Create test data
-	indicators := make([]*storage.ProcessIndicator, 1000)
-	for i := range indicators {
-		indicators[i] = &storage.ProcessIndicator{
-			DeploymentId:  fmt.Sprintf("dep%d", i%10),
-			ContainerName: "container",
-			Signal: &storage.ProcessSignal{
-				ContainerId:  fmt.Sprintf("id%d", i%10),
-				ExecFilePath: fmt.Sprintf("/usr/bin/process%d", i%100),
-				Args:         fmt.Sprintf("arg1 arg2 arg3 iteration%d", i),
-			},
-		}
+	cases := []struct {
+		name           string
+		fanOut         []int
+		maxExact       int
+		maxUnique      int
+		numIndicators  int
+		numDeployments int
+		numProcesses   int
+	}{
+		{
+			name:           "default_fanout",
+			fanOut:         []int{8, 6, 4, 2},
+			maxExact:       5,
+			maxUnique:      5000,
+			numIndicators:  1000,
+			numDeployments: 10,
+			numProcesses:   100,
+		},
+		{
+			name:           "high_fanout",
+			fanOut:         []int{100, 100, 100},
+			maxExact:       100,
+			maxUnique:      1000,
+			numIndicators:  1000,
+			numDeployments: 10,
+			numProcesses:   100,
+		},
 	}
 
-	for i := 0; b.Loop(); i++ {
-		filter.Add(indicators[i%len(indicators)])
+	for _, tc := range cases {
+		b.Run(tc.name, func(b *testing.B) {
+			filter := NewFilter(tc.maxExact, tc.maxUnique, tc.fanOut)
+
+			indicators := make([]*storage.ProcessIndicator, tc.numIndicators)
+			for i := range indicators {
+				indicators[i] = &storage.ProcessIndicator{
+					DeploymentId:  fmt.Sprintf("dep%d", i%tc.numDeployments),
+					ContainerName: "container",
+					Signal: &storage.ProcessSignal{
+						ContainerId:  fmt.Sprintf("id%d", i%tc.numDeployments),
+						ExecFilePath: fmt.Sprintf("/usr/bin/process%d", i%tc.numProcesses),
+						Args:         fmt.Sprintf("arg1 arg2 arg3 iteration%d", i),
+					},
+				}
+			}
+
+			for i := 0; b.Loop(); i++ {
+				filter.Add(indicators[i%len(indicators)])
+			}
+		})
 	}
 }
 
-// BenchmarkAddMemory measures memory allocations
-func BenchmarkAddMemory(b *testing.B) {
-	filter := NewFilter(100, 1000, []int{100, 100, 100})
-
-	pi := &storage.ProcessIndicator{
-		DeploymentId:  "deployment",
-		ContainerName: "container",
-		Signal: &storage.ProcessSignal{
-			ContainerId:  "containerid",
-			ExecFilePath: "/usr/bin/process",
-			Args:         "arg1 arg2 arg3",
-		},
+func BenchmarkLookupInFullLevel(b *testing.B) {
+	cases := []struct {
+		name    string
+		fanOut  []int
+		numArgs int
+	}{
+		{name: "fanout_8", fanOut: []int{8}, numArgs: 8},
+		{name: "fanout_20", fanOut: []int{20}, numArgs: 20},
+		{name: "fanout_100", fanOut: []int{100}, numArgs: 100},
+		{name: "fanout_255", fanOut: []int{255}, numArgs: 255},
 	}
 
-	for b.Loop() {
-		filter.Add(pi)
+	for _, tc := range cases {
+		b.Run(tc.name, func(b *testing.B) {
+			filter := NewFilter(tc.numArgs+1, 5000, tc.fanOut)
+
+			for i := range tc.numArgs {
+				filter.Add(&storage.ProcessIndicator{
+					DeploymentId:  "dep",
+					ContainerName: "container",
+					Signal: &storage.ProcessSignal{
+						ContainerId:  "id",
+						ExecFilePath: "/usr/bin/proc",
+						Args:         fmt.Sprintf("arg%d", i),
+					},
+				})
+			}
+
+			last := &storage.ProcessIndicator{
+				DeploymentId:  "dep",
+				ContainerName: "container",
+				Signal: &storage.ProcessSignal{
+					ContainerId:  "id",
+					ExecFilePath: "/usr/bin/proc",
+					Args:         fmt.Sprintf("arg%d", tc.numArgs-1),
+				},
+			}
+
+			for b.Loop() {
+				filter.Add(last)
+			}
+		})
 	}
 }
 
@@ -80,8 +137,64 @@ func BenchmarkBuildIndicatorFilterMemory(b *testing.B) {
 				}
 			}
 		}
+	}
+}
+
+// BenchmarkHighCardinalityProcesses measures a single container accumulating many
+// distinct executable paths. Sensor runs with an unbounded maxUniqueProcesses, so
+// the process level must stay near O(1) per insert rather than degrading to O(n^2).
+// The "maxed" case additionally pushes the configurable parameters to their limits
+// (fanOut 255 across 10 levels, maxExact 1000) with several argument variations per
+// process to also stress the argument-level tree.
+func BenchmarkHighCardinalityProcesses(b *testing.B) {
+	cases := []struct {
+		name         string
+		numProcesses int
+		argsPerProc  int
+		fanOut       []int
+		maxExact     int
+	}{
+		{
+			name:         "10k_processes_default_fanout",
+			numProcesses: 10000,
+			argsPerProc:  1,
+			fanOut:       []int{8, 6, 4, 2},
+			maxExact:     5,
+		},
+		{
+			name:         "10k_processes_maxed_params",
+			numProcesses: 10000,
+			argsPerProc:  20,
+			fanOut:       []int{255, 255, 255, 255, 255, 255, 255, 255, 255, 255},
+			maxExact:     1000,
+		},
+	}
 
-		// Force GC to measure actual memory retained
-		runtime.GC()
+	for _, tc := range cases {
+		b.Run(tc.name, func(b *testing.B) {
+			indicators := make([]*storage.ProcessIndicator, 0, tc.numProcesses*tc.argsPerProc)
+			for p := range tc.numProcesses {
+				for a := range tc.argsPerProc {
+					indicators = append(indicators, &storage.ProcessIndicator{
+						DeploymentId:  "dep",
+						ContainerName: "container",
+						Signal: &storage.ProcessSignal{
+							ContainerId:  "id",
+							ExecFilePath: fmt.Sprintf("/usr/bin/process%d", p),
+							Args:         fmt.Sprintf("--flag%d value subcommand run", a),
+						},
+					})
+				}
+			}
+
+			b.ReportAllocs()
+			b.ResetTimer()
+			for b.Loop() {
+				filter := NewFilter(tc.maxExact, math.MaxInt, tc.fanOut)
+				for _, pi := range indicators {
+					filter.Add(pi)
+				}
+			}
+		})
 	}
 }
diff --git a/pkg/protocompat/oneof.go b/pkg/protocompat/oneof.go
index 96d043e7249c5..aa148cd07926d 100644
--- a/pkg/protocompat/oneof.go
+++ b/pkg/protocompat/oneof.go
@@ -25,7 +25,7 @@ func GetOneOfTypesByInterface(msgType reflect.Type, oneOfInterfaceType reflect.T
 	oneOfFieldTypes := make([]reflect.Type, 0)
 
 	// Get proto message from Go reflect type.
-	msg, ok := reflect.New(msgType).Interface().(proto.Message)
+	msg, ok := reflect.TypeAssert[proto.Message](reflect.New(msgType))
 	if !ok {
 		return oneOfFieldTypes
 	}
diff --git a/pkg/protoconv/resources/resources.go b/pkg/protoconv/resources/resources.go
index e95a3a12736b7..e03afc7e1a050 100644
--- a/pkg/protoconv/resources/resources.go
+++ b/pkg/protoconv/resources/resources.go
@@ -106,7 +106,7 @@ func SpecToPodTemplateSpec(spec reflect.Value) (v1.PodTemplateSpec, error) {
 	if templateInterface.Type().Kind() == reflect.Pointer && !templateInterface.IsNil() {
 		templateInterface = templateInterface.Elem()
 	}
-	podTemplate, ok := templateInterface.Interface().(v1.PodTemplateSpec)
+	podTemplate, ok := reflect.TypeAssert[v1.PodTemplateSpec](templateInterface)
 	if !ok {
 		return v1.PodTemplateSpec{}, errors.New("not a valid PodTemplateSpec")
 	}
@@ -356,12 +356,12 @@ func (w *DeploymentWrap) populateReplicas(spec reflect.Value, obj interface{}) {
 		return
 	}
 
-	replicasPointer, ok := replicaField.Interface().(*int32)
+	replicasPointer, ok := reflect.TypeAssert[*int32](replicaField)
 	if ok && replicasPointer != nil {
 		w.Deployment.Replicas = int64(*replicasPointer)
 	}
 
-	replicas, ok := replicaField.Interface().(int32)
+	replicas, ok := reflect.TypeAssert[int32](replicaField)
 	if ok {
 		w.Deployment.Replicas = int64(replicas)
 	}
diff --git a/pkg/protoreflect/field.go b/pkg/protoreflect/field.go
index c7a97b95069f1..f06ae1d1ed51e 100644
--- a/pkg/protoreflect/field.go
+++ b/pkg/protoreflect/field.go
@@ -7,7 +7,7 @@ import (
 )
 
 func IsProtoMessage(msgType reflect.Type) bool {
-	_, ok := reflect.New(msgType).Interface().(protocompat.Message)
+	_, ok := reflect.TypeAssert[protocompat.Message](reflect.New(msgType))
 
 	return ok
 }
diff --git a/pkg/queue/queue.go b/pkg/queue/queue.go
index 7ac0192d4b866..09de1f600df09 100644
--- a/pkg/queue/queue.go
+++ b/pkg/queue/queue.go
@@ -26,6 +26,9 @@ type Queue[T comparable] struct {
 	queue          *list.List
 	notEmptySignal concurrency.Signal
 	mutex          sync.Mutex
+	// afterEmptyPull runs after pullWait sees an empty queue and before it waits.
+	// Tests inject a Push in that window; production leaves it nil.
+	afterEmptyPull func()
 }
 
 // OptionFunc provides options for the queue.
@@ -87,41 +90,72 @@ func (q *Queue[T]) Pull() T {
 // PullBlocking will pull an item from the queue, potentially waiting until one is available.
 // In case the waitable signals done, the default value of T will be returned.
 func (q *Queue[T]) PullBlocking(waitable concurrency.Waitable) T {
-	item, ok := q.pull()
-	// In case multiple go routines are pull blocking, we have to ensure that the result of pull
-	// is valid, hence the additional for loop here.
-	for ; !ok; item, ok = q.pull() {
-		select {
-		case <-waitable.Done():
-			return item
-		case <-q.notEmptySignal.Done():
-		}
-	}
+	item, _ := q.pullWait(waitable)
 	return item
 }
 
 // Seq returns a iterator function that yields items from the queue as they become available.
 // The iterator will continue until the provided waitable signals done.
+//
+// Note: Seq checks for cancellation before each pull. If the waitable signals done while items
+// remain in the queue, Seq will exit immediately without consuming them. This differs from
+// PullBlocking, which performs an initial pull before checking whether the waitable is done.
 func (q *Queue[T]) Seq(waitable concurrency.Waitable) func(yield func(T) bool) {
 	return func(yield func(T) bool) {
 		for {
+			// Ensure responsive cancellation even when queue has items
 			select {
 			case <-waitable.Done():
 				return
-			case <-q.notEmptySignal.Done():
-				if item, ok := q.pull(); ok && !yield(item) {
-					return
-				}
+			default:
+			}
+
+			item, ok := q.pullWait(waitable)
+			if !ok {
+				return
+			}
+
+			if !yield(item) {
+				return
 			}
 		}
 	}
 }
 
+// pullWait waits for an item to become available in the queue, blocking until
+// either an item is retrieved or the waitable signals done.
+// Returns the item and true if retrieved, or zero value and false if cancelled.
+func (q *Queue[T]) pullWait(waitable concurrency.Waitable) (T, bool) {
+	item, ok := q.pull()
+	// Keep retrying until we actually get an item or the waitable signals done.
+	// This prevents lost wakeup: if we're signaled but another consumer
+	// takes the item before we pull, we must continue waiting.
+	for !ok {
+		if q.afterEmptyPull != nil {
+			q.afterEmptyPull()
+		}
+		select {
+		case <-waitable.Done():
+			var nilT T
+			return nilT, false
+		case <-q.notEmptySignal.Done():
+		}
+		item, ok = q.pull()
+	}
+	return item, true
+}
+
 func (q *Queue[T]) innerPull() (T, bool) {
 	q.mutex.Lock()
 	defer q.mutex.Unlock()
 
 	if q.queue.Len() == 0 {
+		// Reset signal while observing empty queue under lock.
+		// This prevents the race where a Push signals after we check
+		// but before we wait - the signal and our observation are atomic.
+		if q.notEmptySignal.IsDone() {
+			q.notEmptySignal.Reset()
+		}
 		var nilT T
 		return nilT, false
 	}
@@ -152,6 +186,10 @@ func (q *Queue[T]) innerPush(item T) bool {
 	}
 
 	q.queue.PushBack(item)
+	// Signal while holding the lock, atomically with PushBack.
+	// This prevents the race where a consumer observes empty and resets
+	// the signal after we've added the item but before we signal.
+	q.notEmptySignal.Signal()
 	return true
 }
 
@@ -166,13 +204,37 @@ func (q *Queue[T]) Push(item T) {
 		return
 	}
 
-	q.notEmptySignal.Signal()
 	if q.counterMetric != nil {
 		// Using `WithLabelValues` instead of `With` to avoid extra memory allocations.
 		q.counterMetric.WithLabelValues(metrics.Add.String()).Inc()
 	}
 }
 
+// PullWithPred removes and returns the first element for which pred returns
+// true, scanning front-to-back. Returns the removed item and true, or the nil
+// value of T and false if no element matched.
+func (q *Queue[T]) PullWithPred(pred func(T) bool) (T, bool) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for e := q.queue.Front(); e != nil; e = e.Next() {
+		item := e.Value.(T)
+		if pred(item) {
+			q.queue.Remove(e)
+			if q.queue.Len() == 0 {
+				q.notEmptySignal.Reset()
+			}
+			if q.counterMetric != nil {
+				q.counterMetric.WithLabelValues(metrics.Remove.String()).Inc()
+			}
+			return item, true
+		}
+	}
+
+	var nilT T
+	return nilT, false
+}
+
 // Len returns the number of elements in the queue.
 func (q *Queue[T]) Len() int {
 	q.mutex.Lock()
diff --git a/pkg/queue/queue_test.go b/pkg/queue/queue_test.go
index 2a6663d89a978..cb6d3b974bf81 100644
--- a/pkg/queue/queue_test.go
+++ b/pkg/queue/queue_test.go
@@ -3,6 +3,7 @@ package queue
 import (
 	"context"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/stackrox/rox/pkg/sync"
@@ -41,6 +42,39 @@ func TestQueue(t *testing.T) {
 	assert.Nil(t, q.PullBlocking(context.Background()))
 }
 
+func TestPullWithPred(t *testing.T) {
+	q := NewQueue[int]()
+	q.Push(1)
+	q.Push(2)
+	q.Push(3)
+	q.Push(4)
+
+	item, ok := q.PullWithPred(func(v int) bool { return v%2 == 0 })
+	assert.True(t, ok)
+	assert.Equal(t, 2, item)
+	assert.Equal(t, 3, q.Len())
+
+	item, ok = q.PullWithPred(func(v int) bool { return v > 3 })
+	assert.True(t, ok)
+	assert.Equal(t, 4, item)
+	assert.Equal(t, 2, q.Len())
+
+	_, ok = q.PullWithPred(func(v int) bool { return v > 100 })
+	assert.False(t, ok)
+	assert.Equal(t, 2, q.Len())
+
+	// Remaining items are 1, 3
+	assert.Equal(t, 1, q.Pull())
+	assert.Equal(t, 3, q.Pull())
+	assert.Equal(t, 0, q.Len())
+}
+
+func TestPullWithPredEmptyQueue(t *testing.T) {
+	q := NewQueue[int]()
+	_, ok := q.PullWithPred(func(v int) bool { return true })
+	assert.False(t, ok)
+}
+
 func TestQueueSeq(t *testing.T) {
 	t.Run("Basic Iteration", func(t *testing.T) {
 		q := NewQueue[int]()
@@ -154,4 +188,348 @@ func TestQueueSeq(t *testing.T) {
 		assert.ElementsMatch(t, expectedItems, items)
 
 	})
+
+	t.Run("Seq Empty Queue No Spin Loop", func(t *testing.T) {
+		// This test verifies the fix for the spin-loop bug where Seq() would
+		// continuously loop without blocking when the queue was empty.
+		// Under synctest's deterministic execution, a spin-loop causes timeouts.
+		synctest.Test(t, func(t *testing.T) {
+			q := NewQueue[int]()
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			itemReceived := make(chan int, 1)
+			iterationStarted := make(chan struct{})
+
+			// Start Seq() iteration on empty queue
+			go func() {
+				close(iterationStarted)
+				for item := range q.Seq(ctx) {
+					itemReceived <- item
+					return
+				}
+			}()
+
+			<-iterationStarted
+
+			// Wait to ensure the goroutine is properly blocked (not spinning)
+			// In the buggy version, this would cause synctest to detect a spin-loop
+			synctest.Wait()
+
+			// Now add an item - it should be received
+			q.Push(42)
+			synctest.Wait()
+
+			select {
+			case item := <-itemReceived:
+				assert.Equal(t, 42, item)
+			default:
+				t.Fatal("expected to receive item from queue")
+			}
+		})
+	})
+
+	t.Run("Seq Empty Pull After Signal", func(t *testing.T) {
+		// This test verifies that Seq() properly re-blocks when a signal occurs
+		// but another consumer removes the item before Seq can pull it.
+		// Without proper blocking, Seq would spin-loop after the empty pull.
+		testEmptyPullAfterSignal(t, "Seq", func(q *Queue[int], ctx context.Context, itemReceived chan int, started chan struct{}) {
+			go func() {
+				close(started)
+				for item := range q.Seq(ctx) {
+					itemReceived <- item
+					return
+				}
+			}()
+		})
+	})
+
+	t.Run("Seq Cancellation With Queued Items", func(t *testing.T) {
+		// This test verifies that Seq() checks waitable.Done() before every pull,
+		// not just when the queue is empty. If items are already queued and the
+		// waitable is cancelled, the iterator should exit immediately without
+		// consuming any items.
+		synctest.Test(t, func(t *testing.T) {
+			q := NewQueue[int]()
+
+			// Pre-populate queue with items
+			q.Push(1)
+			q.Push(2)
+			q.Push(3)
+
+			// Create already-cancelled context
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+
+			// Verify context is cancelled before iteration starts
+			select {
+			case <-ctx.Done():
+				// Expected: context is already done
+			default:
+				t.Fatal("context should be cancelled before iteration")
+			}
+
+			// Attempt to iterate - should exit immediately without consuming items
+			itemsConsumed := 0
+			for range q.Seq(ctx) {
+				itemsConsumed++
+			}
+
+			// Assertions
+			assert.Equal(t, 0, itemsConsumed, "should not consume any items when cancelled")
+			assert.Equal(t, 3, q.Len(), "all items should remain in queue")
+		})
+	})
+
+	t.Run("Seq Lost Wakeup With Competing Consumers", func(t *testing.T) {
+		// This test reproduces the lost wakeup bug with competing consumers.
+		// Scenario: Multiple PullBlocking consumers compete with a Seq consumer.
+		// When an item is pushed:
+		// 1. Signal fires
+		// 2. PullBlocking consumer wakes and pulls item (signal resets if queue empty)
+		// 3. Seq consumer wakes but queue is empty, should re-wait
+		// 4. Bug: Seq doesn't re-wait, it returns to top of loop and checks empty again
+		//
+		// With many iterations, we should see Seq miss items that were stolen.
+		synctest.Test(t, func(t *testing.T) {
+			q := NewQueue[int]()
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			seqReceived := make(chan int, 100)
+			pullReceived := make(chan int, 100)
+			pullDone := make(chan struct{})
+
+			const numItems = 10
+
+			// Start Seq() consumer
+			go func() {
+				for item := range q.Seq(ctx) {
+					seqReceived <- item
+				}
+			}()
+
+			// Start competing PullBlocking consumer
+			go func() {
+				defer close(pullDone)
+				for {
+					item := q.PullBlocking(ctx)
+					select {
+					case <-ctx.Done():
+						return
+					default:
+						pullReceived <- item
+					}
+				}
+			}()
+
+			synctest.Wait() // Let both consumers start and block
+
+			// Push items one at a time
+			for i := 1; i <= numItems; i++ {
+				q.Push(i)
+				synctest.Wait() // Let consumers race for the item
+			}
+
+			cancel() // Stop consumers
+			synctest.Wait()
+
+			<-pullDone
+			close(seqReceived)
+			close(pullReceived)
+
+			seqItems := []int{}
+			for item := range seqReceived {
+				seqItems = append(seqItems, item)
+			}
+
+			pullItems := []int{}
+			for item := range pullReceived {
+				pullItems = append(pullItems, item)
+			}
+
+			// Both consumers should collectively receive all items
+			allItems := append(seqItems, pullItems...)
+			assert.Equal(t, numItems, len(allItems), "Total items received should equal items pushed")
+
+			// Verify all items were received exactly once.
+			assert.ElementsMatch(t, itemsFromRange(numItems), allItems)
+		})
+	})
+
+	t.Run("Seq Stale Not Empty Signal Does Not Spin", func(t *testing.T) {
+		testStaleNotEmptySignalDoesNotSpin(t, func(q *Queue[int], ctx context.Context) int {
+			for item := range q.Seq(ctx) {
+				return item
+			}
+			return 0
+		})
+	})
+
+	t.Run("Seq Push After Empty Pull Does Not Lose Item", func(t *testing.T) {
+		testPushAfterEmptyPullDoesNotLoseItem(t, func(q *Queue[int], ctx context.Context) int {
+			for item := range q.Seq(ctx) {
+				return item
+			}
+			return 0
+		})
+	})
+}
+
+func TestQueuePullBlocking(t *testing.T) {
+	t.Run("PullBlocking Empty Pull After Signal", func(t *testing.T) {
+		// This test verifies that PullBlocking() properly re-blocks when a signal
+		// occurs but another consumer removes the item before PullBlocking can pull it.
+		// Without proper blocking, PullBlocking would spin-loop after the empty pull.
+		testEmptyPullAfterSignal(t, "PullBlocking", func(q *Queue[int], ctx context.Context, itemReceived chan int, started chan struct{}) {
+			go func() {
+				close(started)
+				item := q.PullBlocking(ctx)
+				itemReceived <- item
+			}()
+		})
+	})
+
+	t.Run("PullBlocking Cancellation", func(t *testing.T) {
+		// This test verifies that PullBlocking() checks waitable.Done()
+		// before blocking, not just after. If the waitable is already cancelled,
+		// PullBlocking should return immediately.
+		testCancellationWithEmptyQueue(t, func(ctx context.Context, q *Queue[int]) int {
+			return q.PullBlocking(ctx)
+		})
+	})
+
+	t.Run("PullBlocking Stale Not Empty Signal Does Not Spin", func(t *testing.T) {
+		testStaleNotEmptySignalDoesNotSpin(t, func(q *Queue[int], ctx context.Context) int {
+			return q.PullBlocking(ctx)
+		})
+	})
+
+	t.Run("PullBlocking Push After Empty Pull Does Not Lose Item", func(t *testing.T) {
+		testPushAfterEmptyPullDoesNotLoseItem(t, func(q *Queue[int], ctx context.Context) int {
+			return q.PullBlocking(ctx)
+		})
+	})
+}
+
+// testEmptyPullAfterSignal is a shared test helper that verifies a consumer properly
+// re-blocks when signaled but another consumer steals the item. This prevents spin-loops.
+func testEmptyPullAfterSignal(t *testing.T, consumerName string, startConsumer func(*Queue[int], context.Context, chan int, chan struct{})) {
+	synctest.Test(t, func(t *testing.T) {
+		q := NewQueue[int]()
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		itemReceived := make(chan int, 1)
+		consumerStarted := make(chan struct{})
+
+		// Start consumer on empty queue. The started channel is closed before the
+		// first pull, so synctest.Wait below establishes that it is waiting.
+		startConsumer(q, ctx, itemReceived, consumerStarted)
+
+		<-consumerStarted
+		synctest.Wait()
+
+		// Simulate waking after another consumer has already taken the item.
+		// Using Push followed by Pull would race with the waiting consumer.
+		q.notEmptySignal.Signal()
+		synctest.Wait()
+
+		q.Push(42)
+		synctest.Wait()
+		select {
+		case item := <-itemReceived:
+			assert.Equal(t, 42, item)
+		default:
+			t.Fatal("expected to receive item from queue")
+		}
+	})
+}
+
+// testCancellationWithEmptyQueue is a shared test helper that verifies a consumer
+// returns immediately when the waitable is already done.
+func testCancellationWithEmptyQueue(t *testing.T, consume func(context.Context, *Queue[int]) int) {
+	synctest.Test(t, func(t *testing.T) {
+		q := NewQueue[int]()
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+
+		select {
+		case <-ctx.Done():
+		default:
+			t.Fatal("context should be cancelled")
+		}
+
+		item := consume(ctx, q)
+		assert.Equal(t, 0, item, "should return zero value when cancelled")
+	})
+}
+
+// testStaleNotEmptySignalDoesNotSpin covers an empty queue whose notEmptySignal is
+// already triggered. Waiters must clear that latch and block; otherwise synctest.Wait hangs.
+func testStaleNotEmptySignalDoesNotSpin(t *testing.T, consume func(*Queue[int], context.Context) int) {
+	synctest.Test(t, func(t *testing.T) {
+		q := NewQueue[int]()
+		q.notEmptySignal.Signal()
+
+		ctx, cancel := context.WithCancel(t.Context())
+		defer cancel()
+
+		got := make(chan int, 1)
+		started := make(chan struct{})
+		go func() {
+			close(started)
+			got <- consume(q, ctx)
+		}()
+		<-started
+		synctest.Wait()
+		q.Push(7)
+		synctest.Wait()
+		select {
+		case item := <-got:
+			assert.Equal(t, 7, item)
+		default:
+			t.Fatal("consumer should have received the item after blocking")
+		}
+	})
+}
+
+// testPushAfterEmptyPullDoesNotLoseItem covers the window after pullWait observes
+// an empty queue and before it enters select. synctest cannot preempt there, so
+// afterEmptyPull injects the Push.
+func testPushAfterEmptyPullDoesNotLoseItem(t *testing.T, consume func(*Queue[int], context.Context) int) {
+	synctest.Test(t, func(t *testing.T) {
+		q := NewQueue[int]()
+		q.afterEmptyPull = func() {
+			q.Push(7)
+			q.afterEmptyPull = nil
+		}
+
+		ctx, cancel := context.WithCancel(t.Context())
+		defer cancel()
+
+		got := make(chan int, 1)
+		started := make(chan struct{})
+		go func() {
+			close(started)
+			got <- consume(q, ctx)
+		}()
+		<-started
+		synctest.Wait()
+
+		select {
+		case item := <-got:
+			assert.Equal(t, 7, item)
+		default:
+			t.Fatal("Push after empty pull was lost; item is queued but the waiter is blocked")
+		}
+	})
+}
+
+func itemsFromRange(count int) []int {
+	items := make([]int, count)
+	for i := range items {
+		items[i] = i + 1
+	}
+	return items
 }
diff --git a/pkg/registries/docker/docker_integration_test.go b/pkg/registries/docker/docker_integration_test.go
index 119b6ce2fa1e2..4c7d2c8a0048d 100644
--- a/pkg/registries/docker/docker_integration_test.go
+++ b/pkg/registries/docker/docker_integration_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/registries/types"
+	"github.com/stackrox/rox/pkg/retry"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -33,8 +34,16 @@ func TestGetMetadataIntegration(t *testing.T) {
 			Tag:      "1.14.8",
 		},
 	}
-	_, err = dockerHubClient.Metadata(&image)
-	require.Nil(t, err)
+	err = retry.WithRetry(func() error {
+		_, retryErr := dockerHubClient.Metadata(&image)
+		return retryErr
+	}, retry.Tries(3),
+		retry.WithExponentialBackoff(),
+		retry.OnFailedAttempts(func(err error) {
+			t.Logf("retrying: %v", err)
+		}),
+	)
+	require.NoError(t, err)
 
 	// Make sure that request and histogram metrics but no timeouts have been recorded.
 	assert.NotEmpty(t, metricsHandler.TestCollectRequestCounter(t))
@@ -64,7 +73,15 @@ func TestOCIImageIndexManifest(t *testing.T) {
 		},
 	}
 
-	_, err = gcrClient.Metadata(&image)
+	err = retry.WithRetry(func() error {
+		_, retryErr := gcrClient.Metadata(&image)
+		return retryErr
+	}, retry.Tries(3),
+		retry.WithExponentialBackoff(),
+		retry.OnFailedAttempts(func(err error) {
+			t.Logf("retrying: %v", err)
+		}),
+	)
 	require.NoError(t, err)
 }
 
@@ -90,6 +107,14 @@ func TestOCIImageIndexManifestWithoutManifestCall(t *testing.T) {
 		},
 	}
 
-	_, err = gcrClient.Metadata(&image)
+	err = retry.WithRetry(func() error {
+		_, retryErr := gcrClient.Metadata(&image)
+		return retryErr
+	}, retry.Tries(3),
+		retry.WithExponentialBackoff(),
+		retry.OnFailedAttempts(func(err error) {
+			t.Logf("retrying: %v", err)
+		}),
+	)
 	require.NoError(t, err)
 }
diff --git a/pkg/registries/quay/quay_integration_test.go b/pkg/registries/quay/quay_integration_test.go
index 3b8d66b75cc08..db4ed50111c56 100644
--- a/pkg/registries/quay/quay_integration_test.go
+++ b/pkg/registries/quay/quay_integration_test.go
@@ -3,10 +3,10 @@
 package quay
 
 import (
-	"strings"
 	"testing"
 
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/retry"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -30,15 +30,13 @@ func TestQuay(t *testing.T) {
 
 	q, err := newRegistry(integration, false, nil)
 	assert.NoError(t, err)
-	assert.NoError(t, filterOkErrors(q.Test()))
-}
-
-func filterOkErrors(err error) error {
-	if err != nil &&
-		(strings.Contains(err.Error(), "EOF") ||
-			strings.Contains(err.Error(), "status=502")) {
-		// Ignore failures that can indicate quay.io outage
-		return nil
-	}
-	return err
+	err = retry.WithRetry(func() error {
+		return q.Test()
+	}, retry.Tries(3),
+		retry.WithExponentialBackoff(),
+		retry.OnFailedAttempts(func(err error) {
+			t.Logf("retrying: %v", err)
+		}),
+	)
+	assert.NoError(t, err)
 }
diff --git a/pkg/registrymirror/store_test.go b/pkg/registrymirror/store_test.go
index 1d31e682108ff..705603c959772 100644
--- a/pkg/registrymirror/store_test.go
+++ b/pkg/registrymirror/store_test.go
@@ -172,6 +172,14 @@ func TestDataRaceAtCleanup(t *testing.T) {
 	s.Cleanup()
 	doneSignal.Signal()
 	wg.Wait()
+
+	// The stopped writers may still have a delayed updateConfigNow scheduled.
+	// One more update cancels those pending writes and lets us wait for the pipeline to flush,
+	// so no background write recreates the file after Cleanup().
+	source := icspA.Spec.RepositoryDigestMirrors[0].Source
+	require.NoError(t, s.UpsertImageContentSourcePolicy(icspA))
+	require.Eventually(t, func() bool { return fileContains(path, source) }, 5*time.Second, 10*time.Millisecond)
+	s.Cleanup()
 }
 
 func TestCleanup(t *testing.T) {
diff --git a/pkg/renderer/images.go b/pkg/renderer/images.go
index aa80367c25dd6..22735a127cf12 100644
--- a/pkg/renderer/images.go
+++ b/pkg/renderer/images.go
@@ -88,10 +88,6 @@ func configureImageOverrides(c *Config, imageFlavor defaults.ImageFlavor) {
 	imageOverrides["Main"] = mainOverrides
 	imageOverrides["CentralDB"] = ComputeImageOverrides(c.K8sConfig.CentralDBImage, registry, imageFlavor.CentralDBImageName,
 		imageFlavor.CentralDBImageTag)
-	imageOverrides["Scanner"] = ComputeImageOverrides(c.K8sConfig.ScannerImage, registry, imageFlavor.ScannerImageName,
-		imageFlavor.ScannerImageTag)
-	imageOverrides["ScannerDB"] = ComputeImageOverrides(c.K8sConfig.ScannerDBImage, registry, imageFlavor.ScannerDBImageName,
-		imageFlavor.ScannerImageTag)
 	imageOverrides["ScannerV4"] = ComputeImageOverrides(c.K8sConfig.ScannerV4Image, registry, imageFlavor.ScannerV4ImageName,
 		imageFlavor.ScannerV4ImageTag)
 	imageOverrides["ScannerV4DB"] = ComputeImageOverrides(c.K8sConfig.ScannerV4DBImage, registry, imageFlavor.ScannerV4DBImageName,
diff --git a/pkg/renderer/images_test.go b/pkg/renderer/images_test.go
index 62bf68186da02..ae15153d017e7 100644
--- a/pkg/renderer/images_test.go
+++ b/pkg/renderer/images_test.go
@@ -167,16 +167,12 @@ func TestConfigureImageOverrides(t *testing.T) {
 		configValues                 CommonConfig
 		expectedMainRegistry         string
 		expectedMainOverrides        map[string]string
-		expectedScannerOverrides     map[string]string
-		expectedScannerDBOverrides   map[string]string
 		expectedScannerV4Overrides   map[string]string
 		expectedScannerV4DBOverrides map[string]string
 	}{
 		"Override Main Registry": {
 			configValues: CommonConfig{
 				MainImage:        "quay.io/rhacs/main",
-				ScannerImage:     testFlavor.ScannerImage(),
-				ScannerDBImage:   testFlavor.ScannerDBImage(),
 				ScannerV4Image:   testFlavor.ScannerV4Image(),
 				ScannerV4DBImage: testFlavor.ScannerV4DBImage(),
 			},
@@ -184,12 +180,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 			expectedMainOverrides: map[string]string{
 				"Tag": "latest",
 			},
-			expectedScannerOverrides: map[string]string{
-				"Registry": "test.registry",
-			},
-			expectedScannerDBOverrides: map[string]string{
-				"Registry": "test.registry",
-			},
 			expectedScannerV4Overrides: map[string]string{
 				"Registry": "test.registry",
 			},
@@ -200,8 +190,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Don't override main registry": {
 			configValues: CommonConfig{
 				MainImage:        testFlavor.MainImage(),
-				ScannerImage:     testFlavor.ScannerImage(),
-				ScannerDBImage:   testFlavor.ScannerDBImage(),
 				ScannerV4Image:   testFlavor.ScannerV4Image(),
 				ScannerV4DBImage: testFlavor.ScannerV4DBImage(),
 			},
@@ -209,8 +197,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Override Main sub-repo": {
 			configValues: CommonConfig{
 				MainImage:        "test.registry/sub-repo/main",
-				ScannerImage:     testFlavor.ScannerImage(),
-				ScannerDBImage:   testFlavor.ScannerDBImage(),
 				ScannerV4Image:   testFlavor.ScannerV4Image(),
 				ScannerV4DBImage: testFlavor.ScannerV4DBImage(),
 			},
@@ -218,12 +204,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 			expectedMainOverrides: map[string]string{
 				"Tag": "latest",
 			},
-			expectedScannerOverrides: map[string]string{
-				"Registry": "test.registry",
-			},
-			expectedScannerDBOverrides: map[string]string{
-				"Registry": "test.registry",
-			},
 			expectedScannerV4Overrides: map[string]string{
 				"Registry": "test.registry",
 			},
@@ -234,8 +214,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Override Main sub-repo and name": {
 			configValues: CommonConfig{
 				MainImage:        "test.registry/sub-repo/my-main",
-				ScannerImage:     testFlavor.ScannerImage(),
-				ScannerDBImage:   testFlavor.ScannerDBImage(),
 				ScannerV4Image:   testFlavor.ScannerV4Image(),
 				ScannerV4DBImage: testFlavor.ScannerV4DBImage(),
 			},
@@ -248,15 +226,9 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Override Scanner registry": {
 			configValues: CommonConfig{
 				MainImage:        testFlavor.MainImage(),
-				ScannerImage:     "quay.io/rhacs/scanner",
-				ScannerDBImage:   testFlavor.ScannerDBImage(),
 				ScannerV4Image:   "quay.io/rhacs/scanner-v4",
 				ScannerV4DBImage: testFlavor.ScannerV4DBImage(),
 			},
-			expectedScannerOverrides: map[string]string{
-				"Registry": "quay.io/rhacs",
-				"Tag":      "latest",
-			},
 			expectedScannerV4Overrides: map[string]string{
 				"Registry": "quay.io/rhacs",
 				"Tag":      "latest",
@@ -266,15 +238,9 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Override ScannerDB registry": {
 			configValues: CommonConfig{
 				MainImage:        testFlavor.MainImage(),
-				ScannerImage:     testFlavor.ScannerImage(),
-				ScannerDBImage:   "quay.io/rhacs/scanner-db",
 				ScannerV4Image:   testFlavor.ScannerV4Image(),
 				ScannerV4DBImage: "quay.io/rhacs/scanner-v4-db",
 			},
-			expectedScannerDBOverrides: map[string]string{
-				"Registry": "quay.io/rhacs",
-				"Tag":      "latest",
-			},
 			expectedScannerV4DBOverrides: map[string]string{
 				"Registry": "quay.io/rhacs",
 				"Tag":      "latest",
@@ -283,8 +249,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Override Main and Scanner registries": {
 			configValues: CommonConfig{
 				MainImage:        "quay.io/rhacs/main",
-				ScannerImage:     "stackrox.io/scanner",
-				ScannerDBImage:   testFlavor.ScannerDBImage(),
 				ScannerV4Image:   "stackrox.io/scanner-v4",
 				ScannerV4DBImage: testFlavor.ScannerV4DBImage(),
 			},
@@ -292,13 +256,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 			expectedMainOverrides: map[string]string{
 				"Tag": "latest",
 			},
-			expectedScannerOverrides: map[string]string{
-				"Registry": "stackrox.io",
-				"Tag":      "latest",
-			},
-			expectedScannerDBOverrides: map[string]string{
-				"Registry": "test.registry",
-			},
 			expectedScannerV4Overrides: map[string]string{
 				"Registry": "stackrox.io",
 				"Tag":      "latest",
@@ -310,8 +267,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Override Main and ScannerDB registries": {
 			configValues: CommonConfig{
 				MainImage:        "quay.io/rhacs/main",
-				ScannerImage:     testFlavor.ScannerImage(),
-				ScannerDBImage:   "stackrox.io/scanner-db",
 				ScannerV4Image:   testFlavor.ScannerV4Image(),
 				ScannerV4DBImage: "stackrox.io/scanner-v4-db",
 			},
@@ -319,13 +274,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 			expectedMainOverrides: map[string]string{
 				"Tag": "latest",
 			},
-			expectedScannerOverrides: map[string]string{
-				"Registry": "test.registry",
-			},
-			expectedScannerDBOverrides: map[string]string{
-				"Registry": "stackrox.io",
-				"Tag":      "latest",
-			},
 			expectedScannerV4Overrides: map[string]string{
 				"Registry": "test.registry",
 			},
@@ -337,8 +285,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 		"Override Main, Scanner and ScannerDB with the same registries": {
 			configValues: CommonConfig{
 				MainImage:        "quay.io/rhacs/main",
-				ScannerImage:     "quay.io/rhacs/scanner",
-				ScannerDBImage:   "quay.io/rhacs/scanner-db",
 				ScannerV4Image:   "quay.io/rhacs/scanner-v4",
 				ScannerV4DBImage: "quay.io/rhacs/scanner-v4-db",
 			},
@@ -346,12 +292,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 			expectedMainOverrides: map[string]string{
 				"Tag": "latest",
 			},
-			expectedScannerOverrides: map[string]string{
-				"Tag": "latest",
-			},
-			expectedScannerDBOverrides: map[string]string{
-				"Tag": "latest",
-			},
 			expectedScannerV4Overrides: map[string]string{
 				"Tag": "latest",
 			},
@@ -383,16 +323,6 @@ func TestConfigureImageOverrides(t *testing.T) {
 			} else {
 				assert.Len(t, config.K8sConfig.ImageOverrides["Main"], 0, "should have no keys in Main map")
 			}
-			if c.expectedScannerOverrides != nil {
-				assert.Equal(t, c.expectedScannerOverrides, config.K8sConfig.ImageOverrides["Scanner"].(map[string]string))
-			} else {
-				assert.Len(t, config.K8sConfig.ImageOverrides["Scanner"], 0, "should have no keys in Scanner map")
-			}
-			if c.expectedScannerDBOverrides != nil {
-				assert.Equal(t, c.expectedScannerDBOverrides, config.K8sConfig.ImageOverrides["ScannerDB"].(map[string]string))
-			} else {
-				assert.Len(t, config.K8sConfig.ImageOverrides["ScannerDB"], 0, "should have no keys in ScannerDB map")
-			}
 			if c.expectedScannerV4Overrides != nil {
 				assert.Equal(t, c.expectedScannerV4Overrides, config.K8sConfig.ImageOverrides["ScannerV4"].(map[string]string))
 			} else {
diff --git a/pkg/renderer/kubernetes.go b/pkg/renderer/kubernetes.go
index b5927c398fc02..0470cb8217c48 100644
--- a/pkg/renderer/kubernetes.go
+++ b/pkg/renderer/kubernetes.go
@@ -32,12 +32,14 @@ const (
 	// renderAll renders all objects (central+scanner).
 	renderAll mode = iota
 	// scannerOnly renders only the scanner.
+	// TODO(ROX-36705): remove after full scanner v2 cleanup.
 	scannerOnly
 	// centralTLSOnly renders only the central tls secret.
 	centralTLSOnly
 	// centralDBTLSOnly renders only the central-db tls secret
 	centralDBTLSOnly
 	// scannerTLSOnly renders only the scanner tls secret
+	// TODO(ROX-36705): remove after full scanner v2 cleanup.
 	scannerTLSOnly
 	// centralDBOnly renders only the central db
 	centralDBOnly
@@ -53,12 +55,6 @@ func postProcessConfig(c *Config, mode mode, imageFlavor defaults.ImageFlavor) e
 	if c.K8sConfig.CentralDBImage == "" {
 		c.K8sConfig.CentralDBImage = imageFlavor.CentralDBImage()
 	}
-	if c.K8sConfig.ScannerImage == "" {
-		c.K8sConfig.ScannerImage = imageFlavor.ScannerImage()
-	}
-	if c.K8sConfig.ScannerDBImage == "" {
-		c.K8sConfig.ScannerDBImage = imageFlavor.ScannerDBImage()
-	}
 	if c.K8sConfig.ScannerV4Image == "" {
 		c.K8sConfig.ScannerV4Image = imageFlavor.ScannerV4Image()
 	}
@@ -99,16 +95,6 @@ func postProcessConfig(c *Config, mode mode, imageFlavor defaults.ImageFlavor) e
 		}
 	}
 
-	c.K8sConfig.ScannerRegistry, err = kubernetesPkg.GetResolvedRegistry(c.K8sConfig.ScannerImage)
-	if err != nil {
-		return err
-	}
-	if c.K8sConfig.Registry != c.K8sConfig.ScannerRegistry {
-		c.K8sConfig.ScannerSecretName = "stackrox-scanner"
-	} else {
-		c.K8sConfig.ScannerSecretName = "stackrox"
-	}
-
 	if mode == renderAll {
 		if err := injectImageTags(c); err != nil {
 			return err
diff --git a/pkg/renderer/kubernetes_helm_test.go b/pkg/renderer/kubernetes_helm_test.go
index 1b5d3a2b78d76..cfc45da401f39 100644
--- a/pkg/renderer/kubernetes_helm_test.go
+++ b/pkg/renderer/kubernetes_helm_test.go
@@ -54,9 +54,7 @@ func getDefaultMetaValues(t *testing.T) *charts.MetaValues {
 		FactImageRemote: "fact",
 		FactImageTag:    "0.1.0",
 
-		ScannerSlimImageRemote: "scanner",
-		ScannerImageTag:        "3.0.11-slim",
-		ScannerV4ImageTag:      "4.4.0.x-92-g9e8a347ffe",
+		ScannerV4ImageTag: "4.4.0.x-92-g9e8a347ffe",
 
 		CollectionMethod: "CORE_BPF",
 
diff --git a/pkg/renderer/kubernetes_test.go b/pkg/renderer/kubernetes_test.go
index 1cbbdf2da34f7..c3b6b6a13c6b8 100644
--- a/pkg/renderer/kubernetes_test.go
+++ b/pkg/renderer/kubernetes_test.go
@@ -21,7 +21,6 @@ func getBaseConfig() Config {
 		K8sConfig: &K8sConfig{
 			CommonConfig: CommonConfig{
 				MainImage:      "stackrox/main:2.2.11.0-57-g392c0f5bed-dirty",
-				ScannerImage:   "stackrox.io/scanner:0.4.2",
 				ScannerV4Image: "stackrox.io/scanner-v4:0.5.0",
 			},
 		},
@@ -136,9 +135,9 @@ func (suite *renderSuite) TestRenderFailsForOpenShift3() {
 
 func (suite *renderSuite) TestRenderWithBadImage() {
 	conf := getBaseConfig()
-	conf.K8sConfig.ScannerImage = "invalid-image#!@$"
+	conf.K8sConfig.MainImage = "invalid-image#!@$"
 	_, err := Render(conf, suite.testFlavor)
-	suite.Error(err)
+	suite.ErrorContains(err, "error parsing image name")
 }
 
 func (suite *renderSuite) TestRenderWithBadV4Image() {
diff --git a/pkg/renderer/readme.go b/pkg/renderer/readme.go
index 8d9236370ef00..061c12dd2df12 100644
--- a/pkg/renderer/readme.go
+++ b/pkg/renderer/readme.go
@@ -44,11 +44,7 @@ the login page, and log in with username "admin" and the password found in the
 `
 
 	kubectlScannerTemplate = `
-  - Deploy Scanner components
-    - Run scanner/scripts/setup.sh
-    - Run {{.K8sConfig.Command}} create -R -f scanner
-
-  - Optional: Deploy Scanner V4 components
+  - Deploy Scanner V4 components
     - Run scanner-v4/scripts/setup.sh
     - Run {{.K8sConfig.Command}} create -R -f scanner-v4
 `
diff --git a/pkg/renderer/readme_test.go b/pkg/renderer/readme_test.go
index b8fd82fc1de0a..b426430fbe935 100644
--- a/pkg/renderer/readme_test.go
+++ b/pkg/renderer/readme_test.go
@@ -25,7 +25,7 @@ func TestReadme(t *testing.T) {
 			deploymentFormat: v1.DeploymentFormat_KUBECTL,
 			mode:             renderAll,
 
-			mustContain:                           []string{"kubectl create -R -f scanner", "kubectl create -R -f scanner-v4", "kubectl create -R -f central"},
+			mustContain:                           []string{"kubectl create -R -f scanner-v4", "kubectl create -R -f central"},
 			mustNotContain:                        []string{"kubectl create -R -f monitoring", "helm install"},
 			mustContainInstructionSuffixAndPrefix: true,
 		},
@@ -34,7 +34,7 @@ func TestReadme(t *testing.T) {
 			deploymentFormat: v1.DeploymentFormat_KUBECTL,
 			mode:             scannerOnly,
 
-			mustContain:    []string{"kubectl create -R -f scanner", "kubectl create -R -f scanner-v4"},
+			mustContain:    []string{"kubectl create -R -f scanner-v4"},
 			mustNotContain: []string{"kubectl create -R -f central", "kubectl create -R -f monitoring", "helm install"},
 		},
 		{
@@ -42,8 +42,8 @@ func TestReadme(t *testing.T) {
 			deploymentFormat: v1.DeploymentFormat_KUBECTL,
 			mode:             scannerOnly,
 
-			mustContain:    []string{"oc create -R -f scanner", "oc create -R -f scanner-v4"},
-			mustNotContain: []string{"oc create -R -f central", "oc create -R -f monitoring", "helm install", "oc create -R -f scannerv2"},
+			mustContain:    []string{"oc create -R -f scanner-v4"},
+			mustNotContain: []string{"oc create -R -f central", "oc create -R -f monitoring", "helm install"},
 		},
 		{
 			orchCommand:      "kubectl",
diff --git a/pkg/renderer/render_new.go b/pkg/renderer/render_new.go
index 264b3c5831f6a..515c553cf3be7 100644
--- a/pkg/renderer/render_new.go
+++ b/pkg/renderer/render_new.go
@@ -13,7 +13,6 @@ import (
 	"github.com/stackrox/rox/pkg/zip"
 	"helm.sh/helm/v3/pkg/chart/loader"
 	"helm.sh/helm/v3/pkg/chartutil"
-	"sigs.k8s.io/yaml"
 )
 
 var (
@@ -24,7 +23,6 @@ var (
 	}
 
 	kubectlScannerScriptMap = FileNameMap{
-		"common/setup-scanner.sh":    "scanner/scripts/setup.sh",
 		"common/setup-scanner-v4.sh": "scanner-v4/scripts/setup.sh",
 	}
 
@@ -71,8 +69,6 @@ func renderHelmChart(chartFiles []*loader.BufferedFile, mode mode, valuesFiles [
 		subDir := "central"
 		if strings.HasPrefix(path.Base(fileName), "02-scanner-v4-") {
 			subDir = "scanner-v4"
-		} else if strings.HasPrefix(path.Base(fileName), "02-scanner-") {
-			subDir = "scanner"
 		}
 		renderedFiles = append(renderedFiles, zip.NewFile(path.Join(subDir, path.Base(fileName)), []byte(contents), 0))
 	}
@@ -135,23 +131,6 @@ func renderNewBasicFiles(c Config, mode mode, imageFlavor defaults.ImageFlavor)
 		return nil, errors.Errorf("unsupported deployment format %v", c.K8sConfig.DeploymentFormat)
 	}
 
-	// For rendering out deploymend bundles we need to activate Scanner V4, otherwise
-	// no Scanner V4 manifests will be contained in the bundle. Therefore we make sure
-	// here to flip scannerV4.disable to false. To have precedence we need to prepend
-	// the Scanner V4 activation switch to the list of Helm values files.
-	//
-	// This can be removed once Scanner V4 is activated by default.
-	activateScannerV4 := map[string]interface{}{
-		"scannerV4": map[string]interface{}{
-			"disable": false,
-		},
-	}
-	activateScannerV4Bytes, err := yaml.Marshal(activateScannerV4)
-	if err != nil {
-		return nil, errors.Wrap(err, "marshalling Scanner V4 activation switch")
-	}
-	valuesFiles = append([]*zip.File{zip.NewFile("activate-scanner-v4.yaml", activateScannerV4Bytes, 0)}, valuesFiles...)
-
 	renderedFiles, err := renderHelmChart(chartFiles, mode, valuesFiles)
 	if err != nil {
 		return nil, errors.Wrap(err, "rendering helm chart")
@@ -200,12 +179,10 @@ func renderAuxiliaryFiles(c Config, mode mode) ([]*zip.File, error) {
 	if c.K8sConfig.DeploymentFormat == v1.DeploymentFormat_KUBECTL {
 		if mode == centralDBOnly {
 			auxFiles = append(auxFiles, withPrefix("scripts", assets)...)
-		} else {
-			auxFiles = append(auxFiles, withPrefix("scanner/scripts", assets)...)
-		}
-		if mode == renderAll {
+		} else if mode == renderAll {
 			auxFiles = append(auxFiles, withPrefix("central/scripts", assets)...)
 		}
+		// Other modes (scannerOnly): no assets needed — scanner-v4's setup.sh does not use docker-auth.sh.
 	} else {
 		auxFiles = append(auxFiles, withPrefix("scripts", assets)...)
 	}
diff --git a/pkg/renderer/render_test.go b/pkg/renderer/render_test.go
index a1130a5d5069c..c23521ec0cfe7 100644
--- a/pkg/renderer/render_test.go
+++ b/pkg/renderer/render_test.go
@@ -1,10 +1,12 @@
 package renderer
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
 	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/pkg/helm/charts"
 	"github.com/stackrox/rox/pkg/images/defaults"
 	"github.com/stackrox/rox/pkg/images/defaults/testutils"
 	"github.com/stackrox/rox/pkg/k8sutil"
@@ -16,6 +18,56 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
+func TestRenderCentralWorkerEnv(t *testing.T) {
+	t.Setenv("TEST_VERSIONS", "true")
+	flavor := testutils.MakeImageFlavorForTest(t)
+	config := getBaseConfig()
+	config.Environment = map[string]string{
+		"ROX_CENTRAL_WORKER_ENABLED": "true",
+		"CUSTOM_ENV":                 "preserved",
+	}
+	require.NoError(t, postProcessConfig(&config, renderAll, flavor))
+	valuesFiles, err := renderNewHelmValues(config)
+	require.NoError(t, err)
+	chartTemplate, err := config.HelmImage.GetCentralServicesChartTemplate()
+	require.NoError(t, err)
+	metaValues := charts.GetMetaValuesForFlavor(flavor)
+	metaValues.KubectlOutput = true
+	chartFiles, err := chartTemplate.InstantiateRaw(metaValues)
+	require.NoError(t, err)
+
+	cases := map[string]struct {
+		enabled     bool
+		expectedEnv []corev1.EnvVar
+	}{
+		"enabled": {
+			enabled:     true,
+			expectedEnv: []corev1.EnvVar{{Name: "ROX_CENTRAL_WORKER_ENABLED", Value: "true"}},
+		},
+		"disabled": {},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			workerValues := zip.NewFile("worker-values.yaml", []byte(fmt.Sprintf("centralWorker:\n  enabled: %t\n", tc.enabled)), 0)
+			files, err := renderHelmChart(chartFiles, renderAll, append(valuesFiles, workerValues))
+			require.NoError(t, err)
+			centralFile := filterCentralFile(files)
+			require.NotNil(t, centralFile)
+			deployment := getCentralDeployment(t, centralFile)
+			require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
+			envVars := deployment.Spec.Template.Spec.Containers[0].Env
+			var workerEnv []corev1.EnvVar
+			for _, envVar := range envVars {
+				if envVar.Name == "ROX_CENTRAL_WORKER_ENABLED" {
+					workerEnv = append(workerEnv, envVar)
+				}
+			}
+			assert.Equal(t, tc.expectedEnv, workerEnv)
+			assert.Contains(t, envVars, corev1.EnvVar{Name: "CUSTOM_ENV", Value: "preserved"})
+		})
+	}
+}
+
 func TestRenderTLSSecretsOnly(t *testing.T) {
 	config := Config{
 		SecretsByteMap: map[string][]byte{
@@ -23,10 +75,6 @@ func TestRenderTLSSecretsOnly(t *testing.T) {
 			"ca-key.pem":                  []byte("CAKey"),
 			"cert.pem":                    []byte("CentralCert"),
 			"key.pem":                     []byte("CentralKey"),
-			"scanner-cert.pem":            []byte("ScannerCert"),
-			"scanner-key.pem":             []byte("ScannerKey"),
-			"scanner-db-cert.pem":         []byte("ScannerDBCert"),
-			"scanner-db-key.pem":          []byte("ScannerDBKey"),
 			"scanner-v4-indexer-cert.pem": []byte("ScannerV4IndexerCert"),
 			"scanner-v4-indexer-key.pem":  []byte("ScannerV4IndexerKey"),
 			"scanner-v4-matcher-cert.pem": []byte("ScannerV4MatcherCert"),
@@ -46,7 +94,6 @@ func TestRenderTLSSecretsOnly(t *testing.T) {
 		numObjsExpected int
 	}{
 		{"central tls", RenderCentralTLSSecretOnly, 1},
-		{"scanner tls", RenderScannerTLSSecretOnly, 2},
 		{"scanner v4 tls", RenderScannerV4TLSSecretOnly, 3},
 	}
 
@@ -71,10 +118,6 @@ func TestRenderScannerOnly(t *testing.T) {
 			"ca-key.pem":                  []byte("CAKey"),
 			"cert.pem":                    []byte("CentralCert"),
 			"key.pem":                     []byte("CentralKey"),
-			"scanner-cert.pem":            []byte("ScannerCert"),
-			"scanner-key.pem":             []byte("ScannerKey"),
-			"scanner-db-cert.pem":         []byte("ScannerDBCert"),
-			"scanner-db-key.pem":          []byte("ScannerDBKey"),
 			"scanner-v4-indexer-cert.pem": []byte("ScannerV4IndexerCert"),
 			"scanner-v4-indexer-key.pem":  []byte("ScannerV4IndexerKey"),
 			"scanner-v4-matcher-cert.pem": []byte("ScannerV4MatcherCert"),
@@ -86,8 +129,6 @@ func TestRenderScannerOnly(t *testing.T) {
 		K8sConfig: &K8sConfig{
 			CommonConfig: CommonConfig{
 				MainImage:        flavor.MainImage(),
-				ScannerImage:     flavor.ScannerImage(),
-				ScannerDBImage:   flavor.ScannerDBImage(),
 				ScannerV4Image:   flavor.ScannerV4Image(),
 				ScannerV4DBImage: flavor.ScannerV4DBImage(),
 			},
@@ -128,8 +169,6 @@ func TestRenderWithDeclarativeConfig(t *testing.T) {
 		K8sConfig: &K8sConfig{
 			CommonConfig: CommonConfig{
 				MainImage:        flavor.MainImage(),
-				ScannerImage:     flavor.ScannerImage(),
-				ScannerDBImage:   flavor.ScannerDBImage(),
 				ScannerV4Image:   flavor.ScannerV4Image(),
 				ScannerV4DBImage: flavor.ScannerV4DBImage(),
 			},
@@ -206,8 +245,6 @@ func TestRenderDeclarativeConfigEmpty(t *testing.T) {
 			K8sConfig: &K8sConfig{
 				CommonConfig: CommonConfig{
 					MainImage:        flavor.MainImage(),
-					ScannerImage:     flavor.ScannerImage(),
-					ScannerDBImage:   flavor.ScannerDBImage(),
 					ScannerV4Image:   flavor.ScannerV4Image(),
 					ScannerV4DBImage: flavor.ScannerV4DBImage(),
 				},
@@ -237,8 +274,6 @@ func TestRenderDeclarativeConfigEmpty(t *testing.T) {
 			K8sConfig: &K8sConfig{
 				CommonConfig: CommonConfig{
 					MainImage:        flavor.MainImage(),
-					ScannerImage:     flavor.ScannerImage(),
-					ScannerDBImage:   flavor.ScannerDBImage(),
 					ScannerV4Image:   flavor.ScannerV4Image(),
 					ScannerV4DBImage: flavor.ScannerV4DBImage(),
 				},
@@ -268,8 +303,6 @@ func TestRenderDeclarativeConfigEmpty(t *testing.T) {
 			K8sConfig: &K8sConfig{
 				CommonConfig: CommonConfig{
 					MainImage:        flavor.MainImage(),
-					ScannerImage:     flavor.ScannerImage(),
-					ScannerDBImage:   flavor.ScannerDBImage(),
 					ScannerV4Image:   flavor.ScannerV4Image(),
 					ScannerV4DBImage: flavor.ScannerV4DBImage(),
 				},
@@ -337,8 +370,6 @@ func TestDeclarativeConfigDuplicateValues(t *testing.T) {
 		K8sConfig: &K8sConfig{
 			CommonConfig: CommonConfig{
 				MainImage:        flavor.MainImage(),
-				ScannerImage:     flavor.ScannerImage(),
-				ScannerDBImage:   flavor.ScannerDBImage(),
 				ScannerV4Image:   flavor.ScannerV4Image(),
 				ScannerV4DBImage: flavor.ScannerV4DBImage(),
 			},
diff --git a/pkg/renderer/templater.go b/pkg/renderer/templater.go
index 75ff1a11b7763..bbc9531d7739b 100644
--- a/pkg/renderer/templater.go
+++ b/pkg/renderer/templater.go
@@ -59,8 +59,6 @@ func (h *HostPathPersistenceInstance) WithNodeSelector() bool {
 type CommonConfig struct {
 	MainImage        string
 	CentralDBImage   string
-	ScannerImage     string
-	ScannerDBImage   string
 	ScannerV4Image   string
 	ScannerV4DBImage string
 }
@@ -106,10 +104,6 @@ type K8sConfig struct {
 	// k8s fields
 	Registry string
 
-	ScannerRegistry string
-	// If the scanner registry is different from the central registry get a separate secret
-	ScannerSecretName string
-
 	// These variables are not prompted for by Cobra, but are set based on
 	// provided inputs for use in templating.
 	MainImageTag string
diff --git a/pkg/renderer/templates/private_values.yaml.tpl b/pkg/renderer/templates/private_values.yaml.tpl
index 903205a383100..e5a4b4ef471c4 100644
--- a/pkg/renderer/templates/private_values.yaml.tpl
+++ b/pkg/renderer/templates/private_values.yaml.tpl
@@ -56,33 +56,6 @@ central:
       {{- index .SecretsBase64Map "default-tls.key" | b64dec | nindent 6 }}
   {{- end }}
 
-scanner:
-  {{- if ne (index .SecretsBase64Map "scanner-db-password") "" }}
-  # Password for securing the communication between Scanner and its DB.
-  # This password is not relevant to the user (unless for debugging purposes);
-  # it merely acts as a pre-shared, random secret for securing the connection.
-  dbPassword:
-    value: {{ index .SecretsBase64Map "scanner-db-password" | b64dec }}
-  {{- end }}
-
-  {{- if ne (index .SecretsBase64Map "scanner-cert.pem") "" }}
-  # Internal "scanner.stackrox.svc" service TLS certificate.
-  serviceTLS:
-    cert: |
-      {{- index .SecretsBase64Map "scanner-cert.pem" | b64dec | nindent 6 }}
-    key: |
-      {{- index .SecretsBase64Map "scanner-key.pem" | b64dec | nindent 6 }}
-  {{- end }}
-
-  {{- if ne (index .SecretsBase64Map "scanner-db-cert.pem") "" }}
-  # Internal "scanner-db.stackrox" service TLS certificate.
-  dbServiceTLS:
-    cert: |
-      {{- index .SecretsBase64Map "scanner-db-cert.pem" | b64dec | nindent 6 }}
-    key: |
-      {{- index .SecretsBase64Map "scanner-db-key.pem" | b64dec | nindent 6 }}
-  {{- end }}
-
 scannerV4:
   # Password for securing the communication between Scanner and its DB.
   # This password is not relevant to the user (unless for debugging purposes);
diff --git a/pkg/renderer/templates/private_values_postgres.yaml.tpl b/pkg/renderer/templates/private_values_postgres.yaml.tpl
index c9f7980dd6bde..16c1f171293e7 100644
--- a/pkg/renderer/templates/private_values_postgres.yaml.tpl
+++ b/pkg/renderer/templates/private_values_postgres.yaml.tpl
@@ -71,33 +71,6 @@ central:
       {{- index .SecretsBase64Map "default-tls.key" | b64dec | nindent 6 }}
   {{- end }}
 
-scanner:
-  {{- if ne (index .SecretsBase64Map "scanner-db-password") "" }}
-  # Password for securing the communication between Scanner and its DB.
-  # This password is not relevant to the user (unless for debugging purposes);
-  # it merely acts as a pre-shared, random secret for securing the connection.
-  dbPassword:
-    value: {{ index .SecretsBase64Map "scanner-db-password" | b64dec }}
-  {{- end }}
-
-  {{- if ne (index .SecretsBase64Map "scanner-cert.pem") "" }}
-  # Internal "scanner.stackrox.svc" service TLS certificate.
-  serviceTLS:
-    cert: |
-      {{- index .SecretsBase64Map "scanner-cert.pem" | b64dec | nindent 6 }}
-    key: |
-      {{- index .SecretsBase64Map "scanner-key.pem" | b64dec | nindent 6 }}
-  {{- end }}
-
-  {{- if ne (index .SecretsBase64Map "scanner-db-cert.pem") "" }}
-  # Internal "scanner-db.stackrox" service TLS certificate.
-  dbServiceTLS:
-    cert: |
-      {{- index .SecretsBase64Map "scanner-db-cert.pem" | b64dec | nindent 6 }}
-    key: |
-      {{- index .SecretsBase64Map "scanner-db-key.pem" | b64dec | nindent 6 }}
-  {{- end }}
-
 scannerV4:
   # Password for securing the communication between Scanner and its DB.
   # This password is not relevant to the user (unless for debugging purposes);
diff --git a/pkg/renderer/templates/public_values.yaml.tpl b/pkg/renderer/templates/public_values.yaml.tpl
index 3e58be82b414a..30a40e9942d31 100644
--- a/pkg/renderer/templates/public_values.yaml.tpl
+++ b/pkg/renderer/templates/public_values.yaml.tpl
@@ -17,9 +17,6 @@ env:
 imagePullSecrets:
   useExisting:
   - stackrox
-  {{- if and .K8sConfig.ScannerSecretName (ne .K8sConfig.ScannerSecretName "stackrox") }}
-  - {{ .K8sConfig.ScannerSecretName | quote }}
-  {{- end }}
 
 {{- if .K8sConfig.ImageOverrides.MainRegistry }}
 image:
@@ -121,48 +118,12 @@ central:
       none: true
       {{- end }}
 
-scanner:
-  # IMPORTANT: If you do not wish to run StackRox Scanner, change the value on the following
-  # line to "true".
-  disable: false
-
-  {{- if .K8sConfig.ImageOverrides.Scanner }}
-  image:
-    {{- if .K8sConfig.ImageOverrides.Scanner.Registry }}
-    registry: {{ .K8sConfig.ImageOverrides.Scanner.Registry }}
-    {{- end }}
-    {{- if .K8sConfig.ImageOverrides.Scanner.Name }}
-    name: {{ .K8sConfig.ImageOverrides.Scanner.Name }}
-    {{- end }}
-    {{- if .K8sConfig.ImageOverrides.Scanner.Tag }}
-    # WARNING: You are using a non-default Scanner image tag. Upgrades via 'helm upgrade'
-    # will not work as expected. To ensure a smooth upgrade experience, make sure
-    # StackRox images are mirrored with the same tags as in the quay.io/stackrox-io registry.
-    tag: {{ .K8sConfig.ImageOverrides.Scanner.Tag }}
-    {{- end }}
-  {{- end }}
-
-  {{- if .K8sConfig.ImageOverrides.ScannerDB }}
-  dbImage:
-    {{- if .K8sConfig.ImageOverrides.ScannerDB.Registry }}
-    registry: {{ .K8sConfig.ImageOverrides.ScannerDB.Registry }}
-    {{- end }}
-    {{- if .K8sConfig.ImageOverrides.ScannerDB.Name }}
-    name: {{ .K8sConfig.ImageOverrides.ScannerDB.Name }}
-    {{- end }}
-    {{- if .K8sConfig.ImageOverrides.ScannerDB.Tag }}
-    # WARNING: You are using a non-default Scanner DB image tag. Upgrades via
-    # 'helm upgrade' will not work as expected. To ensure a smooth upgrade experience,
-    # make sure StackRox images are mirrored with the same tags as in the quay.io/stackrox-io
-    # registry.
-    tag: {{ .K8sConfig.ImageOverrides.ScannerDB.Tag }}
-    {{- end }}
-  {{- end }}
-
 scannerV4:
-  disable: true
   {{- if .K8sConfig.ImageOverrides.ScannerV4 }}
   image:
+  {{- if .K8sConfig.ImageOverrides.ScannerV4.Registry }}
+    registry: {{ .K8sConfig.ImageOverrides.ScannerV4.Registry }}
+  {{- end }}
   {{- if .K8sConfig.ImageOverrides.ScannerV4.Name }}
     name: {{ .K8sConfig.ImageOverrides.ScannerV4.Name }}
   {{- end }}
@@ -173,6 +134,9 @@ scannerV4:
   db:
     {{- if .K8sConfig.ImageOverrides.ScannerV4DB }}
     image:
+      {{- if .K8sConfig.ImageOverrides.ScannerV4DB.Registry }}
+      registry: {{ .K8sConfig.ImageOverrides.ScannerV4DB.Registry }}
+      {{- end }}
       {{- if .K8sConfig.ImageOverrides.ScannerV4DB.Name }}
       name: {{ .K8sConfig.ImageOverrides.ScannerV4DB.Name }}
       {{- end }}
@@ -186,6 +150,7 @@ scannerV4:
 {{- $_ := unset $envVars "ROX_TELEMETRY_ENDPOINT" -}}
 {{- $_ := unset $envVars "ROX_TELEMETRY_STORAGE_KEY_V1" -}}
 {{- $_ := unset $envVars "ROX_SCANNER_V4" -}}
+{{- $_ := unset $envVars "ROX_CENTRAL_WORKER_ENABLED" -}}
 {{- if $envVars }}
 
 customize:
diff --git a/pkg/sac/externalrolebroker/access_scope_builder.go b/pkg/sac/externalrolebroker/access_scope_builder.go
new file mode 100644
index 0000000000000..288c4af19658b
--- /dev/null
+++ b/pkg/sac/externalrolebroker/access_scope_builder.go
@@ -0,0 +1,63 @@
+package externalrolebroker
+
+import (
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/set"
+	"github.com/stackrox/rox/pkg/uuid"
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+)
+
+// ConvertBindingsToSimpleAccessScope converts ClusterBinding entries from
+// an ACM UserPermission object to a *storage.SimpleAccessScope
+//
+// The function creates:
+//   - Entries in IncludedClusters for bindings with cluster scope
+//   - Entries in IncludedNamespaces for bindings with namespace scope
+//
+// Note: In ACM, the Cluster field in ClusterBinding contains the managed
+// cluster name, which corresponds to a namespace name on the hub cluster.
+// This is mapped to ClusterName in the SimpleAccessScope structure.
+//
+// The returned SimpleAccessScope has a generated ID and an empty name/description.
+// Duplicate namespaces within the same cluster are deduplicated.
+func ConvertBindingsToSimpleAccessScope(
+	bindings []clusterviewv1alpha1.ClusterBinding,
+) *storage.SimpleAccessScope {
+	clusterSet := set.NewStringSet()
+	namespaceSet := set.NewStringSet()
+	var namespaces []*storage.SimpleAccessScope_Rules_Namespace
+
+	for _, binding := range bindings {
+		switch binding.Scope {
+		case clusterviewv1alpha1.BindingScopeCluster:
+			// Cluster-scoped binding: add to IncludedClusters
+			clusterSet.Add(binding.Cluster)
+
+		case clusterviewv1alpha1.BindingScopeNamespace:
+			// Namespace-scoped binding: create entries in IncludedNamespaces
+			for _, ns := range binding.Namespaces {
+				// Convert wildcard namespace to full cluster access
+				if ns == "*" {
+					clusterSet.Add(binding.Cluster)
+					break
+				}
+
+				key := binding.Cluster + ":" + ns
+				if namespaceSet.Add(key) {
+					namespaces = append(namespaces, &storage.SimpleAccessScope_Rules_Namespace{
+						ClusterName:   binding.Cluster,
+						NamespaceName: ns,
+					})
+				}
+			}
+		}
+	}
+
+	return &storage.SimpleAccessScope{
+		Id: uuid.NewV4().String(),
+		Rules: &storage.SimpleAccessScope_Rules{
+			IncludedClusters:   clusterSet.AsSlice(),
+			IncludedNamespaces: namespaces,
+		},
+	}
+}
diff --git a/pkg/sac/externalrolebroker/access_scope_builder_test.go b/pkg/sac/externalrolebroker/access_scope_builder_test.go
new file mode 100644
index 0000000000000..3b94203c29654
--- /dev/null
+++ b/pkg/sac/externalrolebroker/access_scope_builder_test.go
@@ -0,0 +1,362 @@
+package externalrolebroker
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/pkg/set"
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConvertBindingsToSimpleAccessScope(t *testing.T) {
+	tests := map[string]struct {
+		bindings               []clusterviewv1alpha1.ClusterBinding
+		expectedClusters       []string
+		expectedNamespaceCount int
+		checkNamespaces        func(t *testing.T, namespaces []string)
+	}{
+		"empty bindings": {
+			bindings:               []clusterviewv1alpha1.ClusterBinding{},
+			expectedClusters:       []string{},
+			expectedNamespaceCount: 0,
+		},
+		"single cluster-scoped binding": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+			},
+			expectedClusters:       []string{"cluster-a"},
+			expectedNamespaceCount: 0,
+		},
+		"multiple cluster-scoped bindings": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+				{
+					Cluster:    "cluster-b",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+				{
+					Cluster:    "cluster-c",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+			},
+			expectedClusters:       []string{"cluster-a", "cluster-b", "cluster-c"},
+			expectedNamespaceCount: 0,
+		},
+		"duplicate cluster-scoped bindings": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+			},
+			expectedClusters:       []string{"cluster-a"},
+			expectedNamespaceCount: 0,
+		},
+		"duplicate namespace-scoped bindings": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"default", "kube-system"},
+				},
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"default", "monitoring"},
+				},
+			},
+			expectedClusters:       []string{},
+			expectedNamespaceCount: 3,
+			checkNamespaces: func(t *testing.T, namespaces []string) {
+				assert.Contains(t, namespaces, "cluster-a:default")
+				assert.Contains(t, namespaces, "cluster-a:kube-system")
+				assert.Contains(t, namespaces, "cluster-a:monitoring")
+			},
+		},
+		"single namespace-scoped binding": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"default"},
+				},
+			},
+			expectedClusters:       []string{},
+			expectedNamespaceCount: 1,
+			checkNamespaces: func(t *testing.T, namespaces []string) {
+				assert.Contains(t, namespaces, "cluster-a:default")
+			},
+		},
+		"namespace-scoped binding with multiple namespaces": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"default", "kube-system", "app-namespace"},
+				},
+			},
+			expectedClusters:       []string{},
+			expectedNamespaceCount: 3,
+			checkNamespaces: func(t *testing.T, namespaces []string) {
+				assert.Contains(t, namespaces, "cluster-a:default")
+				assert.Contains(t, namespaces, "cluster-a:kube-system")
+				assert.Contains(t, namespaces, "cluster-a:app-namespace")
+			},
+		},
+		"multiple namespace-scoped bindings on different clusters": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"default", "app-ns"},
+				},
+				{
+					Cluster:    "cluster-b",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"production", "staging"},
+				},
+			},
+			expectedClusters:       []string{},
+			expectedNamespaceCount: 4,
+			checkNamespaces: func(t *testing.T, namespaces []string) {
+				assert.Contains(t, namespaces, "cluster-a:default")
+				assert.Contains(t, namespaces, "cluster-a:app-ns")
+				assert.Contains(t, namespaces, "cluster-b:production")
+				assert.Contains(t, namespaces, "cluster-b:staging")
+			},
+		},
+		"mixed cluster and namespace scoped bindings": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+				{
+					Cluster:    "cluster-b",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"default", "kube-system"},
+				},
+				{
+					Cluster:    "cluster-c",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+			},
+			expectedClusters:       []string{"cluster-a", "cluster-c"},
+			expectedNamespaceCount: 2,
+			checkNamespaces: func(t *testing.T, namespaces []string) {
+				assert.Contains(t, namespaces, "cluster-b:default")
+				assert.Contains(t, namespaces, "cluster-b:kube-system")
+			},
+		},
+		"namespace-scoped binding with wildcard namespace (should be converted to full cluster access)": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"*"},
+				},
+			},
+			expectedClusters:       []string{"cluster-a"},
+			expectedNamespaceCount: 0,
+		},
+		"namespace-scoped binding with mix of regular and wildcard namespaces": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "cluster-a",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"default", "*", "kube-system"},
+				},
+			},
+			expectedClusters:       []string{"cluster-a"},
+			expectedNamespaceCount: 1, // Only default and kube-system, wildcard is skipped
+			checkNamespaces: func(t *testing.T, namespaces []string) {
+				assert.Contains(t, namespaces, "cluster-a:default")
+				assert.NotContains(t, namespaces, "cluster-a:kube-system")
+				assert.NotContains(t, namespaces, "cluster-a:*")
+			},
+		},
+		"complex scenario with multiple bindings": {
+			bindings: []clusterviewv1alpha1.ClusterBinding{
+				{
+					Cluster:    "prod-cluster",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+				{
+					Cluster:    "dev-cluster",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"team-a", "team-b"},
+				},
+				{
+					Cluster:    "staging-cluster",
+					Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+					Namespaces: []string{"preview"},
+				},
+				{
+					Cluster:    "test-cluster",
+					Scope:      clusterviewv1alpha1.BindingScopeCluster,
+					Namespaces: []string{"*"},
+				},
+			},
+			expectedClusters:       []string{"prod-cluster", "test-cluster"},
+			expectedNamespaceCount: 3,
+			checkNamespaces: func(t *testing.T, namespaces []string) {
+				assert.Contains(t, namespaces, "dev-cluster:team-a")
+				assert.Contains(t, namespaces, "dev-cluster:team-b")
+				assert.Contains(t, namespaces, "staging-cluster:preview")
+			},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			scope := ConvertBindingsToSimpleAccessScope(tc.bindings)
+
+			require.NotNil(t, scope)
+			assert.NotEmpty(t, scope.GetId(), "SimpleAccessScope should have a generated ID")
+			require.NotNil(t, scope.GetRules())
+
+			// Verify included clusters
+			actualClusters := set.NewStringSet(scope.GetRules().GetIncludedClusters()...)
+			expectedClusters := set.NewStringSet(tc.expectedClusters...)
+			assert.Equal(t, expectedClusters, actualClusters,
+				"Expected clusters %v, got %v", tc.expectedClusters, scope.GetRules().GetIncludedClusters())
+
+			// Verify namespace count
+			assert.Len(t, scope.GetRules().GetIncludedNamespaces(), tc.expectedNamespaceCount,
+				"Expected %d namespaces, got %d", tc.expectedNamespaceCount, len(scope.GetRules().GetIncludedNamespaces()))
+
+			// Additional namespace checks if provided
+			if tc.checkNamespaces != nil && len(scope.GetRules().GetIncludedNamespaces()) > 0 {
+				// Convert to cluster:namespace format for easier checking
+				namespaceStrs := make([]string, len(scope.GetRules().GetIncludedNamespaces()))
+				for i, ns := range scope.GetRules().GetIncludedNamespaces() {
+					namespaceStrs[i] = ns.GetClusterName() + ":" + ns.GetNamespaceName()
+				}
+				tc.checkNamespaces(t, namespaceStrs)
+			}
+		})
+	}
+}
+
+func TestConvertBindingsToSimpleAccessScope_NamespaceStructure(t *testing.T) {
+	bindings := []clusterviewv1alpha1.ClusterBinding{
+		{
+			Cluster:    "my-cluster",
+			Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+			Namespaces: []string{"default", "kube-system"},
+		},
+	}
+
+	scope := ConvertBindingsToSimpleAccessScope(bindings)
+
+	require.NotNil(t, scope)
+	require.NotNil(t, scope.GetRules())
+	require.Len(t, scope.GetRules().GetIncludedNamespaces(), 2)
+
+	// Verify the structure of namespace entries
+	for _, ns := range scope.GetRules().GetIncludedNamespaces() {
+		assert.Equal(t, "my-cluster", ns.GetClusterName(), "ClusterName should be set")
+		assert.NotEmpty(t, ns.GetNamespaceName(), "NamespaceName should be set")
+		assert.Contains(t, []string{"default", "kube-system"}, ns.GetNamespaceName())
+		assert.Empty(t, ns.GetClusterId(), "ClusterId should not be set (we only use ClusterName)")
+	}
+}
+
+func TestConvertBindingsToSimpleAccessScope_EmptyNamespacesList(t *testing.T) {
+	bindings := []clusterviewv1alpha1.ClusterBinding{
+		{
+			Cluster:    "cluster-a",
+			Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+			Namespaces: []string{}, // Empty namespace list
+		},
+	}
+
+	scope := ConvertBindingsToSimpleAccessScope(bindings)
+
+	require.NotNil(t, scope)
+	require.NotNil(t, scope.GetRules())
+	assert.Empty(t, scope.GetRules().GetIncludedNamespaces(), "Should have no namespace entries for empty namespace list")
+}
+
+func TestConvertBindingsToSimpleAccessScope_OnlyClusterScoped(t *testing.T) {
+	bindings := []clusterviewv1alpha1.ClusterBinding{
+		{
+			Cluster:    "cluster-1",
+			Scope:      clusterviewv1alpha1.BindingScopeCluster,
+			Namespaces: []string{"*"},
+		},
+		{
+			Cluster:    "cluster-2",
+			Scope:      clusterviewv1alpha1.BindingScopeCluster,
+			Namespaces: []string{"*"},
+		},
+	}
+
+	scope := ConvertBindingsToSimpleAccessScope(bindings)
+
+	require.NotNil(t, scope)
+	require.NotNil(t, scope.GetRules())
+
+	// Should have clusters but no namespaces
+	assert.Len(t, scope.GetRules().GetIncludedClusters(), 2)
+	assert.Empty(t, scope.GetRules().GetIncludedNamespaces())
+
+	clusterSet := set.NewStringSet(scope.GetRules().GetIncludedClusters()...)
+	assert.True(t, clusterSet.Contains("cluster-1"))
+	assert.True(t, clusterSet.Contains("cluster-2"))
+}
+
+func TestConvertBindingsToSimpleAccessScope_OnlyNamespaceScoped(t *testing.T) {
+	bindings := []clusterviewv1alpha1.ClusterBinding{
+		{
+			Cluster:    "cluster-1",
+			Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+			Namespaces: []string{"ns-1", "ns-2"},
+		},
+		{
+			Cluster:    "cluster-2",
+			Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+			Namespaces: []string{"ns-3"},
+		},
+	}
+
+	scope := ConvertBindingsToSimpleAccessScope(bindings)
+
+	require.NotNil(t, scope)
+	require.NotNil(t, scope.GetRules())
+
+	// Should have namespaces but no cluster-wide access
+	assert.Empty(t, scope.GetRules().GetIncludedClusters())
+	assert.Len(t, scope.GetRules().GetIncludedNamespaces(), 3)
+
+	// Verify all namespaces are present
+	nsMap := make(map[string]bool)
+	for _, ns := range scope.GetRules().GetIncludedNamespaces() {
+		key := ns.GetClusterName() + ":" + ns.GetNamespaceName()
+		nsMap[key] = true
+	}
+
+	assert.True(t, nsMap["cluster-1:ns-1"])
+	assert.True(t, nsMap["cluster-1:ns-2"])
+	assert.True(t, nsMap["cluster-2:ns-3"])
+}
diff --git a/pkg/sac/externalrolebroker/acm/acm_client.go b/pkg/sac/externalrolebroker/acm/acm_client.go
new file mode 100644
index 0000000000000..4fadb1b6d93e7
--- /dev/null
+++ b/pkg/sac/externalrolebroker/acm/acm_client.go
@@ -0,0 +1,53 @@
+package acm
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/pkg/retryablehttp"
+	clusterviewclient "github.com/stolostron/cluster-lifecycle-api/client/clusterview/clientset/versioned/typed/clusterview/v1alpha1"
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/rest"
+)
+
+// Client provides access to the ACM clusterview aggregate API.
+type Client struct {
+	clusterviewClient clusterviewclient.ClusterviewV1alpha1Interface
+}
+
+// NewClientForConfig creates a new client for the ACM clusterview API using the provided config.
+// The config's transport is wrapped with retry logic for transient errors.
+func NewClientForConfig(config *rest.Config) (*Client, error) {
+	cfg := rest.CopyConfig(config)
+	retryablehttp.ConfigureRESTConfig(cfg)
+	clusterviewClient, err := clusterviewclient.NewForConfig(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create clusterview client")
+	}
+	return &Client{
+		clusterviewClient: clusterviewClient,
+	}, nil
+}
+
+// ListUserPermissions retrieves the list of user permissions from the ACM clusterview API.
+// This calls the aggregate API at /apis/clusterview.open-cluster-management.io/v1alpha1/userpermissions.
+func (c *Client) ListUserPermissions(
+	ctx context.Context,
+	opts metav1.ListOptions,
+) (*clusterviewv1alpha1.UserPermissionList, error) {
+	list, err := c.clusterviewClient.UserPermissions().List(ctx, opts)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to list user permissions")
+	}
+	return list, nil
+}
+
+// GetUserPermission retrieves a specific user permission by name from the ACM clusterview API.
+func (c *Client) GetUserPermission(ctx context.Context, name string, opts metav1.GetOptions) (*clusterviewv1alpha1.UserPermission, error) {
+	permission, err := c.clusterviewClient.UserPermissions().Get(ctx, name, opts)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to get user permission %q", name)
+	}
+	return permission, nil
+}
diff --git a/pkg/sac/externalrolebroker/acm/acm_client_test.go b/pkg/sac/externalrolebroker/acm/acm_client_test.go
new file mode 100644
index 0000000000000..3e5704b025cde
--- /dev/null
+++ b/pkg/sac/externalrolebroker/acm/acm_client_test.go
@@ -0,0 +1,237 @@
+package acm
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/rest"
+)
+
+func TestNewClientForConfig(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+
+	client, err := NewClientForConfig(&rest.Config{Host: server.URL})
+	require.NoError(t, err)
+	require.NotNil(t, client)
+	assert.NotNil(t, client.clusterviewClient)
+}
+
+func TestClient_WithFakeServer(t *testing.T) {
+	testPermissions := &clusterviewv1alpha1.UserPermissionList{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "clusterview.open-cluster-management.io/v1alpha1",
+			Kind:       "UserPermissionList",
+		},
+		ListMeta: metav1.ListMeta{},
+		Items: []clusterviewv1alpha1.UserPermission{
+			{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "clusterview.open-cluster-management.io/v1alpha1",
+					Kind:       "UserPermission",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "managedcluster:admin",
+				},
+				Status: clusterviewv1alpha1.UserPermissionStatus{
+					Bindings: []clusterviewv1alpha1.ClusterBinding{
+						{
+							Cluster:    "cluster1",
+							Scope:      clusterviewv1alpha1.BindingScopeCluster,
+							Namespaces: []string{"*"},
+						},
+						{
+							Cluster:    "cluster2",
+							Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+							Namespaces: []string{"default", "kube-system"},
+						},
+					},
+					ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+						Rules: []rbacv1.PolicyRule{
+							{
+								APIGroups: []string{"*"},
+								Resources: []string{"*"},
+								Verbs:     []string{"*"},
+							},
+						},
+					},
+				},
+			},
+			{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "clusterview.open-cluster-management.io/v1alpha1",
+					Kind:       "UserPermission",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "managedcluster:view",
+				},
+				Status: clusterviewv1alpha1.UserPermissionStatus{
+					Bindings: []clusterviewv1alpha1.ClusterBinding{
+						{
+							Cluster:    "cluster1",
+							Scope:      clusterviewv1alpha1.BindingScopeCluster,
+							Namespaces: []string{"*"},
+						},
+					},
+					ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+						Rules: []rbacv1.PolicyRule{
+							{
+								APIGroups: []string{""},
+								Resources: []string{"pods", "services"},
+								Verbs:     []string{"get", "list", "watch"},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		expectedBasePath := "/apis/clusterview.open-cluster-management.io/v1alpha1/userpermissions"
+
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == expectedBasePath:
+			w.Header().Set("Content-Type", "application/json")
+			err := json.NewEncoder(w).Encode(testPermissions)
+			require.NoError(t, err)
+
+		case r.Method == http.MethodGet && r.URL.Path == expectedBasePath+"/managedcluster:admin":
+			w.Header().Set("Content-Type", "application/json")
+			err := json.NewEncoder(w).Encode(&testPermissions.Items[0])
+			require.NoError(t, err)
+
+		case r.Method == http.MethodGet && r.URL.Path == expectedBasePath+"/managedcluster:view":
+			w.Header().Set("Content-Type", "application/json")
+			err := json.NewEncoder(w).Encode(&testPermissions.Items[1])
+			require.NoError(t, err)
+
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	client, err := NewClientForConfig(&rest.Config{Host: server.URL})
+	require.NoError(t, err)
+	require.NotNil(t, client)
+
+	t.Run("ListUserPermissions", func(t *testing.T) {
+		list, err := client.ListUserPermissions(context.Background(), metav1.ListOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, list)
+
+		assert.Len(t, list.Items, 2)
+
+		assert.Equal(t, "managedcluster:admin", list.Items[0].Name)
+		assert.Len(t, list.Items[0].Status.Bindings, 2)
+		assert.Equal(t, "cluster1", list.Items[0].Status.Bindings[0].Cluster)
+		assert.Equal(t, clusterviewv1alpha1.BindingScopeCluster, list.Items[0].Status.Bindings[0].Scope)
+		assert.Equal(t, []string{"*"}, list.Items[0].Status.Bindings[0].Namespaces)
+
+		assert.Equal(t, "cluster2", list.Items[0].Status.Bindings[1].Cluster)
+		assert.Equal(t, clusterviewv1alpha1.BindingScopeNamespace, list.Items[0].Status.Bindings[1].Scope)
+		assert.Equal(t, []string{"default", "kube-system"}, list.Items[0].Status.Bindings[1].Namespaces)
+
+		assert.Len(t, list.Items[0].Status.ClusterRoleDefinition.Rules, 1)
+		assert.Equal(t, []string{"*"}, list.Items[0].Status.ClusterRoleDefinition.Rules[0].APIGroups)
+		assert.Equal(t, []string{"*"}, list.Items[0].Status.ClusterRoleDefinition.Rules[0].Resources)
+		assert.Equal(t, []string{"*"}, list.Items[0].Status.ClusterRoleDefinition.Rules[0].Verbs)
+
+		assert.Equal(t, "managedcluster:view", list.Items[1].Name)
+		assert.Len(t, list.Items[1].Status.Bindings, 1)
+		assert.Equal(t, "cluster1", list.Items[1].Status.Bindings[0].Cluster)
+	})
+
+	t.Run("GetUserPermission_Admin", func(t *testing.T) {
+		permission, err := client.GetUserPermission(context.Background(), "managedcluster:admin", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, permission)
+
+		assert.Equal(t, "managedcluster:admin", permission.Name)
+		assert.Len(t, permission.Status.Bindings, 2)
+
+		assert.Equal(t, "cluster1", permission.Status.Bindings[0].Cluster)
+		assert.Equal(t, clusterviewv1alpha1.BindingScopeCluster, permission.Status.Bindings[0].Scope)
+		assert.Equal(t, []string{"*"}, permission.Status.Bindings[0].Namespaces)
+
+		assert.Equal(t, "cluster2", permission.Status.Bindings[1].Cluster)
+		assert.Equal(t, clusterviewv1alpha1.BindingScopeNamespace, permission.Status.Bindings[1].Scope)
+		assert.Equal(t, []string{"default", "kube-system"}, permission.Status.Bindings[1].Namespaces)
+
+		assert.Len(t, permission.Status.ClusterRoleDefinition.Rules, 1)
+		rule := permission.Status.ClusterRoleDefinition.Rules[0]
+		assert.Equal(t, []string{"*"}, rule.APIGroups)
+		assert.Equal(t, []string{"*"}, rule.Resources)
+		assert.Equal(t, []string{"*"}, rule.Verbs)
+	})
+
+	t.Run("GetUserPermission_View", func(t *testing.T) {
+		permission, err := client.GetUserPermission(context.Background(), "managedcluster:view", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, permission)
+
+		assert.Equal(t, "managedcluster:view", permission.Name)
+		assert.Len(t, permission.Status.Bindings, 1)
+
+		assert.Equal(t, "cluster1", permission.Status.Bindings[0].Cluster)
+		assert.Equal(t, clusterviewv1alpha1.BindingScopeCluster, permission.Status.Bindings[0].Scope)
+		assert.Equal(t, []string{"*"}, permission.Status.Bindings[0].Namespaces)
+
+		assert.Len(t, permission.Status.ClusterRoleDefinition.Rules, 1)
+		rule := permission.Status.ClusterRoleDefinition.Rules[0]
+		assert.Equal(t, []string{""}, rule.APIGroups)
+		assert.Equal(t, []string{"pods", "services"}, rule.Resources)
+		assert.Equal(t, []string{"get", "list", "watch"}, rule.Verbs)
+	})
+}
+
+func TestClient_WithFakeServer_EmptyList(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		emptyList := &clusterviewv1alpha1.UserPermissionList{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "clusterview.open-cluster-management.io/v1alpha1",
+				Kind:       "UserPermissionList",
+			},
+			ListMeta: metav1.ListMeta{},
+			Items:    []clusterviewv1alpha1.UserPermission{},
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		err := json.NewEncoder(w).Encode(emptyList)
+		require.NoError(t, err)
+	}))
+	defer server.Close()
+
+	client, err := NewClientForConfig(&rest.Config{Host: server.URL})
+	require.NoError(t, err)
+
+	list, err := client.ListUserPermissions(context.Background(), metav1.ListOptions{})
+	require.NoError(t, err)
+	require.NotNil(t, list)
+	assert.Len(t, list.Items, 0)
+}
+
+func TestClient_WithFakeServer_NotFound(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+
+	client, err := NewClientForConfig(&rest.Config{Host: server.URL})
+	require.NoError(t, err)
+
+	_, err = client.GetUserPermission(context.Background(), "nonexistent", metav1.GetOptions{})
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get user permission")
+}
diff --git a/pkg/sac/externalrolebroker/acm_resolver.go b/pkg/sac/externalrolebroker/acm_resolver.go
new file mode 100644
index 0000000000000..3ebb0e8d8e0b9
--- /dev/null
+++ b/pkg/sac/externalrolebroker/acm_resolver.go
@@ -0,0 +1,67 @@
+package externalrolebroker
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/pkg/auth/tokens"
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// acmClient is the consumer-side interface for acm.Client, scoped to what this package uses.
+type acmClient interface {
+	ListUserPermissions(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error)
+}
+
+// GetResolvedRolesFromACM retrieves UserPermissions from ACM, filters them for supported Kubernetes resources,
+// and converts each to a permissions.ResolvedRole.
+//
+// The function:
+//   - Calls ListUserPermissions on the ACM client
+//   - Filters the results to only include UserPermissions managing supported K8s resources
+//   - Converts each UserPermission's ClusterRoleDefinition to a PermissionSet
+//   - Converts each UserPermission's Bindings to a SimpleAccessScope
+//   - Creates a ResolvedRole for each UserPermission
+//
+// The role name is derived from the UserPermission metadata name
+func GetResolvedRolesFromACM(
+	ctx context.Context,
+	client acmClient,
+	clusterIDResolver tokens.ClusterResolver,
+) ([]*tokens.InternalRole, error) {
+	// Retrieve all user permissions from ACM
+	userPermissionList, err := client.ListUserPermissions(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to list user permissions")
+	}
+	if userPermissionList == nil {
+		return nil, errors.New("received nil user permission list from ACM")
+	}
+
+	// Filter to only permissions managing supported Kubernetes resources
+	filteredPermissions := FilterUserPermissionsForSupportedK8sResources(userPermissionList.Items)
+
+	// Convert each filtered UserPermission to a ResolvedRole
+	resolvedRoles := make([]*tokens.InternalRole, 0, len(filteredPermissions))
+	for _, userPermission := range filteredPermissions {
+		// Convert ClusterRoleDefinition to PermissionSet
+		permissionSet := ConvertClusterRoleToPermissionSet(userPermission.Status.ClusterRoleDefinition)
+
+		// Convert Bindings to SimpleAccessScope
+		accessScope := ConvertBindingsToSimpleAccessScope(userPermission.Status.Bindings)
+
+		resolvedRole, roleErr := tokens.NewInternalRoleFromPermissionsAndScope(
+			ctx,
+			userPermission.Name,
+			permissionSet,
+			accessScope,
+			clusterIDResolver,
+		)
+		if roleErr != nil {
+			return nil, errors.Wrap(roleErr, "failed to create role")
+		}
+		resolvedRoles = append(resolvedRoles, resolvedRole)
+	}
+	return resolvedRoles, nil
+}
diff --git a/pkg/sac/externalrolebroker/acm_resolver_test.go b/pkg/sac/externalrolebroker/acm_resolver_test.go
new file mode 100644
index 0000000000000..6b8b43d3489f6
--- /dev/null
+++ b/pkg/sac/externalrolebroker/acm_resolver_test.go
@@ -0,0 +1,314 @@
+package externalrolebroker
+
+import (
+	"context"
+	"testing"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/sac/resources"
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// mockACMClient is a test implementation of acmClient.
+type mockACMClient struct {
+	listFunc func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error)
+}
+
+func (m *mockACMClient) ListUserPermissions(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error) {
+	return m.listFunc(ctx, opts)
+}
+
+type mockClusterResolver struct{}
+
+func (m *mockClusterResolver) GetClusterID(_ context.Context, clusterName string) (string, bool, error) {
+	return clusterName, true, nil
+}
+
+func TestGetResolvedRolesFromACM(t *testing.T) {
+	tests := map[string]struct {
+		mockListFunc      func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error)
+		expectedRoleCount int
+		expectedError     bool
+		validateRoles     func(t *testing.T, roles []permissions.ResolvedRole)
+	}{
+		"empty list": {
+			mockListFunc: func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error) {
+				return &clusterviewv1alpha1.UserPermissionList{
+					Items: []clusterviewv1alpha1.UserPermission{},
+				}, nil
+			},
+			expectedRoleCount: 0,
+			expectedError:     false,
+		},
+		"list with no base k8s resources": {
+			mockListFunc: func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error) {
+				return &clusterviewv1alpha1.UserPermissionList{
+					Items: []clusterviewv1alpha1.UserPermission{
+						{
+							ObjectMeta: metav1.ObjectMeta{
+								Name: "non-base-permission",
+							},
+							Status: clusterviewv1alpha1.UserPermissionStatus{
+								ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+									Rules: []rbacv1.PolicyRule{
+										{
+											APIGroups: []string{"apps"},
+											Resources: []string{"deployments", "statefulsets"},
+											Verbs:     []string{"get", "list"},
+										},
+									},
+								},
+								Bindings: []clusterviewv1alpha1.ClusterBinding{
+									{
+										Cluster:    "cluster-1",
+										Scope:      clusterviewv1alpha1.BindingScopeCluster,
+										Namespaces: []string{"*"},
+									},
+								},
+							},
+						},
+					},
+				}, nil
+			},
+			expectedRoleCount: 0,
+			expectedError:     false,
+		},
+		"list with base k8s resources": {
+			mockListFunc: func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error) {
+				return &clusterviewv1alpha1.UserPermissionList{
+					Items: []clusterviewv1alpha1.UserPermission{
+						{
+							ObjectMeta: metav1.ObjectMeta{
+								Name: "secrets-reader",
+							},
+							Status: clusterviewv1alpha1.UserPermissionStatus{
+								ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+									Rules: []rbacv1.PolicyRule{
+										{
+											APIGroups: []string{""},
+											Resources: []string{"secrets"},
+											Verbs:     []string{"get", "list"},
+										},
+									},
+								},
+								Bindings: []clusterviewv1alpha1.ClusterBinding{
+									{
+										Cluster:    "cluster-1",
+										Scope:      clusterviewv1alpha1.BindingScopeCluster,
+										Namespaces: []string{"*"},
+									},
+								},
+							},
+						},
+					},
+				}, nil
+			},
+			expectedRoleCount: 1,
+			expectedError:     false,
+			validateRoles: func(t *testing.T, roles []permissions.ResolvedRole) {
+				require.Len(t, roles, 1)
+				role := roles[0]
+
+				// Verify role name
+				assert.Equal(t, "secrets-reader", role.GetRoleName())
+
+				// Verify permissions
+				permissions := role.GetPermissions()
+				require.NotNil(t, permissions)
+				assert.Equal(t, storage.Access_READ_ACCESS, permissions[string(resources.Secret.GetResource())])
+
+				// Verify access scope
+				accessScope := role.GetAccessScope()
+				require.NotNil(t, accessScope)
+				assert.Contains(t, accessScope.GetRules().GetIncludedClusterIds(), "cluster-1")
+				assert.Empty(t, accessScope.GetRules().GetIncludedNamespaces())
+			},
+		},
+		"multiple permissions with different access levels": {
+			mockListFunc: func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error) {
+				return &clusterviewv1alpha1.UserPermissionList{
+					Items: []clusterviewv1alpha1.UserPermission{
+						{
+							ObjectMeta: metav1.ObjectMeta{
+								Name: "namespace-reader",
+							},
+							Status: clusterviewv1alpha1.UserPermissionStatus{
+								ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+									Rules: []rbacv1.PolicyRule{
+										{
+											APIGroups: []string{""},
+											Resources: []string{"namespaces"},
+											Verbs:     []string{"get", "list"},
+										},
+									},
+								},
+								Bindings: []clusterviewv1alpha1.ClusterBinding{
+									{
+										Cluster:    "cluster-a",
+										Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+										Namespaces: []string{"default", "kube-system"},
+									},
+								},
+							},
+						},
+						{
+							ObjectMeta: metav1.ObjectMeta{
+								Name: "secrets-admin",
+							},
+							Status: clusterviewv1alpha1.UserPermissionStatus{
+								ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+									Rules: []rbacv1.PolicyRule{
+										{
+											APIGroups: []string{""},
+											Resources: []string{"secrets"},
+											Verbs:     []string{"*"},
+										},
+									},
+								},
+								Bindings: []clusterviewv1alpha1.ClusterBinding{
+									{
+										Cluster:    "cluster-b",
+										Scope:      clusterviewv1alpha1.BindingScopeCluster,
+										Namespaces: []string{"*"},
+									},
+								},
+							},
+						},
+					},
+				}, nil
+			},
+			expectedRoleCount: 2,
+			expectedError:     false,
+			validateRoles: func(t *testing.T, roles []permissions.ResolvedRole) {
+				require.Len(t, roles, 2)
+
+				// Verify first role (namespace-reader)
+				var namespaceReader, secretsAdmin permissions.ResolvedRole
+				for _, role := range roles {
+					if role.GetRoleName() == "namespace-reader" {
+						namespaceReader = role
+					} else if role.GetRoleName() == "secrets-admin" {
+						secretsAdmin = role
+					}
+				}
+
+				require.NotNil(t, namespaceReader)
+				assert.Equal(t, storage.Access_READ_ACCESS,
+					namespaceReader.GetPermissions()[string(resources.Namespace.GetResource())])
+				assert.Len(t, namespaceReader.GetAccessScope().GetRules().GetIncludedNamespaces(), 2)
+
+				require.NotNil(t, secretsAdmin)
+				assert.Equal(t, storage.Access_READ_WRITE_ACCESS,
+					secretsAdmin.GetPermissions()[string(resources.Secret.GetResource())])
+				assert.Contains(t, secretsAdmin.GetAccessScope().GetRules().GetIncludedClusterIds(), "cluster-b")
+			},
+		},
+		"acm client returns error": {
+			mockListFunc: func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error) {
+				return nil, errors.New("ACM API unavailable")
+			},
+			expectedRoleCount: 0,
+			expectedError:     true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			client := &mockACMClient{
+				listFunc: tc.mockListFunc,
+			}
+
+			roles, err := GetResolvedRolesFromACM(context.Background(), client, &mockClusterResolver{})
+
+			if tc.expectedError {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Len(t, roles, tc.expectedRoleCount)
+
+			if tc.validateRoles != nil {
+				resolvedRoles := make([]permissions.ResolvedRole, 0, len(roles))
+				for _, role := range roles {
+					resolvedRoles = append(resolvedRoles, role)
+				}
+				tc.validateRoles(t, resolvedRoles)
+			}
+		})
+	}
+}
+
+func TestGetResolvedRolesFromACM_IntegrationExample(t *testing.T) {
+	// This test demonstrates the full integration of all conversion functions
+	client := &mockACMClient{
+		listFunc: func(ctx context.Context, opts metav1.ListOptions) (*clusterviewv1alpha1.UserPermissionList, error) {
+			return &clusterviewv1alpha1.UserPermissionList{
+				Items: []clusterviewv1alpha1.UserPermission{
+					{
+						ObjectMeta: metav1.ObjectMeta{
+							Name: "rbac-admin",
+						},
+						Status: clusterviewv1alpha1.UserPermissionStatus{
+							ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+								Rules: []rbacv1.PolicyRule{
+									{
+										APIGroups: []string{""},
+										Resources: []string{"namespaces", "secrets", "serviceaccounts"},
+										Verbs:     []string{"get", "list", "create", "update"},
+									},
+									{
+										APIGroups: []string{"rbac.authorization.k8s.io"},
+										Resources: []string{"roles", "rolebindings"},
+										Verbs:     []string{"*"},
+									},
+								},
+							},
+							Bindings: []clusterviewv1alpha1.ClusterBinding{
+								{
+									Cluster:    "prod-cluster",
+									Scope:      clusterviewv1alpha1.BindingScopeCluster,
+									Namespaces: []string{"*"},
+								},
+								{
+									Cluster:    "dev-cluster",
+									Scope:      clusterviewv1alpha1.BindingScopeNamespace,
+									Namespaces: []string{"team-a", "team-b"},
+								},
+							},
+						},
+					},
+				},
+			}, nil
+		},
+	}
+
+	roles, err := GetResolvedRolesFromACM(context.Background(), client, &mockClusterResolver{})
+
+	require.NoError(t, err)
+	require.Len(t, roles, 1)
+
+	role := roles[0]
+	assert.Equal(t, "rbac-admin", role.GetRoleName())
+
+	// Verify all 5 base resources have permissions
+	perms := role.GetPermissions()
+	assert.Len(t, perms, 5)
+	assert.Equal(t, storage.Access_READ_WRITE_ACCESS, perms[string(resources.Namespace.GetResource())])
+	assert.Equal(t, storage.Access_READ_WRITE_ACCESS, perms[string(resources.Secret.GetResource())])
+	assert.Equal(t, storage.Access_READ_WRITE_ACCESS, perms[string(resources.ServiceAccount.GetResource())])
+	assert.Equal(t, storage.Access_READ_WRITE_ACCESS, perms[string(resources.K8sRole.GetResource())])
+	assert.Equal(t, storage.Access_READ_WRITE_ACCESS, perms[string(resources.K8sRoleBinding.GetResource())])
+
+	// Verify access scope includes cluster and namespaces
+	scope := role.GetAccessScope()
+	require.NotNil(t, scope)
+	assert.Contains(t, scope.GetRules().GetIncludedClusterIds(), "prod-cluster")
+	assert.Len(t, scope.GetRules().GetIncludedNamespaces(), 2)
+}
diff --git a/pkg/sac/externalrolebroker/filter.go b/pkg/sac/externalrolebroker/filter.go
new file mode 100644
index 0000000000000..cb6885bf8bacd
--- /dev/null
+++ b/pkg/sac/externalrolebroker/filter.go
@@ -0,0 +1,82 @@
+package externalrolebroker
+
+import (
+	"slices"
+	"strings"
+
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	rbacv1 "k8s.io/api/rbac/v1"
+)
+
+const rbacWildcard = "*"
+
+// FilterUserPermissionsForSupportedK8sResources filters a list of UserPermission objects
+// to return only those that reference resources supported by ACS
+// (some core Kubernetes resources, some Kubernetes RBAC resources and Stackrox API resources).
+//
+// A UserPermission is included if its ClusterRoleDefinition contains at least one PolicyRule
+// that references one or more of the supported resources with matching API groups.
+func FilterUserPermissionsForSupportedK8sResources(
+	permissions []clusterviewv1alpha1.UserPermission,
+) []clusterviewv1alpha1.UserPermission {
+	filtered := make([]clusterviewv1alpha1.UserPermission, 0, len(permissions))
+
+	for _, permission := range permissions {
+		if slices.ContainsFunc(
+			permission.Status.ClusterRoleDefinition.Rules,
+			ruleHasSupportedK8sResource,
+		) {
+			filtered = append(filtered, permission)
+		}
+	}
+
+	return filtered
+}
+
+// ruleHasSupportedK8sResource checks if a PolicyRule includes any of
+// the supported Kubernetes resources (a resource here is considered
+// with the API group it belongs to).
+//
+// This function supports wildcards ("*") in the policy rule.
+func ruleHasSupportedK8sResource(rule rbacv1.PolicyRule) bool {
+	// Handle empty APIGroups - no match
+	if len(rule.APIGroups) == 0 {
+		return false
+	}
+	if len(rule.ResourceNames) > 0 {
+		return false
+	}
+	for _, resource := range rule.Resources {
+		baseResource := getBaseResourceFromResource(resource)
+		for _, apiGroup := range rule.APIGroups {
+			if isSupportedResourceInAPIGroup(baseResource, apiGroup) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func isSupportedResourceInAPIGroup(resource string, apiGroup string) bool {
+	if resource == rbacWildcard && apiGroup == rbacWildcard {
+		return true
+	}
+	if apiGroup == rbacWildcard {
+		return supportedK8sRawResources.Contains(resource)
+	}
+	if resource == rbacWildcard {
+		return supportedK8sAPIGroups.Contains(apiGroup)
+	}
+	resourceWithApiGroup := strings.Join([]string{resource, apiGroup}, ".")
+	if _, found := resourceMapping[resourceWithApiGroup]; found {
+		return true
+	}
+	return false
+}
+
+func getBaseResourceFromResource(resource string) string {
+	if prefix, _, found := strings.Cut(resource, "/"); found {
+		return prefix
+	}
+	return resource
+}
diff --git a/pkg/sac/externalrolebroker/filter_test.go b/pkg/sac/externalrolebroker/filter_test.go
new file mode 100644
index 0000000000000..8b3a1eb57dd1f
--- /dev/null
+++ b/pkg/sac/externalrolebroker/filter_test.go
@@ -0,0 +1,520 @@
+package externalrolebroker
+
+import (
+	"testing"
+
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	"github.com/stretchr/testify/assert"
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestFilterUserPermissionsForSupportedK8sResources(t *testing.T) {
+	tests := map[string]struct {
+		permissions []clusterviewv1alpha1.UserPermission
+		expected    int
+	}{
+		"empty list": {
+			permissions: []clusterviewv1alpha1.UserPermission{},
+			expected:    0,
+		},
+		"permission with namespace access": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-1", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"namespaces"},
+						Verbs:     []string{"get", "list"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with secret access": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-2", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"get", "list", "create"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with role and rolebinding access": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-3", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"roles", "rolebindings"},
+						Verbs:     []string{"get", "list", "create", "update", "delete"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with clusterrole and clusterrolebinding access": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-3b", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"clusterroles", "clusterrolebindings"},
+						Verbs:     []string{"get", "list", "create", "update", "delete"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with serviceaccount access": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-4", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"serviceaccounts"},
+						Verbs:     []string{"get", "list"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with wildcard resources in core group": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-5", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"*"},
+						Verbs:     []string{"*"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with wildcard apiGroups": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-6", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"*"},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"get"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with non-base resources only": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-7", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"apps"},
+						Resources: []string{"deployments", "statefulsets"},
+						Verbs:     []string{"get", "list"},
+					},
+				}),
+			},
+			expected: 0,
+		},
+		"permission with pods only (not a base resource)": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("test-8", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"pods"},
+						Verbs:     []string{"get", "list"},
+					},
+				}),
+			},
+			expected: 0,
+		},
+		"mixed permissions - some match, some don't": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("match-1", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"get"},
+					},
+				}),
+				makeUserPermission("no-match-1", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"apps"},
+						Resources: []string{"deployments"},
+						Verbs:     []string{"get"},
+					},
+				}),
+				makeUserPermission("match-2", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"roles"},
+						Verbs:     []string{"create"},
+					},
+				}),
+				makeUserPermission("no-match-2", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"configmaps"},
+						Verbs:     []string{"get"},
+					},
+				}),
+			},
+			expected: 2,
+		},
+		"permission with multiple rules - one matches": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("multi-rule", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"apps"},
+						Resources: []string{"deployments"},
+						Verbs:     []string{"get"},
+					},
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"}, // This one matches
+						Verbs:     []string{"get"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with subresources": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("subresource", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets/status"}, // Should still match "secrets"
+						Verbs:     []string{"get"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with empty APIGroups": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("empty-apigroups", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"get"},
+					},
+				}),
+			},
+			expected: 0,
+		},
+		"permission with all base resources": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("all-base", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"namespaces", "secrets", "serviceaccounts"},
+						Verbs:     []string{"get", "list"},
+					},
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"roles", "rolebindings"},
+						Verbs:     []string{"get", "list"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with StackRox API alert access": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("stackrox-alert", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"alerts"},
+						Verbs:     []string{"get", "list"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with StackRox API deployment access": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("stackrox-deployment", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"deployments"},
+						Verbs:     []string{"get", "list", "create"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with multiple StackRox API resources": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("stackrox-multi", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"compliances", "detections", "networkgraphs"},
+						Verbs:     []string{"get", "list"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with vulnerability management resources": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("stackrox-vuln", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"vulnerabilitymanagementrequests", "vulnerabilitymanagementapprovals"},
+						Verbs:     []string{"get", "list", "create"},
+					},
+				}),
+			},
+			expected: 1,
+		},
+		"permission with StackRox API wrong API group": {
+			permissions: []clusterviewv1alpha1.UserPermission{
+				makeUserPermission("wrong-apigroup", []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"apps"},
+						Resources: []string{"alerts"},
+						Verbs:     []string{"get"},
+					},
+				}),
+			},
+			expected: 0,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			result := FilterUserPermissionsForSupportedK8sResources(tc.permissions)
+			assert.Len(t, result, tc.expected, "Expected %d permissions to be filtered, got %d", tc.expected, len(result))
+		})
+	}
+}
+
+func TestRuleHasSupportedK8sResource(t *testing.T) {
+	tests := map[string]struct {
+		rule     rbacv1.PolicyRule
+		expected bool
+	}{
+		"core API group with namespace": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"namespaces"},
+			},
+			expected: true,
+		},
+		"core API group with secret": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"secrets"},
+			},
+			expected: true,
+		},
+		"core API group with serviceaccount": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"serviceaccounts"},
+			},
+			expected: true,
+		},
+		"rbac API group with role": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"roles"},
+			},
+			expected: true,
+		},
+		"rbac API group with rolebinding": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"rolebindings"},
+			},
+			expected: true,
+		},
+		"rbac API group with clusterrole": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"clusterroles"},
+			},
+			expected: true,
+		},
+		"rbac API group with clusterrolebinding": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"clusterrolebindings"},
+			},
+			expected: true,
+		},
+		"wildcard API group with configured resource": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"*"},
+				Resources: []string{"secrets"},
+			},
+			expected: true,
+		},
+		"wildcard resource with core API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"*"},
+			},
+			expected: true,
+		},
+		"wildcard resource with rbac API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"*"},
+			},
+			expected: true,
+		},
+		"wildcard resource and API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"*"},
+				Resources: []string{"*"},
+			},
+			expected: true,
+		},
+		"non-configured resource": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"pods"},
+			},
+			expected: false,
+		},
+		"wrong API group for resource": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"apps"},
+				Resources: []string{"secrets"},
+			},
+			expected: false,
+		},
+		"rbac resource with wrong API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"roles"},
+			},
+			expected: false,
+		},
+		"core resource with wrong API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"secrets"},
+			},
+			expected: false,
+		},
+		"empty API groups": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{},
+				Resources: []string{"secrets"},
+			},
+			expected: false,
+		},
+		"subresource for secrets with correct API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"secrets/status"},
+			},
+			expected: true,
+		},
+		"multiple API groups with one matching": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"apps", ""},
+				Resources: []string{"secrets"},
+			},
+			expected: true,
+		},
+		"multiple resources with one configured": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{"pods", "secrets", "configmaps"},
+			},
+			expected: true,
+		},
+		"empty resources": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{""},
+				Resources: []string{},
+			},
+			expected: false,
+		},
+		"StackRox API group with alert": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"alerts"},
+			},
+			expected: true,
+		},
+		"StackRox API group with deployment": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"deployments"},
+			},
+			expected: true,
+		},
+		"StackRox API group with compliance": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"compliance"},
+			},
+			expected: true,
+		},
+		"StackRox API group with detection": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"detection"},
+			},
+			expected: true,
+		},
+		"StackRox API group with networkgraph": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"networkgraphs"},
+			},
+			expected: true,
+		},
+		"StackRox API group with vulnerabilitymanagementrequest": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"vulnerabilitymanagementrequests"},
+			},
+			expected: true,
+		},
+		"StackRox API group with vulnerabilitymanagementapproval": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"vulnerabilitymanagementapprovals"},
+			},
+			expected: true,
+		},
+		"StackRox API resources with wrong API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"apps"},
+				Resources: []string{"alerts"},
+			},
+			expected: false,
+		},
+		"wildcard resource with StackRox API group": {
+			rule: rbacv1.PolicyRule{
+				APIGroups: []string{"api.stackrox.io"},
+				Resources: []string{"*"},
+			},
+			expected: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			result := ruleHasSupportedK8sResource(tc.rule)
+			assert.Equal(t, tc.expected, result)
+		})
+	}
+}
+
+// Helper function to create a UserPermission with given rules
+func makeUserPermission(name string, rules []rbacv1.PolicyRule) clusterviewv1alpha1.UserPermission {
+	return clusterviewv1alpha1.UserPermission{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Status: clusterviewv1alpha1.UserPermissionStatus{
+			ClusterRoleDefinition: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: rules,
+			},
+		},
+	}
+}
diff --git a/pkg/sac/externalrolebroker/permission_set_builder.go b/pkg/sac/externalrolebroker/permission_set_builder.go
new file mode 100644
index 0000000000000..9ec33ea44f94f
--- /dev/null
+++ b/pkg/sac/externalrolebroker/permission_set_builder.go
@@ -0,0 +1,155 @@
+package externalrolebroker
+
+import (
+	"strings"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/set"
+	"github.com/stackrox/rox/pkg/uuid"
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+)
+
+var (
+	// Kubernetes verbs that map to READ_ACCESS
+	readVerbs = set.NewFrozenStringSet(
+		"get",
+		"list",
+		"watch",
+	)
+
+	// Kubernetes verbs that map to READ_WRITE_ACCESS
+	writeVerbs = set.NewFrozenStringSet(
+		"create",
+		"delete",
+		"deletecollection",
+		"patch",
+		"update",
+	)
+)
+
+// ConvertClusterRoleToPermissionSet converts the rules within a ClusterRoleDefinition
+// to a storage.PermissionSet.
+//
+// The function maps:
+//
+//   - Core Kubernetes resources (namespaces, secrets, serviceaccounts) to their ACS equivalents
+//
+//   - RBAC resources (roles, clusterroles, rolebindings, clusterrolebindings) to their ACS equivalents
+//
+//   - Stackrox API resources (*.api.stackrox.io) to their ACS equivalents
+//
+//   - Read verbs (get, list, watch) to storage.Access_READ_ACCESS
+//
+//   - Write verbs (create, update, patch, delete, deletecollection) to storage,Access_READ_WRITE_ACCESS
+//
+//   - Wildcard verbs (*) to storage.Access_READ_WRITE_ACCESS (most permissive)
+//
+// Only supported resources that have ACS equivalents are included in the results.
+// The returned PermissionSet has a generated ID and an empty name/description
+func ConvertClusterRoleToPermissionSet(
+	clusterRoleDef clusterviewv1alpha1.ClusterRoleDefinition,
+) *storage.PermissionSet {
+	resourceToAccess := make(map[string]storage.Access)
+
+	for _, rule := range clusterRoleDef.Rules {
+		if len(rule.APIGroups) == 0 {
+			continue
+		}
+		// PermissionSet cannot represent name-scoped access, so skip these
+		// to avoid granting broader access than the rule intended.
+		if len(rule.ResourceNames) > 0 {
+			continue
+		}
+
+		access := computeAccessLevel(rule.Verbs)
+
+		for _, k8sResource := range rule.Resources {
+			// Subresource rules (e.g. "secrets/status") are narrower than
+			// base-resource rules; PermissionSet cannot represent that scope,
+			// so skip them to avoid granting broader access.
+			if strings.Contains(k8sResource, "/") {
+				continue
+			}
+			for _, apiGroup := range rule.APIGroups {
+				grantMatchingResources(resourceToAccess, k8sResource, apiGroup, access)
+			}
+		}
+	}
+
+	return &storage.PermissionSet{
+		Id:               uuid.NewV4().String(),
+		ResourceToAccess: resourceToAccess,
+	}
+}
+
+// grantMatchingResources finds all resourceMapping entries matching the
+// resource/apiGroup pair (supporting wildcards in either dimension) and
+// grants the given access level to each.
+func grantMatchingResources(
+	accessMapping map[string]storage.Access,
+	resource string, apiGroup string,
+	access storage.Access,
+) {
+	if resource == rbacWildcard || apiGroup == rbacWildcard {
+		for key, acsResource := range resourceMapping {
+			mappedResource, mappedGroup, _ := strings.Cut(key, ".")
+			if (resource == rbacWildcard || resource == mappedResource) &&
+				(apiGroup == rbacWildcard || apiGroup == mappedGroup) {
+				grantAccessToResource(accessMapping, acsResource, access)
+			}
+		}
+		return
+	}
+	if acsResource, found := resourceMapping[qualifiedResource(resource, apiGroup)]; found {
+		grantAccessToResource(accessMapping, acsResource, access)
+	}
+}
+
+func grantAccessToResource(
+	accessMapping map[string]storage.Access,
+	acsResource permissions.ResourceMetadata,
+	access storage.Access,
+) {
+	key := string(acsResource.GetResource())
+	if oldAccess, found := accessMapping[key]; found {
+		if oldAccess < access {
+			accessMapping[key] = access
+		}
+	} else {
+		accessMapping[key] = access
+	}
+}
+
+func qualifiedResource(k8sResource string, apiGroup string) string {
+	return strings.Join([]string{k8sResource, apiGroup}, ".")
+}
+
+func computeAccessLevel(verbs []string) storage.Access {
+	hasRead := false
+	hasWrite := false
+
+	for _, verb := range verbs {
+		// Wildcard grants full access
+		if verb == rbacWildcard {
+			return storage.Access_READ_WRITE_ACCESS
+		}
+
+		if readVerbs.Contains(verb) {
+			hasRead = true
+		}
+		if writeVerbs.Contains(verb) {
+			hasWrite = true
+		}
+	}
+	// If any write verb is present, grant READ_WRITE_ACCESS
+	if hasWrite {
+		return storage.Access_READ_WRITE_ACCESS
+	}
+	// If only read verbs are present, grant READ_ACCESS
+	if hasRead {
+		return storage.Access_READ_ACCESS
+	}
+	// If no recognized read or write verb, grant NO_ACCESS
+	return storage.Access_NO_ACCESS
+}
diff --git a/pkg/sac/externalrolebroker/permission_set_builder_test.go b/pkg/sac/externalrolebroker/permission_set_builder_test.go
new file mode 100644
index 0000000000000..9ea0bc8b6950a
--- /dev/null
+++ b/pkg/sac/externalrolebroker/permission_set_builder_test.go
@@ -0,0 +1,525 @@
+package externalrolebroker
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/sac/resources"
+	clusterviewv1alpha1 "github.com/stolostron/cluster-lifecycle-api/clusterview/v1alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	rbacv1 "k8s.io/api/rbac/v1"
+)
+
+func TestConvertClusterRoleToPermissionSet(t *testing.T) {
+	tests := map[string]struct {
+		clusterRoleDef      clusterviewv1alpha1.ClusterRoleDefinition
+		expectedPermissions map[string]storage.Access
+		unexpectedResources []string
+		minPermissionCount  int
+	}{
+		"read-only namespace access": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"namespaces"},
+						Verbs:     []string{"get", "list", "watch"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Namespace.GetResource()): storage.Access_READ_ACCESS,
+			},
+		},
+		"write access to secrets": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"create", "update", "delete"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Secret.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"read and write access to roles": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"roles"},
+						Verbs:     []string{"get", "list", "create", "update"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.K8sRole.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"read-only access to clusterroles": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"clusterroles"},
+						Verbs:     []string{"get", "list", "watch"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.K8sRole.GetResource()): storage.Access_READ_ACCESS,
+			},
+		},
+		"read and write access to clusterrolebindings": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"clusterrolebindings"},
+						Verbs:     []string{"*"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.K8sRoleBinding.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"multiple resources with different access levels": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"namespaces"},
+						Verbs:     []string{"get", "list"},
+					},
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"create", "delete"},
+					},
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"roles", "rolebindings"},
+						Verbs:     []string{"get", "list", "watch"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Namespace.GetResource()):      storage.Access_READ_ACCESS,
+				string(resources.Secret.GetResource()):         storage.Access_READ_WRITE_ACCESS,
+				string(resources.K8sRole.GetResource()):        storage.Access_READ_ACCESS,
+				string(resources.K8sRoleBinding.GetResource()): storage.Access_READ_ACCESS,
+			},
+		},
+		"wildcard verbs grant full access": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"*"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Secret.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"wildcard resources grant access to all base resources": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"*"},
+						Resources: []string{"*"},
+						Verbs:     []string{"get", "list"},
+					},
+				},
+			},
+			minPermissionCount: 5, // All 5 base resources
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Namespace.GetResource()):      storage.Access_READ_ACCESS,
+				string(resources.Secret.GetResource()):         storage.Access_READ_ACCESS,
+				string(resources.ServiceAccount.GetResource()): storage.Access_READ_ACCESS,
+				string(resources.K8sRole.GetResource()):        storage.Access_READ_ACCESS,
+				string(resources.K8sRoleBinding.GetResource()): storage.Access_READ_ACCESS,
+			},
+		},
+		"subresource rules produce no access": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets/status"},
+						Verbs:     []string{"get", "update"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{},
+		},
+		"non-base resources are ignored": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"apps"},
+						Resources: []string{"deployments", "statefulsets"},
+						Verbs:     []string{"get", "list", "create"},
+					},
+					{
+						APIGroups: []string{""},
+						Resources: []string{"pods", "configmaps"},
+						Verbs:     []string{"get", "list"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{},
+		},
+		"mixed base and non-base resources": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"pods", "secrets", "configmaps"},
+						Verbs:     []string{"get", "list"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Secret.GetResource()): storage.Access_READ_ACCESS,
+			},
+			unexpectedResources: []string{"Pod", "ConfigMap"},
+		},
+		"escalating permissions on same resource": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"get", "list"},
+					},
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"create", "delete"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Secret.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"all base resources with full access": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"namespaces", "secrets", "serviceaccounts"},
+						Verbs:     []string{"*"},
+					},
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"roles", "rolebindings"},
+						Verbs:     []string{"*"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Namespace.GetResource()):      storage.Access_READ_WRITE_ACCESS,
+				string(resources.Secret.GetResource()):         storage.Access_READ_WRITE_ACCESS,
+				string(resources.ServiceAccount.GetResource()): storage.Access_READ_WRITE_ACCESS,
+				string(resources.K8sRole.GetResource()):        storage.Access_READ_WRITE_ACCESS,
+				string(resources.K8sRoleBinding.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"unknown verbs grant no access": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{""},
+						Resources: []string{"secrets"},
+						Verbs:     []string{"unknown", "invalid"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Secret.GetResource()): storage.Access_NO_ACCESS,
+			},
+		},
+		"empty rules": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{},
+			},
+			expectedPermissions: map[string]storage.Access{},
+		},
+		"rules with wrong API group are ignored": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"apps"},
+						Resources: []string{"secrets"}, // Right resource, wrong API group
+						Verbs:     []string{"get"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{},
+		},
+		"read-only access to alerts": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"alerts"},
+						Verbs:     []string{"get", "list", "watch"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Alert.GetResource()): storage.Access_READ_ACCESS,
+			},
+		},
+		"read-write access to deployments": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"deployments"},
+						Verbs:     []string{"get", "list", "create", "update", "delete"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Deployment.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"access to multiple StackRox API resources": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"compliance", "detection"},
+						Verbs:     []string{"get", "list"},
+					},
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"networkgraphs"},
+						Verbs:     []string{"*"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Compliance.GetResource()):   storage.Access_READ_ACCESS,
+				string(resources.Detection.GetResource()):    storage.Access_READ_ACCESS,
+				string(resources.NetworkGraph.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"access to vulnerability management resources": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"api.stackrox.io"},
+						Resources: []string{"vulnerabilitymanagementrequests", "vulnerabilitymanagementapprovals"},
+						Verbs:     []string{"get", "list", "create"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.VulnerabilityManagementRequests.GetResource()):  storage.Access_READ_WRITE_ACCESS,
+				string(resources.VulnerabilityManagementApprovals.GetResource()): storage.Access_READ_WRITE_ACCESS,
+			},
+		},
+		"named resource rules produce no access": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups:     []string{""},
+						Resources:     []string{"secrets"},
+						ResourceNames: []string{"my-secret"},
+						Verbs:         []string{"get", "list"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{},
+		},
+		"wildcard resources with specific API group": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"rbac.authorization.k8s.io"},
+						Resources: []string{"*"},
+						Verbs:     []string{"get", "list"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.K8sRole.GetResource()):        storage.Access_READ_ACCESS,
+				string(resources.K8sRoleBinding.GetResource()): storage.Access_READ_ACCESS,
+			},
+		},
+		"specific resource with wildcard API group": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"*"},
+						Resources: []string{"nodes"},
+						Verbs:     []string{"get"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{
+				string(resources.Node.GetResource()): storage.Access_READ_ACCESS,
+			},
+		},
+		"StackRox API resources with wrong API group are ignored": {
+			clusterRoleDef: clusterviewv1alpha1.ClusterRoleDefinition{
+				Rules: []rbacv1.PolicyRule{
+					{
+						APIGroups: []string{"apps"},
+						Resources: []string{"alerts", "deployments"},
+						Verbs:     []string{"get"},
+					},
+				},
+			},
+			expectedPermissions: map[string]storage.Access{},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			permSet := ConvertClusterRoleToPermissionSet(tc.clusterRoleDef)
+
+			// Verify PermissionSet structure
+			require.NotNil(t, permSet)
+			assert.NotEmpty(t, permSet.GetId(), "PermissionSet should have a generated ID")
+			assert.NotNil(t, permSet.GetResourceToAccess())
+
+			// Check minimum permission count if specified
+			if tc.minPermissionCount > 0 {
+				assert.GreaterOrEqual(t, len(permSet.GetResourceToAccess()), tc.minPermissionCount,
+					"Expected at least %d permissions", tc.minPermissionCount)
+			}
+
+			// Verify expected permissions
+			for resource, expectedAccess := range tc.expectedPermissions {
+				actualAccess, exists := permSet.GetResourceToAccess()[resource]
+				assert.True(t, exists, "Expected resource %q to be present", resource)
+				assert.Equal(t, expectedAccess, actualAccess,
+					"Expected %s access for resource %q, got %s",
+					expectedAccess, resource, actualAccess)
+			}
+
+			// Verify unexpected resources are not present
+			for _, resource := range tc.unexpectedResources {
+				_, exists := permSet.GetResourceToAccess()[resource]
+				assert.False(t, exists, "Did not expect resource %q to be present", resource)
+			}
+
+			// If no min count is specified, verify exact match (including empty).
+			if tc.minPermissionCount == 0 {
+				assert.Len(t, permSet.GetResourceToAccess(), len(tc.expectedPermissions),
+					"Expected exactly %d permissions", len(tc.expectedPermissions))
+			}
+		})
+	}
+}
+
+func TestComputeAccessLevel(t *testing.T) {
+	tests := map[string]struct {
+		verbs          []string
+		expectedAccess storage.Access
+	}{
+		"read-only verbs": {
+			verbs:          []string{"get", "list", "watch"},
+			expectedAccess: storage.Access_READ_ACCESS,
+		},
+		"write verbs": {
+			verbs:          []string{"create", "update", "delete"},
+			expectedAccess: storage.Access_READ_WRITE_ACCESS,
+		},
+		"mixed read and write verbs": {
+			verbs:          []string{"get", "list", "create"},
+			expectedAccess: storage.Access_READ_WRITE_ACCESS,
+		},
+		"wildcard verb": {
+			verbs:          []string{"*"},
+			expectedAccess: storage.Access_READ_WRITE_ACCESS,
+		},
+		"wildcard with other verbs": {
+			verbs:          []string{"get", "*", "list"},
+			expectedAccess: storage.Access_READ_WRITE_ACCESS,
+		},
+		"patch verb": {
+			verbs:          []string{"patch"},
+			expectedAccess: storage.Access_READ_WRITE_ACCESS,
+		},
+		"deletecollection verb": {
+			verbs:          []string{"deletecollection"},
+			expectedAccess: storage.Access_READ_WRITE_ACCESS,
+		},
+		"unknown verbs": {
+			verbs:          []string{"unknown", "invalid"},
+			expectedAccess: storage.Access_NO_ACCESS,
+		},
+		"empty verbs": {
+			verbs:          []string{},
+			expectedAccess: storage.Access_NO_ACCESS,
+		},
+		"only get": {
+			verbs:          []string{"get"},
+			expectedAccess: storage.Access_READ_ACCESS,
+		},
+		"only create": {
+			verbs:          []string{"create"},
+			expectedAccess: storage.Access_READ_WRITE_ACCESS,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			access := computeAccessLevel(tc.verbs)
+			assert.Equal(t, tc.expectedAccess, access,
+				"Expected %s for verbs %v, got %s",
+				tc.expectedAccess, tc.verbs, access)
+		})
+	}
+}
+
+func TestConvertClusterRoleToPermissionSet_Integration(t *testing.T) {
+	// This test simulates a realistic cluster-admin-like role
+	clusterRoleDef := clusterviewv1alpha1.ClusterRoleDefinition{
+		Rules: []rbacv1.PolicyRule{
+			{
+				APIGroups: []string{""},
+				Resources: []string{"namespaces", "secrets", "serviceaccounts"},
+				Verbs:     []string{"get", "list", "watch", "create", "update", "patch", "delete"},
+			},
+			{
+				APIGroups: []string{"rbac.authorization.k8s.io"},
+				Resources: []string{"roles", "rolebindings"},
+				Verbs:     []string{"get", "list", "watch", "create", "update", "patch", "delete"},
+			},
+		},
+	}
+
+	permSet := ConvertClusterRoleToPermissionSet(clusterRoleDef)
+
+	require.NotNil(t, permSet)
+	assert.NotEmpty(t, permSet.GetId())
+	assert.Len(t, permSet.GetResourceToAccess(), 5, "Should have all 5 base resources")
+
+	// All resources should have READ_WRITE_ACCESS
+	for _, resource := range []string{
+		string(resources.Namespace.GetResource()),
+		string(resources.Secret.GetResource()),
+		string(resources.ServiceAccount.GetResource()),
+		string(resources.K8sRole.GetResource()),
+		string(resources.K8sRoleBinding.GetResource()),
+	} {
+		access, exists := permSet.GetResourceToAccess()[resource]
+		assert.True(t, exists, "Expected resource %q to exist", resource)
+		assert.Equal(t, storage.Access_READ_WRITE_ACCESS, access,
+			"Expected READ_WRITE_ACCESS for %q", resource)
+	}
+}
diff --git a/pkg/sac/externalrolebroker/resource_mapping.go b/pkg/sac/externalrolebroker/resource_mapping.go
new file mode 100644
index 0000000000000..3e716ca9860c2
--- /dev/null
+++ b/pkg/sac/externalrolebroker/resource_mapping.go
@@ -0,0 +1,62 @@
+package externalrolebroker
+
+import (
+	"strings"
+
+	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/sac/resources"
+	"github.com/stackrox/rox/pkg/set"
+)
+
+var (
+	resourceMapping = map[string]permissions.ResourceMetadata{
+		// Core Kubernetes resources
+		"namespaces.":      resources.Namespace,
+		"nodes.":           resources.Node,
+		"secrets.":         resources.Secret,
+		"serviceaccounts.": resources.ServiceAccount,
+		// Kubernetes RBAC resources
+		"clusterroles.rbac.authorization.k8s.io":        resources.K8sRole,
+		"roles.rbac.authorization.k8s.io":               resources.K8sRole,
+		"clusterrolebindings.rbac.authorization.k8s.io": resources.K8sRoleBinding,
+		"rolebindings.rbac.authorization.k8s.io":        resources.K8sRoleBinding,
+		// Direct resource mapping
+		"accesses.api.stackrox.io":                         resources.Access,
+		"administration.api.stackrox.io":                   resources.Administration,
+		"alerts.api.stackrox.io":                           resources.Alert,
+		"cves.api.stackrox.io":                             resources.CVE,
+		"clusters.api.stackrox.io":                         resources.Cluster,
+		"compliance.api.stackrox.io":                       resources.Compliance,
+		"deployments.api.stackrox.io":                      resources.Deployment,
+		"deploymentextensions.api.stackrox.io":             resources.DeploymentExtension,
+		"detection.api.stackrox.io":                        resources.Detection,
+		"images.api.stackrox.io":                           resources.Image,
+		"imageadministration.api.stackrox.io":              resources.ImageAdministration,
+		"integrations.api.stackrox.io":                     resources.Integration,
+		"k8ssubjects.api.stackrox.io":                      resources.K8sSubject,
+		"networkgraphs.api.stackrox.io":                    resources.NetworkGraph,
+		"networkpolicies.api.stackrox.io":                  resources.NetworkPolicy,
+		"nodes.api.stackrox.io":                            resources.Node,
+		"virtualmachines.api.stackrox.io":                  resources.VirtualMachine,
+		"vulnerabilitymanagementapprovals.api.stackrox.io": resources.VulnerabilityManagementApprovals,
+		"vulnerabilitymanagementrequests.api.stackrox.io":  resources.VulnerabilityManagementRequests,
+		"watchedimages.api.stackrox.io":                    resources.WatchedImage,
+		"workflowadministration.api.stackrox.io":           resources.WorkflowAdministration,
+	}
+
+	supportedK8sAPIGroups, supportedK8sRawResources = listSupportedK8sGroupsAndResources(resourceMapping)
+)
+
+func listSupportedK8sGroupsAndResources(mapping map[string]permissions.ResourceMetadata) (set.StringSet, set.StringSet) {
+	groups := set.NewStringSet()
+	rawResources := set.NewStringSet()
+	for key := range mapping {
+		resource, apiGroup, found := strings.Cut(key, ".")
+		if !found {
+			continue
+		}
+		groups.Add(apiGroup)
+		rawResources.Add(resource)
+	}
+	return groups, rawResources
+}
diff --git a/pkg/sac/externalrolebroker/resource_mapping_test.go b/pkg/sac/externalrolebroker/resource_mapping_test.go
new file mode 100644
index 0000000000000..bd8f88b67efcc
--- /dev/null
+++ b/pkg/sac/externalrolebroker/resource_mapping_test.go
@@ -0,0 +1,23 @@
+package externalrolebroker
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/pkg/auth/permissions"
+	"github.com/stackrox/rox/pkg/sac/resources"
+	"github.com/stackrox/rox/pkg/set"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAllResourcesAreMapped(t *testing.T) {
+	mappedResources := set.NewSet[permissions.Resource]()
+	for _, md := range resourceMapping {
+		mappedResources.Add(md.GetResource())
+	}
+
+	for _, md := range resources.ListAllMetadata() {
+		res := md.GetResource()
+		assert.True(t, mappedResources.Contains(res),
+			"Resource %q is defined in resources.ListAllMetadata() but has no entry in resourceMapping.", res)
+	}
+}
diff --git a/pkg/scanners/scannerv4/convert.go b/pkg/scanners/scannerv4/convert.go
index fab0e4e3d1abe..a4869148a29dd 100644
--- a/pkg/scanners/scannerv4/convert.go
+++ b/pkg/scanners/scannerv4/convert.go
@@ -8,6 +8,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/quay/claircore/rhel/rhcc"
+
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/clair"
@@ -21,19 +23,29 @@ import (
 	"github.com/stackrox/rox/pkg/utils"
 )
 
-// vulnDataSourceDelimiter separates the parts of a vuln's datasource.
-// IMPORTANT: This delimiter was chosen because it does not appear in any known
-// Claircore or StackRox updater names.
-const vulnDataSourceDelimiter = "::"
+const (
+	// vulnDataSourceDelimiter separates the parts of a vuln's datasource.
+	// IMPORTANT: This delimiter was chosen because it does not appear in any known
+	// Claircore or StackRox updater names.
+	vulnDataSourceDelimiter = "::"
+	// redHatVEXUpdaterName identifies vulnerabilities from Claircore's Red Hat VEX updater.
+	redHatVEXUpdaterName = "rhel-vex"
+)
 
 // digitSegment matches contiguous runs of digits for numeric segment comparisons.
 var digitSegment = regexp.MustCompile(`\d+`)
 
 func imageScan(metadata *storage.ImageMetadata, report *v4.VulnerabilityReport, scannerVersion string) *storage.ImageScan {
 	layerSHAToIndex := clair.BuildSHAToIndexMap(metadata)
+	if features.ScannerV4RedHatLayers.Enabled() {
+		filterRedHatLayerVulnerabilities(report, layerSHAToIndex)
+	}
 	if features.ScannerV4RedHatVEXNotAffected.Enabled() {
 		filterNotAffectedVulnerabilities(report, layerSHAToIndex)
 	}
+	if features.ScannerV4SuppressOSVWithRedHatVEX.Enabled() {
+		filterOSVSupersededByRedHatVEX(report, layerSHAToIndex)
+	}
 
 	scan := &storage.ImageScan{
 		ScannerVersion:  scannerVersion,
@@ -47,14 +59,7 @@ func imageScan(metadata *storage.ImageMetadata, report *v4.VulnerabilityReport,
 }
 
 func componentsWithLayerMap(metadata *storage.ImageMetadata, report *v4.VulnerabilityReport, layerSHAToIndex map[string]int32) []*storage.EmbeddedImageScanComponent {
-	pkgs := report.GetContents().GetPackages()
-	if len(pkgs) == 0 {
-		pkgs = make(map[string]*v4.Package, len(report.GetContents().GetPackagesDEPRECATED()))
-		// Fallback to the deprecated slice, if needed.
-		for _, pkg := range report.GetContents().GetPackagesDEPRECATED() {
-			pkgs[pkg.GetId()] = pkg
-		}
-	}
+	pkgs := packagesByID(report.GetContents())
 	// Filter out packages that should not become user-facing components.
 	// Unreferenced source packages are kept defensively.
 	dedupe := features.ScannerV4Dedupe.Enabled()
@@ -146,18 +151,35 @@ func envOS(env *v4.Environment, report *v4.VulnerabilityReport) string {
 	return dist.GetDid() + ":" + dist.GetVersionId()
 }
 
-func environment(report *v4.VulnerabilityReport, id string) *v4.Environment {
+// packagesByID returns the current package map, falling back to the deprecated
+// package list when the map is empty.
+func packagesByID(contents *v4.Contents) map[string]*v4.Package {
+	packages := contents.GetPackages()
+	if len(packages) > 0 {
+		return packages
+	}
+
+	packages = make(map[string]*v4.Package, len(contents.GetPackagesDEPRECATED()))
+	for _, pkg := range contents.GetPackagesDEPRECATED() {
+		packages[pkg.GetId()] = pkg
+	}
+	return packages
+}
+
+// environmentList returns the *v4.Environment_List associated with the given
+// package ID, falling back to the deprecated environments map if the
+// current one is unset.
+func environmentList(report *v4.VulnerabilityReport, id string) *v4.Environment_List {
 	environments := report.GetContents().GetEnvironments()
 	if environments == nil {
 		// Fallback to deprecated environments.
 		environments = report.GetContents().GetEnvironmentsDEPRECATED()
 	}
-	envList, ok := environments[id]
-	if !ok {
-		return nil
-	}
+	return environments[id]
+}
 
-	envs := envList.GetEnvironments()
+func environment(report *v4.VulnerabilityReport, id string) *v4.Environment {
+	envs := environmentList(report, id).GetEnvironments()
 	if len(envs) > 0 {
 		// Just use the first environment.
 		// It is possible there are multiple environments associated with this package;
@@ -170,6 +192,20 @@ func environment(report *v4.VulnerabilityReport, id string) *v4.Environment {
 	return nil
 }
 
+// packageHasRepositoryKey reports whether pkgID is associated, via any of
+// its Environment entries, with a Repository whose Key matches key.
+func packageHasRepositoryKey(report *v4.VulnerabilityReport, pkgID, key string) bool {
+	repos := report.GetContents().GetRepositories()
+	for _, env := range environmentList(report, pkgID).GetEnvironments() {
+		for _, repoID := range env.GetRepositoryIds() {
+			if repos[repoID].GetKey() == key {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // ParsePackageDB parses the given packageDB into its source type + filepath.
 func ParsePackageDB(packageDB string) (storage.SourceType, string) {
 	prefix, path, found := strings.Cut(packageDB, ":")
@@ -276,6 +312,7 @@ func buildEmbeddedVulnerability(ccVuln *v4.VulnerabilityReport_Vulnerability, en
 		CisaKev:               cisaKevEnabled(ccVuln),
 		FixAvailableTimestamp: ccVuln.GetFixedDate(),
 		Datasource:            vulnDataSource(ccVuln, envOS),
+		Origin:                vulnOrigin(ccVuln.GetUpdater()),
 	}
 	if err := setScoresAndScoreVersions(vuln, ccVuln.GetCvssMetrics()); err != nil {
 		utils.Should(err)
@@ -548,6 +585,60 @@ func getPackageLayerSHA(report *v4.VulnerabilityReport, pkgID string) (string, b
 	return env.GetIntroducedIn(), true
 }
 
+func getPackageLayerIndex(report *v4.VulnerabilityReport, layerSHAToIndex map[string]int32, pkgID string) (int32, bool) {
+	layerSHA, ok := getPackageLayerSHA(report, pkgID)
+	if !ok {
+		return 0, false
+	}
+	layerIdx, ok := layerSHAToIndex[layerSHA]
+	return layerIdx, ok
+}
+
+// filterRedHatLayerVulnerabilities removes non-Red Hat VEX findings at or below the
+// highest RHCC-marked ancestry layer. Findings above it are unchanged.
+func filterRedHatLayerVulnerabilities(report *v4.VulnerabilityReport, layerSHAToIndex map[string]int32) {
+	contents := report.GetContents()
+	if len(layerSHAToIndex) == 0 || contents == nil {
+		return
+	}
+
+	packages := packagesByID(contents)
+	maxLayerIdx := int32(-1)
+	for pkgID, pkg := range packages {
+		if pkg == nil || pkg.GetKind() != "ancestry" || !packageHasRepositoryKey(report, pkgID, rhcc.RepositoryKey) {
+			continue
+		}
+		layerIdx, ok := getPackageLayerIndex(report, layerSHAToIndex, pkgID)
+		if !ok {
+			continue
+		}
+		if layerIdx > maxLayerIdx {
+			maxLayerIdx = layerIdx
+		}
+	}
+	if maxLayerIdx < 0 {
+		return
+	}
+
+	for pkgID, vulnIDs := range report.GetPackageVulnerabilities() {
+		pkgLayerIdx, ok := getPackageLayerIndex(report, layerSHAToIndex, pkgID)
+		if !ok || pkgLayerIdx > maxLayerIdx {
+			continue
+		}
+		filtered := make([]string, 0, len(vulnIDs.GetValues()))
+		for _, vulnID := range vulnIDs.GetValues() {
+			if report.GetVulnerabilities()[vulnID].GetUpdater() == redHatVEXUpdaterName {
+				filtered = append(filtered, vulnID)
+			}
+		}
+		if len(filtered) == 0 {
+			delete(report.PackageVulnerabilities, pkgID) //nolint:protogetter // mutation requires direct field access
+		} else {
+			report.PackageVulnerabilities[pkgID] = &v4.StringList{Values: filtered}
+		}
+	}
+}
+
 // filterNotAffectedVulnerabilities removes vulnerabilities from PackageVulnerabilities
 // when they are covered by VEX not-affected assertions via AncestryPackage entries.
 // A package is covered if it was introduced at or below the AncestryPackage's layer
@@ -557,58 +648,122 @@ func filterNotAffectedVulnerabilities(report *v4.VulnerabilityReport, layerSHATo
 		return
 	}
 
-	// Find AncestryPackage entries and collect their boundaries with aliases.
-	type boundary struct {
-		layerIndex      int32
-		notAffectedKeys set.StringSet
-	}
-	var boundaries []boundary
-
+	// Find AncestryPackage entries. A package introduced at or before that
+	// layer is also not affected, so keep the highest layer index per alias.
+	aliasKeyToLayerIndex := make(map[string]int32)
 	for pkgID, vulnIDs := range report.GetPackageNotVulnerable() {
 		pkg := report.GetContents().GetPackages()[pkgID]
 		if pkg == nil || pkg.GetKind() != "ancestry" {
 			continue
 		}
 
-		layerSHA, ok := getPackageLayerSHA(report, pkgID)
+		layerIdx, ok := getPackageLayerIndex(report, layerSHAToIndex, pkgID)
 		if !ok {
 			continue
 		}
-		layerIdx, ok := layerSHAToIndex[layerSHA]
+
+		for _, vulnID := range vulnIDs.GetValues() {
+			vuln := report.GetVulnerabilities()[vulnID]
+			if vuln == nil {
+				continue
+			}
+			for _, alias := range vuln.GetAliases() {
+				key := aliasKey(alias)
+				if cur, ok := aliasKeyToLayerIndex[key]; !ok || layerIdx > cur {
+					aliasKeyToLayerIndex[key] = layerIdx
+				}
+			}
+		}
+	}
+
+	if len(aliasKeyToLayerIndex) == 0 {
+		return
+	}
+
+	// Remove PackageVulnerabilities entries covered by a same-or-lower-layer
+	// not-affected assertion.
+	for pkgID, vulnIDs := range report.GetPackageVulnerabilities() {
+		pkgLayerIdx, ok := getPackageLayerIndex(report, layerSHAToIndex, pkgID)
 		if !ok {
 			continue
 		}
 
-		aliasKeys := set.NewStringSet()
+		var filtered []string
 		for _, vulnID := range vulnIDs.GetValues() {
 			vuln := report.GetVulnerabilities()[vulnID]
 			if vuln == nil {
+				filtered = append(filtered, vulnID)
 				continue
 			}
+
+			removed := false
 			for _, alias := range vuln.GetAliases() {
-				aliasKeys.Add(aliasKey(alias))
+				if layerIdx, ok := aliasKeyToLayerIndex[aliasKey(alias)]; ok && pkgLayerIdx <= layerIdx {
+					removed = true
+					break
+				}
+			}
+
+			if removed {
+				log.Debugf("Suppressing vuln %q for package %q due to VEX not-affected assertion", vuln.GetName(), pkgID)
+			} else {
+				filtered = append(filtered, vulnID)
 			}
 		}
 
-		if aliasKeys.Cardinality() > 0 {
-			boundaries = append(boundaries, boundary{
-				layerIndex:      layerIdx,
-				notAffectedKeys: aliasKeys,
-			})
+		if len(filtered) == 0 {
+			delete(report.PackageVulnerabilities, pkgID) //nolint:protogetter // mutation requires direct field access
+		} else {
+			report.PackageVulnerabilities[pkgID] = &v4.StringList{Values: filtered}
 		}
 	}
+}
+
+// filterOSVSupersededByRedHatVEX removes osv/*-sourced vulnerabilities from
+// PackageVulnerabilities when a rhel-vex updater vulnerability shares a
+// CVE alias at or above the OSV package's layer.
+func filterOSVSupersededByRedHatVEX(report *v4.VulnerabilityReport, layerSHAToIndex map[string]int32) {
+	const osvUpdaterPrefix = "osv/"
 
-	if len(boundaries) == 0 {
+	if len(report.GetPackageVulnerabilities()) == 0 {
 		return
 	}
 
-	// Filter PackageVulnerabilities based on boundaries.
+	// Find packages with a rhel-vex vulnerability. An OSV package introduced
+	// at or before that layer is superseded too, so keep the highest layer per alias.
+	aliasKeyToLayerIndex := make(map[string]int32)
 	for pkgID, vulnIDs := range report.GetPackageVulnerabilities() {
-		pkgLayerSHA, ok := getPackageLayerSHA(report, pkgID)
+		// Only consider OCI (RHCC) packages.
+		if !packageHasRepositoryKey(report, pkgID, rhcc.RepositoryKey) {
+			continue
+		}
+
+		layerIdx, ok := getPackageLayerIndex(report, layerSHAToIndex, pkgID)
 		if !ok {
 			continue
 		}
-		pkgLayerIdx, ok := layerSHAToIndex[pkgLayerSHA]
+
+		for _, vulnID := range vulnIDs.GetValues() {
+			vuln := report.GetVulnerabilities()[vulnID]
+			if vuln == nil || vuln.GetUpdater() != redHatVEXUpdaterName {
+				continue
+			}
+			for _, alias := range vuln.GetAliases() {
+				key := aliasKey(alias)
+				if cur, ok := aliasKeyToLayerIndex[key]; !ok || layerIdx > cur {
+					aliasKeyToLayerIndex[key] = layerIdx
+				}
+			}
+		}
+	}
+
+	if len(aliasKeyToLayerIndex) == 0 {
+		return
+	}
+
+	// Remove osv/* vulnerabilities covered by a same-or-lower-layer rhel-vex vulnerability.
+	for pkgID, vulnIDs := range report.GetPackageVulnerabilities() {
+		pkgLayerIdx, ok := getPackageLayerIndex(report, layerSHAToIndex, pkgID)
 		if !ok {
 			continue
 		}
@@ -616,29 +771,21 @@ func filterNotAffectedVulnerabilities(report *v4.VulnerabilityReport, layerSHATo
 		var filtered []string
 		for _, vulnID := range vulnIDs.GetValues() {
 			vuln := report.GetVulnerabilities()[vulnID]
-			if vuln == nil {
+			if vuln == nil || !strings.HasPrefix(vuln.GetUpdater(), osvUpdaterPrefix) {
 				filtered = append(filtered, vulnID)
 				continue
 			}
 
-			suppressed := false
-			for _, b := range boundaries {
-				if pkgLayerIdx > b.layerIndex {
-					continue
-				}
-				for _, alias := range vuln.GetAliases() {
-					if b.notAffectedKeys.Contains(aliasKey(alias)) {
-						suppressed = true
-						break
-					}
-				}
-				if suppressed {
+			removed := false
+			for _, alias := range vuln.GetAliases() {
+				if layerIdx, ok := aliasKeyToLayerIndex[aliasKey(alias)]; ok && pkgLayerIdx <= layerIdx {
+					removed = true
 					break
 				}
 			}
 
-			if suppressed {
-				log.Debugf("Suppressing vuln %q for package %q due to VEX not-affected assertion", vuln.GetName(), pkgID)
+			if removed {
+				log.Debugf("Suppressing OSV vuln %q for package %q in favor of Red Hat VEX", vuln.GetName(), pkgID)
 			} else {
 				filtered = append(filtered, vulnID)
 			}
@@ -753,6 +900,11 @@ func splitVersionNumbers(v string) []int {
 // mergeScoringFields overwrites scoring-related fields on dst when src has more
 // complete or higher-severity scoring data. Priority: more CVSS metrics, higher
 // severity, higher CVSS base score.
+//
+// Origin is set here defensively so that if in the future multiple updaters
+// report the same CVE, Origin reflects the source that won the scoring
+// comparison, keeping the assignment deterministic rather than dependent
+// on input order.
 func mergeScoringFields(dst, src *storage.EmbeddedVulnerability) {
 	c := cmp.Or(
 		cmp.Compare(len(src.GetCvssMetrics()), len(dst.GetCvssMetrics())),
@@ -776,4 +928,37 @@ func mergeScoringFields(dst, src *storage.EmbeddedVulnerability) {
 	dst.Epss = src.GetEpss()
 	dst.Exploit = src.GetExploit()
 	dst.CisaKev = src.GetExploit() != nil
+	dst.Origin = src.GetOrigin()
+}
+
+var updaterOrigins = []struct {
+	prefix string
+	origin storage.VulnOrigin
+}{
+	{"alpine-", storage.VulnOrigin_VULN_ORIGIN_ALPINE},
+	{"aws-", storage.VulnOrigin_VULN_ORIGIN_AMAZON},
+	{"debian/", storage.VulnOrigin_VULN_ORIGIN_DEBIAN},
+	{"oracle-", storage.VulnOrigin_VULN_ORIGIN_ORACLE},
+	{"osv/", storage.VulnOrigin_VULN_ORIGIN_OSV},
+	{"photon-", storage.VulnOrigin_VULN_ORIGIN_PHOTON},
+	{"rhel-", storage.VulnOrigin_VULN_ORIGIN_RED_HAT},
+	{"suse-", storage.VulnOrigin_VULN_ORIGIN_SUSE},
+	{"ubuntu/", storage.VulnOrigin_VULN_ORIGIN_UBUNTU},
+}
+
+// vulnOrigin translates a Claircore updater name into VulnOrigin.
+//
+// ASSUMPTION: updater names follow prefix conventions observed in Claircore.
+// These names are exposed via the API but their values are not guaranteed
+// to be stable.
+//
+// TODO(ROX-36340): Replace this prefix-based translation with something
+// more stable.
+func vulnOrigin(updater string) storage.VulnOrigin {
+	for _, e := range updaterOrigins {
+		if strings.HasPrefix(updater, e.prefix) {
+			return e.origin
+		}
+	}
+	return storage.VulnOrigin_VULN_ORIGIN_OTHER
 }
diff --git a/pkg/scanners/scannerv4/convert_test.go b/pkg/scanners/scannerv4/convert_test.go
index c5422688d1007..98c6964be66b9 100644
--- a/pkg/scanners/scannerv4/convert_test.go
+++ b/pkg/scanners/scannerv4/convert_test.go
@@ -1847,6 +1847,177 @@ func TestNotes(t *testing.T) {
 	}
 }
 
+func TestFilterRedHatLayerVulnerabilities(t *testing.T) {
+	layers := map[string]int32{
+		"base": 0, "rh-base": 1, "middle": 2, "rh-top": 3, "user": 4,
+	}
+	newReport := func() *v4.VulnerabilityReport {
+		packages := map[string]*v4.Package{}
+		environments := map[string]*v4.Environment_List{}
+		pkgVulns := map[string]*v4.StringList{}
+		for layer := range layers {
+			packages[layer] = &v4.Package{Id: layer, Kind: "binary"}
+			environments[layer] = &v4.Environment_List{Environments: []*v4.Environment{{IntroducedIn: layer}}}
+			pkgVulns[layer] = &v4.StringList{Values: []string{"osv", "redhat"}}
+		}
+		// These layers have only OSV findings.
+		pkgVulns["base"] = &v4.StringList{Values: []string{"osv"}}
+		pkgVulns["middle"] = &v4.StringList{Values: []string{"osv"}}
+		for _, layer := range []string{"rh-base", "rh-top"} {
+			id := layer + "-ancestry"
+			packages[id] = &v4.Package{Id: id, Kind: "ancestry"}
+			environments[id] = &v4.Environment_List{Environments: []*v4.Environment{{IntroducedIn: layer, RepositoryIds: []string{"rhcc"}}}}
+		}
+		return &v4.VulnerabilityReport{
+			Contents: &v4.Contents{
+				Packages:     packages,
+				Repositories: map[string]*v4.Repository{"rhcc": {Key: "rhcc-container-repository"}},
+				Environments: environments,
+			},
+			Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+				"osv": {Updater: "osv/go"}, "redhat": {Updater: "rhel-vex"},
+			},
+			PackageVulnerabilities: pkgVulns,
+		}
+	}
+
+	tests := map[string]struct {
+		prepare  func(*v4.VulnerabilityReport)
+		indices  map[string]int32
+		filtered []string
+	}{
+		"unmarked layer between Red Hat markers needs no VEX assertion": {
+			indices: layers, filtered: []string{"base", "rh-base", "middle", "rh-top"},
+		},
+		"single marker includes every lower layer": {
+			prepare: func(r *v4.VulnerabilityReport) { delete(r.GetContents().GetEnvironments(), "rh-top-ancestry") },
+			indices: layers, filtered: []string{"base", "rh-base"},
+		},
+		"RHCC-marked binary above ancestry does not extend boundary": {
+			prepare: func(r *v4.VulnerabilityReport) { r.Contents.Packages["rh-top-ancestry"].Kind = "binary" },
+			indices: layers, filtered: []string{"base", "rh-base"},
+		},
+		"RHCC-marked binaries without ancestry leave findings alone": {
+			prepare: func(r *v4.VulnerabilityReport) {
+				r.Contents.Packages["rh-base-ancestry"].Kind = "binary"
+				r.Contents.Packages["rh-top-ancestry"].Kind = "binary"
+			},
+			indices: layers,
+		},
+		"top marker includes unmarked lower layers": {
+			prepare: func(r *v4.VulnerabilityReport) { delete(r.GetContents().GetEnvironments(), "rh-base-ancestry") },
+			indices: layers, filtered: []string{"base", "rh-base", "middle", "rh-top"},
+		},
+		"marker in layer zero": {
+			prepare: func(r *v4.VulnerabilityReport) {
+				delete(r.GetContents().GetEnvironments(), "rh-top-ancestry")
+				r.Contents.Environments["rh-base-ancestry"].Environments[0].IntroducedIn = "base"
+			},
+			indices: layers, filtered: []string{"base"},
+		},
+		"legacy Gold Repository marker uses RHCC key": {
+			prepare: func(r *v4.VulnerabilityReport) {
+				r.Contents.Repositories["rhcc"] = &v4.Repository{
+					Name: "Red Hat Container Catalog",
+					Uri:  "https://catalog.redhat.com/software/containers/explore",
+					Key:  "rhcc-container-repository",
+				}
+			},
+			indices: layers, filtered: []string{"base", "rh-base", "middle", "rh-top"},
+		},
+		"no Red Hat marker leaves findings alone": {
+			prepare: func(r *v4.VulnerabilityReport) {
+				delete(r.GetContents().GetEnvironments(), "rh-base-ancestry")
+				delete(r.GetContents().GetEnvironments(), "rh-top-ancestry")
+			},
+			indices: layers,
+		},
+		"orphaned environments do not mark Red Hat layers": {
+			prepare: func(r *v4.VulnerabilityReport) {
+				delete(r.GetContents().GetPackages(), "rh-base-ancestry")
+				delete(r.GetContents().GetPackages(), "rh-top-ancestry")
+			},
+			indices: layers,
+		},
+		"deprecated environments retain the boundary": {
+			prepare: func(r *v4.VulnerabilityReport) {
+				for _, pkg := range r.GetContents().GetPackages() {
+					r.Contents.PackagesDEPRECATED = append(r.Contents.PackagesDEPRECATED, pkg)
+				}
+				r.Contents.Packages = nil
+				r.Contents.EnvironmentsDEPRECATED = r.GetContents().GetEnvironments()
+				r.Contents.Environments = nil
+			},
+			indices: layers, filtered: []string{"base", "rh-base", "middle", "rh-top"},
+		},
+		"SBOM without image layer order leaves findings alone": {
+			indices: nil,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			report := newReport()
+			if tc.prepare != nil {
+				tc.prepare(report)
+			}
+			filterRedHatLayerVulnerabilities(report, tc.indices)
+			filtered := make(map[string]bool)
+			for _, layer := range tc.filtered {
+				filtered[layer] = true
+			}
+			for layer := range layers {
+				want := []string{"osv", "redhat"}
+				if layer == "base" || layer == "middle" {
+					want = []string{"osv"}
+				}
+				if filtered[layer] {
+					want = []string{"redhat"}
+					if layer == "base" || layer == "middle" {
+						want = nil
+					}
+				}
+				assert.Equal(t, want, report.GetPackageVulnerabilities()[layer].GetValues(), "layer %s", layer)
+				if want == nil {
+					assert.NotContains(t, report.GetPackageVulnerabilities(), layer)
+				}
+			}
+		})
+	}
+}
+
+func TestImageScanRedHatLayerFlag(t *testing.T) {
+	newReport := func() *v4.VulnerabilityReport {
+		return &v4.VulnerabilityReport{
+			Contents: &v4.Contents{
+				Packages: map[string]*v4.Package{
+					"marker":  {Kind: "ancestry"},
+					"package": {Kind: "binary"},
+				},
+				Repositories: map[string]*v4.Repository{"rhcc": {Key: "rhcc-container-repository"}},
+				Environments: map[string]*v4.Environment_List{
+					"marker":  {Environments: []*v4.Environment{{IntroducedIn: "layer", RepositoryIds: []string{"rhcc"}}}},
+					"package": {Environments: []*v4.Environment{{IntroducedIn: "layer"}}},
+				},
+			},
+			Vulnerabilities:        map[string]*v4.VulnerabilityReport_Vulnerability{"osv": {Updater: "osv/go"}},
+			PackageVulnerabilities: map[string]*v4.StringList{"package": {Values: []string{"osv"}}},
+		}
+	}
+	metadata := &storage.ImageMetadata{
+		V1:        &storage.V1Metadata{Layers: []*storage.ImageLayer{{}}},
+		LayerShas: []string{"layer"},
+	}
+
+	testutils.MustUpdateFeature(t, features.ScannerV4RedHatLayers, true)
+	imageReport := newReport()
+	imageScan(metadata, imageReport, scannerVersion)
+	assert.Empty(t, imageReport.GetPackageVulnerabilities())
+
+	sbomReport := newReport()
+	imageScan(nil, sbomReport, scannerVersion)
+	assert.Equal(t, []string{"osv"}, sbomReport.GetPackageVulnerabilities()["package"].GetValues())
+}
+
 func TestFilterNotAffectedVulnerabilities(t *testing.T) {
 	// Layer SHAs for test scenarios:
 	// layer0 (index 0) - base layer
@@ -1955,292 +2126,1140 @@ func TestFilterNotAffectedVulnerabilities(t *testing.T) {
 						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
-						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vuln-1": {
+						Id:   "vuln-1",
+						Name: "CVE-2024-24786",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"vuln-1"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg": {Values: []string{"vuln-1"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{},
+		},
+		{
+			name: "package in user layer above ancestry - CVE NOT suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
+						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer2"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vuln-1": {
+						Id:   "vuln-1",
+						Name: "CVE-2024-24786",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"vuln-1"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg": {Values: []string{"vuln-1"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"go-pkg-1": {"vuln-1"},
+			},
+		},
+		{
+			name: "alias matching - GHSA in vuln, CVE in not-affected aliases",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
+						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"ghsa-vuln": {
+						Id:   "ghsa-vuln",
+						Name: "GHSA-8r3f-844c-mc37",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "ghsa", Name: "GHSA-8r3f-844c-mc37"},
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"cve-vuln": {
+						Id:   "cve-vuln",
+						Name: "CVE-2024-24786",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"ghsa-vuln"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg": {Values: []string{"cve-vuln"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{},
+		},
+		{
+			name: "no matching aliases - CVE NOT suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
+						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vuln-1": {
+						Id:   "vuln-1",
+						Name: "CVE-2024-1111",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"vuln-2": {
+						Id:   "vuln-2",
+						Name: "CVE-2024-2222",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"vuln-1"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg": {Values: []string{"vuln-2"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"go-pkg-1": {"vuln-1"},
+			},
+		},
+		{
+			name: "package with no environment - not filtered (safe default)",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
+						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vuln-1": {
+						Id:   "vuln-1",
+						Name: "CVE-2024-24786",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"vuln-1"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg": {Values: []string{"vuln-1"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"go-pkg-1": {"vuln-1"},
+			},
+		},
+		{
+			name: "vulnerability with no aliases - not filtered",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
+						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vuln-1": {
+						Id:      "vuln-1",
+						Name:    "CVE-2024-24786",
+						Aliases: nil,
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"vuln-1"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg": {Values: []string{"vuln-1"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"go-pkg-1": {"vuln-1"},
+			},
+		},
+		{
+			name: "multiple boundaries - each checked independently",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"ancestry-pkg-1": {Id: "ancestry-pkg-1", Kind: "ancestry", Name: "ubi9:9.4"},
+						"ancestry-pkg-2": {Id: "ancestry-pkg-2", Kind: "ancestry", Name: "rhel:8"},
+						"go-pkg-1":       {Id: "go-pkg-1", Kind: "binary", Name: "pkg1"},
+						"go-pkg-2":       {Id: "go-pkg-2", Kind: "binary", Name: "pkg2"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"ancestry-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"ancestry-pkg-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"go-pkg-1":       {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"go-pkg-2":       {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vuln-1": {
+						Id:   "vuln-1",
+						Name: "CVE-2024-1111",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"vuln-2": {
+						Id:   "vuln-2",
+						Name: "CVE-2024-2222",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"vuln-1"}},
+					"go-pkg-2": {Values: []string{"vuln-2"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg-1": {Values: []string{"vuln-1"}},
+					"ancestry-pkg-2": {Values: []string{"vuln-2"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{},
+		},
+		{
+			name: "partial suppression - only matching CVE removed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
+						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vuln-1": {
+						Id:   "vuln-1",
+						Name: "CVE-2024-1111",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"vuln-2": {
+						Id:   "vuln-2",
+						Name: "CVE-2024-2222",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"vuln-1", "vuln-2"}},
+				},
+				PackageNotVulnerable: map[string]*v4.StringList{
+					"ancestry-pkg": {Values: []string{"vuln-1"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"go-pkg-1": {"vuln-2"},
+			},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			filterNotAffectedVulnerabilities(tc.report, layerSHAToIndex)
+
+			got := make(map[string][]string)
+			for pkgID, vulns := range tc.report.GetPackageVulnerabilities() {
+				got[pkgID] = vulns.GetValues()
+			}
+			assert.Equal(t, tc.expectedPkgVulns, got)
+		})
+	}
+}
+
+func TestFilterOSVSupersededByRedHatVEX(t *testing.T) {
+	layerSHAToIndex := map[string]int32{
+		"sha256:layer0": 0,
+		"sha256:layer1": 1,
+		"sha256:layer2": 2,
+	}
+
+	testcases := []struct {
+		name             string
+		report           *v4.VulnerabilityReport
+		expectedPkgVulns map[string][]string
+	}{
+		{
+			name: "nil/empty PackageVulnerabilities - no-op",
+			report: &v4.VulnerabilityReport{
+				PackageVulnerabilities: nil,
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-1111",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+				},
+			},
+			expectedPkgVulns: map[string][]string{},
+		},
+		{
+			name: "no rhel-vex vuln in the report - not suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"osv-vuln": {
+						Id:      "osv-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"go-pkg-1": {Values: []string{"osv-vuln"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"go-pkg-1": {"osv-vuln"},
+			},
+		},
+		{
+			name: "two packages, same layer, share a CVE alias - OSV suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"osv-vuln": {
+						Id:      "osv-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-vuln"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"bin-1": {"vex-vuln"},
+			},
+		},
+		{
+			name: "two packages share a CVE alias, OSV package on a later layer - not suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer2"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"osv-vuln": {
+						Id:      "osv-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-vuln"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"bin-1":    {"vex-vuln"},
+				"go-pkg-1": {"osv-vuln"},
+			},
+		},
+		{
+			name: "two packages, same layer, different vuln names, share a CVE alias - OSV suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"osv-vuln": {
+						Id:      "osv-vuln",
+						Name:    "GHSA-8r3f-844c-mc37",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "ghsa", Name: "GHSA-8r3f-844c-mc37"},
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-vuln"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"bin-1": {"vex-vuln"},
+			},
+		},
+		{
+			name: "no shared alias between an OSV vuln and a rhel-vex vuln - not suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-2222",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+					"osv-vuln": {
+						Id:      "osv-vuln",
+						Name:    "CVE-2024-1111",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-vuln"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"bin-1":    {"vex-vuln"},
+				"go-pkg-1": {"osv-vuln"},
+			},
+		},
+		{
+			name: "non-osv vuln sharing an alias with a rhel-vex vuln, same layer - not suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"nvd-vuln": {
+						Id:      "nvd-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "nvd",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"nvd-vuln"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"bin-1":    {"vex-vuln"},
+				"go-pkg-1": {"nvd-vuln"},
+			},
+		},
+		{
+			name: "two pairs of packages, each pair sharing its own CVE alias - both OSV vulns suppressed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"bin-2":    {Id: "bin-2", Kind: "binary", Name: "rhel8-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "pkg1"},
+						"go-pkg-2": {Id: "go-pkg-2", Kind: "binary", Name: "pkg2"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"bin-2":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"go-pkg-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+					},
+				},
+				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+					"vex-vuln-1": {
+						Id:      "vex-vuln-1",
+						Name:    "CVE-2024-1111",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"vex-vuln-2": {
+						Id:      "vex-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+					"osv-vuln-1": {
+						Id:      "osv-vuln-1",
+						Name:    "CVE-2024-1111",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"osv-vuln-2": {
+						Id:      "osv-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+				},
+				PackageVulnerabilities: map[string]*v4.StringList{
+					"bin-1":    {Values: []string{"vex-vuln-1"}},
+					"bin-2":    {Values: []string{"vex-vuln-2"}},
+					"go-pkg-1": {Values: []string{"osv-vuln-1"}},
+					"go-pkg-2": {Values: []string{"osv-vuln-2"}},
+				},
+			},
+			expectedPkgVulns: map[string][]string{
+				"bin-1": {"vex-vuln-1"},
+				"bin-2": {"vex-vuln-2"},
+			},
+		},
+		{
+			name: "partial suppression - only the matching OSV id is removed",
+			report: &v4.VulnerabilityReport{
+				Contents: &v4.Contents{
+					Packages: map[string]*v4.Package{
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+					},
+					Environments: map[string]*v4.Environment_List{
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"vuln-1": {
-						Id:   "vuln-1",
-						Name: "CVE-2024-24786",
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"osv-match": {
+						Id:      "osv-match",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"osv-other": {
+						Id:      "osv-other",
+						Name:    "CVE-2024-3333",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-3333"},
+						},
+					},
+					"nvd-other": {
+						Id:      "nvd-other",
+						Name:    "CVE-2024-24786",
+						Updater: "nvd",
 						Aliases: []*v4.VulnerabilityReport_Alias{
 							{Space: "cve", Name: "CVE-2024-24786"},
 						},
 					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"vuln-1"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg": {Values: []string{"vuln-1"}},
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-match", "osv-other", "nvd-other"}},
 				},
 			},
-			expectedPkgVulns: map[string][]string{},
+			expectedPkgVulns: map[string][]string{
+				"bin-1":    {"vex-vuln"},
+				"go-pkg-1": {"osv-other", "nvd-other"},
+			},
 		},
 		{
-			name: "package in user layer above ancestry - CVE NOT suppressed",
+			name: "OSV package has no resolvable layer - not suppressed",
 			report: &v4.VulnerabilityReport{
 				Contents: &v4.Contents{
 					Packages: map[string]*v4.Package{
-						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
-						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"bin-2":    {Id: "bin-2", Kind: "binary", Name: "rhel8-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"go-pkg-2": {Id: "go-pkg-2", Kind: "binary", Name: "pkg2"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
-						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer2"}}},
+						"bin-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"bin-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						// go-pkg-1 intentionally has no Environments entry.
+						"go-pkg-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:unknown-layer"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"vuln-1": {
-						Id:   "vuln-1",
-						Name: "CVE-2024-24786",
+					"vex-vuln-1": {
+						Id:      "vex-vuln-1",
+						Name:    "CVE-2024-1111",
+						Updater: "rhel-vex",
 						Aliases: []*v4.VulnerabilityReport_Alias{
-							{Space: "cve", Name: "CVE-2024-24786"},
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"vex-vuln-2": {
+						Id:      "vex-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+					"osv-vuln-1": {
+						Id:      "osv-vuln-1",
+						Name:    "CVE-2024-1111",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"osv-vuln-2": {
+						Id:      "osv-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
 						},
 					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"vuln-1"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg": {Values: []string{"vuln-1"}},
+					"bin-1":    {Values: []string{"vex-vuln-1"}},
+					"bin-2":    {Values: []string{"vex-vuln-2"}},
+					"go-pkg-1": {Values: []string{"osv-vuln-1"}},
+					"go-pkg-2": {Values: []string{"osv-vuln-2"}},
 				},
 			},
 			expectedPkgVulns: map[string][]string{
-				"go-pkg-1": {"vuln-1"},
+				"bin-1":    {"vex-vuln-1"},
+				"bin-2":    {"vex-vuln-2"},
+				"go-pkg-1": {"osv-vuln-1"},
+				"go-pkg-2": {"osv-vuln-2"},
 			},
 		},
 		{
-			name: "alias matching - GHSA in vuln, CVE in not-affected aliases",
+			name: "vuln ID missing from report.Vulnerabilities - kept, no panic",
 			report: &v4.VulnerabilityReport{
 				Contents: &v4.Contents{
 					Packages: map[string]*v4.Package{
-						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
-						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"bin-2":    {Id: "bin-2", Kind: "binary", Name: "rhel8-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"go-pkg-2": {Id: "go-pkg-2", Kind: "binary", Name: "pkg2"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
-						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"bin-2":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"go-pkg-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"ghsa-vuln": {
-						Id:   "ghsa-vuln",
-						Name: "GHSA-8r3f-844c-mc37",
+					"vex-vuln-1": {
+						Id:      "vex-vuln-1",
+						Name:    "CVE-2024-1111",
+						Updater: "rhel-vex",
 						Aliases: []*v4.VulnerabilityReport_Alias{
-							{Space: "ghsa", Name: "GHSA-8r3f-844c-mc37"},
-							{Space: "cve", Name: "CVE-2024-24786"},
+							{Space: "cve", Name: "CVE-2024-1111"},
 						},
 					},
-					"cve-vuln": {
-						Id:   "cve-vuln",
-						Name: "CVE-2024-24786",
+					"vex-vuln-2": {
+						Id:      "vex-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "rhel-vex",
 						Aliases: []*v4.VulnerabilityReport_Alias{
-							{Space: "cve", Name: "CVE-2024-24786"},
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+					"osv-vuln-2": {
+						Id:      "osv-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
 						},
 					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"ghsa-vuln"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg": {Values: []string{"cve-vuln"}},
+					"bin-1":    {Values: []string{"vex-vuln-1"}},
+					"bin-2":    {Values: []string{"vex-vuln-2"}},
+					"go-pkg-1": {Values: []string{"missing-vuln-id"}},
+					"go-pkg-2": {Values: []string{"osv-vuln-2"}},
 				},
 			},
-			expectedPkgVulns: map[string][]string{},
+			expectedPkgVulns: map[string][]string{
+				"bin-1":    {"vex-vuln-1"},
+				"bin-2":    {"vex-vuln-2"},
+				"go-pkg-1": {"missing-vuln-id"},
+			},
 		},
 		{
-			name: "no matching aliases - CVE NOT suppressed",
+			name: "rhel-vex package has no resolvable layer - not suppressed",
 			report: &v4.VulnerabilityReport{
 				Contents: &v4.Contents{
 					Packages: map[string]*v4.Package{
-						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
-						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"bin-2":    {Id: "bin-2", Kind: "binary", Name: "rhel8-container"},
+						"bin-3":    {Id: "bin-3", Kind: "binary", Name: "other-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "pkg1"},
+						"go-pkg-2": {Id: "go-pkg-2", Kind: "binary", Name: "pkg2"},
+						"go-pkg-3": {Id: "go-pkg-3", Kind: "binary", Name: "pkg3"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
-						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						// bin-1 intentionally has no Environments entry.
+						"bin-2":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:unknown-layer", RepositoryIds: []string{"rhcc-repo"}}}},
+						"bin-3":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"go-pkg-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"go-pkg-3": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"vuln-1": {
-						Id:   "vuln-1",
-						Name: "CVE-2024-1111",
+					"vex-vuln-1": {
+						Id:      "vex-vuln-1",
+						Name:    "CVE-2024-1111",
+						Updater: "rhel-vex",
 						Aliases: []*v4.VulnerabilityReport_Alias{
 							{Space: "cve", Name: "CVE-2024-1111"},
 						},
 					},
-					"vuln-2": {
-						Id:   "vuln-2",
-						Name: "CVE-2024-2222",
+					"vex-vuln-2": {
+						Id:      "vex-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "rhel-vex",
 						Aliases: []*v4.VulnerabilityReport_Alias{
 							{Space: "cve", Name: "CVE-2024-2222"},
 						},
 					},
+					"vex-vuln-3": {
+						Id:      "vex-vuln-3",
+						Name:    "CVE-2024-3333",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-3333"},
+						},
+					},
+					"osv-vuln-1": {
+						Id:      "osv-vuln-1",
+						Name:    "CVE-2024-1111",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-1111"},
+						},
+					},
+					"osv-vuln-2": {
+						Id:      "osv-vuln-2",
+						Name:    "CVE-2024-2222",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-2222"},
+						},
+					},
+					"osv-vuln-3": {
+						Id:      "osv-vuln-3",
+						Name:    "CVE-2024-3333",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-3333"},
+						},
+					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"vuln-1"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg": {Values: []string{"vuln-2"}},
+					"bin-1":    {Values: []string{"vex-vuln-1"}},
+					"bin-2":    {Values: []string{"vex-vuln-2"}},
+					"bin-3":    {Values: []string{"vex-vuln-3"}},
+					"go-pkg-1": {Values: []string{"osv-vuln-1"}},
+					"go-pkg-2": {Values: []string{"osv-vuln-2"}},
+					"go-pkg-3": {Values: []string{"osv-vuln-3"}},
 				},
 			},
 			expectedPkgVulns: map[string][]string{
-				"go-pkg-1": {"vuln-1"},
+				"bin-1":    {"vex-vuln-1"},
+				"bin-2":    {"vex-vuln-2"},
+				"bin-3":    {"vex-vuln-3"},
+				"go-pkg-1": {"osv-vuln-1"},
+				"go-pkg-2": {"osv-vuln-2"},
 			},
 		},
 		{
-			name: "package with no environment - not filtered (safe default)",
+			name: "one rhel-vex vuln suppresses OSV vulns on two different packages",
 			report: &v4.VulnerabilityReport{
 				Contents: &v4.Contents{
 					Packages: map[string]*v4.Package{
-						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
-						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"go-pkg-2": {Id: "go-pkg-2", Kind: "binary", Name: "github.com/other/vendored-copy"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+						"go-pkg-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"vuln-1": {
-						Id:   "vuln-1",
-						Name: "CVE-2024-24786",
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"osv-vuln-1": {
+						Id:      "osv-vuln-1",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"osv-vuln-2": {
+						Id:      "osv-vuln-2",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
 						Aliases: []*v4.VulnerabilityReport_Alias{
 							{Space: "cve", Name: "CVE-2024-24786"},
 						},
 					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"vuln-1"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg": {Values: []string{"vuln-1"}},
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-vuln-1"}},
+					"go-pkg-2": {Values: []string{"osv-vuln-2"}},
 				},
 			},
 			expectedPkgVulns: map[string][]string{
-				"go-pkg-1": {"vuln-1"},
+				"bin-1": {"vex-vuln"},
 			},
 		},
 		{
-			name: "vulnerability with no aliases - not filtered",
+			name: "rhel-vex package also has a different-updater vuln alongside it",
 			report: &v4.VulnerabilityReport{
 				Contents: &v4.Contents{
 					Packages: map[string]*v4.Package{
-						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
-						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
-						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"vuln-1": {
-						Id:      "vuln-1",
+					"vex-vuln": {
+						Id:      "vex-vuln",
 						Name:    "CVE-2024-24786",
-						Aliases: nil,
+						Updater: "rhel-vex",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
+					},
+					"other-vuln": {
+						Id:      "other-vuln",
+						Name:    "CVE-2024-9999",
+						Updater: "nvd",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-9999"},
+						},
+					},
+					"osv-vuln": {
+						Id:      "osv-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-24786"},
+						},
 					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"vuln-1"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg": {Values: []string{"vuln-1"}},
+					"bin-1":    {Values: []string{"vex-vuln", "other-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-vuln"}},
 				},
 			},
 			expectedPkgVulns: map[string][]string{
-				"go-pkg-1": {"vuln-1"},
+				"bin-1": {"vex-vuln", "other-vuln"},
 			},
 		},
 		{
-			name: "multiple boundaries - each checked independently",
+			name: "rhel-vex vuln with an empty alias list - not suppressed",
 			report: &v4.VulnerabilityReport{
 				Contents: &v4.Contents{
 					Packages: map[string]*v4.Package{
-						"ancestry-pkg-1": {Id: "ancestry-pkg-1", Kind: "ancestry", Name: "ubi9:9.4"},
-						"ancestry-pkg-2": {Id: "ancestry-pkg-2", Kind: "ancestry", Name: "rhel:8"},
-						"go-pkg-1":       {Id: "go-pkg-1", Kind: "binary", Name: "pkg1"},
-						"go-pkg-2":       {Id: "go-pkg-2", Kind: "binary", Name: "pkg2"},
+						"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+						"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
-						"ancestry-pkg-2": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
-						"go-pkg-1":       {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
-						"go-pkg-2":       {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"vuln-1": {
-						Id:   "vuln-1",
-						Name: "CVE-2024-1111",
-						Aliases: []*v4.VulnerabilityReport_Alias{
-							{Space: "cve", Name: "CVE-2024-1111"},
-						},
+					"vex-vuln": {
+						Id:      "vex-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "rhel-vex",
+						// Intentionally no aliases.
 					},
-					"vuln-2": {
-						Id:   "vuln-2",
-						Name: "CVE-2024-2222",
+					"osv-vuln": {
+						Id:      "osv-vuln",
+						Name:    "CVE-2024-24786",
+						Updater: "osv/go",
 						Aliases: []*v4.VulnerabilityReport_Alias{
-							{Space: "cve", Name: "CVE-2024-2222"},
+							{Space: "cve", Name: "CVE-2024-24786"},
 						},
 					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"vuln-1"}},
-					"go-pkg-2": {Values: []string{"vuln-2"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg-1": {Values: []string{"vuln-1"}},
-					"ancestry-pkg-2": {Values: []string{"vuln-2"}},
+					"bin-1":    {Values: []string{"vex-vuln"}},
+					"go-pkg-1": {Values: []string{"osv-vuln"}},
 				},
 			},
-			expectedPkgVulns: map[string][]string{},
+			expectedPkgVulns: map[string][]string{
+				"bin-1":    {"vex-vuln"},
+				"go-pkg-1": {"osv-vuln"},
+			},
 		},
 		{
-			name: "partial suppression - only matching CVE removed",
+			name: "Mixed RHCC (OCI) and RPM packages: only RHCC suppresses OSV",
 			report: &v4.VulnerabilityReport{
 				Contents: &v4.Contents{
 					Packages: map[string]*v4.Package{
-						"ancestry-pkg": {Id: "ancestry-pkg", Kind: "ancestry", Name: "ubi9:9.4"},
-						"go-pkg-1":     {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+						"rhcc-pkg": {Id: "rhcc-pkg", Kind: "binary", Name: "ubi9-container"},
+						"rpm-pkg":  {Id: "rpm-pkg", Kind: "binary", Name: "some-rpm-package"},
+						"go-pkg":   {Id: "go-pkg", Kind: "binary", Name: "google.golang.org/protobuf"},
+					},
+					Repositories: map[string]*v4.Repository{
+						"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+						"rhel-repo": {Id: "rhel-repo", Key: "rhel-cpe-repository"},
 					},
 					Environments: map[string]*v4.Environment_List{
-						"ancestry-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
-						"go-pkg-1":     {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer1"}}},
+						"rhcc-pkg": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+						"rpm-pkg":  {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhel-repo"}}}},
+						"go-pkg":   {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
 					},
 				},
 				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"vuln-1": {
-						Id:   "vuln-1",
-						Name: "CVE-2024-1111",
+					"rhcc-vex-vuln": {
+						Id:      "rhcc-vex-vuln",
+						Name:    "CVE-2024-11111",
+						Updater: "rhel-vex",
 						Aliases: []*v4.VulnerabilityReport_Alias{
-							{Space: "cve", Name: "CVE-2024-1111"},
+							{Space: "cve", Name: "CVE-2024-11111"},
 						},
 					},
-					"vuln-2": {
-						Id:   "vuln-2",
-						Name: "CVE-2024-2222",
+					"rpm-vex-vuln": {
+						Id:      "rpm-vex-vuln",
+						Name:    "CVE-2024-22222",
+						Updater: "rhel-vex",
 						Aliases: []*v4.VulnerabilityReport_Alias{
-							{Space: "cve", Name: "CVE-2024-2222"},
+							{Space: "cve", Name: "CVE-2024-22222"},
+						},
+					},
+					"osv-vuln-1": {
+						Id:      "osv-vuln-1",
+						Name:    "CVE-2024-11111",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-11111"},
+						},
+					},
+					"osv-vuln-2": {
+						Id:      "osv-vuln-2",
+						Name:    "CVE-2024-22222",
+						Updater: "osv/go",
+						Aliases: []*v4.VulnerabilityReport_Alias{
+							{Space: "cve", Name: "CVE-2024-22222"},
 						},
 					},
 				},
 				PackageVulnerabilities: map[string]*v4.StringList{
-					"go-pkg-1": {Values: []string{"vuln-1", "vuln-2"}},
-				},
-				PackageNotVulnerable: map[string]*v4.StringList{
-					"ancestry-pkg": {Values: []string{"vuln-1"}},
+					"rhcc-pkg": {Values: []string{"rhcc-vex-vuln"}},
+					"rpm-pkg":  {Values: []string{"rpm-vex-vuln"}},
+					"go-pkg":   {Values: []string{"osv-vuln-1", "osv-vuln-2"}},
 				},
 			},
 			expectedPkgVulns: map[string][]string{
-				"go-pkg-1": {"vuln-2"},
+				"rhcc-pkg": {"rhcc-vex-vuln"},
+				"rpm-pkg":  {"rpm-vex-vuln"},
+				"go-pkg":   {"osv-vuln-2"},
 			},
 		},
 	}
 
 	for _, tc := range testcases {
 		t.Run(tc.name, func(t *testing.T) {
-			filterNotAffectedVulnerabilities(tc.report, layerSHAToIndex)
+			filterOSVSupersededByRedHatVEX(tc.report, layerSHAToIndex)
 
 			got := make(map[string][]string)
 			for pkgID, vulns := range tc.report.GetPackageVulnerabilities() {
@@ -2251,6 +3270,80 @@ func TestFilterNotAffectedVulnerabilities(t *testing.T) {
 	}
 }
 
+func TestFilterOSVSupersededByRedHatVEX_FeatureFlag(t *testing.T) {
+	newReport := func() *v4.VulnerabilityReport {
+		return &v4.VulnerabilityReport{
+			Contents: &v4.Contents{
+				Packages: map[string]*v4.Package{
+					"bin-1":    {Id: "bin-1", Kind: "binary", Name: "ubi9-container"},
+					"go-pkg-1": {Id: "go-pkg-1", Kind: "binary", Name: "google.golang.org/protobuf"},
+				},
+				Repositories: map[string]*v4.Repository{
+					"rhcc-repo": {Id: "rhcc-repo", Key: "rhcc-container-repository"},
+				},
+				Environments: map[string]*v4.Environment_List{
+					"bin-1":    {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0", RepositoryIds: []string{"rhcc-repo"}}}},
+					"go-pkg-1": {Environments: []*v4.Environment{{IntroducedIn: "sha256:layer0"}}},
+				},
+			},
+			Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
+				"vex-vuln": {
+					Id:      "vex-vuln",
+					Name:    "CVE-2024-24786",
+					Updater: "rhel-vex",
+					Aliases: []*v4.VulnerabilityReport_Alias{
+						{Space: "cve", Name: "CVE-2024-24786"},
+					},
+				},
+				"osv-vuln": {
+					Id:      "osv-vuln",
+					Name:    "GHSA-osv-flag-test",
+					Updater: "osv/go",
+					Aliases: []*v4.VulnerabilityReport_Alias{
+						{Space: "ghsa", Name: "GHSA-osv-flag-test"},
+						{Space: "cve", Name: "CVE-2024-24786"},
+					},
+				},
+			},
+			PackageVulnerabilities: map[string]*v4.StringList{
+				"bin-1":    {Values: []string{"vex-vuln"}},
+				"go-pkg-1": {Values: []string{"osv-vuln"}},
+			},
+		}
+	}
+	metadata := &storage.ImageMetadata{
+		V2:        &storage.V2Metadata{},
+		V1:        &storage.V1Metadata{Layers: []*storage.ImageLayer{{Empty: false}}},
+		LayerShas: []string{"sha256:layer0"},
+	}
+	const osvCVE = "GHSA-osv-flag-test"
+
+	t.Run("flag off - OSV vuln survives", func(t *testing.T) {
+		t.Setenv(features.ScannerV4SuppressOSVWithRedHatVEX.EnvVar(), "false")
+		scan := imageScan(metadata, newReport(), scannerVersion)
+		assert.True(t, hasCVE(scan, osvCVE), "expected %s to survive with the flag disabled", osvCVE)
+	})
+
+	t.Run("flag on - OSV vuln suppressed", func(t *testing.T) {
+		t.Setenv(features.ScannerV4SuppressOSVWithRedHatVEX.EnvVar(), "true")
+		scan := imageScan(metadata, newReport(), scannerVersion)
+		assert.False(t, hasCVE(scan, osvCVE), "expected %s to be suppressed with the flag enabled", osvCVE)
+	})
+}
+
+// hasCVE reports whether any component in scan carries a vulnerability whose
+// Cve field matches cve.
+func hasCVE(scan *storage.ImageScan, cve string) bool {
+	for _, c := range scan.GetComponents() {
+		for _, v := range c.GetVulns() {
+			if v.GetCve() == cve {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // TestVulnDataSource
 //
 // If this test fails due to a datasource format change
@@ -2645,3 +3738,38 @@ func TestCompareNumericSegments(t *testing.T) {
 		})
 	}
 }
+
+func TestVulnOrigin(t *testing.T) {
+	testcases := map[string]struct {
+		updater  string
+		expected storage.VulnOrigin
+	}{
+		"empty":                     {"", storage.VulnOrigin_VULN_ORIGIN_OTHER},
+		"unknown updater":           {"something-else", storage.VulnOrigin_VULN_ORIGIN_OTHER},
+		"alpine main":               {"alpine-main-v3.18-updater", storage.VulnOrigin_VULN_ORIGIN_ALPINE},
+		"alpine community":          {"alpine-community-v3.21-updater", storage.VulnOrigin_VULN_ORIGIN_ALPINE},
+		"alpine edge":               {"alpine-main-edge-updater", storage.VulnOrigin_VULN_ORIGIN_ALPINE},
+		"aws AL2":                   {"aws-AL2-updater", storage.VulnOrigin_VULN_ORIGIN_AMAZON},
+		"aws AL2023":                {"aws-AL2023-updater", storage.VulnOrigin_VULN_ORIGIN_AMAZON},
+		"debian":                    {"debian/updater", storage.VulnOrigin_VULN_ORIGIN_DEBIAN},
+		"oracle":                    {"oracle-2024-updater", storage.VulnOrigin_VULN_ORIGIN_ORACLE},
+		"osv go":                    {"osv/go", storage.VulnOrigin_VULN_ORIGIN_OSV},
+		"osv maven":                 {"osv/maven", storage.VulnOrigin_VULN_ORIGIN_OSV},
+		"osv npm":                   {"osv/npm", storage.VulnOrigin_VULN_ORIGIN_OSV},
+		"photon":                    {"photon-updater-photon3", storage.VulnOrigin_VULN_ORIGIN_PHOTON},
+		"rhel vex":                  {"rhel-vex", storage.VulnOrigin_VULN_ORIGIN_RED_HAT},
+		"suse leap":                 {"suse-updater-opensuse.leap.15.6", storage.VulnOrigin_VULN_ORIGIN_SUSE},
+		"suse enterprise":           {"suse-updater-suse.linux.enterprise.server.15", storage.VulnOrigin_VULN_ORIGIN_SUSE},
+		"ubuntu focal":              {"ubuntu/updater/focal", storage.VulnOrigin_VULN_ORIGIN_UBUNTU},
+		"ubuntu noble":              {"ubuntu/updater/noble", storage.VulnOrigin_VULN_ORIGIN_UBUNTU},
+		"prefix only alpine":        {"alpine-", storage.VulnOrigin_VULN_ORIGIN_ALPINE},
+		"near miss alpine no dash":  {"alpine", storage.VulnOrigin_VULN_ORIGIN_OTHER},
+		"near miss debian no slash": {"debian-updater", storage.VulnOrigin_VULN_ORIGIN_OTHER},
+	}
+	for name, tt := range testcases {
+		t.Run(name, func(t *testing.T) {
+			got := vulnOrigin(tt.updater)
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
diff --git a/pkg/scanners/scannerv4/nodescan_convert.go b/pkg/scanners/scannerv4/nodescan_convert.go
index ade2eb0b28650..307e7f5ae4d41 100644
--- a/pkg/scanners/scannerv4/nodescan_convert.go
+++ b/pkg/scanners/scannerv4/nodescan_convert.go
@@ -13,7 +13,8 @@ import (
 )
 
 var (
-	rhcosOSImageRegexp = regexp.MustCompile(`(Red Hat Enterprise Linux) (CoreOS) ([\d])([\d]+)`)
+	rhcosOSImageRegexp       = regexp.MustCompile(`Red Hat Enterprise Linux CoreOS (4)(\d+)`)
+	rhcosDottedOSImageRegexp = regexp.MustCompile(`Red Hat Enterprise Linux CoreOS (\d+)\.(\d+)\b`)
 )
 
 const (
@@ -40,21 +41,18 @@ func toNodeScan(r *v4.VulnerabilityReport, osImageRef string) *storage.NodeScan
 
 func toOperatingSystem(ref string) string {
 	r := rhcosOSImageRegexp.FindStringSubmatch(ref)
-	if len(r) != 5 {
-		return ""
+	if len(r) == 3 {
+		return fmt.Sprintf("rhcos:%s.%s", r[1], r[2])
 	}
-	return fmt.Sprintf("rhcos:%s.%s", r[3], r[4])
+	r = rhcosDottedOSImageRegexp.FindStringSubmatch(ref)
+	if len(r) == 3 {
+		return fmt.Sprintf("rhcos:%s.%s", r[1], r[2])
+	}
+	return ""
 }
 
 func toStorageComponents(r *v4.VulnerabilityReport) []*storage.EmbeddedNodeScanComponent {
-	packages := r.GetContents().GetPackages()
-	if len(packages) == 0 {
-		packages = make(map[string]*v4.Package, len(r.GetContents().GetPackagesDEPRECATED()))
-		// Fallback to the deprecated slice, if needed.
-		for _, pkg := range r.GetContents().GetPackagesDEPRECATED() {
-			packages[pkg.GetId()] = pkg
-		}
-	}
+	packages := packagesByID(r.GetContents())
 	result := make([]*storage.EmbeddedNodeScanComponent, 0, len(packages))
 
 	for id, pkg := range packages {
diff --git a/pkg/scanners/scannerv4/nodescan_convert_test.go b/pkg/scanners/scannerv4/nodescan_convert_test.go
index f7d5417209736..220503b4efe7b 100644
--- a/pkg/scanners/scannerv4/nodescan_convert_test.go
+++ b/pkg/scanners/scannerv4/nodescan_convert_test.go
@@ -251,6 +251,26 @@ func (s *indexReportConvertSuite) TestToOperatingSystem() {
 			in:       "Red Hat Enterprise Linux CoreOS 41712345.94.2024",
 			expected: "rhcos:4.1712345",
 		},
+		"legacy single-digit minor version": {
+			in:       "Red Hat Enterprise Linux CoreOS 41.84.201907030753-0",
+			expected: "rhcos:4.1",
+		},
+		"RHCOS 9.6 (OCP 4.19)": {
+			in:       "Red Hat Enterprise Linux CoreOS 9.6.20250701-0 (Plow)",
+			expected: "rhcos:9.6",
+		},
+		"RHCOS 9.8": {
+			in:       "Red Hat Enterprise Linux CoreOS 9.8.20260908-0 (Plow)",
+			expected: "rhcos:9.8",
+		},
+		"RHCOS 10.1": {
+			in:       "Red Hat Enterprise Linux CoreOS 10.1.20260908-0 (Plow)",
+			expected: "rhcos:10.1",
+		},
+		"RHCOS dotted version without build suffix": {
+			in:       "Red Hat Enterprise Linux CoreOS 9.8 (Plow)",
+			expected: "rhcos:9.8",
+		},
 		"non-RHCOS": {
 			in:       "Oracle Linux Server release 6.8",
 			expected: "",
diff --git a/pkg/scanners/scannerv4/scannerv4.go b/pkg/scanners/scannerv4/scannerv4.go
index cacecd18c1c7e..d34ed5f24e05d 100644
--- a/pkg/scanners/scannerv4/scannerv4.go
+++ b/pkg/scanners/scannerv4/scannerv4.go
@@ -1,6 +1,7 @@
 package scannerv4
 
 import (
+	"cmp"
 	"context"
 	"fmt"
 	"io"
@@ -393,14 +394,15 @@ func (s *scannerv4) GetVirtualMachineScan(
 	if indexReport == nil {
 		return nil, errors.New("index report is required for VM scanning")
 	}
+	vmLabel := cmp.Or(vm.GetName(), vm.GetId())
 	vmDigest, err := name.NewDigest(mockVirtualMachineDigest)
 	if err != nil {
-		return nil, errors.Wrapf(err, "failed to parse digest for VM %q", vm.GetName())
+		return nil, errors.Wrapf(err, "failed to parse digest for VM %q", vmLabel)
 	}
 
 	vr, err := s.getVulnerabilityReport(vmDigest, indexReport)
 	if err != nil {
-		return nil, errors.Wrapf(err, "failed to get vulnerability report for VM %q", vm.GetName())
+		return nil, errors.Wrapf(err, "failed to get vulnerability report for VM %q", vmLabel)
 	}
 
 	return ToVirtualMachineScan(vr), nil
diff --git a/pkg/scanners/scannerv4/scannerv4_test.go b/pkg/scanners/scannerv4/scannerv4_test.go
index e3c07abd56b03..c73b8bf5c026e 100644
--- a/pkg/scanners/scannerv4/scannerv4_test.go
+++ b/pkg/scanners/scannerv4/scannerv4_test.go
@@ -585,6 +585,21 @@ func TestGetVirtualMachineScan_Timeout(t *testing.T) {
 	assert.Nil(t, scan)
 }
 
+func TestGetVirtualMachineScan_EmptyNameUsesID(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockClient := s4ClientMocks.NewMockScanner(ctrl)
+	mockClient.EXPECT().GetVulnerabilities(gomock.Any(), gomock.Any(), gomock.Any()).
+		Return(nil, errors.New("scanner service unavailable"))
+
+	scanner := &scannerv4{scannerClient: mockClient}
+	scan, err := scanner.GetVirtualMachineScan(&storage.VirtualMachine{Id: "vm-id"}, &v4.IndexReport{Contents: &v4.Contents{}})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `failed to get vulnerability report for VM "vm-id"`)
+	assert.Nil(t, scan)
+}
+
 func TestNewVirtualMachineScanner(t *testing.T) {
 	t.Run("successful creation", func(it *testing.T) {
 		ctrl := gomock.NewController(t)
diff --git a/pkg/scanners/scannerv4/vm_convert.go b/pkg/scanners/scannerv4/vm_convert.go
index 7c8a553bd72fc..93042ef3713b3 100644
--- a/pkg/scanners/scannerv4/vm_convert.go
+++ b/pkg/scanners/scannerv4/vm_convert.go
@@ -53,13 +53,7 @@ func hasValidCPE(repositories map[string]*v4.Repository, environments map[string
 func toVirtualMachineComponents(r *v4.VulnerabilityReport) []*storage.EmbeddedVirtualMachineScanComponent {
 	repositories := r.GetContents().GetRepositories()
 	environments := r.GetContents().GetEnvironments()
-	packages := r.GetContents().GetPackages()
-	if len(packages) == 0 {
-		packages = make(map[string]*v4.Package, len(r.GetContents().GetPackagesDEPRECATED()))
-		for _, pkg := range r.GetContents().GetPackagesDEPRECATED() {
-			packages[pkg.GetId()] = pkg
-		}
-	}
+	packages := packagesByID(r.GetContents())
 	result := make([]*storage.EmbeddedVirtualMachineScanComponent, 0, len(packages))
 	for id, pkg := range packages {
 		vulnerabilityIDs := r.GetPackageVulnerabilities()[id].GetValues()
diff --git a/pkg/scannerv4/mappers/mappers.go b/pkg/scannerv4/mappers/mappers.go
index 2476267e13547..78df19c2148ca 100644
--- a/pkg/scannerv4/mappers/mappers.go
+++ b/pkg/scannerv4/mappers/mappers.go
@@ -19,7 +19,6 @@ import (
 	"github.com/quay/claircore"
 	"github.com/quay/claircore/enricher/epss"
 	"github.com/quay/claircore/enricher/kev"
-	"github.com/quay/claircore/rhel/rhcc"
 	"github.com/quay/claircore/rhel/vex"
 	"github.com/quay/claircore/toolkit/types"
 	"github.com/quay/claircore/toolkit/types/cpe"
@@ -45,6 +44,11 @@ const (
 	redhatErrataURLPrefix = "https://access.redhat.com/errata/"
 
 	rhelRepositoryKey = "rhel-cpe-repository"
+
+	// unsetCPE is the bound form of an unset CPE. Every released StackRox
+	// component emits and accepts this form, so keep it on the wire instead of
+	// the empty string ClairCore now produces for unset CPEs.
+	unsetCPE = "cpe:2.3:*:*:*:*:*:*:*:*:*:*:*"
 )
 
 var (
@@ -86,13 +90,6 @@ var (
 		// Catchall
 		regexp.MustCompile(`[A-Z]+-\d{4}[-:]\d+`),
 	}
-
-	// vexUpdater is the name of the Red Hat VEX updater used by Claircore.
-	vexUpdater = (*vex.Updater)(nil).Name()
-	// rhccRepoName is the name of the "Gold Repository".
-	rhccRepoName = rhcc.GoldRepo.Name
-	// rhccRepoURI is the URI of the "Gold Repository".
-	rhccRepoURI = rhcc.GoldRepo.URI
 )
 
 // ToProtoV4IndexReport maps claircore.IndexReport to v4.IndexReport.
@@ -118,7 +115,6 @@ func ToProtoV4VulnerabilityReport(ctx context.Context, r *claircore.Vulnerabilit
 		return nil, nil
 	}
 	filterPackages(r)
-	filterVulnerabilities(r)
 	nvdVulns, err := nvdVulnerabilities(r.Enrichments)
 	if err != nil {
 		return nil, fmt.Errorf("internal error: parsing nvd vulns: %w", err)
@@ -257,6 +253,10 @@ func v4Package(p *claircore.Package) (*v4.Package, error) {
 	if err != nil {
 		return nil, err
 	}
+	cpeStr, err := toCPEString(p.CPE)
+	if err != nil {
+		return nil, fmt.Errorf("package %q: %w", p.ID, err)
+	}
 	return &v4.Package{
 		Id:                p.ID,
 		Name:              p.Name,
@@ -268,7 +268,7 @@ func v4Package(p *claircore.Package) (*v4.Package, error) {
 		RepositoryHint:    p.RepositoryHint,
 		Module:            p.Module,
 		Arch:              p.Arch,
-		Cpe:               toCPEString(p.CPE),
+		Cpe:               cpeStr,
 	}, nil
 }
 
@@ -322,6 +322,10 @@ func v4Distribution(d *claircore.Distribution) (*v4.Distribution, error) {
 	if d == nil {
 		return nil, nil
 	}
+	cpeStr, err := toCPEString(d.CPE)
+	if err != nil {
+		return nil, fmt.Errorf("distribution %q: %w", d.ID, err)
+	}
 	return &v4.Distribution{
 		Id:              d.ID,
 		Did:             d.DID,
@@ -330,7 +334,7 @@ func v4Distribution(d *claircore.Distribution) (*v4.Distribution, error) {
 		VersionCodeName: d.VersionCodeName,
 		VersionId:       VersionID(d),
 		Arch:            d.Arch,
-		Cpe:             toCPEString(d.CPE),
+		Cpe:             cpeStr,
 		PrettyName:      d.PrettyName,
 	}, nil
 }
@@ -339,12 +343,16 @@ func v4Repository(r *claircore.Repository) (*v4.Repository, error) {
 	if r == nil {
 		return nil, nil
 	}
+	cpeStr, err := toCPEString(r.CPE)
+	if err != nil {
+		return nil, fmt.Errorf("repository %q: %w", r.ID, err)
+	}
 	return &v4.Repository{
 		Id:   r.ID,
 		Name: r.Name,
 		Key:  r.Key,
 		Uri:  r.URI,
-		Cpe:  toCPEString(r.CPE),
+		Cpe:  cpeStr,
 	}, nil
 }
 
@@ -825,8 +833,15 @@ func toPackageKind(s string) types.PackageKind {
 	return k
 }
 
-func toCPEString(c cpe.WFN) string {
-	return c.BindFS()
+func toCPEString(c cpe.WFN) (string, error) {
+	if errors.Is(c.Valid(), cpe.ErrUnset) {
+		return unsetCPE, nil
+	}
+	b, err := c.AppendText(nil)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
 }
 
 func toDigestString(digest claircore.Digest) string {
@@ -834,6 +849,9 @@ func toDigestString(digest claircore.Digest) string {
 }
 
 func toClairCoreCPE(s string) (cpe.WFN, error) {
+	if s == "" {
+		return cpe.WFN{}, nil
+	}
 	c, err := cpe.Unbind(s)
 	if err != nil {
 		return c, fmt.Errorf("%q: %s", s, strings.TrimPrefix(err.Error(), "cpe: "))
@@ -1150,106 +1168,6 @@ func filterPackages(report *claircore.VulnerabilityReport) {
 	}
 }
 
-// filterVulnerabilities filters out vulnerabilities from the given vulnerability report.
-// Note: This function only modifies the report's PackageVulnerabilities map.
-// It is non-trivial to remove all unreferenced vulnerabilities from the report's
-// Vulnerabilities map, so we leave it untouched and accept we may send Scanner V4 clients
-// extra vulnerabilities. It is up to the client to handle this.
-func filterVulnerabilities(report *claircore.VulnerabilityReport) {
-	// We only filter out non-Red Hat vulnerabilities found in Red Hat layers (if configured to do so) at this time.
-	if !features.ScannerV4RedHatLayers.Enabled() {
-		return
-	}
-
-	redhatLayers := rhccLayers(report)
-	if redhatLayers.IsEmpty() {
-		// This image is neither an official Red Hat image nor based on one, so nothing to do here.
-		return
-	}
-	for pkgID, pkg := range report.Packages {
-		// Sanity check.
-		if pkg == nil {
-			continue
-		}
-
-		envs, found := report.Environments[pkgID]
-		if !found {
-			// Did not find a related environment, so we cannot determine the layer.
-			continue
-		}
-
-		// Just use the first environment.
-		// It is possible there are multiple environments associated with this package;
-		// however, for our purposes, we only need the first one,
-		// as the layer index will always be the same between different environments.
-		// Quay does this, too: https://github.com/quay/quay/blob/v3.10.3/data/secscan_model/secscan_v4_model.py#L583.
-		// We also do this in our own client code.
-		env := envs[0]
-		// If this package was introduced in a non-Red Hat layer, skip it.
-		if !redhatLayers.Contains(env.IntroducedIn.String()) {
-			continue
-		}
-
-		var n int
-		for _, vulnID := range report.PackageVulnerabilities[pkgID] {
-			vuln := report.Vulnerabilities[vulnID]
-			// Sanity check.
-			if vuln == nil {
-				continue
-			}
-
-			// If the vulnerability did not come from Red Hat's VEX data, then skip it.
-			if vuln.Updater != vexUpdater {
-				continue
-			}
-
-			report.PackageVulnerabilities[pkgID][n] = vulnID
-			n++
-		}
-
-		// Hint to the GC the filtered vulnerabilities are no longer needed.
-		clear(report.PackageVulnerabilities[pkgID][n:])
-		report.PackageVulnerabilities[pkgID] = report.PackageVulnerabilities[pkgID][:n:n]
-
-		// If there aren't any vulnerabilities from Red Hat's VEX data,
-		// then delete the whole entry.
-		if n == 0 {
-			delete(report.PackageVulnerabilities, pkgID)
-		}
-	}
-}
-
-// rhccLayers returns a set of SHAs for the layers in official Red Hat images.
-// TODO(ROX-29158): account for images built via Konflux, as they do not contain the same identifiers
-// as the old build system.
-func rhccLayers(report *claircore.VulnerabilityReport) set.FrozenStringSet {
-	layers := set.NewStringSet()
-
-	var rhccID string
-	for id, repo := range report.Repositories {
-		if repo.Name == rhccRepoName && repo.URI == rhccRepoURI {
-			rhccID = id
-			break
-		}
-	}
-	if rhccID == "" {
-		// Not an official Red Hat image nor based on one.
-		return layers.Freeze()
-	}
-
-	for _, envs := range report.Environments {
-		for _, env := range envs {
-			for _, repoID := range env.RepositoryIDs {
-				if repoID == rhccID {
-					layers.Add(env.IntroducedIn.String())
-				}
-			}
-		}
-	}
-
-	return layers.Freeze()
-}
-
 // pkgFixedBy unmarshals and returns the package-fixed-by enrichment, if it exists.
 func pkgFixedBy(enrichments map[string][]json.RawMessage) (map[string]string, error) {
 	enrichmentsList := enrichments[fixedby.Type]
diff --git a/pkg/scannerv4/mappers/mappers_test.go b/pkg/scannerv4/mappers/mappers_test.go
index 23916fe6fd0c1..e46084b043fb4 100644
--- a/pkg/scannerv4/mappers/mappers_test.go
+++ b/pkg/scannerv4/mappers/mappers_test.go
@@ -2,8 +2,7 @@ package mappers
 
 import (
 	"encoding/json"
-	"slices"
-	"strings"
+	"strconv"
 	"testing"
 	"time"
 
@@ -470,361 +469,6 @@ func Test_ToProtoV4VulnerabilityReport_FilterNodeJS(t *testing.T) {
 	}
 }
 
-func TestToProtoV4VulnerabilityReport_FilterRHCCLayers(t *testing.T) {
-	testutils.MustUpdateFeature(t, features.ScannerV4RedHatLayers, true)
-
-	layerA := claircore.MustParseDigest("sha256:" + strings.Repeat("a", 64))
-	layerB := claircore.MustParseDigest("sha256:" + strings.Repeat("b", 64))
-
-	tests := map[string]struct {
-		arg     *claircore.VulnerabilityReport
-		want    *v4.VulnerabilityReport
-		wantErr string
-	}{
-		"filter non-RPM packages in Red Hat layers": {
-			arg: &claircore.VulnerabilityReport{
-				Hash: claircore.MustParseDigest("sha256:9124cd5256c6d674f6b11a4d01fea8148259be1f66ca2cf9dfbaafc83c31874e"),
-				Vulnerabilities: map[string]*claircore.Vulnerability{
-					"0": {
-						ID:      "0",
-						Name:    "0",
-						Updater: "rhel-vex",
-					},
-					"1": {
-						ID:      "1",
-						Name:    "1",
-						Updater: "rhel-vex",
-					},
-					"2": {
-						ID:      "2",
-						Name:    "2",
-						Updater: "something else",
-					},
-					"3": {
-						ID:      "3",
-						Name:    "3",
-						Updater: "something different",
-					},
-				},
-				Packages: map[string]*claircore.Package{
-					"0": {
-						ID:      "0",
-						Name:    "my go binary",
-						Version: "0",
-					},
-					"1": {
-						ID:      "1",
-						Name:    "my java jar",
-						Version: "1",
-					},
-					"2": {
-						ID:      "2",
-						Name:    "my python egg",
-						Version: "2",
-					},
-					"3": {
-						ID:      "3",
-						Name:    "my ruby gem",
-						Version: "3",
-					},
-				},
-				Repositories: map[string]*claircore.Repository{
-					"0": {
-						ID:   "0",
-						Name: "Red Hat Container Catalog",
-						URI:  `https://catalog.redhat.com/software/containers/explore`,
-					},
-					"something else": {
-						ID:   "1",
-						Name: "something else",
-						Key:  "rhel-cpe-repository",
-						URI:  "somethingelse.com",
-					},
-				},
-				Environments: map[string][]*claircore.Environment{
-					"0": {
-						{
-							RepositoryIDs: []string{"0", "something else"},
-							IntroducedIn:  layerA,
-						},
-					},
-					"1": {
-						{
-							RepositoryIDs: []string{"something else"},
-							IntroducedIn:  layerB,
-						},
-					},
-					"2": {
-						{
-							RepositoryIDs: []string{"0"},
-							IntroducedIn:  layerA,
-						},
-					},
-					"3": {
-						{
-							RepositoryIDs: []string{"something else"},
-							IntroducedIn:  layerB,
-						},
-					},
-				},
-				PackageVulnerabilities: map[string][]string{
-					"0": {"2", "0", "3", "1"},
-					"1": {"1", "2"},
-					"2": {"2", "3"},
-					"3": {"0", "1", "2", "3"},
-				},
-			},
-			want: &v4.VulnerabilityReport{
-				// Converter doesn't set HashId to empty.
-				HashId: "",
-				Vulnerabilities: map[string]*v4.VulnerabilityReport_Vulnerability{
-					"0": {
-						Id:      "0",
-						Name:    "0",
-						Updater: "rhel-vex",
-					},
-					"1": {
-						Id:      "1",
-						Name:    "1",
-						Updater: "rhel-vex",
-					},
-					"2": {
-						Id:      "2",
-						Name:    "2",
-						Updater: "something else",
-					},
-					"3": {
-						Id:      "3",
-						Name:    "3",
-						Updater: "something different",
-					},
-				},
-				PackageVulnerabilities: map[string]*v4.StringList{
-					"0": {
-						Values: []string{"0", "1"},
-					},
-					"1": {
-						Values: []string{"1", "2"},
-					},
-					"3": {
-						Values: []string{"0", "1", "2", "3"},
-					},
-				},
-				Contents: &v4.Contents{
-					Packages: map[string]*v4.Package{
-						"0": {
-							Id:      "0",
-							Name:    "my go binary",
-							Version: "0",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-						"1": {
-							Id:      "1",
-							Name:    "my java jar",
-							Version: "1",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-						"2": {
-							Id:      "2",
-							Name:    "my python egg",
-							Version: "2",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-						"3": {
-							Id:      "3",
-							Name:    "my ruby gem",
-							Version: "3",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-					},
-					PackagesDEPRECATED: []*v4.Package{
-						{
-							Id:      "0",
-							Name:    "my go binary",
-							Version: "0",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-						{
-							Id:      "1",
-							Name:    "my java jar",
-							Version: "1",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-						{
-							Id:      "2",
-							Name:    "my python egg",
-							Version: "2",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-						{
-							Id:      "3",
-							Name:    "my ruby gem",
-							Version: "3",
-							NormalizedVersion: &v4.NormalizedVersion{
-								V: []int32{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-							},
-							Kind: "unknown",
-							Cpe:  emptyCPE,
-						},
-					},
-					Repositories: map[string]*v4.Repository{
-						"0": {
-							Id:   "0",
-							Name: "Red Hat Container Catalog",
-							Uri:  `https://catalog.redhat.com/software/containers/explore`,
-							Cpe:  emptyCPE,
-						},
-						"something else": {
-							Id:   "1",
-							Name: "something else",
-							Key:  "rhel-cpe-repository",
-							Uri:  "somethingelse.com",
-							Cpe:  emptyCPE,
-						},
-					},
-					RepositoriesDEPRECATED: []*v4.Repository{
-						{
-							Id:   "0",
-							Name: "Red Hat Container Catalog",
-							Uri:  `https://catalog.redhat.com/software/containers/explore`,
-							Cpe:  emptyCPE,
-						},
-						{
-							Id:   "1",
-							Name: "something else",
-							Key:  "rhel-cpe-repository",
-							Uri:  "somethingelse.com",
-							Cpe:  emptyCPE,
-						},
-					},
-					Environments: map[string]*v4.Environment_List{
-						"0": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"0", "something else"},
-									IntroducedIn:  layerA.String(),
-								},
-							},
-						},
-						"1": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"something else"},
-									IntroducedIn:  layerB.String(),
-								},
-							},
-						},
-						"2": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"0"},
-									IntroducedIn:  layerA.String(),
-								},
-							},
-						},
-						"3": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"something else"},
-									IntroducedIn:  layerB.String(),
-								},
-							},
-						},
-					},
-					EnvironmentsDEPRECATED: map[string]*v4.Environment_List{
-						"0": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"0", "1"},
-									IntroducedIn:  layerA.String(),
-								},
-							},
-						},
-						"1": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"1"},
-									IntroducedIn:  layerB.String(),
-								},
-							},
-						},
-						"2": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"0"},
-									IntroducedIn:  layerA.String(),
-								},
-							},
-						},
-						"3": {
-							Environments: []*v4.Environment{
-								{
-									RepositoryIds: []string{"1"},
-									IntroducedIn:  layerB.String(),
-								},
-							},
-						},
-					},
-				},
-			},
-			wantErr: "",
-		},
-	}
-	for name, tt := range tests {
-		t.Run(name, func(t *testing.T) {
-			ctx := test.Logging(t)
-			got, err := ToProtoV4VulnerabilityReport(ctx, tt.arg)
-			if tt.wantErr != "" {
-				assert.ErrorContains(t, err, tt.wantErr)
-				return
-			}
-			assert.NoError(t, err)
-
-			// The assert library cannot compare elements in slices like the ones below
-			// while ignoring order. So, sort each slice.
-			for _, pkgVulns := range got.GetPackageVulnerabilities() {
-				slices.Sort(pkgVulns.GetValues())
-			}
-			slices.SortFunc(got.GetContents().GetPackagesDEPRECATED(), func(a, b *v4.Package) int {
-				return strings.Compare(a.GetId(), b.GetId())
-			})
-			slices.SortFunc(got.GetContents().GetRepositoriesDEPRECATED(), func(a, b *v4.Repository) int {
-				return strings.Compare(a.GetId(), b.GetId())
-			})
-
-			protoassert.Equal(t, tt.want, got)
-		})
-	}
-}
-
 func Test_ToClairCoreIndexReport(t *testing.T) {
 	tests := map[string]struct {
 		arg     *v4.Contents
@@ -1062,6 +706,28 @@ func Test_ToClairCoreIndexReport(t *testing.T) {
 	}
 }
 
+func TestDeprecatedIndexContentsBecomeCurrentVulnerabilityContents(t *testing.T) {
+	const layerSHA = "sha256:9124cd5256c6d674f6b11a4d01fea8148259be1f66ca2cf9dfbaafc83c31874e"
+	index, err := ToClairCoreIndexReport(&v4.Contents{
+		PackagesDEPRECATED:     []*v4.Package{{Id: "marker", Name: "image", Kind: "ancestry"}},
+		RepositoriesDEPRECATED: []*v4.Repository{{Id: "rhcc", Key: "rhcc-container-repository"}},
+		EnvironmentsDEPRECATED: map[string]*v4.Environment_List{
+			"marker": {Environments: []*v4.Environment{{IntroducedIn: layerSHA, RepositoryIds: []string{"rhcc"}}}},
+		},
+	})
+	require.NoError(t, err)
+
+	report, err := ToProtoV4VulnerabilityReport(test.Logging(t), &claircore.VulnerabilityReport{
+		Packages:     index.Packages,
+		Repositories: index.Repositories,
+		Environments: index.Environments,
+	})
+	require.NoError(t, err)
+	require.Contains(t, report.GetContents().GetPackages(), "marker")
+	require.Equal(t, "rhcc-container-repository", report.GetContents().GetRepositories()["rhcc"].GetKey())
+	require.Equal(t, layerSHA, report.GetContents().GetEnvironments()["marker"].GetEnvironments()[0].GetIntroducedIn())
+}
+
 func Test_toProtoV4Package(t *testing.T) {
 	tests := []struct {
 		name    string
@@ -3261,3 +2927,97 @@ func Test_PackageKindRoundTrip(t *testing.T) {
 		})
 	}
 }
+
+func Test_toCPEString(t *testing.T) {
+	tests := []struct {
+		name    string
+		arg     cpe.WFN
+		want    string
+		wantErr string
+	}{
+		{
+			name: "when zero value then wildcard",
+			arg:  cpe.WFN{},
+			want: emptyCPE,
+		},
+		{
+			name: "when wildcard then wildcard",
+			arg:  cpe.MustUnbind(emptyCPE),
+			want: emptyCPE,
+		},
+		{
+			name: "when set then bound",
+			arg:  cpe.MustUnbind("cpe:/a:redhat:openshift:4.12::el8"),
+			want: "cpe:2.3:a:redhat:openshift:4.12:*:el8:*:*:*:*:*",
+		},
+		{
+			name:    "when invalid then error",
+			arg:     cpe.WFN{Attr: [cpe.NumAttr]cpe.Value{cpe.Part: {Kind: cpe.ValueSet, V: "x"}}},
+			wantErr: "disallowed value",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := toCPEString(tt.arg)
+			if tt.wantErr != "" {
+				assert.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func Test_toClairCoreCPE(t *testing.T) {
+	tests := []struct {
+		name    string
+		arg     string
+		want    cpe.WFN
+		wantErr string
+	}{
+		{
+			name: "when empty then zero value",
+			arg:  "",
+			want: cpe.WFN{},
+		},
+		{
+			name: "when wildcard then no error",
+			arg:  emptyCPE,
+			want: cpe.MustUnbind(emptyCPE),
+		},
+		{
+			name: "when set then unbound",
+			arg:  "cpe:2.3:a:redhat:openshift:4.12:*:el8:*:*:*:*:*",
+			want: cpe.MustUnbind("cpe:2.3:a:redhat:openshift:4.12:*:el8:*:*:*:*:*"),
+		},
+		{
+			name:    "when invalid then error",
+			arg:     "not a cpe",
+			wantErr: `"not a cpe": `,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := toClairCoreCPE(tt.arg)
+			if tt.wantErr != "" {
+				assert.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func Test_CPERoundTrip(t *testing.T) {
+	for _, s := range []string{"", emptyCPE} {
+		t.Run("from "+strconv.Quote(s), func(t *testing.T) {
+			ccCPE, err := toClairCoreCPE(s)
+			require.NoError(t, err)
+			got, err := toCPEString(ccCPE)
+			require.NoError(t, err)
+			assert.Equal(t, emptyCPE, got)
+		})
+	}
+}
diff --git a/pkg/scannerv4/version.go b/pkg/scannerv4/version.go
index fb73588a0da45..10e51b54b188b 100644
--- a/pkg/scannerv4/version.go
+++ b/pkg/scannerv4/version.go
@@ -5,7 +5,7 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/mitchellh/mapstructure"
+	"github.com/go-viper/mapstructure/v2"
 )
 
 const (
diff --git a/pkg/search/options.go b/pkg/search/options.go
index 9d9f38637eff1..6c417f6cff858 100644
--- a/pkg/search/options.go
+++ b/pkg/search/options.go
@@ -55,24 +55,26 @@ var (
 	Severity       = newFieldLabel("Severity")
 	Disabled       = newFieldLabel("Disabled")
 
-	CVEID              = newFieldLabel("CVE ID")
-	CVE                = newFieldLabel("CVE")
-	CVEType            = newFieldLabel("CVE Type")
-	CVEPublishedOn     = newFieldLabel("CVE Published On")
-	CVEFixAvailable    = newFieldLabel("CVE Fix Available Timestamp")
-	CVECreatedTime     = newFieldLabel("CVE Created Time")
-	CVESuppressed      = newFieldLabel("CVE Snoozed")
-	CVESuppressExpiry  = newFieldLabel("CVE Snooze Expiry")
-	CVSS               = newFieldLabel("CVSS")
-	NVDCVSS            = newFieldLabel("NVD CVSS")
-	ImpactScore        = newFieldLabel("Impact Score")
-	VulnerabilityState = newFieldLabel("Vulnerability State")
-	CVEOrphaned        = newFieldLabel("CVE Orphaned")
-	CVEOrphanedTime    = newFieldLabel("CVE Orphaned Time")
-	EPSSProbablity     = newFieldLabel("EPSS Probability")
-	AdvisoryName       = newFieldLabel("Advisory Name")
-	AdvisoryLink       = newFieldLabel("Advisory Link")
-	CisaKev            = newFieldLabel("CISA KEV")
+	CVEID                   = newFieldLabel("CVE ID")
+	CVE                     = newFieldLabel("CVE")
+	CVEType                 = newFieldLabel("CVE Type")
+	CVEPublishedOn          = newFieldLabel("CVE Published On")
+	CVEFixAvailable         = newFieldLabel("CVE Fix Available Timestamp")
+	CVECreatedTime          = newFieldLabel("CVE Created Time")
+	CVEOrigin               = newFieldLabel("CVE Origin")
+	CVESuppressed           = newFieldLabel("CVE Snoozed")
+	CVESuppressExpiry       = newFieldLabel("CVE Snooze Expiry")
+	CVSS                    = newFieldLabel("CVSS")
+	NVDCVSS                 = newFieldLabel("NVD CVSS")
+	ImpactScore             = newFieldLabel("Impact Score")
+	VulnerabilityState      = newFieldLabel("Vulnerability State")
+	CVEOrphaned             = newFieldLabel("CVE Orphaned")
+	CVEOrphanedTime         = newFieldLabel("CVE Orphaned Time")
+	EPSSProbablity          = newFieldLabel("EPSS Probability")
+	AdvisoryName            = newFieldLabel("Advisory Name")
+	AdvisoryLink            = newFieldLabel("Advisory Link")
+	CisaKev                 = newFieldLabel("CISA KEV")
+	KnownRansomwareCampaign = newFieldLabel("Known Ransomware Campaign")
 
 	CVEInfo = newFieldLabel("CVE Info")
 
@@ -498,14 +500,15 @@ var (
 	AuthProviderName = newFieldLabel("AuthProvider Name")
 
 	// Virtual Machine fields.
-	VirtualMachineID       = newFieldLabel("Virtual Machine ID")
-	VirtualMachineName     = newFieldLabel("Virtual Machine Name")
-	GuestOS                = newFieldLabel("Guest OS")
-	VirtualMachineState    = newFieldLabel("Virtual Machine State")
-	VirtualMachineScanID   = newFieldLabel("Virtual Machine Scan ID")
-	VirtualMachineScanTime = newFieldLabel("Virtual Machine Scan Time")
-	VirtualMachineScanOS   = newFieldLabel("Virtual Machine Scan OS")
-	VirtualMachineTopCVSS  = newFieldLabel("Virtual Machine Top CVSS")
+	VirtualMachineID               = newFieldLabel("Virtual Machine ID")
+	VirtualMachineName             = newFieldLabel("Virtual Machine Name")
+	GuestOS                        = newFieldLabel("Guest OS")
+	VirtualMachineState            = newFieldLabel("Virtual Machine State")
+	VirtualMachineScanID           = newFieldLabel("Virtual Machine Scan ID")
+	VirtualMachineScanTime         = newFieldLabel("Virtual Machine Scan Time")
+	VirtualMachineScanOS           = newFieldLabel("Virtual Machine Scan OS")
+	VirtualMachineTopCVSS          = newFieldLabel("Virtual Machine Top CVSS")
+	VirtualMachineLastAgentContact = newFieldLabel("Last Agent Contact")
 
 	// Test Search Fields
 	TestKey               = newFieldLabel("Test Key")
diff --git a/pkg/search/policycategory/transform.go b/pkg/search/policycategory/transform.go
index f06a8c00d38b7..cdfe4a418982b 100644
--- a/pkg/search/policycategory/transform.go
+++ b/pkg/search/policycategory/transform.go
@@ -2,9 +2,19 @@ package policycategory
 
 import (
 	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/pkg/postgres/schema"
 	"github.com/stackrox/rox/pkg/search"
 )
 
+// CategorySearchOptions maps the "Category" label to PolicyCategoryName for POLICIES autocomplete,
+var CategorySearchOptions search.OptionsMap
+
+// init populates CategorySearchOptions from the PolicyCategoriesSchema at startup.
+func init() {
+	CategorySearchOptions = search.NewOptionsMap(v1.SearchCategory_POLICIES).
+		Add(search.Category, schema.PolicyCategoriesSchema.OptionsMap.MustGet(search.PolicyCategoryName.String()))
+}
+
 // TransformCategoryNameFieldsQuery transforms category name fields for the new data layout for categories in postgres.
 func TransformCategoryNameFieldsQuery(q *v1.Query) *v1.Query {
 	// Local copy to avoid changing input.
diff --git a/pkg/search/postgres/common.go b/pkg/search/postgres/common.go
index 3882fb1cafe5a..91dd377ca5adb 100644
--- a/pkg/search/postgres/common.go
+++ b/pkg/search/postgres/common.go
@@ -36,10 +36,9 @@ var (
 	emptyQueryErr = errox.InvalidArgs.New("empty query")
 
 	cursorDefaultTimeout = env.PostgresDefaultCursorTimeout.DurationSetting()
+	cursorBatchSize      = env.PostgresDefaultCursorBatchSize.IntegerSetting()
 )
 
-const cursorBatchSize = 1000
-
 type cursorSession struct {
 	id string
 	tx *postgres.Tx
@@ -1287,7 +1286,7 @@ func RunCursorQueryForSchemaFn[T any, PT pgutils.Unmarshaler[T]](ctx context.Con
 			}
 		}
 
-		if rowsAffected != cursorBatchSize {
+		if rowsAffected != int64(cursorBatchSize) {
 			return ctx.Err()
 		}
 	}
diff --git a/pkg/search/postgres/query/numeric_query.go b/pkg/search/postgres/query/numeric_query.go
index 154e9d550eef3..84303c994779a 100644
--- a/pkg/search/postgres/query/numeric_query.go
+++ b/pkg/search/postgres/query/numeric_query.go
@@ -24,7 +24,7 @@ var (
 	}
 
 	validPrefixesSortedByLengthDec = func() []string {
-		var validPrefixes []string
+		validPrefixes := make([]string, 0, 2*len(prefixesAndInversions)+2)
 		for _, pAndI := range prefixesAndInversions {
 			validPrefixes = append(validPrefixes, pAndI.prefix)
 			validPrefixes = append(validPrefixes, pAndI.inversion)
diff --git a/pkg/search/postgres/select.go b/pkg/search/postgres/select.go
index a038c1675a460..99cb304e7560c 100644
--- a/pkg/search/postgres/select.go
+++ b/pkg/search/postgres/select.go
@@ -12,9 +12,11 @@ import (
 	"github.com/georgysavva/scany/v2/pgxscan"
 	"github.com/pkg/errors"
 	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/pkg/contextutil"
 	"github.com/stackrox/rox/pkg/postgres"
 	"github.com/stackrox/rox/pkg/postgres/pgutils"
 	"github.com/stackrox/rox/pkg/postgres/walker"
+	"github.com/stackrox/rox/pkg/random"
 	searchPkg "github.com/stackrox/rox/pkg/search"
 	"github.com/stackrox/rox/pkg/search/enumregistry"
 	"github.com/stackrox/rox/pkg/search/paginated"
@@ -216,6 +218,122 @@ func RunSelectRequestForSchemaFn[T any](ctx context.Context, db postgres.DB, sch
 	})
 }
 
+// RunSelectCursorForSchemaFn executes a select request using a PostgreSQL server-side cursor.
+// It fetches rows in batches of cursorBatchSize (1000), keeping only one batch in PostgreSQL
+// server memory at a time. This is critical for large result sets where materializing the full
+// result would exhaust server memory.
+func RunSelectCursorForSchemaFn[T any](ctx context.Context, db postgres.DB, schema *walker.Schema, q *v1.Query, fn func(*T) error) (retErr error) {
+	var builtQuery *query
+	defer func() {
+		if r := recover(); r != nil {
+			if builtQuery != nil {
+				log.Errorf("Query issue: %s: %v", builtQuery.AsSQL(), r)
+			} else {
+				log.Errorf("Unexpected error running search request: %v", r)
+			}
+			debug.PrintStack()
+			retErr = fmt.Errorf("unexpected error running search request: %v", r)
+		}
+	}()
+
+	arrayFields := getArrayFieldsFromType[T]()
+
+	var err error
+	builtQuery, err = standardizeSelectQueryAndPopulatePath(ctx, q, schema, SELECT, arrayFields)
+	if err != nil {
+		return err
+	}
+	if builtQuery == nil {
+		return nil
+	}
+
+	ctx, cancel := contextutil.ContextWithTimeoutIfNotExists(ctx, cursorDefaultTimeout)
+	defer cancel()
+
+	cursor, err := pgutils.Retry2(ctx, func() (*cursorSession, error) {
+		return getSelectCursorSession(ctx, db, builtQuery)
+	})
+	if err != nil {
+		return errors.Wrap(err, "prepare cursor")
+	}
+	if cursor == nil {
+		return nil
+	}
+	defer cursor.close()
+
+	for {
+		rows, err := cursor.tx.Query(ctx, fmt.Sprintf("FETCH %d FROM %s", cursorBatchSize, cursor.id))
+		if err != nil {
+			return errors.Wrap(err, "fetching from cursor")
+		}
+
+		scanner := scanAPI.NewRowScanner(rows)
+		var batch []*T
+		for rows.Next() {
+			var row T
+			if err := scanner.Scan(&row); err != nil {
+				rows.Close()
+				return err
+			}
+			batch = append(batch, &row)
+		}
+		rows.Close()
+		if err := rows.Err(); err != nil {
+			return err
+		}
+
+		for _, r := range batch {
+			if err := fn(r); err != nil {
+				return err
+			}
+		}
+
+		if len(batch) < cursorBatchSize {
+			break
+		}
+	}
+	return nil
+}
+
+// getSelectCursorSession creates a cursor session for a pre-built SELECT query,
+// following the same tx-reuse pattern as retryableGetCursorSession in common.go.
+func getSelectCursorSession(ctx context.Context, db postgres.DB, builtQuery *query) (*cursorSession, error) {
+	tx, parentTxExists := postgres.TxFromContext(ctx)
+	if !parentTxExists {
+		var err error
+		tx, err = db.Begin(ctx)
+		if err != nil {
+			return nil, errors.Wrap(err, "creating transaction for cursor")
+		}
+	}
+
+	cleanupFunc := func() {
+		if parentTxExists {
+			return
+		}
+		commitCtx, commitCancel := contextutil.ContextWithTimeoutIfNotExists(context.Background(), cursorDefaultTimeout)
+		defer commitCancel()
+		if err := tx.Commit(commitCtx); err != nil {
+			log.Errorf("error committing cursor transaction: %v", err)
+		}
+	}
+
+	cursorID := fmt.Sprintf("select_%s", random.GenerateString(16, random.CaseInsensitiveAlpha))
+	queryStr := builtQuery.AsSQL()
+
+	_, err := tx.Exec(ctx, fmt.Sprintf("DECLARE %s CURSOR FOR %s", cursorID, queryStr), builtQuery.Data...)
+	if err != nil {
+		cleanupFunc()
+		return nil, errors.Wrap(err, "declaring cursor")
+	}
+
+	return &cursorSession{
+		id:    cursorID,
+		tx:    tx,
+		close: cleanupFunc,
+	}, nil
+}
+
 func standardizeSelectQueryAndPopulatePath(ctx context.Context, q *v1.Query, schema *walker.Schema, queryType QueryType, arrayFields map[string]bool) (*query, error) {
 	nowForQuery := time.Now()
 
diff --git a/pkg/search/postgres/select_cursor_test.go b/pkg/search/postgres/select_cursor_test.go
new file mode 100644
index 0000000000000..490e722625a94
--- /dev/null
+++ b/pkg/search/postgres/select_cursor_test.go
@@ -0,0 +1,266 @@
+//go:build sql_integration
+
+package postgres_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stackrox/rox/pkg/postgres/pgtest"
+	"github.com/stackrox/rox/pkg/postgres/schema"
+	"github.com/stackrox/rox/pkg/sac"
+	"github.com/stackrox/rox/pkg/search"
+	pgSearch "github.com/stackrox/rox/pkg/search/postgres"
+	"github.com/stackrox/rox/pkg/search/postgres/aggregatefunc"
+	"github.com/stackrox/rox/tools/generate-helpers/pg-table-bindings/multitest/postgres"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRunSelectCursorForSchemaFn verifies that RunSelectCursorForSchemaFn
+// produces the same results as RunSelectRequestForSchemaFn. The cursor
+// path uses DECLARE CURSOR / FETCH N under the hood, so equivalence with
+// the non-cursor path is the key property.
+func TestRunSelectCursorForSchemaFn(t *testing.T) {
+	ctx := sac.WithAllAccess(context.Background())
+	testDB := pgtest.ForT(t)
+
+	store := postgres.New(testDB.DB)
+	for _, s := range getTestStructs() {
+		require.NoError(t, store.Upsert(ctx, s))
+	}
+
+	t.Run("select single field matches non-cursor path", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(search.NewQuerySelect(search.TestString)).
+			ProtoQuery()
+
+		var expected []*Struct1
+		err := pgSearch.RunSelectRequestForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			expected = append(expected, r)
+			return nil
+		})
+		require.NoError(t, err)
+		require.NotEmpty(t, expected)
+
+		var actual []*Struct1
+		err = pgSearch.RunSelectCursorForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.ElementsMatch(t, expected, actual)
+	})
+
+	t.Run("select with where clause", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(search.NewQuerySelect(search.TestString)).
+			AddExactMatches(search.TestString, "acs").
+			ProtoQuery()
+
+		var expected []*Struct1
+		err := pgSearch.RunSelectRequestForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			expected = append(expected, r)
+			return nil
+		})
+		require.NoError(t, err)
+
+		var actual []*Struct1
+		err = pgSearch.RunSelectCursorForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, expected, actual)
+	})
+
+	t.Run("select multiple fields from child table", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(
+				search.NewQuerySelect(search.TestNestedString),
+				search.NewQuerySelect(search.TestNestedBool),
+			).
+			AddExactMatches(search.TestNestedString, "nested_acs").
+			ProtoQuery()
+
+		var expected []*Struct2
+		err := pgSearch.RunSelectRequestForSchemaFn[Struct2](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct2) error {
+			expected = append(expected, r)
+			return nil
+		})
+		require.NoError(t, err)
+
+		var actual []*Struct2
+		err = pgSearch.RunSelectCursorForSchemaFn[Struct2](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct2) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, expected, actual)
+	})
+
+	t.Run("select with pagination preserves order", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(
+				search.NewQuerySelect(search.TestString),
+				search.NewQuerySelect(search.TestNestedString),
+			).
+			WithPagination(
+				search.NewPagination().
+					AddSortOption(search.NewSortOption(search.TestString)).
+					AddSortOption(search.NewSortOption(search.TestNestedString)),
+			).
+			ProtoQuery()
+
+		var expected []*Struct3
+		err := pgSearch.RunSelectRequestForSchemaFn[Struct3](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct3) error {
+			expected = append(expected, r)
+			return nil
+		})
+		require.NoError(t, err)
+
+		var actual []*Struct3
+		err = pgSearch.RunSelectCursorForSchemaFn[Struct3](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct3) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, expected, actual)
+	})
+
+	t.Run("select with derived fields and group by", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(
+				search.NewQuerySelect(search.TestNestedString).AggrFunc(aggregatefunc.Count),
+			).
+			AddGroupBy(search.TestNestedString).
+			ProtoQuery()
+
+		var expected []*DerivedStruct5
+		err := pgSearch.RunSelectRequestForSchemaFn[DerivedStruct5](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *DerivedStruct5) error {
+			expected = append(expected, r)
+			return nil
+		})
+		require.NoError(t, err)
+
+		var actual []*DerivedStruct5
+		err = pgSearch.RunSelectCursorForSchemaFn[DerivedStruct5](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *DerivedStruct5) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.ElementsMatch(t, expected, actual)
+	})
+
+	t.Run("nil query returns no results", func(t *testing.T) {
+		called := false
+		err := pgSearch.RunSelectCursorForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, nil, func(r *Struct1) error {
+			called = true
+			return nil
+		})
+		require.NoError(t, err)
+		assert.False(t, called)
+	})
+
+	t.Run("empty result set", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(search.NewQuerySelect(search.TestString)).
+			AddExactMatches(search.TestString, "nonexistent_value_xyz").
+			ProtoQuery()
+
+		var actual []*Struct1
+		err := pgSearch.RunSelectCursorForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Empty(t, actual)
+	})
+
+	t.Run("callback error propagates and stops iteration", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(search.NewQuerySelect(search.TestString)).
+			ProtoQuery()
+
+		expectedErr := errors.New("callback failed")
+		callCount := 0
+		err := pgSearch.RunSelectCursorForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			callCount++
+			return expectedErr
+		})
+		require.Error(t, err)
+		assert.ErrorIs(t, err, expectedErr)
+		assert.Equal(t, 1, callCount)
+	})
+
+	t.Run("callback error after multiple rows", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(search.NewQuerySelect(search.TestString)).
+			ProtoQuery()
+
+		expectedErr := errors.New("fail on third")
+		callCount := 0
+		err := pgSearch.RunSelectCursorForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			callCount++
+			if callCount == 3 {
+				return expectedErr
+			}
+			return nil
+		})
+		require.Error(t, err)
+		assert.ErrorIs(t, err, expectedErr)
+		assert.Equal(t, 3, callCount)
+	})
+
+	t.Run("select null timestamp field", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(
+				search.NewQuerySelect(search.TestString),
+				search.NewQuerySelect(search.TestTimestamp),
+			).
+			ProtoQuery()
+
+		var expected []*Struct5
+		err := pgSearch.RunSelectRequestForSchemaFn[Struct5](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct5) error {
+			expected = append(expected, r)
+			return nil
+		})
+		require.NoError(t, err)
+
+		var actual []*Struct5
+		err = pgSearch.RunSelectCursorForSchemaFn[Struct5](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct5) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.ElementsMatch(t, expected, actual)
+	})
+
+	t.Run("select with limit", func(t *testing.T) {
+		q := search.NewQueryBuilder().
+			AddSelectFields(search.NewQuerySelect(search.TestString)).
+			WithPagination(
+				search.NewPagination().
+					AddSortOption(search.NewSortOption(search.TestString)).
+					Limit(2),
+			).
+			ProtoQuery()
+
+		var expected []*Struct1
+		err := pgSearch.RunSelectRequestForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			expected = append(expected, r)
+			return nil
+		})
+		require.NoError(t, err)
+		require.Len(t, expected, 2)
+
+		var actual []*Struct1
+		err = pgSearch.RunSelectCursorForSchemaFn[Struct1](ctx, testDB.DB, schema.TestStructsSchema, q, func(r *Struct1) error {
+			actual = append(actual, r)
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, expected, actual)
+	})
+}
diff --git a/pkg/search/predicate/base_predicates.go b/pkg/search/predicate/base_predicates.go
index 1497c46ed3935..556695794f25e 100644
--- a/pkg/search/predicate/base_predicates.go
+++ b/pkg/search/predicate/base_predicates.go
@@ -38,7 +38,7 @@ func createBasePredicate(fullPath string, fieldType reflect.Type, value string)
 	case reflect.Bool:
 		return createBoolPredicate(fullPath, value)
 	case reflect.Int64, reflect.Int32, reflect.Int16, reflect.Int8, reflect.Int:
-		if enum, ok := reflect.Zero(fieldType).Interface().(protoreflect.ProtoEnum); ok {
+		if enum, ok := reflect.TypeAssert[protoreflect.ProtoEnum](reflect.Zero(fieldType)); ok {
 			return createEnumPredicate(fullPath, value, enum)
 		}
 		return createIntPredicate(fullPath, value)
diff --git a/pkg/search/predicate/timestamp_predicate.go b/pkg/search/predicate/timestamp_predicate.go
index 2dd98eb589f75..18aea5f5e070e 100644
--- a/pkg/search/predicate/timestamp_predicate.go
+++ b/pkg/search/predicate/timestamp_predicate.go
@@ -14,7 +14,7 @@ func createTimestampPredicate(fullPath, value string) (internalPredicate, error)
 		return nil, err
 	}
 	return internalPredicateFunc(func(instance reflect.Value) (*search.Result, bool) {
-		instanceTS, ok := instance.Interface().(*protocompat.Timestamp)
+		instanceTS, ok := reflect.TypeAssert[*protocompat.Timestamp](instance)
 
 		if ok && baseMatcher(instanceTS) {
 			return &search.Result{
diff --git a/pkg/search/walker.go b/pkg/search/walker.go
index 2a4a3df0e3571..0e6262a8617a5 100644
--- a/pkg/search/walker.go
+++ b/pkg/search/walker.go
@@ -137,7 +137,7 @@ func (s *searchWalker) walkRecursive(prefix string, original reflect.Type) v1.Se
 	case reflect.Bool:
 		return v1.SearchDataType_SEARCH_BOOL
 	case reflect.Uint32, reflect.Uint64, reflect.Int32, reflect.Int64, reflect.Float32, reflect.Float64:
-		enum, ok := reflect.Zero(original).Interface().(protoreflect.ProtoEnum)
+		enum, ok := reflect.TypeAssert[protoreflect.ProtoEnum](reflect.Zero(original))
 		if !ok {
 			return v1.SearchDataType_SEARCH_NUMERIC
 		}
diff --git a/pkg/securedcluster/constants.go b/pkg/securedcluster/constants.go
index 45da4687d2c12..d1b2ba6d600b3 100644
--- a/pkg/securedcluster/constants.go
+++ b/pkg/securedcluster/constants.go
@@ -15,13 +15,13 @@ const (
 )
 
 // AllTLSSecretNames contains all TLS secret names used by SecuredCluster services.
-// Keep in sync with the constants above.
+// Scanner V2 (ScannerTLSSecretName / ScannerDbTLSSecretName) is intentionally excluded: it has
+// been removed and sensor no longer creates those secrets, so the operator must not require them
+// when verifying TLS-secret CA consistency (otherwise the SecuredCluster stays Irreconcilable).
 var AllTLSSecretNames = []string{
 	SensorTLSSecretName,
 	CollectorTLSSecretName,
 	AdmissionControlTLSSecretName,
-	ScannerTLSSecretName,
-	ScannerDbTLSSecretName,
 	ScannerV4IndexerTLSSecretName,
 	ScannerV4DbTLSSecretName,
 }
diff --git a/pkg/signatures/cosign_sig_fetcher.go b/pkg/signatures/cosign_sig_fetcher.go
index ae3ac21bffd84..468214b06e37b 100644
--- a/pkg/signatures/cosign_sig_fetcher.go
+++ b/pkg/signatures/cosign_sig_fetcher.go
@@ -121,12 +121,12 @@ func (c *cosignSignatureFetcher) FetchSignatures(ctx context.Context, image *sto
 	if tagErr == nil {
 		allPayloads = append(allPayloads, tagPayloads...)
 	} else {
-		log.Warnf("Tag-based discovery failed for %q: %v", fullImageName, tagErr)
+		log.Debugf("Tag-based discovery failed for %q: %v", fullImageName, tagErr)
 	}
 	if referrerErr == nil {
 		allPayloads = append(allPayloads, referrerPayloads...)
 	} else {
-		log.Warnf("Referrer-based discovery failed for %q: %v", fullImageName, referrerErr)
+		log.Debugf("Referrer-based discovery failed for %q: %v", fullImageName, referrerErr)
 	}
 
 	// Return an error only when both discovery paths failed.
diff --git a/pkg/signatures/cosign_sig_verifier.go b/pkg/signatures/cosign_sig_verifier.go
index 04e223e5df7cb..e9c6f271a7dd5 100644
--- a/pkg/signatures/cosign_sig_verifier.go
+++ b/pkg/signatures/cosign_sig_verifier.go
@@ -5,20 +5,25 @@ import (
 	"crypto"
 	"crypto/x509"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
 	"encoding/pem"
+	"fmt"
 	"os"
+	"time"
 
 	"github.com/google/go-containerregistry/pkg/name"
 	gcrv1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/hashicorp/go-multierror"
 	"github.com/pkg/errors"
-	"github.com/sigstore/cosign/v3/cmd/cosign/cli/fulcio"
 	"github.com/sigstore/cosign/v3/pkg/cosign"
 	"github.com/sigstore/cosign/v3/pkg/cosign/bundle"
 	"github.com/sigstore/cosign/v3/pkg/oci"
 	"github.com/sigstore/cosign/v3/pkg/oci/static"
 	rekorClient "github.com/sigstore/rekor/pkg/client"
+	sgbundle "github.com/sigstore/sigstore-go/pkg/bundle"
+	"github.com/sigstore/sigstore-go/pkg/root"
+	"github.com/sigstore/sigstore-go/pkg/verify"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/payload"
@@ -48,6 +53,16 @@ var (
 	errUnverifiedBundle     = errors.New("unverified transparency log bundle")
 )
 
+// verifiableSignature holds signature data ready for verification. Exactly one of
+// the two fields is populated:
+//   - sigstoreBundle: raw sigstore bundle JSON, verified via verifySigstoreBundle (sigstore-go).
+//   - signature: reconstructed oci.Signature from decomposed SimpleSigning fields, verified via
+//     cosign.VerifyImageSignature.
+type verifiableSignature struct {
+	sigstoreBundle []byte
+	signature      oci.Signature
+}
+
 var once sync.Once
 
 func setupTufRootDir() {
@@ -173,7 +188,7 @@ func (c *cosignSignatureVerifier) VerifySignature(ctx context.Context,
 		return storage.ImageSignatureVerificationResult_FAILED_VERIFICATION, nil, errNoVerificationData
 	}
 
-	sigs, hash, err := retrieveVerificationDataFromImage(image)
+	vsigs, hash, err := retrieveVerificationDataFromImage(image)
 	if err != nil {
 		return getVerificationResultStatusFromErr(err), nil, err
 	}
@@ -200,9 +215,9 @@ func (c *cosignSignatureVerifier) VerifySignature(ctx context.Context,
 	var mutex sync.Mutex
 	var wg sync.WaitGroup
 	for _, opts := range c.verifierOpts {
-		for cnt, sig := range sigs {
+		for cnt, vsig := range vsigs {
 			wg.Go(func() {
-				verifierRefs, err := verifyImageSignature(ctx, sig, hash, image, opts)
+				verifierRefs, err := verifySignature(ctx, vsig.sigstoreBundle, vsig.signature, hash, image, opts)
 				mutex.Lock()
 				defer mutex.Unlock()
 				if err != nil {
@@ -212,7 +227,6 @@ func (c *cosignSignatureVerifier) VerifySignature(ctx context.Context,
 					)
 					return
 				}
-				// Successful verification. Keep the image references.
 				verifiedImageReferences.AddAll(verifierRefs...)
 			})
 		}
@@ -228,16 +242,132 @@ func (c *cosignSignatureVerifier) VerifySignature(ctx context.Context,
 	return storage.ImageSignatureVerificationResult_FAILED_VERIFICATION, nil, allVerifyErrs
 }
 
+// transparencyLogsFromKeys converts cosign's TrustedTransparencyLogPubKeys map into
+// sigstore-go TransparencyLog entries.
+func transparencyLogsFromKeys(keys *cosign.TrustedTransparencyLogPubKeys) map[string]*root.TransparencyLog {
+	if keys == nil || len(keys.Keys) == 0 {
+		return nil
+	}
+	logs := make(map[string]*root.TransparencyLog, len(keys.Keys))
+	for logID, key := range keys.Keys {
+		idBytes, err := hex.DecodeString(logID)
+		if err != nil {
+			log.Warnf("Skipping transparency log key with malformed log ID %q: %v", logID, err)
+			continue
+		}
+		logs[logID] = &root.TransparencyLog{
+			ID:                idBytes,
+			PublicKey:         key.PubKey,
+			HashFunc:          crypto.SHA256,
+			SignatureHashFunc: crypto.SHA256,
+			// sigstore-go VerifySET rejects zero-value ValidityPeriodStart
+			// as "not set". Unix epoch is a non-zero sentinel meaning "always valid".
+			ValidityPeriodStart: time.Unix(0, 0),
+		}
+	}
+	return logs
+}
+
+// trustedMaterialFromTlogKeys builds a root.TrustedMaterial from the Rekor and CTLog keys
+// on CheckOpts. Returns nil if no custom keys are configured (verifySigstoreBundle will
+// fall back to the public Sigstore TUF root).
+func trustedMaterialFromTlogKeys(opts cosign.CheckOpts) (root.TrustedMaterial, error) {
+	rekorLogs := transparencyLogsFromKeys(opts.RekorPubKeys)
+	ctLogs := transparencyLogsFromKeys(opts.CTLogPubKeys)
+	if len(rekorLogs) == 0 && len(ctLogs) == 0 {
+		return nil, nil
+	}
+	tr, err := root.NewTrustedRoot(root.TrustedRootMediaType01, nil, ctLogs, nil, rekorLogs)
+	if err != nil {
+		return nil, fmt.Errorf("building trusted root from transparency log keys: %w", err)
+	}
+	return tr, nil
+}
+
+// trustedMaterialFromCertificateChain builds a root.TrustedMaterial from a custom certificate
+// chain. The last cert in the chain is treated as the root; the rest are intermediates.
+func trustedMaterialFromCertificateChain(chain []*x509.Certificate, opts cosign.CheckOpts) (root.TrustedMaterial, error) {
+	ca := &root.FulcioCertificateAuthority{
+		Root:          chain[len(chain)-1],
+		Intermediates: chain[:len(chain)-1],
+	}
+	return root.NewTrustedRoot(
+		root.TrustedRootMediaType01,
+		[]root.CertificateAuthority{ca},
+		transparencyLogsFromKeys(opts.CTLogPubKeys),
+		nil,
+		transparencyLogsFromKeys(opts.RekorPubKeys),
+	)
+}
+
+// augmentTrustedMaterialWithSigChain extracts intermediates from a SimpleSigning
+// signature's embedded certificate chain and merges them into the TrustedMaterial.
+// This is necessary because cosign's ValidateAndUnpackCertWithIntermediates ignores
+// sig.Chain() intermediates when TrustedMaterial is set, but the configured chain
+// may only contain the root CA (BYOPKI pattern where the signer provides the
+// intermediate chain).
+func augmentTrustedMaterialWithSigChain(cosignOpts *cosign.CheckOpts, sig oci.Signature) error {
+	sigChain, err := sig.Chain()
+	if err != nil || len(sigChain) <= 1 {
+		return err
+	}
+	sigIntermediates := sigChain[:len(sigChain)-1]
+
+	cas := cosignOpts.TrustedMaterial.FulcioCertificateAuthorities()
+	augmented := make([]root.CertificateAuthority, 0, len(cas))
+	for _, ca := range cas {
+		fca, ok := ca.(*root.FulcioCertificateAuthority)
+		if !ok {
+			augmented = append(augmented, ca)
+			continue
+		}
+		merged := &root.FulcioCertificateAuthority{
+			Root:                fca.Root,
+			Intermediates:       append(append([]*x509.Certificate{}, fca.Intermediates...), sigIntermediates...),
+			ValidityPeriodStart: fca.ValidityPeriodStart,
+			ValidityPeriodEnd:   fca.ValidityPeriodEnd,
+		}
+		augmented = append(augmented, merged)
+	}
+
+	tm, err := root.NewTrustedRoot(
+		root.TrustedRootMediaType01,
+		augmented,
+		cosignOpts.TrustedMaterial.CTLogs(),
+		cosignOpts.TrustedMaterial.TimestampingAuthorities(),
+		cosignOpts.TrustedMaterial.RekorLogs(),
+	)
+	if err != nil {
+		return fmt.Errorf("rebuilding trusted material with signature intermediates: %w", err)
+	}
+	cosignOpts.TrustedMaterial = tm
+	return nil
+}
+
+// sigstoreTrustedRoot returns the public Sigstore trusted root from TUF.
+func sigstoreTrustedRoot() (root.TrustedMaterial, error) {
+	tr, err := cosign.TrustedRoot()
+	if err != nil {
+		return nil, fmt.Errorf("loading sigstore trusted root: %w", err)
+	}
+	return tr, nil
+}
+
 func (c *cosignSignatureVerifier) createVerifierOpts(ctx context.Context) error {
 	defaultOpts, err := c.defaultCosignCheckOpts(ctx)
 	if err != nil {
 		return errors.Wrap(err, "creating default cosign check opts")
 	}
 
+	// Build TrustedMaterial once from the tlog keys for public key verifiers.
+	publicKeyTrustedMaterial, err := trustedMaterialFromTlogKeys(defaultOpts)
+	if err != nil {
+		return err
+	}
+
 	var verifierErrs error
 	// Public key verifiers.
 	for _, key := range c.parsedPublicKeys {
-		// For now, only supporting SHA256 as algorithm.
 		v, err := signature.LoadVerifier(key, crypto.SHA256)
 		if err != nil {
 			verifierErrs = multierror.Append(verifierErrs, errors.Wrap(err, "creating verifier"))
@@ -245,6 +375,7 @@ func (c *cosignSignatureVerifier) createVerifierOpts(ctx context.Context) error
 		}
 		opts := defaultOpts
 		opts.SigVerifier = v
+		opts.TrustedMaterial = publicKeyTrustedMaterial
 		c.verifierOpts = append(c.verifierOpts, opts)
 	}
 
@@ -317,9 +448,9 @@ func (c *cosignSignatureVerifier) defaultCosignCheckOpts(ctx context.Context) (c
 }
 
 func cosignCheckOptsFromCert(ctx context.Context, cert certVerificationData, opts cosign.CheckOpts) (cosign.CheckOpts, error) {
-	// Skip verifying the identities when the wildcard matching logic being used. This fixes an issue
-	// with verifying the identity which will yield an error when using the wildcard expressions _and_ the certificate
-	// to verify has no identities associated with it (i.e. within the BYOPKI use-case).
+	// Only set non-wildcard identities. CheckCertificatePolicy fails on BYOPKI certs
+	// that lack OIDC extensions. For the sigstore-go bundle path, verifySigstoreBundle
+	// injects wildcard identities when Identities is empty and SigVerifier is nil.
 	if cert.oidcIssuerExpr != ".*" && cert.identityExpr != ".*" {
 		opts.Identities = []cosign.Identity{{
 			IssuerRegExp:  cert.oidcIssuerExpr,
@@ -336,65 +467,87 @@ func cosignCheckOptsFromCert(ctx context.Context, cert certVerificationData, opt
 		}
 	}
 
-	// - If we have both cert and chain, we use both to verify the public key and the root.
-	// - If we only have the cert, we assume the fulcio trusted root.
-	// - If we only have the chain, we use this as the trusted root to verify certificates, if any.
-	// - If none is given, we set the fulcio roots.
-	switch {
-	case cert.cert != nil && len(cert.chain) > 0:
-		v, err := cosign.ValidateAndUnpackCertWithChain(cert.cert, cert.chain, &opts)
+	// Build TrustedMaterial: custom chain when provided, Sigstore (Fulcio) root otherwise.
+	// All certificate chain validation flows through TrustedMaterial — the legacy
+	// RootCerts/IntermediateCerts fields are not needed.
+	if len(cert.chain) > 0 {
+		opts.TrustedMaterial, err = trustedMaterialFromCertificateChain(cert.chain, opts)
 		if err != nil {
 			return opts, err
 		}
-		opts.SigVerifier = v
-		return opts, nil
-
-	case cert.cert != nil:
-		opts.RootCerts, err = fulcio.GetRoots()
+	} else {
+		opts.TrustedMaterial, err = sigstoreTrustedRoot()
 		if err != nil {
 			return opts, err
 		}
-		opts.IntermediateCerts, err = fulcio.GetIntermediates()
+	}
+
+	// When a leaf certificate is provided, validate it against TrustedMaterial and
+	// pin its public key as SigVerifier. This catches misconfigurations early (cert
+	// doesn't chain to the configured/Fulcio root, missing SCT) and pins the exact
+	// signing key so only signatures from this key are accepted.
+	if cert.cert != nil {
+		chains, err := verify.VerifyLeafCertificate(time.Now(), cert.cert, opts.TrustedMaterial)
 		if err != nil {
-			return opts, err
+			return opts, fmt.Errorf("validating configured certificate against trust root: %w", err)
 		}
-		v, err := cosign.ValidateAndUnpackCert(cert.cert, &opts)
-		if err != nil {
+		if err := cosign.CheckCertificatePolicy(cert.cert, &opts); err != nil {
 			return opts, err
 		}
-		opts.SigVerifier = v
-		return opts, nil
-
-	case len(cert.chain) > 0:
-		pool := x509.NewCertPool()
-		for _, caCert := range cert.chain {
-			pool.AddCert(caCert)
+		if !opts.IgnoreSCT {
+			contains, err := cosign.ContainsSCT(cert.cert.Raw)
+			if err != nil {
+				return opts, err
+			}
+			if !contains {
+				return opts, errors.New("certificate does not include required embedded SCT")
+			}
+			if err := verify.VerifySignedCertificateTimestamp(chains, 1, opts.TrustedMaterial); err != nil {
+				return opts, fmt.Errorf("verifying signed certificate timestamp: %w", err)
+			}
 		}
-		opts.RootCerts = pool
-		return opts, nil
-
-	default:
-		opts.RootCerts, err = fulcio.GetRoots()
+		v, err := signature.LoadVerifier(cert.cert.PublicKey, crypto.SHA256)
 		if err != nil {
-			return opts, err
+			return opts, errors.Wrap(err, "loading verifier from certificate")
 		}
-		return opts, nil
+		opts.SigVerifier = v
 	}
+
+	return opts, nil
 }
 
-func verifyImageSignature(ctx context.Context, signature oci.Signature,
+// verifySignature dispatches signature verification based on format:
+//   - Sigstore bundle: delegates to verifySigstoreBundle which uses cosign.VerifyNewBundle
+//     (sigstore-go). The bundle carries its own verification material (cert, tlog entry).
+//   - SimpleSigning: delegates to cosign.VerifyImageSignature which verifies the signature
+//     and rekor bundle (transparency log proof) from the decomposed proto fields.
+func verifySignature(ctx context.Context, sigstoreBundle []byte, sig oci.Signature,
 	imageHash gcrv1.Hash, image *storage.Image, cosignOpts cosign.CheckOpts,
 ) ([]string, error) {
-	// If there is no error during the verification, the signature was successfully verified
-	// as well as the claims.
-	bundleVerified, err := cosign.VerifyImageSignature(ctx, signature, imageHash, &cosignOpts)
+	// Verify DSSE Sigstore bundle.
+	if len(sigstoreBundle) > 0 {
+		return verifySigstoreBundle(ctx, sigstoreBundle, imageHash, image, cosignOpts)
+	}
+
+	// Verify SimpleSigning signature.
+	// cosign's ValidateAndUnpackCertWithIntermediates uses VerifyLeafCertificate when
+	// TrustedMaterial is set, which only considers CAs from the TrustedMaterial and
+	// ignores intermediates embedded in the signature. Merge them in so the chain
+	// builds correctly for BYOPKI setups where the configured chain is just the root.
+	if cosignOpts.TrustedMaterial != nil {
+		if err := augmentTrustedMaterialWithSigChain(&cosignOpts, sig); err != nil {
+			return nil, err
+		}
+	}
+	rekorVerified, err := cosign.VerifyImageSignature(ctx, sig, imageHash, &cosignOpts)
 	if err != nil {
 		return nil, err
 	}
-	if !bundleVerified && !cosignOpts.IgnoreTlog {
+	if !rekorVerified && !cosignOpts.IgnoreTlog {
 		return nil, errUnverifiedBundle
 	}
-	refs, err := getVerifiedImageReference(signature, image)
+
+	refs, err := getVerifiedImageReference(sig, image)
 	if err != nil {
 		return nil, errors.Wrap(err, "getting verified image references")
 	}
@@ -404,6 +557,50 @@ func verifyImageSignature(ctx context.Context, signature oci.Signature,
 	return refs, nil
 }
 
+// verifySigstoreBundle verifies a sigstore bundle directly via cosign.VerifyNewBundle.
+// TrustedMaterial must be set by the caller (createVerifierOpts / cosignCheckOptsFromCert).
+func verifySigstoreBundle(ctx context.Context, sigstoreBundle []byte,
+	imageHash gcrv1.Hash, image *storage.Image, cosignOpts cosign.CheckOpts,
+) ([]string, error) {
+	if cosignOpts.TrustedMaterial == nil {
+		var err error
+		if cosignOpts.IgnoreTlog {
+			cosignOpts.TrustedMaterial, err = root.NewTrustedRoot(root.TrustedRootMediaType01, nil, nil, nil, nil)
+		} else {
+			cosignOpts.TrustedMaterial, err = sigstoreTrustedRoot()
+		}
+		if err != nil {
+			return nil, fmt.Errorf("loading trusted material for bundle verification: %w", err)
+		}
+	}
+
+	// sigstore-go requires at least one identity for cert-based verification.
+	// cosignCheckOptsFromCert skips Identities for wildcard BYOPKI certs (they lack
+	// OIDC extensions that the legacy path would check), so inject them here.
+	if len(cosignOpts.Identities) == 0 && cosignOpts.SigVerifier == nil {
+		cosignOpts.Identities = []cosign.Identity{{SubjectRegExp: ".*", IssuerRegExp: ".*"}}
+	}
+
+	bundle := &sgbundle.Bundle{}
+	if err := bundle.UnmarshalJSON(sigstoreBundle); err != nil {
+		return nil, fmt.Errorf("unmarshalling sigstore bundle: %w", err)
+	}
+
+	digestBytes, err := hex.DecodeString(imageHash.Hex)
+	if err != nil {
+		return nil, fmt.Errorf("decoding image digest hex: %w", err)
+	}
+
+	artifactPolicy := verify.WithArtifactDigest(imageHash.Algorithm, digestBytes)
+	if _, err := cosign.VerifyNewBundle(ctx, &cosignOpts, artifactPolicy, bundle); err != nil {
+		return nil, err
+	}
+
+	// Sigstore bundles bind to the image digest, not a docker reference, so all
+	// names sharing the same digest are considered verified.
+	return getAllImageReferences(image), nil
+}
+
 // getVerificationResultStatusFromErr will map an error to a specific storage.ImageSignatureVerificationResult_Status.
 // This is done in an effort to return appropriate status codes to the client triggering the signature verification.
 func getVerificationResultStatusFromErr(err error) storage.ImageSignatureVerificationResult_Status {
@@ -433,7 +630,13 @@ func unmarshalRekorBundle(byteBundle []byte) (*bundle.RekorBundle, error) {
 	return rekorBundle, nil
 }
 
-func retrieveVerificationDataFromImage(image *storage.Image) ([]oci.Signature, gcrv1.Hash, error) {
+// retrieveVerificationDataFromImage reads stored signatures from the image proto and
+// prepares them for verification. Two storage formats are handled:
+//   - SigstoreBundle set: the raw bundle JSON is carried through for verifySigstoreBundle.
+//   - SigstoreBundle empty (legacy): the decomposed fields (RawSignature, SignaturePayload,
+//     CertPem, CertChainPem, RekorBundle) are reassembled into an oci.Signature for
+//     cosign.VerifyImageSignature.
+func retrieveVerificationDataFromImage(image *storage.Image) ([]verifiableSignature, gcrv1.Hash, error) {
 	imgSHA := imgUtils.GetSHA(image)
 	// If there is no digest associated with the image, we cannot safely do signature and claim verification.
 	if imgSHA == "" {
@@ -454,19 +657,29 @@ func retrieveVerificationDataFromImage(image *storage.Image) ([]oci.Signature, g
 			"invalid hashing algorithm %s used, only SHA256 is supported", hash.Algorithm)
 	}
 
-	// Each signature contains the base64 encoded version of it and the associated payload.
-	// In the future, this will also include potential rekor bundles for keyless verification.
-	signatures := make([]oci.Signature, 0, len(image.GetSignature().GetSignatures()))
+	vsigs := make([]verifiableSignature, 0, len(image.GetSignature().GetSignatures()))
 	for _, imgSig := range image.GetSignature().GetSignatures() {
 		if imgSig.GetCosign() == nil {
 			continue
 		}
-		b64Sig := base64.StdEncoding.EncodeToString(imgSig.GetCosign().GetRawSignature())
+
+		cosignSig := imgSig.GetCosign()
+
+		// Sigstore bundle: carry the raw bundle for direct sigstore-go verification.
+		if len(cosignSig.GetSigstoreBundle()) > 0 {
+			vsigs = append(vsigs, verifiableSignature{
+				sigstoreBundle: cosignSig.GetSigstoreBundle(),
+			})
+			continue
+		}
+
+		// Legacy decomposed fields.
+		b64Sig := base64.StdEncoding.EncodeToString(cosignSig.GetRawSignature())
 		sigOpts := []static.Option{
-			static.WithCertChain(imgSig.GetCosign().GetCertPem(), imgSig.GetCosign().GetCertChainPem()),
+			static.WithCertChain(cosignSig.GetCertPem(), cosignSig.GetCertChainPem()),
 		}
 
-		rekorBundle, err := unmarshalRekorBundle(imgSig.GetCosign().GetRekorBundle())
+		rekorBundle, err := unmarshalRekorBundle(cosignSig.GetRekorBundle())
 		if err != nil {
 			log.Errorf("Failed to unmarshal rekor bundle for image %q: %s", image.GetName().GetFullName(), err)
 		}
@@ -474,19 +687,21 @@ func retrieveVerificationDataFromImage(image *storage.Image) ([]oci.Signature, g
 			sigOpts = append(sigOpts, static.WithBundle(rekorBundle))
 		}
 
-		sig, err := static.NewSignature(imgSig.GetCosign().GetSignaturePayload(), b64Sig, sigOpts...)
+		sig, err := static.NewSignature(cosignSig.GetSignaturePayload(), b64Sig, sigOpts...)
 		if err != nil {
 			return nil, gcrv1.Hash{}, errCorruptedSignature.CausedBy(err)
 		}
-		signatures = append(signatures, sig)
+		vsigs = append(vsigs, verifiableSignature{
+			signature: sig,
+		})
 	}
 
-	return signatures, hash, nil
+	return vsigs, hash, nil
 }
 
 // getVerifiedImageReferenceFromSignature retrieves the verified docker reference in the format of
-// <registry>/<repository> from the payload of the oci.Signature and filters out image names that are verified by
-// the docker reference using the image names associated with the storage.Image.
+// <registry>/<repository> from the payload of the SimpleSigning oci.Signature and filters out image
+// names that are verified by the docker reference using the image names associated with the storage.Image.
 func getVerifiedImageReference(signature oci.Signature, image *storage.Image) ([]string, error) {
 	payloadBytes, err := signature.Payload()
 	if err != nil {
@@ -532,6 +747,19 @@ func getVerifiedImageReference(signature oci.Signature, image *storage.Image) ([
 	return verifiedImageReferences, nil
 }
 
+func getAllImageReferences(image *storage.Image) []string {
+	imageNames := protoutils.SliceUnique(
+		append([]*storage.ImageName{image.GetName()}, image.GetNames()...),
+	)
+	refs := make([]string, 0, len(imageNames))
+	for _, n := range imageNames {
+		if fullName := n.GetFullName(); fullName != "" {
+			refs = append(refs, fullName)
+		}
+	}
+	return refs
+}
+
 func equalRegistryRepository(signatureIdentity, imageName string) (bool, error) {
 	sigRef, err := name.ParseReference(signatureIdentity)
 	if err != nil {
diff --git a/pkg/signatures/cosign_sig_verifier_test.go b/pkg/signatures/cosign_sig_verifier_test.go
index f15ff47975b83..198cefd0cd412 100644
--- a/pkg/signatures/cosign_sig_verifier_test.go
+++ b/pkg/signatures/cosign_sig_verifier_test.go
@@ -2,11 +2,21 @@ package signatures
 
 import (
 	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
 	"encoding/base64"
+	"encoding/hex"
+	"encoding/pem"
 	"os"
 	"testing"
 
+	"github.com/sigstore/cosign/v3/pkg/cosign"
 	"github.com/sigstore/cosign/v3/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v3/pkg/oci/static"
+	"github.com/sigstore/sigstore-go/pkg/root"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/images/types"
@@ -482,6 +492,18 @@ func TestCosignVerifier_VerifySignature_Certificate(t *testing.T) {
 	bundle, err := os.ReadFile("testdata/bundle.json")
 	require.NoError(t, err)
 
+	// Pin the Rekor and CT log public keys used to sign the fixtures above instead of
+	// relying on cosign's default behaviour of fetching them from the live Sigstore TUF
+	// root (tuf-repo-cdn.sigstore.dev). That live fetch makes the test flaky/non-hermetic
+	// whenever the public CDN is unreachable or rate-limits CI (see ROX-36683). These are
+	// the same public keys embedded in github.com/sigstore/sigstore's vendored TUF
+	// repository (pkg/tuf/repository/targets/{rekor,ctfe_2022}.pub) and correspond exactly
+	// to the log IDs recorded in the fixtures (verified via the log's SHA-256 key ID).
+	rekorPubKey, err := os.ReadFile("testdata/rekor_pub.pem")
+	require.NoError(t, err)
+	ctfePubKey, err := os.ReadFile("testdata/ctfe_2022_pub.pem")
+	require.NoError(t, err)
+
 	imgWithTlog, err := generateImageWithCosignSignature(imgStringWithTlog, b64SignatureWithTlog,
 		b64PayloadWithTlog, certPEMWithTlog, chainPEMWithTlog, bundle)
 	require.NoError(t, err, "creating image with signature")
@@ -593,10 +615,15 @@ func TestCosignVerifier_VerifySignature_Certificate(t *testing.T) {
 					&storage.SignatureIntegration{
 						CosignCertificates: []*storage.CosignCertificateVerification{
 							{
-								CertificateIdentity:   ".*",
-								CertificateOidcIssuer: ".*",
+								// Pin the real Fulcio intermediate/root chain (the same data cosign would
+								// otherwise fetch live from the Sigstore TUF root) so that certificate chain
+								// validation does not require network access to tuf-repo-cdn.sigstore.dev.
+								CertificateChainPemEnc: string(chainPEMWithTlog),
+								CertificateIdentity:    ".*",
+								CertificateOidcIssuer:  ".*",
 								CertificateTransparencyLog: &storage.CertificateTransparencyLogVerification{
-									Enabled: true,
+									Enabled:         true,
+									PublicKeyPemEnc: string(ctfePubKey),
 								},
 							},
 						},
@@ -604,6 +631,7 @@ func TestCosignVerifier_VerifySignature_Certificate(t *testing.T) {
 						TransparencyLog: &storage.TransparencyLogVerification{
 							Enabled:         true,
 							ValidateOffline: true,
+							PublicKeyPemEnc: string(rekorPubKey),
 						},
 					},
 				)
@@ -623,7 +651,8 @@ func TestCosignVerifier_VerifySignature_Certificate(t *testing.T) {
 								CertificateIdentity:    ".*",
 								CertificateOidcIssuer:  ".*",
 								CertificateTransparencyLog: &storage.CertificateTransparencyLogVerification{
-									Enabled: true,
+									Enabled:         true,
+									PublicKeyPemEnc: string(ctfePubKey),
 								},
 							},
 						},
@@ -639,13 +668,17 @@ func TestCosignVerifier_VerifySignature_Certificate(t *testing.T) {
 					&storage.SignatureIntegration{
 						CosignCertificates: []*storage.CosignCertificateVerification{
 							{
-								CertificateIdentity:   ".*",
-								CertificateOidcIssuer: ".*",
+								// See comment above on pinning the Fulcio chain locally instead of relying
+								// on a live TUF fetch.
+								CertificateChainPemEnc: string(chainPEMWithTlog),
+								CertificateIdentity:    ".*",
+								CertificateOidcIssuer:  ".*",
 							},
 						},
 						TransparencyLog: &storage.TransparencyLogVerification{
 							Enabled:         true,
 							ValidateOffline: true,
+							PublicKeyPemEnc: string(rekorPubKey),
 						},
 					},
 				)
@@ -710,20 +743,21 @@ func TestRetrieveVerificationDataFromImage_Success(t *testing.T) {
 		b64CosignSignature, b64CosignSignaturePayload, nil, nil, nil)
 	require.NoError(t, err, "error creating image")
 
-	sigs, hash, err := retrieveVerificationDataFromImage(img)
+	vsigs, hash, err := retrieveVerificationDataFromImage(img)
 	require.NoError(t, err, "should not fail")
 
-	assert.Len(t, sigs, 1, "expected one signature")
-	sig := sigs[0]
-	b64sig, err := sig.Base64Signature()
+	assert.Len(t, vsigs, 1, "expected one signature")
+	vsig := vsigs[0]
+	b64sig, err := vsig.signature.Base64Signature()
 	require.NoError(t, err)
 	assert.Equal(t, b64CosignSignature, b64sig, "expected the base64 values of the signatures to match")
-	payload, err := sig.Payload()
+	payload, err := vsig.signature.Payload()
 	require.NoError(t, err)
 	expectedPayload, err := base64.StdEncoding.DecodeString(b64CosignSignaturePayload)
 	require.NoError(t, err)
 	assert.Equal(t, expectedPayload, payload, "expected the payloads of the signature to match")
 	assert.Equal(t, imgHash, hash.String(), "expected the hash to match the image's hash")
+	assert.Empty(t, vsig.sigstoreBundle)
 }
 
 func TestRetrieveVerificationDataFromImage_Failure(t *testing.T) {
@@ -754,6 +788,66 @@ func TestRetrieveVerificationDataFromImage_Failure(t *testing.T) {
 	}
 }
 
+func TestRetrieveVerificationDataFromImage_SigstoreBundle(t *testing.T) {
+	imgHash := "sha256:3a4d57227f02243dfc8a2849ec4a116646bed293b9e93cbf9d4a673a28ef6345"
+	bundleJSON := []byte(`{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json"}`)
+
+	cimg, err := imgUtils.GenerateImageFromString("docker.io/nginx@" + imgHash)
+	require.NoError(t, err)
+	img := types.ToImage(cimg)
+	img.Signature = &storage.ImageSignature{
+		Signatures: []*storage.Signature{
+			{
+				Signature: &storage.Signature_Cosign{
+					Cosign: &storage.CosignSignature{
+						SigstoreBundle:  bundleJSON,
+						SignatureFormat: storage.CosignSignature_DEAD_SIMPLE_SIGNING_ENVELOPE,
+					},
+				},
+			},
+		},
+	}
+
+	vsigs, hash, err := retrieveVerificationDataFromImage(img)
+	require.NoError(t, err)
+	assert.Len(t, vsigs, 1)
+	assert.Equal(t, bundleJSON, vsigs[0].sigstoreBundle)
+	assert.Nil(t, vsigs[0].signature)
+	assert.Equal(t, imgHash, hash.String())
+}
+
+func TestRetrieveVerificationDataFromImage_MixedFormats(t *testing.T) {
+	imgHash := "sha256:3a4d57227f02243dfc8a2849ec4a116646bed293b9e93cbf9d4a673a28ef6345"
+	bundleJSON := []byte(`{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json"}`)
+
+	img, err := generateImageWithCosignSignature("docker.io/nginx@"+imgHash,
+		"MEUCIDGMmJyxVKGPxvPk/QlRzMSGzcI8pYCy+MB7RTTpegzTAiEArssqWntVN8oJOMV0Aey0zhsNqRmEVQAY"+
+			"ZNkn8hkAnXI=",
+		"eyJjcml0aWNhbCI6eyJpZGVudGl0eSI6eyJkb2NrZXItcmVmZXJlbmNlIjoidHRsLnNoL2Q4ZDM4O"+
+			"TJkLTQ4YmQtNDY3MS1hNTQ2LTJlNzBhOTAwYjcwMiJ9LCJpbWFnZSI6eyJkb2NrZXItbWFuaWZlc3QtZGlnZXN0Ijoic2hhMjU2OmVlODli"+
+			"MDA1MjhmZjRmMDJmMjQwNWU0ZWUyMjE3NDNlYmMzZjhlOGRkMGJmZDVjNGMyMGEyZmEyYWFhN2VkZTMifSwidHlwZSI6ImNvc2lnbiBjb25"+
+			"0YWluZXIgaW1hZ2Ugc2lnbmF0dXJlIn0sIm9wdGlvbmFsIjpudWxsfQ==",
+		nil, nil, nil)
+	require.NoError(t, err)
+	// Add a second signature with a sigstore bundle.
+	img.GetSignature().Signatures = append(img.GetSignature().GetSignatures(), &storage.Signature{
+		Signature: &storage.Signature_Cosign{
+			Cosign: &storage.CosignSignature{
+				SigstoreBundle:  bundleJSON,
+				SignatureFormat: storage.CosignSignature_DEAD_SIMPLE_SIGNING_ENVELOPE,
+			},
+		},
+	})
+
+	vsigs, _, err := retrieveVerificationDataFromImage(img)
+	require.NoError(t, err)
+	assert.Len(t, vsigs, 2)
+	assert.NotNil(t, vsigs[0].signature, "first signature should be SimpleSigning")
+	assert.Empty(t, vsigs[0].sigstoreBundle)
+	assert.Nil(t, vsigs[1].signature, "second signature should be bundle-only")
+	assert.Equal(t, bundleJSON, vsigs[1].sigstoreBundle)
+}
+
 func TestEqualRegistryRepository(t *testing.T) {
 	cases := map[string]struct {
 		signatureIdentity string
@@ -841,3 +935,178 @@ func generateImageWithCosignSignature(imgString, b64Sig, b64SigPayload string,
 	}
 	return img, nil
 }
+
+func TestTransparencyLogsFromKeys(t *testing.T) {
+	ecKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	validLogID := hex.EncodeToString([]byte("valid-log-id-0123456789ab"))
+
+	cases := map[string]struct {
+		keys     *cosign.TrustedTransparencyLogPubKeys
+		expected int
+	}{
+		"nil keys returns nil": {
+			keys:     nil,
+			expected: 0,
+		},
+		"empty keys map returns nil": {
+			keys:     &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{}},
+			expected: 0,
+		},
+		"valid key is converted": {
+			keys: &cosign.TrustedTransparencyLogPubKeys{
+				Keys: map[string]cosign.TransparencyLogPubKey{
+					validLogID: {PubKey: ecKey.Public()},
+				},
+			},
+			expected: 1,
+		},
+		"malformed hex log ID is skipped": {
+			keys: &cosign.TrustedTransparencyLogPubKeys{
+				Keys: map[string]cosign.TransparencyLogPubKey{
+					"not-valid-hex!": {PubKey: ecKey.Public()},
+				},
+			},
+			expected: 0,
+		},
+		"mixed valid and invalid log IDs": {
+			keys: &cosign.TrustedTransparencyLogPubKeys{
+				Keys: map[string]cosign.TransparencyLogPubKey{
+					validLogID:       {PubKey: ecKey.Public()},
+					"not-valid-hex!": {PubKey: ecKey.Public()},
+				},
+			},
+			expected: 1,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			result := transparencyLogsFromKeys(tc.keys)
+			if tc.expected == 0 {
+				assert.Empty(t, result)
+				return
+			}
+			assert.Len(t, result, tc.expected)
+			for _, tl := range result {
+				assert.NotNil(t, tl.PublicKey)
+				assert.Equal(t, crypto.SHA256, tl.HashFunc)
+				assert.Equal(t, crypto.SHA256, tl.SignatureHashFunc)
+				assert.False(t, tl.ValidityPeriodStart.IsZero(), "ValidityPeriodStart must be non-zero for sigstore-go.")
+			}
+		})
+	}
+}
+
+func TestTrustedMaterialFromCertificateChain(t *testing.T) {
+	certPEM, err := os.ReadFile("testdata/cert.pem")
+	require.NoError(t, err)
+	chainPEM, err := os.ReadFile("testdata/chain.pem")
+	require.NoError(t, err)
+
+	parseCert := func(t *testing.T, pemData []byte) *x509.Certificate {
+		block, _ := pem.Decode(pemData)
+		require.NotNil(t, block)
+		cert, err := x509.ParseCertificate(block.Bytes)
+		require.NoError(t, err)
+		return cert
+	}
+	leafCert := parseCert(t, certPEM)
+	rootCert := parseCert(t, chainPEM)
+
+	cases := map[string]struct {
+		chain                 []*x509.Certificate
+		expectedIntermediates int
+	}{
+		"single cert becomes root with no intermediates": {
+			chain:                 []*x509.Certificate{rootCert},
+			expectedIntermediates: 0,
+		},
+		"two certs: first is intermediate, last is root": {
+			chain:                 []*x509.Certificate{leafCert, rootCert},
+			expectedIntermediates: 1,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			tm, err := trustedMaterialFromCertificateChain(tc.chain, cosign.CheckOpts{})
+			require.NoError(t, err)
+			require.NotNil(t, tm)
+
+			cas := tm.FulcioCertificateAuthorities()
+			require.Len(t, cas, 1)
+			fca, ok := cas[0].(*root.FulcioCertificateAuthority)
+			require.True(t, ok)
+			assert.Equal(t, tc.chain[len(tc.chain)-1], fca.Root, "Last cert in chain should be root.")
+			assert.Len(t, fca.Intermediates, tc.expectedIntermediates)
+		})
+	}
+}
+
+func TestAugmentTrustedMaterialWithSigChain(t *testing.T) {
+	certPEM, err := os.ReadFile("testdata/cert.pem")
+	require.NoError(t, err)
+	chainPEM, err := os.ReadFile("testdata/chain.pem")
+	require.NoError(t, err)
+
+	parseCert := func(t *testing.T, pemData []byte) *x509.Certificate {
+		block, _ := pem.Decode(pemData)
+		require.NotNil(t, block)
+		cert, err := x509.ParseCertificate(block.Bytes)
+		require.NoError(t, err)
+		return cert
+	}
+	rootCert := parseCert(t, chainPEM)
+
+	// Build a TrustedMaterial with one CA that has only a root (no intermediates).
+	baseTM, err := root.NewTrustedRoot(
+		root.TrustedRootMediaType01,
+		[]root.CertificateAuthority{
+			&root.FulcioCertificateAuthority{Root: rootCert},
+		},
+		nil, nil, nil,
+	)
+	require.NoError(t, err)
+
+	t.Run("short chain is a no-op", func(t *testing.T) {
+		// Chain() returns only the root (1 cert) => no intermediates to add.
+		sig, err := static.NewSignature(nil, "", static.WithCertChain(certPEM, chainPEM))
+		require.NoError(t, err)
+
+		opts := &cosign.CheckOpts{TrustedMaterial: baseTM}
+		err = augmentTrustedMaterialWithSigChain(opts, sig)
+		assert.NoError(t, err)
+		// TrustedMaterial should be unchanged because chain has only 1 cert.
+		assert.Equal(t, baseTM, opts.TrustedMaterial)
+	})
+
+	t.Run("no chain is a no-op", func(t *testing.T) {
+		sig, err := static.NewSignature(nil, "")
+		require.NoError(t, err)
+
+		opts := &cosign.CheckOpts{TrustedMaterial: baseTM}
+		err = augmentTrustedMaterialWithSigChain(opts, sig)
+		assert.NoError(t, err)
+		assert.Equal(t, baseTM, opts.TrustedMaterial)
+	})
+
+	t.Run("multi-cert chain merges intermediates", func(t *testing.T) {
+		// Create a chain PEM with cert + root so Chain() returns 2 certs.
+		multiChainPEM := append(append([]byte{}, certPEM...), chainPEM...)
+		sig, err := static.NewSignature(nil, "", static.WithCertChain(certPEM, multiChainPEM))
+		require.NoError(t, err)
+
+		opts := &cosign.CheckOpts{TrustedMaterial: baseTM}
+		err = augmentTrustedMaterialWithSigChain(opts, sig)
+		require.NoError(t, err)
+
+		// The TrustedMaterial should now have the intermediate from the sig chain.
+		assert.NotEqual(t, baseTM, opts.TrustedMaterial, "TrustedMaterial should be replaced.")
+		cas := opts.TrustedMaterial.FulcioCertificateAuthorities()
+		require.Len(t, cas, 1)
+		fca, ok := cas[0].(*root.FulcioCertificateAuthority)
+		require.True(t, ok)
+		assert.Len(t, fca.Intermediates, 1, "One intermediate should be merged from sig chain.")
+	})
+}
diff --git a/pkg/signatures/factory_test.go b/pkg/signatures/factory_test.go
index eb512c5e3fc59..4d7b9a2a0451a 100644
--- a/pkg/signatures/factory_test.go
+++ b/pkg/signatures/factory_test.go
@@ -14,6 +14,16 @@ import (
 // Signatures have been generated via cosign:
 // $ cosign generate-key-pair
 // $ cosign sign -y ttl.sh/88795dd4-270c-4eb7-b3d4-50241d5bc04c@sha256:f2e98ad37e4970f48e85946972ac4acb5574c39f27c624efbd9b17a3a402bfe4 --key=cosign.key
+//
+// The same `cosign sign` invocation also uploads the signature to the public-good
+// Sigstore Rekor transparency log (this is cosign's default behaviour). The resulting
+// Rekor bundle (SignedEntryTimestamp + Payload) is what is stored verbatim in
+// testdata/bundle_bench_test.json. Because that SET was signed by the production Rekor
+// instance, offline verification must be given the matching production Rekor public key
+// (testdata/rekor_pub.pem); otherwise verification falls back to fetching trusted keys
+// from Sigstore's TUF repository over the network, which made this test non-hermetic in CI
+// (ROX-36684). If the bundle is ever regenerated against a different Rekor instance,
+// testdata/rekor_pub.pem must be updated to match.
 const (
 	// pemMatchingPubKey matches the b64Signature.
 	pemMatchingPubKey = `-----BEGIN PUBLIC KEY-----
@@ -43,6 +53,10 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWi3tSxvBH7S/WUmv408nKPxNSJx6
 func TestVerifyAgainstSignatureIntegration(t *testing.T) {
 	bundle, err := os.ReadFile("testdata/bundle_bench_test.json")
 	require.NoError(t, err)
+	// Pinned production Rekor key matching the SET in bundle_bench_test.json; see the
+	// package-level comment above. Shared with cosign_sig_verifier_test.go (ROX-36683).
+	rekorPubKey, err := os.ReadFile("testdata/rekor_pub.pem")
+	require.NoError(t, err)
 	testImg, err := generateImageWithCosignSignature(imgString, b64Signature, b64SignaturePayload, nil, nil, bundle)
 	require.NoError(t, err, "creating test image")
 
@@ -74,6 +88,7 @@ func TestVerifyAgainstSignatureIntegration(t *testing.T) {
 				TransparencyLog: &storage.TransparencyLogVerification{
 					Enabled:         true,
 					ValidateOffline: true,
+					PublicKeyPemEnc: string(rekorPubKey),
 				},
 			},
 			result: &storage.ImageSignatureVerificationResult{
diff --git a/pkg/signatures/testdata/ctfe_2022_pub.pem b/pkg/signatures/testdata/ctfe_2022_pub.pem
new file mode 100644
index 0000000000000..32fa2ad101da5
--- /dev/null
+++ b/pkg/signatures/testdata/ctfe_2022_pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNK
+AaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==
+-----END PUBLIC KEY-----
diff --git a/pkg/signatures/testdata/rekor_pub.pem b/pkg/signatures/testdata/rekor_pub.pem
new file mode 100644
index 0000000000000..050ef601497b2
--- /dev/null
+++ b/pkg/signatures/testdata/rekor_pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwr
+kBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==
+-----END PUBLIC KEY-----
diff --git a/pkg/telemetry/data/data_test.go b/pkg/telemetry/data/data_test.go
index 1f9b94d47d909..2f8850001fe5b 100644
--- a/pkg/telemetry/data/data_test.go
+++ b/pkg/telemetry/data/data_test.go
@@ -26,7 +26,7 @@ func validateJSONFieldNames(t *testing.T, val reflect.Value) {
 			validateJSONFieldNames(t, val.Index(i))
 		}
 	case reflect.Map:
-		m, ok := val.Interface().(map[string]interface{})
+		m, ok := reflect.TypeAssert[map[string]interface{}](val)
 		assert.True(t, ok)
 		for mKey, mVal := range m {
 			validateFieldName(t, mKey)
diff --git a/pkg/telemetry/phonehome/campaign_test.go b/pkg/telemetry/phonehome/campaign_test.go
index a56b5b8ce9aa2..b9a440febf3d1 100644
--- a/pkg/telemetry/phonehome/campaign_test.go
+++ b/pkg/telemetry/phonehome/campaign_test.go
@@ -408,7 +408,7 @@ func TestCompile(t *testing.T) {
 		},
 		{
 			criterion:    *PathPattern("[b-a]"),
-			errorMessage: `error parsing path pattern: failed to compile "[b-a]": hi character 'a' should be greater than lo 'b'`,
+			errorMessage: `error parsing path pattern: failed to compile "[b-a]": glob: syntax error at 5: range hi character is less than lo`,
 		},
 	}
 
diff --git a/pkg/testutils/centralgrpc/connect_to_central.go b/pkg/testutils/centralgrpc/connect_to_central.go
index 6e138a9e82250..ce5dc1408d8ea 100644
--- a/pkg/testutils/centralgrpc/connect_to_central.go
+++ b/pkg/testutils/centralgrpc/connect_to_central.go
@@ -72,7 +72,7 @@ func RoxAPIEndpoint(t testutils.T) string {
 // UnauthenticatedGRPCConnectionToCentral is like GRPCConnectionToCentral,
 // but does not inject credentials into the request.
 func UnauthenticatedGRPCConnectionToCentral(t *testing.T) *grpc.ClientConn {
-	return grpcConnectionToCentral(t, nil)
+	return grpcConnectionToCentral(t)
 }
 
 // GRPCConnectionToCentral returns a GRPC connection to Central, which can be used in E2E tests.
@@ -166,11 +166,9 @@ func grpcConnectionToCentral(t testutils.T, optsFuncs ...func(options *clientcon
 		grpc_retry.WithRetriable(shouldRetryForTests),
 	}
 
-	grpcDialOpts := []grpc.DialOption{}
-
 	// Add logging interceptors if the test object supports logging (e.g., *testing.T)
 	// Logging interceptor first, then retry - this ensures we log each retry attempt
-	grpcDialOpts = append(grpcDialOpts,
+	grpcDialOpts := []grpc.DialOption{
 		grpc.WithChainUnaryInterceptor(
 			loggingUnaryInterceptor(t),
 			grpc_retry.UnaryClientInterceptor(retryOpts...),
@@ -179,7 +177,7 @@ func grpcConnectionToCentral(t testutils.T, optsFuncs ...func(options *clientcon
 			loggingStreamInterceptor(t),
 			grpc_retry.StreamClientInterceptor(retryOpts...),
 		),
-	)
+	}
 
 	conn, err := clientconn.GRPCConnection(context.Background(), mtls.CentralSubject, endpoint, opts, grpcDialOpts...)
 	require.NoError(t, err)
@@ -189,19 +187,31 @@ func grpcConnectionToCentral(t testutils.T, optsFuncs ...func(options *clientcon
 // HTTPClientForCentral returns an *http.Client for talking to central in tests. Basic auth credentials and
 // the hostname and scheme part of the URL may be omitted.
 func HTTPClientForCentral(t testutils.T) *http.Client {
+	user := RoxUsername(t)
+	pw := RoxPassword(t)
+	return newHTTPClientForCentral(t, user, pw)
+}
+
+// UnauthenticatedHTTPClientForCentral is like HTTPClientForCentral but does not inject auth credentials.
+// The hostname and scheme part of the URL may still be omitted.
+func UnauthenticatedHTTPClientForCentral(t testutils.T) *http.Client {
+	return newHTTPClientForCentral(t, "", "")
+}
+
+func newHTTPClientForCentral(t testutils.T, username, password string) *http.Client {
 	baseTransport := &http.Transport{
 		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: true,
+			InsecureSkipVerify: true, //#nosec G402
 		},
 	}
 
 	endpoint := RoxAPIEndpoint(t)
-	user := RoxUsername(t)
-	pw := RoxPassword(t)
 
 	transport := httputil.RoundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		modReq := req.Clone(req.Context())
-		modReq.SetBasicAuth(user, pw)
+		if username != "" || password != "" {
+			modReq.SetBasicAuth(username, password)
+		}
 		if modReq.URL.Host == "" {
 			modReq.URL.Host = endpoint
 		}
@@ -216,10 +226,8 @@ func HTTPClientForCentral(t testutils.T) *http.Client {
 		return resp, nil
 	})
 
-	client := &http.Client{
+	return &http.Client{
 		Timeout:   10 * time.Second,
 		Transport: transport,
 	}
-
-	return client
 }
diff --git a/pkg/testutils/goleak/assert_no_leak.go b/pkg/testutils/goleak/assert_no_leak.go
index 327b44a3d5d16..c958941cba39a 100644
--- a/pkg/testutils/goleak/assert_no_leak.go
+++ b/pkg/testutils/goleak/assert_no_leak.go
@@ -6,15 +6,39 @@ import (
 	"go.uber.org/goleak"
 )
 
+// Option re-exports goleak.Option so callers don't need to import
+// go.uber.org/goleak directly (disallowed by roxvet, see validateimports).
+type Option = goleak.Option
+
+// IgnoreCurrent re-exports goleak.IgnoreCurrent, for tests that need to check
+// for leaks before test cleanup runs rather than via AssertNoGoroutineLeaks.
+func IgnoreCurrent() Option {
+	return goleak.IgnoreCurrent()
+}
+
+// Find re-exports goleak.Find, for tests that need to check for leaks before
+// test cleanup runs rather than via AssertNoGoroutineLeaks.
+func Find(options ...Option) error {
+	return goleak.Find(options...)
+}
+
+// CommonIgnores returns the goleak options for known, unrelated background
+// goroutines. Shared so that tests calling IgnoreCurrent/Find directly stay in
+// sync with AssertNoGoroutineLeaks instead of maintaining their own copy of
+// this list.
+func CommonIgnores() []Option {
+	return []goleak.Option{
+		// Ignore a known leak: https://github.com/DataDog/dd-trace-go/issues/1469
+		goleak.IgnoreTopFunction("github.com/golang/glog.(*fileSink).flushDaemon"),
+		// Ignore a known leak caused by importing the GCP cscc SDK.
+		goleak.IgnoreTopFunction("go.opencensus.io/stats/view.(*worker).start"),
+		// Ignore a known leak from https://github.com/hashicorp/golang-lru/blob/v2.0.7/expirable/expirable_lru.go#L77-L80
+		goleak.IgnoreTopFunction("github.com/hashicorp/golang-lru/v2/expirable.NewLRU[...].func1"),
+	}
+}
+
 func AssertNoGoroutineLeaks(t testing.TB) {
 	t.Cleanup(func() {
-		goleak.VerifyNone(t,
-			// Ignore a known leak: https://github.com/DataDog/dd-trace-go/issues/1469
-			goleak.IgnoreTopFunction("github.com/golang/glog.(*fileSink).flushDaemon"),
-			// Ignore a known leak caused by importing the GCP cscc SDK.
-			goleak.IgnoreTopFunction("go.opencensus.io/stats/view.(*worker).start"),
-			// Ignore a known leak from https://github.com/hashicorp/golang-lru/blob/v2.0.7/expirable/expirable_lru.go#L77-L80
-			goleak.IgnoreTopFunction("github.com/hashicorp/golang-lru/v2/expirable.NewLRU[...].func1"),
-		)
+		goleak.VerifyNone(t, CommonIgnores()...)
 	})
 }
diff --git a/pkg/testutils/matchers.go b/pkg/testutils/matchers.go
index 5c399103cb5da..09ef143eee387 100644
--- a/pkg/testutils/matchers.go
+++ b/pkg/testutils/matchers.go
@@ -150,7 +150,7 @@ func AssertionMatcher(assertFn interface{}, args ...interface{}) gomock.Matcher
 }
 
 func (m *assertionMatcher) String() string {
-	var argStrings []string
+	argStrings := make([]string, 0, len(m.staticArgs))
 	for _, argVal := range m.staticArgs {
 		argStrings = append(argStrings, fmt.Sprintf("%s", argVal.Interface()))
 	}
diff --git a/pkg/tlsutils/service_ca.go b/pkg/tlsutils/service_ca.go
new file mode 100644
index 0000000000000..6736c711585c0
--- /dev/null
+++ b/pkg/tlsutils/service_ca.go
@@ -0,0 +1,41 @@
+package tlsutils
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"net/http"
+	"os"
+)
+
+const (
+	// serviceOperatorCAPath points to the service account secret which within
+	// an OpenShift environment also contains the service-ca.crt. This CA is
+	// used to verify certificates issued by the service-ca operator.
+	serviceOperatorCAPath = "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
+)
+
+// TransportWithServiceCA returns an http.Transport whose TLS config trusts the
+// system cert pool plus the OpenShift service-serving CA (if available).
+func TransportWithServiceCA() *http.Transport {
+	return TransportWithAdditionalCA(serviceOperatorCAPath)
+}
+
+// TransportWithAdditionalCA returns an http.Transport whose TLS config trusts
+// the system cert pool plus an additional CA file (if readable).
+func TransportWithAdditionalCA(caFile string) *http.Transport {
+	rootCAs, err := x509.SystemCertPool()
+	if err != nil {
+		rootCAs = x509.NewCertPool()
+	}
+
+	if caData, err := os.ReadFile(caFile); err == nil {
+		rootCAs.AppendCertsFromPEM(caData)
+	}
+
+	return &http.Transport{
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			RootCAs:    rootCAs,
+		},
+	}
+}
diff --git a/pkg/version/internal/version_data.go b/pkg/version/internal/version_data.go
index 47b7af84355c7..c8ef4634e58b3 100644
--- a/pkg/version/internal/version_data.go
+++ b/pkg/version/internal/version_data.go
@@ -7,8 +7,6 @@ var (
 	CollectorVersion string //XDef:STABLE_COLLECTOR_VERSION
 	// FactVersion is the fact version to be used by default.
 	FactVersion string //XDef:STABLE_FACT_VERSION
-	// ScannerVersion is the scanner version to be used with this Rox version.
-	ScannerVersion string //XDef:STABLE_SCANNER_VERSION
 	// GitShortSha is the (short) Git SHA that was built.
 	GitShortSha string //XDef:STABLE_GIT_SHORT_SHA
 )
diff --git a/pkg/version/testutils/set_version.go b/pkg/version/testutils/set_version.go
index c96d48d340927..d5fc6b65bd29a 100644
--- a/pkg/version/testutils/set_version.go
+++ b/pkg/version/testutils/set_version.go
@@ -31,7 +31,6 @@ func SetExampleVersion(t *testing.T) {
 func SetVersion(t *testing.T, version version.Versions) {
 	testutils.MustBeInTest(t)
 	internal.MainVersion = version.MainVersion
-	internal.ScannerVersion = version.ScannerVersion
 	internal.CollectorVersion = version.CollectorVersion
 	internal.GitShortSha = version.GitCommit
 	internal.FactVersion = version.FactVersion
@@ -46,7 +45,6 @@ func GetExampleVersion(t *testing.T) version.Versions {
 		GoVersion:        runtime.Version(),
 		MainVersion:      "3.0.99.0",
 		Platform:         runtime.GOOS + "/" + runtime.GOARCH,
-		ScannerVersion:   "99.9.9",
 		ChartVersion:     "3.99.0",
 		FactVersion:      "0.1.0",
 	}
diff --git a/pkg/version/version.go b/pkg/version/version.go
index 214224773b35b..01c284ceb722e 100644
--- a/pkg/version/version.go
+++ b/pkg/version/version.go
@@ -51,11 +51,7 @@ type Versions struct {
 	GoVersion        string `json:"GoVersion"`
 	MainVersion      string `json:"MainVersion"`
 	Platform         string `json:"Platform"`
-	// ScannerVersion is exported for compatibility with users that depend on `roxctl version --json` output.
-	// Please do not depend on it. Rely on internal.ScannerVersion if you need the value from the SCANNER_VERSION file,
-	// or rely on defaults.ImageFlavor if you need a default collector image tag.
-	ScannerVersion string `json:"ScannerVersion"`
-	ChartVersion   string `json:"ChartVersion"`
+	ChartVersion     string `json:"ChartVersion"`
 	// The Database versioning needs to be added by the caller due to scoping issues of config availabilty
 	Database              string `json:"Database,omitempty"`
 	DatabaseServerVersion string `json:"DatabaseServerVersion,omitempty"`
@@ -69,7 +65,6 @@ func GetAllVersionsDevelopment() Versions {
 		GoVersion:        runtime.Version(),
 		MainVersion:      GetMainVersion(),
 		Platform:         runtime.GOOS + "/" + runtime.GOARCH,
-		ScannerVersion:   internal.ScannerVersion,
 		ChartVersion:     GetChartVersion(),
 		FactVersion:      getFactVersion(),
 	}
@@ -82,7 +77,6 @@ func GetAllVersionsDevelopment() Versions {
 func GetAllVersionsUnified() Versions {
 	v := GetAllVersionsDevelopment()
 	v.CollectorVersion = GetMainVersion()
-	v.ScannerVersion = GetMainVersion()
 	return v
 }
 
diff --git a/pkg/version/versioncompatibility/compatibility_test.go b/pkg/version/versioncompatibility/compatibility_test.go
index 107f2149a522b..5cc8e4a03bbb5 100644
--- a/pkg/version/versioncompatibility/compatibility_test.go
+++ b/pkg/version/versioncompatibility/compatibility_test.go
@@ -3,6 +3,7 @@ package versioncompatibility
 import (
 	"testing"
 
+	"github.com/stackrox/rox/pkg/buildinfo"
 	"github.com/stackrox/rox/pkg/version/productstreams"
 	"github.com/stackrox/rox/pkg/version/testutils"
 	"github.com/stretchr/testify/assert"
@@ -348,20 +349,41 @@ func TestClassifyVersion(t *testing.T) {
 	assert.Equal(t, CompatibleBehind, compat)
 }
 
-func TestCompatibleVersionsPanicsOnInvalidVersion(t *testing.T) {
+func TestCompatibleVersionsWhenInvalidVersion(t *testing.T) {
 	testutils.SetMainVersion(t, "invalid")
-	assert.Panics(t, func() { _, _ = CompatibleVersions() })
+
+	if buildinfo.ReleaseBuild {
+		v, err := CompatibleVersions()
+		assert.Empty(t, v)
+		assert.Error(t, err)
+	} else {
+		assert.Panics(t, func() { _, _ = CompatibleVersions() })
+	}
 }
 
-func TestClassifyVersionPanicsOnInvalidVersion(t *testing.T) {
+func TestClassifyVersionWhenInvalidVersion(t *testing.T) {
 	testutils.SetMainVersion(t, "invalid")
-	assert.Panics(t, func() { _, _ = ClassifyVersion(xy(4, 9)) })
+
+	if buildinfo.ReleaseBuild {
+		c, err := ClassifyVersion(xy(4, 9))
+		assert.Equal(t, Unknown, c)
+		assert.Error(t, err)
+	} else {
+		assert.Panics(t, func() { _, _ = ClassifyVersion(xy(4, 9)) })
+	}
 }
 
-func TestCompatibleVersionsPanicsOnMissingBumpData(t *testing.T) {
+func TestCompatibleVersionsWhenMissingBumpData(t *testing.T) {
 	productstreams.OverrideBumpsForTesting(t, `bumps: []`)
 	testutils.SetMainVersion(t, "4.2.0-testing")
-	assert.Panics(t, func() { _, _ = CompatibleVersions() })
+
+	if buildinfo.ReleaseBuild {
+		v, err := CompatibleVersions()
+		assert.Empty(t, v)
+		assert.Error(t, err)
+	} else {
+		assert.Panics(t, func() { _, _ = CompatibleVersions() })
+	}
 }
 
 func overrideTestBumps(t *testing.T) {
diff --git a/pkg/virtualmachine/cpemapping/validate.go b/pkg/virtualmachine/cpemapping/validate.go
new file mode 100644
index 0000000000000..5d125ee00621a
--- /dev/null
+++ b/pkg/virtualmachine/cpemapping/validate.go
@@ -0,0 +1,40 @@
+package cpemapping
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/cespare/xxhash/v2"
+)
+
+// MaxMappingBytes is the accepted size cap for repository-to-CPE JSON (5 MiB).
+const MaxMappingBytes = 5 * 1024 * 1024
+
+// mappingShape is the minimal JSON structure used for validation only.
+// The canonical type lives in pkg/scannerv4/repositorytocpe; this avoids
+// coupling the VM-scanning package to that scanner-owned module.
+type mappingShape struct {
+	Data map[string]json.RawMessage `json:"data"`
+}
+
+// ValidateMapping rejects oversize or undecodable repository-to-CPE JSON.
+func ValidateMapping(content []byte) error {
+	if len(content) > MaxMappingBytes {
+		return fmt.Errorf("mapping size %d exceeds %d bytes", len(content), MaxMappingBytes)
+	}
+	var m mappingShape
+	if err := json.Unmarshal(content, &m); err != nil {
+		return fmt.Errorf("decode mapping: %w", err)
+	}
+	if m.Data == nil {
+		return errors.New("mapping missing data object")
+	}
+	return nil
+}
+
+// HashMapping returns XXH64 of content as 16 lowercase hex characters.
+func HashMapping(content []byte) string {
+	sum := xxhash.Sum64(content)
+	return fmt.Sprintf("%016x", sum)
+}
diff --git a/pkg/virtualmachine/cpemapping/validate_test.go b/pkg/virtualmachine/cpemapping/validate_test.go
new file mode 100644
index 0000000000000..76c1b0e20bc35
--- /dev/null
+++ b/pkg/virtualmachine/cpemapping/validate_test.go
@@ -0,0 +1,62 @@
+package cpemapping
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateMapping(t *testing.T) {
+	tests := map[string]struct {
+		content []byte
+		wantErr bool
+	}{
+		"valid minimal JSON accepted": {
+			content: []byte(`{"data":{}}`),
+			wantErr: false,
+		},
+		"malformed JSON rejected": {
+			content: []byte(`{"data":`),
+			wantErr: true,
+		},
+		"oversize content rejected": {
+			content: bytes.Repeat([]byte("a"), MaxMappingBytes+1),
+			wantErr: true,
+		},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			err := ValidateMapping(tt.content)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}
+
+func TestHashMapping(t *testing.T) {
+	tests := map[string]struct {
+		content  []byte
+		wantHash string
+	}{
+		"stable hash for fixed bytes": {
+			content:  []byte(`{"data":{"repo-1":{"cpes":["cpe:/o:redhat:rhel:8"]}}}`),
+			wantHash: "e34b7b416f5e54e8",
+		},
+		"empty content hash is still 16 hex chars": {
+			content:  []byte(""),
+			wantHash: "ef46db3751d8e999",
+		},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			hash := HashMapping(tt.content)
+			assert.Len(t, hash, 16)
+			assert.Equal(t, tt.wantHash, hash)
+		})
+	}
+}
diff --git a/pkg/virtualmachine/facts.go b/pkg/virtualmachine/facts.go
index bb001e04cf29c..7b6f7b1f330df 100644
--- a/pkg/virtualmachine/facts.go
+++ b/pkg/virtualmachine/facts.go
@@ -1,5 +1,7 @@
 package virtualmachine
 
+import "cmp"
+
 // Facts keys used in VirtualMachine.Facts maps.
 // Keep the keys camelCase to match the style used elsewhere in the UI.
 const (
@@ -10,7 +12,28 @@ const (
 	NodeNameKey    = "nodeName"
 	BootOrderKey   = "bootOrder"
 	CDRomDisksKey  = "cdRomDisks"
+	// DetectedGuestOSKey is the guest OS reported by roxagent, kept separate
+	// from GuestOSKey so KubeVirt informer data is not overwritten.
+	DetectedGuestOSKey = "detectedGuestOS"
+	// AgentVersionKey is the roxagent version from ResponseMeta.AgentVersion.
+	AgentVersionKey = "agentVersion"
+	// ActivationStatusKey is whether the guest OS is activated.
+	ActivationStatusKey = "activationStatus"
+	// DNFMetadataStatusKey is whether DNF metadata is available on the guest.
+	DNFMetadataStatusKey = "dnfMetadataStatus"
 	// UnknownGuestOS is the user-facing default value for GuestOSKey when the
 	// guest OS has not been reported by the virtual machine instance.
 	UnknownGuestOS = "unknown"
+	// User-facing values for roxagent-derived facts. Unspecified proto enum
+	// values are omitted rather than stored as raw proto names.
+	ActivationStatusActive       = "active"
+	ActivationStatusInactive     = "inactive"
+	DNFMetadataStatusAvailable   = "available"
+	DNFMetadataStatusUnavailable = "unavailable"
 )
+
+// DisplayGuestOS is the guest OS written to storage.guest_os: agent-detected
+// when present, otherwise fallback (the KubeVirt informer value).
+func DisplayGuestOS(facts map[string]string, fallback string) string {
+	return cmp.Or(facts[DetectedGuestOSKey], fallback)
+}
diff --git a/pkg/virtualmachine/facts_test.go b/pkg/virtualmachine/facts_test.go
new file mode 100644
index 0000000000000..759e34bacd10d
--- /dev/null
+++ b/pkg/virtualmachine/facts_test.go
@@ -0,0 +1,44 @@
+package virtualmachine
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDisplayGuestOS(t *testing.T) {
+	tests := map[string]struct {
+		facts    map[string]string
+		fallback string
+		want     string
+	}{
+		"prefers detected guest OS": {
+			facts: map[string]string{
+				DetectedGuestOSKey: "Red Hat Enterprise Linux 9.2",
+				GuestOSKey:         "Red Hat Enterprise Linux",
+			},
+			fallback: "Red Hat Enterprise Linux",
+			want:     "Red Hat Enterprise Linux 9.2",
+		},
+		"falls back when detected is absent": {
+			facts:    map[string]string{GuestOSKey: "Red Hat Enterprise Linux"},
+			fallback: "Red Hat Enterprise Linux",
+			want:     "Red Hat Enterprise Linux",
+		},
+		"falls back when detected is empty": {
+			facts:    map[string]string{DetectedGuestOSKey: ""},
+			fallback: "Red Hat Enterprise Linux",
+			want:     "Red Hat Enterprise Linux",
+		},
+		"nil facts use fallback": {
+			fallback: "unknown",
+			want:     "unknown",
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tt.want, DisplayGuestOS(tt.facts, tt.fallback))
+		})
+	}
+}
diff --git a/proto/api/v1/deployment_service.proto b/proto/api/v1/deployment_service.proto
index 09ad9de40870f..e88d70cea69e7 100644
--- a/proto/api/v1/deployment_service.proto
+++ b/proto/api/v1/deployment_service.proto
@@ -52,6 +52,10 @@ message ExportDeploymentResponse {
   storage.Deployment deployment = 1;
 }
 
+message DeploymentRiskAISummaryResponse {
+  string summary = 1;
+}
+
 // DeploymentService APIs can be used to manage deployments.
 service DeploymentService {
   // GetDeployment returns a deployment given its ID.
@@ -64,6 +68,11 @@ service DeploymentService {
     option (google.api.http) = {get: "/v1/deploymentswithrisk/{id}"};
   }
 
+  // GetDeploymentRiskAISummary returns an AI-generated risk summary for a deployment.
+  rpc GetDeploymentRiskAISummary(ResourceByID) returns (DeploymentRiskAISummaryResponse) {
+    option (google.api.http) = {get: "/v1/deploymentswithrisk/{id}/ai-summary"};
+  }
+
   // CountDeployments returns the number of deployments.
   rpc CountDeployments(RawQuery) returns (CountDeploymentsResponse) {
     option (google.api.http) = {get: "/v1/deploymentscount"};
diff --git a/proto/api/v1/image_service.proto b/proto/api/v1/image_service.proto
index 380a566cfc571..2cfabdb3c3fa6 100644
--- a/proto/api/v1/image_service.proto
+++ b/proto/api/v1/image_service.proto
@@ -177,6 +177,13 @@ service ImageService {
   // ScanImageInternal is used solely by the Sensor and Admission Controller to send scan requests
   rpc ScanImageInternal(ScanImageInternalRequest) returns (ScanImageInternalResponse);
 
+  // ScanImageInternalForAdmission is used solely by the Admission Controller
+  // (via Sensor or directly) to send scan requests. For tag-only images it
+  // refreshes registry metadata but reuses an existing Central scan when
+  // the resolved digest is already known. For digest-based images it
+  // behaves identically to ScanImageInternal.
+  rpc ScanImageInternalForAdmission(ScanImageInternalRequest) returns (ScanImageInternalResponse);
+
   // Deprecated: GetImageVulnerabilities is used solely by the Sensor to send vulnerability matching requests.
   rpc GetImageVulnerabilitiesInternal(GetImageVulnerabilitiesInternalRequest) returns (ScanImageInternalResponse) {
     option deprecated = true;
diff --git a/proto/api/v1/metadata_service.proto b/proto/api/v1/metadata_service.proto
index 470192ba0f1d8..7382aea0c5353 100644
--- a/proto/api/v1/metadata_service.proto
+++ b/proto/api/v1/metadata_service.proto
@@ -77,6 +77,11 @@ message DatabaseBackupStatus {
   storage.BackupInfo backup_info = 1;
 }
 
+message LightspeedStatusResponse {
+  bool available = 1;
+  string message = 2;
+}
+
 // Provides availability of certain functionality of Central Services in the current configuration.
 // The initial intended use is to disable certain functionality that does not make sense in the Cloud Service context.
 message CentralServicesCapabilities {
@@ -139,4 +144,9 @@ service MetadataService {
   rpc GetCentralCapabilities(Empty) returns (CentralServicesCapabilities) {
     option (google.api.http) = {get: "/v1/central-capabilities"};
   }
+
+  // GetLightspeedStatus returns the availability status of the Lightspeed AI service.
+  rpc GetLightspeedStatus(Empty) returns (LightspeedStatusResponse) {
+    option (google.api.http) = {get: "/v1/lightspeed/status"};
+  }
 }
diff --git a/proto/api/v2/node_report_service.proto b/proto/api/v2/node_report_service.proto
new file mode 100644
index 0000000000000..5e0144f13d304
--- /dev/null
+++ b/proto/api/v2/node_report_service.proto
@@ -0,0 +1,85 @@
+syntax = "proto3";
+
+package v2;
+
+import "api/v2/common.proto";
+import "api/v2/report_service.proto";
+import "api/v2/search_query.proto";
+import weak "google/api/annotations.proto";
+
+option go_package = "./api/v2;v2";
+option java_package = "io.stackrox.proto.api.v2";
+
+service NodeReportService {
+  rpc PostNodeReportConfiguration(ReportConfiguration) returns (ReportConfiguration) {
+    option (google.api.http) = {
+      post: "/v2/reports/node/configurations"
+      body: "*"
+    };
+  }
+
+  rpc UpdateNodeReportConfiguration(ReportConfiguration) returns (Empty) {
+    option (google.api.http) = {
+      put: "/v2/reports/node/configurations/{id}"
+      body: "*"
+    };
+  }
+
+  rpc ListNodeReportConfigurations(RawQuery) returns (ListReportConfigurationsResponse) {
+    option (google.api.http) = {get: "/v2/reports/node/configurations"};
+  }
+
+  rpc CountNodeReportConfigurations(RawQuery) returns (CountReportConfigurationsResponse) {
+    option (google.api.http) = {get: "/v2/reports/node/configuration-count"};
+  }
+
+  rpc GetNodeReportConfiguration(ResourceByID) returns (ReportConfiguration) {
+    option (google.api.http) = {get: "/v2/reports/node/configurations/{id}"};
+  }
+
+  rpc DeleteNodeReportConfiguration(ResourceByID) returns (Empty) {
+    option (google.api.http) = {delete: "/v2/reports/node/configurations/{id}"};
+  }
+
+  rpc RunNodeReport(RunReportRequest) returns (RunReportResponse) {
+    option (google.api.http) = {
+      post: "/v2/reports/node/run"
+      body: "*"
+    };
+  }
+
+  rpc GetNodeReportHistory(GetReportHistoryRequest) returns (ReportHistoryResponse) {
+    option (google.api.http) = {get: "/v2/reports/node/configurations/{id}/history"};
+  }
+
+  rpc GetMyNodeReportHistory(GetReportHistoryRequest) returns (ReportHistoryResponse) {
+    option (google.api.http) = {get: "/v2/reports/node/configurations/{id}/my-history"};
+  }
+
+  rpc GetNodeReportStatus(ResourceByID) returns (ReportStatusResponse) {
+    option (google.api.http) = {get: "/v2/reports/node/jobs/{id}/status"};
+  }
+
+  rpc CancelNodeReport(ResourceByID) returns (Empty) {
+    option (google.api.http) = {delete: "/v2/reports/node/jobs/{id}/cancel"};
+  }
+
+  rpc DeleteNodeReport(DeleteReportRequest) returns (Empty) {
+    option (google.api.http) = {delete: "/v2/reports/node/jobs/{id}/delete"};
+  }
+
+  rpc PostViewBasedNodeReport(ReportRequestViewBased) returns (RunReportResponseViewBased) {
+    option (google.api.http) = {
+      post: "/v2/reports/node/view-based/run"
+      body: "*"
+    };
+  }
+
+  rpc GetViewBasedNodeReportHistory(GetViewBasedReportHistoryRequest) returns (ReportHistoryResponse) {
+    option (google.api.http) = {get: "/v2/reports/node/view-based/history"};
+  }
+
+  rpc GetViewBasedMyNodeReportHistory(GetViewBasedReportHistoryRequest) returns (ReportHistoryResponse) {
+    option (google.api.http) = {get: "/v2/reports/node/view-based/my-history"};
+  }
+}
diff --git a/proto/api/v2/report_service.proto b/proto/api/v2/report_service.proto
index 66feca34d922b..74adf036f6548 100644
--- a/proto/api/v2/report_service.proto
+++ b/proto/api/v2/report_service.proto
@@ -13,7 +13,8 @@ option java_package = "io.stackrox.proto.api.v2";
 
 message ReportConfiguration {
   enum ReportType {
-    VULNERABILITY = 0;
+    VULNERABILITY = 0; // for historical reasons, this short form was used to mean "Image Vulnerability"
+    NODE_VULNERABILITY = 1;
   }
   string id = 1;
   string name = 2;
@@ -21,6 +22,7 @@ message ReportConfiguration {
   ReportType type = 4;
   oneof filter {
     VulnerabilityReportFilters vuln_report_filters = 5;
+    NodeVulnerabilityReportFilters node_vuln_report_filters = 9;
   }
 
   ReportSchedule schedule = 6;
@@ -65,6 +67,13 @@ message VulnerabilityReportFilters {
   string query = 12;
 }
 
+message NodeVulnerabilityReportFilters {
+  oneof cves_since {
+    bool all_vuln = 1;
+  }
+  string query = 2;
+}
+
 //filter for ondemand view based reports
 message ViewBasedVulnerabilityReportFilters {
   string query = 5;
@@ -192,6 +201,11 @@ message CollectionSnapshot {
 }
 
 message ReportSnapshot {
+  enum ReportType {
+    VULNERABILITY = 0; // for historical reasons, this short form was used to mean "Image Vulnerability"
+    NODE_VULNERABILITY = 1;
+  }
+  ReportType type = 16;
   string report_config_id = 1;
   string report_job_id = 2;
   string name = 3;
@@ -199,6 +213,7 @@ message ReportSnapshot {
   oneof filter {
     VulnerabilityReportFilters vuln_report_filters = 5;
     ViewBasedVulnerabilityReportFilters view_based_vuln_report_filters = 12;
+    NodeVulnerabilityReportFilters node_vuln_report_filters = 15;
   }
   CollectionSnapshot collection_snapshot = 6;
   ReportSchedule schedule = 7;
@@ -252,11 +267,13 @@ message DeleteReportRequest {
 
 message ReportRequestViewBased {
   enum ReportType {
-    VULNERABILITY = 0;
+    VULNERABILITY = 0; // for historical reasons, this short form was used to mean "Image Vulnerability"
+    NODE_VULNERABILITY = 1;
   }
   ReportType type = 1;
   oneof filter {
     ViewBasedVulnerabilityReportFilters view_based_vuln_report_filters = 2;
+    NodeVulnerabilityReportFilters node_vuln_report_filters = 4;
   }
 
   string area_of_concern = 3;
diff --git a/proto/api/v2/virtual_machine_v2_service.proto b/proto/api/v2/virtual_machine_v2_service.proto
index 7aaffa7d7dc74..769269c56b643 100644
--- a/proto/api/v2/virtual_machine_v2_service.proto
+++ b/proto/api/v2/virtual_machine_v2_service.proto
@@ -125,10 +125,12 @@ enum VMNote {
   VM_NOTE_SCAN_FAILED = 5;
 }
 
-// Agent status enriched from a separate data source (not on VirtualMachineV2 storage).
+// AgentStatus is roxagent liveness from scrape freshness, computed on GetVM
+// (not a stored enum). UNKNOWN means never scraped; INACTIVE means scraped, then quiet.
 enum AgentStatus {
   AGENT_STATUS_UNKNOWN = 0;
   AGENT_STATUS_ACTIVE = 1;
+  AGENT_STATUS_INACTIVE = 2;
 }
 
 message VMDetail {
diff --git a/proto/internalapi/central/cluster_metrics.proto b/proto/internalapi/central/cluster_metrics.proto
index a555dbe7eb3d4..6f42e586c599a 100644
--- a/proto/internalapi/central/cluster_metrics.proto
+++ b/proto/internalapi/central/cluster_metrics.proto
@@ -10,4 +10,13 @@ message ClusterMetrics {
   int64 node_count = 1; // The number of nodes in the cluster accessible by Sensor.
   int64 cpu_capacity = 2; // The total cpu capacity of all nodes accessible by Sensor.
   string compliance_operator_version = 3; // Compliance operator version discovered by this Sensor.
+
+  // Filled only when ROX_VIRTUAL_MACHINES is enabled on this Sensor.
+  VirtualMachineMetrics virtual_machine_metrics = 4;
+}
+
+message VirtualMachineMetrics {
+  int32 tracked_vms = 1; // VMs currently tracked for scraping.
+  int32 vms_scanned = 2; // Tracked VMs with at least one successful scrape ever.
+  map<string, int32> roxagent_version_counts = 3; // Version (or "unknown"/"other") -> count of scanned VMs. Unscanned VMs are omitted.
 }
diff --git a/proto/internalapi/sensor/image_iservice.proto b/proto/internalapi/sensor/image_iservice.proto
index 39d6961c9077b..96ef2f6bc6df8 100644
--- a/proto/internalapi/sensor/image_iservice.proto
+++ b/proto/internalapi/sensor/image_iservice.proto
@@ -10,7 +10,7 @@ option go_package = "./internalapi/sensor;sensor";
 message GetImageRequest {
   storage.ContainerImage image = 1;
   string namespace = 3;
-  bool scan_inline = 2;
+  bool scan_inline = 2 [deprecated = true]; // always true; AC is the only client
 }
 
 message GetImageResponse {
diff --git a/proto/internalapi/virtualmachine/v1/vm_service.proto b/proto/internalapi/virtualmachine/v1/vm_service.proto
index b0ee43746ef07..b2b9317742acd 100644
--- a/proto/internalapi/virtualmachine/v1/vm_service.proto
+++ b/proto/internalapi/virtualmachine/v1/vm_service.proto
@@ -9,7 +9,7 @@ option go_package = "./internalapi/virtualmachine/v1;v1";
 
 // Protocol for pull-mode VM scanning over VSOCK between Sensor and roxagent.
 // See ADR-0006 §2 (Protocol) for the full design, exchange examples, and
-// generation-based deduplication semantics.
+// token-based deduplication semantics.
 
 // --- Envelope ---
 
@@ -19,6 +19,7 @@ message VMServiceRequest {
   RequestMeta meta = 1;
   oneof method {
     GetReportRequest get_report = 2;
+    SyncRepoCPEMappingRequest sync_repo_cpe_mapping = 3;
   }
 }
 
@@ -29,6 +30,7 @@ message VMServiceResponse {
   oneof result {
     GetReportResponse get_report = 2;
     ErrorResponse error = 3;
+    SyncRepoCPEMappingResponse sync_repo_cpe_mapping = 4;
   }
 }
 
@@ -49,50 +51,53 @@ message ResponseMeta {
   string agent_version = 1;
   // When the cached scan report was produced by the scanner.
   google.protobuf.Timestamp report_generated_at = 2;
-  // Monotonic counter incremented on each rescan; resets to 1 on agent restart.
-  // Sensor uses this for deduplication (see ADR-0006 §2, "Generation counter").
-  uint32 report_generation = 3;
+  // XXH64 of the cached IndexReport and facts. Identical content keeps the
+  // same token; Sensor still forces a full report with an empty last_known_token.
+  string report_token = 3;
   // Methods this agent accepts (e.g. ["get_report"]). Doubles as capability
   // discovery — no separate handshake needed. See ADR-0006 §2.
   repeated string supported_methods = 4;
   // VM metadata from the scan (detected_os, os_version, activation_status, etc.).
   // Future: may also carry roxagent operational metrics.
   map<string, string> facts = 5;
-  // Opaque value seeded once per agent process lifetime (random/time-derived),
-  // held in memory only, never persisted to VM disk. Changes on every agent
-  // restart, unlike report_generation which resets to 1. Sensor should treat
-  // an epoch mismatch as "changed" regardless of report_generation, to avoid
-  // false-negative dedup when a restarted agent's reset generation coincides
-  // with Sensor's cached value for that VM. Zero means the agent predates this
-  // field; Sensor falls back to generation-only comparison in that case.
-  uint32 epoch = 6;
+  // XXH64 hex of active mapping; empty string means none. optional so absence
+  // means an older agent that does not report mapping metadata.
+  optional string repo_cpe_mapping_hash = 6;
+  // SENSOR or URL only; UNSPECIFIED means Sensor must not sync.
+  optional RepoCPEMappingUpdatePath repo_cpe_mapping_update_path = 7;
 }
 
 // --- Methods ---
 
 message GetReportRequest {
-  // Generation last observed by Sensor for this VM (see ResponseMeta.report_generation).
-  // Use 0 when no prior generation is known, which forces a full report. See
-  // ADR-0006 §2, "Generation counter", for how the agent uses this value.
-  uint32 last_known_generation = 1;
-  // Epoch last observed by Sensor for this VM (see ResponseMeta.epoch). 0 means
-  // unknown (first-ever request for this VM, or a Sensor build that predates
-  // this field) -- the agent should ignore epoch and fall back to
-  // generation-only comparison, exactly as if this field did not exist. This
-  // lets the agent detect a restart-coincidence false match (last_known_generation
-  // happens to equal the post-restart generation) and serve the full report in
-  // the same round trip, instead of Sensor needing a second, forced request.
-  uint32 known_epoch = 2;
+  // Token last observed by Sensor for this VM (see ResponseMeta.report_token).
+  // Empty when none is known, which forces a full report.
+  string last_known_token = 1;
 }
 
 message GetReportResponse {
-  // Full scan report; set when generation changed or forced (generation 0).
+  // Full scan report; set when the content hash changed or last_known_token is empty.
   scanner.v4.IndexReport index_report = 1;
-  // True when agent's generation matches last_known_generation; index_report
-  // is nil in this case. Sensor may still force a refresh after 4 h (ADR-0006 §2).
+  // True when the agent's token matches last_known_token; index_report is nil.
+  // Sensor may still force a refresh after 4 h with an empty last_known_token.
   bool unchanged = 2;
 }
 
+message SyncRepoCPEMappingRequest {
+  bytes mapping = 1;
+}
+
+message SyncRepoCPEMappingResponse {
+  // True when the agent accepted new content (applied or staged).
+  bool updated = 1;
+}
+
+enum RepoCPEMappingUpdatePath {
+  REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED = 0;
+  REPO_CPE_MAPPING_UPDATE_PATH_SENSOR = 1;
+  REPO_CPE_MAPPING_UPDATE_PATH_URL = 2;
+}
+
 // --- Errors ---
 
 message ErrorResponse {
@@ -119,4 +124,8 @@ enum ErrorCode {
   ERROR_CODE_REQUEST_TOO_LARGE = 5;
   // Agent is already serving another connection; retry after a backoff.
   ERROR_CODE_BUSY = 6;
+  // No usable mapping yet; guest disk has not been scanned.
+  ERROR_CODE_MAPPING_REQUIRED = 7;
+  // SyncRepoCPEMapping rejected because updater is not Sensor-managed.
+  ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED = 8;
 }
diff --git a/proto/storage/auth_provider.proto b/proto/storage/auth_provider.proto
index f0aeff60822e1..9320d5b1e4692 100644
--- a/proto/storage/auth_provider.proto
+++ b/proto/storage/auth_provider.proto
@@ -31,7 +31,11 @@ message AuthProvider {
   // - "extra_scopes": a space-delimited string of additional scopes to request in addition to "openid profile email"
   //   according to https://www.rfc-editor.org/rfc/rfc6749.html#section-3.3.
   //
-  // OpenShift Auth: supports no extra configuration options.
+  // OpenShift Auth:
+  // These settings only apply for OpenShift Auth used with access control delegation to ACM.
+  // Otherwise, no extra configuration options are supported.
+  // - "client_name": the name of the OAuthClient object used to request an OpenShift auth token.
+  // - "client_secret": the OAuthClient secret.
   //
   // User PKI:
   // - "keys": the trusted certificates PEM encoded.
diff --git a/proto/storage/cluster.proto b/proto/storage/cluster.proto
index 8702523bcc846..060d9e3a71240 100644
--- a/proto/storage/cluster.proto
+++ b/proto/storage/cluster.proto
@@ -88,10 +88,10 @@ enum CollectionMethod {
 message AdmissionControllerConfig {
   bool enabled = 1;
   int32 timeout_seconds = 2;
-  bool scan_inline = 3;
+  bool scan_inline = 3 [deprecated = true]; // always true since 4.9
   bool disable_bypass = 4;
 
-  bool enforce_on_updates = 5;
+  bool enforce_on_updates = 5 [deprecated = true]; // same as enabled since 4.9
 }
 
 message TolerationsConfig {
diff --git a/proto/storage/cve.proto b/proto/storage/cve.proto
index 5a14f5a1eb3bf..87afedeeb280c 100644
--- a/proto/storage/cve.proto
+++ b/proto/storage/cve.proto
@@ -29,6 +29,19 @@ enum Source {
   SOURCE_NVD = 3;
 }
 
+enum VulnOrigin {
+  VULN_ORIGIN_OTHER = 0;
+  VULN_ORIGIN_OSV = 1;
+  VULN_ORIGIN_ALPINE = 2;
+  VULN_ORIGIN_AMAZON = 3;
+  VULN_ORIGIN_DEBIAN = 4;
+  VULN_ORIGIN_ORACLE = 5;
+  VULN_ORIGIN_PHOTON = 6;
+  VULN_ORIGIN_RED_HAT = 7;
+  VULN_ORIGIN_SUSE = 8;
+  VULN_ORIGIN_UBUNTU = 9;
+}
+
 //Added this score version for nvd cvss score. moving out and re using score version from cveinfo will cause backward compatibility issue
 enum CvssScoreVersion {
   UNKNOWN_VERSION = 0;
@@ -151,6 +164,7 @@ message CVEInfo {
   EPSS epss = 12;
   Exploit exploit = 13;
   bool cisa_kev = 14; // @gotags: search:"CISA KEV"
+  bool known_ransomware_campaign = 15; // @gotags: search:"Known Ransomware Campaign"
 }
 
 message Advisory {
@@ -211,6 +225,8 @@ message ImageCVEV2 {
   // Timestamp when the fix for this CVE was made available according to the sources.
   google.protobuf.Timestamp fix_available_timestamp = 16; // @gotags: search:"CVE Fix Available Timestamp,hidden"
   string datasource = 17;
+  // origin indicates where vulnerability details came from, origin may be an aggregator (such as OSV).
+  VulnOrigin origin = 18; // @gotags: search:"CVE Origin,hidden"
 }
 
 message NodeCVE {
diff --git a/proto/storage/policy.proto b/proto/storage/policy.proto
index c07c52d6152e2..922f9fba17715 100644
--- a/proto/storage/policy.proto
+++ b/proto/storage/policy.proto
@@ -36,7 +36,7 @@ message Policy {
   EventSource event_source = 22; // @gotags: crYaml:"eventSource,stringer"
 
   reserved 10; //was repeated Exclusion whitelists
-  // Define deployments or images that should be excluded from this policy.
+  // Define deployments, images, or workload kinds that should be excluded from this policy.
   repeated Exclusion exclusions = 21; // @gotags: crYaml:",omitempty"
   // Defines clusters, namespaces, and deployments that should be included in this policy.  No scopes defined includes everything.
   repeated Scope scope = 11; // @gotags: crYaml:",omitempty"
@@ -180,7 +180,7 @@ enum Comparator {
 
 // EvaluationFilter pre-filters which entities a policy evaluates.
 message EvaluationFilter {
-  repeated ContainerType skip_container_types = 1;
+  repeated ContainerType skip_container_types = 1; // @gotags: crYaml:"skipContainerTypes,omitempty,stringer"
 }
 
 message Exclusion {
@@ -195,7 +195,6 @@ message Exclusion {
     string name = 3; // @gotags: crYaml:",omitempty"
     Scope scope = 4; // @gotags: crYaml:",omitempty"
   }
-  Deployment deployment = 5; // @gotags: crYaml:",omitempty"
 
   message Image {
     string name = 1;
@@ -203,6 +202,25 @@ message Exclusion {
   Image image = 7; // @gotags: crYaml:",omitempty"
 
   google.protobuf.Timestamp expiration = 6; // @gotags: crYaml:",timestamp,omitempty"
+
+  // WorkloadKind is a Kubernetes workload kind that can be excluded from a policy in bulk.
+  enum WorkloadKind {
+    WORKLOAD_KIND_UNSPECIFIED = 0;
+    CRON_JOB = 1;
+    JOB = 2;
+  }
+
+  // ExcludeByKind excludes all workloads of the selected Kubernetes kinds.
+  message ExcludeByKind {
+    repeated WorkloadKind kinds = 1; // @gotags: crYaml:",omitempty,stringer"
+  }
+
+  // matcher is either a name/scope exclusion or an exclusion by Kubernetes kind.
+  // Image stays outside the oneof because existing payloads may set both image and deployment.
+  oneof matcher {
+    Deployment deployment = 5; // @gotags: crYaml:",omitempty"
+    ExcludeByKind exclude_by_kind = 8; // @gotags: crYaml:"excludeByKind,omitempty"
+  }
 }
 
 // ExportPoliciesResponse is used by the API but it is defined in storage because we expect customers to store them.
diff --git a/proto/storage/proto.lock b/proto/storage/proto.lock
index 7eab028b96890..d2c619b50b714 100644
--- a/proto/storage/proto.lock
+++ b/proto/storage/proto.lock
@@ -2241,7 +2241,13 @@
               {
                 "id": 3,
                 "name": "scan_inline",
-                "type": "bool"
+                "type": "bool",
+                "options": [
+                  {
+                    "name": "deprecated",
+                    "value": "true"
+                  }
+                ]
               },
               {
                 "id": 4,
@@ -2251,7 +2257,13 @@
               {
                 "id": 5,
                 "name": "enforce_on_updates",
-                "type": "bool"
+                "type": "bool",
+                "options": [
+                  {
+                    "name": "deprecated",
+                    "value": "true"
+                  }
+                ]
               }
             ]
           },
@@ -6070,6 +6082,50 @@
               }
             ]
           },
+          {
+            "name": "VulnOrigin",
+            "enum_fields": [
+              {
+                "name": "VULN_ORIGIN_OTHER"
+              },
+              {
+                "name": "VULN_ORIGIN_OSV",
+                "integer": 1
+              },
+              {
+                "name": "VULN_ORIGIN_ALPINE",
+                "integer": 2
+              },
+              {
+                "name": "VULN_ORIGIN_AMAZON",
+                "integer": 3
+              },
+              {
+                "name": "VULN_ORIGIN_DEBIAN",
+                "integer": 4
+              },
+              {
+                "name": "VULN_ORIGIN_ORACLE",
+                "integer": 5
+              },
+              {
+                "name": "VULN_ORIGIN_PHOTON",
+                "integer": 6
+              },
+              {
+                "name": "VULN_ORIGIN_RED_HAT",
+                "integer": 7
+              },
+              {
+                "name": "VULN_ORIGIN_SUSE",
+                "integer": 8
+              },
+              {
+                "name": "VULN_ORIGIN_UBUNTU",
+                "integer": 9
+              }
+            ]
+          },
           {
             "name": "CvssScoreVersion",
             "enum_fields": [
@@ -6626,6 +6682,11 @@
                 "id": 14,
                 "name": "cisa_kev",
                 "type": "bool"
+              },
+              {
+                "id": 15,
+                "name": "known_ransomware_campaign",
+                "type": "bool"
               }
             ],
             "messages": [
@@ -6846,6 +6907,11 @@
                 "id": 17,
                 "name": "datasource",
                 "type": "string"
+              },
+              {
+                "id": 18,
+                "name": "origin",
+                "type": "VulnOrigin"
               }
             ]
           },
@@ -13988,6 +14054,22 @@
                 "integer": 4
               }
             ]
+          },
+          {
+            "name": "Exclusion.WorkloadKind",
+            "enum_fields": [
+              {
+                "name": "WORKLOAD_KIND_UNSPECIFIED"
+              },
+              {
+                "name": "CRON_JOB",
+                "integer": 1
+              },
+              {
+                "name": "JOB",
+                "integer": 2
+              }
+            ]
           }
         ],
         "messages": [
@@ -14305,11 +14387,6 @@
                 "name": "name",
                 "type": "string"
               },
-              {
-                "id": 5,
-                "name": "deployment",
-                "type": "Deployment"
-              },
               {
                 "id": 7,
                 "name": "image",
@@ -14319,6 +14396,18 @@
                 "id": 6,
                 "name": "expiration",
                 "type": "google.protobuf.Timestamp"
+              },
+              {
+                "id": 5,
+                "name": "deployment",
+                "type": "Deployment",
+                "oneof_parent": "matcher"
+              },
+              {
+                "id": 8,
+                "name": "exclude_by_kind",
+                "type": "ExcludeByKind",
+                "oneof_parent": "matcher"
               }
             ],
             "reserved_ids": [
@@ -14359,6 +14448,17 @@
                     "type": "string"
                   }
                 ]
+              },
+              {
+                "name": "ExcludeByKind",
+                "fields": [
+                  {
+                    "id": 1,
+                    "name": "kinds",
+                    "type": "WorkloadKind",
+                    "is_repeated": true
+                  }
+                ]
               }
             ]
           },
@@ -15605,6 +15705,10 @@
             "enum_fields": [
               {
                 "name": "VULNERABILITY"
+              },
+              {
+                "name": "NODE_VULNERABILITY",
+                "integer": 1
               }
             ]
           },
@@ -15723,6 +15827,12 @@
                 "type": "VulnerabilityReportFilters",
                 "oneof_parent": "filter"
               },
+              {
+                "id": 15,
+                "name": "node_vuln_report_filters",
+                "type": "NodeVulnerabilityReportFilters",
+                "oneof_parent": "filter"
+              },
               {
                 "id": 6,
                 "name": "scope_id",
@@ -15960,6 +16070,28 @@
               }
             ]
           },
+          {
+            "name": "NodeVulnerabilityReportFilters",
+            "fields": [
+              {
+                "id": 1,
+                "name": "all_vuln",
+                "type": "bool",
+                "oneof_parent": "cves_since"
+              },
+              {
+                "id": 2,
+                "name": "access_scope_rules",
+                "type": "SimpleAccessScope.Rules",
+                "is_repeated": true
+              },
+              {
+                "id": 3,
+                "name": "query",
+                "type": "string"
+              }
+            ]
+          },
           {
             "name": "ViewBasedVulnerabilityReportFilters",
             "fields": [
@@ -16087,6 +16219,10 @@
             "enum_fields": [
               {
                 "name": "VULNERABILITY"
+              },
+              {
+                "name": "NODE_VULNERABILITY",
+                "integer": 1
               }
             ]
           },
@@ -16184,6 +16320,12 @@
                 "type": "ViewBasedVulnerabilityReportFilters",
                 "oneof_parent": "filter"
               },
+              {
+                "id": 15,
+                "name": "node_vuln_report_filters",
+                "type": "NodeVulnerabilityReportFilters",
+                "oneof_parent": "filter"
+              },
               {
                 "id": 7,
                 "name": "collection",
@@ -20397,6 +20539,11 @@
                 "name": "last_updated",
                 "type": "google.protobuf.Timestamp"
               },
+              {
+                "id": 13,
+                "name": "last_agent_contact",
+                "type": "google.protobuf.Timestamp"
+              },
               {
                 "id": 10,
                 "name": "notes",
@@ -21006,6 +21153,11 @@
                 "id": 28,
                 "name": "cisa_kev",
                 "type": "bool"
+              },
+              {
+                "id": 29,
+                "name": "origin",
+                "type": "VulnOrigin"
               }
             ],
             "reserved_ids": [
diff --git a/proto/storage/report_configuration.proto b/proto/storage/report_configuration.proto
index 27216ef197de4..5f9ee58950270 100644
--- a/proto/storage/report_configuration.proto
+++ b/proto/storage/report_configuration.proto
@@ -15,7 +15,8 @@ option java_package = "io.stackrox.proto.storage";
 
 message ReportConfiguration {
   enum ReportType {
-    VULNERABILITY = 0;
+    VULNERABILITY = 0; // for historical reasons, this short form was used to mean "Image Vulnerability"
+    NODE_VULNERABILITY = 1;
   }
 
   string id = 1; // @gotags: sql:"pk"
@@ -24,6 +25,7 @@ message ReportConfiguration {
   ReportType type = 4; // @gotags: search:"Report Type"
   oneof filter {
     VulnerabilityReportFilters vuln_report_filters = 5;
+    NodeVulnerabilityReportFilters node_vuln_report_filters = 15;
   }
   // Deprecated: V1 field. Use resource_scope instead.
   string scope_id = 6 [deprecated = true]; // @gotags: search:"Embedded Collection ID"
@@ -116,6 +118,14 @@ enum EntityField {
   FIELD_ANNOTATION = 4;
 }
 
+message NodeVulnerabilityReportFilters {
+  oneof cves_since {
+    bool all_vuln = 1;
+  }
+  repeated SimpleAccessScope.Rules access_scope_rules = 2;
+  string query = 3;
+}
+
 // filter for view based reports
 message ViewBasedVulnerabilityReportFilters {
   string query = 1;
diff --git a/proto/storage/report_snapshot.proto b/proto/storage/report_snapshot.proto
index e810fc23c67a5..260d5b35bdd6a 100644
--- a/proto/storage/report_snapshot.proto
+++ b/proto/storage/report_snapshot.proto
@@ -15,17 +15,19 @@ option java_package = "io.stackrox.proto.storage";
 // vulnerability filters, notifiers, etc used to generate a report. It also stores the final status of the report job.
 message ReportSnapshot {
   enum ReportType {
-    VULNERABILITY = 0;
+    VULNERABILITY = 0; // for historical reasons, this short form was used to mean "Image Vulnerability"
+    NODE_VULNERABILITY = 1;
   }
 
   string report_id = 1; // @gotags: sql:"pk,type(uuid)"
   string report_configuration_id = 2; // @gotags: search:"Report Configuration ID" sql:"fk(ReportConfiguration:id),allow-null"
   string name = 3; // @gotags: search:"Report Name"
   string description = 4;
-  ReportType type = 5;
+  ReportType type = 5; // @gotags: search:"Report Type"
   oneof filter {
     VulnerabilityReportFilters vuln_report_filters = 6;
     ViewBasedVulnerabilityReportFilters view_based_vuln_report_filters = 12;
+    NodeVulnerabilityReportFilters node_vuln_report_filters = 15;
   }
   CollectionSnapshot collection = 7;
   storage.Schedule schedule = 8;
diff --git a/proto/storage/scope.proto b/proto/storage/scope.proto
index f857c0c72ede4..bbde8c1da1bae 100644
--- a/proto/storage/scope.proto
+++ b/proto/storage/scope.proto
@@ -13,6 +13,6 @@ message Scope {
     string value = 2;
   }
   Label label = 3; // Deployment label. @gotags: crYaml:",omitempty"`
-  Label cluster_label = 4; // @gotags: crYaml:",omitempty"`
-  Label namespace_label = 5; // @gotags: crYaml:",omitempty"`
+  Label cluster_label = 4; // @gotags: crYaml:"clusterLabel,omitempty"`
+  Label namespace_label = 5; // @gotags: crYaml:"namespaceLabel,omitempty"`
 }
diff --git a/proto/storage/virtual_machine_v2.proto b/proto/storage/virtual_machine_v2.proto
index 3dce14fbc1823..c041e9fb8efee 100644
--- a/proto/storage/virtual_machine_v2.proto
+++ b/proto/storage/virtual_machine_v2.proto
@@ -34,6 +34,10 @@ message VirtualMachineV2 {
 
   google.protobuf.Timestamp last_updated = 9; // @gotags: search:"Last Updated,hidden" sql:"type(timestamptz)" hash:"ignore"
 
+  // last_agent_contact is the last successful pull-mode scrape that landed in Central.
+  // Unset means never scraped; GetVM maps age against ROX_VIRTUAL_MACHINES_AGENT_STALE_AFTER.
+  google.protobuf.Timestamp last_agent_contact = 13; // @gotags: search:"Last Agent Contact,hidden" sql:"type(timestamptz)" hash:"ignore"
+
   enum Note {
     MISSING_METADATA = 0;
     MISSING_SCAN_DATA = 1;
diff --git a/proto/storage/vulnerability.proto b/proto/storage/vulnerability.proto
index 849cf5b2247e7..9f08c6c8bbdb1 100644
--- a/proto/storage/vulnerability.proto
+++ b/proto/storage/vulnerability.proto
@@ -8,7 +8,7 @@ import "storage/cve.proto";
 option go_package = "./storage;storage";
 option java_package = "io.stackrox.proto.storage";
 
-// Next Tag: 29
+// Next Tag: 30
 message EmbeddedVulnerability {
   // ScoreVersion can be deprecated ROX-26066
   enum ScoreVersion {
@@ -66,6 +66,8 @@ message EmbeddedVulnerability {
   string datasource = 26; // @gotags: json:"-" hash:"ignore"
   Exploit exploit = 27;
   bool cisa_kev = 28; // @gotags: policy:"CISA KEV"
+  // origin indicates where vulnerability details came from, origin may be an aggregator (such as OSV).
+  VulnOrigin origin = 29;
 }
 
 message NodeVulnerability {
diff --git a/qa-tests-backend/scripts/images-to-prefetch.txt b/qa-tests-backend/scripts/images-to-prefetch.txt
index 4d90575c82287..2f20a0616bf1e 100644
--- a/qa-tests-backend/scripts/images-to-prefetch.txt
+++ b/qa-tests-backend/scripts/images-to-prefetch.txt
@@ -80,4 +80,8 @@ quay.io/rhacs-eng/qa-signatures:distroless-base-multiarch@sha256:bc217643f9c04fc
 quay.io/rhacs-eng/qa-signatures:keyless-rhtas@sha256:e246aa22ad2cbdfbd19e2a6ca2b275e26245a21920e2b2d0666324cee3f15549
 quay.io/rhacs-eng/qa-signatures:keyless-sigstore@sha256:37f7b378a29ceb4c551b1b5582e27747b855bbfaa73fa11914fe0df028dc581f
 quay.io/rhacs-eng/qa-signatures:nginx-multiarch@sha256:dd2d0ac3fff2f007d99e033b64854be0941e19a2ad51f174d9240dda20d9f534
+quay.io/rhacs-eng/qa-signatures:referrer-byopki@sha256:05a79c7279f71f86a2a0d05eb72fcb56ea36139150f0a75cd87e80a4272e4e39
+quay.io/rhacs-eng/qa-signatures:referrer-keyless-rhtas@sha256:e8e5cca392e3cf056fcdb3093e7ac2bf83fcf28b3bcf5818fe8ae71cf360c231
+quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-keyless@sha256:98ad9d1a2be345201bb0709b0d38655eb1b370145c7d94ca1fe9c421f76e245a
+quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-pubkey@sha256:9e2bbca079387d7965c3a9cee6d0c53f4f4e63ff7637877a83c4c05f2a666112
 quay.io/rhacs-eng/qa-signatures:tekton-multiarch@sha256:d12d420438235ccee3f4fcb72cf9e5b2b79f60f713595fe1ada254d10167dfc6
diff --git a/qa-tests-backend/scripts/run-compatibility.sh b/qa-tests-backend/scripts/run-compatibility.sh
index a9441309069af..e05476edd38c5 100755
--- a/qa-tests-backend/scripts/run-compatibility.sh
+++ b/qa-tests-backend/scripts/run-compatibility.sh
@@ -47,7 +47,6 @@ _compatibility_test() {
     local short_sensor_tag="$4"
 
     export_test_environment
-    ci_export CENTRAL_PERSISTENCE_NONE "true"
 
     if [[ "${SKIP_DEPLOY:-false}" = "false" ]]; then
         if [[ "${CI:-false}" = "true" ]]; then
@@ -58,14 +57,20 @@ _compatibility_test() {
 
         setup_deployment_env false false
         setup_podsecuritypolicies_config
-        remove_existing_stackrox_resources
+        "$ROOT/scripts/roxie.sh" teardown all --single-namespace || true
         setup_default_TLS_certs
 
         deploy_stackrox_with_custom_central_and_sensor_versions "${central_version}" "${sensor_version}"
-        echo "Stackrox deployed"
         kubectl -n stackrox get deploy,ds -o wide
 
-        deploy_default_psp
+        # Old versions under test may still deploy Scanner V2. Wait only when that
+        # workload exists; HEAD installs Scanner V4 instead.
+        # TODO(https://github.com/stackrox/roxie/issues/269): replace with --early-readiness=false roxie flag,
+        # once we no longer need to deploy 4.9
+        if retrying_kubectl </dev/null -n stackrox get deployment scanner >/dev/null 2>&1; then
+            wait_for_ready_deployment stackrox scanner 600
+        fi
+
         deploy_webhook_server
         get_ECR_docker_pull_password
     fi
diff --git a/qa-tests-backend/scripts/run-part-1.sh b/qa-tests-backend/scripts/run-part-1.sh
index 35b36700fba2c..819caaefda26f 100755
--- a/qa-tests-backend/scripts/run-part-1.sh
+++ b/qa-tests-backend/scripts/run-part-1.sh
@@ -45,6 +45,11 @@ config_part_1() {
     setup_gcp
     setup_deployment_env false false
     if [[ "$use_roxie_deploy" == "true" ]]; then
+        # On GHA we already installed roxie in a previous workflow step. On Prow we have roxie available as part of the apollo-ci image,
+        # but it might not be up to date, hence this invocation to make sure that we have a recent roxie version also on Prow.
+        if [[ "${GITHUB_ACTIONS:-}" != "true" ]]; then
+            ensure_roxie_on_path
+        fi
         info "Using roxie-based pre-test teardown"
         roxie teardown all --single-namespace
     else
@@ -58,6 +63,8 @@ config_part_1() {
     if [[ "$use_roxie_deploy" == "true" ]]; then
         info "Using roxie-based config_part_1 for qa-tests-backend"
 
+        ensure_roxie_on_path
+
         local config_file
         config_file="$(mktemp)"
 
@@ -65,24 +72,12 @@ config_part_1() {
 central:
   pauseReconciliation: true
   resourceProfile: ci
+  portForwarding: false
 securedCluster:
   pauseReconciliation: true
   resourceProfile: ci
 EOF
 
-        if pr_has_label test-konflux-images; then
-            info "PR label 'test-konflux-images' detected, will be using Konflux-built images for deploying StackRox"
-            patch_yaml "$config_file" ".roxie.konfluxImages = true"
-        fi
-        if [[ "$(yq eval ".roxie.konfluxImages" "$config_file")" == "true" ]]; then
-            # Due to https://access.redhat.com/solutions/6540591 we need to patch the global pull secrets
-            # to be able to pull images after applying image-rewriting rules for downstream images.
-            # See https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/images/
-            #     managing-images#images-update-global-pull-secret_using-image-pull-secrets.
-            #
-            # Can be removed once https://github.com/stackrox/roxie/pull/186 lands.
-            patch_global_openshift_pull_secret "quay.io/rhacs-eng" "${QUAY_RHACS_ENG_RO_USERNAME}" "${QUAY_RHACS_ENG_RO_PASSWORD}"
-        fi
         deploy_stackrox_with_roxie_compat "$config_file"
         setup_client_TLS_certs "$ROOT/$DEPLOY_DIR/client_TLS_certs"
         # Note: The traditional deployment path still references PodSecurityPolicies,
@@ -105,29 +100,6 @@ EOF
     image_prefetcher_prebuilt_await
 }
 
-patch_global_openshift_pull_secret() {
-    local registry="$1"
-    local username="$2"
-    local password="$3"
-
-    info "Patching global OpenShift pull-secret to include credentials for ${registry}"
-    local tmp_pull_secret; tmp_pull_secret=$(mktemp)
-
-    oc get secret/pull-secret \
-        -n openshift-config \
-        --template='{{index .data ".dockerconfigjson" | base64decode}}' \
-        > "$tmp_pull_secret"
-    oc registry login \
-        --registry="$registry" \
-        --auth-basic="${username}:${password}" \
-        --to="$tmp_pull_secret"
-    oc set data secret/pull-secret \
-        -n openshift-config \
-        --from-file=.dockerconfigjson="$tmp_pull_secret"
-
-    rm -f "$tmp_pull_secret"
-}
-
 reuse_config_part_1() {
     info "Reusing config from a prior part 1 e2e test"
 
diff --git a/qa-tests-backend/src/main/groovy/objects/Deployment.groovy b/qa-tests-backend/src/main/groovy/objects/Deployment.groovy
index 7645193566c1a..151da20ae5735 100644
--- a/qa-tests-backend/src/main/groovy/objects/Deployment.groovy
+++ b/qa-tests-backend/src/main/groovy/objects/Deployment.groovy
@@ -14,6 +14,8 @@ class Deployment {
     String name
     String namespace = Constants.ORCHESTRATOR_NAMESPACE
     String image
+    // Optional policy for the main container; takes precedence over the CI Quay policy.
+    String imagePullPolicyOverride
     Map<String, String> labels = [:]
     Map<Integer, String> ports = [:]
     Integer targetport
@@ -104,6 +106,11 @@ class Deployment {
         return this
     }
 
+    Deployment setImagePullPolicyOverride(String policy) {
+        this.imagePullPolicyOverride = policy
+        return this
+    }
+
     Deployment addLabel(String k, String v) {
         this.labels[k] = v
         return this
diff --git a/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy b/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy
index 0a34e502cb40c..7d44e2751784b 100644
--- a/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy
+++ b/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy
@@ -71,6 +71,7 @@ import io.fabric8.kubernetes.api.model.apps.DaemonSetBuilder
 import io.fabric8.kubernetes.api.model.apps.DaemonSetList
 import io.fabric8.kubernetes.api.model.apps.DaemonSetSpec
 import io.fabric8.kubernetes.api.model.apps.Deployment as K8sDeployment
+import io.fabric8.kubernetes.api.model.apps.DeploymentBuilder
 import io.fabric8.kubernetes.api.model.apps.DeploymentList
 import io.fabric8.kubernetes.api.model.apps.DeploymentSpec
 import io.fabric8.kubernetes.api.model.apps.StatefulSet as K8sStatefulSet
@@ -210,15 +211,58 @@ class Kubernetes {
         waitForDeploymentAndPopulateInfo(deployment)
     }
 
+    @CompileDynamic
     boolean updateDeploymentNoWait(Deployment deployment, int maxRetries = 0) {
-        K8sDeployment k8sdeployment = deployments.inNamespace(deployment.namespace).withName(deployment.name).get()
-        if (k8sdeployment) {
-            log.debug "Deployment ${deployment.name} with version ${k8sdeployment.metadata.resourceVersion} " +
-                    "found in namespace ${deployment.namespace}. Updating..."
-        } else {
+        deployment.getNamespace() != null ?: deployment.setNamespace(this.namespace)
+        K8sDeployment existing = deployments.inNamespace(deployment.namespace).withName(deployment.name).get()
+        if (!existing) {
             log.debug "Deployment ${deployment.name} NOT found in namespace ${deployment.namespace}. Creating..."
+            return createDeploymentNoWait(deployment, maxRetries)
+        }
+        log.debug "Deployment ${deployment.name} with version ${existing.metadata.resourceVersion} " +
+                "found in namespace ${deployment.namespace}. Updating..."
+        // Edit the live object rather than createOrReplace (CREATE then REPLACE).
+        // createOrReplace is recorded as CREATE enforcement.
+        // Always retry 409s a few times: the deployment controller often updates
+        // status right after create, so a PATCH with a stale resourceVersion
+        // conflicts. maxRetries=0 still uses that floor; a larger maxRetries
+        // raises it. Do not retry 403; admission denials must fail immediately.
+        K8sDeployment desired = toK8sDeployment(deployment)
+        int maxAttempts = Math.max(maxRetries, 5)
+        for (int i = 0; i < maxAttempts; i++) {
+            try {
+                this.deployments.inNamespace(deployment.namespace)
+                        .withName(deployment.name)
+                        .edit { K8sDeployment current ->
+                            new DeploymentBuilder(current)
+                                    .editMetadata()
+                                    .withLabels(desired.metadata.labels)
+                                    .withAnnotations(desired.metadata.annotations)
+                                    .endMetadata()
+                                    .editSpec()
+                                    .withReplicas(desired.spec.replicas)
+                                    .withMinReadySeconds(desired.spec.minReadySeconds)
+                                    .withTemplate(desired.spec.template)
+                                    .endSpec()
+                                    .build()
+                        }
+                log.debug "Told the orchestrator to update " + deployment.name
+                return true
+            } catch (KubernetesClientException e) {
+                if (e.code == 409 && i < maxAttempts - 1) {
+                    log.debug "Conflict updating ${deployment.name}, retrying " +
+                            "(attempt ${i + 1} of ${maxAttempts})"
+                    sleep 1000
+                    continue
+                }
+                log.warn("Error updating k8s deployment: ", e)
+                return false
+            } catch (Exception e) {
+                log.warn("Error updating k8s deployment: ", e)
+                return false
+            }
         }
-        return createDeploymentNoWait(deployment, maxRetries)
+        return false
     }
 
     void updateDeployment(Deployment deployment) {
@@ -2089,15 +2133,8 @@ class Kubernetes {
     */
 
     @CompileDynamic
-    boolean createDeploymentNoWait(Deployment deployment, int maxNumRetries = 0) {
-        deployment.getNamespace() != null ?: deployment.setNamespace(this.namespace)
-
-        // Create service if needed
-        if (deployment.exposeAsService) {
-            createService(deployment)
-        }
-
-        K8sDeployment d = new K8sDeployment(
+    private K8sDeployment toK8sDeployment(Deployment deployment) {
+        return new K8sDeployment(
                 metadata: new ObjectMeta(
                         name: deployment.name,
                         namespace: deployment.namespace,
@@ -2116,9 +2153,20 @@ class Kubernetes {
                                 ),
                                 spec: generatePodSpec(deployment)
                         )
-
                 )
         )
+    }
+
+    @CompileDynamic
+    boolean createDeploymentNoWait(Deployment deployment, int maxNumRetries = 0) {
+        deployment.getNamespace() != null ?: deployment.setNamespace(this.namespace)
+
+        // Create service if needed
+        if (deployment.exposeAsService) {
+            createService(deployment)
+        }
+
+        K8sDeployment d = toK8sDeployment(deployment)
 
         try {
             withK8sClientRetry(maxNumRetries, 1) {
@@ -2402,7 +2450,9 @@ class Kubernetes {
         // Allow override of imagePullPolicy for quay.io images. Typically used
         // to set to Never to help keep the list of quay.io prebuilt images up
         // to date for image-prefetcher. Why not all images? See ROX-25258.
-        if (Env.IMAGE_PULL_POLICY_FOR_QUAY_IO && deployment.image =~ /^quay.io/) {
+        if (deployment.imagePullPolicyOverride) {
+            container.setImagePullPolicy(deployment.imagePullPolicyOverride)
+        } else if (Env.IMAGE_PULL_POLICY_FOR_QUAY_IO && deployment.image =~ /^quay.io/) {
             container.setImagePullPolicy(Env.IMAGE_PULL_POLICY_FOR_QUAY_IO)
         }
         if (deployment.livenessProbeDefined) {
@@ -2630,8 +2680,91 @@ class Kubernetes {
         withRetry(2, 3) {
             client.namespaces().withName(ns).delete()
         }
-        if (waitForDeletion) {
-            waitForNamespaceDeletion(ns)
+        if (waitForDeletion && !waitForNamespaceDeletion(ns)) {
+            // A namespace that is still listed is a failed cleanup, not a soft warning.
+            throw new OrchestratorManagerException(
+                    "Timed out waiting for namespace ${ns} to be deleted${namespaceDeletionDiagnostics(ns)}")
+        }
+    }
+
+    // deleteManagedWorkloads removes deployments, replica sets, and pods so
+    // namespace deletion is not held by a pod's termination. A second delete
+    // with grace period 0 shortens a termination already in progress.
+    @CompileDynamic
+    void deleteManagedWorkloads(String ns) {
+        Timer t = new Timer(20, 1)
+        boolean sawNoPods = false
+        while (t.IsValid()) {
+            if (namespaceGone(ns)) {
+                return
+            }
+            deleteCollectionQuietly { client.apps().deployments().inNamespace(ns).delete() }
+            deleteCollectionQuietly { client.apps().replicaSets().inNamespace(ns).delete() }
+            deleteCollectionQuietly { client.pods().inNamespace(ns).withGracePeriod(0L).delete() }
+            if (listPodsQuietly(ns).isEmpty()) {
+                // A second empty read covers a replica set that creates one
+                // more pod after it is told to delete.
+                if (sawNoPods) {
+                    return
+                }
+                sawNoPods = true
+                continue
+            }
+            sawNoPods = false
+        }
+        def stuck = listPodsQuietly(ns).collect {
+            "${it.metadata?.name} phase=${it.status?.phase} finalizers=${it.metadata?.finalizers}"
+        }
+        log.info "Workloads still present in ${ns} before namespace deletion: ${stuck}"
+    }
+
+    @CompileDynamic
+    private boolean namespaceGone(String ns) {
+        try {
+            return client.namespaces().withName(ns).get() == null
+        } catch (KubernetesClientException e) {
+            return e.code == 404
+        }
+    }
+
+    @CompileDynamic
+    private void deleteCollectionQuietly(Closure deletion) {
+        try {
+            deletion.call()
+        } catch (KubernetesClientException e) {
+            if (e.code != 404) {
+                log.warn "Resource delete during namespace cleanup failed: ${e.message}"
+            }
+        }
+    }
+
+    @CompileDynamic
+    private List listPodsQuietly(String ns) {
+        try {
+            return client.pods().inNamespace(ns).list()?.items ?: []
+        } catch (KubernetesClientException e) {
+            if (e.code == 404) {
+                return []
+            }
+            throw e
+        }
+    }
+
+    @CompileDynamic
+    private String namespaceDeletionDiagnostics(String ns) {
+        try {
+            def remaining = client.namespaces().withName(ns).get()
+            if (remaining == null) {
+                return ""
+            }
+            def pods = listPodsQuietly(ns).collect {
+                "${it.metadata?.name}(phase=${it.status?.phase}, finalizers=${it.metadata?.finalizers})"
+            }
+            return " (phase=${remaining.status?.phase}," +
+                    " deletionTimestamp=${remaining.metadata?.deletionTimestamp}," +
+                    " finalizers=${remaining.metadata?.finalizers}, pods=${pods})"
+        } catch (Exception e) {
+            return " (failed to collect namespace diagnostics: ${e.message})"
         }
     }
 
diff --git a/qa-tests-backend/src/main/groovy/services/CredentialExpiryService.groovy b/qa-tests-backend/src/main/groovy/services/CredentialExpiryService.groovy
index fa220d6fb890f..961cbbc5c0d38 100644
--- a/qa-tests-backend/src/main/groovy/services/CredentialExpiryService.groovy
+++ b/qa-tests-backend/src/main/groovy/services/CredentialExpiryService.groovy
@@ -17,10 +17,4 @@ class CredentialExpiryService extends BaseService {
             GetCertExpiry.Request.newBuilder().setComponent(GetCertExpiry.Component.CENTRAL).build()
         ).getExpiry()
     }
-
-    static Timestamp getScannerCertExpiry() {
-        return getCredentialExpiryServiceClient().getCertExpiry(
-            GetCertExpiry.Request.newBuilder().setComponent(GetCertExpiry.Component.SCANNER).build()
-        ).getExpiry()
-    }
 }
diff --git a/qa-tests-backend/src/main/groovy/services/ImageIntegrationService.groovy b/qa-tests-backend/src/main/groovy/services/ImageIntegrationService.groovy
index aabba2f08ae02..bb3596aed6049 100644
--- a/qa-tests-backend/src/main/groovy/services/ImageIntegrationService.groovy
+++ b/qa-tests-backend/src/main/groovy/services/ImageIntegrationService.groovy
@@ -158,6 +158,10 @@ class ImageIntegrationService extends BaseService {
     }
 
     static String addStackroxScannerIntegration() {
+        if (FeatureFlagService.isFeatureFlagEnabled("ROX_SCANNER_V4")) {
+            log.debug("Not adding ${Constants.AUTO_REGISTERED_STACKROX_SCANNER_INTEGRATION}; Scanner V4 is enabled")
+            return ""
+        }
         ImageIntegrationOuterClass.ImageIntegration existing =
             getImageIntegrationByName(Constants.AUTO_REGISTERED_STACKROX_SCANNER_INTEGRATION)
         if (existing) {
diff --git a/qa-tests-backend/src/main/groovy/services/ReportV2Service.groovy b/qa-tests-backend/src/main/groovy/services/ReportV2Service.groovy
new file mode 100644
index 0000000000000..c911ecc2d54ef
--- /dev/null
+++ b/qa-tests-backend/src/main/groovy/services/ReportV2Service.groovy
@@ -0,0 +1,39 @@
+package services
+
+import groovy.util.logging.Slf4j
+
+import io.stackrox.proto.api.v2.Common
+import io.stackrox.proto.api.v2.ReportServiceGrpc
+import io.stackrox.proto.api.v2.ReportServiceOuterClass
+
+@Slf4j
+class ReportV2Service extends BaseService {
+
+    static ReportServiceGrpc.ReportServiceBlockingStub getClient() {
+        return ReportServiceGrpc.newBlockingStub(getChannel())
+    }
+
+    static ReportServiceOuterClass.ReportConfiguration createReportConfig(
+            ReportServiceOuterClass.ReportConfiguration config) {
+        return getClient().postReportConfiguration(config)
+    }
+
+    static deleteReportConfig(String configId) {
+        getClient().deleteReportConfiguration(
+                Common.ResourceByID.newBuilder().setId(configId).build())
+    }
+
+    static ReportServiceOuterClass.RunReportResponse runReport(String configId,
+            ReportServiceOuterClass.NotificationMethod method) {
+        return getClient().runReport(
+                ReportServiceOuterClass.RunReportRequest.newBuilder()
+                        .setReportConfigId(configId)
+                        .setReportNotificationMethod(method)
+                        .build())
+    }
+
+    static ReportServiceOuterClass.ReportStatusResponse getReportStatus(String reportId) {
+        return getClient().getReportStatus(
+                Common.ResourceByID.newBuilder().setId(reportId).build())
+    }
+}
diff --git a/qa-tests-backend/src/main/groovy/util/Env.groovy b/qa-tests-backend/src/main/groovy/util/Env.groovy
index 76801ffe04106..22bd89dedee97 100644
--- a/qa-tests-backend/src/main/groovy/util/Env.groovy
+++ b/qa-tests-backend/src/main/groovy/util/Env.groovy
@@ -267,10 +267,6 @@ class Env {
         return mustGet("GOOGLE_CREDENTIALS_GCR_NO_ACCESS_KEY_V2")
     }
 
-    static String mustGetPagerdutyToken() {
-        return mustGet("PAGERDUTY_TOKEN")
-    }
-
     static String mustGetSlackFixableVulnsChannel() {
         return mustGet("SLACK_FIXABLE_VULNS_CHANNEL")
     }
diff --git a/qa-tests-backend/src/main/groovy/util/SplunkUtil.groovy b/qa-tests-backend/src/main/groovy/util/SplunkUtil.groovy
index aee9924bf9a00..ae4138b0a63c7 100644
--- a/qa-tests-backend/src/main/groovy/util/SplunkUtil.groovy
+++ b/qa-tests-backend/src/main/groovy/util/SplunkUtil.groovy
@@ -191,6 +191,8 @@ class SplunkUtil {
         Service syslogSvc
         LocalPortForward splunkPortForward
         try {
+            // No TCP readiness probe: Splunk binds 8089 after the container is
+            // running, and waitForSplunkBoot already waits on the health API.
             deployment =
                     new Deployment()
                             .setNamespace(namespace)
@@ -204,7 +206,6 @@ class SplunkUtil {
                             .addLabel("app", deploymentName)
                             .addRequest("cpu", "500m")
                             .addLimits("memory", "3Gi")
-                            .setReadinessProbeTcpPort(8089)
             orchestrator.createDeployment(deployment)
 
             collectorSvc = new Service("splunk-collector-" + uid, namespace)
diff --git a/qa-tests-backend/src/test/groovy/AdmissionControllerNoImageScanTest.groovy b/qa-tests-backend/src/test/groovy/AdmissionControllerNoImageScanTest.groovy
index 6d562584c284e..4780d500306c1 100644
--- a/qa-tests-backend/src/test/groovy/AdmissionControllerNoImageScanTest.groovy
+++ b/qa-tests-backend/src/test/groovy/AdmissionControllerNoImageScanTest.groovy
@@ -75,30 +75,12 @@ OqxYbK0Iro6GzSmOzxkn+N2AKawLyXi84WSwJQBK//psATakCgAQKkNTAA==
     def "Verify Admission Controller Behavior for No Image Scans Policy"() {
         String gcrId
 
-        // Note: This test is intentionally not using @Unroll in order to depend on the order of
-        // operations.
-
         when:
+        "Enable admission controller enforcement"
         def ac = AdmissionControllerConfig.newBuilder()
                 .setEnabled(true)
-                .setScanInline(false)
                 .setTimeoutSeconds(30)
 
-        assert ClusterService.updateAdmissionController(ac)
-        // Maximum time to wait for propagation to sensor
-        sleep 5000
-
-        then:
-        "Create deployment with a non-scannable image and inline scans disabled"
-        assert launchDeploymentWithImage(NON_EXISTENT_IMAGE)
-
-        and:
-        "Create deployment with a scannable image and inline scans disabled"
-        assert launchDeploymentWithImage(IMAGE_WITH_SCANS)
-
-        when:
-        "Enable inline scans"
-        ac.scanInline = true
         assert ClusterService.updateAdmissionController(ac)
         sleep 5000
 
@@ -113,32 +95,13 @@ OqxYbK0Iro6GzSmOzxkn+N2AKawLyXi84WSwJQBK//psATakCgAQKkNTAA==
         sleep 5000
 
         then:
-        "Create deployment with a scannable image and inline scans enabled (w/ long timeout)"
+        "Create deployment with a scannable image"
         assert launchDeploymentWithImage(IMAGE_WITH_SCANS)
 
         and:
-        "Create deployment with a non-scannable image and inline scans enabled (w/ long timeout)"
+        "Create deployment with a non-scannable image"
         assert !launchDeploymentWithImage(NON_EXISTENT_IMAGE)
 
-        when:
-        "Disable inline scans again"
-        ac.scanInline = false
-        assert ClusterService.updateAdmissionController(ac)
-        sleep 5000
-
-        and:
-        "Enable image signature policy"
-        updateImageSignaturePolicy(true)
-        sleep 5000
-
-        then:
-        "Create deployment with a non-scannable image and inline scans disabled"
-        assert launchDeploymentWithImage(NON_EXISTENT_IMAGE)
-
-        and:
-        "Create deployment with a scannable image and inline scans disabled"
-        assert launchDeploymentWithImage(IMAGE_WITH_SCANS)
-
         cleanup:
         if (gcrId) {
             ImageIntegrationService.deleteImageIntegration(gcrId)
diff --git a/qa-tests-backend/src/test/groovy/AdmissionControllerTest.groovy b/qa-tests-backend/src/test/groovy/AdmissionControllerTest.groovy
index c45601902d8ae..5c674a7b3b03b 100644
--- a/qa-tests-backend/src/test/groovy/AdmissionControllerTest.groovy
+++ b/qa-tests-backend/src/test/groovy/AdmissionControllerTest.groovy
@@ -1,5 +1,7 @@
 import static util.Helpers.withRetry
 
+import io.grpc.Status
+import io.grpc.StatusRuntimeException
 import io.stackrox.proto.storage.Cve.VulnerabilitySeverity
 import io.stackrox.proto.storage.ImageOuterClass
 import io.stackrox.proto.storage.PolicyOuterClass
@@ -8,6 +10,7 @@ import io.stackrox.proto.storage.ScopeOuterClass
 import objects.Deployment
 import services.ClusterService
 import services.ImageService
+import services.NamespaceService
 import services.PolicyService
 import util.Timer
 
@@ -130,10 +133,17 @@ class AdmissionControllerTest extends BaseSpecification {
     }
 
     def cleanupSpec() {
+        // A pod can still be listed after its deployment object is gone, and
+        // that holds this shared namespace in Terminating.
+        orchestrator.deleteManagedWorkloads(TEST_NAMESPACE)
         orchestrator.deleteNamespace(TEST_NAMESPACE)
 
-        for (policyID in createdPolicyIds) {
-            PolicyService.deletePolicy(policyID)
+        try {
+            for (policyID in createdPolicyIds) {
+                PolicyService.deletePolicy(policyID)
+            }
+        } catch (Exception e) {
+            log.warn "Failed to delete one or more policies during cleanup: ${e.message}"
         }
     }
 
@@ -143,21 +153,7 @@ class AdmissionControllerTest extends BaseSpecification {
     def "Verify admission controller enforcement on create: #desc"() {
         when:
         "Create a deployment that violates an enforced policy"
-        // Retry to allow time for the admission controller to fetch scan data from
-        // Central. Policies that require image enrichment (e.g. severity) may not
-        // evaluate on the first attempt if the AC pod handling this request hasn't
-        // cached the scan results yet. The retry is harmless for fast-path policies
-        // (latest tag, bypass) since they pass on the first attempt.
-        def created
-        withRetry(ClusterService.isOpenShift4() ? 40 : 20, 1) {
-            created = orchestrator.createDeploymentNoWait(deployment)
-            if (created != launched) {
-                if (created) {
-                    deleteDeploymentWithCaution(deployment)
-                }
-                assert created == launched
-            }
-        }
+        def created = createDeploymentWithEnforcementRetry(deployment, launched)
 
         then:
         "Verify the admission controller allows or blocks based on policy and bypass annotation"
@@ -252,16 +248,74 @@ class AdmissionControllerTest extends BaseSpecification {
         true         | true
     }
 
+    // cleanupLabelTestNamespace removes workloads before the namespace. A pod
+    // from an allowed deployment keeps the namespace past the delete wait, and
+    // Central can still list it after the API object is gone (ROX-36941).
+    private void cleanupLabelTestNamespace(String testNs) {
+        if (!testNs) {
+            return
+        }
+        orchestrator.deleteManagedWorkloads(testNs)
+        orchestrator.deleteNamespace(testNs)
+        withRetry(30, 1) {
+            assert NamespaceService.getNamespaces().every { it.metadata.name != testNs }
+        }
+    }
+
     def deleteDeploymentWithCaution(Deployment deployment) {
+        orchestrator.deleteDeployment(deployment)
         def timer = new Timer(30, 1)
-        def deleted = false
-        while (!deleted && timer.IsValid()) {
-            orchestrator.deleteDeployment(deployment)
-            deleted = true
+        while (timer.IsValid()) {
+            if (orchestrator.getOrchestratorDeployment(deployment.namespace, deployment.name) == null) {
+                return
+            }
+        }
+        log.warn "Failed to confirm deletion of deployment ${deployment.name}. Subsequent tests may be affected ..."
+    }
+
+    private Exception deletePolicyWithCaution(String policyId) {
+        try {
+            if (policyId) {
+                PolicyService.deletePolicy(policyId)
+                // Wait for policy deletion to propagate to admission controller
+                withRetry(10, 1) {
+                    def policyExists = true
+                    try {
+                        Services.getPolicy(policyId)
+                    } catch (StatusRuntimeException e) {
+                        if (e.status.code == Status.Code.NOT_FOUND) {
+                            policyExists = false
+                        } else {
+                            throw e
+                        }
+                    }
+                    assert !policyExists : "Policy ${policyId} still exists after deletion"
+                }
+            }
+        } catch (Exception e) {
+            log.warn "Failed to delete policy ${policyId}: ${e.message}"
+            return e
         }
-        if (!deleted) {
-            log.warn "Failed to delete deployment. Subsequent tests may be affected ..."
+        return null
+    }
+
+    // Retry to allow time for the admission controller to fetch scan data from
+    // Central. Policies that require image enrichment (e.g. severity) may not
+    // evaluate on the first attempt if the AC pod handling this request hasn't
+    // cached the scan results yet. The retry is harmless for fast-path policies
+    // (latest tag, bypass) since they pass on the first attempt.
+    private boolean createDeploymentWithEnforcementRetry(Deployment deployment, boolean expected) {
+        def created
+        withRetry(ClusterService.isOpenShift4() ? 40 : 20, 1) {
+            created = orchestrator.createDeploymentNoWait(deployment)
+            if (created != expected) {
+                if (created) {
+                    deleteDeploymentWithCaution(deployment)
+                }
+                assert created == expected
+            }
         }
+        return created
     }
 
     @Unroll
@@ -309,12 +363,15 @@ class AdmissionControllerTest extends BaseSpecification {
         assert created == !blocked
 
         cleanup:
-        if (created) {
-            deleteDeploymentWithCaution(deployment)
+        def policyDeletionFailure = deletePolicyWithCaution(policyId)
+        try {
+            cleanupLabelTestNamespace(testNs)
+        } catch (Exception e) {
+            log.warn "Namespace ${testNs} deletion failed or timed out: ${e.message}"
+            throw e
         }
-        orchestrator.deleteNamespace(testNs, false)
-        if (policyId) {
-            PolicyService.deletePolicy(policyId)
+        if (policyDeletionFailure) {
+            throw policyDeletionFailure
         }
 
         where:
@@ -406,12 +463,15 @@ class AdmissionControllerTest extends BaseSpecification {
         assert created2
 
         cleanup:
-        if (created2) {
-            deleteDeploymentWithCaution(deployment2)
+        def policyDeletionFailure = deletePolicyWithCaution(policyId)
+        try {
+            cleanupLabelTestNamespace(testNs)
+        } catch (Exception e) {
+            log.warn "Namespace ${testNs} deletion failed or timed out: ${e.message}"
+            throw e
         }
-        orchestrator.deleteNamespace(testNs, false)
-        if (policyId) {
-            PolicyService.deletePolicy(policyId)
+        if (policyDeletionFailure) {
+            throw policyDeletionFailure
         }
 
         where:
@@ -433,7 +493,7 @@ class AdmissionControllerTest extends BaseSpecification {
                 .addLabel("app", "test")
                 .addInitContainer("init-0", initImage)
 
-        def created = orchestrator.createDeploymentNoWait(deployment)
+        def created = createDeploymentWithEnforcementRetry(deployment, allowed)
 
         then:
         "Verify admission controller allows or blocks based on init container image"
diff --git a/qa-tests-backend/src/test/groovy/AttemptedAlertsTest.groovy b/qa-tests-backend/src/test/groovy/AttemptedAlertsTest.groovy
index 5f7eafb30ca55..e6d55c642efeb 100644
--- a/qa-tests-backend/src/test/groovy/AttemptedAlertsTest.groovy
+++ b/qa-tests-backend/src/test/groovy/AttemptedAlertsTest.groovy
@@ -189,8 +189,7 @@ class AttemptedAlertsTest extends BaseSpecification {
         and:
         "Set admission controller settings to enforce on updates to #enforce"
         AdmissionControllerConfig ac = AdmissionControllerConfig.newBuilder()
-                .setEnabled(false)
-                .setEnforceOnUpdates(enforce)
+                .setEnabled(enforce)
                 .setTimeoutSeconds(3)
                 .build()
 
diff --git a/qa-tests-backend/src/test/groovy/AuditScrubbingTest.groovy b/qa-tests-backend/src/test/groovy/AuditScrubbingTest.groovy
index 30a12cba6779c..2d10175670e9c 100644
--- a/qa-tests-backend/src/test/groovy/AuditScrubbingTest.groovy
+++ b/qa-tests-backend/src/test/groovy/AuditScrubbingTest.groovy
@@ -58,12 +58,14 @@ class AuditScrubbingTest extends BaseSpecification {
 
         when:
         "A POST request is made to the ExchangeToken API"
+        def encodedUser = URLEncoder.encode(username, 'UTF-8')
+        def encodedPass = URLEncoder.encode(password, 'UTF-8')
         RestAssured.given()
                 .relaxedHTTPSValidation()
                 .body(
                         JsonFormat.printer().print(
                                 AuthproviderService.ExchangeTokenRequest.newBuilder()
-                                    .setExternalToken("username=${username}&password=${password}")
+                                    .setExternalToken("username=${encodedUser}&password=${encodedPass}")
                                     .setState("${BASIC_AUTH_PROVIDER_ID}:${attemptId}")
                                     .setType("basic")))
                 .header("Referer", baseURL)
@@ -83,6 +85,7 @@ class AuditScrubbingTest extends BaseSpecification {
         and:
         "Verify that audit log string representation does not contain the password"
         assert !auditLogEntry.toString().contains(password)
+        assert !auditLogEntry.toString().contains(encodedPass)
 
         where:
         "Data inputs are"
diff --git a/qa-tests-backend/src/test/groovy/AutocompleteTest.groovy b/qa-tests-backend/src/test/groovy/AutocompleteTest.groovy
index bee052cca32e2..707a47ada77c2 100644
--- a/qa-tests-backend/src/test/groovy/AutocompleteTest.groovy
+++ b/qa-tests-backend/src/test/groovy/AutocompleteTest.groovy
@@ -36,11 +36,25 @@ class AutocompleteTest extends BaseSpecification {
         "Data inputs are: "
         query                 | category                   | contains
 
-        "Subject:system:auth" | []                         | "system:authenticated"
+        "Subject:system:auth" | []                          | "system:authenticated"
         "Subject:system:auth" | [SearchCategory.SUBJECTS]  | "system:authenticated"
-        "Subject Kind:GROUP"  | []                         | GROUP_AUTOCOMPLETE
-        "Subject Kind:group"  | []                         | GROUP_AUTOCOMPLETE
-        "Subject Kind:gr"     | []                         | GROUP_AUTOCOMPLETE
+        "Subject Kind:GROUP"  | []                          | GROUP_AUTOCOMPLETE
+        "Subject Kind:group"  | []                          | GROUP_AUTOCOMPLETE
+        "Subject Kind:gr"     | []                          | GROUP_AUTOCOMPLETE
+    }
+
+    @Tag("BAT")
+    def "Verify Autocomplete: Category returns results for POLICIES"() {
+        when:
+        SearchServiceOuterClass.AutocompleteResponse resp = SearchService.autocomplete(
+                RawSearchRequest.newBuilder()
+                        .addAllCategories([SearchCategory.POLICIES])
+                        .setQuery("Category:")
+                        .build()
+        )
+
+        then:
+        !resp.valuesList.isEmpty()
     }
 
     @Unroll
diff --git a/qa-tests-backend/src/test/groovy/BaseSpecification.groovy b/qa-tests-backend/src/test/groovy/BaseSpecification.groovy
index b9fd54897e044..eb3302abc7d13 100644
--- a/qa-tests-backend/src/test/groovy/BaseSpecification.groovy
+++ b/qa-tests-backend/src/test/groovy/BaseSpecification.groovy
@@ -459,7 +459,7 @@ class BaseSpecification extends Specification {
         return Env.get("IS_RACE_BUILD", null) == "true" || Env.CI_JOB_NAME == "race-condition-qa-e2e-tests"
     }
 
-    @Retry(attempts = 30, delay = 3)
+    @Retry(attempts = 60, delay = 5)
     static void waitForClusterHealthy() {
         ClusterOuterClass.ClusterHealthStatus status = ClusterService.getCluster().healthStatus
         assert status.overallHealthStatus == ClusterOuterClass.ClusterHealthStatus.HealthStatusLabel.HEALTHY
diff --git a/qa-tests-backend/src/test/groovy/BuiltinPoliciesTest.groovy b/qa-tests-backend/src/test/groovy/BuiltinPoliciesTest.groovy
index 0b9cc4098c5e6..5bfec018b8c02 100644
--- a/qa-tests-backend/src/test/groovy/BuiltinPoliciesTest.groovy
+++ b/qa-tests-backend/src/test/groovy/BuiltinPoliciesTest.groovy
@@ -1,6 +1,8 @@
 import static Services.getPolicies
 import static Services.waitForViolation
 
+import orchestratormanager.OrchestratorTypes
+
 import io.stackrox.proto.api.v1.PolicyServiceOuterClass.PatchPolicyRequest
 
 import objects.Deployment
@@ -72,6 +74,11 @@ class BuiltinPoliciesTest extends BaseSpecification {
                     .setImage("non-existent:image"),
     ]
 
+    // Enabling disabled deploy-time policies re-evaluates every cluster workload.
+    // OpenShift platform namespaces make that queue several minutes long.
+    static final private Integer WAIT_FOR_VIOLATION_TIMEOUT =
+            (isRaceBuild() || Env.mustGetOrchestratorType() == OrchestratorTypes.OPENSHIFT) ? 450 : 120
+
     @Shared
     private List<String> disabledPolicyIds
 
@@ -127,7 +134,7 @@ class BuiltinPoliciesTest extends BaseSpecification {
 
         then:
         "Verify Violation for #policyName is triggered"
-        assert waitForViolation(deploymentName, policyName, isRaceBuild() ? 450 : 120)
+        assert waitForViolation(deploymentName, policyName, WAIT_FOR_VIOLATION_TIMEOUT)
 
         where:
         "Data inputs are:"
diff --git a/qa-tests-backend/src/test/groovy/CentralWorkerTest.groovy b/qa-tests-backend/src/test/groovy/CentralWorkerTest.groovy
new file mode 100644
index 0000000000000..42b305f5c9ca3
--- /dev/null
+++ b/qa-tests-backend/src/test/groovy/CentralWorkerTest.groovy
@@ -0,0 +1,182 @@
+import static util.Helpers.withRetry
+
+import io.stackrox.proto.api.v2.ReportServiceOuterClass
+
+import services.CollectionsService
+import services.ReportV2Service
+import util.Env
+
+import spock.lang.IgnoreIf
+import spock.lang.Tag
+import spock.lang.Shared
+
+@Tag("CentralWorker")
+// CentralWorkerTest requires a central-worker pod, which is off unless
+// ROX_CENTRAL_WORKER_ENABLED is true at deploy time.
+@IgnoreIf({ Env.get("ROX_CENTRAL_WORKER_ENABLED", "false") != "true" })
+class CentralWorkerTest extends BaseSpecification {
+
+    @Shared
+    private String collectionId
+
+    def setupSpec() {
+        // Create a collection scoped to the stackrox namespace for report tests
+        def collection = CollectionsService.createCollection([], ["stackrox"])
+        collectionId = collection.getId()
+        assert collectionId
+        LOG.info("Created test collection: ${collectionId}")
+    }
+
+    def cleanupSpec() {
+        if (collectionId) {
+            CollectionsService.deleteCollection(collectionId)
+        }
+    }
+
+    def "central-worker pod should be running"() {
+        expect:
+        "exactly one worker pod should be running"
+        withRetry(10, 3) {
+            def pods = orchestrator.getPods("stackrox", "central-worker")
+            assert pods.size() == 1
+        }
+    }
+
+    def "Central should skip pruning when worker is enabled"() {
+        expect:
+        "Central should log that pruning is managed by central-worker"
+        withRetry(10, 3) {
+            def centralLog = orchestrator.getPodLog("stackrox",
+                    orchestrator.getPods("stackrox", "central").first().metadata.name)
+            assert centralLog.contains("Pruning is managed by central-worker")
+        }
+    }
+
+    def "Central should skip report scheduling when worker is enabled"() {
+        expect:
+        "Central should log that report scheduling is managed by central-worker"
+        withRetry(10, 3) {
+            def centralLog = orchestrator.getPodLog("stackrox",
+                    orchestrator.getPods("stackrox", "central").first().metadata.name)
+            assert centralLog.contains("Report scheduling is managed by central-worker")
+        }
+    }
+
+    def "Worker should run pruning cycle"() {
+        expect:
+        "worker should have completed a pruning cycle"
+        withRetry(30, 5) {
+            def workerPodName = orchestrator.getPods("stackrox", "central-worker")
+                    .first().metadata.name
+            def workerLog = orchestrator.getPodLog("stackrox", workerPodName)
+            assert workerLog.contains("Finished garbage collection cycle")
+        }
+    }
+
+    def "Worker should acquire advisory lock for pruning"() {
+        expect:
+        "worker should acquire and release pruning advisory lock"
+        withRetry(30, 5) {
+            def workerPodName = orchestrator.getPods("stackrox", "central-worker")
+                    .first().metadata.name
+            def workerLog = orchestrator.getPodLog("stackrox", workerPodName)
+            assert workerLog.contains("Advisory lock 7293581046138294017 acquired")
+            assert workerLog.contains("Advisory lock 7293581046138294017 released")
+        }
+    }
+
+    def "Worker should start LISTEN/NOTIFY listener"() {
+        expect:
+        "worker should be listening on report channels"
+        withRetry(10, 3) {
+            def workerPodName = orchestrator.getPods("stackrox", "central-worker")
+                    .first().metadata.name
+            def workerLog = orchestrator.getPodLog("stackrox", workerPodName)
+            assert workerLog.contains("Notification listener started on channels: " +
+                    "[notifier_changed report_config_changed report_request_submitted report_request_cancelled]")
+        }
+    }
+
+    def "On-demand report should be generated by worker"() {
+        given:
+        "a report configuration"
+        def config = ReportV2Service.createReportConfig(
+                ReportServiceOuterClass.ReportConfiguration.newBuilder()
+                        .setName("e2e-worker-test-${UUID.randomUUID()}")
+                        .setDescription("E2E test for central-worker report generation")
+                        .setType(ReportServiceOuterClass.ReportConfiguration.ReportType.VULNERABILITY)
+                        .setVulnReportFilters(
+                                ReportServiceOuterClass.VulnerabilityReportFilters.newBuilder()
+                                        .setFixability(
+                                                ReportServiceOuterClass.VulnerabilityReportFilters
+                                                        .Fixability.BOTH)
+                                        .addSeverities(
+                                                ReportServiceOuterClass.VulnerabilityReportFilters
+                                                        .VulnerabilitySeverity.CRITICAL_VULNERABILITY_SEVERITY)
+                                        .addImageTypes(
+                                                ReportServiceOuterClass.VulnerabilityReportFilters
+                                                        .ImageType.DEPLOYED)
+                                        .setAllVuln(true)
+                                        .build())
+                        .setResourceScope(
+                                ReportServiceOuterClass.ResourceScope.newBuilder()
+                                        .setCollectionScope(
+                                                ReportServiceOuterClass.CollectionReference
+                                                        .newBuilder()
+                                                        .setCollectionId(collectionId)
+                                                        .build())
+                                        .build())
+                        .build())
+
+        when:
+        "submitting an on-demand report"
+        def runResponse = ReportV2Service.runReport(config.getId(),
+                ReportServiceOuterClass.NotificationMethod.DOWNLOAD)
+        def reportId = runResponse.getReportId()
+
+        then:
+        "report should be generated successfully"
+        withRetry(10, 3) {
+            def status = ReportV2Service.getReportStatus(reportId)
+            assert status.getStatus().getRunState() ==
+                    ReportServiceOuterClass.ReportStatus.RunState.GENERATED ||
+                    status.getStatus().getRunState() ==
+                    ReportServiceOuterClass.ReportStatus.RunState.DELIVERED
+        }
+
+        and:
+        "worker logs should show report execution"
+        withRetry(10, 3) {
+            def workerPodName = orchestrator.getPods("stackrox", "central-worker")
+                    .first().metadata.name
+            def workerLog = orchestrator.getPodLog("stackrox", workerPodName)
+            assert workerLog.contains("Executing report")
+        }
+
+        cleanup:
+        if (config?.getId()) {
+            ReportV2Service.deleteReportConfig(config.getId())
+        }
+    }
+
+    def "Worker should recover after pod restart"() {
+        when:
+        "killing the worker pod"
+        def workerPods = orchestrator.getPods("stackrox", "central-worker")
+        assert workerPods.size() == 1
+        def oldPodName = workerPods.first().metadata.name
+        orchestrator.deletePod("stackrox", oldPodName, 0L)
+
+        then:
+        "a new worker pod should start and complete initialization"
+        withRetry(20, 5) {
+            def pods = orchestrator.getPods("stackrox", "central-worker")
+            assert pods.size() == 1
+            def newPodName = pods.first().metadata.name
+            assert newPodName != oldPodName
+            def log = orchestrator.getPodLog("stackrox", newPodName)
+            assert log.contains("central-worker is ready")
+            assert log.contains("Finished garbage collection cycle")
+        }
+    }
+}
diff --git a/qa-tests-backend/src/test/groovy/CertExpiryTest.groovy b/qa-tests-backend/src/test/groovy/CertExpiryTest.groovy
index d17a33314a52d..cffd3030d5b94 100644
--- a/qa-tests-backend/src/test/groovy/CertExpiryTest.groovy
+++ b/qa-tests-backend/src/test/groovy/CertExpiryTest.groovy
@@ -1,12 +1,9 @@
-import static util.Helpers.shellCmdExitValue
-
 import services.CredentialExpiryService
 import util.Cert
 
 import spock.lang.Tag
 import spock.lang.IgnoreIf
 import util.Env
-import util.Helpers
 
 @Tag("BAT")
 @Tag("COMPATIBILITY")
@@ -28,22 +25,4 @@ class CertExpiryTest extends BaseSpecification {
         assert Cert.loadBase64EncodedCert(centralTLSSecret.data["cert.pem"]).notAfter == centralCertExpiryFromCentral
     }
 
-    def "Test Scanner cert expiry"() {
-        when:
-        "Fetch the current scanner-tls secret, and the scanner cert expiry as returned by Central"
-        assert shellCmdExitValue("./scripts/ci/is-scanner-v2-available.sh stackrox") == 0
-        def scannerTLSSecret = orchestrator.getSecret("scanner-tls", "stackrox")
-        assert scannerTLSSecret
-        // Retry since scanner integration registration happens asynchronously.
-        def scannerCertExpiryFromCentral = Helpers.evaluateWithRetry(5, 5) {
-            return new Date(CredentialExpiryService.getScannerCertExpiry().getSeconds() * 1000)
-        }
-        assert scannerCertExpiryFromCentral
-
-        then:
-        "Make sure they match"
-        assert Cert.loadBase64EncodedCert(scannerTLSSecret.data["cert.pem"]).notAfter == scannerCertExpiryFromCentral
-    }
-
 }
-
diff --git a/qa-tests-backend/src/test/groovy/CertRotationTest.groovy b/qa-tests-backend/src/test/groovy/CertRotationTest.groovy
index 536e1b99801da..af58ddeec1de7 100644
--- a/qa-tests-backend/src/test/groovy/CertRotationTest.groovy
+++ b/qa-tests-backend/src/test/groovy/CertRotationTest.groovy
@@ -109,23 +109,6 @@ class CertRotationTest extends BaseSpecification {
             "cert.pem", "key.pem", "CENTRAL_SERVICE", start)
     }
 
-    def "Test Scanner cert rotation"() {
-        when:
-        "Fetch the current scanner-tls and scanner-db-tls secrets, and regenerate new certs"
-        def scannerTLSSecret = orchestrator.getSecret("scanner-tls", "stackrox")
-        assert scannerTLSSecret
-        def scannerDBTLSSecret = orchestrator.getSecret("scanner-db-tls", "stackrox")
-        assert scannerDBTLSSecret
-        def start = System.currentTimeMillis()
-        def regeneratedSecrets = generateCerts("api/extensions/certgen/scanner", "scanner-tls.yaml")
-
-        then:
-        testMatchingSecretFoundWithExpectedProperties(regeneratedSecrets, scannerTLSSecret,
-            "cert.pem", "key.pem", "SCANNER_SERVICE", start)
-        testMatchingSecretFoundWithExpectedProperties(regeneratedSecrets, scannerDBTLSSecret,
-            "cert.pem", "key.pem", "SCANNER_DB_SERVICE", start)
-    }
-
     def "Test sensor cert rotation"() {
         when:
         "Fetch the current sensor-tls, collector-tls and admission-control-tls secrets, and regenerate certs"
diff --git a/qa-tests-backend/src/test/groovy/CloudSourcesTest.groovy b/qa-tests-backend/src/test/groovy/CloudSourcesTest.groovy
index 34827d0933a02..ed80fd481fd6a 100644
--- a/qa-tests-backend/src/test/groovy/CloudSourcesTest.groovy
+++ b/qa-tests-backend/src/test/groovy/CloudSourcesTest.groovy
@@ -49,7 +49,6 @@ class CloudSourcesTest extends BaseSpecification {
 
         where:
         authMethod            | token                        | clientId                 | clientSecret
-        "OCM offline token"   | Env.mustGetOcmOfflineToken() | ""                       | ""
         "OCM service account" | ""                           | Env.mustGetOcmClientId() | Env.mustGetOcmClientSecret()
     }
 }
diff --git a/qa-tests-backend/src/test/groovy/DefaultPoliciesTest.groovy b/qa-tests-backend/src/test/groovy/DefaultPoliciesTest.groovy
index 7543ba51f05c1..f2bb5227ac1b6 100644
--- a/qa-tests-backend/src/test/groovy/DefaultPoliciesTest.groovy
+++ b/qa-tests-backend/src/test/groovy/DefaultPoliciesTest.groovy
@@ -83,6 +83,10 @@ class DefaultPoliciesTest extends BaseSpecification {
             "tunnelfront - Secure Shell Server (sshd) Execution",
             "tunnelfront - Docker CIS 4.7: Alert on Update Instruction",
             "webhookserver - Kubernetes Actions: Port Forward to Pod",
+            // Newer EKS ebs-csi-node DaemonSets use bidirectional mount propagation.
+            "ebs-csi-node - Docker CIS 5.19: Ensure mount propagation mode is not enabled",
+            // GKE filestore-node DaemonSets use bidirectional mount propagation.
+            "filestore-node - Docker CIS 5.19: Ensure mount propagation mode is not enabled",
     ]
 
     static final private Deployment STRUTS_DEPLOYMENT = new Deployment()
@@ -114,7 +118,7 @@ class DefaultPoliciesTest extends BaseSpecification {
             .addLabel("app", "test"),
         new Deployment()
             .setName(GCR_NGINX)
-            .setImage("us.gcr.io/acs-san-stackroxci/qa-multi-arch:nginx-1.12")
+            .setImage("quay.io/rhacs-eng/qa-multi-arch:nginx-2.0.3")
             .addLabel ( "app", "test" )
             .setCommand(["sleep", "600"]),
         new Deployment()
@@ -459,11 +463,10 @@ class DefaultPoliciesTest extends BaseSpecification {
                 "Port 80 is exposed in the cluster"  | null | []
 
         "Image Vulnerabilities"           | 4.0f     | null |
-                // StackRox Scanner reports 100+ CVEs between Low and Critical.
-                // Scanner V4 reports fewer CVEs (~78) and a different minimum
-                // severity (Moderate in this case). Using \\d{2,} and \\w+ to accept both outcomes.
+                // Scanner versions report different counts of distinct CVEs and minimum
+                // severities. Use a regex to accept both outcomes.
                 "Image \"" + STRUTS_IMAGE + "\\\"" +
-                     " contains \\d{2,} CVEs with severities ranging between " +
+                     " contains \\d{2,} distinct CVEs with severities ranging between " +
                      "\\w+ and \\w+" | []
 
         "Service Configuration"           | 2.0f     |
diff --git a/qa-tests-backend/src/test/groovy/GlobalSearch.groovy b/qa-tests-backend/src/test/groovy/GlobalSearch.groovy
index 04056f42a13f5..e4f563e85bf19 100644
--- a/qa-tests-backend/src/test/groovy/GlobalSearch.groovy
+++ b/qa-tests-backend/src/test/groovy/GlobalSearch.groovy
@@ -34,10 +34,6 @@ class GlobalSearch extends BaseSpecification {
                                      SearchServiceOuterClass.SearchCategory.NAMESPACES,
                                      SearchServiceOuterClass.SearchCategory.IMAGES,
                                      SearchServiceOuterClass.SearchCategory.DEPLOYMENTS)
-        if (flattenImageDataEnabled) {
-            EXPECTED_DEPLOYMENT_CATEGORIES.add(SearchServiceOuterClass.SearchCategory.IMAGES_V2)
-            EXPECTED_IMAGE_CATEGORIES.add(SearchServiceOuterClass.SearchCategory.IMAGES_V2)
-        }
 
         orchestrator.createDeployment(DEPLOYMENT)
         assert Services.waitForDeployment(DEPLOYMENT)
diff --git a/qa-tests-backend/src/test/groovy/GraphQLResourcePaginationTest.groovy b/qa-tests-backend/src/test/groovy/GraphQLResourcePaginationTest.groovy
index 400e862051fe5..9f388c0d8501e 100644
--- a/qa-tests-backend/src/test/groovy/GraphQLResourcePaginationTest.groovy
+++ b/qa-tests-backend/src/test/groovy/GraphQLResourcePaginationTest.groovy
@@ -63,7 +63,7 @@ class GraphQLResourcePaginationTest extends BaseSpecification {
         // TODO: re-activate once fixed against postgres
         //"image"      | "Image:main" | null | "Sort(null)" | "deployments"
 
-        "secret"     | "Secret:scanner-db-password" | null | "Sort(null)" | "deployments"
+        "secret"     | "Secret:central-tls" | null | "Sort(null)" | "deployments"
 
         "subject"    | "Subject:kubelet" | null | "Sort(null)" | "k8sRoles"
 
diff --git a/qa-tests-backend/src/test/groovy/ImageScanningTest.groovy b/qa-tests-backend/src/test/groovy/ImageScanningTest.groovy
index bfda3507ebc5b..a56d13e2c4e47 100644
--- a/qa-tests-backend/src/test/groovy/ImageScanningTest.groovy
+++ b/qa-tests-backend/src/test/groovy/ImageScanningTest.groovy
@@ -80,6 +80,8 @@ class ImageScanningTest extends BaseSpecification {
                     // Alternatively can use quay.io/rhacs-eng/qa:struts-app but that doesn't have as many
                     // dockerfile violations
                     .setImage("quay.io/rhacs-eng/qa:registry-image-0-3")
+                    // TODO(ROX-37155): Revert this override.
+                    .setImagePullPolicyOverride("IfNotPresent")
                     .addLabel("app", "quay-image-scanning-test")
                     .addImagePullSecret("quay-image-scanning-test"),
             "gcr": new Deployment()
@@ -158,7 +160,9 @@ class ImageScanningTest extends BaseSpecification {
     def cleanupSpec() {
         orchestrator.deleteNamespace(TEST_NAMESPACE)
 
-        ImageIntegrationService.addStackroxScannerIntegration()
+        if (!scannerV4Enabled) {
+            ImageIntegrationService.addStackroxScannerIntegration()
+        }
         addGCRImagePullSecret(orchestrator)
 
         for (Policy policy : policiesScopedForTest) {
@@ -480,7 +484,9 @@ class ImageScanningTest extends BaseSpecification {
     @Tag("BAT")
     @Tag("Integration")
     def "Verify Scan Results from Registries - #registry.name() - #component:#version - #image - #cve - #idx"() {
-        ImageIntegrationService.addStackroxScannerIntegration()
+        if (!scannerV4Enabled) {
+            ImageIntegrationService.addStackroxScannerIntegration()
+        }
 
         when:
         "Add scanner"
@@ -509,7 +515,9 @@ class ImageScanningTest extends BaseSpecification {
         vuln != null
 
         cleanup:
-        deleteStackroxScanner = true
+        if (!scannerV4Enabled) {
+            deleteStackroxScanner = true
+        }
         imageToCleanup = image
 
         where:
@@ -661,7 +669,7 @@ class ImageScanningTest extends BaseSpecification {
                 { -> AzureRegistryIntegration.createDefaultIntegration() }
         "acr-config-only"     | "acr"       | true               | /^acr$/                    |
                 { -> AzureRegistryIntegration.createDefaultIntegration() }
-        "quay-auto"           | "quay"      | false              | source(".*.quay.io")       | null
+        "quay-auto"           | "quay"      | false              | source(".*quay\\.io.*")    | null
         // ROX-29720 - disable gcr.io until tests are fixed for metadata failures after migration to artifacts registry
         //"gcr-auto"            | "gcr"       | false              | source(".*.gcr.io")        | null
     }
@@ -674,8 +682,10 @@ class ImageScanningTest extends BaseSpecification {
     @Unroll
     @Tag("Integration")
     def "Image scanning test to check if scan time is not null #image from stackrox"() {
+        Assume.assumeTrue(StackroxScannerIntegration.isTestable())
+
         when:
-        "Add Stackrox scanner"
+        "Add scanner"
         String integrationId = StackroxScannerIntegration.createDefaultIntegration()
         assert integrationId
         integrationIds.add(integrationId)
diff --git a/qa-tests-backend/src/test/groovy/ImageSignatureVerificationTest.groovy b/qa-tests-backend/src/test/groovy/ImageSignatureVerificationTest.groovy
index f45330daf0a3a..594d17d0aa1a7 100644
--- a/qa-tests-backend/src/test/groovy/ImageSignatureVerificationTest.groovy
+++ b/qa-tests-backend/src/test/groovy/ImageSignatureVerificationTest.groovy
@@ -42,6 +42,10 @@ class ImageSignatureVerificationTest extends BaseSpecification {
     static final private String KEYLESS_SIGSTORE_UNVERIFIABLE = "Keyless-Sigstore-Unverifiable"
     static final private String KEYLESS_RHTAS_MATCHING = "Keyless-RHTAS-Matching"
     static final private String KEYLESS_RHTAS_UNVERIFIABLE = "Keyless-RHTAS-Unverifiable"
+    static final private String REFERRER_BYOPKI_MATCHING = "Referrer-BYOPKI-Matching"
+    static final private String REFERRER_BYOPKI_UNVERIFIABLE = "Referrer-BYOPKI-Unverifiable"
+    static final private String REFERRER_PUBKEY_MATCHING = "Referrer-PubKey-Matching"
+    static final private String REFERRER_PUBKEY_UNVERIFIABLE = "Referrer-PubKey-Unverifiable"
 
     // List of integration names used within tests.
     // NOTE: If you add a new name, make sure to add it here.
@@ -59,6 +63,10 @@ class ImageSignatureVerificationTest extends BaseSpecification {
             KEYLESS_SIGSTORE_UNVERIFIABLE,
             KEYLESS_RHTAS_MATCHING,
             KEYLESS_RHTAS_UNVERIFIABLE,
+            REFERRER_BYOPKI_MATCHING,
+            REFERRER_BYOPKI_UNVERIFIABLE,
+            REFERRER_PUBKEY_MATCHING,
+            REFERRER_PUBKEY_UNVERIFIABLE,
     ]
 
     // Public keys used within signature integrations.
@@ -139,38 +147,122 @@ nzTe7BpOmVwmqLkIefEJe5L4PSXtp2KFLZqGO/kY5A==
     static final private String BYOPKI_UNVERIFIABLE_ISSUER = "invalid"
     static final private String BYOPKI_UNVERIFIABLE_IDENTITY = "invalid"
 
+    // Root CA bundle for referrer BYOPKI test image.
+    static final private String REFERRER_BYOPKI_CA_BUNDLE = """\
+-----BEGIN CERTIFICATE-----
+MIIFqzCCA5OgAwIBAgIUXp5NfhduES4NIr+wVdh6oGiDmMkwDQYJKoZIhvcNAQEL
+BQAwVDELMAkGA1UEBhMCVVMxEDAOBgNVBAcMB1Rlc3RpbmcxDDAKBgNVBAoMA0RF
+VjEQMA4GA1UECwwHVGVzdGluZzETMBEGA1UEAwwKVGVzdGluZyBDQTAgFw0yNjA3
+MjgxMzAwNDZaGA8yMDUzMTIxMjEzMDA0NlowYTELMAkGA1UEBhMCVVMxEDAOBgNV
+BAcMB1Rlc3RpbmcxDDAKBgNVBAoMA0RFVjEQMA4GA1UECwwHVGVzdGluZzEgMB4G
+A1UEAwwXVGVzdGluZyBJbnRlcm1lZGlhdGUgQ0EwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQCot6wi8hVYOFYioC1hx/kNpXWEO1vvoXLfFFIjgkN/SRz+
+h7JiEYT5h86lgFseNKwyWhXCSRjqU0wgwioZXxk8lWJ4oHUaelSHDoRsC2IuYLuG
+zk1yiQiaSMyde3zf7CiQ/zWEY7o5TD4I0jHoWE1igCnP7EKgznNK0OWA0kFmgrb/
+uv6yC/Mi8y0q8uM6SWrQZtnrqVP8ZWwd887l65gXrCzF+sERvG8rV3AEEn4H5x1W
+32xBve9H9UT2vqvR0etwEGTdjn5hSXOOp4eL/CmSwhthEJR5UCmtFnix1N2zv0Yx
+xRI5HCxcROTdWgqu2pSYr+WmflAMJHwLYnt90hoB5wa094moM+SM3dh3vRaIHw61
+D0VFFgbzePBN/aMIW8F1y/RWwsKsaaA42GVrJ9UrS2LakiYS3h/RAZWAl4JqAEH4
+5Zs0fIZ4oqgJiMWxbeXG3iHTM1NzXluBrxwVpN0bGhQz1q1kqXnlIwbNk6w8ORkq
+l8BxFYasXFjiDu3ukrAFeE8qXX1+UdFh9JM08lpfPmjmzeoi95spiN5CzjJQ7Ije
+NLs5T1wHloBVSo1DQNAyJ2+wDA2wR7xsji8TlcXayUD3V5427oTl8ReNrDrxyzSB
+1V5JTwdnRI7vcFUDK/+Cy/TVAfn2e9BBOPKsnTQVkyX8T8j+FvnMDgCPaZmtPwID
+AQABo2YwZDAdBgNVHQ4EFgQUrb+MoT88/AigoiWyKutB71e0Vg8wDgYDVR0PAQH/
+BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQIwHwYDVR0jBBgwFoAUeKB90BMprglp
+ttMybtqk3NTWnkcwDQYJKoZIhvcNAQELBQADggIBAK81DMmXVogJ4zASBvjxrIrK
+NTAp91bB6ji6SkH2RcBIfyA/rLCrbWhg9euU/tN+9a141WYn/wdZ8IAIcFVNac+m
+eCxqC6BWbqesfIKOjuMIlkK1zE8sA36FlAxYZq3JHH31NwHdbN6xPBMP0/qBPWs4
+XuP0yIXOsVcm1elwBDPFztojOcXVZc0hpiwTAuiWSA4p4xbgyKaiubBYyy+KA41C
+dpxooMSFwnD82G4yS9UskWOmUq/7yCxIaINZKjFgFFIl3HKrZ2AmoT8fBnIXtfdK
+MgrpxpruBPM6pmEFm86tgwlOcZMjfo4/v5KMAUOBKL43+Cd/rAjMChTOdlFrC4RC
+Qlpdqv1ylSlCR6y8T+iRT14X4N1SVEIhVq/CqWijUksk+rgXdW8t+Sqf4N5NrecU
+AgUbVG8yoDQJx82zirtU1b0TL1dkZuWnJU8PMNm5sVabPmASnrtQmVedlnce2BET
+6/Z/RenLDW4FsMitUxAPEjLa8Gw3dCIlrxlRBd//6j30SqcgrXPQ4bAeGHb7xcMR
+3by+sIgtttcz10NP8yR4l/zO1FVBlMGB35jI6+e1DrVtRt+Mk9I75WkT0SJ3dC/0
+JWjz6++KJ8sXQqyveGdL/rnxf1d2nylGQj9Lcb41DdY8G8Q9hoN7QNGXvS19AYyk
+SX52n8GLrS4ph8b+hDgX
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFizCCA3OgAwIBAgIUXbdRB0FhfSY7Qm780j6jn4jGAK4wDQYJKoZIhvcNAQEL
+BQAwVDELMAkGA1UEBhMCVVMxEDAOBgNVBAcMB1Rlc3RpbmcxDDAKBgNVBAoMA0RF
+VjEQMA4GA1UECwwHVGVzdGluZzETMBEGA1UEAwwKVGVzdGluZyBDQTAgFw0yNjA3
+MjgxMzAwMzVaGA8yMDUzMTIxMjEzMDAzNVowVDELMAkGA1UEBhMCVVMxEDAOBgNV
+BAcMB1Rlc3RpbmcxDDAKBgNVBAoMA0RFVjEQMA4GA1UECwwHVGVzdGluZzETMBEG
+A1UEAwwKVGVzdGluZyBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+AMt5lS0A3u7vzNFymcUxz4+M15/z4jfWD3csIgdwKUPXnOshkD5t9jrytlBPO/sA
+u9uSz0ZkLPYQivnVfopqobiwrpU0i1hR6WXsEqcAXsPyu5kIP12MMua+HD946RZK
+xXE7MP5HtaC634Ki9GsVHHWKkVKn+ChHfP6NVm8tKPipAbMRfxzYKAzV0GAgszKM
+MRTViW74NGG3+E6Lh8a88QwkvxC3gSIF7jYdCByCbn88EKpbzPc5asXzEB7XxxI4
+69886omw4G4HFaM4yS6LAc/GFixd4+XUGp6wyckHKt5yvh0pM8f0RkqUndhWREWG
+MM0FS0LUnaM/SYUCtp5g4OrYoT59cfqJiXgU7bpR4vjA0NxihoypMmt/8l12Yecb
+InGdp88hqPuQl5mUb43/tqWLnU7lqVlz2SifpY/dr8c8lHafY1++erfED19YhJkX
+pC+wmInqVxIgoy+O/iu0eZn0Enj1Y4ZkqM1V+R05JQ9LxMjw1RATLy4tDECiJrQI
+rr9P0dSdRpb9rWe42OUIrqsNVHtFJJ3iNwGuyC2qn6lFsbbP/smZzaufUUxVQMo3
+HiohNgLnXnLT8H9COmpZ9mPn4TixYUyaHxKhEtp/z3f1CUcZxbXdHiwzG0ua0Mji
+TQnaj0MROwyYr46Wx0JSF7G5a/RTexHRd8izq3ZNb9+rAgMBAAGjUzBRMB0GA1Ud
+DgQWBBR4oH3QEymuCWm20zJu2qTc1NaeRzAfBgNVHSMEGDAWgBR4oH3QEymuCWm2
+0zJu2qTc1NaeRzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAr
+F63FL67wOBUaFsOJS3tjBC6T0LW6jJfdK1J+EPIaeMzfbYEfNrS1WvjHbDbucld7
+OasRv35j+1h3MlbH6H6SjLBqG0cAVoc5HxB9cQ83eWx6AQ3Qz1A20SQIQm+OsRNt
+KF44H5mhijtgEbCSXqPBmIMhvuubbZ1cnMzmYX9kS71c0okDEQcamVnNX8J+3T+F
+1PwIf94QPfy67jlcnBw3mvh46VmYh8RV52jGZiVBW4TWUDNEGlSfXei5r7zYNEDK
+ukaDvKuKdLxPkfqslD3Ewls/kYqA2/82aFDBlWgIQGRH6P1GfWt0OVN1zt2lCR3K
+yuO4rpbvz88A1gocDUGGsMF3lX4O429GD8eiJ5Iy3iDekf+fAKsE/C6QvNXZJ3PF
+tjGVYw5EoD+lhRIKveuePWwhsOOiEq+0fVDtOl93/QKbT/mODt6eC2v6EBqNKWF6
+MMfAX4tGHsunfJXOu2P2rt+sroTAfzzfhs45mHlR1SRjS0uSH33oMFGPV3VIMNup
+cQtyfbxM4JvxKiuJTQSE2KaxpMWz4GI/SIyOkgEQd7o7Gs6aagD1lcg6zcQTF9yI
+hN4lyr+IhJcs6FOmY1oCKEm0d+zZyZ0C9UhZT0WtCC21ODIhIY1cIOop+gHrQNI5
+YnCZegw4WELm9/9HL3/UKjODvfJWroVn4k8hPB+wWg==
+-----END CERTIFICATE-----"""
+    static final private String REFERRER_BYOPKI_MATCHING_ISSUER = "https://testing.org"
+    static final private String REFERRER_BYOPKI_MATCHING_IDENTITY = "team-a@testing.org"
+
+    // Public key used to sign the referrer-based test images.
+    // Source: https://vault.bitwarden.com/#/vault?itemId=95313e19-de46-4533-b160-af620120452a.
+    static final private Map<String, String> REFERRER_COSIGN_PUBLIC_KEY = [
+            "Referrer": """\
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEu8+OtJR+dVIDHk89zl8WnzcQskow
+bfbvZqSDudXtfGwpKu6tZ1CtH9utaLkglXynrLNecl0QvrhuCuKA/htSwA==
+-----END PUBLIC KEY-----
+""",
+    ]
+
     static final private String KEYLESS_SIGSTORE_ISSUER = "https://github.com/login/oauth"
     static final private String KEYLESS_SIGSTORE_IDENTITY = ".*@redhat.com"
     static final private String KEYLESS_SIGSTORE_REKOR_URL = "https://rekor.sigstore.dev"
 
+    // RHTAS instance is hosted on
+    // [testing services cluster](
+    //   https://console-openshift-console.apps.rosa.c3a7d6d7i1o8i5l.427x.p3.openshiftapps.com
+    // ).
     static final private String KEYLESS_RHTAS_ISSUER = "https://accounts.google.com"
     static final private String KEYLESS_RHTAS_IDENTITY = ".*@redhat.com"
     static final private String KEYLESS_RHTAS_FULCIO_CHAIN = """\
 -----BEGIN CERTIFICATE-----
-MIICBDCCAYqgAwIBAgIUNo8BCDFZXeig9JJONBUirNKTPW0wCgYIKoZIzj0EAwMw
+MIICAzCCAYqgAwIBAgIUctVXHIIauBVird+Ti/YJjvX8hpowCgYIKoZIzj0EAwMw
 LDEQMA4GA1UEChMHUmVkIEhhdDEYMBYGA1UEAxMPZnVsY2lvLmhvc3RuYW1lMB4X
-DTI1MDQwOTE1MzgzMFoXDTM1MDQwNzE1MzgzMFowLDEQMA4GA1UEChMHUmVkIEhh
+DTI2MDcyNDE0MzkwMloXDTM2MDcyMTE0MzkwMlowLDEQMA4GA1UEChMHUmVkIEhh
 dDEYMBYGA1UEAxMPZnVsY2lvLmhvc3RuYW1lMHYwEAYHKoZIzj0CAQYFK4EEACID
-YgAEBUJFBeglXU9zgd34suFRG8FIWz3eNChxgd5vcAI22LJvT0dhDLxOE/W1h0f+
-jRa9jM9V0EeYRpMQ6SKhbOu5mv9dTJ1d36f0e1iHQAPKDXq09D5mDcwZmR7uiaE8
-rMPjo20wazAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
-FgQUNoDRLK7bVIxt7tLbETIvDzdJ5hAwKQYDVR0RBCIwIIEeYWNzLXRlYW0tYXV0
-b21hdGlvbkByZWRoYXQuY29tMAoGCCqGSM49BAMDA2gAMGUCMG8sro032ep9lnOx
-XaZsqx+Vjb6dGmJmFQbPZX9EZxgZxG1n50EnLi/xTMxR98z4HgIxAI4ViQ6pd+6r
-ceLzLr4eKGR5yqqoWWciLF5Che/Cfqgma3jSRxbiL2urMRS3Y7038g==
+YgAEozLgKDyvO+qnl3PZNnspzjY4xgBd1bMeyLZwKIPH19bRuCSGgJPVUizTdrkb
+mOXiGyHw7w97XLITtbEOSi7mIEhc+3CuvE2nq/mfWHQQRsgm6yOx1EDh1hhiBkuD
+asNuo20wazAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQUNqwE3qpbn7ZYcF8yWCigAzsMfRcwKQYDVR0RBCIwIIEeYWNzLXRlYW0tYXV0
+b21hdGlvbkByZWRoYXQuY29tMAoGCCqGSM49BAMDA2cAMGQCMFYVSgoPjQzhxBx+
+vpgZb5CUJwUZDHCvp9PPN/Kz48+ELC0kDF90KbTJv0Tj0GjnzAIwPl5EVmjV/Hoy
+yri0BdxRThPV8+/wTrDCqsA1bOlgOYzAzEAZqTNTvnLinNzf7yQ5
 -----END CERTIFICATE-----"""
     static final private String KEYLESS_RHTAS_CTLOG_PUBLIC_KEY = """\
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHOWcrgffC8A4CwsPqmfy+unEU1km
-SgPCnfCzwRToJ9263qyEp+3aaCv0T4QicC31fsokxoUIGzK0Ftrt3SoXDw==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8ewvXPAw43N3ULmsN8YIYDh47rZu
+0EXuZ06hVeddfdxbRzHehpWIVNUO1zzl7wFpqPPYAffxxDmDDkNmy8cB6Q==
 -----END PUBLIC KEY-----"""
     static final private String KEYLESS_RHTAS_REKOR_URL =
-            "https://rekor-server-trusted-artifact-signer.apps.staging-central.services.rox.systems"
+            "https://rekor-server-trusted-artifact-signer.apps.rosa.c3a7d6d7i1o8i5l.427x.p3.openshiftapps.com"
     static final private String KEYLESS_RHTAS_REKOR_PUBLIC_KEY = """\
 -----BEGIN PUBLIC KEY-----
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAECsUdy4SYw0Wey6iYiJ7uArUqHhKTwpRn
-YTuoC8lh1tt0nLkIQpdAJMuWndZJkRHcZriW1Qc2l3Mau0DtuYK17uz7pEwci+tK
-5mll4EcDCwjeQyH0cXjCdn9gXfIDFjg/
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAFH7J1JajguG/zJ6CsUWIbKau0/A
+l4RLgOfB7JK26P2QEGpNzOKYHxWIV+oBSrrG1/2q1LS6WJYqhlM2+tLK9g==
 -----END PUBLIC KEY-----"""
 
     static final private String DISTROLESS_IMAGE_DIGEST =
@@ -191,6 +283,14 @@ YTuoC8lh1tt0nLkIQpdAJMuWndZJkRHcZriW1Qc2l3Mau0DtuYK17uz7pEwci+tK
             "sha256:37f7b378a29ceb4c551b1b5582e27747b855bbfaa73fa11914fe0df028dc581f"
     static final private String KEYLESS_RHTAS_IMAGE_DIGEST =
             "sha256:e246aa22ad2cbdfbd19e2a6ca2b275e26245a21920e2b2d0666324cee3f15549"
+    static final private String REFERRER_BYOPKI_IMAGE_DIGEST =
+            "sha256:05a79c7279f71f86a2a0d05eb72fcb56ea36139150f0a75cd87e80a4272e4e39"
+    static final private String REFERRER_PUBKEY_MATCHING_IMAGE_DIGEST =
+            "sha256:9e2bbca079387d7965c3a9cee6d0c53f4f4e63ff7637877a83c4c05f2a666112"
+    static final private String REFERRER_KEYLESS_RHTAS_MATCHING_IMAGE_DIGEST =
+            "sha256:e8e5cca392e3cf056fcdb3093e7ac2bf83fcf28b3bcf5818fe8ae71cf360c231"
+    static final private String REFERRER_KEYLESS_SIGSTORE_MATCHING_IMAGE_DIGEST =
+            "sha256:98ad9d1a2be345201bb0709b0d38655eb1b370145c7d94ca1fe9c421f76e245a"
 
     static final private List<String> IMAGE_DIGESTS = [
             DISTROLESS_IMAGE_DIGEST,
@@ -202,6 +302,10 @@ YTuoC8lh1tt0nLkIQpdAJMuWndZJkRHcZriW1Qc2l3Mau0DtuYK17uz7pEwci+tK
             BYOPKI_IMAGE_DIGEST,
             KEYLESS_SIGSTORE_IMAGE_DIGEST,
             KEYLESS_RHTAS_IMAGE_DIGEST,
+            REFERRER_BYOPKI_IMAGE_DIGEST,
+            REFERRER_PUBKEY_MATCHING_IMAGE_DIGEST,
+            REFERRER_KEYLESS_RHTAS_MATCHING_IMAGE_DIGEST,
+            REFERRER_KEYLESS_SIGSTORE_MATCHING_IMAGE_DIGEST,
     ]
 
     // Deployment holding an image which has a cosign signature that is verifiable with the DISTROLESS_PUBLIC_KEY.
@@ -291,6 +395,45 @@ YTuoC8lh1tt0nLkIQpdAJMuWndZJkRHcZriW1Qc2l3Mau0DtuYK17uz7pEwci+tK
             .setNamespace(SIGNATURE_TESTING_NAMESPACE)
             .setImagePrefetcherAffinity()
 
+    // Deployment holding an image with BYOPKI signature stored as an OCI referrer.
+    static final private Deployment REFERRER_BYOPKI_DEPLOYMENT = new Deployment()
+            .setName("referrer-byopki")
+            .setImage("quay.io/rhacs-eng/qa-signatures:referrer-byopki@$REFERRER_BYOPKI_IMAGE_DIGEST")
+            .addLabel("app", "image-with-referrer-byopki")
+            .setCommand(["sleep", "600"])
+            .setNamespace(SIGNATURE_TESTING_NAMESPACE)
+            .setImagePrefetcherAffinity()
+
+    // Deployment holding an image signed with a public key using the sigstore bundle format.
+    static final private Deployment REFERRER_PUBKEY_MATCHING_DEPLOYMENT = new Deployment()
+            .setName("referrer-pubkey")
+            .setImage("quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-pubkey" +
+                    "@$REFERRER_PUBKEY_MATCHING_IMAGE_DIGEST")
+            .addLabel("app", "image-with-referrer-pubkey")
+            .setCommand(["sleep", "600"])
+            .setNamespace(SIGNATURE_TESTING_NAMESPACE)
+            .setImagePrefetcherAffinity()
+
+    // Deployment holding an image signed keyless via RHTAS using the sigstore bundle format.
+    static final private Deployment REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT = new Deployment()
+            .setName("referrer-rhtas-keyless")
+            .setImage("quay.io/rhacs-eng/qa-signatures:referrer-keyless-rhtas" +
+                    "@$REFERRER_KEYLESS_RHTAS_MATCHING_IMAGE_DIGEST")
+            .addLabel("app", "image-with-referrer-keyless-rhtas")
+            .setCommand(["sleep", "600"])
+            .setNamespace(SIGNATURE_TESTING_NAMESPACE)
+            .setImagePrefetcherAffinity()
+
+    // Deployment holding an image signed keyless via public Sigstore using the sigstore bundle format.
+    static final private Deployment REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT = new Deployment()
+            .setName("referrer-sigstore-keyless")
+            .setImage("quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-keyless" +
+                    "@$REFERRER_KEYLESS_SIGSTORE_MATCHING_IMAGE_DIGEST")
+            .addLabel("app", "image-with-referrer-sigstore-bundle-keyless")
+            .setCommand(["sleep", "600"])
+            .setNamespace(SIGNATURE_TESTING_NAMESPACE)
+            .setImagePrefetcherAffinity()
+
     // List of deployments used within the tests. This will be used during setup of the spec / teardown to create /
     // delete all deployments.
     // NOTE: If you add another deployment, make sure to add it here as well.
@@ -304,6 +447,10 @@ YTuoC8lh1tt0nLkIQpdAJMuWndZJkRHcZriW1Qc2l3Mau0DtuYK17uz7pEwci+tK
             BYOPKI_DEPLOYMENT,
             KEYLESS_SIGSTORE_DEPLOYMENT,
             KEYLESS_RHTAS_DEPLOYMENT,
+            REFERRER_BYOPKI_DEPLOYMENT,
+            REFERRER_PUBKEY_MATCHING_DEPLOYMENT,
+            REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT,
+            REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT,
     ]
 
     // Base policy which will be used for creating subsequent policies that have signature integration IDs as values.
@@ -487,6 +634,45 @@ YTuoC8lh1tt0nLkIQpdAJMuWndZJkRHcZriW1Qc2l3Mau0DtuYK17uz7pEwci+tK
         CREATED_SIGNATURE_INTEGRATIONS.put(KEYLESS_RHTAS_UNVERIFIABLE,
             keylessRHTASUnverifiableSignatureIntegrationID)
 
+        // Signature integration "Referrer-BYOPKI-Matching" which holds the referrer BYOPKI CA bundle
+        // with matching identity and issuer.
+        String referrerByopkiMatchingID = createSignatureIntegration(
+            REFERRER_BYOPKI_MATCHING, NO_PUBLIC_KEYS,
+            new CertificateVerificationArgs(
+                chain: REFERRER_BYOPKI_CA_BUNDLE,
+                identity: REFERRER_BYOPKI_MATCHING_IDENTITY,
+                issuer: REFERRER_BYOPKI_MATCHING_ISSUER,
+            ),
+        )
+        assert referrerByopkiMatchingID
+        CREATED_SIGNATURE_INTEGRATIONS.put(REFERRER_BYOPKI_MATCHING, referrerByopkiMatchingID)
+
+        // Referrer BYOPKI with non-matching identity and issuer.
+        String referrerByopkiUnverifiableID = createSignatureIntegration(
+            REFERRER_BYOPKI_UNVERIFIABLE, NO_PUBLIC_KEYS,
+            new CertificateVerificationArgs(
+                chain: REFERRER_BYOPKI_CA_BUNDLE,
+                identity: BYOPKI_UNVERIFIABLE_IDENTITY,
+                issuer: BYOPKI_UNVERIFIABLE_ISSUER,
+            ),
+        )
+        assert referrerByopkiUnverifiableID
+        CREATED_SIGNATURE_INTEGRATIONS.put(REFERRER_BYOPKI_UNVERIFIABLE, referrerByopkiUnverifiableID)
+
+        // Signature integration for referrer signed with a public key.
+        String referrerPubKeyMatchingID = createSignatureIntegration(
+            REFERRER_PUBKEY_MATCHING, REFERRER_COSIGN_PUBLIC_KEY,
+        )
+        assert referrerPubKeyMatchingID
+        CREATED_SIGNATURE_INTEGRATIONS.put(REFERRER_PUBKEY_MATCHING, referrerPubKeyMatchingID)
+
+        // Referrer with wrong public key.
+        String referrerPubKeyUnverifiableID = createSignatureIntegration(
+            REFERRER_PUBKEY_UNVERIFIABLE, UNVERIFIABLE_COSIGN_PUBLIC_KEY,
+        )
+        assert referrerPubKeyUnverifiableID
+        CREATED_SIGNATURE_INTEGRATIONS.put(REFERRER_PUBKEY_UNVERIFIABLE, referrerPubKeyUnverifiableID)
+
         // Create all required deployments.
         orchestrator.batchCreateDeployments(DEPLOYMENTS)
         DEPLOYMENTS.each { assert Services.waitForDeployment(it) }
@@ -560,151 +746,259 @@ YTuoC8lh1tt0nLkIQpdAJMuWndZJkRHcZriW1Qc2l3Mau0DtuYK17uz7pEwci+tK
         }
 
         where:
-        policyName                                 | deployment                   | expectViolations
-        // Distroless should create alerts for all deployments except those using distroless images.
-        DISTROLESS                                 | BYOPKI_DEPLOYMENT            | true
-        DISTROLESS                                 | DISTROLESS_DEPLOYMENT        | false
-        DISTROLESS                                 | KEYLESS_RHTAS_DEPLOYMENT     | true
-        DISTROLESS                                 | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        DISTROLESS                                 | SAME_DIGEST_NO_SIGNATURE     | true
-        DISTROLESS                                 | SAME_DIGEST_WITH_SIGNATURE   | true
-        DISTROLESS                                 | TEKTON_DEPLOYMENT            | true
-        DISTROLESS                                 | UNVERIFIABLE_DEPLOYMENT      | true
-        DISTROLESS                                 | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Tekton should create alerts for all deployments except those using tekton images.
-        TEKTON                                     | BYOPKI_DEPLOYMENT            | true
-        TEKTON                                     | DISTROLESS_DEPLOYMENT        | true
-        TEKTON                                     | KEYLESS_RHTAS_DEPLOYMENT     | true
-        TEKTON                                     | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        TEKTON                                     | SAME_DIGEST_NO_SIGNATURE     | true
-        TEKTON                                     | SAME_DIGEST_WITH_SIGNATURE   | true
-        TEKTON                                     | TEKTON_DEPLOYMENT            | false
-        TEKTON                                     | UNVERIFIABLE_DEPLOYMENT      | true
-        TEKTON                                     | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Unverifiable should create alerts for all deployments.
-        UNVERIFIABLE                               | BYOPKI_DEPLOYMENT            | true
-        UNVERIFIABLE                               | DISTROLESS_DEPLOYMENT        | true
-        UNVERIFIABLE                               | KEYLESS_RHTAS_DEPLOYMENT     | true
-        UNVERIFIABLE                               | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        UNVERIFIABLE                               | SAME_DIGEST_NO_SIGNATURE     | true
-        UNVERIFIABLE                               | SAME_DIGEST_WITH_SIGNATURE   | true
-        UNVERIFIABLE                               | TEKTON_DEPLOYMENT            | true
-        UNVERIFIABLE                               | UNVERIFIABLE_DEPLOYMENT      | true
-        UNVERIFIABLE                               | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Distroless and tekton should create alerts for all deployments except those using distroless / tekton images.
-        DISTROLESS_AND_TEKTON                      | BYOPKI_DEPLOYMENT            | true
-        DISTROLESS_AND_TEKTON                      | DISTROLESS_DEPLOYMENT        | false
-        DISTROLESS_AND_TEKTON                      | KEYLESS_RHTAS_DEPLOYMENT     | true
-        DISTROLESS_AND_TEKTON                      | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        DISTROLESS_AND_TEKTON                      | SAME_DIGEST_NO_SIGNATURE     | true
-        DISTROLESS_AND_TEKTON                      | SAME_DIGEST_WITH_SIGNATURE   | true
-        DISTROLESS_AND_TEKTON                      | TEKTON_DEPLOYMENT            | false
-        DISTROLESS_AND_TEKTON                      | UNVERIFIABLE_DEPLOYMENT      | true
-        DISTROLESS_AND_TEKTON                      | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Policy with all three integrations should create alerts for all deployments except those using distroless /
-        // tekton images.
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | BYOPKI_DEPLOYMENT            | true
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | DISTROLESS_DEPLOYMENT        | false
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | KEYLESS_RHTAS_DEPLOYMENT     | true
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | SAME_DIGEST_NO_SIGNATURE     | true
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | SAME_DIGEST_WITH_SIGNATURE   | true
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | TEKTON_DEPLOYMENT            | false
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | UNVERIFIABLE_DEPLOYMENT      | true
-        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Same digest should create alerts for all deployments except those using alt-nginx image.
-        SAME_DIGEST                                | BYOPKI_DEPLOYMENT            | true
-        SAME_DIGEST                                | DISTROLESS_DEPLOYMENT        | true
-        SAME_DIGEST                                | KEYLESS_RHTAS_DEPLOYMENT     | true
-        SAME_DIGEST                                | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        SAME_DIGEST                                | SAME_DIGEST_NO_SIGNATURE     | true
-        SAME_DIGEST                                | SAME_DIGEST_WITH_SIGNATURE   | false
-        SAME_DIGEST                                | TEKTON_DEPLOYMENT            | true
-        SAME_DIGEST                                | UNVERIFIABLE_DEPLOYMENT      | true
-        SAME_DIGEST                                | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // BYOPKI wildcard should create alerts for all deployments except the BYOPKI deployment one.
-        BYOPKI_WILDCARD                            | BYOPKI_DEPLOYMENT            | false
-        BYOPKI_WILDCARD                            | DISTROLESS_DEPLOYMENT        | true
-        BYOPKI_WILDCARD                            | KEYLESS_RHTAS_DEPLOYMENT     | true
-        BYOPKI_WILDCARD                            | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        BYOPKI_WILDCARD                            | SAME_DIGEST_NO_SIGNATURE     | true
-        BYOPKI_WILDCARD                            | SAME_DIGEST_WITH_SIGNATURE   | true
-        BYOPKI_WILDCARD                            | TEKTON_DEPLOYMENT            | true
-        BYOPKI_WILDCARD                            | UNVERIFIABLE_DEPLOYMENT      | true
-        BYOPKI_WILDCARD                            | WITHOUT_SIGNATURE_DEPLOYMENT | true
+        policyName                                    | deployment                                      | expectViolations
         // BYOPKI matching should create alerts for all deployments except the BYOPKI deployment one.
-        BYOPKI_MATCHING                            | BYOPKI_DEPLOYMENT            | false
-        BYOPKI_MATCHING                            | DISTROLESS_DEPLOYMENT        | true
-        BYOPKI_MATCHING                            | KEYLESS_RHTAS_DEPLOYMENT     | true
-        BYOPKI_MATCHING                            | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        BYOPKI_MATCHING                            | SAME_DIGEST_NO_SIGNATURE     | true
-        BYOPKI_MATCHING                            | SAME_DIGEST_WITH_SIGNATURE   | true
-        BYOPKI_MATCHING                            | TEKTON_DEPLOYMENT            | true
-        BYOPKI_MATCHING                            | UNVERIFIABLE_DEPLOYMENT      | true
-        BYOPKI_MATCHING                            | WITHOUT_SIGNATURE_DEPLOYMENT | true
+        BYOPKI_MATCHING                               | BYOPKI_DEPLOYMENT                               | false
+        BYOPKI_MATCHING                               | DISTROLESS_DEPLOYMENT                           | true
+        BYOPKI_MATCHING                               | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        BYOPKI_MATCHING                               | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        BYOPKI_MATCHING                               | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        BYOPKI_MATCHING                               | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        BYOPKI_MATCHING                               | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        BYOPKI_MATCHING                               | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        BYOPKI_MATCHING                               | SAME_DIGEST_NO_SIGNATURE                        | true
+        BYOPKI_MATCHING                               | SAME_DIGEST_WITH_SIGNATURE                      | true
+        BYOPKI_MATCHING                               | TEKTON_DEPLOYMENT                               | true
+        BYOPKI_MATCHING                               | UNVERIFIABLE_DEPLOYMENT                         | true
+        BYOPKI_MATCHING                               | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
         // BYOPKI unverifiable should create alerts for all deployments.
-        BYOPKI_UNVERIFIABLE                        | BYOPKI_DEPLOYMENT            | true
-        BYOPKI_UNVERIFIABLE                        | DISTROLESS_DEPLOYMENT        | true
-        BYOPKI_UNVERIFIABLE                        | KEYLESS_RHTAS_DEPLOYMENT     | true
-        BYOPKI_UNVERIFIABLE                        | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        BYOPKI_UNVERIFIABLE                        | SAME_DIGEST_NO_SIGNATURE     | true
-        BYOPKI_UNVERIFIABLE                        | SAME_DIGEST_WITH_SIGNATURE   | true
-        BYOPKI_UNVERIFIABLE                        | TEKTON_DEPLOYMENT            | true
-        BYOPKI_UNVERIFIABLE                        | UNVERIFIABLE_DEPLOYMENT      | true
-        BYOPKI_UNVERIFIABLE                        | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // BYOPKI wildcard + Tekton should create alerts for all deployments except the
-        // BYOPKI one and the Tekton one.
-        BYOPKI_WILDCARD_AND_TEKTON                 | BYOPKI_DEPLOYMENT            | false
-        BYOPKI_WILDCARD_AND_TEKTON                 | DISTROLESS_DEPLOYMENT        | true
-        BYOPKI_WILDCARD_AND_TEKTON                 | KEYLESS_RHTAS_DEPLOYMENT     | true
-        BYOPKI_WILDCARD_AND_TEKTON                 | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        BYOPKI_WILDCARD_AND_TEKTON                 | SAME_DIGEST_NO_SIGNATURE     | true
-        BYOPKI_WILDCARD_AND_TEKTON                 | SAME_DIGEST_WITH_SIGNATURE   | true
-        BYOPKI_WILDCARD_AND_TEKTON                 | TEKTON_DEPLOYMENT            | false
-        BYOPKI_WILDCARD_AND_TEKTON                 | UNVERIFIABLE_DEPLOYMENT      | true
-        BYOPKI_WILDCARD_AND_TEKTON                 | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Keyless Sigstore matching should create alerts for all deployments except the
-        // one running the keyless Sigstore signed image.
-        KEYLESS_SIGSTORE_MATCHING                  | BYOPKI_DEPLOYMENT            | true
-        KEYLESS_SIGSTORE_MATCHING                  | DISTROLESS_DEPLOYMENT        | true
-        KEYLESS_SIGSTORE_MATCHING                  | KEYLESS_RHTAS_DEPLOYMENT     | true
-        KEYLESS_SIGSTORE_MATCHING                  | KEYLESS_SIGSTORE_DEPLOYMENT  | false
-        KEYLESS_SIGSTORE_MATCHING                  | SAME_DIGEST_NO_SIGNATURE     | true
-        KEYLESS_SIGSTORE_MATCHING                  | SAME_DIGEST_WITH_SIGNATURE   | true
-        KEYLESS_SIGSTORE_MATCHING                  | TEKTON_DEPLOYMENT            | true
-        KEYLESS_SIGSTORE_MATCHING                  | UNVERIFIABLE_DEPLOYMENT      | true
-        KEYLESS_SIGSTORE_MATCHING                  | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Keyless Sigstore unverifiable should create alerts for all deployments.
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | BYOPKI_DEPLOYMENT            | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | DISTROLESS_DEPLOYMENT        | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | KEYLESS_RHTAS_DEPLOYMENT     | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | SAME_DIGEST_NO_SIGNATURE     | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | SAME_DIGEST_WITH_SIGNATURE   | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | TEKTON_DEPLOYMENT            | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | UNVERIFIABLE_DEPLOYMENT      | true
-        KEYLESS_SIGSTORE_UNVERIFIABLE              | WITHOUT_SIGNATURE_DEPLOYMENT | true
-        // Keyless RHTAS matching should create alerts for all deployments except the
-        // one running the keyless RHTAS signed image.
-        KEYLESS_RHTAS_MATCHING                     | BYOPKI_DEPLOYMENT            | true
-        KEYLESS_RHTAS_MATCHING                     | DISTROLESS_DEPLOYMENT        | true
-        KEYLESS_RHTAS_MATCHING                     | KEYLESS_RHTAS_DEPLOYMENT     | false
-        KEYLESS_RHTAS_MATCHING                     | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        KEYLESS_RHTAS_MATCHING                     | SAME_DIGEST_NO_SIGNATURE     | true
-        KEYLESS_RHTAS_MATCHING                     | SAME_DIGEST_WITH_SIGNATURE   | true
-        KEYLESS_RHTAS_MATCHING                     | TEKTON_DEPLOYMENT            | true
-        KEYLESS_RHTAS_MATCHING                     | UNVERIFIABLE_DEPLOYMENT      | true
-        KEYLESS_RHTAS_MATCHING                     | WITHOUT_SIGNATURE_DEPLOYMENT | true
+        BYOPKI_UNVERIFIABLE                           | BYOPKI_DEPLOYMENT                               | true
+        BYOPKI_UNVERIFIABLE                           | DISTROLESS_DEPLOYMENT                           | true
+        BYOPKI_UNVERIFIABLE                           | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        BYOPKI_UNVERIFIABLE                           | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        BYOPKI_UNVERIFIABLE                           | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        BYOPKI_UNVERIFIABLE                           | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        BYOPKI_UNVERIFIABLE                           | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        BYOPKI_UNVERIFIABLE                           | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        BYOPKI_UNVERIFIABLE                           | SAME_DIGEST_NO_SIGNATURE                        | true
+        BYOPKI_UNVERIFIABLE                           | SAME_DIGEST_WITH_SIGNATURE                      | true
+        BYOPKI_UNVERIFIABLE                           | TEKTON_DEPLOYMENT                               | true
+        BYOPKI_UNVERIFIABLE                           | UNVERIFIABLE_DEPLOYMENT                         | true
+        BYOPKI_UNVERIFIABLE                           | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // BYOPKI wildcard should create alerts for all deployments except the BYOPKI deployment one.
+        BYOPKI_WILDCARD                               | BYOPKI_DEPLOYMENT                               | false
+        BYOPKI_WILDCARD                               | DISTROLESS_DEPLOYMENT                           | true
+        BYOPKI_WILDCARD                               | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        BYOPKI_WILDCARD                               | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        BYOPKI_WILDCARD                               | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        BYOPKI_WILDCARD                               | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        BYOPKI_WILDCARD                               | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        BYOPKI_WILDCARD                               | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        BYOPKI_WILDCARD                               | SAME_DIGEST_NO_SIGNATURE                        | true
+        BYOPKI_WILDCARD                               | SAME_DIGEST_WITH_SIGNATURE                      | true
+        BYOPKI_WILDCARD                               | TEKTON_DEPLOYMENT                               | true
+        BYOPKI_WILDCARD                               | UNVERIFIABLE_DEPLOYMENT                         | true
+        BYOPKI_WILDCARD                               | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // BYOPKI wildcard + Tekton should create alerts for all deployments except the BYOPKI one and the Tekton one.
+        BYOPKI_WILDCARD_AND_TEKTON                    | BYOPKI_DEPLOYMENT                               | false
+        BYOPKI_WILDCARD_AND_TEKTON                    | DISTROLESS_DEPLOYMENT                           | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | SAME_DIGEST_NO_SIGNATURE                        | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | SAME_DIGEST_WITH_SIGNATURE                      | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | TEKTON_DEPLOYMENT                               | false
+        BYOPKI_WILDCARD_AND_TEKTON                    | UNVERIFIABLE_DEPLOYMENT                         | true
+        BYOPKI_WILDCARD_AND_TEKTON                    | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Distroless should create alerts for all deployments except those using distroless images.
+        DISTROLESS                                    | BYOPKI_DEPLOYMENT                               | true
+        DISTROLESS                                    | DISTROLESS_DEPLOYMENT                           | false
+        DISTROLESS                                    | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        DISTROLESS                                    | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        DISTROLESS                                    | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        DISTROLESS                                    | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        DISTROLESS                                    | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        DISTROLESS                                    | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        DISTROLESS                                    | SAME_DIGEST_NO_SIGNATURE                        | true
+        DISTROLESS                                    | SAME_DIGEST_WITH_SIGNATURE                      | true
+        DISTROLESS                                    | TEKTON_DEPLOYMENT                               | true
+        DISTROLESS                                    | UNVERIFIABLE_DEPLOYMENT                         | true
+        DISTROLESS                                    | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Distroless and tekton should create alerts for all deployments except those using distroless / tekton images.
+        DISTROLESS_AND_TEKTON                         | BYOPKI_DEPLOYMENT                               | true
+        DISTROLESS_AND_TEKTON                         | DISTROLESS_DEPLOYMENT                           | false
+        DISTROLESS_AND_TEKTON                         | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        DISTROLESS_AND_TEKTON                         | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        DISTROLESS_AND_TEKTON                         | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        DISTROLESS_AND_TEKTON                         | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        DISTROLESS_AND_TEKTON                         | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        DISTROLESS_AND_TEKTON                         | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        DISTROLESS_AND_TEKTON                         | SAME_DIGEST_NO_SIGNATURE                        | true
+        DISTROLESS_AND_TEKTON                         | SAME_DIGEST_WITH_SIGNATURE                      | true
+        DISTROLESS_AND_TEKTON                         | TEKTON_DEPLOYMENT                               | false
+        DISTROLESS_AND_TEKTON                         | UNVERIFIABLE_DEPLOYMENT                         | true
+        DISTROLESS_AND_TEKTON                         | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Keyless RHTAS matching should create alerts for all deployments except those running a keyless RHTAS signed image.
+        KEYLESS_RHTAS_MATCHING                        | BYOPKI_DEPLOYMENT                               | true
+        KEYLESS_RHTAS_MATCHING                        | DISTROLESS_DEPLOYMENT                           | true
+        KEYLESS_RHTAS_MATCHING                        | KEYLESS_RHTAS_DEPLOYMENT                        | false
+        KEYLESS_RHTAS_MATCHING                        | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        KEYLESS_RHTAS_MATCHING                        | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        KEYLESS_RHTAS_MATCHING                        | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | false
+        KEYLESS_RHTAS_MATCHING                        | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        KEYLESS_RHTAS_MATCHING                        | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        KEYLESS_RHTAS_MATCHING                        | SAME_DIGEST_NO_SIGNATURE                        | true
+        KEYLESS_RHTAS_MATCHING                        | SAME_DIGEST_WITH_SIGNATURE                      | true
+        KEYLESS_RHTAS_MATCHING                        | TEKTON_DEPLOYMENT                               | true
+        KEYLESS_RHTAS_MATCHING                        | UNVERIFIABLE_DEPLOYMENT                         | true
+        KEYLESS_RHTAS_MATCHING                        | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
         // Keyless RHTAS unverifiable should create alerts for all deployments.
-        KEYLESS_RHTAS_UNVERIFIABLE                 | BYOPKI_DEPLOYMENT            | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | DISTROLESS_DEPLOYMENT        | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | KEYLESS_RHTAS_DEPLOYMENT     | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | KEYLESS_SIGSTORE_DEPLOYMENT  | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | SAME_DIGEST_NO_SIGNATURE     | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | SAME_DIGEST_WITH_SIGNATURE   | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | TEKTON_DEPLOYMENT            | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | UNVERIFIABLE_DEPLOYMENT      | true
-        KEYLESS_RHTAS_UNVERIFIABLE                 | WITHOUT_SIGNATURE_DEPLOYMENT | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | BYOPKI_DEPLOYMENT                               | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | DISTROLESS_DEPLOYMENT                           | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | SAME_DIGEST_NO_SIGNATURE                        | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | SAME_DIGEST_WITH_SIGNATURE                      | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | TEKTON_DEPLOYMENT                               | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | UNVERIFIABLE_DEPLOYMENT                         | true
+        KEYLESS_RHTAS_UNVERIFIABLE                    | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Keyless Sigstore matching should create alerts for all deployments except those running a keyless Sigstore signed image.
+        KEYLESS_SIGSTORE_MATCHING                     | BYOPKI_DEPLOYMENT                               | true
+        KEYLESS_SIGSTORE_MATCHING                     | DISTROLESS_DEPLOYMENT                           | true
+        KEYLESS_SIGSTORE_MATCHING                     | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        KEYLESS_SIGSTORE_MATCHING                     | KEYLESS_SIGSTORE_DEPLOYMENT                     | false
+        KEYLESS_SIGSTORE_MATCHING                     | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        KEYLESS_SIGSTORE_MATCHING                     | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        KEYLESS_SIGSTORE_MATCHING                     | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | false
+        KEYLESS_SIGSTORE_MATCHING                     | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        KEYLESS_SIGSTORE_MATCHING                     | SAME_DIGEST_NO_SIGNATURE                        | true
+        KEYLESS_SIGSTORE_MATCHING                     | SAME_DIGEST_WITH_SIGNATURE                      | true
+        KEYLESS_SIGSTORE_MATCHING                     | TEKTON_DEPLOYMENT                               | true
+        KEYLESS_SIGSTORE_MATCHING                     | UNVERIFIABLE_DEPLOYMENT                         | true
+        KEYLESS_SIGSTORE_MATCHING                     | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Keyless Sigstore unverifiable should create alerts for all deployments.
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | BYOPKI_DEPLOYMENT                               | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | DISTROLESS_DEPLOYMENT                           | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | SAME_DIGEST_NO_SIGNATURE                        | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | SAME_DIGEST_WITH_SIGNATURE                      | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | TEKTON_DEPLOYMENT                               | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | UNVERIFIABLE_DEPLOYMENT                         | true
+        KEYLESS_SIGSTORE_UNVERIFIABLE                 | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Policy with all three integrations should create alerts for all deployments except those using distroless / tekton images.
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | BYOPKI_DEPLOYMENT                               | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | DISTROLESS_DEPLOYMENT                           | false
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | SAME_DIGEST_NO_SIGNATURE                        | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | SAME_DIGEST_WITH_SIGNATURE                      | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | TEKTON_DEPLOYMENT                               | false
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | UNVERIFIABLE_DEPLOYMENT                         | true
+        POLICY_WITH_DISTROLESS_TEKTON_UNVERIFIABLE    | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Referrer BYOPKI matching: only the referrer BYOPKI deployment passes.
+        REFERRER_BYOPKI_MATCHING                      | BYOPKI_DEPLOYMENT                               | true
+        REFERRER_BYOPKI_MATCHING                      | DISTROLESS_DEPLOYMENT                           | true
+        REFERRER_BYOPKI_MATCHING                      | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        REFERRER_BYOPKI_MATCHING                      | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        REFERRER_BYOPKI_MATCHING                      | REFERRER_BYOPKI_DEPLOYMENT                      | false
+        REFERRER_BYOPKI_MATCHING                      | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        REFERRER_BYOPKI_MATCHING                      | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        REFERRER_BYOPKI_MATCHING                      | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        REFERRER_BYOPKI_MATCHING                      | SAME_DIGEST_NO_SIGNATURE                        | true
+        REFERRER_BYOPKI_MATCHING                      | SAME_DIGEST_WITH_SIGNATURE                      | true
+        REFERRER_BYOPKI_MATCHING                      | TEKTON_DEPLOYMENT                               | true
+        REFERRER_BYOPKI_MATCHING                      | UNVERIFIABLE_DEPLOYMENT                         | true
+        REFERRER_BYOPKI_MATCHING                      | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Referrer BYOPKI unverifiable: wrong identity/issuer, all deployments alert.
+        REFERRER_BYOPKI_UNVERIFIABLE                  | BYOPKI_DEPLOYMENT                               | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | DISTROLESS_DEPLOYMENT                           | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | SAME_DIGEST_NO_SIGNATURE                        | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | SAME_DIGEST_WITH_SIGNATURE                      | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | TEKTON_DEPLOYMENT                               | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | UNVERIFIABLE_DEPLOYMENT                         | true
+        REFERRER_BYOPKI_UNVERIFIABLE                  | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Referrer with public key: only the matching deployment passes.
+        REFERRER_PUBKEY_MATCHING                      | BYOPKI_DEPLOYMENT                               | true
+        REFERRER_PUBKEY_MATCHING                      | DISTROLESS_DEPLOYMENT                           | true
+        REFERRER_PUBKEY_MATCHING                      | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        REFERRER_PUBKEY_MATCHING                      | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        REFERRER_PUBKEY_MATCHING                      | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        REFERRER_PUBKEY_MATCHING                      | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        REFERRER_PUBKEY_MATCHING                      | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        REFERRER_PUBKEY_MATCHING                      | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | false
+        REFERRER_PUBKEY_MATCHING                      | SAME_DIGEST_NO_SIGNATURE                        | true
+        REFERRER_PUBKEY_MATCHING                      | SAME_DIGEST_WITH_SIGNATURE                      | true
+        REFERRER_PUBKEY_MATCHING                      | TEKTON_DEPLOYMENT                               | true
+        REFERRER_PUBKEY_MATCHING                      | UNVERIFIABLE_DEPLOYMENT                         | true
+        REFERRER_PUBKEY_MATCHING                      | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Referrer with wrong public key: all deployments alert.
+        REFERRER_PUBKEY_UNVERIFIABLE                  | BYOPKI_DEPLOYMENT                               | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | DISTROLESS_DEPLOYMENT                           | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | SAME_DIGEST_NO_SIGNATURE                        | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | SAME_DIGEST_WITH_SIGNATURE                      | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | TEKTON_DEPLOYMENT                               | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | UNVERIFIABLE_DEPLOYMENT                         | true
+        REFERRER_PUBKEY_UNVERIFIABLE                  | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Same digest should create alerts for all deployments except those using alt-nginx image.
+        SAME_DIGEST                                   | BYOPKI_DEPLOYMENT                               | true
+        SAME_DIGEST                                   | DISTROLESS_DEPLOYMENT                           | true
+        SAME_DIGEST                                   | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        SAME_DIGEST                                   | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        SAME_DIGEST                                   | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        SAME_DIGEST                                   | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        SAME_DIGEST                                   | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        SAME_DIGEST                                   | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        SAME_DIGEST                                   | SAME_DIGEST_NO_SIGNATURE                        | true
+        SAME_DIGEST                                   | SAME_DIGEST_WITH_SIGNATURE                      | false
+        SAME_DIGEST                                   | TEKTON_DEPLOYMENT                               | true
+        SAME_DIGEST                                   | UNVERIFIABLE_DEPLOYMENT                         | true
+        SAME_DIGEST                                   | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Tekton should create alerts for all deployments except those using tekton images.
+        TEKTON                                        | BYOPKI_DEPLOYMENT                               | true
+        TEKTON                                        | DISTROLESS_DEPLOYMENT                           | true
+        TEKTON                                        | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        TEKTON                                        | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        TEKTON                                        | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        TEKTON                                        | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        TEKTON                                        | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        TEKTON                                        | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        TEKTON                                        | SAME_DIGEST_NO_SIGNATURE                        | true
+        TEKTON                                        | SAME_DIGEST_WITH_SIGNATURE                      | true
+        TEKTON                                        | TEKTON_DEPLOYMENT                               | false
+        TEKTON                                        | UNVERIFIABLE_DEPLOYMENT                         | true
+        TEKTON                                        | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
+        // Unverifiable should create alerts for all deployments.
+        UNVERIFIABLE                                  | BYOPKI_DEPLOYMENT                               | true
+        UNVERIFIABLE                                  | DISTROLESS_DEPLOYMENT                           | true
+        UNVERIFIABLE                                  | KEYLESS_RHTAS_DEPLOYMENT                        | true
+        UNVERIFIABLE                                  | KEYLESS_SIGSTORE_DEPLOYMENT                     | true
+        UNVERIFIABLE                                  | REFERRER_BYOPKI_DEPLOYMENT                      | true
+        UNVERIFIABLE                                  | REFERRER_KEYLESS_RHTAS_MATCHING_DEPLOYMENT      | true
+        UNVERIFIABLE                                  | REFERRER_KEYLESS_SIGSTORE_MATCHING_DEPLOYMENT   | true
+        UNVERIFIABLE                                  | REFERRER_PUBKEY_MATCHING_DEPLOYMENT             | true
+        UNVERIFIABLE                                  | SAME_DIGEST_NO_SIGNATURE                        | true
+        UNVERIFIABLE                                  | SAME_DIGEST_WITH_SIGNATURE                      | true
+        UNVERIFIABLE                                  | TEKTON_DEPLOYMENT                               | true
+        UNVERIFIABLE                                  | UNVERIFIABLE_DEPLOYMENT                         | true
+        UNVERIFIABLE                                  | WITHOUT_SIGNATURE_DEPLOYMENT                    | true
     }
 
     // Helper which creates a policy builder for a policy which uses the image signature policy criteria.
diff --git a/qa-tests-backend/src/test/groovy/IntegrationHealthTest.groovy b/qa-tests-backend/src/test/groovy/IntegrationHealthTest.groovy
index 119740b9b1ba5..92f1cb1793354 100644
--- a/qa-tests-backend/src/test/groovy/IntegrationHealthTest.groovy
+++ b/qa-tests-backend/src/test/groovy/IntegrationHealthTest.groovy
@@ -1,5 +1,7 @@
+import objects.StackroxScannerIntegration
 import services.IntegrationHealthService
 
+import org.junit.Assume
 import spock.lang.Tag
 import spock.lang.Unroll
 
@@ -10,6 +12,7 @@ class IntegrationHealthTest extends BaseSpecification {
     def "Verify vulnerability definitions information is available"() {
         when:
         "Vulnerability definition is requested"
+        Assume.assumeTrue("Clairify integration is present", StackroxScannerIntegration.isTestable())
         def vulnDefInfo = IntegrationHealthService.getVulnDefinitionsInfo()
 
         then:
diff --git a/qa-tests-backend/src/test/groovy/IntegrationsTest.groovy b/qa-tests-backend/src/test/groovy/IntegrationsTest.groovy
index cc612fe61dc4e..10c31990c17dc 100644
--- a/qa-tests-backend/src/test/groovy/IntegrationsTest.groovy
+++ b/qa-tests-backend/src/test/groovy/IntegrationsTest.groovy
@@ -185,12 +185,16 @@ class IntegrationsTest extends BaseSpecification {
     def "Verify Splunk Integration"() {
         given:
         "the integration is tested"
-        SplunkUtil.SplunkDeployment parts = SplunkUtil.createSplunk(orchestrator, Constants.ORCHESTRATOR_NAMESPACE)
+        SplunkUtil.SplunkDeployment parts = null
+        SplunkNotifier notifier = null
+        String policyId = null
+        Deployment nginxdeployment = null
+        parts = SplunkUtil.createSplunk(orchestrator, Constants.ORCHESTRATOR_NAMESPACE)
         SplunkUtil.waitForSplunkBoot(parts.splunkPortForward.localPort)
 
         when:
         "call the grpc API for the splunk integration."
-        SplunkNotifier notifier = new SplunkNotifier(parts.collectorSvc.name, parts.splunkPortForward.localPort)
+        notifier = new SplunkNotifier(parts.collectorSvc.name, parts.splunkPortForward.localPort)
         notifier.createNotifier()
 
         and:
@@ -205,11 +209,11 @@ class IntegrationsTest extends BaseSpecification {
                   .setKey("app")
                   .setValue(nginxName)))
               .addNotifiers(notifier.getId())
-        def policyId = PolicyService.createNewPolicy(policy.build())
+        policyId = PolicyService.createNewPolicy(policy.build())
 
         and:
         "Create a new deployment to trigger the violation against the policy"
-        Deployment nginxdeployment =
+        nginxdeployment =
                 new Deployment()
                         .setName(nginxName)
                         .setImage("quay.io/rhacs-eng/qa-multi-arch-nginx:latest")
@@ -223,16 +227,16 @@ class IntegrationsTest extends BaseSpecification {
 
         cleanup:
         "remove Deployment and services"
-        if (parts.deployment != null) {
+        if (nginxdeployment) {
             orchestrator.deleteDeployment(nginxdeployment)
         }
-        if (policy != null) {
+        if (policyId) {
             PolicyService.deletePolicy(policyId)
         }
         if (parts) {
             SplunkUtil.tearDownSplunk(orchestrator, parts)
         }
-        notifier.deleteNotifier()
+        notifier?.deleteNotifier()
     }
 
     @Unroll
diff --git a/qa-tests-backend/src/test/groovy/NetworkFlowTest.groovy b/qa-tests-backend/src/test/groovy/NetworkFlowTest.groovy
index 5b9af9972d824..d8e2a279d3358 100644
--- a/qa-tests-backend/src/test/groovy/NetworkFlowTest.groovy
+++ b/qa-tests-backend/src/test/groovy/NetworkFlowTest.groovy
@@ -956,7 +956,9 @@ class NetworkFlowTest extends BaseSpecification {
         expect:
         "actual policies should exist in generated response depending on delete mode"
         def modification = NetworkPolicyService.generateNetworkPolicies(deleteMode, 'Namespace:r/^qa2?$')
-        assert !(NetworkPolicyService.applyGeneratedNetworkPolicy(modification) instanceof StatusRuntimeException)
+        Helpers.withRetry(3, 2) {
+            assert !(NetworkPolicyService.applyGeneratedNetworkPolicy(modification) instanceof StatusRuntimeException)
+        }
         def appliedNetworkPolicies = getQANetworkPoliciesNamesByNamespace(true)
         log.info "${appliedNetworkPolicies}"
 
@@ -1009,10 +1011,12 @@ class NetworkFlowTest extends BaseSpecification {
         def undoRecord = NetworkPolicyService.undoGeneratedNetworkPolicy()
         assert undoRecord.originalModification == modification
 
-        assert !(
-                NetworkPolicyService.applyGeneratedNetworkPolicy(undoRecord.undoModification)
-                        instanceof StatusRuntimeException
-        )
+        Helpers.withRetry(3, 2) {
+            assert !(
+                    NetworkPolicyService.applyGeneratedNetworkPolicy(undoRecord.undoModification)
+                            instanceof StatusRuntimeException
+            )
+        }
         def undoNetworkPolicies = getQANetworkPoliciesNamesByNamespace(true)
         log.info "${undoNetworkPolicies}"
         assert undoNetworkPolicies == preExistingNetworkPolicies
diff --git a/qa-tests-backend/src/test/groovy/NodeIndexTest.groovy b/qa-tests-backend/src/test/groovy/NodeIndexTest.groovy
new file mode 100644
index 0000000000000..68963fb8e9be0
--- /dev/null
+++ b/qa-tests-backend/src/test/groovy/NodeIndexTest.groovy
@@ -0,0 +1,54 @@
+import static util.Helpers.waitForTrue
+import static util.Helpers.withRetry
+
+import orchestratormanager.OrchestratorTypes
+
+import io.stackrox.proto.storage.NodeOuterClass.Node
+
+import org.junit.Assume
+
+import common.Constants
+import services.BaseService
+import services.NodeService
+import util.Env
+
+import spock.lang.IgnoreIf
+import spock.lang.Requires
+import spock.lang.Tag
+
+// Central's scanner-v4-matcher is required to enrich index reports into node scans.
+@IgnoreIf({ Env.ONLY_SECURED_CLUSTER == "true" })
+// V4 node index reports are produced on OpenShift (RHCOS/RHEL RPM DBs).
+@Requires({ Env.mustGetOrchestratorType() == OrchestratorTypes.OPENSHIFT })
+@Tag("PZ")
+class NodeIndexTest extends BaseSpecification {
+    def setupSpec() {
+        BaseService.useBasicAuth()
+    }
+
+    @Tag("BAT")
+    def "Verify node index scans"() {
+        given:
+        "Scanner V4 is enabled and the cluster has nodes"
+        Assume.assumeTrue("Scanner V4 node indexing is required", scannerV4Enabled)
+
+        when:
+        "scanner-v4-matcher is ready so index reports can be enriched"
+        log.info("Waiting for scanner-v4-matcher deployment to be ready")
+        waitForTrue(20, 6) {
+            orchestrator.deploymentReady(Constants.STACKROX_NAMESPACE, "scanner-v4-matcher")
+        }
+        then:
+        "each OpenShift node scan has RPM packages, not only kubelet/kernel/runtime"
+        withRetry(12, 30) {
+            List<Node> nodes = NodeService.getNodes()
+            assert nodes.size() > 0, "Expected to find at least one node"
+            nodes.each { node ->
+                assert node.getScan(), "Expected to find a nodeScan on the node"
+                int n = node.getScan().getComponentsList().size()
+                log.info("Node ${node.getName()} scan contains ${n} components")
+                assert n > 4, "Expected to find more than 4 components on OpenShift node"
+            }
+        }
+    }
+}
diff --git a/qa-tests-backend/src/test/groovy/NodeInventoryTest.groovy b/qa-tests-backend/src/test/groovy/NodeInventoryTest.groovy
deleted file mode 100644
index d09a67040de1b..0000000000000
--- a/qa-tests-backend/src/test/groovy/NodeInventoryTest.groovy
+++ /dev/null
@@ -1,98 +0,0 @@
-import static util.Helpers.waitForTrue
-import static util.Helpers.withRetry
-
-import io.stackrox.proto.storage.NodeOuterClass.Node
-
-import common.Constants
-import services.BaseService
-import services.ClusterService
-import services.NodeService
-import util.Env
-
-import spock.lang.IgnoreIf
-import spock.lang.Shared
-import spock.lang.Tag
-
-// skip if executed in a test environment with just secured-cluster deployed in the test cluster
-// i.e. central is deployed elsewhere
-@IgnoreIf({ Env.ONLY_SECURED_CLUSTER == "true" })
-@IgnoreIf({ true })  // ROX-29634: address legacy scanner-v2 test failing with rhcos layers change
-@Tag("PZ")
-class NodeInventoryTest extends BaseSpecification {
-    @Shared
-    private String clusterId
-    def setupSpec() {
-        BaseService.useBasicAuth()
-
-        // Get cluster ID
-        assert ClusterService.getClusters().size() > 0, "There must be at least one secured cluster"
-        clusterId = ClusterService.getClusters().get(0).getId()
-        assert clusterId
-    }
-
-    @Tag("BAT")
-    def "Verify node inventories and their scans"() {
-        given:
-        "given a non-empty list of nodes on an OpenShift 4 cluster"
-        List<Node> nodes = NodeService.getNodes()
-        assert nodes.size() > 0
-
-        when:
-        boolean nodeInventoryContainerAvailable =
-            orchestrator.containsDaemonSetContainer(Constants.STACKROX_NAMESPACE, "collector", "node-inventory")
-        if (nodeInventoryContainerAvailable) {
-            // Sometimes one pod in daemon set will miss the env variable despite updating.
-            // Let's try this operation twice before giving up
-            waitForTrue(2, 20) {
-                log.info("Setting collector.node-inventory ROX_NODE_SCANNING_MAX_INITIAL_WAIT to 1s")
-                orchestrator.updateDaemonSetEnv(Constants.STACKROX_NAMESPACE, "collector", "node-inventory",
-                    "ROX_NODE_SCANNING_MAX_INITIAL_WAIT", "1s")
-                try {
-                    log.info("Wait for collector DS to be restarted with new values")
-                    waitForTrue(20, 10) {
-                        orchestrator.daemonSetEnvVarUpdated(Constants.STACKROX_NAMESPACE, "collector",
-                            "node-inventory", "ROX_NODE_SCANNING_MAX_INITIAL_WAIT", "1s")
-                    }
-
-                    log.info("Wait for collector DS to be ready")
-                    waitForTrue(20, 10) {
-                        orchestrator.daemonSetReady(Constants.STACKROX_NAMESPACE, "collector")
-                    }
-                }
-                catch (Exception ignored) {
-                    log.info("Unable to bring collector ds to the desired state")
-                    return false
-                }
-                return true
-            }
-        }
-        log.info("Waiting for scanner deployment to be ready")
-        waitForTrue(20, 6) {
-            orchestrator.deploymentReady(Constants.STACKROX_NAMESPACE, "scanner")
-        }
-
-        then:
-        "confirm the number of components in the inventory and their scan"
-        // ensure that the nodes got scanned at least once - retry up to 6 minutes
-        withRetry(12, 30) {
-            nodes = NodeService.getNodes()
-            assert nodes.size() > 0, "Expected to find at least one node"
-            nodes.each { node ->
-                assert node.getScan().getComponentsList().size() >= 4, "Expected to find at least 4 node components"
-            }
-        }
-        nodes.each { node ->
-            assert node.getScan(), "Expected to find a nodeScan on the node"
-            log.info("Node ${node.getName()} scan contains ${node.getScan().getComponentsList().size()} components")
-
-            if (!nodeInventoryContainerAvailable) {
-                // No RHCOS node scanning on this cluster
-                assert node.getScan().getComponentsList().size() == 4,
-                    "Expected to find exactly 4 components on non-RHCOS node"
-                return
-            }
-            assert node.getScan().getComponentsList().size() > 4,
-                "Expected to find more than 4 components on RHCOS node"
-        }
-    }
-}
diff --git a/qa-tests-backend/src/test/groovy/RuntimeViolationLifecycleTest.groovy b/qa-tests-backend/src/test/groovy/RuntimeViolationLifecycleTest.groovy
index 9102aaf7bbd5f..dd0d27ce75880 100644
--- a/qa-tests-backend/src/test/groovy/RuntimeViolationLifecycleTest.groovy
+++ b/qa-tests-backend/src/test/groovy/RuntimeViolationLifecycleTest.groovy
@@ -51,6 +51,21 @@ class RuntimeViolationLifecycleTest extends BaseSpecification  {
         return disappearedFromStackRox
     }
 
+    // waitForAlertsInactive polls because Central deletes the deployment before
+    // the alerts pipeline stamps Inactive on remaining runtime alerts.
+    def waitForAlertsInactive(violations) {
+        Timer t = new Timer(60, 1)
+        while (t.IsValid()) {
+            if (violations.every { violation ->
+                def alert = AlertService.getViolation(violation.getId())
+                alert.getDeployment()?.getInactive()
+            }) {
+                return true
+            }
+        }
+        return false
+    }
+
     def assertAlertExistsForDeploymentUidAndGetViolations(String policyName, String deploymentUid) {
         checkPolicyExists(APTGETPOLICY)
         def violations = Services.getViolationsByDeploymentID(deploymentUid, policyName, false, 66)
@@ -215,10 +230,7 @@ class RuntimeViolationLifecycleTest extends BaseSpecification  {
         def newViolations =
                 assertAlertExistsForDeploymentUidAndGetViolations(APTGETPOLICY, DEPLOYMENT.getDeploymentUid())
         assert (newViolations*.id).toSet().containsAll(violations*.id)
-        for (def violation: newViolations) {
-            def alert = AlertService.getViolation(violation.getId())
-            assert alert.getDeployment() != null && alert.getDeployment().getInactive()
-        }
+        assert waitForAlertsInactive(newViolations)
 
         cleanup:
         if (!deploymentDeleted) {
diff --git a/qa-tests-backend/src/test/groovy/SACTest.groovy b/qa-tests-backend/src/test/groovy/SACTest.groovy
index dd6a10fa6d83a..c9bd307501e2f 100644
--- a/qa-tests-backend/src/test/groovy/SACTest.groovy
+++ b/qa-tests-backend/src/test/groovy/SACTest.groovy
@@ -404,7 +404,7 @@ class SACTest extends BaseSpecification {
         tokenName                | category     | numResults
         NOACCESSTOKEN            | "Cluster"    | 0
         "searchDeploymentsToken" | "Deployment" | 1
-        "searchImagesToken"      | "Image"      | (flattenImageDataEnabled ? 2 : 1)
+        "searchImagesToken"      | "Image"      | 1
     }
 
     @Unroll
diff --git a/qa-tests-backend/src/test/groovy/testdata/referrer-test-images.md b/qa-tests-backend/src/test/groovy/testdata/referrer-test-images.md
new file mode 100644
index 0000000000000..e10cc3de6b2ca
--- /dev/null
+++ b/qa-tests-backend/src/test/groovy/testdata/referrer-test-images.md
@@ -0,0 +1,161 @@
+# Referrer-based Signature Test Images
+
+Instructions for creating test images with OCI 1.1 referrer-based sigstore
+bundle signatures for `ImageSignatureVerificationTest`.
+
+## Prerequisites
+
+```bash
+cosign version  # requires v3+ for --new-bundle-format
+crane version   # for copying base images
+```
+
+## Generate a key pair
+
+```bash
+cosign generate-key-pair
+# Produces cosign.key (private) and cosign.pub (public).
+# Store both in Bitwarden alongside existing signature test credentials.
+```
+
+## 1. referrer-sigstore-bundle-pubkey
+
+Sigstore bundle format, public key, attached as OCI referrer.
+
+```bash
+crane cp docker.io/library/alpine:latest \
+  quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-pubkey
+
+DIGEST=$(crane digest quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-pubkey)
+
+cosign sign \
+  --key cosign.key \
+  --new-bundle-format \
+  "quay.io/rhacs-eng/qa-signatures@$DIGEST"
+```
+
+## 2. referrer-sigstore-bundle-keyless
+
+Sigstore bundle format, keyless (public Sigstore), attached as OCI referrer.
+Sign with an `@redhat.com` GitHub identity to match the test's OIDC config.
+
+```bash
+crane cp docker.io/library/alpine:latest \
+  quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-keyless
+
+DIGEST=$(crane digest quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-keyless)
+
+cosign sign \
+  --new-bundle-format \
+  "quay.io/rhacs-eng/qa-signatures@$DIGEST"
+```
+
+## 3. referrer-keyless-rhtas
+
+Sigstore bundle format, keyless via the private RHTAS instance on the testing
+services cluster, attached as OCI referrer. Sign with an `@redhat.com` Google
+identity to match the test's OIDC config.
+
+Cosign's default OIDC flow uses a Sigstore-hosted OAuth client that only
+supports GitHub and Microsoft identities. To sign with a Google (`@redhat.com`)
+identity, create a GCP OAuth 2.0 client (type "Desktop app") and pass its
+credentials to cosign. The RHTAS TUF URL is derived from the cluster's route
+(see `KEYLESS_RHTAS_REKOR_URL` in the test file for the cluster base URL).
+
+```bash
+# Point cosign at the private RHTAS TUF root to use its Fulcio and Rekor.
+TUF_URL=<RHTAS_TUF_URL>
+cosign initialize --mirror=$TUF_URL --root=$TUF_URL/root.json
+
+crane cp docker.io/library/alpine:latest \
+  quay.io/rhacs-eng/qa-signatures:referrer-keyless-rhtas
+
+DIGEST=$(crane digest quay.io/rhacs-eng/qa-signatures:referrer-keyless-rhtas)
+
+cosign sign --yes \
+  --oidc-client-id="<GCP_OAUTH_CLIENT_ID>" \
+  --oidc-client-secret-file=$HOME/oidc-client-secret \
+  "quay.io/rhacs-eng/qa-signatures@$DIGEST"
+```
+
+## 4. referrer-byopki
+
+Sigstore bundle format, BYOPKI (bring-your-own-PKI) certificate chain, attached
+as OCI referrer. The signing certificate must carry OIDC extensions for issuer
+(`https://testing.org`) and identity (`team-a@testing.org`).
+
+### Generate the CA hierarchy
+
+```bash
+# Root CA.
+openssl req -x509 -newkey rsa:4096 -keyout root-ca.key -out root-ca.pem \
+  -days 10000 -nodes -subj "/C=US/L=Testing/O=DEV/OU=Testing/CN=Testing CA"
+
+# Intermediate CA.
+openssl req -newkey rsa:4096 -keyout intermediate-ca.key -out intermediate-ca.csr \
+  -nodes -subj "/C=US/L=Testing/O=DEV/OU=Testing/CN=Testing Intermediate CA"
+openssl x509 -req -in intermediate-ca.csr -CA root-ca.pem -CAkey root-ca.key \
+  -CAcreateserial -out intermediate-ca.pem -days 10000 \
+  -extfile <(printf "basicConstraints=critical,CA:TRUE,pathlen:2\nkeyUsage=critical,keyCertSign")
+
+# Leaf signing key and certificate with OIDC extensions.
+openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+  -keyout leaf.key -out leaf.csr -nodes \
+  -subj "/C=US/L=Testing/O=DEV/OU=Testing/CN=team-a@testing.org"
+openssl x509 -req -in leaf.csr -CA intermediate-ca.pem -CAkey intermediate-ca.key \
+  -CAcreateserial -out leaf.pem -days 10000 \
+  -extfile <(printf "1.3.6.1.4.1.57264.1.1=ASN1:UTF8String:https://testing.org\n1.3.6.1.4.1.57264.1.7=ASN1:UTF8String:team-a@testing.org")
+
+# CA bundle (intermediate + root, order matters).
+cat intermediate-ca.pem root-ca.pem > ca-bundle.pem
+```
+
+### Sign the image
+
+```bash
+crane cp docker.io/library/alpine:latest \
+  quay.io/rhacs-eng/qa-signatures:referrer-byopki
+
+DIGEST=$(crane digest quay.io/rhacs-eng/qa-signatures:referrer-byopki)
+
+cosign sign \
+  --key leaf.key \
+  --certificate leaf.pem \
+  --certificate-chain ca-bundle.pem \
+  --new-bundle-format \
+  "quay.io/rhacs-eng/qa-signatures@$DIGEST"
+```
+
+## After signing
+
+Update `ImageSignatureVerificationTest.groovy` with:
+- `REFERRER_COSIGN_PUBLIC_KEY`: contents of `cosign.pub`
+- `REFERRER_PUBKEY_MATCHING_IMAGE_DIGEST`: digest from step 1
+- `REFERRER_KEYLESS_SIGSTORE_MATCHING_IMAGE_DIGEST`: digest from step 2
+- `REFERRER_KEYLESS_RHTAS_MATCHING_IMAGE_DIGEST`: digest from step 3
+- `REFERRER_BYOPKI_IMAGE_DIGEST`: digest from step 4
+- `REFERRER_BYOPKI_CA_BUNDLE`: contents of `ca-bundle.pem`
+
+## Verification
+
+```bash
+cosign verify --key cosign.pub --new-bundle-format \
+  quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-pubkey
+
+cosign verify --new-bundle-format \
+  --certificate-identity-regexp=".*@redhat.com" \
+  --certificate-oidc-issuer="https://github.com/login/oauth" \
+  quay.io/rhacs-eng/qa-signatures:referrer-sigstore-bundle-keyless
+
+# Requires prior: cosign initialize --mirror=$TUF_URL --root=$TUF_URL/root.json
+cosign verify --new-bundle-format \
+  --certificate-identity-regexp=".*@redhat.com" \
+  --certificate-oidc-issuer="https://accounts.google.com" \
+  quay.io/rhacs-eng/qa-signatures:referrer-keyless-rhtas
+
+cosign verify --new-bundle-format \
+  --certificate-identity="team-a@testing.org" \
+  --certificate-oidc-issuer="https://testing.org" \
+  --cert-chain=ca-bundle.pem \
+  quay.io/rhacs-eng/qa-signatures:referrer-byopki
+```
diff --git a/roxctl/central/export/deployments/deployments_test.go b/roxctl/central/export/deployments/deployments_test.go
index 45f79a2264e54..276f48a0f1ec4 100644
--- a/roxctl/central/export/deployments/deployments_test.go
+++ b/roxctl/central/export/deployments/deployments_test.go
@@ -93,6 +93,10 @@ func (s *fakeDeploymentService) GetLabels(_ context.Context, _ *v1.Empty) (*v1.D
 	return nil, errox.NotImplemented
 }
 
+func (s *fakeDeploymentService) GetDeploymentRiskAISummary(_ context.Context, _ *v1.ResourceByID) (*v1.DeploymentRiskAISummaryResponse, error) {
+	return nil, errox.NotImplemented
+}
+
 // getDeploymentForSerializationTest returns a Mock Deployment for serialization testing purpose.
 func getDeploymentForSerializationTest() *storage.Deployment {
 	deployment := fixtures.LightweightDeployment()
diff --git a/roxctl/central/export/images/images_test.go b/roxctl/central/export/images/images_test.go
index 479f5f19555d7..57617dff568e8 100644
--- a/roxctl/central/export/images/images_test.go
+++ b/roxctl/central/export/images/images_test.go
@@ -88,6 +88,10 @@ func (s *fakeImageService) ScanImageInternal(_ context.Context, _ *v1.ScanImageI
 	return nil, errox.NotImplemented
 }
 
+func (s *fakeImageService) ScanImageInternalForAdmission(_ context.Context, _ *v1.ScanImageInternalRequest) (*v1.ScanImageInternalResponse, error) {
+	return nil, errox.NotImplemented
+}
+
 func (s *fakeImageService) ScanImage(_ context.Context, _ *v1.ScanImageRequest) (*storage.Image, error) {
 	return nil, errox.NotImplemented
 }
diff --git a/roxctl/central/generate/interactive.go b/roxctl/central/generate/interactive.go
index ab71755c2d954..e5df581fb6f4a 100644
--- a/roxctl/central/generate/interactive.go
+++ b/roxctl/central/generate/interactive.go
@@ -26,7 +26,7 @@ const (
 )
 
 var (
-	orderedFlagGroupNames = []string{"central", "central-db", "scanner", "scanner-v4"}
+	orderedFlagGroupNames = []string{"central", "central-db", "scanner-v4"}
 )
 
 func readUserInput(prompt string) (string, error) {
@@ -318,8 +318,6 @@ func processFlagWraps(argSlice *argSlice, fws []flagWrap) {
 
 		// set default values for image-{main,scanner,scanner-db,scanner-v4,scanner-v4-db} flags
 		if fw.Flag.Name == flags.FlagNameMainImage ||
-			fw.Flag.Name == flags.FlagNameScannerImage ||
-			fw.Flag.Name == flags.FlagNameScannerDBImage ||
 			fw.Flag.Name == flags.FlagNameScannerV4Image ||
 			fw.Flag.Name == flags.FlagNameScannerV4DBImage ||
 			fw.Flag.Name == flags.FlagNameCentralDBImage {
@@ -336,14 +334,6 @@ func processFlagWraps(argSlice *argSlice, fws []flagWrap) {
 				if fw.Flag.DefValue == "" {
 					fw.Flag.DefValue = flavor.MainImage()
 				}
-			case flags.FlagNameScannerImage:
-				if fw.Flag.DefValue == "" {
-					fw.Flag.DefValue = flavor.ScannerImage()
-				}
-			case flags.FlagNameScannerDBImage:
-				if fw.Flag.DefValue == "" {
-					fw.Flag.DefValue = flavor.ScannerDBImage()
-				}
 			case flags.FlagNameScannerV4Image:
 				if fw.Flag.DefValue == "" {
 					fw.Flag.DefValue = flavor.ScannerV4Image()
@@ -362,11 +352,9 @@ func processFlagWraps(argSlice *argSlice, fws []flagWrap) {
 		depUnmet := false
 		for _, dep := range fw.Annotations[flags.DependenciesKey] {
 			flag := flagsByName[dep]
-			//nolint:staticcheck // SA5011 flag is definitely not nil because utils.Must panics.
 			if flag == nil {
 				utils.CrashOnError(errors.Errorf("invalid flag dependency %q", dep))
 			}
-			//nolint:staticcheck // SA5011 flag is definitely not nil because utils.Must panics.
 			if !argSlice.flagNameIsSetExplicitly(flag.Name) {
 				depUnmet = true
 				break
diff --git a/roxctl/central/generate/k8s.go b/roxctl/central/generate/k8s.go
index 5162f708ced31..9b0a27b7827ee 100644
--- a/roxctl/central/generate/k8s.go
+++ b/roxctl/central/generate/k8s.go
@@ -112,8 +112,6 @@ func k8sBasedOrchestrator(cliEnvironment environment.Environment, k8sConfig *ren
 	flagWrap.StringVarP(&k8sConfig.MainImage, flags.FlagNameMainImage, "i", "", "The main image to use"+defaultImageHelp, "central")
 	flagWrap.BoolVar(&k8sConfig.OfflineMode, "offline", false, "Whether to run StackRox in offline mode, which avoids reaching out to the Internet.", "central")
 	flagWrap.StringVar(&k8sConfig.CentralDBImage, flags.FlagNameCentralDBImage, "", "The central-db image to use"+defaultImageHelp, "central")
-	flagWrap.StringVar(&k8sConfig.ScannerImage, flags.FlagNameScannerImage, "", "The scanner image to use"+defaultImageHelp, "scanner")
-	flagWrap.StringVar(&k8sConfig.ScannerDBImage, flags.FlagNameScannerDBImage, "", "The scanner-db image to use"+defaultImageHelp, "scanner")
 	flagWrap.StringVar(&k8sConfig.ScannerV4Image, flags.FlagNameScannerV4Image, "", "The scanner-v4 image to use"+defaultImageHelp, "scanner-v4")
 	flagWrap.StringVar(&k8sConfig.ScannerV4DBImage, flags.FlagNameScannerV4DBImage, "", "The scanner-v4-db image to use"+defaultImageHelp, "scanner-v4")
 	flagWrap.BoolVar(&k8sConfig.Telemetry.Enabled, "enable-telemetry", version.IsReleaseVersion(), "Whether to enable telemetry.", "central")
diff --git a/roxctl/common/client.go b/roxctl/common/client.go
index d1f8cb4ef4dcb..3cc94fb51002a 100644
--- a/roxctl/common/client.go
+++ b/roxctl/common/client.go
@@ -2,6 +2,7 @@ package common
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"io"
 	"net/http"
@@ -59,16 +60,16 @@ func getURL(path string) (string, error) {
 	return fmt.Sprintf("%s://%s/%s", scheme, endpoint, strings.TrimLeft(path, "/")), nil
 }
 
-// GetRoxctlHTTPClient returns a new instance of RoxctlHTTPClient with the given configuration
-func GetRoxctlHTTPClient(config *HttpClientConfig) (RoxctlHTTPClient, error) {
-	tlsConf, err := tlsConfigForCentral()
-	if err != nil {
-		return nil, errors.Wrap(err, "instantiating TLS configuration for central")
-	}
+// newHTTPTransport builds the HTTP transport used by roxctl to talk to Central.
+// Proxy is set to http.ProxyFromEnvironment so that HTTP(S)_PROXY/NO_PROXY are honored;
+// a hand-built http.Transport otherwise defaults to no proxy (unlike http.DefaultTransport),
+// which made roxctl dial Central directly and time out behind egress proxies (ROX-37149).
+func newHTTPTransport(tlsConf *tls.Config, forceHTTP1 bool) *http.Transport {
 	transport := &http.Transport{
+		Proxy:           http.ProxyFromEnvironment,
 		TLSClientConfig: tlsConf,
 	}
-	if config.ForceHTTP1 {
+	if forceHTTP1 {
 		transport.TLSClientConfig.NextProtos = http1NextProtos
 	} else {
 		// There's no reason to not use HTTP/2, but we don't go out of our way to do so.
@@ -76,6 +77,16 @@ func GetRoxctlHTTPClient(config *HttpClientConfig) (RoxctlHTTPClient, error) {
 			transport.TLSClientConfig.NextProtos = http1NextProtos
 		}
 	}
+	return transport
+}
+
+// GetRoxctlHTTPClient returns a new instance of RoxctlHTTPClient with the given configuration
+func GetRoxctlHTTPClient(config *HttpClientConfig) (RoxctlHTTPClient, error) {
+	tlsConf, err := tlsConfigForCentral()
+	if err != nil {
+		return nil, errors.Wrap(err, "instantiating TLS configuration for central")
+	}
+	transport := newHTTPTransport(tlsConf, config.ForceHTTP1)
 
 	retryClient := retryablehttp.NewClient()
 	retryClient.CheckRetry = func(ctx context.Context, resp *http.Response, err error) (bool, error) {
diff --git a/roxctl/common/client_test.go b/roxctl/common/client_test.go
index 9804d62c26050..be569f3b6e40a 100644
--- a/roxctl/common/client_test.go
+++ b/roxctl/common/client_test.go
@@ -1,13 +1,16 @@
 package common
 
 import (
+	"crypto/tls"
 	"net/http"
+	"reflect"
 	"testing"
 
 	"github.com/stackrox/rox/pkg/clientconn"
 	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/telemetry/phonehome"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestSanitizeHeaderValue(t *testing.T) {
@@ -22,6 +25,25 @@ func TestSanitizeHeaderValue(t *testing.T) {
 	}
 }
 
+func Test_newHTTPTransport_honorsProxyEnv(t *testing.T) {
+	// Regression test for ROX-37149: roxctl ignored HTTP(S)_PROXY because the
+	// hand-built transport left Proxy unset. Verify the transport delegates to
+	// http.ProxyFromEnvironment for both HTTP/2 and forced HTTP/1 modes.
+	for name, forceHTTP1 := range map[string]bool{
+		"http2":      false,
+		"forceHTTP1": true,
+	} {
+		t.Run(name, func(t *testing.T) {
+			transport := newHTTPTransport(&tls.Config{}, forceHTTP1)
+			require.NotNil(t, transport.Proxy, "transport must resolve the proxy from the environment")
+			assert.Equal(t,
+				reflect.ValueOf(http.ProxyFromEnvironment).Pointer(),
+				reflect.ValueOf(transport.Proxy).Pointer(),
+				"transport.Proxy must be http.ProxyFromEnvironment")
+		})
+	}
+}
+
 func Test_setCustomHeaders(t *testing.T) {
 	headers := http.Header{}
 	setCustomHeaders(phonehome.Headers(headers).Set)
diff --git a/roxctl/common/connection.go b/roxctl/common/connection.go
index 19246279db05e..a60d8a17b16e7 100644
--- a/roxctl/common/connection.go
+++ b/roxctl/common/connection.go
@@ -3,6 +3,7 @@ package common
 import (
 	"context"
 	"crypto/tls"
+	"io"
 	"net"
 	"strings"
 	"time"
@@ -16,6 +17,7 @@ import (
 	"github.com/stackrox/rox/pkg/roxctl/common"
 	"github.com/stackrox/rox/roxctl/common/auth"
 	"github.com/stackrox/rox/roxctl/common/flags"
+	"github.com/stackrox/rox/roxctl/common/versioncheck"
 	http1DowngradeClient "golang.stackrox.io/grpc-http1/client"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -33,6 +35,15 @@ func WithRetryTimeout(timeout time.Duration) GRPCOption {
 	}
 }
 
+// WithVersionCheck enables version compatibility checking on gRPC responses.
+// Warnings are written to w at most once when a version incompatibility is
+// detected from the Central version response header.
+func WithVersionCheck(w io.Writer) GRPCOption {
+	return func(config *grpcConfig) {
+		config.versionCheckWriter = w
+	}
+}
+
 // GetGRPCConnection gets a grpc connection to Central with the correct auth
 func GetGRPCConnection(am auth.Method, connectionOpts ...GRPCOption) (*grpc.ClientConn, error) {
 	endpoint, serverName, usePlaintext, err := ConnectNames()
@@ -67,14 +78,15 @@ func GetGRPCConnection(am auth.Method, connectionOpts ...GRPCOption) (*grpc.Clie
 }
 
 type grpcConfig struct {
-	usePlaintext  bool
-	insecure      bool
-	opts          clientconn.Options
-	serverName    string
-	useDirectGRPC bool
-	forceHTTP1    bool
-	endpoint      string
-	retryTimeout  time.Duration
+	usePlaintext       bool
+	insecure           bool
+	opts               clientconn.Options
+	serverName         string
+	useDirectGRPC      bool
+	forceHTTP1         bool
+	endpoint           string
+	retryTimeout       time.Duration
+	versionCheckWriter io.Writer
 }
 
 func makeCtxWithCommandHeader(ctx context.Context) context.Context {
@@ -122,13 +134,19 @@ func createGRPCConn(c grpcConfig) (*grpc.ClientConn, error) {
 		grpc_retry.WithRetriable(shouldRetry),
 	}
 
+	unaryInterceptors := []grpc.UnaryClientInterceptor{
+		addCommandHeaderUnaryInterceptor,
+		grpc_retry.UnaryClientInterceptor(retryOpts...),
+	}
+	if c.versionCheckWriter != nil {
+		unaryInterceptors = append(unaryInterceptors, versioncheck.CentralVersionClientInterceptor(c.versionCheckWriter))
+	}
+
 	grpcDialOpts := []grpc.DialOption{
 		grpc.WithChainStreamInterceptor(
 			addCommandHeaderStreamInterceptor,
 			grpc_retry.StreamClientInterceptor(retryOpts...)),
-		grpc.WithChainUnaryInterceptor(
-			addCommandHeaderUnaryInterceptor,
-			grpc_retry.UnaryClientInterceptor(retryOpts...)),
+		grpc.WithChainUnaryInterceptor(unaryInterceptors...),
 	}
 
 	if c.usePlaintext {
diff --git a/roxctl/common/environment/environment-impl.go b/roxctl/common/environment/environment-impl.go
index 1833f212aa496..63627eedffd89 100644
--- a/roxctl/common/environment/environment-impl.go
+++ b/roxctl/common/environment/environment-impl.go
@@ -94,6 +94,7 @@ func (c *cliEnvironmentImpl) GRPCConnection(connectionOpts ...common.GRPCOption)
 	if err != nil {
 		return nil, errors.Wrap(err, "determining auth method")
 	}
+	connectionOpts = append(connectionOpts, common.WithVersionCheck(c.io.ErrOut()))
 	connection, err := common.GetGRPCConnection(am, connectionOpts...)
 	return connection, errors.WithStack(err)
 }
diff --git a/roxctl/common/flags/imageFlavor.go b/roxctl/common/flags/imageFlavor.go
index f9ba2f7478912..020ef6df7b340 100644
--- a/roxctl/common/flags/imageFlavor.go
+++ b/roxctl/common/flags/imageFlavor.go
@@ -16,10 +16,6 @@ const (
 	FlagNameMainImage = "main-image"
 	// FlagNameCentralDBImage is a shared constant for --central-db-image command line flag.
 	FlagNameCentralDBImage = "central-db-image"
-	// FlagNameScannerImage is a shared constant for --scanner-image command line flag.
-	FlagNameScannerImage = "scanner-image"
-	// FlagNameScannerDBImage is a shared constant for --scanner-db-image command line flag.
-	FlagNameScannerDBImage = "scanner-db-image"
 	// FlagNameScannerV4Image is a shared constant for --scanner-v4-image command line flag.
 	FlagNameScannerV4Image = "scanner-v4-image"
 	// FlagNameScannerV4DBImage is a shared constant for --scanner-v4-db-image command line flag.
diff --git a/roxctl/common/versioncheck/check.go b/roxctl/common/versioncheck/check.go
new file mode 100644
index 0000000000000..58f979fb799fd
--- /dev/null
+++ b/roxctl/common/versioncheck/check.go
@@ -0,0 +1,87 @@
+package versioncheck
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+	"sync/atomic"
+
+	"github.com/stackrox/rox/pkg/clientconn"
+	"github.com/stackrox/rox/pkg/version"
+	"github.com/stackrox/rox/pkg/version/productstreams"
+	"github.com/stackrox/rox/pkg/version/versioncompatibility"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+// CentralVersionClientInterceptor returns a gRPC unary client interceptor that reads
+// the Central version from response header and emits a warning if the
+// versions of Central and roxctl are incompatible. The warning is emitted at most once per
+// interceptor instance.
+func CentralVersionClientInterceptor(w io.Writer) grpc.UnaryClientInterceptor {
+	var checked atomic.Bool
+	return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+		var md metadata.MD
+		opts = append(opts, grpc.Header(&md))
+		// Response headers are populated after the RPC completes.
+		err := invoker(ctx, method, req, reply, cc, opts...)
+		if vals := md.Get(clientconn.CentralVersionHeader); len(vals) > 0 {
+			if !checked.Swap(true) {
+				checkAndWarn(vals[0], w)
+			}
+		}
+		return err
+	}
+}
+
+func checkAndWarn(centralVersion string, w io.Writer) bool {
+	remoteXY, err := productstreams.ParseXYFromVersionString(centralVersion)
+	if err != nil {
+		return false
+	}
+	roxctlVersion := version.GetMainVersion()
+	localXY, err := productstreams.ParseXYFromVersionString(roxctlVersion)
+	if err != nil {
+		return false
+	}
+	if localXY == remoteXY {
+		return false
+	}
+
+	compat, err := versioncompatibility.ClassifyVersion(remoteXY)
+	if err != nil {
+		return false
+	}
+	if compat != versioncompatibility.IncompatibleAhead && compat != versioncompatibility.IncompatibleBehind {
+		return false
+	}
+
+	versionRange, err := versioncompatibility.CompatibleVersions()
+	if err != nil {
+		return false
+	}
+	compatRange := formatVersionRange(versionRange)
+
+	var direction string
+	if compat == versioncompatibility.IncompatibleAhead {
+		direction = "too old"
+	} else {
+		direction = "too new"
+	}
+	fmt.Fprintf(w, "Warning: Your roxctl %s is %s for this Central %s. "+
+		"Correct functioning is not guaranteed. "+
+		"Use roxctl version matching the Central version or at least such that the Central version is within the roxctl compatibility range.\n",
+		roxctlVersion, direction, centralVersion)
+	fmt.Fprintf(w, "         roxctl: %s | Central: %s | Compatible Centrals: %s\n",
+		roxctlVersion, centralVersion, compatRange)
+	return true
+}
+
+func formatVersionRange(versions []productstreams.XYVersion) string {
+	strs := make([]string, len(versions))
+	for i, v := range versions {
+		strs[i] = v.String()
+	}
+	return strings.Join(strs, ", ")
+}
diff --git a/roxctl/common/versioncheck/check_test.go b/roxctl/common/versioncheck/check_test.go
new file mode 100644
index 0000000000000..4551678f69001
--- /dev/null
+++ b/roxctl/common/versioncheck/check_test.go
@@ -0,0 +1,227 @@
+package versioncheck
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"testing"
+
+	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/pkg/clientconn"
+	"github.com/stackrox/rox/pkg/grpc/authn"
+	"github.com/stackrox/rox/pkg/grpc/versionheader"
+	"github.com/stackrox/rox/pkg/version/testutils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/test/bufconn"
+)
+
+func TestCheckAndWarn(t *testing.T) {
+	cases := map[string]struct {
+		localVersion   string
+		centralVersion string
+		expectWarning  string
+	}{
+		"same version": {
+			localVersion:   "4.8.0",
+			centralVersion: "4.8.0",
+		},
+		"same XY different patch": {
+			localVersion:   "4.8.0",
+			centralVersion: "4.8.1",
+		},
+		"compatible behind within range": {
+			localVersion:   "4.8.0",
+			centralVersion: "4.6.0",
+		},
+		"compatible ahead within range": {
+			localVersion:   "4.8.0",
+			centralVersion: "4.10.0",
+		},
+		"incompatible behind": {
+			localVersion:   "4.8.0",
+			centralVersion: "4.3.0",
+			expectWarning:  "too new",
+		},
+		"incompatible ahead": {
+			localVersion:   "4.8.0",
+			centralVersion: "4.15.0",
+			expectWarning:  "too old",
+		},
+		"invalid central version": {
+			localVersion:   "4.8.0",
+			centralVersion: "invalid",
+		},
+		"invalid local version": {
+			localVersion:   "invalid",
+			centralVersion: "4.10.1",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			testutils.SetMainVersion(t, tc.localVersion)
+
+			var buf bytes.Buffer
+			result := checkAndWarn(tc.centralVersion, &buf)
+
+			assert.Equal(t, tc.expectWarning != "", result, "return value mismatch")
+			if tc.expectWarning != "" {
+				assert.Contains(t, buf.String(), tc.expectWarning)
+				assert.Contains(t, buf.String(), "Compatible Centrals:")
+			} else {
+				assert.Empty(t, buf.String())
+			}
+		})
+	}
+}
+
+func TestCentralVersionClientInterceptor(t *testing.T) {
+	cases := map[string]struct {
+		centralVersion string
+		expectWarning  string
+	}{
+		"incompatible version warns": {
+			centralVersion: "4.2.0",
+			expectWarning:  "too new",
+		},
+		"compatible version is silent": {
+			centralVersion: "4.10.6",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			testutils.SetMainVersion(t, "4.8.0")
+
+			var buf bytes.Buffer
+			conn := setupServerAndClient(t,
+				[]grpc.UnaryServerInterceptor{injectVersionHeaderInterceptor(t, tc.centralVersion)},
+				[]grpc.UnaryClientInterceptor{CentralVersionClientInterceptor(&buf)},
+			)
+
+			client := v1.NewMetadataServiceClient(conn)
+			_, err := client.GetMetadata(context.Background(), &v1.Empty{})
+			require.NoError(t, err)
+
+			if tc.expectWarning != "" {
+				assert.Contains(t, buf.String(), tc.expectWarning)
+				assert.Contains(t, buf.String(), "Compatible Centrals:")
+			} else {
+				assert.Empty(t, buf.String())
+			}
+		})
+	}
+}
+
+func TestCentralVersionClientInterceptor_WithRealServerInterceptor(t *testing.T) {
+	// When the client is authenticated, CentralVersionServerInterceptor serves the same version so no warning is raised.
+	// When the client is not authenticated, CentralVersionServerInterceptor does not return the header and no warning is raised either.
+	cases := map[string]struct {
+		authenticated bool
+	}{
+		"authenticated with matching versions is silent": {authenticated: true},
+		"anonymous is silent":                            {authenticated: false},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			testutils.SetMainVersion(t, "4.8.0")
+
+			var serverInterceptors []grpc.UnaryServerInterceptor
+			if tc.authenticated {
+				serverInterceptors = append(serverInterceptors, injectIdentityInterceptor(t))
+			}
+			serverInterceptors = append(serverInterceptors, versionheader.CentralVersionServerInterceptor())
+
+			var buf bytes.Buffer
+			conn := setupServerAndClient(t,
+				serverInterceptors,
+				[]grpc.UnaryClientInterceptor{CentralVersionClientInterceptor(&buf)},
+			)
+
+			client := v1.NewMetadataServiceClient(conn)
+			_, err := client.GetMetadata(context.Background(), &v1.Empty{})
+			require.NoError(t, err)
+
+			assert.Empty(t, buf.String())
+		})
+	}
+}
+
+func TestCentralVersionClientInterceptor_WarnsOnlyOnce(t *testing.T) {
+	testutils.SetMainVersion(t, "4.8.0")
+
+	var buf bytes.Buffer
+	conn := setupServerAndClient(t,
+		[]grpc.UnaryServerInterceptor{
+			injectIdentityInterceptor(t),
+			injectVersionHeaderInterceptor(t, "4.2.0"),
+		},
+		[]grpc.UnaryClientInterceptor{CentralVersionClientInterceptor(&buf)},
+	)
+
+	client := v1.NewMetadataServiceClient(conn)
+	_, err := client.GetMetadata(context.Background(), &v1.Empty{})
+	require.NoError(t, err)
+	assert.NotEmpty(t, buf.String())
+
+	buf.Reset()
+
+	_, err = client.GetMetadata(context.Background(), &v1.Empty{})
+	require.NoError(t, err)
+	assert.Empty(t, buf.String(), "warning should not be emitted a second time")
+}
+
+// --- helpers and mocks ---
+
+type fakeIdentity struct {
+	authn.Identity
+}
+
+type fakeMetadataServer struct {
+	v1.UnimplementedMetadataServiceServer
+}
+
+func (f *fakeMetadataServer) GetMetadata(_ context.Context, _ *v1.Empty) (*v1.Metadata, error) {
+	return &v1.Metadata{Version: "test"}, nil
+}
+
+func setupServerAndClient(t *testing.T, serverInterceptors []grpc.UnaryServerInterceptor, clientInterceptors []grpc.UnaryClientInterceptor) *grpc.ClientConn {
+	listener := bufconn.Listen(1024 * 1024)
+	server := grpc.NewServer(grpc.ChainUnaryInterceptor(serverInterceptors...))
+	v1.RegisterMetadataServiceServer(server, &fakeMetadataServer{})
+
+	go func() {
+		assert.NoError(t, server.Serve(listener))
+	}()
+	t.Cleanup(server.Stop)
+
+	conn, err := grpc.NewClient("passthrough:///bufnet",
+		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
+			return listener.DialContext(ctx)
+		}),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithChainUnaryInterceptor(clientInterceptors...),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, conn.Close()) })
+	return conn
+}
+
+func injectIdentityInterceptor(t testing.TB) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		ctx = authn.ContextWithIdentity(ctx, fakeIdentity{}, t)
+		return handler(ctx, req)
+	}
+}
+
+func injectVersionHeaderInterceptor(t testing.TB, centralVersion string) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		require.NoError(t, grpc.SetHeader(ctx, metadata.Pairs(clientconn.CentralVersionHeader, centralVersion)))
+		return handler(ctx, req)
+	}
+}
diff --git a/roxctl/maincommand/command.go b/roxctl/maincommand/command.go
index e30cc43e1fc96..44fb99c00e3e2 100644
--- a/roxctl/maincommand/command.go
+++ b/roxctl/maincommand/command.go
@@ -9,6 +9,7 @@ import (
 	"github.com/stackrox/rox/pkg/buildinfo"
 	"github.com/stackrox/rox/pkg/env"
 	"github.com/stackrox/rox/pkg/version"
+	"github.com/stackrox/rox/pkg/version/versioncompatibility"
 	"github.com/stackrox/rox/roxctl/central"
 	"github.com/stackrox/rox/roxctl/cluster"
 	"github.com/stackrox/rox/roxctl/collector"
@@ -27,6 +28,11 @@ import (
 	"github.com/stackrox/rox/roxctl/sensor"
 )
 
+type roxctlVersionInfo struct {
+	version.Versions
+	CompatibleCentralVersions []string `json:"CompatibleCentralVersions,omitempty"`
+}
+
 func versionCommand(cliEnvironment environment.Environment) *cobra.Command {
 	c := &cobra.Command{
 		Use:   "version",
@@ -36,11 +42,15 @@ func versionCommand(cliEnvironment environment.Environment) *cobra.Command {
 			if useJSON, _ := c.Flags().GetBool("json"); useJSON {
 				enc := json.NewEncoder(cliEnvironment.InputOutput().Out())
 				enc.SetIndent("", "  ")
-				versions := version.GetAllVersionsDevelopment()
+				base := version.GetAllVersionsDevelopment()
 				if buildinfo.ReleaseBuild {
-					versions = version.GetAllVersionsUnified()
+					base = version.GetAllVersionsUnified()
+				}
+				v := roxctlVersionInfo{
+					Versions:                  base,
+					CompatibleCentralVersions: compatibleVersionStrings(),
 				}
-				return errors.Wrap(enc.Encode(versions), "could not encode version")
+				return errors.Wrap(enc.Encode(v), "could not encode version")
 			}
 			cliEnvironment.Logger().PrintfLn(version.GetMainVersion())
 			return nil
@@ -51,6 +61,16 @@ func versionCommand(cliEnvironment environment.Environment) *cobra.Command {
 	return c
 }
 
+func compatibleVersionStrings() []string {
+	// Ignoring error because it's handled inside the function.
+	versions, _ := versioncompatibility.CompatibleVersions()
+	result := make([]string, 0, len(versions))
+	for _, v := range versions {
+		result = append(result, v.String())
+	}
+	return result
+}
+
 // Command constructs and returns the roxctl command tree
 func Command() *cobra.Command {
 	c := &cobra.Command{
diff --git a/roxctl/maincommand/command_test.go b/roxctl/maincommand/command_test.go
index 2de6a4002b860..743f8258a49ba 100644
--- a/roxctl/maincommand/command_test.go
+++ b/roxctl/maincommand/command_test.go
@@ -1,12 +1,17 @@
 package maincommand
 
 import (
+	"encoding/json"
 	"fmt"
 	"strings"
 	"testing"
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+	versiontestutils "github.com/stackrox/rox/pkg/version/testutils"
+	"github.com/stackrox/rox/roxctl/common/environment"
+	cliIO "github.com/stackrox/rox/roxctl/common/io"
+	"github.com/stackrox/rox/roxctl/common/printer"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v3"
@@ -141,3 +146,32 @@ func Test_commandTree(t *testing.T) {
 	assert.NotEmpty(t, commandTreeFilename, result)
 	assert.Equal(t, commandTree, result)
 }
+
+// Deploy scripts and external tooling parse "roxctl version" output expecting
+// a single line containing only the version string. Adding extra lines or
+// content breaks version-match checks and causes deployment failures.
+func TestVersionCommand_TextOutput_SingleVersionLine(t *testing.T) {
+	versiontestutils.SetMainVersion(t, "5.0.0")
+
+	testIO, _, out, _ := cliIO.TestIO()
+	env := environment.NewTestCLIEnvironment(t, testIO, printer.DefaultColorPrinter())
+	cmd := versionCommand(env)
+	require.NoError(t, cmd.Execute())
+
+	assert.Equal(t, "5.0.0\n", out.String())
+}
+
+func TestVersionCommand_JSONOutput_IncludesCompatibleVersions(t *testing.T) {
+	versiontestutils.SetMainVersion(t, "5.0.0")
+
+	testIO, _, out, _ := cliIO.TestIO()
+	env := environment.NewTestCLIEnvironment(t, testIO, printer.DefaultColorPrinter())
+	cmd := versionCommand(env)
+	cmd.SetArgs([]string{"--json"})
+	require.NoError(t, cmd.Execute())
+
+	var result roxctlVersionInfo
+	require.NoError(t, json.Unmarshal(out.Bytes(), &result))
+	assert.Equal(t, "5.0.0", result.MainVersion)
+	assert.NotEmpty(t, result.CompatibleCentralVersions)
+}
diff --git a/roxctl/maincommand/command_tree_debug.yaml b/roxctl/maincommand/command_tree_debug.yaml
index d2bf21b69860b..3b15e497cdea3 100644
--- a/roxctl/maincommand/command_tree_debug.yaml
+++ b/roxctl/maincommand/command_tree_debug.yaml
@@ -521,8 +521,6 @@ central:
         - offline
         - output-dir
         - output-format
-        - scanner-db-image
-        - scanner-image
         - scanner-v4-db-image
         - scanner-v4-image
       INHERITED_FLAGS:
@@ -583,8 +581,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -622,8 +618,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -665,8 +659,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -688,8 +680,6 @@ central:
         - openshift-version
         - output-dir
         - output-format
-        - scanner-db-image
-        - scanner-image
         - scanner-v4-db-image
         - scanner-v4-image
       INHERITED_FLAGS:
@@ -752,8 +742,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -793,8 +781,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -838,8 +824,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -2029,7 +2013,6 @@ scanner:
     LOCAL_FLAGS:
       - istio-support
       - output-dir
-      - scanner-image
       - scanner-v4-db-image
       - scanner-v4-image
     PERSISTENT_FLAGS:
diff --git a/roxctl/maincommand/command_tree_release.yaml b/roxctl/maincommand/command_tree_release.yaml
index ce063deaf2e2b..f68e511aa3d70 100644
--- a/roxctl/maincommand/command_tree_release.yaml
+++ b/roxctl/maincommand/command_tree_release.yaml
@@ -517,8 +517,6 @@ central:
         - offline
         - output-dir
         - output-format
-        - scanner-db-image
-        - scanner-image
         - scanner-v4-db-image
         - scanner-v4-image
       INHERITED_FLAGS:
@@ -575,8 +573,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -612,8 +608,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -653,8 +647,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -676,8 +668,6 @@ central:
         - openshift-version
         - output-dir
         - output-format
-        - scanner-db-image
-        - scanner-image
         - scanner-v4-db-image
         - scanner-v4-image
       INHERITED_FLAGS:
@@ -736,8 +726,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -775,8 +763,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -818,8 +804,6 @@ central:
           - password
           - plaintext
           - plaintext-endpoints
-          - scanner-db-image
-          - scanner-image
           - scanner-v4-db-image
           - scanner-v4-image
           - server-name
@@ -1990,7 +1974,6 @@ scanner:
     LOCAL_FLAGS:
       - istio-support
       - output-dir
-      - scanner-image
       - scanner-v4-db-image
       - scanner-v4-image
     PERSISTENT_FLAGS:
diff --git a/roxctl/sbom/scan/scan.go b/roxctl/sbom/scan/scan.go
index fcaf6de295f73..93e70b782c8c1 100644
--- a/roxctl/sbom/scan/scan.go
+++ b/roxctl/sbom/scan/scan.go
@@ -54,8 +54,11 @@ func Command(cliEnvironment environment.Environment) *cobra.Command {
 
 	c := &cobra.Command{
 		Use:   "scan",
-		Short: "[DEV PREVIEW] Scan the specified SBOM and return scan results",
-		Long:  "[DEV PREVIEW] Scan the specified SBOM and return scan results. You must have write permissions to the `Image` resource. Currently supports SPDX 2.3 JSON documents with content types: [`application/spdx+json`, `text/spdx+json`].",
+		Short: "(Technology Preview) Scan the specified SBOM and return scan results",
+		Long: "(Technology Preview) Scan the specified SBOM and return scan results. " +
+			"You must have write permissions to the `Image` resource. Currently supports SPDX 2.3 JSON documents with content types: " +
+			"[`application/spdx+json`, `text/spdx+json`]." +
+			common.TechPreviewLongText,
 		RunE: util.RunENoArgs(func(c *cobra.Command) error {
 			if err := sbomScanCmd.Construct(nil, c, objectPrinterFactory); err != nil {
 				return err
diff --git a/roxctl/scanner/generate/generate.go b/roxctl/scanner/generate/generate.go
index c2a7f276e6066..0b6f291de0b06 100644
--- a/roxctl/scanner/generate/generate.go
+++ b/roxctl/scanner/generate/generate.go
@@ -73,7 +73,7 @@ func Command(cliEnvironment environment.Environment) *cobra.Command {
 
 	c := &cobra.Command{
 		Use:   "generate",
-		Short: "Generate the required YAML configuration files to deploy StackRox Scanner and Scanner V4",
+		Short: "Generate the required YAML configuration files to deploy Scanner V4",
 		Args:  cobra.NoArgs,
 		RunE: func(c *cobra.Command, args []string) error {
 			scannerGenerateCmd.construct(c)
@@ -89,7 +89,6 @@ func Command(cliEnvironment environment.Environment) *cobra.Command {
 	c.PersistentFlags().Var(clustertype.Value(storage.ClusterType_KUBERNETES_CLUSTER), "cluster-type", "Type of cluster the scanner will run on (k8s, openshift).")
 
 	c.Flags().StringVar(&scannerGenerateCmd.outputDir, "output-dir", "", "Output directory for scanner bundle (leave blank for default).")
-	c.Flags().StringVar(&scannerGenerateCmd.apiParams.ScannerImage, flags.FlagNameScannerImage, "", "Scanner image to use (leave blank to use server default).")
 	c.Flags().StringVar(&scannerGenerateCmd.apiParams.ScannerV4Image, flags.FlagNameScannerV4Image, "", "Scanner V4 image to use (leave blank to use server default).")
 	c.Flags().StringVar(&scannerGenerateCmd.apiParams.ScannerV4DBImage, flags.FlagNameScannerV4DBImage, "", "Scanner V4 DB image to use (leave blank to use server default).")
 	c.Flags().StringVar(&scannerGenerateCmd.apiParams.IstioVersion, istioSupportArg, "",
diff --git a/rpms.in.yaml b/rpms.in.yaml
index 70e8fdcaa730b..ee1616dcd4c38 100644
--- a/rpms.in.yaml
+++ b/rpms.in.yaml
@@ -4,6 +4,7 @@
 packages:
 # builder stage in image/rhel/konflux.Dockerfile
 - jq
+- pigz
 # final stage in image/rhel/konflux.Dockerfile
 - findutils
 - postgresql
@@ -18,7 +19,7 @@ packages:
 - tar
 moduleEnable:
 # final stage in image/rhel/konflux.Dockerfile
-- postgresql:15
+- postgresql:16
 contentOrigin:
   repofiles: [ "rpms.rhel.repo" ]
 context:
diff --git a/rpms.lock.yaml b/rpms.lock.yaml
index 6ff8a1d04a017..3263e010852b7 100644
--- a/rpms.lock.yaml
+++ b/rpms.lock.yaml
@@ -18,13 +18,13 @@ arches:
     name: delve
     evr: 1.26.1-1.el9_8
     sourcerpm: delve-1.26.1-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9_8.1.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 216292
-    checksum: sha256:3fd73bd271e9c04dc297eb08c3829d276faee372f77666aad29f4b676ea220f4
+    size: 218086
+    checksum: sha256:d38712f7aa4e5b3821ba899d6b4f62821407f6f239e17bf240ca488fb1d35376
     name: gawk-all-langpacks
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/gcc-11.5.0-14.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
     size: 31291354
@@ -32,55 +32,55 @@ arches:
     name: gcc
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/glibc-devel-2.34-275.el9_8.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/glibc-devel-2.34-283.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 576947
-    checksum: sha256:aef79b53955c2ec67efdc39cb91148b377f8719a8b68cf76c7ddcffbcb6b8bf0
+    size: 577250
+    checksum: sha256:b363f894683abf7076596ea8d67269eb878d2724d9447e6b3f4c6409650cefd2
     name: glibc-devel
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/go-toolset-1.26.5-1.el9_8.aarch64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/go-toolset-1.26.7-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 12473
-    checksum: sha256:620f3204ee99c57a87354dfb2ba566b7c1d099915a67d80550fccdada823c2f6
+    size: 12453
+    checksum: sha256:3d9ec6b63182ed0120fad760a8fc20a4bfa05e96134b4cc5c6fe42b9f85ec9c5
     name: go-toolset
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-1.26.5-1.el9_8.aarch64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-1.26.7-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 1519189
-    checksum: sha256:82f201dbf4dc69fb60a6c3d2a0a19823f64c6194a1d4cd1ed035dc2b90fb7558
+    size: 1520141
+    checksum: sha256:27c00a1943d2e5c5e3a19308f6b8650e3740d784e8dc7e4aa0036693c958b1c4
     name: golang
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-bin-1.26.5-1.el9_8.aarch64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-bin-1.26.7-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 41545990
-    checksum: sha256:79a9efc6c72b374e0355ae27ca6c15cff222a430e25399eb48a2d5b62043c3eb
+    size: 42755650
+    checksum: sha256:4a3e09bbf75a009a9e4ef2b0f2703b517353335f9113d22f3562886390c13eb4
     name: golang-bin
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-race-1.26.5-1.el9_8.aarch64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-race-1.26.7-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 1743341
-    checksum: sha256:0e74ba670a978e63f3af9511641730f65913d4a58bf1c2d62c85fcb651912662
+    size: 1743339
+    checksum: sha256:80c03d0c817e3f37bae189287bb6b42fc18dcadeb22c90e57f01d6ecbceec4a7
     name: golang-race
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-src-1.26.5-1.el9_8.noarch.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/g/golang-src-1.26.7-2.el9_8.noarch.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 12881624
-    checksum: sha256:4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0
+    size: 12879471
+    checksum: sha256:ff54c6f194fcf25d743af1af7893242085c798b7ce04056066fee993c2167166
     name: golang-src
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/k/kernel-headers-5.14.0-687.39.1.el9_8.aarch64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/k/kernel-headers-5.14.0-687.57.1.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 2866853
-    checksum: sha256:fb3b89778b21461f4f4610fbb3068e7a62d0b250cc7f5c243acfe50015aff179
+    size: 2939977
+    checksum: sha256:31860419149438987e706dd2929fbc707552cd2e51dbc86547d294f9fed5f204
     name: kernel-headers
-    evr: 5.14.0-687.39.1.el9_8
-    sourcerpm: kernel-5.14.0-687.39.1.el9_8.src.rpm
+    evr: 5.14.0-687.57.1.el9_8
+    sourcerpm: kernel-5.14.0-687.57.1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/l/libasan-11.5.0-14.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
     size: 409047
@@ -130,41 +130,41 @@ arches:
     name: mpdecimal
     evr: 2.5.1-3.el9
     sourcerpm: mpdecimal-2.5.1-3.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/o/openssl-devel-3.5.5-6.el9_8.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/o/openssl-devel-3.5.8-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 5028889
-    checksum: sha256:c92e750163820a817ca5562935010872f8db5ca5712a517b01beafcb87221670
+    size: 5049780
+    checksum: sha256:7ae4c2948a7e30ad50c399558b1af9be4055de267eb8de1d1757e12b2776e3ef
     name: openssl-devel
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.aarch64.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 1819455
-    checksum: sha256:9a533624ca7110176ccfedbd4ec54d339fadeeb985f7016eed7e4e738dd44ed2
+    size: 2049624
+    checksum: sha256:5295a9a347f24655946ca8870d76cc7acdaa96c1e631a6880193576e92061d27
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/postgresql-private-libs-15.18-1.module+el9.8.0+24358+32c5830e.aarch64.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/postgresql-private-libs-16.15-1.module+el9.8.0+24803+9dca000b.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 149345
-    checksum: sha256:7168e8dc1147af4fe2033ddaa86418321f850c746c1a92f7aa0e5416b2b37ced
+    size: 149710
+    checksum: sha256:e4b9f9f73ee8986c64148b838c9a32492d75e4c6352810542952a8126eaa31ef
     name: postgresql-private-libs
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/python3.12-3.12.13-3.el9_8.1.aarch64.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/python3.12-3.12.15-1.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 32747
-    checksum: sha256:f1878fee909c46fadc203680309dfe2f2cb5926796569dc71ef327f13e57f732
+    size: 32621
+    checksum: sha256:9097113ea007073e718b55da7ea5d33f5ee5ce0e5f7b0b04beb706872d5968a4
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/python3.12-libs-3.12.13-3.el9_8.1.aarch64.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/python3.12-libs-3.12.15-1.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 10137763
-    checksum: sha256:95a5f3c22a8604ce4e5b4c770ec455cf7fcda812a1a0bb7de988f388adf28155
+    size: 10154341
+    checksum: sha256:f0b73d057827f2380f50f3bc9459298cc103da8b333eefc5cacd3865087b4ee1
     name: python3.12-libs
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/Packages/p/python3.12-pip-wheel-23.2.1-5.el9.noarch.rpm
     repoid: rhel-9-for-aarch64-appstream-rpms
     size: 1527128
@@ -242,20 +242,20 @@ arches:
     name: ca-certificates
     evr: 2025.2.80_v9.0.305-91.el9
     sourcerpm: ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/c/coreutils-8.32-41.el9_8.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/c/coreutils-8.32-41.el9_8.1.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 1177900
-    checksum: sha256:ee2de9f5fbc5e83bad920a353c45d3446997aa0e4023436528b2d6f817bd6f50
+    size: 1175876
+    checksum: sha256:22827aedd764c1ab706086965859e7f8fef0d719ac0b3d8735f6b8e53b0a13e9
     name: coreutils
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.aarch64.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.1.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 2114764
-    checksum: sha256:cd79ca65bba152b9ccadcb9780ec78e3d06ce538b693078fd14459d038ab5c0c
+    size: 2115646
+    checksum: sha256:b449955249a6d2da7369522a5ac2759919d36633e129ba88924057814906d5f5
     name: coreutils-common
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/c/cracklib-2.9.6-28.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 102026
@@ -291,13 +291,13 @@ arches:
     name: dbus
     evr: 1:1.12.20-8.el9
     sourcerpm: dbus-1.12.20-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/d/dbus-broker-28-7.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/d/dbus-broker-28-9.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 173303
-    checksum: sha256:342af53fbf4254e34b5f19a6be6f22c67551c26dd0c49016edc93e806621b75d
+    size: 174219
+    checksum: sha256:ffebc8de0cd9ed86122973be161b617aa46ce1e020f61f9e8e5a42246d4bd495
     name: dbus-broker
-    evr: 28-7.el9
-    sourcerpm: dbus-broker-28-7.el9.src.rpm
+    evr: 28-9.el9_8
+    sourcerpm: dbus-broker-28-9.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/d/dbus-common-1.12.20-8.el9.noarch.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 18551
@@ -340,13 +340,13 @@ arches:
     name: elfutils-libs
     evr: 0.194-1.el9
     sourcerpm: elfutils-0.194-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/e/expat-2.5.0-6.el9_8.1.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/e/expat-2.5.0-6.el9_8.5.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 120882
-    checksum: sha256:7cc4e533f63bdec0ead003d176cb262b8d4d2583dfd57b2e9cfeeed4ead13475
+    size: 122957
+    checksum: sha256:d13bd77f429835b303d388e24811fb935060be4788c8fe4cf87703640f2337e0
     name: expat
-    evr: 2.5.0-6.el9_8.1
-    sourcerpm: expat-2.5.0-6.el9_8.1.src.rpm
+    evr: 2.5.0-6.el9_8.5
+    sourcerpm: expat-2.5.0-6.el9_8.5.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/f/filesystem-3.16-5.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 5003914
@@ -361,13 +361,13 @@ arches:
     name: findutils
     evr: 1:4.8.0-7.el9
     sourcerpm: findutils-4.8.0-7.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/gawk-5.1.0-6.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/gawk-5.1.0-6.el9_8.1.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 1024204
-    checksum: sha256:a4b7202ac90653a7d3e072c2444bde6a9270d6a818eb6f2ffcfcaa50774f1fad
+    size: 1026105
+    checksum: sha256:54365d2a6150079c2dc5003eeb94ada32fc15801b5db05422361f02ed58e6772
     name: gawk
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/gdbm-libs-1.23-1.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 60311
@@ -375,34 +375,34 @@ arches:
     name: gdbm-libs
     evr: 1:1.23-1.el9
     sourcerpm: gdbm-1.23-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-2.34-275.el9_8.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-2.34-283.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 1813928
-    checksum: sha256:e40a78100f731b5f5a1b235880a0aaad5b08bb32e6521e90535b7f4a94c6e9e9
+    size: 1814330
+    checksum: sha256:76611b8d5d56730d15142d62b85e83731f5c199523b40a31da5250f81ec66d3c
     name: glibc
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-common-2.34-275.el9_8.aarch64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-common-2.34-283.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 312665
-    checksum: sha256:24e1c7189d101531c526dd3cc1a42ab62d89f874824b54fb6b518ec24f190554
+    size: 312943
+    checksum: sha256:a3cbba6c367d316bb1738bab6ac3e3e1c9423fa642faf8365b39a23a7b067768
     name: glibc-common
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-gconv-extra-2.34-275.el9_8.aarch64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-gconv-extra-2.34-283.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 1829737
-    checksum: sha256:7f2f23c07b84b3cd3bacb905dffaca4f4474298e936f3b10b93390d4127591da
+    size: 1831695
+    checksum: sha256:15321958afc2a83349b084df59bdf272ee447ea98b384fdfec57e5c589fa143c
     name: glibc-gconv-extra
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-minimal-langpack-2.34-275.el9_8.aarch64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/glibc-minimal-langpack-2.34-283.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 30881
-    checksum: sha256:b1348c4c4fe3da979f342b0c27ff0d33a11688274a0b6708292d7750bbc8d853
+    size: 31033
+    checksum: sha256:422d151f31a9fea5dd99aa7bb218c2932d64386f5daa3a8af0827183dc1beb39
     name: glibc-minimal-langpack
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/gmp-6.2.0-13.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 275679
@@ -417,13 +417,13 @@ arches:
     name: grep
     evr: 3.6-5.el9
     sourcerpm: grep-3.6-5.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/gzip-1.12-1.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/g/gzip-1.12-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 169809
-    checksum: sha256:45710df49b439ddc4a2848fd3877367761b574234ae28b6be46f1cf54f3fcdca
+    size: 171305
+    checksum: sha256:efafc848fdaa3a8e5e77baddc07abc7d800dc973efd44ecf492bc64dca4fabe6
     name: gzip
-    evr: 1.12-1.el9
-    sourcerpm: gzip-1.12-1.el9.src.rpm
+    evr: 1.12-2.el9_8
+    sourcerpm: gzip-1.12-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/j/jq-1.6-19.el9_8.2.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 191195
@@ -480,13 +480,13 @@ arches:
     name: libatomic
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libattr-2.5.1-3.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libattr-2.6.0-1.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 20696
-    checksum: sha256:b6a73c9da522df55690b886c0a9af39338571d34ee6f0d4d9b994c8289df3412
+    size: 23276
+    checksum: sha256:ec08036348dbe2ee41645bdb96eb485b9db5121ec0524258b0639426a22a49bc
     name: libattr
-    evr: 2.5.1-3.el9
-    sourcerpm: attr-2.5.1-3.el9.src.rpm
+    evr: 2.6.0-1.el9_8
+    sourcerpm: attr-2.6.0-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libblkid-2.37.4-25.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 113931
@@ -494,13 +494,13 @@ arches:
     name: libblkid
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libbrotli-1.0.9-9.el9_7.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libbrotli-1.0.9-10.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 325179
-    checksum: sha256:f5237abc90191238333c1214da97b5202c8a15c2be3ab401ee10d95343cfdf17
+    size: 325419
+    checksum: sha256:04d157b138153dcd27c04d81ae985e8190ddc542d63620f3d1ae0a690a1041b7
     name: libbrotli
-    evr: 1.0.9-9.el9_7
-    sourcerpm: brotli-1.0.9-9.el9_7.src.rpm
+    evr: 1.0.9-10.el9_8
+    sourcerpm: brotli-1.0.9-10.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libcap-2.48-10.el9_8.1.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 78021
@@ -522,13 +522,13 @@ arches:
     name: libcom_err
     evr: 1.46.5-8.el9
     sourcerpm: e2fsprogs-1.46.5-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.5.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 292322
-    checksum: sha256:ea6c3ade86939df7a985ae71e4c5100731962add54295fd40660a2f2c2f85f1d
+    size: 293076
+    checksum: sha256:a7ec72530e41371da4984e19c93168de6a911067d2bb597dec1e3bbe48e179a8
     name: libcurl
-    evr: 7.76.1-40.el9_8.5
-    sourcerpm: curl-7.76.1-40.el9_8.5.src.rpm
+    evr: 7.76.1-40.el9_8.8
+    sourcerpm: curl-7.76.1-40.el9_8.8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libdb-5.3.28-57.el9_6.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 727417
@@ -543,13 +543,13 @@ arches:
     name: libeconf
     evr: 0.4.1-7.el9_8
     sourcerpm: libeconf-0.4.1-7.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libevent-2.1.12-8.el9_4.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libevent-2.1.13-1.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 265763
-    checksum: sha256:0858687ac9d55a0db78ecc4f669ad21ccba6815744457d135f5a313898dfcab7
+    size: 268476
+    checksum: sha256:27a85302d64c15bfd383929eedcdeabef9bfc8f0a1e085b0501d0de73cb2bf74
     name: libevent
-    evr: 2.1.12-8.el9_4
-    sourcerpm: libevent-2.1.12-8.el9_4.src.rpm
+    evr: 2.1.13-1.el9_8
+    sourcerpm: libevent-2.1.13-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libfdisk-2.37.4-25.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 156711
@@ -676,20 +676,20 @@ arches:
     name: libsmartcols
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libssh-0.10.4-18.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libssh-0.10.4-19.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 222382
-    checksum: sha256:6d529b3f31dee553349277c9f72da4f14ae54a2d48d10aa3088b45fbe90f99c2
+    size: 223114
+    checksum: sha256:80f3962d3eb780ca6d6d4f8c6841b003a907d758ad8ad1c3d785e9cf327672f6
     name: libssh
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libssh-config-0.10.4-18.el9.noarch.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libssh-config-0.10.4-19.el9_8.noarch.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 14685
-    checksum: sha256:ab353cbff2269677fc7364bfcddb8e11537ea83361a0ad642e60eac87ed67fbb
+    size: 14764
+    checksum: sha256:ce06b99793b9e5abc50a58ebc3ef11037f2efbdb5f819a25f8de4994613194d4
     name: libssh-config
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/l/libstdc++-11.5.0-14.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 723913
@@ -809,13 +809,13 @@ arches:
     name: openldap
     evr: 2.6.8-4.el9
     sourcerpm: openldap-2.6.8-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/o/openssl-3.5.5-6.el9_8.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/o/openssl-3.5.8-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 1541002
-    checksum: sha256:9f10be36d0d532c65a3f9a41f7d0cd3190b0b908f60850862cc24cab06cd1101
+    size: 1546093
+    checksum: sha256:f625d004eb04013ac83037d7b6b77a100d54706de8d9a9c8a6d39d907169bbf8
     name: openssl
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 14220
@@ -830,13 +830,13 @@ arches:
     name: openssl-fips-provider-so
     evr: 3.0.7-11.el9_8
     sourcerpm: openssl-fips-provider-3.0.7-11.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/o/openssl-libs-3.5.5-6.el9_8.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/o/openssl-libs-3.5.8-2.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 2290581
-    checksum: sha256:9af799c6be853cb42999a1228a2768da20a21895b7dcac111dba3be13a397b67
+    size: 2294447
+    checksum: sha256:89aa84e734616240e7541b8095c2f2c2cd9c114e98b345042f5276d03781180b
     name: openssl-libs
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/p11-kit-0.26.4-1.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 589112
@@ -851,13 +851,13 @@ arches:
     name: p11-kit-trust
     evr: 0.26.4-1.el9_8
     sourcerpm: p11-kit-0.26.4-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pam-1.5.1-28.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pam-1.5.1-28.el9_8.1.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 635826
-    checksum: sha256:eab9afe4a8ef70912d8c59c0d8c429c0474436e756d37bcd9ee0589f9a1c9311
+    size: 642233
+    checksum: sha256:12271815e3a5d35dbc4a8e1e3b52442b0d00b833816ef3a923da427a3bca561a
     name: pam
-    evr: 1.5.1-28.el9
-    sourcerpm: pam-1.5.1-28.el9.src.rpm
+    evr: 1.5.1-28.el9_8.1
+    sourcerpm: pam-1.5.1-28.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pcre-8.44-4.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 187289
@@ -865,20 +865,27 @@ arches:
     name: pcre
     evr: 8.44-4.el9
     sourcerpm: pcre-8.44-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pcre2-10.40-6.el9.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pcre2-10.40-7.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 224938
-    checksum: sha256:29285f81cef68f73b4f8ff81ee8fdf4ceaa007933302119ed1615e4aa1091613
+    size: 227991
+    checksum: sha256:40fd0cd92f4cf824fb5186128d360bdc0a8a9f70c9f820b8c0efda4afec75cc8
     name: pcre2
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pcre2-syntax-10.40-6.el9.noarch.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pcre2-syntax-10.40-7.el9_8.noarch.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 147926
-    checksum: sha256:d386b5e9b3a4b077b2ba143882e605750855dd3354f13c55fa12ed26908cb442
+    size: 150069
+    checksum: sha256:e7466a43ef2bfda2b1dc07e855b0db743d48b11c0bdc1402e1d2ea6fb23d33a3
     name: pcre2-syntax
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pigz-2.8-1.el9.aarch64.rpm
+    repoid: rhel-9-for-aarch64-baseos-rpms
+    size: 93525
+    checksum: sha256:159d67ec9f3dd3925521b92907b450e27a3932f770a48a3702b67888519ef4e9
+    name: pigz
+    evr: 2.8-1.el9
+    sourcerpm: pigz-2.8-1.el9.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/p/pkgconf-1.7.3-10.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 45196
@@ -949,55 +956,55 @@ arches:
     name: shadow-utils
     evr: 2:4.9-16.el9
     sourcerpm: shadow-utils-4.9-16.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/sqlite-libs-3.34.1-10.el9_8.aarch64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/sqlite-libs-3.34.1-11.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 660260
-    checksum: sha256:dda4c59309d47d73d64291c53078cce330b8d5a9d95c903e133d9f37ec0e0a68
+    size: 660770
+    checksum: sha256:0fbb8043f9c02870c831da433f69b856a6674d02b60306d9cc01149ec89ed239
     name: sqlite-libs
-    evr: 3.34.1-10.el9_8
-    sourcerpm: sqlite-3.34.1-10.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-252-67.el9_8.4.aarch64.rpm
+    evr: 3.34.1-11.el9_8
+    sourcerpm: sqlite-3.34.1-11.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-252-67.el9_8.6.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 4156431
-    checksum: sha256:f49001c208ea0ec7776b2353800f133d3383e72bda8486132dc6822a803aef9f
+    size: 4135917
+    checksum: sha256:758ae3df6d76cace670ce7af7caa557a7cf8807a2160ccb30c49f7d8ec018749
     name: systemd
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-libs-252-67.el9_8.4.aarch64.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-libs-252-67.el9_8.6.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 647617
-    checksum: sha256:78f8f784050b920675ce5d37d659213226265dd72de14ec10df291afae59d8b7
+    size: 629233
+    checksum: sha256:55e58c413ee69f19a69ba25905f96343076e21abe54cdff51f0d80e48be06769
     name: systemd-libs
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-pam-252-67.el9_8.4.aarch64.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-pam-252-67.el9_8.6.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 266579
-    checksum: sha256:e85f1916e5fc35f483282c2de00cb4e1a9a40743e745c00bb66e30e383955d46
+    size: 247880
+    checksum: sha256:736a6bbb73b0ef682ddfe356bb49578c2a8f17c6685ca762fcc1636003a4f5f3
     name: systemd-pam
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.4.noarch.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.6.noarch.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 59475
-    checksum: sha256:7d671ec39a7caeb7346be6d5fcb44212545844ced6f4974c4b409fef6a12a891
+    size: 40844
+    checksum: sha256:974a0352427799559a3e90dcdb38200d767631452cca7717c5b0fbe7760df313
     name: systemd-rpm-macros
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/t/tar-1.34-11.el9.aarch64.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/t/tar-1.34-13.el9_8.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 904777
-    checksum: sha256:62f985a87e048caa3ef883966d6176448398abc42df00ebff07e7311ff5f425d
+    size: 909271
+    checksum: sha256:ee4fa57c4bb87613f6fbd4b785a9e6162d43f046d1bbdd5022771652b931e9d0
     name: tar
-    evr: 2:1.34-11.el9
-    sourcerpm: tar-1.34-11.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm
+    evr: 2:1.34-13.el9_8
+    sourcerpm: tar-1.34-13.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/t/tzdata-2026e-1.el9_8.noarch.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
-    size: 933286
-    checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc
+    size: 936099
+    checksum: sha256:c105d92f6cacb9bb8337b77041cedd9c9c906a72c4b5233909b9b69b78f4369f
     name: tzdata
-    evr: 2026c-1.el9_8
-    sourcerpm: tzdata-2026c-1.el9_8.src.rpm
+    evr: 2026e-1.el9_8
+    sourcerpm: tzdata-2026e-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/u/util-linux-2.37.4-25.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-rpms
     size: 2390152
@@ -1033,12 +1040,12 @@ arches:
     checksum: sha256:5fa267daa0e7df3e072c17e81db41b809b256da8cfb0372669d9a1bea937a01a
     name: delve
     evr: 1.26.1-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/g/golang-1.26.5-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/g/golang-1.26.7-2.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-appstream-source-rpms
-    size: 36513301
-    checksum: sha256:45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf
+    size: 36539286
+    checksum: sha256:7a9ea792be9d09b61bc321ce8b65a040430d06891d6372aeb929753c2f270770
     name: golang
-    evr: 1.26.5-1.el9_8
+    evr: 1.26.7-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/l/libmpc-1.2.1-4.el9.src.rpm
     repoid: rhel-9-for-aarch64-appstream-source-rpms
     size: 846236
@@ -1063,18 +1070,18 @@ arches:
     checksum: sha256:2f5ece89d6a8d892816f386462d8be291ad83f1500b4c4b3655dcc7ed5192c0d
     name: mpdecimal
     evr: 2.5.1-3.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
     repoid: rhel-9-for-aarch64-appstream-source-rpms
-    size: 45775054
-    checksum: sha256:5955f781730fe817b08b7ddc3d2117a7c0a0c95ed2fd2044cbc1ff7d1eba1b28
+    size: 48516429
+    checksum: sha256:fdb3a4e84c097bb87061fbf6b3f1f11a03b4aa6adf13b0b20cc1d439b5a2c7d7
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/p/python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/p/python3.12-3.12.15-1.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-appstream-source-rpms
-    size: 20886822
-    checksum: sha256:7e01f587203e8d951fb7a38dff1c893cb1a3de5d7e762be6d6623cafd7c7435f
+    size: 20904561
+    checksum: sha256:8a3db1154cbfe206ac68b31268348da6039522d09be22520dd94207417146ebd
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
+    evr: 3.12.15-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/source/SRPMS/Packages/p/python3.12-pip-23.2.1-5.el9.src.rpm
     repoid: rhel-9-for-aarch64-appstream-source-rpms
     size: 9384965
@@ -1093,12 +1100,12 @@ arches:
     checksum: sha256:b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db
     name: acl
     evr: 2.4.0-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/a/attr-2.5.1-3.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/a/attr-2.6.0-1.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 482234
-    checksum: sha256:5171534e7de11df197f3c5e08658544983198288e04624c739b5c3d9db07b59c
+    size: 389805
+    checksum: sha256:9bdd2e605e0ddc9818382bd95644594fa8b8eedfe08048303093db13cde9963c
     name: attr
-    evr: 2.5.1-3.el9
+    evr: 2.6.0-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/a/audit-3.1.5-8.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 1275064
@@ -1123,12 +1130,12 @@ arches:
     checksum: sha256:82174416ee39df7795da7fab8d37ea5dbbe25f1dbc2df39f5fb3f8a168bf5120
     name: binutils
     evr: 2.35.2-72.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/b/brotli-1.0.9-9.el9_7.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/b/brotli-1.0.9-10.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 517498
-    checksum: sha256:814868e0bec831c79d3e12ff76d31e06e5e62c462a1a4b6607b1f3cab7014438
+    size: 519221
+    checksum: sha256:c833ffbd6c6555543472ef4034a958cf4b8b8dee35b8661b2144ca6fc38908c7
     name: brotli
-    evr: 1.0.9-9.el9_7
+    evr: 1.0.9-10.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/b/bzip2-1.0.8-11.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 828199
@@ -1147,12 +1154,12 @@ arches:
     checksum: sha256:b2618b278f5c8d6dacfae790c8c73b1fc1578b8f64011f325ced5a4a2e3b58bc
     name: chkconfig
     evr: 1.24-2.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.1.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 5696745
-    checksum: sha256:9129bd65888eb0b6d802d8fe912609726af5d1f6347df8a18b243c426dcbb4db
+    size: 5697510
+    checksum: sha256:5852781d2fbb2c447c4425960f4fe30310870a0e4073363d2254047b785b5a9e
     name: coreutils
-    evr: 8.32-41.el9_8
+    evr: 8.32-41.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/c/cracklib-2.9.6-28.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 6416053
@@ -1165,12 +1172,12 @@ arches:
     checksum: sha256:775d926429179caeade6af8dc7dea15a0bea49102c2592d5b712f996a329ec38
     name: crypto-policies
     evr: 20260224-1.gitea0f072.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.5.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 2576796
-    checksum: sha256:5a455f6c35ae1069b8c54ade4c9d0d3d260134f76bee10f22efef9683c31b03f
+    size: 2581541
+    checksum: sha256:303a97cbdfaaac1d709ef7621b2b349dc403da6a553ecfe5e3114f76d757d554
     name: curl
-    evr: 7.76.1-40.el9_8.5
+    evr: 7.76.1-40.el9_8.8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/c/cyrus-sasl-2.1.27-22.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 4025677
@@ -1183,12 +1190,12 @@ arches:
     checksum: sha256:3fe74a2b4fb4485c93e974010d9376e30a63dfcc628bfd6c01837c27b4953912
     name: dbus
     evr: 1:1.12.20-8.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/d/dbus-broker-28-7.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/d/dbus-broker-28-9.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 254475
-    checksum: sha256:aced3097fbb8a424ca1816b8cb3e79960a9ccf7ba139538282886e692c317b29
+    size: 258866
+    checksum: sha256:9ccbb440edb6826689fd5e0d650de4f08550c3c0f3b2732c54c1e99b0d361824
     name: dbus-broker
-    evr: 28-7.el9
+    evr: 28-9.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/d/diffutils-3.7-12.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 1477522
@@ -1207,12 +1214,12 @@ arches:
     checksum: sha256:643279e796ded16c5be5cdc2a91839c787e62e59757008675eb0580a4a42af21
     name: elfutils
     evr: 0.194-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.5.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 8390481
-    checksum: sha256:3ef9a4df767dbc5e75944b5c197d186f8b5ca8745522e07cdf1a195229d381b4
+    size: 8411609
+    checksum: sha256:38d7acfd1130c02c6a00010159a1350ca0f56cd7ed64f3d8394aa5b3d6512ddd
     name: expat
-    evr: 2.5.0-6.el9_8.1
+    evr: 2.5.0-6.el9_8.5
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/f/filesystem-3.16-5.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 20486
@@ -1225,12 +1232,12 @@ arches:
     checksum: sha256:48bd4d4dd081120bcc6ab772b930a150f30b2fc89a4a14a24220383d24a30b3f
     name: findutils
     evr: 1:4.8.0-7.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9_8.1.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 3190934
-    checksum: sha256:37571947707e835d36ceb5641b187aba13ef8f5f605a6762ce72aeea3e745b8d
+    size: 3197459
+    checksum: sha256:8f156f11c96b1720ba2e9e287f2ddf5e0588a9c9ad17753f779ebbdf0c4e99df
     name: gawk
-    evr: 5.1.0-6.el9
+    evr: 5.1.0-6.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/gcc-11.5.0-14.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 81978017
@@ -1243,12 +1250,12 @@ arches:
     checksum: sha256:ad42264274c2a792220395a4dbe736a1de6100c4e14611707ec1dd447583271f
     name: gdbm
     evr: 1:1.23-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/glibc-2.34-275.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/glibc-2.34-283.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 20442764
-    checksum: sha256:bd7a453f66e13da24d073f53070c2d209fcd88ca2aaa24ab3b2f81cae198b46c
+    size: 20462553
+    checksum: sha256:9007b0a97151f43f812049a925cb418753f9fd643fe1283cc7eddc7e6785e2f3
     name: glibc
-    evr: 2.34-275.el9_8
+    evr: 2.34-283.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/gmp-6.2.0-13.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 2503825
@@ -1261,12 +1268,12 @@ arches:
     checksum: sha256:81b14432ebe1645b74b57592f1dcde8fab15ec13632f483f72ff2407ed16c33e
     name: grep
     evr: 3.6-5.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/gzip-1.12-1.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/g/gzip-1.12-2.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 856147
-    checksum: sha256:a05f582ec42e89258ee5e10af96dee4300bcb2a6a69a76bfb5b46f79e6a6a47b
+    size: 859023
+    checksum: sha256:f28fcbe8f3de2ec7dcdb51b1f51f03f61d0afa18c9fef10d210f40ff0c71f3a0
     name: gzip
-    evr: 1.12-1.el9
+    evr: 1.12-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/j/jq-1.6-19.el9_8.2.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 1512470
@@ -1279,12 +1286,12 @@ arches:
     checksum: sha256:c4c76ebfd66ba6d00edf672797d7f077b29d279b7866a04e05258a257a5bc306
     name: json-c
     evr: 0.14-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.39.1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.57.1.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 152374943
-    checksum: sha256:7002d750cf1966a61a9131f2b5b24887816d989509efd27e5a4ed0dc8243e002
+    size: 152563149
+    checksum: sha256:a2660af0b87ac6a4d161ccc76c7d8a8338a44b4fbaad6da9e5529e3027f25aa2
     name: kernel
-    evr: 5.14.0-687.39.1.el9_8
+    evr: 5.14.0-687.57.1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/k/keyutils-1.6.3-1.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 150790
@@ -1333,12 +1340,12 @@ arches:
     checksum: sha256:425009c96135f39ca7bdb8a6ea948187d052d339dd76235979439fbd169da331
     name: libeconf
     evr: 0.4.1-7.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/l/libevent-2.1.12-8.el9_4.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/l/libevent-2.1.13-1.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 1123179
-    checksum: sha256:8c00dc837b8685fc660cc0bcdfd4f533888facaa8c83655c26d2fb068cb7b135
+    size: 1152974
+    checksum: sha256:39aef29e588e3815189ca7b54326a4e1247e8a1f5a44c908ca4325c8cae83acb
     name: libevent
-    evr: 2.1.12-8.el9_4
+    evr: 2.1.13-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/l/libffi-3.4.2-8.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 1367398
@@ -1405,12 +1412,12 @@ arches:
     checksum: sha256:734651070d0113de033da80114b416931c4c0be21ce51f6b1c1641b1185c34f3
     name: libsigsegv
     evr: 2.13-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/l/libssh-0.10.4-18.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/l/libssh-0.10.4-19.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 707007
-    checksum: sha256:e012994887f4f4c4367bce98f2eb5589bfa5c7926d65471cefeee12bee636b1d
+    size: 720407
+    checksum: sha256:83663aff05b77225cded03c63955736eddc0d6ecf6072cb4355563094a2a3250
     name: libssh
-    evr: 0.10.4-18.el9
+    evr: 0.10.4-19.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/l/libtasn1-4.16.0-10.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 1899881
@@ -1495,12 +1502,12 @@ arches:
     checksum: sha256:0d21c12c55d40d1fc2f006c8ec187b5fcc799b794cfd31ed2d98434189c62800
     name: openldap
     evr: 2.6.8-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/o/openssl-3.5.5-6.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/o/openssl-3.5.8-2.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 53369050
-    checksum: sha256:b79f08d2d04536fdb6801b6ba7da7174942d174dd2b7969316402c737689d735
+    size: 53435636
+    checksum: sha256:1e67b59efe228f804c0544a31ab3de0bb4a0c8250d3d5f5fc53a3c7794104795
     name: openssl
-    evr: 1:3.5.5-6.el9_8
+    evr: 1:3.5.8-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 28686020
@@ -1513,24 +1520,30 @@ arches:
     checksum: sha256:6f06a4f6812fce869528ff17ab002d655a8da18fc745eafa6c02594bb23dfeeb
     name: p11-kit
     evr: 0.26.4-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9_8.1.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 1133226
-    checksum: sha256:d88f44d73e9ccb288d75fd5490dc1434b06e88966febed66648775a0b46fb50c
+    size: 1142205
+    checksum: sha256:fe61734fdb226915dff402bcd1ad2002e0fd7a4dad9042af65688804f428b30b
     name: pam
-    evr: 1.5.1-28.el9
+    evr: 1.5.1-28.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/p/pcre-8.44-4.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 1624356
     checksum: sha256:7edbd87b866a3f6e3df1426d660b902e063193d6186027bf99f6d77626a43817
     name: pcre
     evr: 8.44-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/p/pcre2-10.40-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/p/pcre2-10.40-7.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 1789790
-    checksum: sha256:a570f7192be555222aa3704882b9199fb013a84ad4d7dcf40a93d8de2ecf6e0a
+    size: 1805958
+    checksum: sha256:43c40093332890a77f7d7c573a1b540867319bbcaaec5a6dfd73101765dc6ea0
     name: pcre2
-    evr: 10.40-6.el9
+    evr: 10.40-7.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/p/pigz-2.8-1.el9.src.rpm
+    repoid: rhel-9-for-aarch64-baseos-source-rpms
+    size: 131701
+    checksum: sha256:2eb6030553235feec36ab1406d80066f60ca545bf5a073a43a2a841a70892d2a
+    name: pigz
+    evr: 2.8-1.el9
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/p/pkgconf-1.7.3-10.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 310904
@@ -1573,30 +1586,30 @@ arches:
     checksum: sha256:771a5ed07cdb690c75cd428a8113e2ee471270044e6cb8025d92c54e32c180ff
     name: shadow-utils
     evr: 2:4.9-16.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-10.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-11.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 25116090
-    checksum: sha256:4387ae8d5a5a0b972b7a8612dca277499a43e7991163c7519e8a0ced2e57c90a
+    size: 25117596
+    checksum: sha256:4efcc956008f0468362b41bdba79111c41027b682bcdea3ecca3744cf50ebfd7
     name: sqlite
-    evr: 3.34.1-10.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.4.src.rpm
+    evr: 3.34.1-11.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.6.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 45009674
-    checksum: sha256:e44181d1de2a135a5507b956d18a9eb11951a35aaa9c15dbc0f144ed8313f732
+    size: 45003976
+    checksum: sha256:f535f4c20ed82f56cc7f4c86202e3cd582815f702bb0c24005a07a496ec94c97
     name: systemd
-    evr: 252-67.el9_8.4
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm
+    evr: 252-67.el9_8.6
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 2294162
-    checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6
+    size: 2312101
+    checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c
     name: tar
-    evr: 2:1.34-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm
+    evr: 2:1.34-13.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/t/tzdata-2026e-1.el9_8.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
-    size: 933774
-    checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f
+    size: 943814
+    checksum: sha256:016ab67407e6f67418d8f36c5944396fe82c85896b9e945441f93d3cf1b823b4
     name: tzdata
-    evr: 2026c-1.el9_8
+    evr: 2026e-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/u/util-linux-2.37.4-25.el9.src.rpm
     repoid: rhel-9-for-aarch64-baseos-source-rpms
     size: 6291867
@@ -1622,10 +1635,10 @@ arches:
     name: zstd
     evr: 1.5.5-1.el9
   module_metadata:
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/repodata/f44ff824c6f9e9f05e33561ff199a3df2d92abc697f59cd95be5fb8bfbdcbdf5-modules.yaml.gz
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/appstream/os/repodata/e4bd35a63d3720d47f8770f923c2f4f4a21dc06f0ff1cb37c98ba520477a2b5f-modules.yaml.gz
     repoid: rhel-9-for-aarch64-appstream-rpms
-    size: 63516
-    checksum: sha256:f44ff824c6f9e9f05e33561ff199a3df2d92abc697f59cd95be5fb8bfbdcbdf5
+    size: 69384
+    checksum: sha256:e4bd35a63d3720d47f8770f923c2f4f4a21dc06f0ff1cb37c98ba520477a2b5f
 - arch: ppc64le
   packages:
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/c/cpp-11.5.0-14.el9.ppc64le.rpm
@@ -1642,13 +1655,13 @@ arches:
     name: delve
     evr: 1.26.1-1.el9_8
     sourcerpm: delve-1.26.1-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9_8.1.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 216324
-    checksum: sha256:f44a17730803f53266874678031b8121541b5b1a8047a3205c2576630216f468
+    size: 218118
+    checksum: sha256:c12a101cc4a7fd08f4fa1a430629fe45fa7fd56e59d5f4094aaa159c9a0aabea
     name: gawk-all-langpacks
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/gcc-11.5.0-14.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
     size: 29072214
@@ -1656,55 +1669,55 @@ arches:
     name: gcc
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/glibc-devel-2.34-275.el9_8.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/glibc-devel-2.34-283.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 587995
-    checksum: sha256:8a7198be7897a154c0882d7302fe37ebead33e09d41ca2643b1677360dbb06ee
+    size: 588179
+    checksum: sha256:bbf07477a92658eb7667624537b47fc925a61c8aa379b912a5d701ff22cd924b
     name: glibc-devel
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/go-toolset-1.26.5-1.el9_8.ppc64le.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/go-toolset-1.26.7-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 12493
-    checksum: sha256:9064749e7f12c74ec1cd5603ea42227f7ab850b30ab977f18a91f1b0bf917974
+    size: 12469
+    checksum: sha256:e41a8424c10bc94cd0bfcd5e047dde7bced6d7f5e8e56ceeec3845ea9c0a91ce
     name: go-toolset
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-1.26.5-1.el9_8.ppc64le.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-1.26.7-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 1520603
-    checksum: sha256:5b1cacea443746d5c5cdfa02d867ec58d5a1f6a559fdf5b9d4afdcf085f9548b
+    size: 1520306
+    checksum: sha256:0666a0e9d74aba917e5dd385629548b8d4e6f13e29441f3dec00e2a928c0173a
     name: golang
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-bin-1.26.5-1.el9_8.ppc64le.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-bin-1.26.7-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 42717141
-    checksum: sha256:84d77e1d2e804e06840ef8039ab49f22f7f8cc688f2301d1090d5d705afab096
+    size: 43905181
+    checksum: sha256:079e5c168a173ea7b7caa53a6b08c768fd9ce36c9dc746a45b2e47aec9ae8c62
     name: golang-bin
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-race-1.26.5-1.el9_8.ppc64le.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-race-1.26.7-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 1663710
-    checksum: sha256:e2c691d291865cf6f46e91b170771493519efa6e250f0eaf51a6342f487a86b1
+    size: 1663702
+    checksum: sha256:06cbd04d297dd3d522deab3c3c4b4226358efb4616eb55988edcac4c373a6617
     name: golang-race
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-src-1.26.5-1.el9_8.noarch.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/g/golang-src-1.26.7-2.el9_8.noarch.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 12881624
-    checksum: sha256:4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0
+    size: 12879471
+    checksum: sha256:ff54c6f194fcf25d743af1af7893242085c798b7ce04056066fee993c2167166
     name: golang-src
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/k/kernel-headers-5.14.0-687.39.1.el9_8.ppc64le.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/k/kernel-headers-5.14.0-687.57.1.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 2890621
-    checksum: sha256:0214763708cdc25b5a92387531ba51bca96f3094e30dc919d40813ba2c70f653
+    size: 2963757
+    checksum: sha256:92f45cbda331f1f1a398d83ef564d02085e9e8e5274127f949129446a1e62668
     name: kernel-headers
-    evr: 5.14.0-687.39.1.el9_8
-    sourcerpm: kernel-5.14.0-687.39.1.el9_8.src.rpm
+    evr: 5.14.0-687.57.1.el9_8
+    sourcerpm: kernel-5.14.0-687.57.1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/l/libasan-11.5.0-14.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
     size: 440756
@@ -1754,41 +1767,41 @@ arches:
     name: mpdecimal
     evr: 2.5.1-3.el9
     sourcerpm: mpdecimal-2.5.1-3.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/o/openssl-devel-3.5.5-6.el9_8.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/o/openssl-devel-3.5.8-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 5028706
-    checksum: sha256:c3c05e886a636a5fc3c6ff52638cedcd11612913cf7547ccd9659ee017624939
+    size: 5049303
+    checksum: sha256:43e79a52675424d735be395869a49f30355257639571d46b7a15699364547463
     name: openssl-devel
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.ppc64le.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 1881747
-    checksum: sha256:6aee4d674c4b3b504a62e263386ebc1bf4f9daed2cd89b3a9578de4fc3e3dcce
+    size: 2115888
+    checksum: sha256:a5f63dd209db8b709ebda515c4a71c746360e2438ed54a448920a84b431ab3d3
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/postgresql-private-libs-15.18-1.module+el9.8.0+24358+32c5830e.ppc64le.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/postgresql-private-libs-16.15-1.module+el9.8.0+24803+9dca000b.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 170196
-    checksum: sha256:388ed8fa7cddbdcf4c20bfd13986e2c1d25090daadcb585e442fe7ca99a76955
+    size: 171976
+    checksum: sha256:96366eb8e165d019f05d42c0b5fb801e658377f65b1d92bae29a8e9d73722725
     name: postgresql-private-libs
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/python3.12-3.12.13-3.el9_8.1.ppc64le.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/python3.12-3.12.15-1.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 32808
-    checksum: sha256:18f196faebc9865f11e1ca27f82cc69b92e5354cc5580072793beabb70eeec91
+    size: 32671
+    checksum: sha256:8487fe96fe76e5dce0a7725ac8d7f0567f7b6efd79bfa425994e5e58c11fc4e7
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/python3.12-libs-3.12.13-3.el9_8.1.ppc64le.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/python3.12-libs-3.12.15-1.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 10087484
-    checksum: sha256:56acbc33e3d1bf7f5795fc53937a8e60e2d2f62e5eb668f017ecaa0255e42cd4
+    size: 10098201
+    checksum: sha256:da7dceeaf521afad56701795db246750b261a5759053fe37c1ebbfe623034c21
     name: python3.12-libs
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/Packages/p/python3.12-pip-wheel-23.2.1-5.el9.noarch.rpm
     repoid: rhel-9-for-ppc64le-appstream-rpms
     size: 1527128
@@ -1866,20 +1879,20 @@ arches:
     name: ca-certificates
     evr: 2025.2.80_v9.0.305-91.el9
     sourcerpm: ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/c/coreutils-8.32-41.el9_8.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/c/coreutils-8.32-41.el9_8.1.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 1259870
-    checksum: sha256:d9fc3be701da7abe502bc5f9d07f93e13088de2e78cf0de8bcf5fb8c0fc7e737
+    size: 1262204
+    checksum: sha256:195fa8b9b1eee88c69323de32c1fadc6dd9af2dfe7df10a2a04ee796b5248767
     name: coreutils
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.ppc64le.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.1.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 2115089
-    checksum: sha256:a242aae86238374731d5d52f23962a6af31b5ed51ce5cffaeee62e05046ed2ce
+    size: 2113363
+    checksum: sha256:a9006eb589f6f6dfd468ae1f2c8d3ea9874b86238f462b21f75a12a5c298f7b1
     name: coreutils-common
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/c/cracklib-2.9.6-28.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 104055
@@ -1915,13 +1928,13 @@ arches:
     name: dbus
     evr: 1:1.12.20-8.el9
     sourcerpm: dbus-1.12.20-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/d/dbus-broker-28-7.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/d/dbus-broker-28-9.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 192179
-    checksum: sha256:dfe710f3a07cd31fd144f439deaed0ef78b5ea65caecb754bc69959908191af7
+    size: 192671
+    checksum: sha256:62f23c1c9a1354c21b0b2d4c4013874b8c60f11e134f8cdf6f0314adb4bf3bbe
     name: dbus-broker
-    evr: 28-7.el9
-    sourcerpm: dbus-broker-28-7.el9.src.rpm
+    evr: 28-9.el9_8
+    sourcerpm: dbus-broker-28-9.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/d/dbus-common-1.12.20-8.el9.noarch.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 18551
@@ -1964,13 +1977,13 @@ arches:
     name: elfutils-libs
     evr: 0.194-1.el9
     sourcerpm: elfutils-0.194-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/e/expat-2.5.0-6.el9_8.1.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/e/expat-2.5.0-6.el9_8.5.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 132202
-    checksum: sha256:eae0d2c0c23adc9b878e86d46a7cd176e991a84fc5780877dd58f15552b6a5c6
+    size: 133703
+    checksum: sha256:f379b66b57d67569fabaa4cecc75d7ed26b1c46733b626f3550fc31e740761af
     name: expat
-    evr: 2.5.0-6.el9_8.1
-    sourcerpm: expat-2.5.0-6.el9_8.1.src.rpm
+    evr: 2.5.0-6.el9_8.5
+    sourcerpm: expat-2.5.0-6.el9_8.5.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/f/filesystem-3.16-5.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 5003944
@@ -1985,13 +1998,13 @@ arches:
     name: findutils
     evr: 1:4.8.0-7.el9
     sourcerpm: findutils-4.8.0-7.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/gawk-5.1.0-6.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/gawk-5.1.0-6.el9_8.1.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 1064251
-    checksum: sha256:b0cc389ad0855900c79f2cfa525df8cbc663093056b0b5d29ec3e36a189b325e
+    size: 1062624
+    checksum: sha256:4c2d81c6874201646d5c5eee719ecdb95f610b277b3782bb1956a19f71d17d59
     name: gawk
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/gdbm-libs-1.23-1.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 65838
@@ -1999,34 +2012,34 @@ arches:
     name: gdbm-libs
     evr: 1:1.23-1.el9
     sourcerpm: gdbm-1.23-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-2.34-275.el9_8.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-2.34-283.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 2910729
-    checksum: sha256:283894cf70b0f263673a2c312c221fdde95c57ee42919ca55f2a8ddffe9ac35b
+    size: 2912446
+    checksum: sha256:58cb522948a569844774333002f3f46bef3605995a12ae1d604c6b9346d2c3e2
     name: glibc
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-common-2.34-275.el9_8.ppc64le.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-common-2.34-283.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 339553
-    checksum: sha256:385baf7f6dff31df34fd649b90b3352f6435bc18aa1bb6b75b4cae1f706148d2
+    size: 339738
+    checksum: sha256:425ee42d476c84313217e727d19fa9e5621536de9154be01a3a1de2e24732445
     name: glibc-common
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-gconv-extra-2.34-275.el9_8.ppc64le.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-gconv-extra-2.34-283.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 1828793
-    checksum: sha256:6c70cd8679823b0834ddc4e31d0d878a7b65b0a2299cfd860705e7fc51328ee1
+    size: 1829644
+    checksum: sha256:8818013abf534cecafd88c6c8f0e47229745a9aac310d322e4eef3cf31c5ceaf
     name: glibc-gconv-extra
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-minimal-langpack-2.34-275.el9_8.ppc64le.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/glibc-minimal-langpack-2.34-283.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 30901
-    checksum: sha256:207421071834e057ca6e25ee11c273be2b4f230cd9fd6f16760be5be3276b39f
+    size: 31057
+    checksum: sha256:809935a22c981342d7ce446e8085753351a2cbc29db8baa2006a67091e7331d4
     name: glibc-minimal-langpack
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/gmp-6.2.0-13.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 312805
@@ -2041,13 +2054,13 @@ arches:
     name: grep
     evr: 3.6-5.el9
     sourcerpm: grep-3.6-5.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/gzip-1.12-1.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/g/gzip-1.12-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 175705
-    checksum: sha256:55b983f08d8b2a0741b07f114cdba89a8ecb207064c001e90e4c76a13836d458
+    size: 176201
+    checksum: sha256:6303a915e54bf2df02c788387d44b4e08882c1431b896483482fa87a2b799972
     name: gzip
-    evr: 1.12-1.el9
-    sourcerpm: gzip-1.12-1.el9.src.rpm
+    evr: 1.12-2.el9_8
+    sourcerpm: gzip-1.12-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/j/jq-1.6-19.el9_8.2.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 210467
@@ -2104,13 +2117,13 @@ arches:
     name: libatomic
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libattr-2.5.1-3.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libattr-2.6.0-1.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 21501
-    checksum: sha256:a2398158adad2016fca3d0d2c272e027b8279020992a349664caf6a2299ec50b
+    size: 24709
+    checksum: sha256:9931133a1f833d158bc8098815924c1b15cf6c024bc89e0f55571ef906ae8f43
     name: libattr
-    evr: 2.5.1-3.el9
-    sourcerpm: attr-2.5.1-3.el9.src.rpm
+    evr: 2.6.0-1.el9_8
+    sourcerpm: attr-2.6.0-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libblkid-2.37.4-25.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 130845
@@ -2118,13 +2131,13 @@ arches:
     name: libblkid
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libbrotli-1.0.9-9.el9_7.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libbrotli-1.0.9-10.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 349508
-    checksum: sha256:ff72df4a441c2f8ee8e1bcde8dcbd5bbd89250db9caf8792ff253b7af3e1c51c
+    size: 349850
+    checksum: sha256:42e896518cf1eafcacb3de33fc0bd827d574413543166a218ee69b22653ccea9
     name: libbrotli
-    evr: 1.0.9-9.el9_7
-    sourcerpm: brotli-1.0.9-9.el9_7.src.rpm
+    evr: 1.0.9-10.el9_8
+    sourcerpm: brotli-1.0.9-10.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libcap-2.48-10.el9_8.1.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 82771
@@ -2146,13 +2159,13 @@ arches:
     name: libcom_err
     evr: 1.46.5-8.el9
     sourcerpm: e2fsprogs-1.46.5-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.5.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 329146
-    checksum: sha256:1101e1698ca9b9d1b67332cf81c29ffbfbcd4342b053a3e3d4304d8d86e73bc2
+    size: 329921
+    checksum: sha256:3398c7352676781afaccc81aeb80925dc9b213c4fdbe6784e0662194931ad948
     name: libcurl
-    evr: 7.76.1-40.el9_8.5
-    sourcerpm: curl-7.76.1-40.el9_8.5.src.rpm
+    evr: 7.76.1-40.el9_8.8
+    sourcerpm: curl-7.76.1-40.el9_8.8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libdb-5.3.28-57.el9_6.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 837087
@@ -2167,13 +2180,13 @@ arches:
     name: libeconf
     evr: 0.4.1-7.el9_8
     sourcerpm: libeconf-0.4.1-7.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libevent-2.1.12-8.el9_4.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libevent-2.1.13-1.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 287857
-    checksum: sha256:bc6eb253e6cf0e06fa7270c029502e14ee70cb22c2ed86b15f2a9952ba2f375f
+    size: 290670
+    checksum: sha256:807d7fa3f3d44f61494a8e10513fba73a030202c44e4f740406a1aecb8af9094
     name: libevent
-    evr: 2.1.12-8.el9_4
-    sourcerpm: libevent-2.1.12-8.el9_4.src.rpm
+    evr: 2.1.13-1.el9_8
+    sourcerpm: libevent-2.1.13-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libfdisk-2.37.4-25.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 176392
@@ -2307,20 +2320,20 @@ arches:
     name: libsmartcols
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libssh-0.10.4-18.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libssh-0.10.4-19.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 250594
-    checksum: sha256:15cff94afc4645b00c917abd7780a6a3ee1b476dff3eaccaaed93b88298a2ca1
+    size: 252645
+    checksum: sha256:44d3d65ac69d08e4ce6053e477b236772065f48c4be8162370976d3bd0f3e82f
     name: libssh
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libssh-config-0.10.4-18.el9.noarch.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libssh-config-0.10.4-19.el9_8.noarch.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 14685
-    checksum: sha256:ab353cbff2269677fc7364bfcddb8e11537ea83361a0ad642e60eac87ed67fbb
+    size: 14764
+    checksum: sha256:ce06b99793b9e5abc50a58ebc3ef11037f2efbdb5f819a25f8de4994613194d4
     name: libssh-config
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/l/libstdc++-11.5.0-14.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 856889
@@ -2440,13 +2453,13 @@ arches:
     name: openldap
     evr: 2.6.8-4.el9
     sourcerpm: openldap-2.6.8-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/o/openssl-3.5.5-6.el9_8.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/o/openssl-3.5.8-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 1566179
-    checksum: sha256:d207d19541eb62721034fbcf7f8ae046d3862541bc20221bd5cb12262eefe3a0
+    size: 1571604
+    checksum: sha256:1821093057fa1deba0217258135142da201100664028ce15b36471a36c4a20d9
     name: openssl
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 14245
@@ -2461,13 +2474,13 @@ arches:
     name: openssl-fips-provider-so
     evr: 3.0.7-11.el9_8
     sourcerpm: openssl-fips-provider-3.0.7-11.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/o/openssl-libs-3.5.5-6.el9_8.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/o/openssl-libs-3.5.8-2.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 2553440
-    checksum: sha256:736ae95ae35ebd344438f0871e471135e0ebb0ed61352b467e71040412f871de
+    size: 2558230
+    checksum: sha256:a3cc786155a4fe2be6d16c15b12bdb628f3f5141f21851dfd061bc550dfe34d8
     name: openssl-libs
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/p11-kit-0.26.4-1.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 621129
@@ -2482,13 +2495,13 @@ arches:
     name: p11-kit-trust
     evr: 0.26.4-1.el9_8
     sourcerpm: p11-kit-0.26.4-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pam-1.5.1-28.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pam-1.5.1-28.el9_8.1.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 677440
-    checksum: sha256:4d7ae59c6b8bfd1548bf5d0b44081b77d966f63aac6057f48731c0a0f1e794e8
+    size: 683853
+    checksum: sha256:a855ac273e5c783879fc57f27886a7d9e662e8c5988777113688736dc59a23fd
     name: pam
-    evr: 1.5.1-28.el9
-    sourcerpm: pam-1.5.1-28.el9.src.rpm
+    evr: 1.5.1-28.el9_8.1
+    sourcerpm: pam-1.5.1-28.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pcre-8.44-4.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 208333
@@ -2496,20 +2509,27 @@ arches:
     name: pcre
     evr: 8.44-4.el9
     sourcerpm: pcre-8.44-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pcre2-10.40-6.el9.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pcre2-10.40-7.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 243057
-    checksum: sha256:fcccf3d6981333ac0ac747ee143dae975381e02025ad2bc53e6aa7e0dc5fafb7
+    size: 245697
+    checksum: sha256:58ff04ee8a1bca90fbabc3310043eac023d09440579f9140fa74306425dd3de4
     name: pcre2
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pcre2-syntax-10.40-6.el9.noarch.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pcre2-syntax-10.40-7.el9_8.noarch.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 147926
-    checksum: sha256:d386b5e9b3a4b077b2ba143882e605750855dd3354f13c55fa12ed26908cb442
+    size: 150069
+    checksum: sha256:e7466a43ef2bfda2b1dc07e855b0db743d48b11c0bdc1402e1d2ea6fb23d33a3
     name: pcre2-syntax
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pigz-2.8-1.el9.ppc64le.rpm
+    repoid: rhel-9-for-ppc64le-baseos-rpms
+    size: 101362
+    checksum: sha256:6488d453e558f9418cb83b605894f79839977315c5689275dd26674c3da73275
+    name: pigz
+    evr: 2.8-1.el9
+    sourcerpm: pigz-2.8-1.el9.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/p/pkgconf-1.7.3-10.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 46315
@@ -2580,55 +2600,55 @@ arches:
     name: shadow-utils
     evr: 2:4.9-16.el9
     sourcerpm: shadow-utils-4.9-16.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/sqlite-libs-3.34.1-10.el9_8.ppc64le.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/sqlite-libs-3.34.1-11.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 758081
-    checksum: sha256:6eac353037fe537e4639455a4ce8595b6b8c345913f84868b2a3288c6b54000a
+    size: 758085
+    checksum: sha256:f51af80eda44e36b51b315a90e44a0bfd2c6c7d4ce4aadd40bac23af3fc43cb8
     name: sqlite-libs
-    evr: 3.34.1-10.el9_8
-    sourcerpm: sqlite-3.34.1-10.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-252-67.el9_8.4.ppc64le.rpm
+    evr: 3.34.1-11.el9_8
+    sourcerpm: sqlite-3.34.1-11.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-252-67.el9_8.6.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 4435450
-    checksum: sha256:bff8fa0817533a53ff5f52d3510b15566af85678685d14d731154806ace4e1d7
+    size: 4416503
+    checksum: sha256:ce49b64e3fdba53c10a4127b91a9f80ceb9d18e6a1fe834a41e4d66cd1a20b90
     name: systemd
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-libs-252-67.el9_8.4.ppc64le.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-libs-252-67.el9_8.6.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 713252
-    checksum: sha256:334c026fbafebded08f9d42b0bdaba9dba60863179c95792c13af4cb1f8b6523
+    size: 694605
+    checksum: sha256:8779364a6687523779cc8f9cfa8a5e0fc809d390e5c6d9e399705a754531c79f
     name: systemd-libs
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-pam-252-67.el9_8.4.ppc64le.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-pam-252-67.el9_8.6.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 294891
-    checksum: sha256:cb44a6b99e0deafaad55d75942b67fa6079a1cfbc0929fefeeeea8f8ada6eaf0
+    size: 276291
+    checksum: sha256:bdc687a7e14c8df0cc6d5f1f3c1fd0ffa911e391ac83102f33c5ececf08dde08
     name: systemd-pam
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.4.noarch.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.6.noarch.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 59475
-    checksum: sha256:7d671ec39a7caeb7346be6d5fcb44212545844ced6f4974c4b409fef6a12a891
+    size: 40844
+    checksum: sha256:974a0352427799559a3e90dcdb38200d767631452cca7717c5b0fbe7760df313
     name: systemd-rpm-macros
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/t/tar-1.34-11.el9.ppc64le.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/t/tar-1.34-13.el9_8.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 945887
-    checksum: sha256:cb2fe4ca6c89e1a9fff648629cc7b9b7f33a7853a8ae74c10baa1d5b731d2447
+    size: 947907
+    checksum: sha256:d1edfa14f40d3556861be567c693a18cf025f7d1a1e041142a8a7cae6f7b32f7
     name: tar
-    evr: 2:1.34-11.el9
-    sourcerpm: tar-1.34-11.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm
+    evr: 2:1.34-13.el9_8
+    sourcerpm: tar-1.34-13.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/t/tzdata-2026e-1.el9_8.noarch.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
-    size: 933286
-    checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc
+    size: 936099
+    checksum: sha256:c105d92f6cacb9bb8337b77041cedd9c9c906a72c4b5233909b9b69b78f4369f
     name: tzdata
-    evr: 2026c-1.el9_8
-    sourcerpm: tzdata-2026c-1.el9_8.src.rpm
+    evr: 2026e-1.el9_8
+    sourcerpm: tzdata-2026e-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/u/util-linux-2.37.4-25.el9.ppc64le.rpm
     repoid: rhel-9-for-ppc64le-baseos-rpms
     size: 2426763
@@ -2664,12 +2684,12 @@ arches:
     checksum: sha256:5fa267daa0e7df3e072c17e81db41b809b256da8cfb0372669d9a1bea937a01a
     name: delve
     evr: 1.26.1-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/g/golang-1.26.5-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/g/golang-1.26.7-2.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-appstream-source-rpms
-    size: 36513301
-    checksum: sha256:45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf
+    size: 36539286
+    checksum: sha256:7a9ea792be9d09b61bc321ce8b65a040430d06891d6372aeb929753c2f270770
     name: golang
-    evr: 1.26.5-1.el9_8
+    evr: 1.26.7-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/l/libmpc-1.2.1-4.el9.src.rpm
     repoid: rhel-9-for-ppc64le-appstream-source-rpms
     size: 846236
@@ -2694,18 +2714,18 @@ arches:
     checksum: sha256:2f5ece89d6a8d892816f386462d8be291ad83f1500b4c4b3655dcc7ed5192c0d
     name: mpdecimal
     evr: 2.5.1-3.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
     repoid: rhel-9-for-ppc64le-appstream-source-rpms
-    size: 45775054
-    checksum: sha256:5955f781730fe817b08b7ddc3d2117a7c0a0c95ed2fd2044cbc1ff7d1eba1b28
+    size: 48516429
+    checksum: sha256:fdb3a4e84c097bb87061fbf6b3f1f11a03b4aa6adf13b0b20cc1d439b5a2c7d7
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/p/python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/p/python3.12-3.12.15-1.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-appstream-source-rpms
-    size: 20886822
-    checksum: sha256:7e01f587203e8d951fb7a38dff1c893cb1a3de5d7e762be6d6623cafd7c7435f
+    size: 20904561
+    checksum: sha256:8a3db1154cbfe206ac68b31268348da6039522d09be22520dd94207417146ebd
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
+    evr: 3.12.15-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/source/SRPMS/Packages/p/python3.12-pip-23.2.1-5.el9.src.rpm
     repoid: rhel-9-for-ppc64le-appstream-source-rpms
     size: 9384965
@@ -2724,12 +2744,12 @@ arches:
     checksum: sha256:b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db
     name: acl
     evr: 2.4.0-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/a/attr-2.5.1-3.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/a/attr-2.6.0-1.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 482234
-    checksum: sha256:5171534e7de11df197f3c5e08658544983198288e04624c739b5c3d9db07b59c
+    size: 389805
+    checksum: sha256:9bdd2e605e0ddc9818382bd95644594fa8b8eedfe08048303093db13cde9963c
     name: attr
-    evr: 2.5.1-3.el9
+    evr: 2.6.0-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/a/audit-3.1.5-8.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 1275064
@@ -2754,12 +2774,12 @@ arches:
     checksum: sha256:82174416ee39df7795da7fab8d37ea5dbbe25f1dbc2df39f5fb3f8a168bf5120
     name: binutils
     evr: 2.35.2-72.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/b/brotli-1.0.9-9.el9_7.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/b/brotli-1.0.9-10.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 517498
-    checksum: sha256:814868e0bec831c79d3e12ff76d31e06e5e62c462a1a4b6607b1f3cab7014438
+    size: 519221
+    checksum: sha256:c833ffbd6c6555543472ef4034a958cf4b8b8dee35b8661b2144ca6fc38908c7
     name: brotli
-    evr: 1.0.9-9.el9_7
+    evr: 1.0.9-10.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/b/bzip2-1.0.8-11.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 828199
@@ -2778,12 +2798,12 @@ arches:
     checksum: sha256:b2618b278f5c8d6dacfae790c8c73b1fc1578b8f64011f325ced5a4a2e3b58bc
     name: chkconfig
     evr: 1.24-2.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.1.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 5696745
-    checksum: sha256:9129bd65888eb0b6d802d8fe912609726af5d1f6347df8a18b243c426dcbb4db
+    size: 5697510
+    checksum: sha256:5852781d2fbb2c447c4425960f4fe30310870a0e4073363d2254047b785b5a9e
     name: coreutils
-    evr: 8.32-41.el9_8
+    evr: 8.32-41.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/c/cracklib-2.9.6-28.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 6416053
@@ -2796,12 +2816,12 @@ arches:
     checksum: sha256:775d926429179caeade6af8dc7dea15a0bea49102c2592d5b712f996a329ec38
     name: crypto-policies
     evr: 20260224-1.gitea0f072.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.5.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 2576796
-    checksum: sha256:5a455f6c35ae1069b8c54ade4c9d0d3d260134f76bee10f22efef9683c31b03f
+    size: 2581541
+    checksum: sha256:303a97cbdfaaac1d709ef7621b2b349dc403da6a553ecfe5e3114f76d757d554
     name: curl
-    evr: 7.76.1-40.el9_8.5
+    evr: 7.76.1-40.el9_8.8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/c/cyrus-sasl-2.1.27-22.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 4025677
@@ -2814,12 +2834,12 @@ arches:
     checksum: sha256:3fe74a2b4fb4485c93e974010d9376e30a63dfcc628bfd6c01837c27b4953912
     name: dbus
     evr: 1:1.12.20-8.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/d/dbus-broker-28-7.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/d/dbus-broker-28-9.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 254475
-    checksum: sha256:aced3097fbb8a424ca1816b8cb3e79960a9ccf7ba139538282886e692c317b29
+    size: 258866
+    checksum: sha256:9ccbb440edb6826689fd5e0d650de4f08550c3c0f3b2732c54c1e99b0d361824
     name: dbus-broker
-    evr: 28-7.el9
+    evr: 28-9.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/d/diffutils-3.7-12.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 1477522
@@ -2838,12 +2858,12 @@ arches:
     checksum: sha256:643279e796ded16c5be5cdc2a91839c787e62e59757008675eb0580a4a42af21
     name: elfutils
     evr: 0.194-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.5.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 8390481
-    checksum: sha256:3ef9a4df767dbc5e75944b5c197d186f8b5ca8745522e07cdf1a195229d381b4
+    size: 8411609
+    checksum: sha256:38d7acfd1130c02c6a00010159a1350ca0f56cd7ed64f3d8394aa5b3d6512ddd
     name: expat
-    evr: 2.5.0-6.el9_8.1
+    evr: 2.5.0-6.el9_8.5
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/f/filesystem-3.16-5.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 20486
@@ -2856,12 +2876,12 @@ arches:
     checksum: sha256:48bd4d4dd081120bcc6ab772b930a150f30b2fc89a4a14a24220383d24a30b3f
     name: findutils
     evr: 1:4.8.0-7.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9_8.1.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 3190934
-    checksum: sha256:37571947707e835d36ceb5641b187aba13ef8f5f605a6762ce72aeea3e745b8d
+    size: 3197459
+    checksum: sha256:8f156f11c96b1720ba2e9e287f2ddf5e0588a9c9ad17753f779ebbdf0c4e99df
     name: gawk
-    evr: 5.1.0-6.el9
+    evr: 5.1.0-6.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/gcc-11.5.0-14.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 81978017
@@ -2874,12 +2894,12 @@ arches:
     checksum: sha256:ad42264274c2a792220395a4dbe736a1de6100c4e14611707ec1dd447583271f
     name: gdbm
     evr: 1:1.23-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/glibc-2.34-275.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/glibc-2.34-283.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 20442764
-    checksum: sha256:bd7a453f66e13da24d073f53070c2d209fcd88ca2aaa24ab3b2f81cae198b46c
+    size: 20462553
+    checksum: sha256:9007b0a97151f43f812049a925cb418753f9fd643fe1283cc7eddc7e6785e2f3
     name: glibc
-    evr: 2.34-275.el9_8
+    evr: 2.34-283.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/gmp-6.2.0-13.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 2503825
@@ -2892,12 +2912,12 @@ arches:
     checksum: sha256:81b14432ebe1645b74b57592f1dcde8fab15ec13632f483f72ff2407ed16c33e
     name: grep
     evr: 3.6-5.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/gzip-1.12-1.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/g/gzip-1.12-2.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 856147
-    checksum: sha256:a05f582ec42e89258ee5e10af96dee4300bcb2a6a69a76bfb5b46f79e6a6a47b
+    size: 859023
+    checksum: sha256:f28fcbe8f3de2ec7dcdb51b1f51f03f61d0afa18c9fef10d210f40ff0c71f3a0
     name: gzip
-    evr: 1.12-1.el9
+    evr: 1.12-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/j/jq-1.6-19.el9_8.2.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 1512470
@@ -2910,12 +2930,12 @@ arches:
     checksum: sha256:c4c76ebfd66ba6d00edf672797d7f077b29d279b7866a04e05258a257a5bc306
     name: json-c
     evr: 0.14-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.39.1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.57.1.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 152374943
-    checksum: sha256:7002d750cf1966a61a9131f2b5b24887816d989509efd27e5a4ed0dc8243e002
+    size: 152563149
+    checksum: sha256:a2660af0b87ac6a4d161ccc76c7d8a8338a44b4fbaad6da9e5529e3027f25aa2
     name: kernel
-    evr: 5.14.0-687.39.1.el9_8
+    evr: 5.14.0-687.57.1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/k/keyutils-1.6.3-1.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 150790
@@ -2964,12 +2984,12 @@ arches:
     checksum: sha256:425009c96135f39ca7bdb8a6ea948187d052d339dd76235979439fbd169da331
     name: libeconf
     evr: 0.4.1-7.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/l/libevent-2.1.12-8.el9_4.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/l/libevent-2.1.13-1.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 1123179
-    checksum: sha256:8c00dc837b8685fc660cc0bcdfd4f533888facaa8c83655c26d2fb068cb7b135
+    size: 1152974
+    checksum: sha256:39aef29e588e3815189ca7b54326a4e1247e8a1f5a44c908ca4325c8cae83acb
     name: libevent
-    evr: 2.1.12-8.el9_4
+    evr: 2.1.13-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/l/libffi-3.4.2-8.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 1367398
@@ -3042,12 +3062,12 @@ arches:
     checksum: sha256:734651070d0113de033da80114b416931c4c0be21ce51f6b1c1641b1185c34f3
     name: libsigsegv
     evr: 2.13-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/l/libssh-0.10.4-18.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/l/libssh-0.10.4-19.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 707007
-    checksum: sha256:e012994887f4f4c4367bce98f2eb5589bfa5c7926d65471cefeee12bee636b1d
+    size: 720407
+    checksum: sha256:83663aff05b77225cded03c63955736eddc0d6ecf6072cb4355563094a2a3250
     name: libssh
-    evr: 0.10.4-18.el9
+    evr: 0.10.4-19.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/l/libtasn1-4.16.0-10.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 1899881
@@ -3132,12 +3152,12 @@ arches:
     checksum: sha256:0d21c12c55d40d1fc2f006c8ec187b5fcc799b794cfd31ed2d98434189c62800
     name: openldap
     evr: 2.6.8-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/o/openssl-3.5.5-6.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/o/openssl-3.5.8-2.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 53369050
-    checksum: sha256:b79f08d2d04536fdb6801b6ba7da7174942d174dd2b7969316402c737689d735
+    size: 53435636
+    checksum: sha256:1e67b59efe228f804c0544a31ab3de0bb4a0c8250d3d5f5fc53a3c7794104795
     name: openssl
-    evr: 1:3.5.5-6.el9_8
+    evr: 1:3.5.8-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 28686020
@@ -3150,24 +3170,30 @@ arches:
     checksum: sha256:6f06a4f6812fce869528ff17ab002d655a8da18fc745eafa6c02594bb23dfeeb
     name: p11-kit
     evr: 0.26.4-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9_8.1.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 1133226
-    checksum: sha256:d88f44d73e9ccb288d75fd5490dc1434b06e88966febed66648775a0b46fb50c
+    size: 1142205
+    checksum: sha256:fe61734fdb226915dff402bcd1ad2002e0fd7a4dad9042af65688804f428b30b
     name: pam
-    evr: 1.5.1-28.el9
+    evr: 1.5.1-28.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/p/pcre-8.44-4.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 1624356
     checksum: sha256:7edbd87b866a3f6e3df1426d660b902e063193d6186027bf99f6d77626a43817
     name: pcre
     evr: 8.44-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/p/pcre2-10.40-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/p/pcre2-10.40-7.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 1789790
-    checksum: sha256:a570f7192be555222aa3704882b9199fb013a84ad4d7dcf40a93d8de2ecf6e0a
+    size: 1805958
+    checksum: sha256:43c40093332890a77f7d7c573a1b540867319bbcaaec5a6dfd73101765dc6ea0
     name: pcre2
-    evr: 10.40-6.el9
+    evr: 10.40-7.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/p/pigz-2.8-1.el9.src.rpm
+    repoid: rhel-9-for-ppc64le-baseos-source-rpms
+    size: 131701
+    checksum: sha256:2eb6030553235feec36ab1406d80066f60ca545bf5a073a43a2a841a70892d2a
+    name: pigz
+    evr: 2.8-1.el9
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/p/pkgconf-1.7.3-10.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 310904
@@ -3210,30 +3236,30 @@ arches:
     checksum: sha256:771a5ed07cdb690c75cd428a8113e2ee471270044e6cb8025d92c54e32c180ff
     name: shadow-utils
     evr: 2:4.9-16.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-10.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-11.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 25116090
-    checksum: sha256:4387ae8d5a5a0b972b7a8612dca277499a43e7991163c7519e8a0ced2e57c90a
+    size: 25117596
+    checksum: sha256:4efcc956008f0468362b41bdba79111c41027b682bcdea3ecca3744cf50ebfd7
     name: sqlite
-    evr: 3.34.1-10.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.4.src.rpm
+    evr: 3.34.1-11.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.6.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 45009674
-    checksum: sha256:e44181d1de2a135a5507b956d18a9eb11951a35aaa9c15dbc0f144ed8313f732
+    size: 45003976
+    checksum: sha256:f535f4c20ed82f56cc7f4c86202e3cd582815f702bb0c24005a07a496ec94c97
     name: systemd
-    evr: 252-67.el9_8.4
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm
+    evr: 252-67.el9_8.6
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 2294162
-    checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6
+    size: 2312101
+    checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c
     name: tar
-    evr: 2:1.34-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm
+    evr: 2:1.34-13.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/t/tzdata-2026e-1.el9_8.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
-    size: 933774
-    checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f
+    size: 943814
+    checksum: sha256:016ab67407e6f67418d8f36c5944396fe82c85896b9e945441f93d3cf1b823b4
     name: tzdata
-    evr: 2026c-1.el9_8
+    evr: 2026e-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/u/util-linux-2.37.4-25.el9.src.rpm
     repoid: rhel-9-for-ppc64le-baseos-source-rpms
     size: 6291867
@@ -3259,10 +3285,10 @@ arches:
     name: zstd
     evr: 1.5.5-1.el9
   module_metadata:
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/repodata/f1b49c35f6842532482b562da4d87cf2f1f45b976bf446e411adeaa17a8d695d-modules.yaml.gz
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/appstream/os/repodata/2b46c0e65a7612308b8149db945f1a1710a6c4491c106262a500f9942b2fc429-modules.yaml.gz
     repoid: rhel-9-for-ppc64le-appstream-rpms
-    size: 63801
-    checksum: sha256:f1b49c35f6842532482b562da4d87cf2f1f45b976bf446e411adeaa17a8d695d
+    size: 70564
+    checksum: sha256:2b46c0e65a7612308b8149db945f1a1710a6c4491c106262a500f9942b2fc429
 - arch: s390x
   packages:
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/c/cpp-11.5.0-14.el9.s390x.rpm
@@ -3272,13 +3298,13 @@ arches:
     name: cpp
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9_8.1.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 216312
-    checksum: sha256:fc71db041e9b749a3f8bcbc9f812509625cfaf5d4fa83d37324c4dbdeb00a36e
+    size: 218106
+    checksum: sha256:4828be3b34d4f1e54ec4b0ff53c1291f18b01be78165e10ec4967b6b061e13d4
     name: gawk-all-langpacks
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/gcc-11.5.0-14.el9.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
     size: 26825105
@@ -3286,62 +3312,62 @@ arches:
     name: gcc
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/glibc-devel-2.34-275.el9_8.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/glibc-devel-2.34-283.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 54280
-    checksum: sha256:afc3171234ba01129468f8e08f175f17454f060961c364bc35a1242ea41b9111
+    size: 54448
+    checksum: sha256:5231ede78f3db9f2a58735cb755f8f930f00f0398c60b809c8d6ca0ed1b231c2
     name: glibc-devel
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/glibc-headers-2.34-275.el9_8.s390x.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/glibc-headers-2.34-283.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 557847
-    checksum: sha256:4d87900e5abc5755b1bf57a4e127d6edddd8f59b1501b5005d0463c3ad3e457d
+    size: 558061
+    checksum: sha256:72bb935c23190ee6b4162cff38de2e5289f55de71e454bcd198624424d3e3d8b
     name: glibc-headers
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/go-toolset-1.26.5-1.el9_8.s390x.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/go-toolset-1.26.7-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 12465
-    checksum: sha256:157c5faa4d40c5890a19e27d6c3064f063eba47ca8b1f6a426627b6425d01321
+    size: 12445
+    checksum: sha256:a0a8e830dc1a6cb78d888682650f74a03e99a3e06f0d9e944f083d58cf479d5e
     name: go-toolset
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-1.26.5-1.el9_8.s390x.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-1.26.7-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 1519629
-    checksum: sha256:5b8e471be65daee3807c8b4d0ecf2d74c31810fe77bd743a44604544efebf075
+    size: 1520127
+    checksum: sha256:1a996cac6c20254f109cc904e8e42866520dd686d85accea215e0e359d9c41d6
     name: golang
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-bin-1.26.5-1.el9_8.s390x.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-bin-1.26.7-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 45137069
-    checksum: sha256:50e9ffabb62ef294a14a96fa58cbc3dff1c78ed612d22fc9f1f2c3ffb94908ca
+    size: 46533766
+    checksum: sha256:948cdcf452abbbd590d9552a1eae7ef061c78bcd717c80d059def1c9db440089
     name: golang-bin
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-race-1.26.5-1.el9_8.s390x.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-race-1.26.7-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 1711739
-    checksum: sha256:e94275b37bb5e73b2fba01d15272ab89a1edbaccbe7853598afcaedfe10be7e5
+    size: 1711787
+    checksum: sha256:cdf8536fbba9d019882ad9e90b0b34d4997077eac595fef7adcb631768f4c492
     name: golang-race
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-src-1.26.5-1.el9_8.noarch.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/g/golang-src-1.26.7-2.el9_8.noarch.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 12881624
-    checksum: sha256:4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0
+    size: 12879471
+    checksum: sha256:ff54c6f194fcf25d743af1af7893242085c798b7ce04056066fee993c2167166
     name: golang-src
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/k/kernel-headers-5.14.0-687.39.1.el9_8.s390x.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/k/kernel-headers-5.14.0-687.57.1.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 2896829
-    checksum: sha256:d709861af2dce7bface9aa0106f30694a80600ef047e627b4b4bcf0e79aea3c5
+    size: 2969965
+    checksum: sha256:33a6f1dfc82b4e4487e3a00df7f49d05a07644da11e9f3ccbf32aca3453837fa
     name: kernel-headers
-    evr: 5.14.0-687.39.1.el9_8
-    sourcerpm: kernel-5.14.0-687.39.1.el9_8.src.rpm
+    evr: 5.14.0-687.57.1.el9_8
+    sourcerpm: kernel-5.14.0-687.57.1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/l/libasan-11.5.0-14.el9.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
     size: 412888
@@ -3391,41 +3417,41 @@ arches:
     name: mpdecimal
     evr: 2.5.1-3.el9
     sourcerpm: mpdecimal-2.5.1-3.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/o/openssl-devel-3.5.5-6.el9_8.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/o/openssl-devel-3.5.8-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 5038202
-    checksum: sha256:c8316fcfae1d02ba21f72428811811f832f0e85ab02d826c44cb79e26966e4fb
+    size: 5050289
+    checksum: sha256:fcd9416c3dfecbd9144d886d183fb0b9633fb05e142fb5cade8ae01874a82396
     name: openssl-devel
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.s390x.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 1851802
-    checksum: sha256:dec726e071d7a3d2fd601eaa3d0dc88797022ebf3145c5d3facfdc5ff6827602
+    size: 2085027
+    checksum: sha256:7c047295d9ae473c18fbbeb9b0ce4a432ae6a75f1a8378d857809cbad2596214
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/postgresql-private-libs-15.18-1.module+el9.8.0+24358+32c5830e.s390x.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/postgresql-private-libs-16.15-1.module+el9.8.0+24803+9dca000b.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 147697
-    checksum: sha256:504ab6379c9051e1b745d0ab259f6957e0a2c0eee3042c9989302229af7dd3cd
+    size: 150732
+    checksum: sha256:fa72693328f1f6fa5958912ca1d048aec07563e4bc7f013ccb1f4050805a8703
     name: postgresql-private-libs
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/python3.12-3.12.13-3.el9_8.1.s390x.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/python3.12-3.12.15-1.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 32622
-    checksum: sha256:1b8026822b4302d08915e55b692f2cf274ed1a537d797d962883a7e8b7fc386a
+    size: 32494
+    checksum: sha256:5056455a54f6c67bab0c0758930535a8364a18b71075ab6e34e37076111c87b5
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/python3.12-libs-3.12.13-3.el9_8.1.s390x.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/python3.12-libs-3.12.15-1.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 9971141
-    checksum: sha256:20b2d5c7372f2f46c180d0e34806c99375326c1bb17afc2f4355715bfa28753d
+    size: 9982480
+    checksum: sha256:d83ff7b955bd7bc2aadbdd44a6f80bbf6004b0c08371db0c7b90945a587e5b78
     name: python3.12-libs
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/Packages/p/python3.12-pip-wheel-23.2.1-5.el9.noarch.rpm
     repoid: rhel-9-for-s390x-appstream-rpms
     size: 1527128
@@ -3503,20 +3529,20 @@ arches:
     name: ca-certificates
     evr: 2025.2.80_v9.0.305-91.el9
     sourcerpm: ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/c/coreutils-8.32-41.el9_8.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/c/coreutils-8.32-41.el9_8.1.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 1206429
-    checksum: sha256:ca42d8e48fa5056805089051e473d693c1eeb2b05b0f47ecc00f6a3a4c10496f
+    size: 1206694
+    checksum: sha256:a86313c10c9310922710ae321145017bc1046a600ad35c528691164fcaba512b
     name: coreutils
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.s390x.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.1.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 2112471
-    checksum: sha256:3eb7d326a40de65cee2458c471b6b8f8a16218452a6d2194c6b6f2eb1c344bb9
+    size: 2117124
+    checksum: sha256:b0f8b8a7b42cb74b9397afb79c98f6614bd2da8331e51081a3d9b7d60623b5d5
     name: coreutils-common
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/c/cracklib-2.9.6-28.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 101566
@@ -3552,13 +3578,13 @@ arches:
     name: dbus
     evr: 1:1.12.20-8.el9
     sourcerpm: dbus-1.12.20-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/d/dbus-broker-28-7.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/d/dbus-broker-28-9.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 169208
-    checksum: sha256:68a4e64a8591df9ae3086014572da3d3b5eb2316a0c2c5e78aaed576c359fd81
+    size: 170185
+    checksum: sha256:d366b1927ddd1322a8b2ad5e9c54a9f7c0ce69be227a20c86a4a660b404991c0
     name: dbus-broker
-    evr: 28-7.el9
-    sourcerpm: dbus-broker-28-7.el9.src.rpm
+    evr: 28-9.el9_8
+    sourcerpm: dbus-broker-28-9.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/d/dbus-common-1.12.20-8.el9.noarch.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 18551
@@ -3601,13 +3627,13 @@ arches:
     name: elfutils-libs
     evr: 0.194-1.el9
     sourcerpm: elfutils-0.194-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/e/expat-2.5.0-6.el9_8.1.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/e/expat-2.5.0-6.el9_8.5.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 123151
-    checksum: sha256:a5b24ad347a1722a948f417a7289a89b1aee9047350e88866173e05157239142
+    size: 125167
+    checksum: sha256:f7480b168cba79b9f30bc54faf1c43b9eab1cd3d9701c31f601b40e472659981
     name: expat
-    evr: 2.5.0-6.el9_8.1
-    sourcerpm: expat-2.5.0-6.el9_8.1.src.rpm
+    evr: 2.5.0-6.el9_8.5
+    sourcerpm: expat-2.5.0-6.el9_8.5.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/f/filesystem-3.16-5.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 5003897
@@ -3622,13 +3648,13 @@ arches:
     name: findutils
     evr: 1:4.8.0-7.el9
     sourcerpm: findutils-4.8.0-7.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/gawk-5.1.0-6.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/gawk-5.1.0-6.el9_8.1.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 1029188
-    checksum: sha256:d34fd3f586240f43f71bc74824ae513cba2e4a6812f0ebbd101122e7e99bafe8
+    size: 1029963
+    checksum: sha256:7382392d06b5e21161966cec0c187bba6afb9710047ab17d79e7b55ce43def40
     name: gawk
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/gdbm-libs-1.23-1.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 60437
@@ -3636,34 +3662,34 @@ arches:
     name: gdbm-libs
     evr: 1:1.23-1.el9
     sourcerpm: gdbm-1.23-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-2.34-275.el9_8.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-2.34-283.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 1790650
-    checksum: sha256:f73a9a19f2139ac3aca555309f1f9d5909a549d1bda684eadbdc9ed95e536407
+    size: 1790814
+    checksum: sha256:7b757b36efa81a2a5ed6e3cd47d1c0df6c1a8b52e9c7975411d308e022bc09fd
     name: glibc
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-common-2.34-275.el9_8.s390x.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-common-2.34-283.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 325700
-    checksum: sha256:cb7edc5131da954868e8053a9203ec7d94375627c1c8b717a3e42e7768b037e1
+    size: 325539
+    checksum: sha256:a240480901672e62f1d3f9b46c4b8beed69fa912d9871ccc11080b0ef35c5fd4
     name: glibc-common
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-gconv-extra-2.34-275.el9_8.s390x.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-gconv-extra-2.34-283.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 1755391
-    checksum: sha256:7959a606ce9cab72ff1f0221e4f1d43a4cdf905a9b49bf868401b9409cc324cc
+    size: 1757088
+    checksum: sha256:e4d30d442cc59041e259199420b8be9e73f6526671983020526586fbbf50b940
     name: glibc-gconv-extra
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-minimal-langpack-2.34-275.el9_8.s390x.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/glibc-minimal-langpack-2.34-283.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 30885
-    checksum: sha256:96398be130a7db017656673be8f39dbd063d0fce335c1eb20b300b6c503e8dbc
+    size: 31037
+    checksum: sha256:86d08f88de137ba5dfef4aff54bbb29b628a9b774f0930423f44fc5a2e340000
     name: glibc-minimal-langpack
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/gmp-6.2.0-13.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 296399
@@ -3678,13 +3704,13 @@ arches:
     name: grep
     evr: 3.6-5.el9
     sourcerpm: grep-3.6-5.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/gzip-1.12-1.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/g/gzip-1.12-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 173101
-    checksum: sha256:50034ee6281864a218a5f3bc47de5afb434400fb8415907fd31d8351adbdc5a6
+    size: 174286
+    checksum: sha256:6a78d3ceeb859f4be0ae548a63556ede364b89cc9e984063e011086e497ae24d
     name: gzip
-    evr: 1.12-1.el9
-    sourcerpm: gzip-1.12-1.el9.src.rpm
+    evr: 1.12-2.el9_8
+    sourcerpm: gzip-1.12-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/j/jq-1.6-19.el9_8.2.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 206781
@@ -3741,13 +3767,13 @@ arches:
     name: libatomic
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libattr-2.5.1-3.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libattr-2.6.0-1.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 20575
-    checksum: sha256:4013df08b49661a8592c2c57428f8040f8e2397379dfc02fa9a125cbf8de44c6
+    size: 23584
+    checksum: sha256:a0bb5b85dfc28983f2522c860fcde0792ec03398f1d39ef019d134b840f88165
     name: libattr
-    evr: 2.5.1-3.el9
-    sourcerpm: attr-2.5.1-3.el9.src.rpm
+    evr: 2.6.0-1.el9_8
+    sourcerpm: attr-2.6.0-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libblkid-2.37.4-25.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 111331
@@ -3755,13 +3781,13 @@ arches:
     name: libblkid
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libbrotli-1.0.9-9.el9_7.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libbrotli-1.0.9-10.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 329308
-    checksum: sha256:ea47c24d8670923c31472fac1c2887ee8124b0a142ffb8a3c4953da8bf65c238
+    size: 329468
+    checksum: sha256:1d94d6401d4dd4c75b96b810046f1918c82460e0c3e9651e98d0e0c810ba0e22
     name: libbrotli
-    evr: 1.0.9-9.el9_7
-    sourcerpm: brotli-1.0.9-9.el9_7.src.rpm
+    evr: 1.0.9-10.el9_8
+    sourcerpm: brotli-1.0.9-10.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libcap-2.48-10.el9_8.1.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 77818
@@ -3783,13 +3809,13 @@ arches:
     name: libcom_err
     evr: 1.46.5-8.el9
     sourcerpm: e2fsprogs-1.46.5-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.5.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 291750
-    checksum: sha256:27ec5fc1d1420007c387595e76ce70f944ac51b19f5afe7b867f4f528da43ee4
+    size: 292806
+    checksum: sha256:fba30ce3801d491bd946c7df555b671f8973fab988413c006abe5874d5547207
     name: libcurl
-    evr: 7.76.1-40.el9_8.5
-    sourcerpm: curl-7.76.1-40.el9_8.5.src.rpm
+    evr: 7.76.1-40.el9_8.8
+    sourcerpm: curl-7.76.1-40.el9_8.8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libdb-5.3.28-57.el9_6.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 721041
@@ -3804,13 +3830,13 @@ arches:
     name: libeconf
     evr: 0.4.1-7.el9_8
     sourcerpm: libeconf-0.4.1-7.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libevent-2.1.12-8.el9_4.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libevent-2.1.13-1.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 264391
-    checksum: sha256:0abf1b13779d3aea3820b2ab76ce687f1f9675e531fb13bfff89ff97a288ba6c
+    size: 267419
+    checksum: sha256:191d3f8958d23f242aea3b332b200653740f6e5d3e78a4608768301ae2fb4155
     name: libevent
-    evr: 2.1.12-8.el9_4
-    sourcerpm: libevent-2.1.12-8.el9_4.src.rpm
+    evr: 2.1.13-1.el9_8
+    sourcerpm: libevent-2.1.13-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libfdisk-2.37.4-25.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 156062
@@ -3937,20 +3963,20 @@ arches:
     name: libsmartcols
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libssh-0.10.4-18.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libssh-0.10.4-19.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 212889
-    checksum: sha256:363b892f5c1a3b50916f93cbc942cb1526d08bace674b9499fe7aeab00637a4c
+    size: 214570
+    checksum: sha256:d8f81f77d6fa830d001ea0336b7b4dfa955bd94e885205f8eb62b21e9439b264
     name: libssh
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libssh-config-0.10.4-18.el9.noarch.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libssh-config-0.10.4-19.el9_8.noarch.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 14685
-    checksum: sha256:ab353cbff2269677fc7364bfcddb8e11537ea83361a0ad642e60eac87ed67fbb
+    size: 14764
+    checksum: sha256:ce06b99793b9e5abc50a58ebc3ef11037f2efbdb5f819a25f8de4994613194d4
     name: libssh-config
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/l/libstdc++-11.5.0-14.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 795149
@@ -4070,13 +4096,13 @@ arches:
     name: openldap
     evr: 2.6.8-4.el9
     sourcerpm: openldap-2.6.8-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/o/openssl-3.5.5-6.el9_8.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/o/openssl-3.5.8-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 1549454
-    checksum: sha256:55ace1358d336a4bc54659df2c4f1317d6638e70dbabc95b83a70d29cf6e113d
+    size: 1554288
+    checksum: sha256:45353765ef5b07378507001e3a16b9752fb25ce4c98fba108fe4272902661c43
     name: openssl
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 14236
@@ -4091,13 +4117,13 @@ arches:
     name: openssl-fips-provider-so
     evr: 3.0.7-11.el9_8
     sourcerpm: openssl-fips-provider-3.0.7-11.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/o/openssl-libs-3.5.5-6.el9_8.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/o/openssl-libs-3.5.8-2.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 2028396
-    checksum: sha256:5f2f1608c0ea78bcbc58c5bd5d4b0c6c5c4acbbc1a1bcde569d2d30e3846d04d
+    size: 2034568
+    checksum: sha256:0c2715769f47c21fdaf465e61ee350d939903cc06f50ee0f2fcb9448809c4f5c
     name: openssl-libs
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/p11-kit-0.26.4-1.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 628346
@@ -4112,13 +4138,13 @@ arches:
     name: p11-kit-trust
     evr: 0.26.4-1.el9_8
     sourcerpm: p11-kit-0.26.4-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pam-1.5.1-28.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pam-1.5.1-28.el9_8.1.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 630422
-    checksum: sha256:25f76128edb27d622927cadb5dc485e0e72c546457598c9cceb4b8364cf53e6a
+    size: 636601
+    checksum: sha256:6ed26e54f724fead3c4368e5da20237b9d61bbd6f6dbe1bc60970a6255cfbb17
     name: pam
-    evr: 1.5.1-28.el9
-    sourcerpm: pam-1.5.1-28.el9.src.rpm
+    evr: 1.5.1-28.el9_8.1
+    sourcerpm: pam-1.5.1-28.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pcre-8.44-4.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 121477
@@ -4126,20 +4152,27 @@ arches:
     name: pcre
     evr: 8.44-4.el9
     sourcerpm: pcre-8.44-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pcre2-10.40-6.el9.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pcre2-10.40-7.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 224385
-    checksum: sha256:b7166437e0179c46304403ddb126fd8a3d6c15d29b33a395b951e54b67697559
+    size: 227201
+    checksum: sha256:fee820347bd080be9dabf5dc7ce23a1d354240703f2665c5791607fcf2b67aec
     name: pcre2
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pcre2-syntax-10.40-6.el9.noarch.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pcre2-syntax-10.40-7.el9_8.noarch.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 147926
-    checksum: sha256:d386b5e9b3a4b077b2ba143882e605750855dd3354f13c55fa12ed26908cb442
+    size: 150069
+    checksum: sha256:e7466a43ef2bfda2b1dc07e855b0db743d48b11c0bdc1402e1d2ea6fb23d33a3
     name: pcre2-syntax
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pigz-2.8-1.el9.s390x.rpm
+    repoid: rhel-9-for-s390x-baseos-rpms
+    size: 96630
+    checksum: sha256:773b977c92e2b5c15ca319ab8392e7a0722dc7cd65434ad93f11269528066037
+    name: pigz
+    evr: 2.8-1.el9
+    sourcerpm: pigz-2.8-1.el9.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/p/pkgconf-1.7.3-10.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 45258
@@ -4210,55 +4243,55 @@ arches:
     name: shadow-utils
     evr: 2:4.9-16.el9
     sourcerpm: shadow-utils-4.9-16.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/sqlite-libs-3.34.1-10.el9_8.s390x.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/sqlite-libs-3.34.1-11.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 652115
-    checksum: sha256:d773b3c1eac55a53efd669c87906804b31cf065a8f9885e6370b739c8f213f9d
+    size: 653093
+    checksum: sha256:5897571d31b7cc9d3e8ef0e7dc9dbf8230bea207c9e926d4fef9fb635ab16f64
     name: sqlite-libs
-    evr: 3.34.1-10.el9_8
-    sourcerpm: sqlite-3.34.1-10.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-252-67.el9_8.4.s390x.rpm
+    evr: 3.34.1-11.el9_8
+    sourcerpm: sqlite-3.34.1-11.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-252-67.el9_8.6.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 4167506
-    checksum: sha256:b2db6892cf6b5e562ebebc828f8b85d709fb9ababf0582492693f3fe75df3be4
+    size: 4148771
+    checksum: sha256:f6522ccf722b7bbc014a3aa935d0a0410a096ab3d9bbcb9b345ed9b0f7f123b4
     name: systemd
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-libs-252-67.el9_8.4.s390x.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-libs-252-67.el9_8.6.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 641241
-    checksum: sha256:d2bf594df308844dcf204aba2c4341249cdc24d13654169755364946d8ec52f0
+    size: 622880
+    checksum: sha256:d851aa92c51f9432358cdb2e6a26b503f54a06154efc1415608a674e44a5ee85
     name: systemd-libs
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-pam-252-67.el9_8.4.s390x.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-pam-252-67.el9_8.6.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 266273
-    checksum: sha256:b52f54b47c27177f53e2344b86ac01f0e10482bc5a1dfae988051502d94df6e0
+    size: 247723
+    checksum: sha256:1043bd2359f6a9f64a90adf15bfe0718b36f2d752df3ead427983a52365e446d
     name: systemd-pam
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.4.noarch.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.6.noarch.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 59475
-    checksum: sha256:7d671ec39a7caeb7346be6d5fcb44212545844ced6f4974c4b409fef6a12a891
+    size: 40844
+    checksum: sha256:974a0352427799559a3e90dcdb38200d767631452cca7717c5b0fbe7760df313
     name: systemd-rpm-macros
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/t/tar-1.34-11.el9.s390x.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/t/tar-1.34-13.el9_8.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 907745
-    checksum: sha256:2eee88e1c470b033bd44432f4ed5b1a41ffc7132ebe51f8ce12fa9268314e841
+    size: 910326
+    checksum: sha256:811cba7426379544fd3fbf6e5a8638bed49132e447b0c536c91e6fd315fac6a0
     name: tar
-    evr: 2:1.34-11.el9
-    sourcerpm: tar-1.34-11.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm
+    evr: 2:1.34-13.el9_8
+    sourcerpm: tar-1.34-13.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/t/tzdata-2026e-1.el9_8.noarch.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
-    size: 933286
-    checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc
+    size: 936099
+    checksum: sha256:c105d92f6cacb9bb8337b77041cedd9c9c906a72c4b5233909b9b69b78f4369f
     name: tzdata
-    evr: 2026c-1.el9_8
-    sourcerpm: tzdata-2026c-1.el9_8.src.rpm
+    evr: 2026e-1.el9_8
+    sourcerpm: tzdata-2026e-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/u/util-linux-2.37.4-25.el9.s390x.rpm
     repoid: rhel-9-for-s390x-baseos-rpms
     size: 2327681
@@ -4288,12 +4321,12 @@ arches:
     evr: 1.2.11-40.el9
     sourcerpm: zlib-1.2.11-40.el9.src.rpm
   source:
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/g/golang-1.26.5-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/g/golang-1.26.7-2.el9_8.src.rpm
     repoid: rhel-9-for-s390x-appstream-source-rpms
-    size: 36513301
-    checksum: sha256:45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf
+    size: 36539286
+    checksum: sha256:7a9ea792be9d09b61bc321ce8b65a040430d06891d6372aeb929753c2f270770
     name: golang
-    evr: 1.26.5-1.el9_8
+    evr: 1.26.7-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/l/libmpc-1.2.1-4.el9.src.rpm
     repoid: rhel-9-for-s390x-appstream-source-rpms
     size: 846236
@@ -4318,18 +4351,18 @@ arches:
     checksum: sha256:2f5ece89d6a8d892816f386462d8be291ad83f1500b4c4b3655dcc7ed5192c0d
     name: mpdecimal
     evr: 2.5.1-3.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
     repoid: rhel-9-for-s390x-appstream-source-rpms
-    size: 45775054
-    checksum: sha256:5955f781730fe817b08b7ddc3d2117a7c0a0c95ed2fd2044cbc1ff7d1eba1b28
+    size: 48516429
+    checksum: sha256:fdb3a4e84c097bb87061fbf6b3f1f11a03b4aa6adf13b0b20cc1d439b5a2c7d7
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/p/python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/p/python3.12-3.12.15-1.el9_8.src.rpm
     repoid: rhel-9-for-s390x-appstream-source-rpms
-    size: 20886822
-    checksum: sha256:7e01f587203e8d951fb7a38dff1c893cb1a3de5d7e762be6d6623cafd7c7435f
+    size: 20904561
+    checksum: sha256:8a3db1154cbfe206ac68b31268348da6039522d09be22520dd94207417146ebd
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
+    evr: 3.12.15-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/source/SRPMS/Packages/p/python3.12-pip-23.2.1-5.el9.src.rpm
     repoid: rhel-9-for-s390x-appstream-source-rpms
     size: 9384965
@@ -4348,12 +4381,12 @@ arches:
     checksum: sha256:b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db
     name: acl
     evr: 2.4.0-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/a/attr-2.5.1-3.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/a/attr-2.6.0-1.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 482234
-    checksum: sha256:5171534e7de11df197f3c5e08658544983198288e04624c739b5c3d9db07b59c
+    size: 389805
+    checksum: sha256:9bdd2e605e0ddc9818382bd95644594fa8b8eedfe08048303093db13cde9963c
     name: attr
-    evr: 2.5.1-3.el9
+    evr: 2.6.0-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/a/audit-3.1.5-8.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 1275064
@@ -4378,12 +4411,12 @@ arches:
     checksum: sha256:82174416ee39df7795da7fab8d37ea5dbbe25f1dbc2df39f5fb3f8a168bf5120
     name: binutils
     evr: 2.35.2-72.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/b/brotli-1.0.9-9.el9_7.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/b/brotli-1.0.9-10.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 517498
-    checksum: sha256:814868e0bec831c79d3e12ff76d31e06e5e62c462a1a4b6607b1f3cab7014438
+    size: 519221
+    checksum: sha256:c833ffbd6c6555543472ef4034a958cf4b8b8dee35b8661b2144ca6fc38908c7
     name: brotli
-    evr: 1.0.9-9.el9_7
+    evr: 1.0.9-10.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/b/bzip2-1.0.8-11.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 828199
@@ -4402,12 +4435,12 @@ arches:
     checksum: sha256:b2618b278f5c8d6dacfae790c8c73b1fc1578b8f64011f325ced5a4a2e3b58bc
     name: chkconfig
     evr: 1.24-2.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.1.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 5696745
-    checksum: sha256:9129bd65888eb0b6d802d8fe912609726af5d1f6347df8a18b243c426dcbb4db
+    size: 5697510
+    checksum: sha256:5852781d2fbb2c447c4425960f4fe30310870a0e4073363d2254047b785b5a9e
     name: coreutils
-    evr: 8.32-41.el9_8
+    evr: 8.32-41.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/c/cracklib-2.9.6-28.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 6416053
@@ -4420,12 +4453,12 @@ arches:
     checksum: sha256:775d926429179caeade6af8dc7dea15a0bea49102c2592d5b712f996a329ec38
     name: crypto-policies
     evr: 20260224-1.gitea0f072.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.5.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 2576796
-    checksum: sha256:5a455f6c35ae1069b8c54ade4c9d0d3d260134f76bee10f22efef9683c31b03f
+    size: 2581541
+    checksum: sha256:303a97cbdfaaac1d709ef7621b2b349dc403da6a553ecfe5e3114f76d757d554
     name: curl
-    evr: 7.76.1-40.el9_8.5
+    evr: 7.76.1-40.el9_8.8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/c/cyrus-sasl-2.1.27-22.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 4025677
@@ -4438,12 +4471,12 @@ arches:
     checksum: sha256:3fe74a2b4fb4485c93e974010d9376e30a63dfcc628bfd6c01837c27b4953912
     name: dbus
     evr: 1:1.12.20-8.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/d/dbus-broker-28-7.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/d/dbus-broker-28-9.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 254475
-    checksum: sha256:aced3097fbb8a424ca1816b8cb3e79960a9ccf7ba139538282886e692c317b29
+    size: 258866
+    checksum: sha256:9ccbb440edb6826689fd5e0d650de4f08550c3c0f3b2732c54c1e99b0d361824
     name: dbus-broker
-    evr: 28-7.el9
+    evr: 28-9.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/d/diffutils-3.7-12.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 1477522
@@ -4462,12 +4495,12 @@ arches:
     checksum: sha256:643279e796ded16c5be5cdc2a91839c787e62e59757008675eb0580a4a42af21
     name: elfutils
     evr: 0.194-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.5.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 8390481
-    checksum: sha256:3ef9a4df767dbc5e75944b5c197d186f8b5ca8745522e07cdf1a195229d381b4
+    size: 8411609
+    checksum: sha256:38d7acfd1130c02c6a00010159a1350ca0f56cd7ed64f3d8394aa5b3d6512ddd
     name: expat
-    evr: 2.5.0-6.el9_8.1
+    evr: 2.5.0-6.el9_8.5
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/f/filesystem-3.16-5.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 20486
@@ -4480,12 +4513,12 @@ arches:
     checksum: sha256:48bd4d4dd081120bcc6ab772b930a150f30b2fc89a4a14a24220383d24a30b3f
     name: findutils
     evr: 1:4.8.0-7.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9_8.1.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 3190934
-    checksum: sha256:37571947707e835d36ceb5641b187aba13ef8f5f605a6762ce72aeea3e745b8d
+    size: 3197459
+    checksum: sha256:8f156f11c96b1720ba2e9e287f2ddf5e0588a9c9ad17753f779ebbdf0c4e99df
     name: gawk
-    evr: 5.1.0-6.el9
+    evr: 5.1.0-6.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/gcc-11.5.0-14.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 81978017
@@ -4498,12 +4531,12 @@ arches:
     checksum: sha256:ad42264274c2a792220395a4dbe736a1de6100c4e14611707ec1dd447583271f
     name: gdbm
     evr: 1:1.23-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/glibc-2.34-275.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/glibc-2.34-283.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 20442764
-    checksum: sha256:bd7a453f66e13da24d073f53070c2d209fcd88ca2aaa24ab3b2f81cae198b46c
+    size: 20462553
+    checksum: sha256:9007b0a97151f43f812049a925cb418753f9fd643fe1283cc7eddc7e6785e2f3
     name: glibc
-    evr: 2.34-275.el9_8
+    evr: 2.34-283.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/gmp-6.2.0-13.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 2503825
@@ -4516,12 +4549,12 @@ arches:
     checksum: sha256:81b14432ebe1645b74b57592f1dcde8fab15ec13632f483f72ff2407ed16c33e
     name: grep
     evr: 3.6-5.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/gzip-1.12-1.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/g/gzip-1.12-2.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 856147
-    checksum: sha256:a05f582ec42e89258ee5e10af96dee4300bcb2a6a69a76bfb5b46f79e6a6a47b
+    size: 859023
+    checksum: sha256:f28fcbe8f3de2ec7dcdb51b1f51f03f61d0afa18c9fef10d210f40ff0c71f3a0
     name: gzip
-    evr: 1.12-1.el9
+    evr: 1.12-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/j/jq-1.6-19.el9_8.2.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 1512470
@@ -4534,12 +4567,12 @@ arches:
     checksum: sha256:c4c76ebfd66ba6d00edf672797d7f077b29d279b7866a04e05258a257a5bc306
     name: json-c
     evr: 0.14-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.39.1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.57.1.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 152374943
-    checksum: sha256:7002d750cf1966a61a9131f2b5b24887816d989509efd27e5a4ed0dc8243e002
+    size: 152563149
+    checksum: sha256:a2660af0b87ac6a4d161ccc76c7d8a8338a44b4fbaad6da9e5529e3027f25aa2
     name: kernel
-    evr: 5.14.0-687.39.1.el9_8
+    evr: 5.14.0-687.57.1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/k/keyutils-1.6.3-1.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 150790
@@ -4588,12 +4621,12 @@ arches:
     checksum: sha256:425009c96135f39ca7bdb8a6ea948187d052d339dd76235979439fbd169da331
     name: libeconf
     evr: 0.4.1-7.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/l/libevent-2.1.12-8.el9_4.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/l/libevent-2.1.13-1.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 1123179
-    checksum: sha256:8c00dc837b8685fc660cc0bcdfd4f533888facaa8c83655c26d2fb068cb7b135
+    size: 1152974
+    checksum: sha256:39aef29e588e3815189ca7b54326a4e1247e8a1f5a44c908ca4325c8cae83acb
     name: libevent
-    evr: 2.1.12-8.el9_4
+    evr: 2.1.13-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/l/libffi-3.4.2-8.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 1367398
@@ -4660,12 +4693,12 @@ arches:
     checksum: sha256:734651070d0113de033da80114b416931c4c0be21ce51f6b1c1641b1185c34f3
     name: libsigsegv
     evr: 2.13-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/l/libssh-0.10.4-18.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/l/libssh-0.10.4-19.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 707007
-    checksum: sha256:e012994887f4f4c4367bce98f2eb5589bfa5c7926d65471cefeee12bee636b1d
+    size: 720407
+    checksum: sha256:83663aff05b77225cded03c63955736eddc0d6ecf6072cb4355563094a2a3250
     name: libssh
-    evr: 0.10.4-18.el9
+    evr: 0.10.4-19.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/l/libtasn1-4.16.0-10.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 1899881
@@ -4750,12 +4783,12 @@ arches:
     checksum: sha256:0d21c12c55d40d1fc2f006c8ec187b5fcc799b794cfd31ed2d98434189c62800
     name: openldap
     evr: 2.6.8-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/o/openssl-3.5.5-6.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/o/openssl-3.5.8-2.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 53369050
-    checksum: sha256:b79f08d2d04536fdb6801b6ba7da7174942d174dd2b7969316402c737689d735
+    size: 53435636
+    checksum: sha256:1e67b59efe228f804c0544a31ab3de0bb4a0c8250d3d5f5fc53a3c7794104795
     name: openssl
-    evr: 1:3.5.5-6.el9_8
+    evr: 1:3.5.8-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 28686020
@@ -4768,24 +4801,30 @@ arches:
     checksum: sha256:6f06a4f6812fce869528ff17ab002d655a8da18fc745eafa6c02594bb23dfeeb
     name: p11-kit
     evr: 0.26.4-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9_8.1.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 1133226
-    checksum: sha256:d88f44d73e9ccb288d75fd5490dc1434b06e88966febed66648775a0b46fb50c
+    size: 1142205
+    checksum: sha256:fe61734fdb226915dff402bcd1ad2002e0fd7a4dad9042af65688804f428b30b
     name: pam
-    evr: 1.5.1-28.el9
+    evr: 1.5.1-28.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/p/pcre-8.44-4.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 1624356
     checksum: sha256:7edbd87b866a3f6e3df1426d660b902e063193d6186027bf99f6d77626a43817
     name: pcre
     evr: 8.44-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/p/pcre2-10.40-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/p/pcre2-10.40-7.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 1789790
-    checksum: sha256:a570f7192be555222aa3704882b9199fb013a84ad4d7dcf40a93d8de2ecf6e0a
+    size: 1805958
+    checksum: sha256:43c40093332890a77f7d7c573a1b540867319bbcaaec5a6dfd73101765dc6ea0
     name: pcre2
-    evr: 10.40-6.el9
+    evr: 10.40-7.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/p/pigz-2.8-1.el9.src.rpm
+    repoid: rhel-9-for-s390x-baseos-source-rpms
+    size: 131701
+    checksum: sha256:2eb6030553235feec36ab1406d80066f60ca545bf5a073a43a2a841a70892d2a
+    name: pigz
+    evr: 2.8-1.el9
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/p/pkgconf-1.7.3-10.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 310904
@@ -4828,30 +4867,30 @@ arches:
     checksum: sha256:771a5ed07cdb690c75cd428a8113e2ee471270044e6cb8025d92c54e32c180ff
     name: shadow-utils
     evr: 2:4.9-16.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-10.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-11.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 25116090
-    checksum: sha256:4387ae8d5a5a0b972b7a8612dca277499a43e7991163c7519e8a0ced2e57c90a
+    size: 25117596
+    checksum: sha256:4efcc956008f0468362b41bdba79111c41027b682bcdea3ecca3744cf50ebfd7
     name: sqlite
-    evr: 3.34.1-10.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.4.src.rpm
+    evr: 3.34.1-11.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.6.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 45009674
-    checksum: sha256:e44181d1de2a135a5507b956d18a9eb11951a35aaa9c15dbc0f144ed8313f732
+    size: 45003976
+    checksum: sha256:f535f4c20ed82f56cc7f4c86202e3cd582815f702bb0c24005a07a496ec94c97
     name: systemd
-    evr: 252-67.el9_8.4
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm
+    evr: 252-67.el9_8.6
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 2294162
-    checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6
+    size: 2312101
+    checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c
     name: tar
-    evr: 2:1.34-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm
+    evr: 2:1.34-13.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/t/tzdata-2026e-1.el9_8.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
-    size: 933774
-    checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f
+    size: 943814
+    checksum: sha256:016ab67407e6f67418d8f36c5944396fe82c85896b9e945441f93d3cf1b823b4
     name: tzdata
-    evr: 2026c-1.el9_8
+    evr: 2026e-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/u/util-linux-2.37.4-25.el9.src.rpm
     repoid: rhel-9-for-s390x-baseos-source-rpms
     size: 6291867
@@ -4877,10 +4916,10 @@ arches:
     name: zstd
     evr: 1.5.5-1.el9
   module_metadata:
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/repodata/ab6506c601ab067e63da15a86b61a3819cc64cba9795e4f3cb0756fc878d535e-modules.yaml.gz
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/appstream/os/repodata/7dc4986dbd0c0869d9d96782d955fa25fd75b6262959b8b115c35b4a58ed5570-modules.yaml.gz
     repoid: rhel-9-for-s390x-appstream-rpms
-    size: 62126
-    checksum: sha256:ab6506c601ab067e63da15a86b61a3819cc64cba9795e4f3cb0756fc878d535e
+    size: 65738
+    checksum: sha256:7dc4986dbd0c0869d9d96782d955fa25fd75b6262959b8b115c35b4a58ed5570
 - arch: x86_64
   packages:
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/c/cpp-11.5.0-14.el9.x86_64.rpm
@@ -4897,13 +4936,13 @@ arches:
     name: delve
     evr: 1.26.1-1.el9_8
     sourcerpm: delve-1.26.1-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/gawk-all-langpacks-5.1.0-6.el9_8.1.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 216340
-    checksum: sha256:c1fcc71c1cc1160d58ace4b60cc6733b68d6f6d406e5ec5ce24327787f452cd1
+    size: 218134
+    checksum: sha256:bedaac1d71ca9f41e3398dc413dea2008bfd20799de1b4db14e37ebb7a7ce74d
     name: gawk-all-langpacks
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/gcc-11.5.0-14.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
     size: 33982584
@@ -4911,62 +4950,62 @@ arches:
     name: gcc
     evr: 11.5.0-14.el9
     sourcerpm: gcc-11.5.0-14.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/glibc-devel-2.34-275.el9_8.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/glibc-devel-2.34-283.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 46499
-    checksum: sha256:a3b6ed698d21192fa7c421094a5d6648411fba4252db28c96d629778c86e6cd5
+    size: 46663
+    checksum: sha256:5f47e3ae6aea8fde6cbb02357463b3e8c884971284267ced3806b16a93a5c2e5
     name: glibc-devel
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/glibc-headers-2.34-275.el9_8.x86_64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/glibc-headers-2.34-283.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 567171
-    checksum: sha256:2124192aba2e7931cdf00c2dcd4b70b71b313790c28dcf09b2fb09cc9831c86f
+    size: 567260
+    checksum: sha256:796a7079041c288eec9e74437c2f9f85513c0dfade393877a9281828bb55e966
     name: glibc-headers
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/go-toolset-1.26.5-1.el9_8.x86_64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/go-toolset-1.26.7-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 12505
-    checksum: sha256:6fe04126a34d4802ec9271403682b126f8861d88aefec0ddbaca7da483bf39e8
+    size: 12485
+    checksum: sha256:d90108b27b68942ac00068421d4cb3551320fb8345bdabf5684d6868dca0b25c
     name: go-toolset
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-1.26.5-1.el9_8.x86_64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-1.26.7-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 1520284
-    checksum: sha256:ffb6333998d5c61e80202fe8fa5b427a8dbf126b2b5cebf4e687e269669c1dbe
+    size: 1519594
+    checksum: sha256:120adc77ba187e12ba0f564e989ad2a495a3cd4db854ff8950bb0fa820d440d3
     name: golang
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-bin-1.26.5-1.el9_8.x86_64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-bin-1.26.7-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 46263591
-    checksum: sha256:f177bf6c26824c1a20693eb8e2d2a16b42977a7d9f3bd288b508afad65812564
+    size: 47210487
+    checksum: sha256:d62137e48551c075bf6addd0946a49d833a63e57eee66199220a2102039abc32
     name: golang-bin
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-race-1.26.5-1.el9_8.x86_64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-race-1.26.7-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 1743103
-    checksum: sha256:00c68c81e26c9acc38d80b838f0e782bb587a28757e7f11ecd725c4499ea0777
+    size: 1743083
+    checksum: sha256:afbb626a86be3ed06007041a4d1c9c1fc82ab06d79ab9e8e1f32ece08427290a
     name: golang-race
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-src-1.26.5-1.el9_8.noarch.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/g/golang-src-1.26.7-2.el9_8.noarch.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 12881624
-    checksum: sha256:4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0
+    size: 12879471
+    checksum: sha256:ff54c6f194fcf25d743af1af7893242085c798b7ce04056066fee993c2167166
     name: golang-src
-    evr: 1.26.5-1.el9_8
-    sourcerpm: golang-1.26.5-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/k/kernel-headers-5.14.0-687.39.1.el9_8.x86_64.rpm
+    evr: 1.26.7-2.el9_8
+    sourcerpm: golang-1.26.7-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/k/kernel-headers-5.14.0-687.57.1.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 2906125
-    checksum: sha256:978a5d84f2c2e74a7ec915f71eea4dd5fb3a72a15fe9aea192cc47be32e7f671
+    size: 2979225
+    checksum: sha256:c5766b2f8e4531f824575546028de7d8eb9fa95d7246dfafd4883c58312a2ef2
     name: kernel-headers
-    evr: 5.14.0-687.39.1.el9_8
-    sourcerpm: kernel-5.14.0-687.39.1.el9_8.src.rpm
+    evr: 5.14.0-687.57.1.el9_8
+    sourcerpm: kernel-5.14.0-687.57.1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/l/libmpc-1.2.1-4.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
     size: 66075
@@ -5002,41 +5041,41 @@ arches:
     name: mpdecimal
     evr: 2.5.1-3.el9
     sourcerpm: mpdecimal-2.5.1-3.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/o/openssl-devel-3.5.5-6.el9_8.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/o/openssl-devel-3.5.8-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 5029526
-    checksum: sha256:84e54b3467ecfe70c75688f28dbc0e071e268d845db17b28a1f35a35d45640cd
+    size: 5050455
+    checksum: sha256:72a693633446cd95202dd926109bf25aeb8ace8d91a630583f6d25e0ce10c0f3
     name: openssl-devel
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.x86_64.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 1832108
-    checksum: sha256:1f2f8e5526bac45da979c876fbb9a069459ec5a6476d89398433048005fb786b
+    size: 2067493
+    checksum: sha256:f078cf1183f6bb750e39cdcab4d2ecb3f936d745b7360b741a6919e926855ad7
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/postgresql-private-libs-15.18-1.module+el9.8.0+24358+32c5830e.x86_64.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/postgresql-private-libs-16.15-1.module+el9.8.0+24803+9dca000b.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 154248
-    checksum: sha256:a8fca7c9e1d9cf9aa6eb95fd39e90068960190b40cac303f546930cab667ae11
+    size: 153488
+    checksum: sha256:f36cf284eb08753b6b2576f8eed63c8c2651ef82e618fe1641a6b0ff4cd2d4ca
     name: postgresql-private-libs
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-    sourcerpm: postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/python3.12-3.12.13-3.el9_8.1.x86_64.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+    sourcerpm: postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/python3.12-3.12.15-1.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 32810
-    checksum: sha256:e3824eb610d0a5c444a9c49462dcd3c31e9ef2ce0b6f42f5b75e0d492a64deb6
+    size: 32669
+    checksum: sha256:819f912b87f620c462ab6500eea6ac8acf1c41c395af39746c30db2ab84e5629
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/python3.12-libs-3.12.13-3.el9_8.1.x86_64.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/python3.12-libs-3.12.15-1.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 10207533
-    checksum: sha256:2135bca6d950ad5e8b3cc18e370fdeeedbe7bff413362247b28e0336d3bccb9d
+    size: 10213038
+    checksum: sha256:d2791de143c4172a6a2c272521071f580a78d3527781e074d8d2405de66fda2c
     name: python3.12-libs
-    evr: 3.12.13-3.el9_8.1
-    sourcerpm: python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 3.12.15-1.el9_8
+    sourcerpm: python3.12-3.12.15-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/Packages/p/python3.12-pip-wheel-23.2.1-5.el9.noarch.rpm
     repoid: rhel-9-for-x86_64-appstream-rpms
     size: 1527128
@@ -5114,20 +5153,20 @@ arches:
     name: ca-certificates
     evr: 2025.2.80_v9.0.305-91.el9
     sourcerpm: ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/c/coreutils-8.32-41.el9_8.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/c/coreutils-8.32-41.el9_8.1.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 1220715
-    checksum: sha256:e53f0f831246c73ab03ae395054d261ae392faa1229e6c691c08d2321a824b75
+    size: 1222083
+    checksum: sha256:374257c4cd69107333a7f524dd99579f3ea3ab842b66168eade0a3475fb6eea1
     name: coreutils
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.x86_64.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.1.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 2116611
-    checksum: sha256:1d4010cdc4f0fb7a4be68bf1bf0f0cda84a11d7337bd15d8368ab0ff90ca0db4
+    size: 2113503
+    checksum: sha256:41f69eb8b2087feaa98d0228fb933b6fe8af20a4bf371cfef51e11cbd1f84b4e
     name: coreutils-common
-    evr: 8.32-41.el9_8
-    sourcerpm: coreutils-8.32-41.el9_8.src.rpm
+    evr: 8.32-41.el9_8.1
+    sourcerpm: coreutils-8.32-41.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/c/cracklib-2.9.6-28.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 102444
@@ -5163,13 +5202,13 @@ arches:
     name: dbus
     evr: 1:1.12.20-8.el9
     sourcerpm: dbus-1.12.20-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/d/dbus-broker-28-7.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/d/dbus-broker-28-9.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 179634
-    checksum: sha256:de9869c08df7f6952787d0335b9bf1a09b328bea920556a59af07c8e085dd3cb
+    size: 180434
+    checksum: sha256:2c3b853f8548394af581f487d3682e3e6a4fd27bb451088ce278c7f00af454db
     name: dbus-broker
-    evr: 28-7.el9
-    sourcerpm: dbus-broker-28-7.el9.src.rpm
+    evr: 28-9.el9_8
+    sourcerpm: dbus-broker-28-9.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/d/dbus-common-1.12.20-8.el9.noarch.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 18551
@@ -5212,13 +5251,13 @@ arches:
     name: elfutils-libs
     evr: 0.194-1.el9
     sourcerpm: elfutils-0.194-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/e/expat-2.5.0-6.el9_8.1.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/e/expat-2.5.0-6.el9_8.5.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 126909
-    checksum: sha256:6a0c98d67b643fe620297e4cd7e990f99a86ed6bc90a8295a952c626ecbb9f62
+    size: 129088
+    checksum: sha256:e6e7edd632fdd1dc4ad94b19b7ab88646f3ef8c1c7956bac58985c3e7118a362
     name: expat
-    evr: 2.5.0-6.el9_8.1
-    sourcerpm: expat-2.5.0-6.el9_8.1.src.rpm
+    evr: 2.5.0-6.el9_8.5
+    sourcerpm: expat-2.5.0-6.el9_8.5.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/f/filesystem-3.16-5.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 5003807
@@ -5233,13 +5272,13 @@ arches:
     name: findutils
     evr: 1:4.8.0-7.el9
     sourcerpm: findutils-4.8.0-7.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/gawk-5.1.0-6.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/gawk-5.1.0-6.el9_8.1.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 1045534
-    checksum: sha256:99fda6725a2c668bae29fbab74d1b347e074f4e8c8ed18d656cb928fb6fc92b7
+    size: 1046649
+    checksum: sha256:fcc5e724c32597cf781626728f0faff2f0e5ed6455ab95af4883eefca30a074e
     name: gawk
-    evr: 5.1.0-6.el9
-    sourcerpm: gawk-5.1.0-6.el9.src.rpm
+    evr: 5.1.0-6.el9_8.1
+    sourcerpm: gawk-5.1.0-6.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/gdbm-libs-1.23-1.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 60152
@@ -5247,34 +5286,34 @@ arches:
     name: gdbm-libs
     evr: 1:1.23-1.el9
     sourcerpm: gdbm-1.23-1.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-2.34-275.el9_8.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-2.34-283.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 2083064
-    checksum: sha256:7d2d420b97c05c09ee1e9bd881cb0725fe8d89688b933f411f278cb23210c65d
+    size: 2083811
+    checksum: sha256:ac0a85530d147cc35d56422d2f6eab14800eec63c6d5318f2bef576252426939
     name: glibc
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-common-2.34-275.el9_8.x86_64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-common-2.34-283.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 321585
-    checksum: sha256:f23581b888783f576bd3a55503618a48f74f468fcfd4837bbd7a2d00fe7f3530
+    size: 321942
+    checksum: sha256:87a1528415c5a1680faf8a816bf4a79e423f1b13c9a7d1aac387a5080ea48738
     name: glibc-common
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-gconv-extra-2.34-275.el9_8.x86_64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-gconv-extra-2.34-283.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 1763577
-    checksum: sha256:91899acba57caeb8768bf2ce4631d7f56c6b8e052f2bdf20003382205eb8eee8
+    size: 1767979
+    checksum: sha256:d421d4318c25a5817f72f4547b0be36c6be99303138a738080cdbe161577d31a
     name: glibc-gconv-extra
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-minimal-langpack-2.34-275.el9_8.x86_64.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/glibc-minimal-langpack-2.34-283.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 30913
-    checksum: sha256:6cc48d78bf2ceacfa5b58633b648c564b66505f4677adea8eb663fe90acd76f2
+    size: 31065
+    checksum: sha256:4031293a63d3851b03969172779a9b0f6669e00a544c80425c9eae74e08c70b0
     name: glibc-minimal-langpack
-    evr: 2.34-275.el9_8
-    sourcerpm: glibc-2.34-275.el9_8.src.rpm
+    evr: 2.34-283.el9_8
+    sourcerpm: glibc-2.34-283.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/gmp-6.2.0-13.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 326840
@@ -5289,13 +5328,13 @@ arches:
     name: grep
     evr: 3.6-5.el9
     sourcerpm: grep-3.6-5.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/gzip-1.12-1.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/g/gzip-1.12-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 171206
-    checksum: sha256:c8b3e0414d55b1eedb0185a564ac6cb2368bee2fd5f995447d045f6a714488ac
+    size: 172571
+    checksum: sha256:a87bdcce45011f232758c01bd99c564b5f6b549d391646cc573a132d22604b85
     name: gzip
-    evr: 1.12-1.el9
-    sourcerpm: gzip-1.12-1.el9.src.rpm
+    evr: 1.12-2.el9_8
+    sourcerpm: gzip-1.12-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/j/jq-1.6-19.el9_8.2.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 197453
@@ -5345,13 +5384,13 @@ arches:
     name: libacl
     evr: 2.4.0-1.el9_8
     sourcerpm: acl-2.4.0-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libattr-2.5.1-3.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libattr-2.6.0-1.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 20786
-    checksum: sha256:6519f028915fbd7ee0474f0bf4e98e35f04b5d0cf7be9f66c0cb9eafac0b8c5a
+    size: 23752
+    checksum: sha256:9e37537f690c748f7f05faa80966072f118ec722e38ef332fe19cf22b087349f
     name: libattr
-    evr: 2.5.1-3.el9
-    sourcerpm: attr-2.5.1-3.el9.src.rpm
+    evr: 2.6.0-1.el9_8
+    sourcerpm: attr-2.6.0-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libblkid-2.37.4-25.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 114192
@@ -5359,13 +5398,13 @@ arches:
     name: libblkid
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libbrotli-1.0.9-9.el9_7.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libbrotli-1.0.9-10.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 326278
-    checksum: sha256:81096e6aed022489306e2fe1d1496b2b689d8f0bf6c70a94b5bddb82356eeda1
+    size: 326501
+    checksum: sha256:ecf2cda794cb9f68a7f67742ce0aeef4c3480795cce0e9bc8f49634072fd2e07
     name: libbrotli
-    evr: 1.0.9-9.el9_7
-    sourcerpm: brotli-1.0.9-9.el9_7.src.rpm
+    evr: 1.0.9-10.el9_8
+    sourcerpm: brotli-1.0.9-10.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libcap-2.48-10.el9_8.1.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 78928
@@ -5387,13 +5426,13 @@ arches:
     name: libcom_err
     evr: 1.46.5-8.el9
     sourcerpm: e2fsprogs-1.46.5-8.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.5.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libcurl-7.76.1-40.el9_8.8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 297551
-    checksum: sha256:428b87ca3eb808d769f6f0f68019a97d3c487c86268ccff2ab7ad7223beab01e
+    size: 297409
+    checksum: sha256:cc12ee8e4fb07d93ad55dc59406ff65a3acbb795b3eca30b32195e51b3a12965
     name: libcurl
-    evr: 7.76.1-40.el9_8.5
-    sourcerpm: curl-7.76.1-40.el9_8.5.src.rpm
+    evr: 7.76.1-40.el9_8.8
+    sourcerpm: curl-7.76.1-40.el9_8.8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libdb-5.3.28-57.el9_6.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 755192
@@ -5408,13 +5447,13 @@ arches:
     name: libeconf
     evr: 0.4.1-7.el9_8
     sourcerpm: libeconf-0.4.1-7.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libevent-2.1.12-8.el9_4.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libevent-2.1.13-1.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 272588
-    checksum: sha256:072426910a254b797bbe977b3397ab90513911d020580a0135179f700a48df44
+    size: 276162
+    checksum: sha256:c28b28573118d5cf0f1f68d96bc7c46d56671e45360698c894ca06ddf40163ae
     name: libevent
-    evr: 2.1.12-8.el9_4
-    sourcerpm: libevent-2.1.12-8.el9_4.src.rpm
+    evr: 2.1.13-1.el9_8
+    sourcerpm: libevent-2.1.13-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libfdisk-2.37.4-25.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 161769
@@ -5541,20 +5580,20 @@ arches:
     name: libsmartcols
     evr: 2.37.4-25.el9
     sourcerpm: util-linux-2.37.4-25.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libssh-0.10.4-18.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libssh-0.10.4-19.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 225119
-    checksum: sha256:4a3ec8a0cc0d4f693a876c522d3e4bc2296180b9ec05f958f6a0aa8658702458
+    size: 225821
+    checksum: sha256:10d0ecb7cef182f8d11eb4bc772943a60c48b8171f602ffd83bb79b9edf5eb44
     name: libssh
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libssh-config-0.10.4-18.el9.noarch.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libssh-config-0.10.4-19.el9_8.noarch.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 14685
-    checksum: sha256:ab353cbff2269677fc7364bfcddb8e11537ea83361a0ad642e60eac87ed67fbb
+    size: 14764
+    checksum: sha256:ce06b99793b9e5abc50a58ebc3ef11037f2efbdb5f819a25f8de4994613194d4
     name: libssh-config
-    evr: 0.10.4-18.el9
-    sourcerpm: libssh-0.10.4-18.el9.src.rpm
+    evr: 0.10.4-19.el9_8
+    sourcerpm: libssh-0.10.4-19.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/l/libstdc++-11.5.0-14.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 763021
@@ -5674,13 +5713,13 @@ arches:
     name: openldap
     evr: 2.6.8-4.el9
     sourcerpm: openldap-2.6.8-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/o/openssl-3.5.5-6.el9_8.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/o/openssl-3.5.8-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 1564334
-    checksum: sha256:1c502507f42674119318b66b111448f618efe2767a55edde5fadddcecb47ac64
+    size: 1570074
+    checksum: sha256:4a560a738babd422ff2ba6077da7abfe1b9ce5ef89c056ec5f693334dbebf928
     name: openssl
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 14256
@@ -5695,13 +5734,13 @@ arches:
     name: openssl-fips-provider-so
     evr: 3.0.7-11.el9_8
     sourcerpm: openssl-fips-provider-3.0.7-11.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/o/openssl-libs-3.5.5-6.el9_8.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/o/openssl-libs-3.5.8-2.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 2427181
-    checksum: sha256:a289cdf4da547031cd39a4f31decd0bb22649bbcb5fe4f88b939d341a83708be
+    size: 2431317
+    checksum: sha256:6448671d67b300025edac8382995707a0763ae0843e097cbe717d1cbc29817e2
     name: openssl-libs
-    evr: 1:3.5.5-6.el9_8
-    sourcerpm: openssl-3.5.5-6.el9_8.src.rpm
+    evr: 1:3.5.8-2.el9_8
+    sourcerpm: openssl-3.5.8-2.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/p11-kit-0.26.4-1.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 625862
@@ -5716,13 +5755,13 @@ arches:
     name: p11-kit-trust
     evr: 0.26.4-1.el9_8
     sourcerpm: p11-kit-0.26.4-1.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pam-1.5.1-28.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pam-1.5.1-28.el9_8.1.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 637912
-    checksum: sha256:15a0a5000af6f57f47c30682f7aacf3959903788e68255132b6a05bb4b713ab1
+    size: 645147
+    checksum: sha256:9285aea93392dada0c8399b7d8a1c85ce7a6fdafd2fb5264727448549c15637c
     name: pam
-    evr: 1.5.1-28.el9
-    sourcerpm: pam-1.5.1-28.el9.src.rpm
+    evr: 1.5.1-28.el9_8.1
+    sourcerpm: pam-1.5.1-28.el9_8.1.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pcre-8.44-4.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 205261
@@ -5730,20 +5769,27 @@ arches:
     name: pcre
     evr: 8.44-4.el9
     sourcerpm: pcre-8.44-4.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pcre2-10.40-6.el9.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pcre2-10.40-7.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 241900
-    checksum: sha256:75db1e5a50e7b1794d7ba18212d95cd2684559da9e7c52eee46490302c7f24dd
+    size: 244785
+    checksum: sha256:ef2c65a463e1ef1bfbf3d9ee66986e14cca0fbae88343f099dd5b16619276f1f
     name: pcre2
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pcre2-syntax-10.40-6.el9.noarch.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pcre2-syntax-10.40-7.el9_8.noarch.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 147926
-    checksum: sha256:d386b5e9b3a4b077b2ba143882e605750855dd3354f13c55fa12ed26908cb442
+    size: 150069
+    checksum: sha256:e7466a43ef2bfda2b1dc07e855b0db743d48b11c0bdc1402e1d2ea6fb23d33a3
     name: pcre2-syntax
-    evr: 10.40-6.el9
-    sourcerpm: pcre2-10.40-6.el9.src.rpm
+    evr: 10.40-7.el9_8
+    sourcerpm: pcre2-10.40-7.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pigz-2.8-1.el9.x86_64.rpm
+    repoid: rhel-9-for-x86_64-baseos-rpms
+    size: 99148
+    checksum: sha256:3d468520034285d071ad3ae5cdf8726d88e66a24c41aa6d4bd7919a3e32a0cd3
+    name: pigz
+    evr: 2.8-1.el9
+    sourcerpm: pigz-2.8-1.el9.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/p/pkgconf-1.7.3-10.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 45675
@@ -5814,55 +5860,55 @@ arches:
     name: shadow-utils
     evr: 2:4.9-16.el9
     sourcerpm: shadow-utils-4.9-16.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/sqlite-libs-3.34.1-10.el9_8.x86_64.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/sqlite-libs-3.34.1-11.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 664960
-    checksum: sha256:7dc2202e08184890c851dcb2218a9abce14da150f12dfb8663ca306416e1d8d4
+    size: 665095
+    checksum: sha256:e5c20e933ec01f746a6c59a94cb99f46c6138dab3f387f0d02dab47f356e2e98
     name: sqlite-libs
-    evr: 3.34.1-10.el9_8
-    sourcerpm: sqlite-3.34.1-10.el9_8.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-252-67.el9_8.4.x86_64.rpm
+    evr: 3.34.1-11.el9_8
+    sourcerpm: sqlite-3.34.1-11.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-252-67.el9_8.6.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 4401138
-    checksum: sha256:e3cbe70aaa847f1b02bd4ea9470625434c26b25368cbfcb0e9a18de99e3bc1c7
+    size: 4383786
+    checksum: sha256:025ffe42235a9d4d40138bab7511995392d2a50ba6912be97b47e634b15823b8
     name: systemd
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-libs-252-67.el9_8.4.x86_64.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-libs-252-67.el9_8.6.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 681056
-    checksum: sha256:ca5a11f102b0e3a32fdddf017a4509984db83290d7364c9566d037d0ef7f1e66
+    size: 662007
+    checksum: sha256:d491d7375ed820bf4fa0d5f6d80a6f1a72cfa6ff31e79dabf9288246061cf88e
     name: systemd-libs
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-pam-252-67.el9_8.4.x86_64.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-pam-252-67.el9_8.6.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 276960
-    checksum: sha256:de8408dbe8ee06afa99fbb914377384774e27b9b337cb3b491a37f84ccca7e9b
+    size: 258340
+    checksum: sha256:eb780b309cd671d4b3bec7d3b31bf148179e527d7222663544470310f4cb43ee
     name: systemd-pam
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.4.noarch.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.6.noarch.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 59475
-    checksum: sha256:7d671ec39a7caeb7346be6d5fcb44212545844ced6f4974c4b409fef6a12a891
+    size: 40844
+    checksum: sha256:974a0352427799559a3e90dcdb38200d767631452cca7717c5b0fbe7760df313
     name: systemd-rpm-macros
-    evr: 252-67.el9_8.4
-    sourcerpm: systemd-252-67.el9_8.4.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/t/tar-1.34-11.el9.x86_64.rpm
+    evr: 252-67.el9_8.6
+    sourcerpm: systemd-252-67.el9_8.6.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/t/tar-1.34-13.el9_8.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 913256
-    checksum: sha256:58b622ab7bc225731a2473e677f16c9eb51b1ed218a86a7aa039a6fed665f245
+    size: 914200
+    checksum: sha256:913d84cd94463e3f0400d80c6742a2974eeab6445ac71ff9eb802a70779c146f
     name: tar
-    evr: 2:1.34-11.el9
-    sourcerpm: tar-1.34-11.el9.src.rpm
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm
+    evr: 2:1.34-13.el9_8
+    sourcerpm: tar-1.34-13.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/t/tzdata-2026e-1.el9_8.noarch.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
-    size: 933286
-    checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc
+    size: 936099
+    checksum: sha256:c105d92f6cacb9bb8337b77041cedd9c9c906a72c4b5233909b9b69b78f4369f
     name: tzdata
-    evr: 2026c-1.el9_8
-    sourcerpm: tzdata-2026c-1.el9_8.src.rpm
+    evr: 2026e-1.el9_8
+    sourcerpm: tzdata-2026e-1.el9_8.src.rpm
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/u/util-linux-2.37.4-25.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-rpms
     size: 2382511
@@ -5898,12 +5944,12 @@ arches:
     checksum: sha256:5fa267daa0e7df3e072c17e81db41b809b256da8cfb0372669d9a1bea937a01a
     name: delve
     evr: 1.26.1-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/g/golang-1.26.5-1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/g/golang-1.26.7-2.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-appstream-source-rpms
-    size: 36513301
-    checksum: sha256:45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf
+    size: 36539286
+    checksum: sha256:7a9ea792be9d09b61bc321ce8b65a040430d06891d6372aeb929753c2f270770
     name: golang
-    evr: 1.26.5-1.el9_8
+    evr: 1.26.7-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/l/libmpc-1.2.1-4.el9.src.rpm
     repoid: rhel-9-for-x86_64-appstream-source-rpms
     size: 846236
@@ -5928,18 +5974,18 @@ arches:
     checksum: sha256:2f5ece89d6a8d892816f386462d8be291ad83f1500b4c4b3655dcc7ed5192c0d
     name: mpdecimal
     evr: 2.5.1-3.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/p/postgresql-15.18-1.module+el9.8.0+24358+32c5830e.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/p/postgresql-16.15-1.module+el9.8.0+24803+9dca000b.src.rpm
     repoid: rhel-9-for-x86_64-appstream-source-rpms
-    size: 45775054
-    checksum: sha256:5955f781730fe817b08b7ddc3d2117a7c0a0c95ed2fd2044cbc1ff7d1eba1b28
+    size: 48516429
+    checksum: sha256:fdb3a4e84c097bb87061fbf6b3f1f11a03b4aa6adf13b0b20cc1d439b5a2c7d7
     name: postgresql
-    evr: 15.18-1.module+el9.8.0+24358+32c5830e
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/p/python3.12-3.12.13-3.el9_8.1.src.rpm
+    evr: 16.15-1.module+el9.8.0+24803+9dca000b
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/p/python3.12-3.12.15-1.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-appstream-source-rpms
-    size: 20886822
-    checksum: sha256:7e01f587203e8d951fb7a38dff1c893cb1a3de5d7e762be6d6623cafd7c7435f
+    size: 20904561
+    checksum: sha256:8a3db1154cbfe206ac68b31268348da6039522d09be22520dd94207417146ebd
     name: python3.12
-    evr: 3.12.13-3.el9_8.1
+    evr: 3.12.15-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/source/SRPMS/Packages/p/python3.12-pip-23.2.1-5.el9.src.rpm
     repoid: rhel-9-for-x86_64-appstream-source-rpms
     size: 9384965
@@ -5958,12 +6004,12 @@ arches:
     checksum: sha256:b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db
     name: acl
     evr: 2.4.0-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/a/attr-2.5.1-3.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/a/attr-2.6.0-1.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 482234
-    checksum: sha256:5171534e7de11df197f3c5e08658544983198288e04624c739b5c3d9db07b59c
+    size: 389805
+    checksum: sha256:9bdd2e605e0ddc9818382bd95644594fa8b8eedfe08048303093db13cde9963c
     name: attr
-    evr: 2.5.1-3.el9
+    evr: 2.6.0-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/a/audit-3.1.5-8.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 1275064
@@ -5988,12 +6034,12 @@ arches:
     checksum: sha256:82174416ee39df7795da7fab8d37ea5dbbe25f1dbc2df39f5fb3f8a168bf5120
     name: binutils
     evr: 2.35.2-72.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/b/brotli-1.0.9-9.el9_7.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/b/brotli-1.0.9-10.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 517498
-    checksum: sha256:814868e0bec831c79d3e12ff76d31e06e5e62c462a1a4b6607b1f3cab7014438
+    size: 519221
+    checksum: sha256:c833ffbd6c6555543472ef4034a958cf4b8b8dee35b8661b2144ca6fc38908c7
     name: brotli
-    evr: 1.0.9-9.el9_7
+    evr: 1.0.9-10.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/b/bzip2-1.0.8-11.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 828199
@@ -6012,12 +6058,12 @@ arches:
     checksum: sha256:b2618b278f5c8d6dacfae790c8c73b1fc1578b8f64011f325ced5a4a2e3b58bc
     name: chkconfig
     evr: 1.24-2.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.1.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 5696745
-    checksum: sha256:9129bd65888eb0b6d802d8fe912609726af5d1f6347df8a18b243c426dcbb4db
+    size: 5697510
+    checksum: sha256:5852781d2fbb2c447c4425960f4fe30310870a0e4073363d2254047b785b5a9e
     name: coreutils
-    evr: 8.32-41.el9_8
+    evr: 8.32-41.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/c/cracklib-2.9.6-28.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 6416053
@@ -6030,12 +6076,12 @@ arches:
     checksum: sha256:775d926429179caeade6af8dc7dea15a0bea49102c2592d5b712f996a329ec38
     name: crypto-policies
     evr: 20260224-1.gitea0f072.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.5.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/c/curl-7.76.1-40.el9_8.8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 2576796
-    checksum: sha256:5a455f6c35ae1069b8c54ade4c9d0d3d260134f76bee10f22efef9683c31b03f
+    size: 2581541
+    checksum: sha256:303a97cbdfaaac1d709ef7621b2b349dc403da6a553ecfe5e3114f76d757d554
     name: curl
-    evr: 7.76.1-40.el9_8.5
+    evr: 7.76.1-40.el9_8.8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/c/cyrus-sasl-2.1.27-22.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 4025677
@@ -6048,12 +6094,12 @@ arches:
     checksum: sha256:3fe74a2b4fb4485c93e974010d9376e30a63dfcc628bfd6c01837c27b4953912
     name: dbus
     evr: 1:1.12.20-8.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/d/dbus-broker-28-7.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/d/dbus-broker-28-9.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 254475
-    checksum: sha256:aced3097fbb8a424ca1816b8cb3e79960a9ccf7ba139538282886e692c317b29
+    size: 258866
+    checksum: sha256:9ccbb440edb6826689fd5e0d650de4f08550c3c0f3b2732c54c1e99b0d361824
     name: dbus-broker
-    evr: 28-7.el9
+    evr: 28-9.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/d/diffutils-3.7-12.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 1477522
@@ -6072,12 +6118,12 @@ arches:
     checksum: sha256:643279e796ded16c5be5cdc2a91839c787e62e59757008675eb0580a4a42af21
     name: elfutils
     evr: 0.194-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.1.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.5.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 8390481
-    checksum: sha256:3ef9a4df767dbc5e75944b5c197d186f8b5ca8745522e07cdf1a195229d381b4
+    size: 8411609
+    checksum: sha256:38d7acfd1130c02c6a00010159a1350ca0f56cd7ed64f3d8394aa5b3d6512ddd
     name: expat
-    evr: 2.5.0-6.el9_8.1
+    evr: 2.5.0-6.el9_8.5
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/f/filesystem-3.16-5.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 20486
@@ -6090,12 +6136,12 @@ arches:
     checksum: sha256:48bd4d4dd081120bcc6ab772b930a150f30b2fc89a4a14a24220383d24a30b3f
     name: findutils
     evr: 1:4.8.0-7.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/gawk-5.1.0-6.el9_8.1.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 3190934
-    checksum: sha256:37571947707e835d36ceb5641b187aba13ef8f5f605a6762ce72aeea3e745b8d
+    size: 3197459
+    checksum: sha256:8f156f11c96b1720ba2e9e287f2ddf5e0588a9c9ad17753f779ebbdf0c4e99df
     name: gawk
-    evr: 5.1.0-6.el9
+    evr: 5.1.0-6.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/gcc-11.5.0-14.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 81978017
@@ -6108,12 +6154,12 @@ arches:
     checksum: sha256:ad42264274c2a792220395a4dbe736a1de6100c4e14611707ec1dd447583271f
     name: gdbm
     evr: 1:1.23-1.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/glibc-2.34-275.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/glibc-2.34-283.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 20442764
-    checksum: sha256:bd7a453f66e13da24d073f53070c2d209fcd88ca2aaa24ab3b2f81cae198b46c
+    size: 20462553
+    checksum: sha256:9007b0a97151f43f812049a925cb418753f9fd643fe1283cc7eddc7e6785e2f3
     name: glibc
-    evr: 2.34-275.el9_8
+    evr: 2.34-283.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/gmp-6.2.0-13.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 2503825
@@ -6126,12 +6172,12 @@ arches:
     checksum: sha256:81b14432ebe1645b74b57592f1dcde8fab15ec13632f483f72ff2407ed16c33e
     name: grep
     evr: 3.6-5.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/gzip-1.12-1.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/g/gzip-1.12-2.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 856147
-    checksum: sha256:a05f582ec42e89258ee5e10af96dee4300bcb2a6a69a76bfb5b46f79e6a6a47b
+    size: 859023
+    checksum: sha256:f28fcbe8f3de2ec7dcdb51b1f51f03f61d0afa18c9fef10d210f40ff0c71f3a0
     name: gzip
-    evr: 1.12-1.el9
+    evr: 1.12-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/j/jq-1.6-19.el9_8.2.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 1512470
@@ -6144,12 +6190,12 @@ arches:
     checksum: sha256:c4c76ebfd66ba6d00edf672797d7f077b29d279b7866a04e05258a257a5bc306
     name: json-c
     evr: 0.14-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.39.1.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/k/kernel-5.14.0-687.57.1.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 152374943
-    checksum: sha256:7002d750cf1966a61a9131f2b5b24887816d989509efd27e5a4ed0dc8243e002
+    size: 152563149
+    checksum: sha256:a2660af0b87ac6a4d161ccc76c7d8a8338a44b4fbaad6da9e5529e3027f25aa2
     name: kernel
-    evr: 5.14.0-687.39.1.el9_8
+    evr: 5.14.0-687.57.1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/k/keyutils-1.6.3-1.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 150790
@@ -6198,12 +6244,12 @@ arches:
     checksum: sha256:425009c96135f39ca7bdb8a6ea948187d052d339dd76235979439fbd169da331
     name: libeconf
     evr: 0.4.1-7.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/l/libevent-2.1.12-8.el9_4.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/l/libevent-2.1.13-1.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 1123179
-    checksum: sha256:8c00dc837b8685fc660cc0bcdfd4f533888facaa8c83655c26d2fb068cb7b135
+    size: 1152974
+    checksum: sha256:39aef29e588e3815189ca7b54326a4e1247e8a1f5a44c908ca4325c8cae83acb
     name: libevent
-    evr: 2.1.12-8.el9_4
+    evr: 2.1.13-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/l/libffi-3.4.2-8.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 1367398
@@ -6270,12 +6316,12 @@ arches:
     checksum: sha256:734651070d0113de033da80114b416931c4c0be21ce51f6b1c1641b1185c34f3
     name: libsigsegv
     evr: 2.13-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/l/libssh-0.10.4-18.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/l/libssh-0.10.4-19.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 707007
-    checksum: sha256:e012994887f4f4c4367bce98f2eb5589bfa5c7926d65471cefeee12bee636b1d
+    size: 720407
+    checksum: sha256:83663aff05b77225cded03c63955736eddc0d6ecf6072cb4355563094a2a3250
     name: libssh
-    evr: 0.10.4-18.el9
+    evr: 0.10.4-19.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/l/libtasn1-4.16.0-10.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 1899881
@@ -6360,12 +6406,12 @@ arches:
     checksum: sha256:0d21c12c55d40d1fc2f006c8ec187b5fcc799b794cfd31ed2d98434189c62800
     name: openldap
     evr: 2.6.8-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/o/openssl-3.5.5-6.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/o/openssl-3.5.8-2.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 53369050
-    checksum: sha256:b79f08d2d04536fdb6801b6ba7da7174942d174dd2b7969316402c737689d735
+    size: 53435636
+    checksum: sha256:1e67b59efe228f804c0544a31ab3de0bb4a0c8250d3d5f5fc53a3c7794104795
     name: openssl
-    evr: 1:3.5.5-6.el9_8
+    evr: 1:3.5.8-2.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 28686020
@@ -6378,24 +6424,30 @@ arches:
     checksum: sha256:6f06a4f6812fce869528ff17ab002d655a8da18fc745eafa6c02594bb23dfeeb
     name: p11-kit
     evr: 0.26.4-1.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9_8.1.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 1133226
-    checksum: sha256:d88f44d73e9ccb288d75fd5490dc1434b06e88966febed66648775a0b46fb50c
+    size: 1142205
+    checksum: sha256:fe61734fdb226915dff402bcd1ad2002e0fd7a4dad9042af65688804f428b30b
     name: pam
-    evr: 1.5.1-28.el9
+    evr: 1.5.1-28.el9_8.1
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/p/pcre-8.44-4.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 1624356
     checksum: sha256:7edbd87b866a3f6e3df1426d660b902e063193d6186027bf99f6d77626a43817
     name: pcre
     evr: 8.44-4.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/p/pcre2-10.40-6.el9.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/p/pcre2-10.40-7.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 1789790
-    checksum: sha256:a570f7192be555222aa3704882b9199fb013a84ad4d7dcf40a93d8de2ecf6e0a
+    size: 1805958
+    checksum: sha256:43c40093332890a77f7d7c573a1b540867319bbcaaec5a6dfd73101765dc6ea0
     name: pcre2
-    evr: 10.40-6.el9
+    evr: 10.40-7.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/p/pigz-2.8-1.el9.src.rpm
+    repoid: rhel-9-for-x86_64-baseos-source-rpms
+    size: 131701
+    checksum: sha256:2eb6030553235feec36ab1406d80066f60ca545bf5a073a43a2a841a70892d2a
+    name: pigz
+    evr: 2.8-1.el9
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/p/pkgconf-1.7.3-10.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 310904
@@ -6438,30 +6490,30 @@ arches:
     checksum: sha256:771a5ed07cdb690c75cd428a8113e2ee471270044e6cb8025d92c54e32c180ff
     name: shadow-utils
     evr: 2:4.9-16.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-10.el9_8.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/s/sqlite-3.34.1-11.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 25116090
-    checksum: sha256:4387ae8d5a5a0b972b7a8612dca277499a43e7991163c7519e8a0ced2e57c90a
+    size: 25117596
+    checksum: sha256:4efcc956008f0468362b41bdba79111c41027b682bcdea3ecca3744cf50ebfd7
     name: sqlite
-    evr: 3.34.1-10.el9_8
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.4.src.rpm
+    evr: 3.34.1-11.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.6.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 45009674
-    checksum: sha256:e44181d1de2a135a5507b956d18a9eb11951a35aaa9c15dbc0f144ed8313f732
+    size: 45003976
+    checksum: sha256:f535f4c20ed82f56cc7f4c86202e3cd582815f702bb0c24005a07a496ec94c97
     name: systemd
-    evr: 252-67.el9_8.4
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm
+    evr: 252-67.el9_8.6
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 2294162
-    checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6
+    size: 2312101
+    checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c
     name: tar
-    evr: 2:1.34-11.el9
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm
+    evr: 2:1.34-13.el9_8
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/t/tzdata-2026e-1.el9_8.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
-    size: 933774
-    checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f
+    size: 943814
+    checksum: sha256:016ab67407e6f67418d8f36c5944396fe82c85896b9e945441f93d3cf1b823b4
     name: tzdata
-    evr: 2026c-1.el9_8
+    evr: 2026e-1.el9_8
   - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/u/util-linux-2.37.4-25.el9.src.rpm
     repoid: rhel-9-for-x86_64-baseos-source-rpms
     size: 6291867
@@ -6487,7 +6539,7 @@ arches:
     name: zstd
     evr: 1.5.5-1.el9
   module_metadata:
-  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/repodata/ce4d5043429e82a8a9959c9c95551a1c77a370bbef5959ea4dd5db83c2379b09-modules.yaml.gz
+  - url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/repodata/23e894ddbf1b6da3354d9713960e5b9ec453ba7417208b4441fcc9eb979cd456-modules.yaml.gz
     repoid: rhel-9-for-x86_64-appstream-rpms
-    size: 66091
-    checksum: sha256:ce4d5043429e82a8a9959c9c95551a1c77a370bbef5959ea4dd5db83c2379b09
+    size: 72012
+    checksum: sha256:23e894ddbf1b6da3354d9713960e5b9ec453ba7417208b4441fcc9eb979cd456
diff --git a/scale/dev/kill-sensors.sh b/scale/dev/kill-sensors.sh
index 37fed2d19c707..94c4279c722d1 100755
--- a/scale/dev/kill-sensors.sh
+++ b/scale/dev/kill-sensors.sh
@@ -3,8 +3,17 @@ set -eoux pipefail
 
 
 echo "Killing sensors"
-mapfile -t sensor_namespaces < <(kubectl get namespaces -o custom-columns=:metadata.name | grep -E 'stackrox[0-9]+')
+if [[ -n ${1:-} ]]; then
+  mapfile -t sensor_namespaces < <(for i in $(seq 1 $1); do echo "stackrox${i}"; done)
+else
+  mapfile -t sensor_namespaces < <(kubectl get namespaces -o custom-columns=:metadata.name | grep -E 'stackrox[0-9]+')
+fi
 nnamespace="${#sensor_namespaces[@]}"
+for ((i = 0; i < nnamespace; i = i + 1)); do
+  roxie teardown secured-cluster --set securedCluster.namespace="${sensor_namespaces[i]}"
+done
+# The pods need a while to shut down which blocks namespace deletion,
+# so deleting the namespaces separately speeds things up esp. when there are many.
 for ((i = 0; i < nnamespace; i = i + 1)); do
   kubectl delete namespace "${sensor_namespaces[i]}"
 done
diff --git a/scale/dev/launch_central.sh b/scale/dev/launch_central.sh
index 2426f50e5c088..74fe4bf2eb18f 100755
--- a/scale/dev/launch_central.sh
+++ b/scale/dev/launch_central.sh
@@ -4,23 +4,56 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)"
 
 local_port=${1:-8000}
 
-export STORAGE=pvc
-export STORAGE_SIZE=100
 # This is GKE specific so we may need to be careful in the future
 if kubectl version -o json | jq .serverVersion.gitVersion | grep "gke" > /dev/null; then
-  echo "Setting storage class to faster"
-  export STORAGE_CLASS=faster
+  echo "Setting storage class to SSD-based"
+  extra_args=(--set central.spec.central.db.persistence.persistentVolumeClaim.storageClassName=premium-rwo)
 fi
 
 # Launch Central
-$DIR/../../deploy/k8s/central.sh
 
-kubectl -n stackrox set env deploy/central MUTEX_WATCHDOG_TIMEOUT_SECS=0  ROX_SCALE_TEST=true
-if [[ $(kubectl get nodes -o json | jq '.items | length') == 1 ]]; then
-  exit 0
+roxie_config=$(mktemp)
+trap 'rm -f "${roxie_config}"' EXIT
+cat > "${roxie_config}" <<EOF
+central:
+  exposure: none
+  portForwarding: true # Needed for roxie to health-check central, but otherwise ignored.
+  spec:
+    customize:
+      envVars:
+      - name: MUTEX_WATCHDOG_TIMEOUT_SECS
+        value: "0"
+      - name: ROX_SCALE_TEST
+        value: "true"
+    scannerV4:
+      # ROX-29641: We are facing issues with workload generation on GKE when Scanner v4 is enabled.
+      scannerComponent: Disabled
+EOF
+
+if [[ $(kubectl get nodes -o json | jq '.items | length') != 1 ]]; then
+  "${DIR}/../../tests/e2e/lib-yaml.sh" merge_yaml "${roxie_config}" <<EOF
+central:
+  spec:
+    central:
+      resources:
+        requests:
+          memory: 16Gi
+          cpu: "8"
+        limits:
+          memory: 16Gi
+          cpu: "8"
+      db:
+        resources:
+          requests:
+            memory: 32Gi
+            cpu: "16"
+          limits:
+            memory: 32Gi
+            cpu: "16"
+EOF
 fi
 
-kubectl -n stackrox patch deploy/central -p '{"spec":{"template":{"spec":{"containers":[{"name":"central","resources":{"requests":{"memory":"16Gi","cpu":"8"},"limits":{"memory":"16Gi","cpu":"8"}}}]}}}}'
-kubectl -n stackrox patch deploy/central-db -p '{"spec":{"template":{"spec":{"containers":[{"name":"central-db","resources":{"requests":{"memory":"32Gi","cpu":"16"},"limits":{"memory":"32Gi","cpu":"16"}}}]}}}}'
+roxie deploy central --single-namespace --verbose --envrc .roxie.env --config "${roxie_config}" "${extra_args[@]}"
+rm -f "${roxie_config}"
 
 $DIR/port-forward.sh "${local_port}"
diff --git a/scale/dev/launch_sensor.sh b/scale/dev/launch_sensor.sh
index 84678021e17d9..2eb21d721a097 100755
--- a/scale/dev/launch_sensor.sh
+++ b/scale/dev/launch_sensor.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -euo pipefail
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)"
 
@@ -18,24 +19,69 @@ if [ ! -f "$file" ]; then
     exit 1
 fi
 
-SENSOR_HELM_DEPLOY=false CLUSTER="${namespace}" NAMESPACE_OVERRIDE="${namespace}" "$DIR/../../deploy/k8s/sensor.sh"
-
-# This is purposefully kept as stackrox because this is where central should be run
 if ! kubectl -n stackrox get pvc/central-db > /dev/null; then
   >&2 echo "Running the scale workload requires a PVC"
   exit 1
 fi
 
-kubectl -n "${namespace}" delete deploy/admission-control
-kubectl -n "${namespace}" delete daemonset collector
+roxie_config=$(mktemp)
+trap 'rm -f "${roxie_config}"' EXIT
+
+CENTRAL_ENDPOINT=${CENTRAL_ENDPOINT:-central.stackrox.svc:443}
+
+cat > "${roxie_config}" <<EOF
+securedCluster:
+  namespace: "${namespace}"
+  pauseReconciliation: true  # to be able to delete deployments below
+  metadata:
+    annotations:
+      platform.stackrox.io/namespace-prefix-global-resources: "true"
+  spec:
+    clusterName: "${namespace}"
+    centralEndpoint: "${CENTRAL_ENDPOINT}"
+    scannerV4:
+      scannerComponent: Disabled
+    customize:
+      envVars:
+      - name: MUTEX_WATCHDOG_TIMEOUT_SECS
+        value: "0"
+      - name: ROX_FAKE_WORKLOAD_STORAGE
+        value: "/var/cache/stackrox/pebble.db"
+    overlays:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: sensor
+      patches:
+      - path: spec.template.spec.containers[name:sensor].volumeMounts[-1]
+        value: |
+          name: scale-workload-config
+          mountPath: /var/scale/stackrox
+      - path: spec.template.spec.volumes[-1]
+        value: |
+          name: scale-workload-config
+          configMap:
+            name: scale-workload-config
+EOF
 
-kubectl -n "${namespace}" set env deploy/sensor MUTEX_WATCHDOG_TIMEOUT_SECS=0 ROX_FAKE_WORKLOAD_STORAGE=/var/cache/stackrox/pebble.db
+if [[ $(kubectl get nodes -o json | jq '.items | length') != 1 ]]; then
+  "${DIR}/../../tests/e2e/lib-yaml.sh" merge_yaml "${roxie_config}" <<EOF
+securedCluster:
+  spec:
+    sensor:
+      resources:
+          requests:
+            memory: 20Gi
+            cpu: "4"
+          limits:
+            memory: 20Gi
+            cpu: "8"
+EOF
+fi
+kubectl get namespace "${namespace}" || kubectl create namespace "${namespace}"
 kubectl -n "${namespace}" delete configmap scale-workload-config || true
 kubectl -n "${namespace}" create configmap scale-workload-config --from-file=workload.yaml="$file"
-kubectl -n "${namespace}" patch deploy/sensor -p '{"spec":{"template":{"spec":{"containers":[{"name":"sensor","volumeMounts":[{"name":"scale-workload-config","mountPath":"/var/scale/stackrox"}]}],"volumes":[{"name":"scale-workload-config","configMap":{"name": "scale-workload-config"}}]}}}}'
 
-if [[ $(kubectl get nodes -o json | jq '.items | length') == 1 ]]; then
-  exit 0
-fi
+API_ENDPOINT="localhost:${LOCAL_PORT:-8000}" roxie deploy secured-cluster --config "${roxie_config}" --verbose --early-readiness
 
-kubectl -n "${namespace}" patch deploy/sensor -p '{"spec":{"template":{"spec":{"containers":[{"name":"sensor","resources":{"requests":{"memory":"20Gi","cpu":"4"},"limits":{"memory":"20Gi","cpu":"8"}}}]}}}}'
+kubectl -n "${namespace}" delete deploy/admission-control || true
+kubectl -n "${namespace}" delete daemonset collector || true
diff --git a/scale/dev/run-many.sh b/scale/dev/run-many.sh
index a063fc27ec324..0921ce5e751d4 100755
--- a/scale/dev/run-many.sh
+++ b/scale/dev/run-many.sh
@@ -18,12 +18,11 @@ else
   killpf "${LOCAL_PORT}"
   "$DIR"/port-forward.sh "${LOCAL_PORT}"
 fi
+. .roxie.env
 echo "Set retention settings"
 roxcurl v1/config -X PUT -d @config.json
 
+"$DIR"/kill-sensors.sh ${2:-1}
 for i in $(seq 1 $2); do
-  namespace="stackrox$i"
-  kubectl get ns $namespace && kubectl delete ns $namespace
-  kubectl create ns $namespace
-  "$DIR"/launch_sensor.sh $1 $namespace
+  "$DIR"/launch_sensor.sh $1 "stackrox$i" || exit 1
 done
diff --git a/scale/workloads/file-activity-scale.yaml b/scale/workloads/file-activity-scale.yaml
new file mode 100644
index 0000000000000..19bf8faf9406c
--- /dev/null
+++ b/scale/workloads/file-activity-scale.yaml
@@ -0,0 +1,28 @@
+nodeWorkload:
+  numNodes: 10
+
+numNamespaces: 3
+
+deploymentWorkload:
+- deploymentType: Deployment
+  numDeployments: 100
+  numLabels: 5
+  lifecycleDuration: 30m
+  updateInterval: 5m
+  podWorkload:
+    numContainers: 2
+    numPods: 3
+    lifecycleDuration: 10m
+    processWorkload:
+      processInterval: 30s
+      alertRate: 0
+
+networkWorkload:
+  flowInterval: 60s
+  batchSize: 50
+
+fileActivityWorkload:
+  activityInterval: 50ms
+  batchSize: 100
+  numPaths: 500
+  nodeEventPercent: 50
diff --git a/scale/workloads/long-running.yaml b/scale/workloads/long-running.yaml
index 752089da52dce..c83eec051d1e0 100755
--- a/scale/workloads/long-running.yaml
+++ b/scale/workloads/long-running.yaml
@@ -24,3 +24,8 @@ rbacWorkload:
   numBindings: 1000
   numRoles: 1000
   numServiceAccounts: 1000
+fileActivityWorkload:
+  activityInterval: 50ms
+  batchSize: 10
+  numPaths: 500
+  nodeEventPercent: 50
diff --git a/scale/workloads/sample.yaml b/scale/workloads/sample.yaml
index 3a5158b0e182a..a63cfc52c23d6 100755
--- a/scale/workloads/sample.yaml
+++ b/scale/workloads/sample.yaml
@@ -78,6 +78,15 @@ virtualMachineWorkload:
   reportInterval: 60s
   # Number of fake packages to include in each index report
   numPackages: 100
-  # Delay before the first index report for each VM (±20% max deviation applied)
-  initialReportDelay: 10s
+
+# File activity workload generates synthetic file access events (requires ROX_SENSITIVE_FILE_ACTIVITY=true)
+fileActivityWorkload:
+  # Every time the specified interval is reached...
+  activityInterval: 1s
+  # ...create this many random file access events
+  batchSize: 100
+  # Number of unique file paths to generate events for
+  numPaths: 200
+  # Percentage of events generated as node-level (0-100), remainder are deployment-level
+  nodeEventPercent: 50
 
diff --git a/scale/workloads/virtual-machines-small.yaml b/scale/workloads/virtual-machines-small.yaml
index 4fe7e14c99f25..f2b6af1912b93 100644
--- a/scale/workloads/virtual-machines-small.yaml
+++ b/scale/workloads/virtual-machines-small.yaml
@@ -4,10 +4,10 @@
 #
 # The unified VirtualMachineWorkload config handles both:
 # 1. VM/VMI informer events (always generated when poolSize > 0)
-# 2. VM index reports (only generated when reportInterval > 0)
+# 2. VM index reports (when reportInterval > 0): VMScraper polls an in-process
+#    fake agent. Cadence is the scraper poll interval, not reportInterval.
 #
-# Index reports are tied to VM lifecycle: reports are only sent while the VM is "alive".
-# You can run just the informers (for testing k8s events) or informers + reports (full flow).
+# You can run just the informers (reportInterval: 0) or informers + reports.
 #
 # Usage:
 #   ROX_VIRTUAL_MACHINES=true go run tools/local-sensor/main.go -no-mem-prof -no-cpu-prof -with-metrics -with-fakeworkload scale/workloads/virtual-machines.yaml
@@ -29,9 +29,8 @@ virtualMachineWorkload:
   updateInterval: 5m
   lifecycleDuration: 2h
   numLifecycles: 0
-  reportInterval: 5m # ±5% max deviation applied
+  reportInterval: 5m # > 0 enables fake agent reports; scrape cadence is independent
   numPackages: 700
-  initialReportDelay: 30s # ±20% max deviation applied
 
 deploymentWorkload:
 - deploymentType: Deployment
diff --git a/scale/workloads/virtual-machines.yaml b/scale/workloads/virtual-machines.yaml
index cff61df29bac2..8ad4b3e717b7f 100644
--- a/scale/workloads/virtual-machines.yaml
+++ b/scale/workloads/virtual-machines.yaml
@@ -4,10 +4,10 @@
 #
 # The unified VirtualMachineWorkload config handles both:
 # 1. VM/VMI informer events (always generated when poolSize > 0)
-# 2. VM index reports (only generated when reportInterval > 0)
+# 2. VM index reports (when reportInterval > 0): VMScraper polls an in-process
+#    fake agent. Cadence is the scraper poll interval, not reportInterval.
 #
-# Index reports are tied to VM lifecycle: reports are only sent while the VM is "alive".
-# You can run just the informers (for testing k8s events) or informers + reports (full flow).
+# You can run just the informers (reportInterval: 0) or informers + reports.
 #
 # Usage:
 #   ROX_VIRTUAL_MACHINES=true go run tools/local-sensor/main.go -no-mem-prof -no-cpu-prof -with-metrics -with-fakeworkload scale/workloads/virtual-machines.yaml
@@ -29,9 +29,8 @@ virtualMachineWorkload:
   updateInterval: 5m
   lifecycleDuration: 2h
   numLifecycles: 0
-  reportInterval: 5m # ±5% max deviation applied
+  reportInterval: 5m # > 0 enables fake agent reports; scrape cadence is independent
   numPackages: 700
-  initialReportDelay: 30s # ±20% max deviation applied
 
 deploymentWorkload:
 - deploymentType: Deployment
diff --git a/scanner/VULNERABILITY_VERSION b/scanner/VULNERABILITY_VERSION
index 29ef827e8a45b..c694117fd4e76 100644
--- a/scanner/VULNERABILITY_VERSION
+++ b/scanner/VULNERABILITY_VERSION
@@ -1 +1 @@
-v3
+v4
diff --git a/scanner/config/config.go b/scanner/config/config.go
index b0b87fca11c4c..bbe1139dc3b40 100644
--- a/scanner/config/config.go
+++ b/scanner/config/config.go
@@ -15,8 +15,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/go-viper/mapstructure/v2"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/mitchellh/mapstructure"
 	"github.com/spf13/viper"
 	"github.com/stackrox/rox/pkg/buildinfo"
 	"github.com/stackrox/rox/pkg/utils"
diff --git a/scanner/e2etests/helmchart/templates/scanner-config.yaml b/scanner/e2etests/helmchart/templates/scanner-config.yaml
index 61aaf18ff1ea4..aeb571a9eb005 100644
--- a/scanner/e2etests/helmchart/templates/scanner-config.yaml
+++ b/scanner/e2etests/helmchart/templates/scanner-config.yaml
@@ -10,11 +10,11 @@ data:
     grpc_listen_addr: :8443
     indexer:
       database:
-        conn_string: host={{ .Values.app.db.name }}.{{ .Release.Namespace }} port=5432 user=postgres sslmode=verify-ca statement_timeout=60000 sslrootcert=/run/secrets/stackrox.io/certs/ca.pem
+        conn_string: host={{ .Values.app.db.name }}.{{ .Release.Namespace }} port=5432 user=postgres sslmode=verify-ca statement_timeout=360000 sslrootcert=/run/secrets/stackrox.io/certs/ca.pem
         password_file: /run/secrets/stackrox.io/postgresql/password
     matcher:
       database:
-        conn_string: host={{ .Values.app.db.name }}.{{ .Release.Namespace }} port=5432 user=postgres sslmode=verify-ca statement_timeout=60000 sslrootcert=/run/secrets/stackrox.io/certs/ca.pem
+        conn_string: host={{ .Values.app.db.name }}.{{ .Release.Namespace }} port=5432 user=postgres sslmode=verify-ca statement_timeout=360000 sslrootcert=/run/secrets/stackrox.io/certs/ca.pem
         password_file: /run/secrets/stackrox.io/postgresql/password
       vulnerabilities_url: https://definitions.stackrox.io/v4/vulnerability-bundles/ROX_VULNERABILITY_VERSION/vulnerabilities.zip
       readiness: vulnerability
diff --git a/scanner/image/db/bats/docker_entrypoint.bats b/scanner/image/db/bats/docker_entrypoint.bats
new file mode 100644
index 0000000000000..4608955eea9a9
--- /dev/null
+++ b/scanner/image/db/bats/docker_entrypoint.bats
@@ -0,0 +1,158 @@
+#!/usr/bin/env bats
+
+# Unit tests for the StackRox additions to the scanner-v4-db entrypoint,
+# scanner/image/db/scripts/docker-entrypoint.sh.
+#
+# Run with:
+#
+#   bats scanner/image/db/bats/docker_entrypoint.bats
+
+load "../../../../scripts/test_helpers.bats"
+
+function setup() {
+    source "${BATS_TEST_DIRNAME}/../scripts/docker-entrypoint.sh"
+
+    export PGDATA="${BATS_TEST_TMPDIR}/pgdata"
+    mkdir -p "$PGDATA"
+
+    # In place of /usr/lib64/pgsql in the image.
+    prev_dir="${BATS_TEST_TMPDIR}/pgsql"
+
+    image_bin="${BATS_TEST_TMPDIR}/bin"
+    mkdir -p "$image_bin"
+    export PATH="${image_bin}:${PATH}"
+}
+
+# given_binary_version makes `postgres -V` report the given major version.
+function given_binary_version() {
+    local major="$1"
+    mock_executable "${image_bin}/postgres" \
+        "echo 'postgres (PostgreSQL) ${major}.2'"
+}
+
+# given_data_version writes $PGDATA/PG_VERSION the way initdb would.
+function given_data_version() {
+    local major="$1"
+    echo "$major" > "${PGDATA}/PG_VERSION"
+}
+
+# given_prev_binaries mimics the postgres executable under /usr/lib64/pgsql.
+function given_prev_binaries() {
+    local major="$1"
+    mock_executable "${prev_dir}/postgresql-${major}/bin/postgres" \
+        "echo 'PostgreSQL ${major} server'"
+}
+
+function mock_executable() {
+    local target_path="$1"
+    local script_body="$2"
+
+    mkdir -p "$(dirname "$target_path")"
+    printf '#!/usr/bin/env bash\n%s\n' "$script_body" > "$target_path"
+    chmod +x "$target_path"
+}
+
+# Calls rox_use_matching_binaries and gathers results.
+function use_matching_binaries() {
+    local status=0
+
+    rox_use_matching_binaries "$prev_dir" || status=$?
+    printf 'first-path=%s\n' "${PATH%%:*}"
+    printf 'path=%s\n' "$PATH"
+    return "$status"
+}
+
+# == rox_use_matching_binaries ==
+#
+# The function must always return 0: under `set -e` a non-zero return takes the
+# container down.
+
+@test "rox_use_matching_binaries - fresh install, no PG_VERSION yet" {
+    run use_matching_binaries
+    assert_success
+    assert_line "first-path=${image_bin}"
+}
+
+@test "rox_use_matching_binaries - normal boot" {
+    given_binary_version 16
+    given_data_version 16
+    run use_matching_binaries
+    assert_success
+    refute_output --partial "no executable"
+    assert_line "first-path=${image_bin}"
+}
+
+@test "rox_use_matching_binaries - data are newer than the image" {
+    # Unsupported. The image has no newer binaries.
+    given_binary_version 16
+    given_data_version 17
+    run use_matching_binaries
+    assert_success
+    refute_output --partial "no executable"
+    assert_line "first-path=${image_bin}"
+}
+
+@test "rox_use_matching_binaries - data match the previous binaries" {
+    local data_major=15
+    local matching_bin_dir="${prev_dir}/postgresql-${data_major}/bin"
+    given_binary_version 17
+    given_data_version "$data_major"
+    given_prev_binaries "$data_major"
+    local before="$PATH"
+    run use_matching_binaries
+    assert_success
+    assert_output --partial \
+        "Data are still in PostgreSQL ${data_major}, starting the binaries in ${matching_bin_dir}"
+    assert_line "path=${matching_bin_dir}:${before}"
+}
+
+@test "rox_use_matching_binaries - data do not match the previous binaries" {
+    local data_major=14
+    local matching_bin_dir="${prev_dir}/postgresql-${data_major}/bin"
+    given_binary_version 16
+    given_prev_binaries 15
+    given_data_version "$data_major"
+    run use_matching_binaries
+    assert_success
+    assert_output --partial \
+        "Data are in PostgreSQL ${data_major}, but there is no executable ${matching_bin_dir}/postgres"
+    assert_line "first-path=${image_bin}"
+}
+
+@test "rox_use_matching_binaries - matching postgres is not executable" {
+    local data_major=15
+    local matching_bin_dir="${prev_dir}/postgresql-${data_major}/bin"
+    given_binary_version 16
+    given_data_version "$data_major"
+    given_prev_binaries "$data_major"
+    chmod -x "${matching_bin_dir}/postgres"
+    run use_matching_binaries
+    assert_success
+    assert_output --partial "no executable"
+    assert_line "first-path=${image_bin}"
+}
+
+@test "rox_use_matching_binaries - corrupted PG_VERSION" {
+    given_data_version "not-a-version"
+    run use_matching_binaries
+    assert_success
+    assert_output --partial "Cannot read a valid major version from ${PGDATA}/PG_VERSION"
+    assert_line "first-path=${image_bin}"
+}
+
+@test "rox_use_matching_binaries - unparsable binary version" {
+    mock_executable "${image_bin}/postgres" "echo 'something else entirely'"
+    given_data_version 15
+    run use_matching_binaries
+    assert_success
+    assert_output --partial "Cannot read a valid major version from postgres -V"
+    assert_line "first-path=${image_bin}"
+}
+
+@test "rox_use_matching_binaries - postgres -V failure does not crash the container" {
+    mock_executable "${image_bin}/postgres" "exit 127"
+    given_data_version 15
+    # Called without `run`, which would swallow an abort.
+    rox_use_matching_binaries "$prev_dir"
+    assert_equal "${PATH%%:*}" "$image_bin"
+}
diff --git a/scanner/image/db/konflux.Dockerfile b/scanner/image/db/konflux.Dockerfile
index 5b29c214e31c0..a4b3f6bfc6890 100644
--- a/scanner/image/db/konflux.Dockerfile
+++ b/scanner/image/db/konflux.Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/rhel9/postgresql-15:latest@sha256:7194048e972bd3da04a53e3f9537b123eb6b1b2cc3388268896b8923f86e04d4
+FROM registry.redhat.io/rhel9/postgresql-15:latest@sha256:04dc558560697443edac184d16684147eba4d6bb7a6dd646928ad433def33c95
 
 ARG BUILD_TAG
 RUN if [[ "$BUILD_TAG" == "" ]]; then >&2 echo "error: required BUILD_TAG arg is unset"; exit 6; fi
@@ -36,6 +36,8 @@ RUN localedef -f UTF-8 -i en_US en_US.UTF-8 && \
     usermod -u 70 postgres -d /var/lib/postgresql && \
     chown -R postgres:postgres /var/lib/postgresql && \
     chown -R postgres:postgres /var/run/postgresql && \
+    # Update ownership of directories that are owned by the original postgres uid.
+    chown -R postgres /var/lib/pgsql && chown -R postgres /opt/app-root && \
     dnf clean all && \
     rpm --verbose -e --nodeps $(rpm -qa curl '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \
     rm -rf /var/cache/dnf /var/cache/yum
diff --git a/scanner/image/db/scripts/docker-entrypoint.sh b/scanner/image/db/scripts/docker-entrypoint.sh
index 2848ddbe4af01..705762aa70ba9 100755
--- a/scanner/image/db/scripts/docker-entrypoint.sh
+++ b/scanner/image/db/scripts/docker-entrypoint.sh
@@ -311,6 +311,51 @@ _pg_want_help() {
 	return 1
 }
 
+### STACKROX MODIFIED - Always run the server binaries matching the on-disk
+### data directory. If init-entrypoint.sh declined or failed to upgrade, starting
+### the newer server against it would make the pod crashloop.
+###
+### The base image ships the previous major under
+### /usr/lib64/pgsql/postgresql-<major> (see POSTGRESQL_PREV_VERSION).
+###
+### This function returns 0. Parameter $1 is the root of the previous binaries.
+rox_use_matching_binaries() {
+	local prev_dir="$1"
+	local major_regex='^[0-9]+$'
+	local data_version binary_version matching_bin_dir
+
+	# A fresh install has no usable PG_VERSION file yet.
+	[ -s "$PGDATA/PG_VERSION" ] || return 0
+
+	data_version="$(< "$PGDATA/PG_VERSION")" || true
+	if ! [[ "$data_version" =~ $major_regex ]]; then
+		printf >&2 'Cannot read a valid major version from %s/PG_VERSION: "%s"\n' \
+			"$PGDATA" "$data_version"
+		return 0
+	fi
+
+	binary_version="$(postgres -V 2>/dev/null | sed 's/postgres (PostgreSQL) \([0-9]*\).*/\1/')" || true
+	if ! [[ "$binary_version" =~ $major_regex ]]; then
+		printf >&2 'Cannot read a valid major version from postgres -V: "%s"\n' \
+			"$binary_version"
+		return 0
+	fi
+
+	[ "$data_version" -lt "$binary_version" ] || return 0
+
+	# Binaries for the data version, which is the previous major.
+	matching_bin_dir="${prev_dir}/postgresql-${data_version}/bin"
+	if [ ! -x "$matching_bin_dir/postgres" ]; then
+		printf >&2 'Data are in PostgreSQL %s, but there is no executable %s/postgres; startup will fail\n' \
+			"$data_version" "$matching_bin_dir"
+		return 0
+	fi
+
+	printf >&2 'Data are still in PostgreSQL %s, starting the binaries in %s\n' \
+		"$data_version" "$matching_bin_dir"
+	export PATH="$matching_bin_dir:$PATH"
+}
+
 _main() {
 	# if first arg looks like a flag, assume we want to run postgres server
 	if [ "${1:0:1}" = '-' ]; then
@@ -318,6 +363,12 @@ _main() {
 	fi
 
 	if [ "$1" = 'postgres' ] && ! _pg_want_help "$@"; then
+		### STACKROX MODIFIED - Must run before anything that resolves a
+		### PostgreSQL binary through PATH. The server itself is launched as
+		### `flock ... "$@" &` below, which resolves `postgres` at exec time,
+		### so exporting PATH here is enough.
+		rox_use_matching_binaries /usr/lib64/pgsql
+
 		docker_setup_env
 		# setup data directories and permissions (when run as root)
 		docker_create_db_directories
diff --git a/scanner/image/scanner/konflux.Dockerfile b/scanner/image/scanner/konflux.Dockerfile
index 67fa951d5725e..cfec85c4ce01c 100644
--- a/scanner/image/scanner/konflux.Dockerfile
+++ b/scanner/image/scanner/konflux.Dockerfile
@@ -1,4 +1,4 @@
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:3ca2c34c83e6563fa574b7c7ecda92a5fdae2ec7a5f37a408e5e383947fb1957 AS builder
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26@sha256:e74b03198cccc24c24a27071ad4d6c2edcfe0bb10c6de99c609ce6e3c06d6d04 AS builder
 
 ARG BUILD_TAG
 RUN if [[ "$BUILD_TAG" == "" ]]; then >&2 echo "error: required BUILD_TAG arg is unset"; exit 6; fi
@@ -16,9 +16,9 @@ WORKDIR /src
 
 RUN make -C scanner NODEPS=1 CGO_ENABLED=1 image/scanner/bin/scanner copy-scripts
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95 AS ubi-micro-base
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:5be877a2a280ae36eb9ab80ca4efb28bbf77c57abbba38137cdc37a03b8465e6 AS ubi-micro-base
 
-FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:bcbf1fe577df63bd975ea19ebae604b5f072e1833b2bde417a0ffd4afd938b96 AS package_installer
+FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:16e9e43d99e181463513cc84a514859b1abb9460f1c4d9e208da4b4e51cd5cc3 AS package_installer
 
 COPY --from=ubi-micro-base / /out/
 
diff --git a/scanner/matcher/updater/vuln/updater.go b/scanner/matcher/updater/vuln/updater.go
index 809dd492e7891..6356a2df3a498 100644
--- a/scanner/matcher/updater/vuln/updater.go
+++ b/scanner/matcher/updater/vuln/updater.go
@@ -373,9 +373,6 @@ func (u *Updater) Update(ctx context.Context) error {
 		err     error
 	)
 	updated, err = u.runMultiBundleUpdate(ctx)
-	if err != nil {
-		return err
-	}
 
 	// Only bother running the GC when it's not disabled
 	// and when the vulnerabilities have been updated.
@@ -386,7 +383,7 @@ func (u *Updater) Update(ctx context.Context) error {
 		slog.InfoContext(ctx, "no vulnerability updates: skipping GC")
 	}
 
-	return nil
+	return err
 }
 
 // runMultiBundleUpdate updates the vulnerability data with a multi-bundle and
@@ -446,38 +443,57 @@ func (u *Updater) runMultiBundleUpdate(ctx context.Context) (bool, error) {
 	slog.InfoContext(ctx, "pre-registered vulnerability bundles", "count", len(bundles))
 
 	// Process each vulnerability bundle in the .zip archive.
+	// Errors are collected so all bundles are attempted even when some fail.
+	//
+	// TODO(ROX-36437): succeeded counts lock-skipped and already-current
+	// bundles as successes; distinguish genuinely imported bundles from
+	// skipped ones.
+	var bundleErrs []error
+	succeeded := 0
 	for _, bundleF := range bundles {
 		bundleCtx := log.With(ctx, "bundle", bundleF.Name)
 		slog.InfoContext(bundleCtx, "starting bundle update")
-		if err := u.updateBundle(bundleCtx, bundleF, zipTime, prevTime); err != nil {
+		if err := u.updateBundle(bundleCtx, bundleF, prevTime); err != nil {
 			slog.ErrorContext(bundleCtx, "updating bundle failed", "reason", err)
-			return false, fmt.Errorf("updating bundle %s: %w", bundleF.Name, err)
+			bundleErrs = append(bundleErrs, fmt.Errorf("bundle %s: %w", bundleF.Name, err))
+			continue
 		}
 		slog.InfoContext(bundleCtx, "completed bundle update")
+		succeeded++
+	}
+
+	// Skip GC and distribution update only when every bundle that was
+	// attempted returned an error (i.e., no partial success to build on).
+	if len(bundleErrs) > 0 && succeeded == 0 {
+		return false, errors.Join(bundleErrs...)
 	}
 
 	// Clean updaters that were deleted (not in the zip and older than this update).
 	// Safe to be run concurrently.
-	names := make([]string, 0, len(bundles))
-	for _, f := range bundles {
-		names = append(names, f.Name)
-	}
-	err = u.metadataStore.GCVulnerabilityUpdates(ctx, names, zipTime)
-	if err != nil {
-		return false, fmt.Errorf("cleaning vuln updates: %w", err)
+	if len(bundles) > 0 {
+		names := make([]string, 0, len(bundles))
+		for _, f := range bundles {
+			names = append(names, f.Name)
+		}
+		err = u.metadataStore.GCVulnerabilityUpdates(ctx, names, zipTime)
+		if err != nil {
+			return false, errors.Join(fmt.Errorf("cleaning vuln updates: %w", err), errors.Join(bundleErrs...))
+		}
+	} else {
+		slog.WarnContext(ctx, "skipping vuln update cleanup: no bundle was processed")
 	}
 
 	err = u.distManager.update(ctx)
 	if err != nil {
-		return false, fmt.Errorf("updating known-distributions: %w", err)
+		return false, errors.Join(fmt.Errorf("updating known-distributions: %w", err), errors.Join(bundleErrs...))
 	}
 
 	_ = u.Initialized(ctx)
 
-	return true, nil
+	return true, errors.Join(bundleErrs...)
 }
 
-func (u *Updater) updateBundle(ctx context.Context, zipF *zip.File, zipTime time.Time, prevTime time.Time) error {
+func (u *Updater) updateBundle(ctx context.Context, zipF *zip.File, prevTime time.Time) error {
 	// Use TryLock to prevent simultaneous updates for the same bundle.
 	lCtx, lDone := u.locker.TryLock(ctx, zipF.Name)
 	defer lDone()
@@ -492,8 +508,8 @@ func (u *Updater) updateBundle(ctx context.Context, zipF *zip.File, zipTime time
 	if err != nil {
 		return fmt.Errorf("querying last update: %w", err)
 	}
-	if !lastTime.Before(zipTime) {
-		slog.InfoContext(ctx, "skipping: last update time is greater or equal to the zip archive time", "last_update_time", lastTime, "update_time", zipTime)
+	if !lastTime.Before(zipF.Modified) {
+		slog.InfoContext(ctx, "skipping: last update time is greater or equal to the zip archive time", "last_update_time", lastTime, "update_time", zipF.Modified)
 		return nil
 	}
 
@@ -515,7 +531,7 @@ func (u *Updater) updateBundle(ctx context.Context, zipF *zip.File, zipTime time
 		return fmt.Errorf("importing vulnerabilities: %w", err)
 	}
 
-	err = u.metadataStore.SetLastVulnerabilityUpdate(lCtx, zipF.Name, zipTime)
+	err = u.metadataStore.SetLastVulnerabilityUpdate(lCtx, zipF.Name, zipF.Modified)
 	if err != nil {
 		return fmt.Errorf("updating timestamp (import was successful): %w", err)
 	}
diff --git a/scanner/matcher/updater/vuln/updater_test.go b/scanner/matcher/updater/vuln/updater_test.go
index bf3ab7505ba36..2f1b8a4693deb 100644
--- a/scanner/matcher/updater/vuln/updater_test.go
+++ b/scanner/matcher/updater/vuln/updater_test.go
@@ -19,6 +19,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/klauspost/compress/zstd"
 	"github.com/quay/claircore"
 	"github.com/quay/claircore/datastore"
 	"github.com/quay/claircore/libvuln/driver"
@@ -124,9 +125,6 @@ func TestMultiBundleUpdate(t *testing.T) {
 	metadataStore.EXPECT().
 		GetLastVulnerabilityUpdate(gomock.Any()).
 		Return(now.Add(-time.Minute), nil)
-	metadataStore.EXPECT().
-		GCVulnerabilityUpdates(gomock.Any(), gomock.Any(), now).
-		Return(nil)
 	metadataStore.EXPECT().
 		GetLastVulnerabilityUpdate(gomock.Any()).
 		Return(now, nil)
@@ -149,14 +147,87 @@ func TestMultiBundleUpdate(t *testing.T) {
 	assert.Equal(t, dists, u.KnownDistributions())
 }
 
+func TestMultiBundleUpdate_SkipsCleanupWhenNoBundleProcessed(t *testing.T) {
+	tests := map[string]struct {
+		bundleNames []string
+		allowlist   []string
+	}{
+		"empty archive": {
+			bundleNames: nil,
+		},
+		"every entry filtered out by allowlist": {
+			bundleNames: []string{"alpine.json.zst"},
+			allowlist:   []string{"not-in-the-archive"},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			srv, now := testHTTPServer(t, func(_ *http.Request) io.ReadSeeker {
+				var buf bytes.Buffer
+				zw := zip.NewWriter(&buf)
+				for _, n := range tc.bundleNames {
+					_, err := zw.Create(n)
+					require.NoError(t, err)
+				}
+				require.NoError(t, zw.Close())
+				return bytes.NewReader(buf.Bytes())
+			})
+
+			ctrl := gomock.NewController(t)
+			store := mocks.NewMockMatcherStore(ctrl)
+			metadataStore := mocks.NewMockMatcherMetadataStore(ctrl)
+
+			u := &Updater{
+				locker:              &testLocker{locker: updates.NewLocalLockSource()},
+				store:               store,
+				metadataStore:       metadataStore,
+				client:              srv.Client(),
+				urls:                []string{srv.URL},
+				root:                t.TempDir(),
+				skipGC:              true,
+				importFunc:          func(_ context.Context, _ io.Reader) error { return nil },
+				retryDelay:          1 * time.Second,
+				retryMax:            1,
+				distManager:         newDistManager(store),
+				vulnBundleAllowlist: set.NewFrozenSet(tc.allowlist...),
+			}
+
+			prevTime := now.Add(-time.Hour)
+
+			// No GetOrSetLastVulnerabilityUpdate (pre-registration/processing), and
+			// critically no GCVulnerabilityUpdates call: with zero allowed bundles,
+			// nothing should be pre-registered, processed, or cleaned up.
+			metadataStore.EXPECT().
+				GetLastVulnerabilityUpdate(gomock.Any()).
+				Return(prevTime, nil)
+			store.EXPECT().
+				Distributions(gomock.Any()).
+				Return(nil, nil)
+			metadataStore.EXPECT().
+				GetLastVulnerabilityUpdate(gomock.Any()).
+				Return(now, nil)
+
+			err := u.Update(test.Logging(t))
+			assert.NoError(t, err)
+		})
+	}
+}
+
 func TestMultiBundleUpdate_PreRegistration(t *testing.T) {
 	bundleNames := []string{"alpine.json.zst", "nvd.json.zst", "rhel-vex.json.zst"}
+	entryModified, err := http.ParseTime(time.Now().Add(-2 * time.Hour).UTC().Format(http.TimeFormat))
+	require.NoError(t, err)
 
 	srv, now := testHTTPServer(t, func(_ *http.Request) io.ReadSeeker {
 		var buf bytes.Buffer
 		zw := zip.NewWriter(&buf)
 		for _, name := range bundleNames {
-			_, err := zw.Create(name)
+			_, err := zw.CreateHeader(&zip.FileHeader{
+				Name:     name,
+				Method:   zip.Deflate,
+				Modified: entryModified,
+			})
 			require.NoError(t, err)
 		}
 		require.NoError(t, zw.Close())
@@ -167,7 +238,7 @@ func TestMultiBundleUpdate_PreRegistration(t *testing.T) {
 	store := mocks.NewMockMatcherStore(ctrl)
 	metadataStore := mocks.NewMockMatcherMetadataStore(ctrl)
 
-	prevTime := now.Add(-time.Minute)
+	prevTime := entryModified.Add(-time.Minute)
 
 	u := &Updater{
 		locker:        &testLocker{locker: updates.NewLocalLockSource()},
@@ -198,12 +269,12 @@ func TestMultiBundleUpdate_PreRegistration(t *testing.T) {
 	}
 
 	// Processing phase: each updateBundle calls GetOrSetLastVulnerabilityUpdate.
-	// Return zipTime (now) so updateBundle skips actual import (no zst decoding needed).
+	// Return entryModified so updateBundle skips actual import (no zst decoding needed).
 	// Constrained to happen AFTER all pre-registration calls.
 	for _, name := range bundleNames {
 		call := metadataStore.EXPECT().
 			GetOrSetLastVulnerabilityUpdate(gomock.Any(), name, prevTime).
-			Return(now, nil)
+			Return(entryModified, nil)
 		for _, pre := range preReg {
 			call.After(pre)
 		}
@@ -220,10 +291,200 @@ func TestMultiBundleUpdate_PreRegistration(t *testing.T) {
 		GetLastVulnerabilityUpdate(gomock.Any()).
 		Return(now, nil)
 
-	err := u.Update(test.Logging(t))
+	err = u.Update(test.Logging(t))
 	assert.NoError(t, err)
 }
 
+func TestUpdateBundle_UsesPerEntryZipModifiedTimestamp(t *testing.T) {
+	const bundleName = "alpine.json.zst"
+
+	// Older than the archive zipTime
+	entryModified, err := http.ParseTime(time.Now().Add(-2 * time.Hour).UTC().Format(http.TimeFormat))
+	require.NoError(t, err)
+
+	srv, now := testHTTPServer(t, func(_ *http.Request) io.ReadSeeker {
+		var buf bytes.Buffer
+		zw := zip.NewWriter(&buf)
+		w, err := zw.CreateHeader(&zip.FileHeader{
+			Name:     bundleName,
+			Method:   zip.Deflate,
+			Modified: entryModified,
+		})
+		require.NoError(t, err)
+		_, err = w.Write([]byte("fake-compressed-content"))
+		require.NoError(t, err)
+		require.NoError(t, zw.Close())
+		return bytes.NewReader(buf.Bytes())
+	})
+	require.True(t, entryModified.Before(now), "test setup: entry timestamp must be older than the archive zipTime")
+
+	ctrl := gomock.NewController(t)
+	store := mocks.NewMockMatcherStore(ctrl)
+	metadataStore := mocks.NewMockMatcherMetadataStore(ctrl)
+
+	prevTime := entryModified.Add(-time.Hour)
+
+	u := &Updater{
+		locker:        &testLocker{locker: updates.NewLocalLockSource()},
+		store:         store,
+		metadataStore: metadataStore,
+		client:        srv.Client(),
+		urls:          []string{srv.URL},
+		root:          t.TempDir(),
+		skipGC:        true,
+		importFunc:    func(_ context.Context, _ io.Reader) error { return nil },
+		retryDelay:    1 * time.Second,
+		retryMax:      1,
+		distManager:   newDistManager(store),
+	}
+
+	metadataStore.EXPECT().
+		GetLastVulnerabilityUpdate(gomock.Any()).
+		Return(prevTime, nil)
+
+	// Pre-registration phase.
+	preReg := metadataStore.EXPECT().
+		GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleName, prevTime).
+		Return(prevTime, nil)
+
+	// Processing phase: lastTime (prevTime) is before the entry's Modified time, so it runs.
+	metadataStore.EXPECT().
+		GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleName, prevTime).
+		Return(prevTime, nil).
+		After(preReg)
+
+	// Saved timestamp is the entry's Modified time, not zipTime.
+	metadataStore.EXPECT().
+		SetLastVulnerabilityUpdate(gomock.Any(), bundleName, gomock.Cond(func(got time.Time) bool {
+			return got.Equal(entryModified)
+		})).
+		Return(nil)
+
+	// GC and Initialized at end of runMultiBundleUpdate.
+	metadataStore.EXPECT().
+		GCVulnerabilityUpdates(gomock.Any(), gomock.Any(), now).
+		Return(nil)
+	store.EXPECT().
+		Distributions(gomock.Any()).
+		Return(nil, nil)
+	metadataStore.EXPECT().
+		GetLastVulnerabilityUpdate(gomock.Any()).
+		Return(now, nil)
+
+	err = u.Update(test.Logging(t))
+	assert.NoError(t, err)
+}
+
+func TestMultiBundleUpdate_UnchangedBundleNotReimported(t *testing.T) {
+	const bundleA = "alpine.json.zst"
+	const bundleB = "nvd.json.zst"
+
+	buildZip := func(t *testing.T, modA, modB time.Time) []byte {
+		var buf bytes.Buffer
+		zw := zip.NewWriter(&buf)
+		for _, e := range []struct {
+			name string
+			mod  time.Time
+		}{{bundleA, modA}, {bundleB, modB}} {
+			w, err := zw.CreateHeader(&zip.FileHeader{
+				Name:     e.name,
+				Method:   zip.Deflate,
+				Modified: e.mod,
+			})
+			require.NoError(t, err)
+			_, err = w.Write([]byte("fake-compressed-content"))
+			require.NoError(t, err)
+		}
+		require.NoError(t, zw.Close())
+		return buf.Bytes()
+	}
+
+	var requestCount int
+	var zip1, zip2 []byte
+	srv, now := testHTTPServer(t, func(_ *http.Request) io.ReadSeeker {
+		requestCount++
+		if requestCount == 1 {
+			return bytes.NewReader(zip1)
+		}
+		return bytes.NewReader(zip2)
+	})
+
+	modA, err := http.ParseTime(now.Add(-3 * time.Hour).Format(http.TimeFormat))
+	require.NoError(t, err)
+	modB1, err := http.ParseTime(now.Add(-3 * time.Hour).Format(http.TimeFormat))
+	require.NoError(t, err)
+	modB2, err := http.ParseTime(now.Add(-1 * time.Hour).Format(http.TimeFormat))
+	require.NoError(t, err)
+
+	// Cycle 1: both bundles are new. Cycle 2: bundleA's entry is unchanged
+	// (still modA), bundleB's entry changed (modB2 > modB1).
+	zip1 = buildZip(t, modA, modB1)
+	zip2 = buildZip(t, modA, modB2)
+
+	ctrl := gomock.NewController(t)
+	store := mocks.NewMockMatcherStore(ctrl)
+	metadataStore := mocks.NewMockMatcherMetadataStore(ctrl)
+
+	var importCount int
+	u := &Updater{
+		locker:        &testLocker{locker: updates.NewLocalLockSource()},
+		store:         store,
+		metadataStore: metadataStore,
+		client:        srv.Client(),
+		urls:          []string{srv.URL},
+		root:          t.TempDir(),
+		skipGC:        true,
+		importFunc: func(_ context.Context, _ io.Reader) error {
+			importCount++
+			return nil
+		},
+		retryDelay:  1 * time.Second,
+		retryMax:    1,
+		distManager: newDistManager(store),
+	}
+
+	prevTime1 := now.Add(-4 * time.Hour)
+	prevTime2 := modA // aggregate MIN after cycle 1, since both bundles landed on modA==modB1.
+
+	gomock.InOrder(
+		// Cycle 1: both bundles are new, both import.
+		metadataStore.EXPECT().GetLastVulnerabilityUpdate(gomock.Any()).Return(prevTime1, nil),
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleA, prevTime1).Return(prevTime1, nil),
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleB, prevTime1).Return(prevTime1, nil),
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleA, prevTime1).Return(prevTime1, nil),
+		metadataStore.EXPECT().SetLastVulnerabilityUpdate(gomock.Any(), bundleA, gomock.Cond(func(got time.Time) bool {
+			return got.Equal(modA)
+		})).Return(nil),
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleB, prevTime1).Return(prevTime1, nil),
+		metadataStore.EXPECT().SetLastVulnerabilityUpdate(gomock.Any(), bundleB, gomock.Cond(func(got time.Time) bool {
+			return got.Equal(modB1)
+		})).Return(nil),
+		metadataStore.EXPECT().GCVulnerabilityUpdates(gomock.Any(), gomock.Any(), now).Return(nil),
+		store.EXPECT().Distributions(gomock.Any()).Return(nil, nil),
+		metadataStore.EXPECT().GetLastVulnerabilityUpdate(gomock.Any()).Return(modA, nil), // Initialized() caches true from here on.
+
+		// Cycle 2: bundleA unchanged (must NOT reimport), bundleB changed (must reimport).
+		metadataStore.EXPECT().GetLastVulnerabilityUpdate(gomock.Any()).Return(prevTime2, nil),
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleA, prevTime2).Return(modA, nil),
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleB, prevTime2).Return(modB1, nil),
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleA, prevTime2).Return(modA, nil),
+		// No SetLastVulnerabilityUpdate for bundleA: it must be skipped, not reimported.
+		metadataStore.EXPECT().GetOrSetLastVulnerabilityUpdate(gomock.Any(), bundleB, prevTime2).Return(modB1, nil),
+		metadataStore.EXPECT().SetLastVulnerabilityUpdate(gomock.Any(), bundleB, gomock.Cond(func(got time.Time) bool {
+			return got.Equal(modB2)
+		})).Return(nil),
+		metadataStore.EXPECT().GCVulnerabilityUpdates(gomock.Any(), gomock.Any(), now).Return(nil),
+		store.EXPECT().Distributions(gomock.Any()).Return(nil, nil),
+		// Initialized() short-circuits on the cached value: no further GetLastVulnerabilityUpdate call.
+	)
+
+	require.NoError(t, u.Update(test.Logging(t)))
+	assert.Equal(t, 2, importCount, "cycle 1 should import both bundles")
+
+	require.NoError(t, u.Update(test.Logging(t)))
+	assert.Equal(t, 3, importCount, "cycle 2 should only reimport the changed bundle (bundleB), not the unchanged bundleA")
+}
+
 func TestFetch(t *testing.T) {
 	srv, now := testHTTPServer(t, func(_ *http.Request) io.ReadSeeker {
 		return strings.NewReader("test")
@@ -426,6 +687,119 @@ func TestIsBundleAllowed(t *testing.T) {
 	}
 }
 
+func TestRunMultiBundleUpdate_PartialFailure(t *testing.T) {
+	bundleNames := []string{"alpine.json.zst", "nvd.json.zst", "rhel-vex.json.zst"}
+
+	// Create a minimal valid zstd frame around empty content.
+	makeZstd := func() []byte {
+		var buf bytes.Buffer
+		w, err := zstd.NewWriter(&buf)
+		require.NoError(t, err)
+		require.NoError(t, w.Close())
+		return buf.Bytes()
+	}
+
+	entryModified, err := http.ParseTime(time.Now().Add(-2 * time.Hour).UTC().Format(http.TimeFormat))
+	require.NoError(t, err)
+
+	srv, now := testHTTPServer(t, func(_ *http.Request) io.ReadSeeker {
+		var buf bytes.Buffer
+		zw := zip.NewWriter(&buf)
+		for _, name := range bundleNames {
+			f, err := zw.CreateHeader(&zip.FileHeader{
+				Name:     name,
+				Method:   zip.Deflate,
+				Modified: entryModified,
+			})
+			require.NoError(t, err)
+			_, err = f.Write(makeZstd())
+			require.NoError(t, err)
+		}
+		require.NoError(t, zw.Close())
+		return bytes.NewReader(buf.Bytes())
+	})
+
+	ctrl := gomock.NewController(t)
+	store := mocks.NewMockMatcherStore(ctrl)
+	metadataStore := mocks.NewMockMatcherMetadataStore(ctrl)
+
+	prevTime := entryModified.Add(-time.Minute)
+
+	// importFunc fails for the second call (nvd), succeeds for the others.
+	importCallCount := 0
+	u := &Updater{
+		locker:        &testLocker{locker: updates.NewLocalLockSource()},
+		store:         store,
+		metadataStore: metadataStore,
+		client:        srv.Client(),
+		urls:          []string{srv.URL},
+		root:          t.TempDir(),
+		skipGC:        true,
+		importFunc: func(_ context.Context, _ io.Reader) error {
+			importCallCount++
+			if importCallCount == 2 {
+				return errors.New("fake import error")
+			}
+			return nil
+		},
+		retryDelay:  1 * time.Second,
+		retryMax:    1,
+		distManager: newDistManager(store),
+	}
+
+	// Start of runMultiBundleUpdate.
+	metadataStore.EXPECT().
+		GetLastVulnerabilityUpdate(gomock.Any()).
+		Return(prevTime, nil)
+
+	// Pre-registration phase: one call per bundle.
+	preReg := make([]*gomock.Call, len(bundleNames))
+	for i, name := range bundleNames {
+		preReg[i] = metadataStore.EXPECT().
+			GetOrSetLastVulnerabilityUpdate(gomock.Any(), name, prevTime).
+			Return(prevTime, nil)
+	}
+
+	// Processing phase: return prevTime so each bundle proceeds to import.
+	for _, name := range bundleNames {
+		call := metadataStore.EXPECT().
+			GetOrSetLastVulnerabilityUpdate(gomock.Any(), name, prevTime).
+			Return(prevTime, nil)
+		for _, pre := range preReg {
+			call.After(pre)
+		}
+	}
+
+	// SetLastVulnerabilityUpdate is called only for the two bundles that succeed.
+	metadataStore.EXPECT().
+		SetLastVulnerabilityUpdate(gomock.Any(), "alpine.json.zst", gomock.Cond(func(got time.Time) bool {
+			return got.Equal(entryModified)
+		})).
+		Return(nil)
+	metadataStore.EXPECT().
+		SetLastVulnerabilityUpdate(gomock.Any(), "rhel-vex.json.zst", gomock.Cond(func(got time.Time) bool {
+			return got.Equal(entryModified)
+		})).
+		Return(nil)
+
+	// GC and distribution update run because at least one bundle succeeded.
+	metadataStore.EXPECT().
+		GCVulnerabilityUpdates(gomock.Any(), gomock.Any(), now).
+		Return(nil)
+	store.EXPECT().
+		Distributions(gomock.Any()).
+		Return(nil, nil)
+
+	// Initialized check at end of runMultiBundleUpdate.
+	metadataStore.EXPECT().
+		GetLastVulnerabilityUpdate(gomock.Any()).
+		Return(now, nil)
+
+	err = u.Update(test.Logging(t))
+	assert.ErrorContains(t, err, "nvd.json.zst")
+	assert.Equal(t, 3, importCallCount, "all three bundles must be attempted")
+}
+
 func TestIsRetryableDialError(t *testing.T) {
 	testCases := map[string]struct {
 		err  error
diff --git a/scanner/services/validators/validators.go b/scanner/services/validators/validators.go
index d912f65eca071..d3b6e15c938bd 100644
--- a/scanner/services/validators/validators.go
+++ b/scanner/services/validators/validators.go
@@ -154,6 +154,20 @@ func validateContents(contents *v4.Contents) error {
 	return nil
 }
 
+// validateCPE reports an error if s is a non-empty string that isn't a valid
+// bound CPE WFN. An empty string is treated as "no CPE" and is not an error,
+// matching the same convention mappers.toClairCoreCPE uses for the wire
+// format: ClairCore's own zero-value WFN and this package's empty string are
+// both accepted as "unset", even though StackRox's own mappers now always
+// serialize "unset" as the bound wildcard CPE rather than "".
+func validateCPE(s string) error {
+	if s == "" {
+		return nil
+	}
+	_, err := cpe.Unbind(s)
+	return err
+}
+
 func validateMap[T hasIDAndCPE](m map[string]T, fieldName string, validateF func(T) error) error {
 	for k, v := range m {
 		if reflect.ValueOf(v).IsZero() {
@@ -162,8 +176,7 @@ func validateMap[T hasIDAndCPE](m map[string]T, fieldName string, validateF func
 		if v.GetId() == "" {
 			return fmt.Errorf("%s element %q: ID is empty", fieldName, k)
 		}
-		_, err := cpe.Unbind(v.GetCpe())
-		if err != nil {
+		if err := validateCPE(v.GetCpe()); err != nil {
 			return fmt.Errorf("%s element %q: invalid CPE: %w", fieldName, k, err)
 		}
 		if err := validateF(v); err != nil {
@@ -182,8 +195,7 @@ func validateList[T hasIDAndCPE](l []T, fieldName string, validateF func(T) erro
 		if o.GetId() == "" {
 			return fmt.Errorf("%s element #%d: Id is empty", fieldName, n)
 		}
-		_, err := cpe.Unbind(o.GetCpe())
-		if err != nil {
+		if err := validateCPE(o.GetCpe()); err != nil {
 			return fmt.Errorf("%s element #%d (id: %q): invalid CPE: %w", fieldName, n, o.GetId(), err)
 		}
 		if err := validateF(o); err != nil {
diff --git a/scanner/services/validators/validators_test.go b/scanner/services/validators/validators_test.go
index 5150f073f46cd..d64c289f316a0 100644
--- a/scanner/services/validators/validators_test.go
+++ b/scanner/services/validators/validators_test.go
@@ -131,6 +131,14 @@ func Test_validateGetVulnerabilitiesRequest(t *testing.T) {
 				addPackageDEPRECATED(&v4.Package{Id: "foobar", Cpe: "cpe:2.3:*:*:*:*:*:*:*:*:*:*:*"}),
 			},
 		},
+		"when a package has an empty CPE": {
+			// An empty CPE is treated the same as an unset one (e.g. the bound
+			// wildcard), not an invalid CPE. See mappers.toClairCoreCPE.
+			argOpts: []opts{
+				addPackage(&v4.Package{Id: "foobar", Cpe: ""}),
+				addPackageDEPRECATED(&v4.Package{Id: "foobar", Cpe: ""}),
+			},
+		},
 		"when a package has a source package with another source package": {
 			wantErr: `Contents.Packages element "foo": package ID="foo" has a source with a source`,
 			argOpts: []opts{
diff --git a/scanner/updater/ci/source-config.yaml b/scanner/updater/ci/source-config.yaml
index cdd4dcf6eef47..e39335eaf0fd3 100644
--- a/scanner/updater/ci/source-config.yaml
+++ b/scanner/updater/ci/source-config.yaml
@@ -10,10 +10,18 @@
 # updaters: per-updater configuration. Each updater inherits from 'default'
 # unless it overrides a field. New configuration sections can be added here
 # as the pipeline evolves.
+#
+# interval: minimum age of the last successful upload before a refresh is due.
+#
+# attempt_cadence: optional spacing between eligible one-hour scheduling windows,
+# aligned to UTC epoch hours. Must be a positive whole-hour duration.
+# For example, 4h permits attempts during UTC hours 00, 04, 08, 12, 16, and 20.
+# If omitted, due refreshes may be attempted on every scheduler run.
+# Failed attempts do not change the windows or the last successful upload time.
 
 storage:
-  bucket: scanner-v4-test
-  prefix: vulnerability-bundles
+  bucket: definitions.stackrox.io
+  prefix: v4/vulnerability-bundles
 
 bundles:
   dev:
@@ -58,7 +66,24 @@ bundles:
     - stackrox-rhel-csaf
     - suse
     - ubuntu
+  v4:
+    - alpine
+    - aws
+    - debian
+    - epss
+    - manual
+    - nvd
+    - oracle
+    - osv
+    - photon
+    - rhel-vex
+    - stackrox-rhel-csaf
+    - suse
+    - ubuntu
 
 updaters:
   default:
     interval: 4h
+  oracle:
+    interval: 8h
+    attempt_cadence: 4h
diff --git a/scanner/updater/export.go b/scanner/updater/export.go
index faf2d5158bda7..ca0ce59f53503 100644
--- a/scanner/updater/export.go
+++ b/scanner/updater/export.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strconv"
 	"time"
 
 	"github.com/klauspost/compress/zstd"
@@ -201,26 +202,40 @@ func rhelVexOpts() []updates.ManagerOption {
 		updates.WithEnabled([]string{rhelVexUpdaterName}),
 		updates.WithConfigs(map[string]driver.ConfigUnmarshaler{
 			rhelVexUpdaterName: func(i any) error {
-				ctx := context.Background()
-				ctx = log.With(ctx, "updater", rhelVexUpdaterName)
+				ctx := log.With(context.Background(), "updater", rhelVexUpdaterName)
+				// Validate during factory configuration so invalid input fails manager
+				// initialization; updater configuration errors only skip the updater.
+				ignoreKernel := false
+				if value := os.Getenv("STACKROX_RHEL_VEX_IGNORE_KERNEL_PACKAGES"); value != "" {
+					var err error
+					ignoreKernel, err = strconv.ParseBool(value)
+					if err != nil {
+						return fmt.Errorf("STACKROX_RHEL_VEX_IGNORE_KERNEL_PACKAGES: %w", err)
+					}
+				}
 
-				// This function gets called for both the Factory and the Updater.
-				// We only need to configure the Factory (which has the CompressedFileTimeout field).
+				// The factory passes the download timeout to the updater; UpdaterConfig
+				// has no timeout field. Kernel exclusion is set on UpdaterConfig because
+				// the manager configures the updater after construction, overwriting any
+				// kernel-exclusion value inherited from the factory.
 				switch cfg := i.(type) {
 				case *vex.FactoryConfig:
-					// Configure the factory with custom timeout.
-					timeout := os.Getenv("STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT")
-					if timeout != "" {
-						parsedTimeout, err := time.ParseDuration(timeout)
+					var timeout *claircore.Duration
+					if value := os.Getenv("STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT"); value != "" {
+						parsedTimeout, err := time.ParseDuration(value)
 						if err != nil {
 							slog.WarnContext(ctx, "using default STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT due to invalid duration", "reason", err)
 						} else {
-							cfg.CompressedFileTimeout = claircore.Duration(parsedTimeout)
+							duration := claircore.Duration(parsedTimeout)
+							timeout = &duration
 							slog.InfoContext(ctx, "using compressed file timeout", "timeout", parsedTimeout.String())
 						}
 					}
+					if timeout != nil {
+						cfg.CompressedFileTimeout = *timeout
+					}
 				case *vex.UpdaterConfig:
-					// Updater config - nothing to configure here.
+					cfg.IgnoreKernelPackages = ignoreKernel
 				default:
 					return fmt.Errorf("rhel-vex: unexpected config type: %T", i)
 				}
diff --git a/scanner/updater/export_test.go b/scanner/updater/export_test.go
index 23c33dc90a945..caca347d2be5c 100644
--- a/scanner/updater/export_test.go
+++ b/scanner/updater/export_test.go
@@ -1,15 +1,101 @@
 package updater
 
 import (
+	"context"
 	"maps"
+	"net/http"
 	"slices"
 	"testing"
+	"time"
 
+	"github.com/quay/claircore"
+	"github.com/quay/claircore/libvuln/driver"
 	"github.com/quay/claircore/libvuln/updates"
+	"github.com/quay/claircore/rhel/vex"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// configCaptureFactory captures the callback registered with the updates manager.
+type configCaptureFactory struct {
+	driver.UpdaterSetFactory
+	configure driver.ConfigUnmarshaler
+}
+
+func (f *configCaptureFactory) Configure(_ context.Context, configure driver.ConfigUnmarshaler, _ *http.Client) error {
+	f.configure = configure
+	return nil
+}
+
+func rhelVexConfigForTest(t *testing.T) driver.ConfigUnmarshaler {
+	t.Helper()
+	factory := &configCaptureFactory{}
+	opts := append(rhelVexOpts(), updates.WithFactories(map[string]driver.UpdaterSetFactory{
+		rhelVexUpdaterName: factory,
+	}))
+	_, err := updates.NewManager(context.Background(), nil, nil, http.DefaultClient, opts...)
+	require.NoError(t, err)
+	require.NotNil(t, factory.configure)
+	return factory.configure
+}
+
+func TestRHELVexOpts(t *testing.T) {
+	configure := rhelVexConfigForTest(t)
+	for name, tc := range map[string]struct {
+		value string
+		want  bool
+		err   bool
+	}{
+		"unset":    {},
+		"enabled":  {value: "true", want: true},
+		"disabled": {value: "false"},
+		"invalid":  {value: "invalid", err: true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv("STACKROX_RHEL_VEX_IGNORE_KERNEL_PACKAGES", tc.value)
+			t.Setenv("STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT", "10m")
+			factory := &vex.FactoryConfig{}
+			updater := &vex.UpdaterConfig{}
+			for _, cfg := range []any{factory, updater} {
+				err := configure(cfg)
+				if tc.err {
+					require.ErrorContains(t, err, "STACKROX_RHEL_VEX_IGNORE_KERNEL_PACKAGES")
+				} else {
+					require.NoError(t, err)
+				}
+			}
+			if !tc.err {
+				assert.False(t, factory.IgnoreKernelPackages)
+				assert.Equal(t, tc.want, updater.IgnoreKernelPackages)
+				assert.Equal(t, claircore.Duration(10*time.Minute), factory.CompressedFileTimeout)
+			}
+		})
+	}
+}
+
+func TestRHELVexOptsTimeout(t *testing.T) {
+	configure := rhelVexConfigForTest(t)
+	for name, tc := range map[string]struct {
+		value string
+		want  time.Duration
+	}{
+		"empty preserves default":   {want: time.Minute},
+		"invalid preserves default": {value: "invalid", want: time.Minute},
+		"valid overrides default":   {value: "10m", want: 10 * time.Minute},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv("STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT", tc.value)
+			t.Setenv("STACKROX_RHEL_VEX_IGNORE_KERNEL_PACKAGES", "true")
+			factory := &vex.FactoryConfig{CompressedFileTimeout: claircore.Duration(time.Minute)}
+			require.NoError(t, configure(factory))
+			assert.Equal(t, claircore.Duration(tc.want), factory.CompressedFileTimeout)
+			updater := &vex.UpdaterConfig{}
+			require.NoError(t, configure(updater))
+			assert.True(t, updater.IgnoreKernelPackages)
+		})
+	}
+}
+
 func TestFilterSources(t *testing.T) {
 	bundles := map[string][]updates.ManagerOption{
 		"alpha":   nil,
diff --git a/scanner/updater/version/RELEASE_VERSION b/scanner/updater/version/RELEASE_VERSION
index e7beb020a049a..bd9facc9a0966 100644
--- a/scanner/updater/version/RELEASE_VERSION
+++ b/scanner/updater/version/RELEASE_VERSION
@@ -8,16 +8,23 @@
 # offline bundle for that release.
 4.10.0
 4.10.1
+4.10.10
+4.10.11
 4.10.2
 4.10.3
 4.10.4
 4.10.5
 4.10.6
 4.10.7
+4.10.8
+4.10.9
 4.11.0
 4.11.1
 4.11.2
 4.11.3
+4.11.4
+4.11.5
+4.11.6
 4.4.0
 4.4.1
 4.4.2
@@ -82,3 +89,4 @@
 4.9.7
 4.9.8
 4.9.9
+5.0.0
diff --git a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION
index 6e2ed9e2edd8b..8409e0debc779 100644
--- a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION
+++ b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION
@@ -6,5 +6,7 @@
 # This process ensures that each version's vulnerability data is accurately captured and maintained in accordance with its respective version.
 dev heads/master
 v2 heads/release-4.9.x/scanner-updater-v2
-# release-4.11 at 2026-08-06, after 4.11.3-rc.0.
-v3 heads/2e8d7a35b1200eb29d5a75cad2a443719cf265e1
+# release-4.11 with claircore v1.5.55
+v3 heads/1e51a275092d9421b9acabaf09bca3ae3d59d3fc
+# master until the release branch is available.
+v4 heads/master
diff --git a/scripts/check-debugger.sh b/scripts/check-debugger.sh
index 48d8bd1de6189..d4645d2d3a238 100755
--- a/scripts/check-debugger.sh
+++ b/scripts/check-debugger.sh
@@ -6,6 +6,8 @@
 
 set -euo pipefail
 
+CONTAINER_ENGINE="${CONTAINER_ENGINE:-docker}"
+
 errecho() {
   echo >&2 -e "$@"
 }
@@ -17,9 +19,9 @@ if [[ -n "${BUILD_TAG}" && "${DEBUG_BUILD}" == "yes" ]]; then
 fi
 
 # This searches for a file in the image without running the container.
-container=$(docker create stackrox/main:"${TAG}")
-docker export "${container}" | tar t | grep 'bin/dlv$' && found_dlv="yes" || found_dlv="no"
-docker rm "${container}" &>/dev/null
+container=$(${CONTAINER_ENGINE} create stackrox/main:"${TAG}")
+${CONTAINER_ENGINE} export "${container}" | tar t | grep 'bin/dlv$' && found_dlv="yes" || found_dlv="no"
+${CONTAINER_ENGINE} rm "${container}" &>/dev/null
 
 if [[ "${found_dlv}" != "${DEBUG_BUILD}" ]]; then
   if [[ "${DEBUG_BUILD}" == "yes" ]]; then
diff --git a/scripts/ci/add-vms/action.yml b/scripts/ci/add-vms/action.yml
index 3b300baf010ec..41eca4d2c9bda 100644
--- a/scripts/ci/add-vms/action.yml
+++ b/scripts/ci/add-vms/action.yml
@@ -1,4 +1,4 @@
-name: "Add VMs to ACS Cluster"
+name: "Ensure VMs on ACS Cluster"
 description: "Install OpenShift Virtualization, deploy VMs, and install roxagent on an Infra-managed cluster"
 
 inputs:
@@ -6,11 +6,11 @@ inputs:
     description: "Infra cluster name (from `infractl list`)"
     required: true
   num-vms:
-    description: "Number of VMs to deploy"
+    description: "Desired count of {os}-1..N. Existing VMs are reused."
     required: false
     default: "1"
   vm-os:
-    description: "VM OS: rhel9 or rhel10"
+    description: "VM OS: rhel8, rhel9, or rhel10"
     required: false
     default: "rhel9"
   ssh-public-key:
diff --git a/scripts/ci/add-vms/add-vms.bats b/scripts/ci/add-vms/add-vms.bats
index 4b37bc3dba926..1c6ce5090598f 100644
--- a/scripts/ci/add-vms/add-vms.bats
+++ b/scripts/ci/add-vms/add-vms.bats
@@ -21,6 +21,7 @@ load "../../test_helpers.bats"
     ' _ "${BATS_TEST_DIRNAME}/add-vms.sh"
 
     assert_success
+    assert_output --partial "::error title=Add VMs incomplete::Skipped: rhel10-3; agent failed: rhel10-3"
 
     run cat "$summary_file"
     assert_output --partial "## Add VMs to Cluster"
diff --git a/scripts/ci/add-vms/add-vms.sh b/scripts/ci/add-vms/add-vms.sh
index 517a0143a5625..fd4f89cc880d5 100755
--- a/scripts/ci/add-vms/add-vms.sh
+++ b/scripts/ci/add-vms/add-vms.sh
@@ -7,7 +7,7 @@
 # Options:
 #   --cluster NAME       Infra cluster name (calls infractl for kubeconfig)
 #   --num-vms N          Number of VMs (default: 1)
-#   --os OS              VM OS: rhel9|rhel10 (default: rhel9)
+#   --os OS              VM OS: rhel8|rhel9|rhel10 (default: rhel9)
 #   --ssh-key PATH       Path to user SSH public key to add to target VMs
 #   --namespace NS       Target namespace (default: openshift-cnv)
 #   --vm-prefix PREFIX   VM name prefix (default: same as OS)
@@ -64,7 +64,7 @@ parse_args() {
     if ! [[ "$NUM_VMS" =~ ^[0-9]+$ ]] || (( NUM_VMS < 1 )); then
         die "--num-vms must be a positive integer"
     fi
-    [[ "$VM_OS" =~ ^rhel(9|10)$ ]] || die "--os must be rhel9 or rhel10"
+    [[ "$VM_OS" =~ ^rhel(8|9|10)$ ]] || die "--os must be rhel8, rhel9, or rhel10"
 }
 
 # Sets KUBECONFIG: either fetches it from infractl for the given cluster
@@ -218,7 +218,11 @@ write_github_summary() {
         echo ""
     } >> "$GITHUB_STEP_SUMMARY"
 
-    echo "::notice title=VM action summary::See the job summary for VM access, key download, and native service verification."
+    if [[ ${#SKIPPED_VMS[@]} -gt 0 || ${#NATIVE_AGENT_FAILED_VMS[@]} -gt 0 ]]; then
+        echo "::error title=Add VMs incomplete::Skipped: ${SKIPPED_VMS[*]}; agent failed: ${NATIVE_AGENT_FAILED_VMS[*]}. See the job summary."
+    else
+        echo "::notice title=VM action summary::See the job summary for VM access, key download, and native service verification."
+    fi
 }
 
 cleanup() {
@@ -268,6 +272,8 @@ main() {
     accessible_vms+=("${MANAGED_VMS[@]}" "${ADOPTED_VMS[@]}")
 
     if [[ ${#accessible_vms[@]} -eq 0 ]]; then
+        # Summary first so the ::error annotation still names the skipped VMs.
+        print_summary
         die "No accessible VMs — cannot install agent. All VMs failed SSH readiness."
     else
         export AUTOMATION_SSH_PRIVKEY
@@ -278,6 +284,9 @@ main() {
 
     # Step 4: Summary
     print_summary
+    if [[ ${#SKIPPED_VMS[@]} -gt 0 || ${#NATIVE_AGENT_FAILED_VMS[@]} -gt 0 ]]; then
+        die "Some VMs were skipped or the native agent failed to start"
+    fi
 }
 
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
diff --git a/scripts/ci/bats/lib_release_version_test.bats b/scripts/ci/bats/lib_release_version_test.bats
index 07a602fb32faa..fe66082173aef 100644
--- a/scripts/ci/bats/lib_release_version_test.bats
+++ b/scripts/ci/bats/lib_release_version_test.bats
@@ -85,7 +85,7 @@ function setup() {
     assert_output ""
 }
 
-# check_collector_version(), check_scanner_version() tests
+# check_collector_version(), check_fact_version() tests
 
 function make() {
     echo "${tags[$3]}"
@@ -130,23 +130,3 @@ function make() {
     run check_fact_version
     assert_success
 }
-
-@test "spots scanner tag is a master commit" {
-    declare -A tags=( [scanner-tag]="3.45.x-12-g8a2e05d0ec")
-    run check_scanner_version
-    assert_failure
-    assert_output --partial 'Scanner tag does not look like a release tag'
-}
-
-@test "spots scanner tag is a release candidate" {
-    declare -A tags=( [scanner-tag]="3.45.1-rc.1")
-    run check_scanner_version
-    assert_failure
-    assert_output --partial 'Scanner tag does not look like a release tag'
-}
-
-@test "spots scanner tag is a release" {
-    declare -A tags=( [scanner-tag]="3.45.1")
-    run check_scanner_version
-    assert_success
-}
diff --git a/scripts/ci/bats/scanner-updater-config.bats b/scripts/ci/bats/scanner-updater-config.bats
new file mode 100644
index 0000000000000..d9680a53c5a86
--- /dev/null
+++ b/scripts/ci/bats/scanner-updater-config.bats
@@ -0,0 +1,67 @@
+#!/usr/bin/env bats
+# shellcheck disable=SC1091
+
+load "../../test_helpers.bats"
+
+function setup() {
+    repo_root="$(cd "${BATS_TEST_DIRNAME}/../../.." && pwd)"
+    config_script="${repo_root}/.github/workflows/scripts/scanner-updater-config.sh"
+    export SOURCE_CONFIG="${BATS_TEST_TMPDIR}/source-config.yaml"
+}
+
+@test "Oracle uses eight-hour freshness and four-hour attempt cadence" {
+    run env SOURCE_CONFIG="${repo_root}/scanner/updater/ci/source-config.yaml" \
+        "$config_script" interval-secs oracle
+    assert_success
+    assert_output "28800"
+
+    run env SOURCE_CONFIG="${repo_root}/scanner/updater/ci/source-config.yaml" \
+        "$config_script" attempt-cadence-secs oracle
+    assert_success
+    assert_output "14400"
+}
+
+@test "sources without a cadence retain default freshness and unrestricted attempts" {
+    run env SOURCE_CONFIG="${repo_root}/scanner/updater/ci/source-config.yaml" \
+        "$config_script" interval-secs debian
+    assert_success
+    assert_output "14400"
+
+    run env SOURCE_CONFIG="${repo_root}/scanner/updater/ci/source-config.yaml" \
+        "$config_script" attempt-cadence-secs debian
+    assert_success
+    assert_output "0"
+}
+
+@test "attempt cadence inherits the default and supports per-source overrides" {
+    cat > "$SOURCE_CONFIG" <<'YAML'
+updaters:
+  default:
+    attempt_cadence: 6h
+  oracle:
+    attempt_cadence: 240m
+YAML
+    run "$config_script" attempt-cadence-secs debian
+    assert_success
+    assert_output "21600"
+
+    run "$config_script" attempt-cadence-secs oracle
+    assert_success
+    assert_output "14400"
+}
+
+@test "attempt cadence rejects zero and fractional-hour durations" {
+    for cadence in 0h 30m 1h30m; do
+        printf 'updaters:\n  oracle:\n    attempt_cadence: %s\n' "$cadence" > "$SOURCE_CONFIG"
+        run "$config_script" attempt-cadence-secs oracle
+        assert_failure
+        assert_output --partial "attempt_cadence must be a positive whole-hour duration"
+    done
+}
+
+@test "attempt cadence rejects malformed durations" {
+    printf 'updaters:\n  oracle:\n    attempt_cadence: invalid\n' > "$SOURCE_CONFIG"
+    run "$config_script" attempt-cadence-secs oracle
+    assert_failure
+    assert_output --partial "cannot parse duration"
+}
diff --git a/scripts/ci/bats/scanner-updater-matrix.bats b/scripts/ci/bats/scanner-updater-matrix.bats
new file mode 100644
index 0000000000000..62147b86af1e8
--- /dev/null
+++ b/scripts/ci/bats/scanner-updater-matrix.bats
@@ -0,0 +1,124 @@
+#!/usr/bin/env bats
+# shellcheck disable=SC1091
+
+load "../../test_helpers.bats"
+
+function setup() {
+    bats_require_minimum_version 1.5.0
+    repo_root="$(cd "${BATS_TEST_DIRNAME}/../../.." && pwd)"
+    fixture="${BATS_TEST_TMPDIR}/repo"
+    scripts="${fixture}/.github/workflows/scripts"
+    mkdir -p "$scripts"
+    cp "${repo_root}/.github/workflows/scripts/scanner-updater-matrix.sh" "$scripts/"
+    cp "${repo_root}/.github/workflows/scripts/scanner-updater-config.sh" "$scripts/"
+    export SOURCE_CONFIG="${fixture}/source-config.yaml"
+    export FRESHNESS_CALLS="${BATS_TEST_TMPDIR}/freshness-calls"
+    export SOURCE_FRESH=false
+    export FRESHNESS_ERROR=false
+    export SCHEDULE_TIME="2026-10-14T08:27:00Z"
+    : > "$FRESHNESS_CALLS"
+
+    cat > "$SOURCE_CONFIG" <<'YAML'
+storage:
+  bucket: test-bucket
+  prefix: test-prefix
+bundles:
+  dev: [oracle, debian]
+  v4: [oracle, debian]
+updaters:
+  default:
+    interval: 4h
+  oracle:
+    interval: 8h
+    attempt_cadence: 4h
+YAML
+
+    cat > "${scripts}/scanner-get-released-tags.sh" <<'SH'
+#!/usr/bin/env bash
+echo '[{"version":"dev","ref":"master"},{"version":"v4","ref":"release"}]'
+SH
+    cat > "${scripts}/scanner-updater-check-freshness.sh" <<'SH'
+#!/usr/bin/env bash
+printf '%s %s\n' "$GCS_OBJECT" "$*" >> "$FRESHNESS_CALLS"
+if [[ "$FRESHNESS_ERROR" == true ]]; then
+    exit 1
+fi
+echo "$SOURCE_FRESH"
+SH
+    chmod +x "${scripts}/scanner-get-released-tags.sh" \
+        "${scripts}/scanner-updater-check-freshness.sh"
+    cd "$fixture" || return 1
+}
+
+@test "due sources are scheduled in eligible hours across streams" {
+    run "${scripts}/scanner-updater-matrix.sh"
+    assert_success
+    run jq -e '.has_due == "true" and .has_errors == "false" and
+        ([.matrix.include[] | select(.source == "oracle")] | length == 2)' <<< "$output"
+    assert_success
+    run grep -c 'oracle.json.zst --max-age 28800' "$FRESHNESS_CALLS"
+    assert_success
+    assert_output "2"
+    run grep -c 'debian.json.zst --max-age 14400' "$FRESHNESS_CALLS"
+    assert_success
+    assert_output "2"
+}
+
+@test "ineligible hours skip Oracle before freshness checks but retain other sources" {
+    run env SCHEDULE_TIME="2026-10-14T09:27:00Z" \
+        "${scripts}/scanner-updater-matrix.sh"
+    assert_success
+    run jq -e '.matrix.include | length == 2 and all(.[]; .source == "debian")' <<< "$output"
+    assert_success
+    run grep oracle "$FRESHNESS_CALLS"
+    assert_failure
+}
+
+@test "fresh sources are not scheduled even in eligible hours" {
+    run env SOURCE_FRESH=true "${scripts}/scanner-updater-matrix.sh"
+    assert_success
+    run jq -e '.has_due == "false" and .has_errors == "false" and
+        (.matrix.include | length == 0)' <<< "$output"
+    assert_success
+}
+
+@test "eligible windows include the whole hour and cross midnight" {
+    for timestamp in 2026-10-14T23:59:59Z 2026-10-15T00:00:00Z 2026-10-15T00:59:59Z 2026-10-15T01:00:00Z; do
+        expected=0
+        [[ "$timestamp" == *T00:* ]] && expected=2
+        run env SCHEDULE_TIME="$timestamp" "${scripts}/scanner-updater-matrix.sh"
+        assert_success
+        run jq -e --argjson expected "$expected" \
+            '[.matrix.include[] | select(.source == "oracle")] | length == $expected' <<< "$output"
+        assert_success
+    done
+}
+
+@test "changing cadence changes eligible hours using UTC epoch alignment" {
+    yq eval -i '.updaters.oracle.attempt_cadence = "5h"' "$SOURCE_CONFIG"
+    run env SCHEDULE_TIME="1970-01-02T00:27:00Z" \
+        "${scripts}/scanner-updater-matrix.sh"
+    assert_success
+    run jq -e '[.matrix.include[] | select(.source == "oracle")] | length == 0' <<< "$output"
+    assert_success
+
+    run env SCHEDULE_TIME="1970-01-02T01:27:00Z" \
+        "${scripts}/scanner-updater-matrix.sh"
+    assert_success
+    run jq -e '[.matrix.include[] | select(.source == "oracle")] | length == 2' <<< "$output"
+    assert_success
+}
+
+@test "freshness lookup failures remain visible scheduling errors" {
+    run --separate-stderr env FRESHNESS_ERROR=true "${scripts}/scanner-updater-matrix.sh"
+    assert_success
+    [[ "$stderr" == *"::error::gs://test-bucket/test-prefix/dev/sources/oracle.json.zst: freshness check failed"* ]]
+    run jq -e '.has_errors == "true" and (.errors | length == 4) and
+        (.matrix.include | length == 0)' <<< "$output"
+    assert_success
+}
+
+@test "invalid scheduling time fails rather than using the current time" {
+    run env SCHEDULE_TIME="invalid" "${scripts}/scanner-updater-matrix.sh"
+    assert_failure
+}
diff --git a/scripts/ci/collect-collector-metrics.sh b/scripts/ci/collect-collector-metrics.sh
index 777e922197db9..6d9ef92fd4af7 100755
--- a/scripts/ci/collect-collector-metrics.sh
+++ b/scripts/ci/collect-collector-metrics.sh
@@ -53,6 +53,7 @@ main() {
         exit 0
     fi
 
+    exit_code=0
     for pod in ${pods}; do
         remote="${pod}:${pod_port}"
         metrics_file="${pod}.txt"
@@ -73,11 +74,17 @@ main() {
         done
         echo
         echo "set up port-forwarding from $remote to $local"
-        curl --silent --fail -k "${local}/${metrics_path}" > "${metrics_dir}/${metrics_file}"
-        echo "finished download ${metrics_file}"
+        if curl --silent --fail -k "${local}/${metrics_path}" > "${metrics_dir}/${metrics_file}"; then
+            echo "finished download ${metrics_file}"
+        else
+            echo >&2 "failed to download metrics from $pod"
+            exit_code=1
+        fi
         kill ${PID}
         echo "finished tear down of port-forwarding from $remote to $local"
     done
+
+    return "${exit_code}"
 }
 
 main "$@"
diff --git a/scripts/ci/collect-service-logs.sh b/scripts/ci/collect-service-logs.sh
index e8ce1ad22aa0a..6564f669f4aa9 100755
--- a/scripts/ci/collect-service-logs.sh
+++ b/scripts/ci/collect-service-logs.sh
@@ -69,7 +69,8 @@ main() {
     set +e
 
     for object in daemonsets deployments services pods secrets serviceaccounts validatingwebhookconfigurations \
-      catalogsources subscriptions clusterserviceversions central securedclusters nodes persistentvolumeclaims; do
+      catalogsources subscriptions clusterserviceversions central securedclusters nodes persistentvolumeclaims \
+      storageclasses; do
         # A feel good command before pulling logs
         info ">>> Collecting ${object} from namespace ${namespace} <<<"
         out="$(mktemp)"
@@ -83,7 +84,15 @@ main() {
         local item_count=0
 
         for item in $(kubectl -n "${namespace}" get "${object}" -o jsonpath='{.items}' | jq -r '.[] | select(.metadata.deletionTimestamp | not) | .metadata.name'); do
-            kubectl get "${object}" "${item}" -n "${namespace}" -o json > "${log_dir}/${object}/${item}_object.json" 2>&1
+            if ! kubectl get "${object}" "${item}" -n "${namespace}" -o json > "${log_dir}/${object}/${item}_object.json" 2>/dev/null; then
+                # The object may have been deleted/replaced between listing it above and
+                # fetching it here. Don't let the stderr text (e.g. "Error from server
+                # (NotFound)") get merged into what is meant to be a JSON file, and don't
+                # leave a partial/empty file behind for downstream jq consumers to choke on.
+                info "Cannot get ${object}/${item} in ${namespace} (likely deleted mid-collection): skipping"
+                rm -f "${log_dir}/${object}/${item}_object.json"
+                continue
+            fi
             {
               kubectl describe "${object}" "${item}" -n "${namespace}" 2>&1
               echo
diff --git a/scripts/ci/collect-vm-guest-logs.sh b/scripts/ci/collect-vm-guest-logs.sh
new file mode 100755
index 0000000000000..ed9fae05bd5fe
--- /dev/null
+++ b/scripts/ci/collect-vm-guest-logs.sh
@@ -0,0 +1,287 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# collect-vm-guest-logs.sh copies roxagent journals from VM-scanning e2e guests
+# via virtctl ssh. Best-effort: always exits 0.
+#
+# Usage:
+#   collect-vm-guest-logs.sh <output-dir>
+#
+# Environment:
+#   VM_SCAN_NAMESPACE_PREFIX  default: vm-scan-e2e
+#   VM_GUEST_USER             default: cloud-user
+#   VM_SCAN_E2E_DIR           host files shared with the test run (default: /tmp/vm-scan-e2e)
+#   VM_SSH_PRIVATE_KEY_PATH   PEM identity for virtctl (default: $VM_SCAN_E2E_DIR/ssh-identity)
+#   VIRTCTL_PATH              optional virtctl override
+#   VM_GUEST_JOURNAL_TIMEOUT  per-VM virtctl ssh ceiling (default: 90s)
+#   VM_GUEST_COLLECT_DEADLINE total collection budget (default: 540s)
+
+SCRIPTS_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)"
+# shellcheck source=../../scripts/ci/lib.sh
+source "$SCRIPTS_ROOT/scripts/ci/lib.sh"
+
+usage() {
+    echo "./scripts/ci/collect-vm-guest-logs.sh <output-dir>"
+}
+
+vm_scan_e2e_dir() {
+    printf '%s\n' "${VM_SCAN_E2E_DIR:-/tmp/vm-scan-e2e}"
+}
+
+resolve_virtctl() {
+    if [[ -n "${VIRTCTL_PATH:-}" ]]; then
+        if [[ -x "$VIRTCTL_PATH" ]]; then
+            printf '%s\n' "$VIRTCTL_PATH"
+            return 0
+        fi
+        info "VIRTCTL_PATH is not executable: ${VIRTCTL_PATH}" >&2
+        return 1
+    fi
+    local persisted
+    persisted="$(vm_scan_e2e_dir)/virtctl"
+    if [[ -x "$persisted" ]]; then
+        printf '%s\n' "$persisted"
+        return 0
+    fi
+    local pointed
+    pointed="$(vm_scan_e2e_dir)/virtctl-path"
+    if [[ -f "$pointed" ]]; then
+        local src
+        src="$(<"$pointed")"
+        if [[ -n "$src" && -x "$src" ]]; then
+            printf '%s\n' "$src"
+            return 0
+        fi
+    fi
+    command -v virtctl
+}
+
+resolve_ssh_identity() {
+    if [[ -n "${VM_SSH_PRIVATE_KEY_PATH:-}" && -f "${VM_SSH_PRIVATE_KEY_PATH}" ]]; then
+        printf '%s\n' "${VM_SSH_PRIVATE_KEY_PATH}"
+        return 0
+    fi
+    local persisted
+    persisted="$(vm_scan_e2e_dir)/ssh-identity"
+    if [[ -f "$persisted" ]]; then
+        printf '%s\n' "$persisted"
+        return 0
+    fi
+    return 1
+}
+
+# list_vm_scan_vmis prints "namespace name" lines for VMIs in vm-scan-e2e namespaces.
+# Returns 1 when kubectl cannot list VMIs (distinct from zero matches).
+list_vm_scan_vmis() {
+    local prefix="${VM_SCAN_NAMESPACE_PREFIX:-vm-scan-e2e}"
+    local out err ns name
+    out="$(mktemp)"
+    err="$(mktemp)"
+    if ! kubectl --request-timeout=30s get vmi -A \
+        -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}' \
+        > "$out" 2>"$err"; then
+        info "kubectl get vmi failed: $(<"$err")" >&2
+        rm -f "$out" "$err"
+        return 1
+    fi
+    rm -f "$err"
+    while read -r ns name; do
+        [[ -z "$ns" || -z "$name" ]] && continue
+        if [[ "$ns" == "$prefix" || "$ns" == "${prefix}-"* ]]; then
+            printf '%s %s\n' "$ns" "$name"
+        fi
+    done < "$out"
+    rm -f "$out"
+    return 0
+}
+
+run_with_timeout() {
+    local seconds="$1"
+    shift
+    if command -v timeout >/dev/null; then
+        timeout -k 5s "${seconds}s" "$@"
+    else
+        "$@"
+    fi
+}
+
+guest_ssh() {
+    local virtctl_bin="$1"
+    local identity="$2"
+    local guest_user="$3"
+    local ns="$4"
+    local vmi="$5"
+    local ssh_timeout="$6"
+    local remote_cmd="$7"
+
+    # virtctl ssh reads stdin (OpenSSH without -n) and would consume the VMI
+    # list from the caller's while-read loop.
+    run_with_timeout "$ssh_timeout" \
+        "${virtctl_bin}" ssh \
+        --namespace "$ns" \
+        --identity-file "$identity" \
+        --local-ssh-opts="-n" \
+        --local-ssh-opts="-o StrictHostKeyChecking=no" \
+        --local-ssh-opts="-o IdentitiesOnly=yes" \
+        --local-ssh-opts="-o UserKnownHostsFile=/dev/null" \
+        --local-ssh-opts="-o BatchMode=yes" \
+        --local-ssh-opts="-o ConnectTimeout=30" \
+        --username "$guest_user" \
+        "vmi/${vmi}" \
+        --command "$remote_cmd" \
+        < /dev/null
+}
+
+# seconds_left is the timeout for the next virtctl ssh. Collection stops
+# on its own before the 10 minute post-test kill, which fails the job.
+seconds_left() {
+    local cap="${VM_GUEST_JOURNAL_TIMEOUT:-90}"
+    local left=$((collect_deadline_at - SECONDS))
+    if ((left < 1)); then
+        return 1
+    fi
+    if ((left < cap)); then
+        printf '%s\n' "$left"
+        return 0
+    fi
+    printf '%s\n' "$cap"
+}
+
+# collect_roxagent_container_journal writes container stdout that RHEL 8
+# Podman stores in its own log, not the journal. Quadlet names that
+# container systemd-roxagent.
+collect_roxagent_container_journal() {
+    local virtctl_bin="$1"
+    local identity="$2"
+    local guest_user="$3"
+    local ns="$4"
+    local vmi="$5"
+    local out_file="$6"
+    local ssh_timeout="$7"
+    local stderr_file
+
+    stderr_file="$(mktemp)"
+    if ! guest_ssh "$virtctl_bin" "$identity" "$guest_user" "$ns" "$vmi" "$ssh_timeout" \
+        "sudo podman logs --timestamps systemd-roxagent || true" \
+        > "$out_file" 2>"$stderr_file"; then
+        {
+            echo "roxagent container journal collection failed for ${ns}/${vmi}"
+            echo "virtctl: ${virtctl_bin}"
+            echo "guest_user: ${guest_user}"
+            echo "--- stderr ---"
+            cat "$stderr_file"
+        } >> "$out_file"
+    elif [[ -s "$stderr_file" ]]; then
+        {
+            echo "--- stderr ---"
+            cat "$stderr_file"
+        } >> "$out_file"
+    fi
+    rm -f "$stderr_file"
+}
+
+# collect_roxagent_journal is enough on RHEL 9 and 10, where Podman files
+# container stdout on roxagent.service. On RHEL 8 that stdout is missing
+# here, so the container journal is collected separately.
+collect_roxagent_journal() {
+    local virtctl_bin="$1"
+    local identity="$2"
+    local guest_user="$3"
+    local ns="$4"
+    local vmi="$5"
+    local out_file="$6"
+    local container_file="$7"
+    local ssh_timeout
+
+    ssh_timeout="$(seconds_left)" || return 1
+
+    local stderr_file
+    stderr_file="$(mktemp)"
+
+    if ! guest_ssh "$virtctl_bin" "$identity" "$guest_user" "$ns" "$vmi" "$ssh_timeout" \
+        "sudo journalctl -u roxagent.service -u roxagent-serve.service -b --no-pager -o short-iso" \
+        > "$out_file" 2>"$stderr_file"; then
+        {
+            echo "roxagent journal collection failed for ${ns}/${vmi}"
+            echo "virtctl: ${virtctl_bin}"
+            echo "guest_user: ${guest_user}"
+            echo "--- stderr ---"
+            cat "$stderr_file"
+        } >> "$out_file"
+    fi
+    rm -f "$stderr_file"
+    ssh_timeout="$(seconds_left)" || return 1
+    collect_roxagent_container_journal "$virtctl_bin" "$identity" "$guest_user" "$ns" "$vmi" "$container_file" "$ssh_timeout" || true
+}
+
+collect_journals() {
+    local output_dir="$1"
+    local guest_user="${VM_GUEST_USER:-cloud-user}"
+    local virtctl_bin="" identity=""
+    virtctl_bin="$(resolve_virtctl)" || virtctl_bin=""
+    identity="$(resolve_ssh_identity)" || identity=""
+
+    if [[ -n "$virtctl_bin" && -n "$identity" ]]; then
+        info ">>> Collecting roxagent journals into ${output_dir} <<<"
+        collect_deadline_at=$((SECONDS + ${VM_GUEST_COLLECT_DEADLINE:-540}))
+        local vmi_count=0 ns vmi out_file container_file vmi_list list_err
+        vmi_list="$(mktemp)"
+        list_err="$(mktemp)"
+        if ! list_vm_scan_vmis > "$vmi_list" 2>"$list_err"; then
+            info "Failed to list VMIs; writing collection-failed.txt"
+            {
+                echo "kubectl get vmi failed (not an empty match)"
+                cat "$list_err"
+            } > "${output_dir}/collection-failed.txt"
+            rm -f "$vmi_list" "$list_err"
+            return 0
+        fi
+        rm -f "$list_err"
+        while read -r ns vmi; do
+            [[ -z "$ns" || -z "$vmi" ]] && continue
+            vmi_count=$((vmi_count + 1))
+            out_file="${output_dir}/${ns}_${vmi}_roxagent.journal.log"
+            container_file="${output_dir}/${ns}_${vmi}_roxagent.container.journal.log"
+            info "Collecting roxagent journals for ${ns}/${vmi} -> ${out_file} ${container_file}"
+            if ! collect_roxagent_journal "$virtctl_bin" "$identity" "$guest_user" "$ns" "$vmi" "$out_file" "$container_file"; then
+                echo "stopped at ${ns}/${vmi}: collect deadline reached" \
+                    > "${output_dir}/collection-partial.txt"
+                break
+            fi
+        done < "$vmi_list"
+        rm -f "$vmi_list"
+
+        if [[ "$vmi_count" -eq 0 ]]; then
+            info "No VMIs found in VM scan namespaces"
+            echo "no VMIs matched prefix ${VM_SCAN_NAMESPACE_PREFIX:-vm-scan-e2e}" \
+                > "${output_dir}/collection-skipped.txt"
+        fi
+        return 0
+    fi
+
+    if [[ -z "$virtctl_bin" ]]; then
+        info "virtctl not found; skipping VM guest journal collection"
+        echo "virtctl not found" > "${output_dir}/collection-skipped.txt"
+    else
+        info "VM SSH identity not found; skipping VM guest journal collection"
+        echo "ssh identity not found at $(vm_scan_e2e_dir)/ssh-identity" \
+            > "${output_dir}/collection-skipped.txt"
+    fi
+}
+
+main() {
+    cd "$SCRIPTS_ROOT"
+
+    if [[ $# -lt 1 ]]; then
+        usage
+        exit 1
+    fi
+
+    local output_dir="$1"
+    mkdir -p "$output_dir"
+    collect_journals "$output_dir" || true
+    exit 0
+}
+
+main "$@"
diff --git a/scripts/ci/create-webhookserver.sh b/scripts/ci/create-webhookserver.sh
index c08d0191fc887..b6d83f925a956 100755
--- a/scripts/ci/create-webhookserver.sh
+++ b/scripts/ci/create-webhookserver.sh
@@ -34,7 +34,7 @@ create_webhook_server_port_forward() {
     kubectl rollout status deployment webhookserver --namespace stackrox --timeout=5m --watch=true
 
     local log="${ARTIFACT_DIR:-/tmp}/webhook_server_port_forward.log"
-    nohup "${BASH_SOURCE[0]}" restart_webhook_server_port_forward "${pod}" 0<&- &> "${log}" &
+    nohup "${BASH_SOURCE[0]}" restart_webhook_server_port_forward 0<&- &> "${log}" &
     sleep 1
 }
 
diff --git a/scripts/ci/delete-vm-ns.sh b/scripts/ci/delete-vm-ns.sh
new file mode 100755
index 0000000000000..a733d1b5e012e
--- /dev/null
+++ b/scripts/ci/delete-vm-ns.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPTS_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)"
+# shellcheck source=../../scripts/ci/lib.sh
+source "$SCRIPTS_ROOT/scripts/ci/lib.sh"
+
+usage() {
+    cat <<EOF
+$0 deletes VM-scanning e2e namespaces. Best-effort: exits 0
+when kubectl cannot list namespaces or a delete fails.
+
+Usage:
+    $0
+    $0 -h|--help
+
+Environment:
+    VM_SCAN_NAMESPACE_PREFIX  default: vm-scan-e2e
+EOF
+}
+
+delete_vm_scan_namespaces() {
+    local ns ns_list
+    info ">>> Cleaning up VM scan e2e namespaces <<<"
+    ns_list="$(mktemp)"
+    if ! list_vm_scan_namespaces > "$ns_list"; then
+        info "Skipping namespace delete: kubectl get ns failed"
+        rm -f "$ns_list"
+        return 0
+    fi
+    while IFS= read -r ns; do
+        [[ -z "$ns" ]] && continue
+        info "Deleting namespace ${ns}"
+        # 10s leaves room for the namespace list inside the 60s cleanup budget.
+        kubectl delete namespace "$ns" --wait=false --request-timeout=10s </dev/null 2>&1 || \
+            info "Namespace delete for ${ns} failed or already removed"
+    done < "$ns_list"
+    rm -f "$ns_list"
+}
+
+main() {
+    case "${1:-}" in
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        "")
+            ;;
+        *)
+            usage >&2
+            exit 1
+            ;;
+    esac
+
+    cd "$SCRIPTS_ROOT"
+    delete_vm_scan_namespaces
+    exit 0
+}
+
+main "$@"
diff --git a/scripts/ci/get-slack-user-id.sh b/scripts/ci/get-slack-user-id.sh
index b8287adce5be9..4f246c5179d7b 100755
--- a/scripts/ci/get-slack-user-id.sh
+++ b/scripts/ci/get-slack-user-id.sh
@@ -57,6 +57,7 @@ case "$github_login" in
 'parametalol')      slack_user='U02MJ72K1B5' ;;
 'pedrottimark')     slack_user='U01RN8V8DEH' ;;
 'porridge')         slack_user='U020XCUG2LA' ;;
+'rhmdnd')           slack_user='U01C24L97D1' ;;
 'rhybrillou')       slack_user='U02GPRG4NHF' ;;
 'robbycochran')     slack_user='U03NAEPKDE1' ;;
 'rukletsov')        slack_user='U01G6P17RTK' ;;
diff --git a/scripts/ci/is-scanner-v2-available.sh b/scripts/ci/is-scanner-v2-available.sh
deleted file mode 100755
index f6656b18a651b..0000000000000
--- a/scripts/ci/is-scanner-v2-available.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Asserts that scanner v2 is running and ready in the supplied namespace
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)"
-# shellcheck source=../../tests/e2e/lib.sh
-source "$ROOT/tests/e2e/lib.sh"
-
-verify_scannerV2_deployed_and_ready() {
-    if [[ "$#" -ne 1 ]]; then
-        die "missing arg. usage: verify_scannerV2_deployed_and_ready <namespace>"
-    fi
-    local namespace=${1:-stackrox}
-    info "Waiting for Scanner V2 deployment to appear in namespace ${namespace}..."
-    wait_for_object_to_appear "$namespace" deploy/scanner-db 600
-    wait_for_object_to_appear "$namespace" deploy/scanner 300
-    info "** Scanner V2 is deployed in namespace ${namespace}"
-    kubectl -n "${namespace}" wait --for=condition=ready pod -l app=scanner --timeout 5m
-}
-
-verify_scannerV2_deployed_and_ready "$@"
diff --git a/scripts/ci/jobs/aks_qa_e2e_tests.py b/scripts/ci/jobs/aks_qa_e2e_tests.py
index cd5cd84e514c9..fb4e65c757c02 100755
--- a/scripts/ci/jobs/aks_qa_e2e_tests.py
+++ b/scripts/ci/jobs/aks_qa_e2e_tests.py
@@ -10,6 +10,7 @@
 # set required test parameters
 os.environ["ORCHESTRATOR_FLAVOR"] = "k8s"
 os.environ["KUBERNETES_PROVIDER"] = "aks"
+os.environ["USE_ROXIE_DEPLOY"] = "true"
 
 os.environ["ROX_RISK_REPROCESSING_INTERVAL"] = "15s"
 os.environ["ROX_SENSOR_CONNECTION_RETRY_MAX_INTERVAL"] = "30s"
diff --git a/scripts/ci/jobs/eks_qa_e2e_tests.py b/scripts/ci/jobs/eks_qa_e2e_tests.py
index b52672293ebae..4e3dc19bd1ea4 100755
--- a/scripts/ci/jobs/eks_qa_e2e_tests.py
+++ b/scripts/ci/jobs/eks_qa_e2e_tests.py
@@ -10,6 +10,7 @@
 # set required test parameters
 os.environ["ORCHESTRATOR_FLAVOR"] = "k8s"
 os.environ["KUBERNETES_PROVIDER"] = "eks"
+os.environ["USE_ROXIE_DEPLOY"] = "true"
 
 os.environ["ROX_RISK_REPROCESSING_INTERVAL"] = "15s"
 os.environ["ROX_SENSOR_CONNECTION_RETRY_MAX_INTERVAL"] = "30s"
diff --git a/scripts/ci/jobs/gke_external_pg_17_qa_e2e_tests.py b/scripts/ci/jobs/gke_external_pg_17_qa_e2e_tests.py
index 2c652d5e83a9a..bed50919fccbe 100755
--- a/scripts/ci/jobs/gke_external_pg_17_qa_e2e_tests.py
+++ b/scripts/ci/jobs/gke_external_pg_17_qa_e2e_tests.py
@@ -13,8 +13,10 @@
 # set test parameters
 os.environ["ORCHESTRATOR_FLAVOR"] = "k8s"
 os.environ["KUBERNETES_PROVIDER"] = "gke"
+os.environ["SCANNER_V4_DB_STORAGE_CLASS"] = "stackrox-gke-ssd"
 os.environ["POSTGRES_VERSION"] = "17"
 os.environ["BYODB_TEST"] = "true"
+os.environ["USE_ROXIE_DEPLOY"] = "true"
 
 os.environ["ROX_RISK_REPROCESSING_INTERVAL"] = "15s"
 os.environ["ROX_SENSOR_CONNECTION_RETRY_MAX_INTERVAL"] = "30s"
diff --git a/scripts/ci/jobs/gke_nongroovy_e2e_tests.py b/scripts/ci/jobs/gke_nongroovy_e2e_tests.py
index f173c23e3291a..cfe1e152aeece 100755
--- a/scripts/ci/jobs/gke_nongroovy_e2e_tests.py
+++ b/scripts/ci/jobs/gke_nongroovy_e2e_tests.py
@@ -19,7 +19,7 @@
 os.environ["SCANNER_V4_CI_VULN_BUNDLE_ALLOWLIST"] = "rhel-vex,stackrox-rhel-csaf,manual,epss,nvd"
 
 # delegated scanning support in the secured cluster
-os.environ["SENSOR_SCANNER_SUPPORT"] = "true"
+os.environ["SENSOR_SCANNER_V4_SUPPORT"] = "true"
 
 # Enable new CRS-based flow for registering secured clusters
 os.environ["ROX_DEPLOY_SENSOR_WITH_CRS"] = "true"
diff --git a/scripts/ci/jobs/gke_qa_e2e_tests.py b/scripts/ci/jobs/gke_qa_e2e_tests.py
index cf8f78280e1cd..65a1dd9f2ac0b 100755
--- a/scripts/ci/jobs/gke_qa_e2e_tests.py
+++ b/scripts/ci/jobs/gke_qa_e2e_tests.py
@@ -12,6 +12,7 @@
 os.environ["KUBERNETES_PROVIDER"] = "gke"
 os.environ["GCP_IMAGE_TYPE"] = "cos_containerd"
 os.environ["OUTPUT_FORMAT"] = "helm"
+os.environ["USE_ROXIE_DEPLOY"] = "true"
 
 os.environ["SCANNER_V4_DB_STORAGE_CLASS"] = "stackrox-gke-ssd"
 
diff --git a/scripts/ci/jobs/gke_ui_e2e_tests.py b/scripts/ci/jobs/gke_ui_e2e_tests.py
index 12aaa2d80dd9c..99cba4e19242b 100755
--- a/scripts/ci/jobs/gke_ui_e2e_tests.py
+++ b/scripts/ci/jobs/gke_ui_e2e_tests.py
@@ -16,9 +16,11 @@
 
 # Override test env defaults here:
 # (for defaults see: tests/e2e/lib.sh export_test_environment())
-os.environ["OUTPUT_FORMAT"] = "helm"
 os.environ["SCANNER_V4_DB_STORAGE_CLASS"] = "stackrox-gke-ssd"
 os.environ["SENSOR_SCANNER_SUPPORT"] = "true"
+# Optimize Scanner V4 startup time by loading only RHEL vulnerability bundles
+# UI tests only scan RHEL/UBI images (StackRox components) - no user workloads deployed
+os.environ["SCANNER_V4_CI_VULN_BUNDLE_ALLOWLIST"] = "rhel-vex,stackrox-rhel-csaf,manual,epss,nvd"
 
 ClusterTestRunner(
     cluster=GKECluster("ui-e2e-test"),
diff --git a/scripts/ci/jobs/gke_upgrade_tests.py b/scripts/ci/jobs/gke_upgrade_tests.py
deleted file mode 100755
index cca9c5be4b540..0000000000000
--- a/scripts/ci/jobs/gke_upgrade_tests.py
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env -S python3 -u
-
-"""
-Run the upgrade test in a GKE cluster
-"""
-import os
-from runners import ClusterTestRunner
-from clusters import GKECluster
-from pre_tests import PreSystemTests
-from ci_tests import UpgradeTest
-from post_tests import PostClusterTest, FinalPost
-
-os.environ["ORCHESTRATOR_FLAVOR"] = "k8s"
-os.environ["KUBERNETES_PROVIDER"] = "gke"
-os.environ["SCANNER_V4_DB_STORAGE_CLASS"] = "faster"
-
-ClusterTestRunner(
-    cluster=GKECluster("upgrade-test", machine_type="e2-standard-8"),
-    pre_test=PreSystemTests(),
-    test=UpgradeTest(),
-    post_test=PostClusterTest(),
-    final_post=FinalPost(
-        store_qa_tests_data=True,
-    ),
-).run()
diff --git a/scripts/ci/jobs/ocp-perf-scale-tests-post.sh b/scripts/ci/jobs/ocp-perf-scale-tests-post.sh
index f387169edc848..cb0d75324c3fe 100755
--- a/scripts/ci/jobs/ocp-perf-scale-tests-post.sh
+++ b/scripts/ci/jobs/ocp-perf-scale-tests-post.sh
@@ -53,7 +53,7 @@ fi
 # Set API_ENDPOINT since we know it from the port-forward
 export API_ENDPOINT="localhost:8000"
 
-# Get admin password from SHARED_DIR (saved by stackrox-install-helm step)
+# Get admin password from SHARED_DIR (saved by stackrox-install-roxie step)
 if [[ -n "${SHARED_DIR:-}" && -f "${SHARED_DIR}/rox_admin_password" ]]; then
     export ROX_ADMIN_PASSWORD="$(cat "${SHARED_DIR}/rox_admin_password")"
     info "Retrieved admin password from SHARED_DIR"
@@ -89,12 +89,24 @@ else
     info "Warning: Failed to get central diagnostics"
 fi
 
+# Collect collector metrics
+COLLECTOR_METRICS_OUTPUT="collector-metrics"
+info "Collecting collector metrics to ${COLLECTOR_METRICS_OUTPUT}"
+if "${ROOT}/scripts/ci/collect-collector-metrics.sh" stackrox "${COLLECTOR_METRICS_OUTPUT}"; then
+    info "Collected collector metrics to ${COLLECTOR_METRICS_OUTPUT}"
+else
+    info "Warning: Failed to collect collector metrics"
+fi
+
 # Store artifacts to OpenShift CI artifact directory
 if [[ -n "${ARTIFACT_DIR:-}" ]]; then
     info "Copying diagnostics to ${ARTIFACT_DIR}"
     if [[ -d "${DIAGNOSTIC_OUTPUT}" ]]; then
         cp -r "${DIAGNOSTIC_OUTPUT}" "${ARTIFACT_DIR}/" || info "Warning: Failed to copy ${DIAGNOSTIC_OUTPUT}"
     fi
+    if [[ -d "${COLLECTOR_METRICS_OUTPUT}" ]]; then
+        cp -r "${COLLECTOR_METRICS_OUTPUT}" "${ARTIFACT_DIR}/" || info "Warning: Failed to copy ${COLLECTOR_METRICS_OUTPUT}"
+    fi
 else
     info "Warning: ARTIFACT_DIR not set, diagnostics not copied to artifacts"
 fi
diff --git a/scripts/ci/jobs/ocp-perf-scale-tests.sh b/scripts/ci/jobs/ocp-perf-scale-tests.sh
index 08f143494c2f6..1c0194ef6887a 100755
--- a/scripts/ci/jobs/ocp-perf-scale-tests.sh
+++ b/scripts/ci/jobs/ocp-perf-scale-tests.sh
@@ -19,7 +19,7 @@ info "Will poll for: $(awk '{print $1}' "${image_list}")"
 
 poll_for_system_test_images 3600
 
-# Export the tag for stackrox-install-helm to use
+# Export the tag for stackrox-install-roxie to use
 if [[ -n "${SHARED_DIR:-}" ]]; then
   echo "${MAIN_IMAGE_TAG}" > "${SHARED_DIR}/acs_image_tag"
   info "Exported ACS_IMAGE_TAG=${MAIN_IMAGE_TAG} to ${SHARED_DIR}/acs_image_tag"
diff --git a/scripts/ci/jobs/ocp_nongroovy_e2e_tests.py b/scripts/ci/jobs/ocp_nongroovy_e2e_tests.py
index bc2f86b865102..685984e5b8237 100755
--- a/scripts/ci/jobs/ocp_nongroovy_e2e_tests.py
+++ b/scripts/ci/jobs/ocp_nongroovy_e2e_tests.py
@@ -16,7 +16,7 @@
 os.environ["KUBERNETES_PROVIDER"] = "ocp"
 
 # delegated scanning support in the secured cluster
-os.environ["SENSOR_SCANNER_SUPPORT"] = "true"
+os.environ["SENSOR_SCANNER_V4_SUPPORT"] = "true"
 
 # Enable new CRS-based flow for registering secured clusters
 os.environ["ROX_DEPLOY_SENSOR_WITH_CRS"] = "true"
diff --git a/scripts/ci/jobs/ocp_qa_e2e_tests.py b/scripts/ci/jobs/ocp_qa_e2e_tests.py
index 27d29566d7c84..4e7d7049e18b0 100755
--- a/scripts/ci/jobs/ocp_qa_e2e_tests.py
+++ b/scripts/ci/jobs/ocp_qa_e2e_tests.py
@@ -12,6 +12,7 @@
 os.environ["DEPLOY_STACKROX_VIA_OPERATOR"] = "true"
 os.environ["ORCHESTRATOR_FLAVOR"] = "openshift"
 os.environ["KUBERNETES_PROVIDER"] = "ocp"
+os.environ["USE_ROXIE_DEPLOY"] = "true"
 # Workload identities are only set up for `openshift-4` infra clusters.
 if 'openshift-4' in os.environ.get('CLUSTER_FLAVOR_VARIANT', ''):
     os.environ["SETUP_WORKLOAD_IDENTITIES"] = "true"
diff --git a/scripts/ci/jobs/ocp_ui_e2e_tests.py b/scripts/ci/jobs/ocp_ui_e2e_tests.py
index 28e5b281b4d58..b5f28a700bd22 100755
--- a/scripts/ci/jobs/ocp_ui_e2e_tests.py
+++ b/scripts/ci/jobs/ocp_ui_e2e_tests.py
@@ -11,10 +11,12 @@
 from post_tests import PostClusterTest, FinalPost
 
 # set required test parameters
-os.environ["DEPLOY_STACKROX_VIA_OPERATOR"] = "true"
 os.environ["INSTALL_COMPLIANCE_OPERATOR"] = "true"
 os.environ["ORCHESTRATOR_FLAVOR"] = "openshift"
 os.environ["KUBERNETES_PROVIDER"] = "ocp"
+# Optimize Scanner V4 startup time by loading only RHEL vulnerability bundles
+# UI tests only scan RHEL/UBI images (OpenShift platform, StackRox, operators, nodes)
+os.environ["SCANNER_V4_CI_VULN_BUNDLE_ALLOWLIST"] = "rhel-vex,stackrox-rhel-csaf,manual,epss,nvd"
 
 ClusterTestRunner(
     cluster=AutomationFlavorsCluster(),
diff --git a/scripts/ci/jobs/ocp_vm_scanning_e2e_tests.py b/scripts/ci/jobs/ocp_vm_scanning_e2e_tests.py
index 695d9d77640fc..a77f458cb16b8 100755
--- a/scripts/ci/jobs/ocp_vm_scanning_e2e_tests.py
+++ b/scripts/ci/jobs/ocp_vm_scanning_e2e_tests.py
@@ -23,6 +23,9 @@
 os.environ["SENSOR_HELM_MANAGED"] = "true"
 os.environ["INSTALL_CNV_OPERATOR"] = "true"
 os.environ["ROX_VIRTUAL_MACHINES"] = "true"
+# Leave guests up so post-test can collect roxagent journals, then
+# delete-vm-ns.sh deletes the test namespaces.
+os.environ["VM_SCAN_SKIP_CLEANUP"] = "true"
 # Selectively enable vulnerability bundles to prevent timeouts of matcher not being ready in 40 minutes.
 # The rhel-vex bundle alone has ~3M records and can take >30 min to import.
 # Drops alpine, aws, debian, oracle, osv, photon, suse, ubuntu (unused for RHEL guests).
@@ -36,10 +39,10 @@
 
 
 class VMScanningPostTest(PostClusterTest):
-    """Extends standard post-test with CNV namespace logs."""
+    """Extends standard post-test with CNV namespace logs and guest roxagent journals."""
 
     def __init__(self, **kwargs):
-        super().__init__(**kwargs)
+        super().__init__(collect_vm_guest_logs=True, **kwargs)
         self.k8s_namespaces.extend([
             "openshift-cnv",
         ])
diff --git a/scripts/ci/lib.sh b/scripts/ci/lib.sh
index 3aff3621dfee2..c87e420a12158 100755
--- a/scripts/ci/lib.sh
+++ b/scripts/ci/lib.sh
@@ -14,6 +14,35 @@ source "$SCRIPTS_ROOT/scripts/ci/gcp.sh"
 
 set -euo pipefail
 
+# ensure_writable_bash_env points BASH_ENV at a temp file when the CI image
+# default (/etc/initial-bash.env) is not readable or writable by the process
+# UID. Child bash then stops erroring on source, and cci-export can persist env.
+ensure_writable_bash_env() {
+    if [[ -z "${BASH_ENV:-}" ]]; then
+        return 0
+    fi
+    if [[ -r "${BASH_ENV}" && -w "${BASH_ENV}" ]]; then
+        return 0
+    fi
+
+    local new_bash_env
+    new_bash_env="$(mktemp)" || return 1
+    if [[ -r "${BASH_ENV}" ]]; then
+        if ! cp "${BASH_ENV}" "${new_bash_env}"; then
+            rm -f "${new_bash_env}"
+            return 1
+        fi
+    fi
+    BASH_ENV="${new_bash_env}"
+    export BASH_ENV
+}
+
+# OpenShift CI cannot read /etc/initial-bash.env (random user). Switch BASH_ENV
+# to a writable file now, before make and status.sh start more bash processes.
+if is_CI; then
+    ensure_writable_bash_env
+fi
+
 ensure_CI() {
     if ! is_CI; then
         die "A CI environment is required."
@@ -28,20 +57,27 @@ ci_export() {
     local env_name="$1"
     local env_value="$2"
 
-    if command -v cci-export >/dev/null; then
-        # cci-export writes to $BASH_ENV which defaults to read-only /etc/initial-bash.env in the CI container
-        if [[ -n "${BASH_ENV:-}" && ! -w "${BASH_ENV}" ]]; then
-            BASH_ENV=$(mktemp)
-            export BASH_ENV
+    if is_GITHUB_ACTIONS; then
+        export "${env_name}"="${env_value}"
+        if [[ -z "${GITHUB_ENV:-}" ]]; then
+            die "GITHUB_ENV is unset in the environment even though GITHUB_ACTION is set"
+        fi
+        if [[ "$env_value" == *$'\n'* ]]; then
+            # GHA also supports multi-line values, which need to be added to $GITHUB_ENV with a
+            # special syntax.
+            # See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#multiline-strings
+            local delimiter="EOF_${env_name}_$$"
+            printf '%s<<%s\n%s\n%s\n' "$env_name" "$delimiter" "$env_value" "$delimiter" >> "$GITHUB_ENV"
+        else
+            # GHA needs the environment variables to be unquoted and unescaped, they are parsed literally.
+            echo "${env_name}=${env_value}" >> "$GITHUB_ENV"
         fi
+    elif command -v cci-export >/dev/null; then
+        ensure_writable_bash_env || return 1
         cci-export "$env_name" "$env_value"
     else
         export "$env_name"="$env_value"
     fi
-
-    if [[ -n "${GITHUB_ENV:-}" ]]; then
-        printf '%s=%q\n' "${env_name}" "${env_value}" >> "$GITHUB_ENV"
-    fi
 }
 
 # set_ci_shared_export() - for openshift-ci and GHA this is state shared between steps.
@@ -543,8 +579,6 @@ push_matching_collector_scanner_images() {
 
     local main_tag
     main_tag="$(make --quiet --no-print-directory tag)"
-    local scanner_version
-    scanner_version="$(make --quiet --no-print-directory scanner-tag)"
     local collector_version
     collector_version="$(make --quiet --no-print-directory collector-tag)"
     local fact_version
@@ -552,11 +586,6 @@ push_matching_collector_scanner_images() {
 
     registry_rw_login "${registry}"
 
-    _retag "${registry}/scanner:${scanner_version}"    "${registry}/scanner:${main_tag}"
-    _retag "${registry}/scanner-db:${scanner_version}" "${registry}/scanner-db:${main_tag}"
-    _retag "${registry}/scanner-slim:${scanner_version}"    "${registry}/scanner-slim:${main_tag}"
-    _retag "${registry}/scanner-db-slim:${scanner_version}" "${registry}/scanner-db-slim:${main_tag}"
-
     _retag "${registry}/collector:${collector_version}"      "${registry}/collector:${main_tag}"
 
     _retag "${registry}/fact:${fact_version}" "${registry}/fact:${main_tag}"
@@ -576,28 +605,47 @@ poll_for_system_test_images() {
     local image_list
     image_list="$(mktemp)"
     populate_stackrox_image_list "${image_list}"
-    info "Will poll for: $(awk '{print $1}' "${image_list}")"
+    info "Will poll for the following images:"
+    while IFS=' ' read -r name tag; do
+        info "  ${name}:${tag}"
+    done < "${image_list}"
 
     local start_time
     start_time="$(date '+%s')"
 
     local tag
     local image
+    local success="true"
     while read -r image tag
     do
         while ! check_rhacs_eng_image_exists "$image" "$tag"
         do
             info "$image does not exist"
             if (( $(date '+%s') - start_time > time_limit )); then
-                check_build_workflows "$(get_commit_sha)"
-                die "ERROR: Timed out waiting for images after ${time_limit} seconds"
+                success="false"
+                break 2
             fi
             sleep 60
         done
     done < "$image_list"
 
-    info "All images exist."
-    touch "${STATE_IMAGES_AVAILABLE}"
+    local images_available=("Image_Availability" "Were the required images built successfully by GitHub Actions?")
+    if [[ "$success" == "true" ]]; then
+        save_junit_success "${images_available[@]}"
+        info "All images exist."
+        touch "${STATE_IMAGES_AVAILABLE}"
+    else
+        local commit_sha="$(get_commit_sha)"
+        local build_details="Build results are unknown"
+        local build_results
+        if build_results="$(check-workflow-run --workflow=build.yaml --head-SHA="${commit_sha}")"; then
+            build_details="GitHub Actions workflow status for build.yaml:
+$build_results"
+        fi
+        info "${build_details}"
+        save_junit_failure "${images_available[@]}" "${build_details}"
+        die "ERROR: Timed out waiting for images after ${time_limit} seconds"
+    fi
 }
 
 # Image prefetch is broken into two sets:
@@ -630,11 +678,11 @@ _image_prefetcher_prebuilt_start() {
     # _image_prefetcher_prebuilt_await
 
     case "$CI_JOB_NAME" in
-    *qa-e2e-tests)
+    *qa-e2e-tests*)
         image_prefetcher_start_set qa-e2e
         _set_quay_pull_policy
         ;;
-    *nongroovy-e2e-tests)
+    *nongroovy-e2e-tests*)
         image_prefetcher_start_set qa-nongroovy-e2e
         _set_quay_pull_policy
         ;;
@@ -681,7 +729,7 @@ _image_prefetcher_system_start() {
     case "$CI_JOB_NAME" in
     # ROX-24818: GKE is excluded from system image prefetch as it causes
     # flakes in test.
-    *-operator-e2e-tests|*ocp*qa-e2e-tests)
+    *-operator-e2e-tests|*ocp*qa-e2e-tests*)
         image_prefetcher_start_set stackrox-images
         ;;
     # Enabling scanner V4 installation tests as well, even though they also run on GKE,
@@ -799,10 +847,10 @@ _image_prefetcher_prebuilt_await() {
     # at the last moment before any of the prebuilt images is used. (See other existing examples.)
     # This way we save time since prefetching can happen in parallel with whatever other setup the test job needs.
 
-    *qa-e2e-tests)
+    *qa-e2e-tests*)
         image_prefetcher_await_set qa-e2e
         ;;
-    *nongroovy-e2e-tests)
+    *nongroovy-e2e-tests*)
         image_prefetcher_await_set qa-nongroovy-e2e
         ;;
     *compatibility-tests)
@@ -822,7 +870,7 @@ _image_prefetcher_system_await() {
     case "$CI_JOB_NAME" in
     # ROX-24818: GKE is excluded from system image prefetch as it causes
     # flakes in test.
-    *-operator-e2e-tests|*ocp*qa-e2e-tests)
+    *-operator-e2e-tests|*ocp*qa-e2e-tests*)
         image_prefetcher_await_set stackrox-images
         ;;
     # Enabling scanner V4 installation tests as well, even though they also run on GKE,
@@ -892,28 +940,15 @@ EOM
         rm -f "${query}"
     fi
     info "Now retrieving prefetcher metrics..."
-    local attempt=0
-    local service="service/${name}-metrics"
-    while [[ -z $(kubectl -n "${ns}" get "${service}" -o jsonpath="{.status.loadBalancer.ingress}" 2>/dev/null) ]]; do
-        if [ "$attempt" -lt "60" ]; then
-            info "Waiting for ${service} to obtain endpoint ..."
-            ((attempt++))
-            sleep 10
-        else
-            info "Something is wrong with the ${service} service. See the following 'describe' output."
-            kubectl -n "${ns}" describe "${service}" || true
-            die "Timeout waiting for ${service} to obtain endpoint!"
-        fi
-    done
-    local endpoint
-    endpoint="$(kubectl -n "${ns}" get "${service}" -o json | service_get_endpoint)"
+    make image-prefetcher-deploy-bin
+    local image_prefetcher_deploy_bin
+    image_prefetcher_deploy_bin="$(make print-image-prefetcher-deploy-bin)"
     local fetcher_metrics
     fetcher_metrics="$(mktemp --suffix=.csv)"
     local fetcher_metrics_json
     fetcher_metrics_json="$(mktemp --suffix=.json)"
-    local metrics_url="http://${endpoint}:8080/metrics"
-    if ! curl --silent --show-error --fail --retry 3 --retry-connrefused "${metrics_url}" > "${fetcher_metrics_json}"; then
-        die "Failed to fetch prefetcher metrics from ${metrics_url}"
+    if ! "${image_prefetcher_deploy_bin}" --fetch-metrics --namespace="${ns}" "${name}" > "${fetcher_metrics_json}"; then
+        die "Failed to fetch prefetcher metrics for set ${name}"
     fi
     # See the stackrox_image_prefetches table definition in https://github.com/stackrox/automation-iac/blob/main/resources/testing/stackrox-ci/metrics.tf
     # for the order of columns.
@@ -982,9 +1017,12 @@ populate_stackrox_image_list() {
 
     local tag
     tag="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory tag)"}"
+
+    local operator_controller_tag
+    operator_controller_tag="$(BUILD_TAG="${tag}" make -C operator --quiet --no-print-directory tag)"
+
     local operator_metadata_tag
-    operator_metadata_tag="$(echo "v${tag}" | sed 's,x,0,')"
-    local operator_controller_tag="${tag//x/0}"
+    operator_metadata_tag="v${operator_controller_tag}"
 
     # Require images based on the job
     case "$CI_JOB_NAME" in
@@ -996,8 +1034,6 @@ stackrox-operator-index ${operator_metadata_tag}
 main ${tag}
 central-db ${tag}
 collector ${tag}
-scanner ${tag}
-scanner-db ${tag}
 scanner-v4 ${tag}
 scanner-v4-db ${tag}
 END
@@ -1026,13 +1062,38 @@ stackrox-operator-index ${operator_metadata_tag}
 main ${tag}
 central-db ${tag}
 collector ${tag}
-scanner ${tag}
-scanner-db ${tag}
 scanner-v4 ${tag}
 scanner-v4-db ${tag}
 roxctl ${tag}
 END
             ;;
+        *nongroovy-e2e-tests*|*qa-e2e-tests*)
+            if [[ "${USE_KONFLUX_IMAGES:-false}" == "true" ]]; then
+                cat >> "${image_list}" << END
+release-operator ${operator_controller_tag}
+release-operator-bundle ${operator_metadata_tag}
+release-main ${operator_controller_tag}
+release-central-db ${operator_controller_tag}
+release-collector ${operator_controller_tag}
+release-fact ${operator_controller_tag}
+release-scanner-v4 ${operator_controller_tag}
+release-scanner-v4-db ${operator_controller_tag}
+release-roxctl ${operator_controller_tag}
+END
+            else
+                cat >> "${image_list}" << END
+stackrox-operator ${operator_controller_tag}
+stackrox-operator-bundle ${operator_metadata_tag}
+main ${tag}
+central-db ${tag}
+collector ${tag}
+fact ${tag}
+scanner-v4 ${tag}
+scanner-v4-db ${tag}
+roxctl ${tag}
+END
+            fi
+            ;;
         *)
             cat >> "${image_list}" << END
 central-db ${tag}
@@ -1080,25 +1141,6 @@ check_rhacs_eng_image_exists() {
     [[ "$(jq -r '.tags | first | .name' <<<"$check")" == "$tag" ]]
 }
 
-check_build_workflows() {
-    local commit_sha="$1"
-
-    {
-        echo
-        info "GitHub Actions workflow status for build.yaml:"
-        check-workflow-run \
-            --workflow=build.yaml \
-            --head-SHA="${commit_sha}"
-    } | tee "${STATE_BUILD_RESULTS}" || true
-}
-
-check_scanner_version() {
-    if ! is_release_version "$(make --quiet --no-print-directory scanner-tag)"; then
-        echo "::error::Scanner tag does not look like a release tag. Please update SCANNER_VERSION file before releasing."
-        exit 1
-    fi
-}
-
 check_collector_version() {
     if ! is_release_version "$(make --quiet --no-print-directory collector-tag)"; then
         echo "::error::Collector tag does not look like a release tag. Please update COLLECTOR_VERSION file before releasing."
@@ -1484,6 +1526,8 @@ get_pr_details() {
 openshift_ci_mods() {
     info "BEGIN OpenShift CI mods"
 
+    ensure_writable_bash_env
+
     openshift_ci_debug
 
     info "Current Status:"
@@ -2668,19 +2712,20 @@ _record_cluster_info() {
     # Assumes (a) there is a single cluster under test (cut_*) and (b) all nodes
     # in the cluster are homogeneous.
 
-    # Product version. Currently used for OpenShift version. Could cover cloud
-    # provider versions for example.
-    local oc_version
-    oc_version="$(oc version -o json 2>&1 || true)"
-    local openshiftVersion
-    openshiftVersion=$(jq -r <<<"$oc_version" '.openshiftVersion')
-    set_ci_shared_export "cut_product_version" "$openshiftVersion"
+    # Product version. Currently used for OpenShift version.
+    if command -v oc &>/dev/null; then
+        local oc_version
+        oc_version="$(oc version -o json 2>/dev/null || true)"
+        local openshiftVersion
+        openshiftVersion=$(jq -r <<<"$oc_version" '.openshiftVersion // empty')
+        set_ci_shared_export "cut_product_version" "$openshiftVersion"
+    fi
 
     # K8s version.
     local kubectl_version
-    kubectl_version="$(kubectl version -o json 2>&1 || true)"
+    kubectl_version="$(kubectl version -o json 2>/dev/null || true)"
     local serverGitVersion
-    serverGitVersion=$(jq -r <<<"$kubectl_version" '.serverVersion.gitVersion')
+    serverGitVersion=$(jq -r <<<"$kubectl_version" '.serverVersion.gitVersion // empty')
     set_ci_shared_export "cut_k8s_version" "$serverGitVersion"
 
     # Node info: OS, Kernel & Container Runtime.
@@ -2699,6 +2744,26 @@ _record_cluster_info() {
     set_ci_shared_export "cut_container_runtime_version" "$containerRuntimeVersion"
 }
 
+# list_vm_scan_namespaces prints VM-scanning e2e namespace names, one per line.
+# Returns 1 when kubectl cannot list namespaces, distinct from zero matches.
+list_vm_scan_namespaces() {
+    local prefix="${VM_SCAN_NAMESPACE_PREFIX:-vm-scan-e2e}"
+    local out err
+    out="$(mktemp)"
+    err="$(mktemp)"
+    if ! kubectl --request-timeout=30s get ns \
+        -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' \
+        > "$out" 2>"$err"; then
+        info "kubectl get ns failed: $(<"$err")" >&2
+        rm -f "$out" "$err"
+        return 1
+    fi
+    rm -f "$err"
+    grep -E "^${prefix}(-|$)" "$out" || true
+    rm -f "$out"
+    return 0
+}
+
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
     if [[ "$#" -lt 1 ]]; then
         die "When invoked at the command line a method is required."
diff --git a/scripts/ci/logcheck/check-restart-logs_test.bats b/scripts/ci/logcheck/check-restart-logs_test.bats
index 622cef31ce623..998d1a3f1f886 100755
--- a/scripts/ci/logcheck/check-restart-logs_test.bats
+++ b/scripts/ci/logcheck/check-restart-logs_test.bats
@@ -85,6 +85,17 @@ function setup() {
     [ "$status" -eq 0 ]
 }
 
+@test "scanner restart during upgrade postgres bounce is OK" {
+    run "$CMD" "gke-upgrade-tests-central" "${TEST_FIXTURES}/upgrade-scanner-previous.log"
+    [ "$status" -eq 0 ]
+    [ "${lines[1]}" = "Ignoring this restart due to: scanner restart due to DB connection loss during postgres bounce in upgrade test" ]
+}
+
+@test "scanner restart during upgrade postgres bounce is NOT OK for non-upgrade jobs" {
+    run "$CMD" "gke-nongroovy-e2e-tests" "${TEST_FIXTURES}/upgrade-scanner-previous.log"
+    [ "$status" -eq 2 ]
+}
+
 teardown () {
     echo "$BATS_TEST_NAME
 --------
diff --git a/scripts/ci/logcheck/check.sh b/scripts/ci/logcheck/check.sh
index 3b820b3a5f4c9..8b4d1529c11a4 100755
--- a/scripts/ci/logcheck/check.sh
+++ b/scripts/ci/logcheck/check.sh
@@ -11,6 +11,16 @@
 
 DIR="$(cd "$(dirname "$0")" && pwd)"
 
+# Block/allow lists use PCRE. BSD grep has no -P; Homebrew GNU grep is `ggrep`.
+if grep -P 'a' <<<'a' >/dev/null 2>&1; then
+    GREP_CMD="grep"
+elif command -v ggrep >/dev/null 2>&1; then
+    GREP_CMD="ggrep"
+else
+    echo "logcheck requires GNU grep (-P). On macOS: brew install grep" >&2
+    exit 2
+fi
+
 LINES_OF_CONTEXT=5
 BLOCKLIST_FILE="${DIR}/blocklist-patterns"
 allow_file="${ALLOWLIST_FILE:-${DIR}/allowlist-patterns}"
@@ -25,8 +35,8 @@ IFS=$'\n' read -d '' -r -a allowlist_subpatterns < <(egrep -v '^(#.*|\s*)$' "${a
 
 allowlist_pattern="$(join_by '|' "${allowlist_subpatterns[@]}")"
 
-if check_out="$(grep -vHP "$allowlist_pattern" "$@" | grep -"${LINES_OF_CONTEXT}" -Pi "$blocklist_pattern")"; then
-    first_occurence="$(grep -vhP "$allowlist_pattern" "$@" | grep -Pi "$blocklist_pattern" | head -1)"
+if check_out="$("${GREP_CMD}" -vHP "$allowlist_pattern" "$@" | "${GREP_CMD}" -"${LINES_OF_CONTEXT}" -Pi "$blocklist_pattern")"; then
+    first_occurence="$("${GREP_CMD}" -vhP "$allowlist_pattern" "$@" | "${GREP_CMD}" -Pi "$blocklist_pattern" | head -1)"
     echo "${first_occurence}"
     echo "${check_out}"
     exit 1
diff --git a/scripts/ci/logcheck/restart-ok-patterns.json b/scripts/ci/logcheck/restart-ok-patterns.json
index 4ad976448e98e..464531694d915 100644
--- a/scripts/ci/logcheck/restart-ok-patterns.json
+++ b/scripts/ci/logcheck/restart-ok-patterns.json
@@ -23,6 +23,12 @@
         "logfile": "collector-previous",
         "logline": "Unable to connect to Sensor at"
     },
+    {
+        "comment": "fact restart when sensor is briefly unavailable during a rollout/bounce",
+        "job": ".*",
+        "logfile": "fact-previous",
+        "logline": "Reconnection attempts exhausted"
+    },
     {
         "comment": "collector downloads throttled due to bouncing in upgrade test",
         "job": "upgrade",
@@ -48,15 +54,9 @@
         "logline": "Socket closed"
     },
     {
-        "comment": "Scanner V4 slow to start indexer with external DB",
-        "job": "(gke-external-pg-17-qa-e2e-tests|gke-byodb-qa-e2e-tests)",
-        "logfile": "indexer-previous",
-        "logline": "panic: migrate: failed to connect to"
-    },
-    {
-        "comment": "Scanner V4 slow to start matcher with external DB",
-        "job": "(gke-external-pg-17-qa-e2e-tests|gke-byodb-qa-e2e-tests)",
-        "logfile": "matcher-previous",
+        "comment": "Scanner V4 components can start before scanner-v4-db is ready to accept connections",
+        "job": ".*",
+        "logfile": "(indexer|matcher)-previous",
         "logline": "panic: migrate: failed to connect to"
     },
     {
@@ -76,5 +76,11 @@
         "job": "compatibility",
         "logfile": "400\\.(9|10)\\..*matcher-previous",
         "logline": "unable to connect to database.*connection refused"
+    },
+    {
+        "comment": "scanner restart due to DB connection loss during postgres bounce in upgrade test",
+        "job": "upgrade",
+        "logfile": "scanner-previous",
+        "logline": "Failed to initialize updater"
     }
 ]
diff --git a/scripts/ci/logcheck/test_fixtures/upgrade-scanner-previous.log b/scripts/ci/logcheck/test_fixtures/upgrade-scanner-previous.log
new file mode 100644
index 0000000000000..b0e258118b420
--- /dev/null
+++ b/scripts/ci/logcheck/test_fixtures/upgrade-scanner-previous.log
@@ -0,0 +1,3 @@
+{"Event":"searchKeyValue","Level":"info","Location":"pgsql.go:190","Time":"2026-07-23 07:30:25.123456"}
+{"Description":"searchKeyValue","Event":"Handled Database Error","Level":"error","Location":"pgsql.go:266","Time":"2026-07-23 07:31:06.037214","error":"dial tcp 34.118.224.96:5432: connect: connection refused"}
+{"Event":"Failed to initialize updater","Level":"fatal","Location":"main.go:169","Time":"2026-07-23 07:31:06.037376","error":"getting last updated time from DB: getting last updated time from DB: dial tcp 34.118.224.96:5432: connect: connection refused"}
diff --git a/scripts/ci/push-as-multiarch-manifest-list.sh b/scripts/ci/push-as-multiarch-manifest-list.sh
index 6c55d6f5ed9b4..01c6387506ef2 100755
--- a/scripts/ci/push-as-multiarch-manifest-list.sh
+++ b/scripts/ci/push-as-multiarch-manifest-list.sh
@@ -22,7 +22,10 @@ do
     image_list+=("$arch_image")
 done
 
-docker manifest create "$image" "${image_list[@]}"
+# --amend: this script is retried on failure (see push_*_manifest_lists in
+# scripts/ci/lib.sh), and "docker manifest create" errors out if a local
+# manifest list of the same name already exists, which it would on a retry.
+docker manifest create --amend "$image" "${image_list[@]}"
 
 # Try pushing manifest a few times for the case when quay.io has issues
 pushed=0
diff --git a/scripts/ci/store-artifacts.sh b/scripts/ci/store-artifacts.sh
index b26fc301efb77..3ac6e6598e9ee 100755
--- a/scripts/ci/store-artifacts.sh
+++ b/scripts/ci/store-artifacts.sh
@@ -108,7 +108,7 @@ set_gs_path_vars() {
         GS_JOB_URL="${GS_URL}/${WORKFLOW_SUBDIR}/${JOB_SUBDIR}"
     elif is_GITHUB_ACTIONS; then
         WORKFLOW_SUBDIR="${GITHUB_REPOSITORY}/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-        JOB_SUBDIR="${GITHUB_JOB}"
+        JOB_SUBDIR="${CI_JOB_NAME:-${GITHUB_JOB}}"
         GS_JOB_URL="${GS_URL}/${WORKFLOW_SUBDIR}/${JOB_SUBDIR}"
     else
         die "Support is missing for this CI environment"
diff --git a/scripts/ci/test_state.sh b/scripts/ci/test_state.sh
index 1b204d59a3675..2acb244b556f0 100644
--- a/scripts/ci/test_state.sh
+++ b/scripts/ci/test_state.sh
@@ -3,7 +3,6 @@
 # State files used to track test progress across script invocations.
 
 export STATE_IMAGES_AVAILABLE="${SHARED_DIR:-/tmp}/stackrox_ci_state_images_available"
-export STATE_BUILD_RESULTS="${SHARED_DIR:-/tmp}/stackrox_ci_state_build_results"
 export STATE_DEPLOYED="${SHARED_DIR:-/tmp}/stackrox_ci_state_deployed"
 
 # For the upgrade test
diff --git a/scripts/connect-ui.sh b/scripts/connect-ui.sh
index 62b2782be786e..f37f760b6f45c 100755
--- a/scripts/connect-ui.sh
+++ b/scripts/connect-ui.sh
@@ -2,8 +2,10 @@
 
 set -e
 
-# ensure logged in to docker
-docker login
+CONTAINER_ENGINE="${CONTAINER_ENGINE:-docker}"
+
+# ensure logged in to container registry
+${CONTAINER_ENGINE} login
 
 # get clean cluster name
 CLUSTER_NAME="$(echo $1 | sed 's/-rg//')"
diff --git a/scripts/docker-build.sh b/scripts/docker-build.sh
index 2ea8d02d38244..cbce9069e9aaa 100755
--- a/scripts/docker-build.sh
+++ b/scripts/docker-build.sh
@@ -2,9 +2,14 @@
 
 set -e
 
+CONTAINER_ENGINE="${CONTAINER_ENGINE:-docker}"
+
 echo "Building with platform linux/${GOARCH}"
-if docker info | grep buildx; then
+
+buildx_enabled=$(${CONTAINER_ENGINE} info 2>/dev/null | grep -q buildx && echo true || echo false)
+
+if [[ "${CONTAINER_ENGINE}" == "docker" ]] && [[ "${buildx_enabled}" == "true" ]]; then
     docker buildx build --platform "linux/${GOARCH}" --load "$@"
 else
-    docker build --platform "linux/${GOARCH}" "$@"
+    ${CONTAINER_ENGINE} build --platform "linux/${GOARCH}" "$@"
 fi
diff --git a/scripts/ensure_image.sh b/scripts/ensure_image.sh
index 5bc014bcf55a7..3e25d7e7ceacf 100755
--- a/scripts/ensure_image.sh
+++ b/scripts/ensure_image.sh
@@ -4,6 +4,8 @@
 ## First, it tries to pull the image. If it succeeds, it exits.
 ## If not, it builds the image. If run in CI, it also pushes the image.
 
+CONTAINER_ENGINE="${CONTAINER_ENGINE:-docker}"
+
 die() {
   echo >&2 "$@"
   exit 1
@@ -16,30 +18,30 @@ dir="$3"
 [[ -n "${image}" && -n "${dockerfile}" && -n "${dir}" ]] || die "Usage $0 <image> <dockerfile_path> <dir>"
 
 echo "Potentially pulling image ${image}"
-docker_pull_output="$(docker pull "${image}" 2>&1)"
+docker_pull_output="$(${CONTAINER_ENGINE} pull "${image}" 2>&1)"
 if [[ "$?" -eq 0 ]]; then
   echo "Image exists. Exiting..."
   exit 0
 fi
 if [[ ! "${docker_pull_output}" =~ ^.*manifest\ for.*not\ found.*$ ]]; then
-  die "Unexpected docker pull error: ${docker_pull_output}"
+  die "Unexpected ${CONTAINER_ENGINE} pull error: ${docker_pull_output}"
 fi
 
 set -e
 echo "Building the image since it doesn't exist"
-docker build -t "${image}" -f "${dockerfile}" "${dir}"
+${CONTAINER_ENGINE} build -t "${image}" -f "${dockerfile}" "${dir}"
 if [[ -n "${CI}" ]]; then
     case "$image" in
         quay.io/rhacs-eng/*)
-            docker login -u "$QUAY_RHACS_ENG_RW_USERNAME" --password-stdin <<<"$QUAY_RHACS_ENG_RW_PASSWORD" quay.io
+            ${CONTAINER_ENGINE} login -u "$QUAY_RHACS_ENG_RW_USERNAME" --password-stdin <<<"$QUAY_RHACS_ENG_RW_PASSWORD" quay.io
             ;;
         quay.io/stackrox-io/*)
-            docker login -u "$QUAY_STACKROX_IO_RW_USERNAME" --password-stdin <<<"$QUAY_STACKROX_IO_RW_PASSWORD" quay.io
+            ${CONTAINER_ENGINE} login -u "$QUAY_STACKROX_IO_RW_USERNAME" --password-stdin <<<"$QUAY_STACKROX_IO_RW_PASSWORD" quay.io
             ;;
         *)
             die "Unsupported registry of image: $image"
     esac
-    docker push "${image}" | cat
+    ${CONTAINER_ENGINE} push "${image}" | cat
 else
   echo "Not in CI, not pushing the new image..."
 fi
diff --git a/scripts/fixxxers/config-controller/10-generate.sh b/scripts/fixxxers/config-controller/10-generate.sh
new file mode 100755
index 0000000000000..22fcfa5a44923
--- /dev/null
+++ b/scripts/fixxxers/config-controller/10-generate.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+
+make config-controller-gen
diff --git a/scripts/go-files-to-packages.sh b/scripts/go-files-to-packages.sh
new file mode 100755
index 0000000000000..f87926393c81c
--- /dev/null
+++ b/scripts/go-files-to-packages.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Reads a list of files (one per line) from stdin and prints on stdout a list of go packages.
+# The arguments are passed to `go list` that is used to perform the transformation.
+# That go list command is retried, to help with go proxy unavailability.
+
+num_retries=4
+
+dir_list=$(mktemp)
+sed -e 's@^@./@g' | xargs -n 1 dirname | sort | uniq > "${dir_list}"
+output=$(mktemp)
+for attempt in $(seq 0 $num_retries)
+do
+    sleep_sec=$((attempt * 5))
+    if [[ $sleep_sec -gt 0 ]]; then
+        echo >&2 "Sleeping ${sleep_sec} before retrying..."
+        sleep "${sleep_sec}"
+    fi
+    if xargs go list "$@" < "${dir_list}" > "${output}"; then
+        grep -v '^github.com/stackrox/rox/tests$' "${output}"
+        exit 0
+    fi
+done
+echo >&2 "Running 'go list $*' failed despite $num_retries retries."
+exit 1
diff --git a/scripts/offline-bundle/.gitignore b/scripts/offline-bundle/.gitignore
deleted file mode 100644
index 8bc06143b8a41..0000000000000
--- a/scripts/offline-bundle/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-**/*.img
-**/bin
-*.tgz
diff --git a/scripts/offline-bundle/create.sh b/scripts/offline-bundle/create.sh
deleted file mode 100755
index 0bf4e1b614dce..0000000000000
--- a/scripts/offline-bundle/create.sh
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-IFS=$'\n\t'
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)"
-
-export_image() {
-  local name=$1
-  local image=$2
-  local last_dir=$3
-
-  docker pull "$image" | cat
-
-  mkdir -p "${DIR}/${last_dir}"
-  echo "Saving $image to ${DIR}/${last_dir}/${name}.img"
-  docker save "$image" -o "${DIR}/${last_dir}/${name}.img"
-}
-
-save() {
-  local registry=$1
-  local name=$2
-  local tag=$3
-  local last_dir=$4
-
-  export_image "$name" "${registry}/${name}:${tag}" "${last_dir}"
-}
-
-bundle() {
-  local name=$1
-  pushd "${DIR}"
-  tar -czvf "${name}.tgz" "${name}"
-  popd
-}
-
-store_roxctl() {
-  output_path=$1
-  mkdir -p "${DIR}/${output_path}/bin"
-  gsutil -m cp -r "gs://sr-roxc/${main_tag}/bin/darwin"  "${DIR}/${output_path}/bin"
-  gsutil -m cp -r "gs://sr-roxc/${main_tag}/bin/linux"   "${DIR}/${output_path}/bin"
-  gsutil -m cp -r "gs://sr-roxc/${main_tag}/bin/windows" "${DIR}/${output_path}/bin"
-  chmod +x "${DIR}/${output_path}/bin/darwin/roxctl" "${DIR}/${output_path}/bin/linux/roxctl"
-}
-
-main() {
-    # Main uses the version reported by make tag.
-    local main_tag
-    main_tag="$(make --quiet --no-print-directory tag)"
-    save "stackrox.io" "main" "${main_tag}" "image-bundle"
-
-    # Scanner uses the same version as Main.
-    save "stackrox.io" "scanner" "${main_tag}" "image-bundle"
-    save "stackrox.io" "scanner-db" "${main_tag}" "image-bundle"
-
-    # Collector uses the same version as Main.
-    save "collector.stackrox.io" "collector" "${main_tag}" "image-collector-bundle"
-
-    store_roxctl "image-bundle"
-
-    bundle "image-bundle"
-    bundle "image-collector-bundle"
-}
-
-main "$@"
diff --git a/scripts/offline-bundle/image-bundle/README.txt b/scripts/offline-bundle/image-bundle/README.txt
deleted file mode 100644
index 5375d77249f1e..0000000000000
--- a/scripts/offline-bundle/image-bundle/README.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-This bundle contains archives of the images necessary to run the
-StackRox Kubernetes Security Platform.
-
-To secure a cluster, your private registry must be able to pull the images.
-The import script loads images onto your local Docker engine, but can also
-push the images to a private registry.
-
-To install, first reimport the images:
-    ./import.sh
-
-See product documentation for complete setup steps. To view documentation:
- - Go to https://help.stackrox.com, or
- - Run import.sh, then follow the instructions displayed.
-
-When you generate your installation configuration and follow the
-instructions, use your private registry image names.
-
-See product documentation for additional details.
diff --git a/scripts/offline-bundle/image-bundle/import.sh b/scripts/offline-bundle/image-bundle/import.sh
deleted file mode 100755
index 625de26a13d37..0000000000000
--- a/scripts/offline-bundle/image-bundle/import.sh
+++ /dev/null
@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-IFS=$'\n\t'
-
-print_docs_usage() {
-  echo
-  echo "To view complete product documentation go to https://help.stackrox.com"
-}
-
-main() {
-    cd "$(dirname "${BASH_SOURCE[0]}")"
-
-    echo "This script can optionally push imported images into a private registry."
-    echo "Most users add a path segment like \"/stackrox\"."
-    echo "For example, you might input: my-registry.example.com:5000/stackrox"
-    echo "To skip pushing, simply do not enter a prefix."
-    echo -n "Enter your private registry prefix: "
-    read registry_prefix
-    echo
-
-    echo "Loading main image..."
-    main_tag="$(docker load -i main.img | tag)"
-    main_image_local="stackrox.io/main:${main_tag}"
-    main_image_remote="${registry_prefix}/main:${main_tag}"
-
-    echo "Loading scanner images..."
-    scanner_tag="$(docker load -i scanner.img | tag)"
-    scanner_image_local="stackrox.io/scanner:${scanner_tag}"
-    scanner_image_remote="${registry_prefix}/scanner:${scanner_tag}"
-
-    scanner_db_tag="$(docker load -i scanner-db.img | tag)"
-    scanner_db_image_local="stackrox.io/scanner-db:${scanner_db_tag}"
-    scanner_db_image_remote="${registry_prefix}/scanner-db:${scanner_db_tag}"
-
-    if [[ -z "$registry_prefix" ]]; then
-        echo "No registry prefix given, all done!"
-        print_docs_usage
-        return
-    fi
-
-    echo "Pushing image: ${main_image_local} as ${main_image_remote}"
-    docker tag "${main_image_local}" "${main_image_remote}"
-    docker push "${main_image_remote}" | cat
-
-    echo "Pushing image: ${scanner_image_local} as ${scanner_image_remote}"
-    docker tag "${scanner_image_local}" "${scanner_image_remote}"
-    docker push "${scanner_image_remote}" | cat
-
-    echo "Pushing image: ${scanner_db_image_local} as ${scanner_db_image_remote}"
-    docker tag "${scanner_db_image_local}" "${scanner_db_image_remote}"
-    docker push "${scanner_db_image_remote}" | cat
-
-    echo "All done!"
-    print_docs_usage
-}
-
-tag() {
-    sed 's/.*:\(.*$\)/\1/'
-}
-
-main
diff --git a/scripts/offline-bundle/image-collector-bundle/README.txt b/scripts/offline-bundle/image-collector-bundle/README.txt
deleted file mode 100644
index 6c5b4ab778c6b..0000000000000
--- a/scripts/offline-bundle/image-collector-bundle/README.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-This bundle contains archives of the Collector image which integrates with
-the StackRox Kubernetes Security Platform.
-
-To install, first reimport the image:
-    ./import.sh
-
-See product documentation for additional details.
diff --git a/scripts/offline-bundle/image-collector-bundle/import.sh b/scripts/offline-bundle/image-collector-bundle/import.sh
deleted file mode 100755
index 024f0edd5a629..0000000000000
--- a/scripts/offline-bundle/image-collector-bundle/import.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-IFS=$'\n\t'
-
-main() {
-    cd "$(dirname "${BASH_SOURCE[0]}")"
-
-    echo "This script can optionally push imported images into a private registry."
-    echo "Most users add a path segment like \"/stackrox\"."
-    echo "For example, you might input: my-registry.example.com:5000/stackrox"
-    echo "To skip pushing, simply do not enter a prefix."
-    echo -n "Enter your private registry prefix: "
-    read registry_prefix
-    echo
-
-    echo "Loading collector image..."
-    collector_tag="$(docker load -i collector.img | tag)"
-    collector_image_local="collector.stackrox.io/collector:${collector_tag}"
-    collector_image_remote="${registry_prefix}/collector:${collector_tag}"
-
-    if [[ -z "$registry_prefix" ]]; then
-        echo "No registry prefix given, all done!"
-        return
-    fi
-
-    echo "Pushing image: ${collector_image_local} as ${collector_image_remote}"
-    docker tag "${collector_image_local}" "${collector_image_remote}"
-    docker push "${collector_image_remote}" | cat
-
-    echo "All done!"
-}
-
-tag() {
-    sed 's/.*:\(.*$\)/\1/'
-}
-
-main
diff --git a/deploy/common/pull-secret.sh b/scripts/pull-secret.sh
similarity index 80%
rename from deploy/common/pull-secret.sh
rename to scripts/pull-secret.sh
index 869de8c44d6fc..900b8c093441e 100755
--- a/deploy/common/pull-secret.sh
+++ b/scripts/pull-secret.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 
 die() {
   echo >&2 "$@"
@@ -16,7 +16,7 @@ name="$1"
 registry="$2"
 [[ -n "$registry" ]] || die "No registry specified"
 
-registry_auth="$("${DIR}/docker-auth.sh" -m k8s "$registry")"
+registry_auth="$("${ROOT_DIR}/image/assets/docker-auth.sh" -m k8s "$registry")"
 [[ -n "$registry_auth" ]] || die "Unable to get registry auth info."
 
 cat <<EOF
diff --git a/scripts/release-tools/MERGE_WINDOW b/scripts/release-tools/MERGE_WINDOW
new file mode 100644
index 0000000000000..10e31f59d7a41
--- /dev/null
+++ b/scripts/release-tools/MERGE_WINDOW
@@ -0,0 +1 @@
+OPEN
diff --git a/scripts/release-tools/README.md b/scripts/release-tools/README.md
index 615f6821a4c5e..6ef54f10a1a85 100644
--- a/scripts/release-tools/README.md
+++ b/scripts/release-tools/README.md
@@ -1,28 +1,23 @@
-# Upstream Release Tools
+# Release Helpers and Configuration
 
-This directory contains a selection of scripts that automate selected mundane manual steps (a.k.a toil) in the upstream release process.
+This directory contains a selection of helper scripts and configuration for the StackRox release process.
 
-:warning: The scripts are bleeding-edge - there is no guarantee that they would work for you the way they work for me. Test coverage is currently not provided.:warning:
+## Contents
 
-## Meta
+### Long-running cluster
 
-This document describes the intention behind the scripts in this folder.
-We acknowledge that different developers may run some parts of the release differently, use different tools, and prefer different programming languages.
-Some parts could have been definitely done better than they currently are, however the balance of time, effort, and usability at the time of the release resulted exactly in this state.
-Thus, it is fully okay to:
+For the purposes of configuring workloads on the long-running cluster (created as part of the release process), there are directories containing configuration:
 
-- use these scripts partially or not at all,
-- replace them with something better,
-- add functionalities, bugfixes, or tests.
+- `kube-burner-configs`
+- `long-running-cluster`
 
-## Prerequisites
+### Cluster access
 
-The scripts described here require the following env variables to exist and have correct values:
+To access long-running and upgrade clusters created during the release process, there are two scripts and a library of shared functions.
 
-```shell
-export RELEASE=3.69
-export RC_NUMBER=1
+### Merge Window
 
-export INFRA_TOKEN="xxx" # generate under https://infra.stackrox.com/
-export JIRA_TOKEN="yyy" # generate under https://issues.redhat.com/secure/ViewProfile.jspa?selectedTab=com.atlassian.pats.pats-plugin:jira-user-personal-access-tokens
-```
+When on a release branch, the `MERGE_WINDOW` file describes whether or not changes are allowed to be merged to the respective release branch.
+It contains either "OPEN" or "CLOSED".
+These states are set through release automation.
+Follow the documented process in case you need to bypass a closed merge window.
diff --git a/scripts/retry-kubectl.sh b/scripts/retry-kubectl.sh
index 9b6a9169bd49f..aeb9057a2899c 100755
--- a/scripts/retry-kubectl.sh
+++ b/scripts/retry-kubectl.sh
@@ -20,10 +20,10 @@ The connection to the server [^ ]+ was refused
 EOT
 )
 
-tmp_in="$(mktemp)"
-tmp_out="$(mktemp --suffix=-stdout.txt)"
-tmp_err="$(mktemp --suffix=-stderr.txt)"
-grep_out="$(mktemp)"
+tmp_in="$(mktemp "${TMPDIR:-/tmp}/rox-kubectl-stdin.XXXXXX")"
+tmp_out="$(mktemp "${TMPDIR:-/tmp}/rox-kubectl-stdout.XXXXXX")"
+tmp_err="$(mktemp "${TMPDIR:-/tmp}/rox-kubectl-stderr.XXXXXX")"
+grep_out="$(mktemp "${TMPDIR:-/tmp}/rox-kubectl-grep.XXXXXX")"
 trap 'cat ${tmp_out}; cat ${tmp_err} >&2; rm -f ${tmp_in} ${tmp_out} ${tmp_err} ${grep_out}' EXIT
 
 cat > "${tmp_in}"
diff --git a/scripts/roxie.sh b/scripts/roxie.sh
index 2361f0028bc57..0850bcd99d864 100755
--- a/scripts/roxie.sh
+++ b/scripts/roxie.sh
@@ -108,7 +108,15 @@ gh_download_release() {
         version="tags/${version}"
     fi
 
-    asset_id="$(curl -fsS --retry 3 --retry-delay 5 --retry-connrefused \
+    local auth_headers=()
+    if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+        auth_headers+=(-H "Authorization: token ${GITHUB_TOKEN}")
+    else
+        # shellcheck disable=SC2016
+        echo >&2 'Note: $GITHUB_TOKEN not found, querying GitHub without an Authorization header may result in throttling.'
+    fi
+
+    asset_id="$(curl -fsS --retry 3 --retry-delay 5 --retry-connrefused "${auth_headers[@]}" \
         -H "Accept: application/vnd.github+json" \
         -H "X-GitHub-Api-Version: 2026-03-10" \
         "https://api.github.com/repos/${repo}/releases/${version}" \
@@ -117,7 +125,7 @@ gh_download_release() {
         echo >&2 "Error: No asset ID found for asset name ${asset_name} for release tag ${version} in repo ${repo}"
         exit 1
     fi
-    curl -fsSL --retry 3 --retry-delay 5 --retry-connrefused \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-connrefused "${auth_headers[@]}" \
         -H 'Accept: application/octet-stream' \
         -o "$target" \
         "https://api.github.com/repos/${repo}/releases/assets/${asset_id}"
diff --git a/sensor/admission-control/errors/msg.go b/sensor/admission-control/errors/msg.go
deleted file mode 100644
index 50346aad031ef..0000000000000
--- a/sensor/admission-control/errors/msg.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package errors
-
-import (
-	"fmt"
-
-	"github.com/stackrox/rox/generated/storage"
-)
-
-// ImageScanUnavailableMsg return message indicating inability to handle policies requiring image scans.
-func ImageScanUnavailableMsg(policy *storage.Policy) string {
-	return fmt.Sprintf("Policy %q (%s) depends on the existence of image scans. To enforce this policy "+
-		"please enable the 'Contact image scanners' option", policy.GetName(), policy.GetId())
-}
diff --git a/sensor/admission-control/manager/evaluate_deploytime.go b/sensor/admission-control/manager/evaluate_deploytime.go
index 91ace291194d7..9c35ffe8acef3 100644
--- a/sensor/admission-control/manager/evaluate_deploytime.go
+++ b/sensor/admission-control/manager/evaluate_deploytime.go
@@ -26,11 +26,6 @@ const (
 )
 
 func (m *manager) shouldBypass(s *state, req *admission.AdmissionRequest) bool {
-	if !s.activeForOperation(req.Operation) {
-		log.Debugf("Not enforcing on operation, bypassing %s request on %s/%s [%s]", req.Operation, req.Namespace, req.Name, req.Kind)
-		return true
-	}
-
 	// Do not enforce on StackRox and system namespaces
 	if req.Namespace == namespaces.StackRox || req.Namespace == m.ownNamespace || kubernetes.IsSystemNamespace(req.Namespace) {
 		log.Debugf("Action affects system namespace, bypassing %s request on %s/%s [%s]", req.Operation, req.Namespace, req.Name, req.Kind)
diff --git a/sensor/admission-control/manager/fast_path_detection_bench_test.go b/sensor/admission-control/manager/fast_path_detection_bench_test.go
index f9cc072d3fd63..4730eeecf233c 100644
--- a/sensor/admission-control/manager/fast_path_detection_bench_test.go
+++ b/sensor/admission-control/manager/fast_path_detection_bench_test.go
@@ -313,7 +313,6 @@ func benchSettings(fastPolicies, slowPolicies []*storage.Policy) *sensor.Admissi
 		ClusterConfig: &storage.DynamicClusterConfig{
 			AdmissionControllerConfig: &storage.AdmissionControllerConfig{
 				Enabled:        true,
-				ScanInline:     true,
 				TimeoutSeconds: 10,
 			},
 		},
diff --git a/sensor/admission-control/manager/image_coalescing_caching_bench_test.go b/sensor/admission-control/manager/image_coalescing_caching_bench_test.go
index e683609667a8d..bea93a06f1c0c 100644
--- a/sensor/admission-control/manager/image_coalescing_caching_bench_test.go
+++ b/sensor/admission-control/manager/image_coalescing_caching_bench_test.go
@@ -238,10 +238,8 @@ func cachingBenchSettings() *sensor.AdmissionControlSettings {
 		ClusterId: uuid.NewDummy().String(),
 		ClusterConfig: &storage.DynamicClusterConfig{
 			AdmissionControllerConfig: &storage.AdmissionControllerConfig{
-				Enabled:          true,
-				EnforceOnUpdates: false,
-				TimeoutSeconds:   10,
-				ScanInline:       true,
+				Enabled:        true,
+				TimeoutSeconds: 10,
 			},
 		},
 		EnforcedDeployTimePolicies: &storage.PolicyList{Policies: []*storage.Policy{
diff --git a/sensor/admission-control/manager/images.go b/sensor/admission-control/manager/images.go
index 84ef75aecf3e7..a3b9bb721fc2e 100644
--- a/sensor/admission-control/manager/images.go
+++ b/sensor/admission-control/manager/images.go
@@ -125,9 +125,9 @@ func (m *manager) getImageFromSensorOrCentral(ctx context.Context, s *state, img
 	// Note: Sensor is required to scan images in the local registry.
 	if !m.sensorConnStatus.Get() && s.centralConn != nil && s.centralConn.GetState() != connectivity.Shutdown {
 		start := time.Now()
-		resp, err := v1.NewImageServiceClient(s.centralConn).ScanImageInternal(ctx, &v1.ScanImageInternalRequest{
+		resp, err := v1.NewImageServiceClient(s.centralConn).ScanImageInternalForAdmission(ctx, &v1.ScanImageInternalRequest{
 			Image:      img,
-			CachedOnly: !s.GetClusterConfig().GetAdmissionControllerConfig().GetScanInline(),
+			CachedOnly: false,
 		})
 		observeImageFetch(fetchSourceCentral, time.Since(start), err)
 		if err != nil {
@@ -139,7 +139,7 @@ func (m *manager) getImageFromSensorOrCentral(ctx context.Context, s *state, img
 	start := time.Now()
 	resp, err := m.client.GetImage(ctx, &sensor.GetImageRequest{
 		Image:      img,
-		ScanInline: s.GetClusterConfig().GetAdmissionControllerConfig().GetScanInline(),
+		ScanInline: true,
 		Namespace:  deployment.GetNamespace(),
 	})
 	observeImageFetch(fetchSourceSensor, time.Since(start), err)
@@ -220,20 +220,16 @@ func (m *manager) getAvailableImagesAndKickOffScans(ctx context.Context, shouldF
 	pendingCount.Store(1)
 	fetchCount := 0
 
-	scanInline := s.GetClusterConfig().GetAdmissionControllerConfig().GetScanInline()
-
 	for idx, container := range deployment.GetContainers() {
 		image := container.GetImage()
-		if image.GetId() != "" || scanInline {
-			cachedImage := m.getCachedImage(image, s, true)
-			if cachedImage != nil {
-				images[idx] = cachedImage
-			}
-			if shouldFetch && (cachedImage == nil || (scanInline && cachedImage.GetScan() == nil)) {
-				pendingCount.Add(1)
-				fetchCount++
-				go m.fetchImage(ctx, s, imgChan, &pendingCount, idx, image, deployment)
-			}
+		cachedImage := m.getCachedImage(image, s, true)
+		if cachedImage != nil {
+			images[idx] = cachedImage
+		}
+		if shouldFetch && (cachedImage == nil || cachedImage.GetScan() == nil) {
+			pendingCount.Add(1)
+			fetchCount++
+			go m.fetchImage(ctx, s, imgChan, &pendingCount, idx, image, deployment)
 		}
 		if images[idx] == nil {
 			images[idx] = types.ToImage(container.GetImage())
diff --git a/sensor/admission-control/manager/images_test.go b/sensor/admission-control/manager/images_test.go
index 7e87d0ce9b995..cc24b56f5457e 100644
--- a/sensor/admission-control/manager/images_test.go
+++ b/sensor/admission-control/manager/images_test.go
@@ -425,11 +425,6 @@ func (s *ImageCacheTestSuite) TestGetAvailableImagesInitContainerHandling() {
 	for name, tc := range cases {
 		s.Run(name, func() {
 			st := createTestState(false)
-			st.ClusterConfig = &storage.DynamicClusterConfig{
-				AdmissionControllerConfig: &storage.AdmissionControllerConfig{
-					ScanInline: true,
-				},
-			}
 			s.manager.state.Store(st)
 
 			deployment := &storage.Deployment{
diff --git a/sensor/admission-control/manager/manager_impl.go b/sensor/admission-control/manager/manager_impl.go
index dc200e1afa000..90db67b4026a2 100644
--- a/sensor/admission-control/manager/manager_impl.go
+++ b/sensor/admission-control/manager/manager_impl.go
@@ -11,7 +11,6 @@ import (
 	"github.com/stackrox/rox/generated/internalapi/sensor"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/booleanpolicy"
-	"github.com/stackrox/rox/pkg/booleanpolicy/policyfields"
 	"github.com/stackrox/rox/pkg/clientconn"
 	"github.com/stackrox/rox/pkg/coalescer"
 	"github.com/stackrox/rox/pkg/concurrency"
@@ -27,7 +26,6 @@ import (
 	"github.com/stackrox/rox/pkg/sizeboundedcache"
 	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stackrox/rox/pkg/utils"
-	"github.com/stackrox/rox/sensor/admission-control/errors"
 	"github.com/stackrox/rox/sensor/admission-control/resources"
 	"google.golang.org/grpc"
 	admission "k8s.io/api/admission/v1"
@@ -64,7 +62,6 @@ type state struct {
 	eventOnlyK8sDetector   runtime.Detector
 
 	bypassForUsers, bypassForGroups set.FrozenStringSet
-	enforcedOps                     map[admission.Operation]struct{}
 
 	centralConn *grpc.ClientConn
 }
@@ -82,11 +79,6 @@ func (s *state) admissionTimeoutCtx() (context.Context, context.CancelFunc) {
 	return context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 }
 
-func (s *state) activeForOperation(op admission.Operation) bool {
-	_, active := s.enforcedOps[op]
-	return active
-}
-
 const (
 	// imageNameCacheSize is the maximum number of entries in the image name-to-cache-key
 	// LRU. Each entry maps a full image name (e.g. "docker.io/library/nginx:1.25") to its
@@ -379,11 +371,6 @@ func (m *manager) ProcessNewSettings(newSettings *sensor.AdmissionControlSetting
 	allK8sEventPolicies := detection.NewPolicySet(m, m)
 	deployFieldK8sEventPolicies, k8sEventOnlyPolicies := detection.NewPolicySet(m, m), detection.NewPolicySet(m, m)
 	for _, policy := range newSettings.GetRuntimePolicies().GetPolicies() {
-		if policyfields.AlertsOnMissingEnrichment(policy) && !newSettings.GetClusterConfig().GetAdmissionControllerConfig().GetScanInline() {
-			log.Warn(errors.ImageScanUnavailableMsg(policy))
-			continue
-		}
-
 		if err := allK8sEventPolicies.UpsertPolicy(policy); err != nil {
 			log.Errorf("Unable to upsert policy %q (%s), will not be able to detect", policy.GetName(), policy.GetId())
 		}
@@ -400,19 +387,13 @@ func (m *manager) ProcessNewSettings(newSettings *sensor.AdmissionControlSetting
 		log.Debugf("Upserted policy %q (%s)", policy.GetName(), policy.GetId())
 	}
 
-	enforceOnCreates := newSettings.GetClusterConfig().GetAdmissionControllerConfig().GetEnabled()
-	enforceOnUpdates := newSettings.GetClusterConfig().GetAdmissionControllerConfig().GetEnforceOnUpdates()
+	enforce := newSettings.GetClusterConfig().GetAdmissionControllerConfig().GetEnabled()
 
 	// Manager implements both ClusterLabelProvider and NamespaceLabelProvider interfaces.
 	specOnlyPolicies := detection.NewPolicySet(m, m)
 	enrichmentRequiredPolicies := detection.NewPolicySet(m, m)
-	if enforceOnCreates || enforceOnUpdates {
+	if enforce {
 		for _, policy := range newSettings.GetEnforcedDeployTimePolicies().GetPolicies() {
-			if policyfields.AlertsOnMissingEnrichment(policy) &&
-				!newSettings.GetClusterConfig().GetAdmissionControllerConfig().GetScanInline() {
-				log.Warn(errors.ImageScanUnavailableMsg(policy))
-				continue
-			}
 			compiled, err := detection.CompilePolicy(policy, m, m)
 			if err != nil {
 				log.Errorf("Unable to compile policy %q (%s): %v", policy.GetName(), policy.GetId(), err)
@@ -426,15 +407,6 @@ func (m *manager) ProcessNewSettings(newSettings *sensor.AdmissionControlSetting
 		}
 	}
 
-	enforcedOperations := make(map[admission.Operation]struct{})
-	if enforceOnCreates {
-		enforcedOperations[admission.Create] = struct{}{}
-	}
-
-	if enforceOnUpdates {
-		enforcedOperations[admission.Update] = struct{}{}
-	}
-
 	oldState := m.currentState()
 	newState := &state{
 		AdmissionControlSettings:         newSettings,
@@ -445,7 +417,6 @@ func (m *manager) ProcessNewSettings(newSettings *sensor.AdmissionControlSetting
 		eventOnlyK8sDetector:             runtime.NewDetector(k8sEventOnlyPolicies),
 		bypassForUsers:                   allowAlwaysUsers,
 		bypassForGroups:                  allowAlwaysGroups,
-		enforcedOps:                      enforcedOperations,
 	}
 
 	if oldState != nil && newSettings.GetCentralEndpoint() == oldState.GetCentralEndpoint() {
diff --git a/sensor/admission-control/service/service_test.go b/sensor/admission-control/service/service_test.go
index 7e896ea79da3c..28a34dc26cbae 100644
--- a/sensor/admission-control/service/service_test.go
+++ b/sensor/admission-control/service/service_test.go
@@ -88,8 +88,7 @@ func TestLatestTagPolicyAdmissionReview(t *testing.T) {
 			ClusterId: uuid.NewDummy().String(),
 			ClusterConfig: &storage.DynamicClusterConfig{
 				AdmissionControllerConfig: &storage.AdmissionControllerConfig{
-					EnforceOnUpdates: true,
-					Enabled:          true,
+					Enabled: true,
 				},
 			},
 		},
diff --git a/sensor/common/clusterentities/store.go b/sensor/common/clusterentities/store.go
index 1a17660f2c2d0..90313c046ac25 100644
--- a/sensor/common/clusterentities/store.go
+++ b/sensor/common/clusterentities/store.go
@@ -112,6 +112,24 @@ func (ed *EntityData) AddContainerID(containerID string, container ContainerMeta
 	ed.containerIDs[containerID] = container
 }
 
+// Clone returns a deep copy of the EntityData that can be mutated independently of the original.
+func (ed *EntityData) Clone() *EntityData {
+	if ed == nil {
+		return nil
+	}
+	clone := &EntityData{
+		ips:          maps.Clone(ed.ips),
+		containerIDs: maps.Clone(ed.containerIDs),
+	}
+	if ed.endpoints != nil {
+		clone.endpoints = make(map[net.NumericEndpoint][]EndpointTargetInfo, len(ed.endpoints))
+		for ep, infos := range ed.endpoints {
+			clone.endpoints[ep] = slices.Clone(infos)
+		}
+	}
+	return clone
+}
+
 // Store is a store for managing cluster entities (currently deployments only) and allows looking them up by
 // endpoint.
 type Store struct {
@@ -128,6 +146,10 @@ type Store struct {
 	pastSensors HeritageManager
 	// heritageApplied ensures that past heritage data is applied to the current instance only once.
 	heritageApplied concurrency.Signal
+	// applyHeritageLock serializes concurrent ApplyDataFromHeritageOnce calls. With the PubSub
+	// concurrent lane, deployment events are processed on separate goroutines, so the heritage
+	// apply can be entered concurrently; without this lock the "apply once" guard would race.
+	applyHeritageLock sync.Mutex
 
 	// Cache enriched data for the current instance of Sensor.
 	// This data won't be stored into config map.
@@ -201,6 +223,13 @@ func (e *Store) GetHeritageManager() HeritageManager {
 
 // ApplyDataFromHeritageOnce adds heritage data about past sensors to the store if that hasn't happened yet.
 func (e *Store) ApplyDataFromHeritageOnce() {
+	if e.heritageApplied.IsDone() {
+		return
+	}
+	// Serialize concurrent callers and re-check under the lock: the initial IsDone check above
+	// is only a fast path. Two goroutines could both pass it before either signals completion.
+	e.applyHeritageLock.Lock()
+	defer e.applyHeritageLock.Unlock()
 	if e.heritageApplied.IsDone() {
 		return
 	}
@@ -238,15 +267,33 @@ func (e *Store) applyHeritageData(dg dataGetter) bool {
 		return false
 	}
 
-	e.currentSensorLock.RLock()
-	defer e.currentSensorLock.RUnlock()
+	var deploymentID string
+	var modEntityData *EntityData
+	// Clone under the read lock and mutate the private copy. The shared currentSensorEntityData
+	// is also referenced by concurrent Apply() calls (see onDeploymentCreateOrUpdate), so mutating
+	// it in place would race with those readers.
+	concurrency.WithRLock(&e.currentSensorLock, func() {
+		deploymentID = e.currentSensorDeploymentID
+		modEntityData = e.currentSensorEntityData.Clone()
+	})
+
+	// Snapshot the current Sensor's endpoints once. Each past entry derives its endpoints from
+	// this immutable snapshot; deriving from modEntityData.endpoints instead would compound the
+	// endpoints added for earlier past entries, growing exponentially with the number of entries.
+	srcEndpoints := maps.Clone(modEntityData.endpoints)
+	changed := false
 	for _, entry := range past {
-		log.Infof("Applying heritage data %q to current Sensor deploymentID %s", entry.String(), e.currentSensorDeploymentID)
-		modEntityData := e.currentSensorEntityData
-		if applyPastToEntityData(modEntityData, entry) {
-			e.Apply(map[string]*EntityData{e.currentSensorDeploymentID: modEntityData}, true)
+		log.Infof("Applying heritage data %q to current Sensor deploymentID %s", entry.String(), deploymentID)
+		if applyPastToEntityData(modEntityData, srcEndpoints, entry) {
+			changed = true
 		}
 	}
+	// modEntityData accumulates every past entry, so a single Apply after the loop suffices.
+	// Applying inside the loop re-sent the whole growing object as an incremental update on each
+	// iteration; the store dedupes with sets so the result was identical, just extra work.
+	if changed {
+		e.Apply(map[string]*EntityData{deploymentID: modEntityData}, true)
+	}
 	return true
 }
 
@@ -266,7 +313,11 @@ func (e *Store) HasCurrentSensorMetadata() bool {
 }
 
 // applyPastToEntityData returns true if the `past` data was added to `data`; false otherwise.
-func applyPastToEntityData(data *EntityData, past *heritage.SensorMetadata) bool {
+// srcEndpoints is an immutable snapshot of the current Sensor's endpoints; past endpoints are
+// derived from it rather than from data.endpoints so that endpoints added for earlier past entries
+// are neither re-derived (which compounds exponentially across past entries) nor mutated while
+// being ranged over.
+func applyPastToEntityData(data *EntityData, srcEndpoints map[net.NumericEndpoint][]EndpointTargetInfo, past *heritage.SensorMetadata) bool {
 	if _, found := data.containerIDs[past.ContainerID]; found {
 		// The cluster entities store knows about this past instance of sensor. Skip adding.
 		log.Debugf("Cluster entities store already knows about container %s. Skipping.", past.ContainerID)
@@ -277,9 +328,14 @@ func applyPastToEntityData(data *EntityData, past *heritage.SensorMetadata) bool
 	pastIP := net.ParseIP(past.PodIP)
 	// Adding additional pod IP to the Sensor deployment
 	data.AddIP(pastIP)
-	for endpoint, infos := range data.endpoints {
-		// Craft endpoint with the same port and proto but with past IP
+	// Craft endpoints with the same port and proto but with the past IP.
+	for endpoint, infos := range srcEndpoints {
 		newEndpoint := net.MakeNumericEndpoint(pastIP, endpoint.IPAndPort.Port, endpoint.L4Proto)
+		if _, exists := data.endpoints[newEndpoint]; exists {
+			// The past pod IP coincides with an endpoint that already exists (e.g. the current
+			// Sensor's IP was previously used by this past instance); nothing new to add.
+			continue
+		}
 		// Container port and port name included in `infos` remain the same
 		for _, info := range infos {
 			data.AddEndpoint(newEndpoint, info)
diff --git a/sensor/common/clusterentities/store_heritage_test.go b/sensor/common/clusterentities/store_heritage_test.go
index 7c7ed6a78339b..497104cbe33e3 100644
--- a/sensor/common/clusterentities/store_heritage_test.go
+++ b/sensor/common/clusterentities/store_heritage_test.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/stackrox/rox/pkg/net"
+	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stackrox/rox/sensor/common/heritage"
 	"github.com/stretchr/testify/assert"
 )
@@ -134,6 +135,73 @@ func TestStore_applyHeritageData(t *testing.T) {
 	}
 }
 
+// TestStore_ApplyHeritageDataOnce_Concurrent is a regression test for a "concurrent map writes"
+// crash: with the PubSub concurrent lane, deployment events are processed on separate goroutines,
+// so ApplyDataFromHeritageOnce could be entered concurrently. Both callers passed the "once" guard
+// and mutated the shared currentSensorEntityData maps at the same time. Run with -race.
+func TestStore_ApplyHeritageDataOnce_Concurrent(t *testing.T) {
+	mockHM := &mockHeritageManager{
+		data: []*heritage.SensorMetadata{
+			{ContainerID: "past123", PodIP: "10.1.1.1", SensorStart: time.Now().Add(-time.Hour)},
+			{ContainerID: "past456", PodIP: "10.1.1.2", SensorStart: time.Now().Add(-2 * time.Hour)},
+		},
+		isEnabled: true,
+	}
+	store := NewStore(0, mockHM, false)
+
+	currentData := createSensorEntityData("current123", "10.2.2.2")
+	// Endpoints are required to exercise EntityData.AddEndpoint, the site of the original crash.
+	currentData.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), 8443, net.TCP), EndpointTargetInfo{ContainerPort: 8443})
+	currentData.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), 9090, net.TCP), EndpointTargetInfo{ContainerPort: 9090})
+	store.RememberCurrentSensorMetadata("sensor-deploy-1", currentData)
+
+	var wg sync.WaitGroup
+	for range 50 {
+		wg.Go(func() {
+			store.ApplyDataFromHeritageOnce()
+		})
+	}
+	wg.Wait()
+
+	assert.True(t, store.heritageApplied.IsDone())
+}
+
+// TestStore_ApplyHeritage_ConcurrentWithApply is a regression test for a data race between the
+// heritage apply and a concurrent Apply() call on the same EntityData. onDeploymentCreateOrUpdate
+// stores the deployment's EntityData via RememberCurrentSensorMetadata and then passes that same
+// object to Apply(); with the PubSub concurrent lane these run on separate goroutines. Serializing
+// the heritage apply is not enough: it must not mutate the shared object in place while Apply reads
+// it. Run with -race.
+func TestStore_ApplyHeritage_ConcurrentWithApply(t *testing.T) {
+	mockHM := &mockHeritageManager{
+		data: []*heritage.SensorMetadata{
+			{ContainerID: "past123", PodIP: "10.1.1.1", SensorStart: time.Now().Add(-time.Hour)},
+		},
+		isEnabled: true,
+	}
+	store := NewStore(0, mockHM, false)
+
+	// The same object is remembered as current sensor metadata and passed to Apply below.
+	shared := createSensorEntityData("current123", "10.2.2.2")
+	shared.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), 8443, net.TCP), EndpointTargetInfo{ContainerPort: 8443})
+	shared.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), 9090, net.TCP), EndpointTargetInfo{ContainerPort: 9090})
+	store.RememberCurrentSensorMetadata("sensor-deploy-1", shared)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		store.ApplyDataFromHeritageOnce()
+	}()
+	go func() {
+		defer wg.Done()
+		store.Apply(map[string]*EntityData{"sensor-deploy-1": shared}, false)
+	}()
+	wg.Wait()
+
+	assert.True(t, store.heritageApplied.IsDone())
+}
+
 func TestApplyPastToEntityData(t *testing.T) {
 	tests := map[string]struct {
 		currentData    *EntityData
@@ -187,7 +255,7 @@ func TestApplyPastToEntityData(t *testing.T) {
 
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
-			result := applyPastToEntityData(tt.currentData, tt.pastSensor)
+			result := applyPastToEntityData(tt.currentData, maps.Clone(tt.currentData.endpoints), tt.pastSensor)
 			assert.Equal(t, tt.expectedResult, result)
 			containerIDs := tt.currentData.GetContainerIDs("sensor")
 			podIPs := tt.currentData.GetValidIPs()
@@ -212,6 +280,75 @@ func TestApplyPastToEntityData(t *testing.T) {
 	}
 }
 
+// TestApplyPastToEntityData_NoDuplicateEndpoints is a regression test for endpoints being
+// duplicated because applyPastToEntityData added entries to data.endpoints while ranging over it.
+// Adding keys to a map during iteration is nondeterministic in Go (a new key "may be produced or
+// may be skipped"); with enough endpoints the buggy version reliably re-visited freshly added
+// past-IP endpoints and appended their info a second time.
+func TestApplyPastToEntityData_NoDuplicateEndpoints(t *testing.T) {
+	const nPorts = 64
+	data := createSensorEntityData("current123", "10.2.2.2")
+	for i := range nPorts {
+		port := uint16(1000 + i)
+		data.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), port, net.TCP), EndpointTargetInfo{ContainerPort: port})
+	}
+
+	added := applyPastToEntityData(data, maps.Clone(data.endpoints), &heritage.SensorMetadata{ContainerID: "past456", PodIP: "10.1.1.1"})
+	assert.True(t, added)
+
+	// Every endpoint (current and past) must carry exactly one info; a longer slice means the map
+	// was mutated while being ranged over and an entry was processed twice.
+	assert.Len(t, data.endpoints, 2*nPorts, "expected current + past endpoints and nothing else")
+	for ep, infos := range data.endpoints {
+		assert.Lenf(t, infos, 1, "endpoint %v has duplicate infos: %v", ep, infos)
+	}
+}
+
+// TestApplyPastToEntityData_MultiplePastNoCompounding is a regression test for endpoints compounding
+// across past entries: applyHeritageData reuses a single EntityData for all past sensors, so deriving
+// past endpoints from data.endpoints (which grows each entry) rather than from an immutable snapshot
+// caused the per-endpoint info slice to double with every additional past sensor (1, 2, 4, 8, ...).
+func TestApplyPastToEntityData_MultiplePastNoCompounding(t *testing.T) {
+	data := createSensorEntityData("current123", "10.2.2.2")
+	data.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), 8443, net.TCP), EndpointTargetInfo{ContainerPort: 8443})
+	data.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), 9090, net.TCP), EndpointTargetInfo{ContainerPort: 9090})
+
+	// Mirror applyHeritageData: snapshot once, then apply every past entry against that snapshot.
+	srcEndpoints := maps.Clone(data.endpoints)
+	past := []*heritage.SensorMetadata{
+		{ContainerID: "past1", PodIP: "10.1.1.1"},
+		{ContainerID: "past2", PodIP: "10.1.1.2"},
+		{ContainerID: "past3", PodIP: "10.1.1.3"},
+		{ContainerID: "past4", PodIP: "10.1.1.4"},
+	}
+	for _, entry := range past {
+		assert.True(t, applyPastToEntityData(data, srcEndpoints, entry))
+	}
+
+	// 2 ports for the current IP plus 2 ports per past IP, each with exactly one info.
+	assert.Len(t, data.endpoints, 2*(1+len(past)), "unexpected number of endpoints")
+	for ep, infos := range data.endpoints {
+		assert.Lenf(t, infos, 1, "endpoint %v has duplicate infos: %v", ep, infos)
+	}
+}
+
+// TestApplyPastToEntityData_PastIPEqualsCurrent is a regression test for a past pod IP that coincides
+// with the current Sensor's endpoint IP: deriving a past endpoint would collide with an existing key
+// and append a duplicate info to it. Applying the same past entry must leave one info per endpoint.
+func TestApplyPastToEntityData_PastIPEqualsCurrent(t *testing.T) {
+	data := createSensorEntityData("current123", "10.2.2.2")
+	data.AddEndpoint(net.MakeNumericEndpoint(net.ParseIP("10.2.2.2"), 8443, net.TCP), EndpointTargetInfo{ContainerPort: 8443})
+
+	srcEndpoints := maps.Clone(data.endpoints)
+	// Past sensor reused the current pod IP but has a different container ID.
+	assert.True(t, applyPastToEntityData(data, srcEndpoints, &heritage.SensorMetadata{ContainerID: "past456", PodIP: "10.2.2.2"}))
+
+	assert.Len(t, data.endpoints, 1, "no new endpoint expected for a coinciding IP")
+	for ep, infos := range data.endpoints {
+		assert.Lenf(t, infos, 1, "endpoint %v has duplicate infos: %v", ep, infos)
+	}
+}
+
 func TestEntityData_String_SlicesCollectFix(t *testing.T) {
 	// Test justification: Validates the slices.Collect fix for proper formatting
 	tests := map[string]struct {
diff --git a/sensor/common/deduper/deduper.go b/sensor/common/deduper/deduper.go
index 3e8734f205ef6..d33c8379be41c 100644
--- a/sensor/common/deduper/deduper.go
+++ b/sensor/common/deduper/deduper.go
@@ -80,11 +80,12 @@ func (d *deduper) Send(msg *central.MsgFromSensor) error {
 		ResourceType: reflect.TypeOf(event.GetResource()),
 	}
 	if event.GetAction() == central.ResourceAction_REMOVE_RESOURCE {
-		priorLen := len(d.lastSent)
+		_, previouslySent := d.lastSent[key]
 		delete(d.lastSent, key)
-		// Do not send a remove message for something that has not been seen before
-		// This also effectively dedupes REMOVE actions
-		if priorLen == len(d.lastSent) {
+		// Runtime alerts bypass lastSent, so alert removals must reach Central
+		// even if no deploy-time result has been sent yet. Other resource
+		// removals can be dropped if the resource was never sent or already removed.
+		if !previouslySent && event.GetAlertResults() == nil {
 			return nil
 		}
 		if err := d.stream.Send(msg); err != nil {
diff --git a/sensor/common/deduper/runtime_removal_test.go b/sensor/common/deduper/runtime_removal_test.go
new file mode 100644
index 0000000000000..3525142767491
--- /dev/null
+++ b/sensor/common/deduper/runtime_removal_test.go
@@ -0,0 +1,117 @@
+package deduper
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/internalapi/central"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRuntimeAlertRemovalIsForwarded(t *testing.T) {
+	cases := map[string]bool{
+		"runtime alert only":                 false,
+		"deploy result before runtime alert": true,
+	}
+
+	for name, sendDeployResult := range cases {
+		t.Run(name, func(t *testing.T) {
+			downstream := new(fakeStream)
+			stream := NewDedupingMessageStream(downstream, nil, false)
+
+			makeMessage := func(action central.ResourceAction, stage storage.LifecycleStage) *central.MsgFromSensor {
+				return &central.MsgFromSensor{
+					Msg: &central.MsgFromSensor_Event{
+						Event: &central.SensorEvent{
+							Id:     "deployment-1",
+							Action: action,
+							Resource: &central.SensorEvent_AlertResults{
+								AlertResults: &central.AlertResults{
+									DeploymentId: "deployment-1",
+									Stage:        stage,
+								},
+							},
+						},
+					},
+				}
+			}
+
+			if sendDeployResult {
+				msg := makeMessage(central.ResourceAction_CREATE_RESOURCE, storage.LifecycleStage_DEPLOY)
+				require.NoError(t, stream.Send(msg))
+				require.Len(t, downstream.orderedMessages, 1)
+			}
+
+			runtime := makeMessage(central.ResourceAction_CREATE_RESOURCE, storage.LifecycleStage_RUNTIME)
+			runtime.GetEvent().GetAlertResults().Alerts = []*storage.Alert{
+				{
+					Id:             "runtime-alert-1",
+					LifecycleStage: storage.LifecycleStage_RUNTIME,
+					State:          storage.ViolationState_ACTIVE,
+				},
+			}
+			beforeRuntime := len(downstream.orderedMessages)
+			require.NoError(t, stream.Send(runtime))
+			require.Len(t, downstream.orderedMessages, beforeRuntime+1)
+
+			// Sensor's removal message is empty and has the default lifecycle
+			// stage, DEPLOY, even when the deployment has runtime alerts.
+			removal := makeMessage(central.ResourceAction_REMOVE_RESOURCE, storage.LifecycleStage_DEPLOY)
+			beforeRemoval := len(downstream.orderedMessages)
+			require.NoError(t, stream.Send(removal))
+			require.Len(t, downstream.orderedMessages, beforeRemoval+1,
+				"alert removal must reach Central even without a prior deploy-time result")
+			require.Same(t, removal, downstream.orderedMessages[len(downstream.orderedMessages)-1])
+
+			// Repeated alert removals must also reach Central.
+			require.NoError(t, stream.Send(removal))
+			require.Len(t, downstream.orderedMessages, beforeRemoval+2)
+			require.Same(t, removal, downstream.orderedMessages[len(downstream.orderedMessages)-1])
+
+			// Removal must clear any cached deploy-time result.
+			if sendDeployResult {
+				msg := makeMessage(central.ResourceAction_CREATE_RESOURCE, storage.LifecycleStage_DEPLOY)
+				require.NoError(t, stream.Send(msg))
+				require.Len(t, downstream.orderedMessages, beforeRemoval+3)
+			}
+		})
+	}
+}
+
+func TestDeploymentRemovalDeduplication(t *testing.T) {
+	cases := map[string]bool{
+		"previously sent": true,
+		"never sent":      false,
+	}
+	for name, previouslySent := range cases {
+		t.Run(name, func(t *testing.T) {
+			downstream := new(fakeStream)
+			stream := NewDedupingMessageStream(downstream, nil, false)
+			msg := &central.MsgFromSensor{
+				Msg: &central.MsgFromSensor_Event{
+					Event: &central.SensorEvent{
+						Id:     "deployment-1",
+						Action: central.ResourceAction_CREATE_RESOURCE,
+						Resource: &central.SensorEvent_Deployment{
+							Deployment: &storage.Deployment{Id: "deployment-1"},
+						},
+					},
+				},
+			}
+			if previouslySent {
+				require.NoError(t, stream.Send(msg))
+				require.Len(t, downstream.orderedMessages, 1)
+			}
+			removal := msg.CloneVT()
+			removal.GetEvent().Action = central.ResourceAction_REMOVE_RESOURCE
+			require.NoError(t, stream.Send(removal))
+			require.NoError(t, stream.Send(removal))
+			if previouslySent {
+				require.Len(t, downstream.orderedMessages, 2)
+				require.Same(t, removal, downstream.orderedMessages[1])
+			} else {
+				require.Empty(t, downstream.orderedMessages)
+			}
+		})
+	}
+}
diff --git a/sensor/common/detector/detector.go b/sensor/common/detector/detector.go
index ef9b94103e2ef..5eae96f0afdc9 100644
--- a/sensor/common/detector/detector.go
+++ b/sensor/common/detector/detector.go
@@ -427,7 +427,11 @@ func (d *detectorImpl) Notify(e common.SensorComponentEvent) {
 }
 
 func (d *detectorImpl) Capabilities() []centralsensor.SensorCapability {
-	return []centralsensor.SensorCapability{centralsensor.SensorDetectionCap}
+	caps := []centralsensor.SensorCapability{centralsensor.SensorDetectionCap}
+	if features.PolicyWorkloadKindExclusion.Enabled() {
+		caps = append(caps, centralsensor.WorkloadKindExclusionCap)
+	}
+	return caps
 }
 
 // ProcessPolicySync reconciles policies and flush all deployments through the detector
diff --git a/sensor/common/detector/detector_network_flow_test.go b/sensor/common/detector/detector_network_flow_test.go
index 0509469c72aad..c772a89b52015 100644
--- a/sensor/common/detector/detector_network_flow_test.go
+++ b/sensor/common/detector/detector_network_flow_test.go
@@ -208,7 +208,7 @@ func TestNetworkFlowPipelineDropsWhenFull(t *testing.T) {
 				require.NoError(t, d.Start())
 				defer d.Stop()
 
-				for i := range totalEvents {
+				sendFlow := func(idSuffix int) {
 					d.ProcessNetworkFlow(context.Background(), &storage.NetworkFlow{
 						Props: &storage.NetworkFlowProperties{
 							SrcEntity: &storage.NetworkEntityInfo{
@@ -217,13 +217,22 @@ func TestNetworkFlowPipelineDropsWhenFull(t *testing.T) {
 							},
 							DstEntity: &storage.NetworkEntityInfo{
 								Type: storage.NetworkEntityInfo_INTERNET,
-								Id:   fmt.Sprintf("internet-%d", i),
+								Id:   fmt.Sprintf("internet-%d", idSuffix),
 							},
 							DstPort:    80,
 							L4Protocol: storage.L4Protocol_L4_PROTOCOL_TCP,
 						},
 					})
 				}
+
+				// PubSub: the BufferedConsumer's run() goroutine pulls this one
+				// event and PARKS in handleEvent. That makes count deterministic.
+				sendFlow(totalEvents + 1)
+				synctest.Wait()
+
+				for i := range totalEvents {
+					sendFlow(i)
+				}
 				synctest.Wait()
 
 				select {
diff --git a/sensor/common/events/fake_file_activity.go b/sensor/common/events/fake_file_activity.go
new file mode 100644
index 0000000000000..790d4d4ef6aee
--- /dev/null
+++ b/sensor/common/events/fake_file_activity.go
@@ -0,0 +1,21 @@
+package events
+
+import (
+	sensorAPI "github.com/stackrox/rox/generated/internalapi/sensor"
+	"github.com/stackrox/rox/sensor/common/pubsub"
+)
+
+// FakeFileActivityEvent wraps a file activity message from fake workloads.
+// This allows fake workloads to publish file activities through the pubsub system rather
+// than writing directly to a shared channel.
+type FakeFileActivityEvent struct {
+	Activity *sensorAPI.FileActivity
+}
+
+func (e *FakeFileActivityEvent) Topic() pubsub.Topic {
+	return pubsub.FakeFileActivityTopic
+}
+
+func (e *FakeFileActivityEvent) Lane() pubsub.LaneID {
+	return pubsub.FakeFileActivityLane
+}
diff --git a/sensor/common/filesystem/pipeline/pipeline.go b/sensor/common/filesystem/pipeline/pipeline.go
index 5b64a52078aec..8050c6df20ad9 100644
--- a/sensor/common/filesystem/pipeline/pipeline.go
+++ b/sensor/common/filesystem/pipeline/pipeline.go
@@ -16,6 +16,7 @@ import (
 	"github.com/stackrox/rox/sensor/common/clusterentities"
 	"github.com/stackrox/rox/sensor/common/detector"
 	detectorMetrics "github.com/stackrox/rox/sensor/common/detector/metrics"
+	"github.com/stackrox/rox/sensor/common/events"
 	"github.com/stackrox/rox/sensor/common/metrics"
 	"github.com/stackrox/rox/sensor/common/processsignal"
 	"github.com/stackrox/rox/sensor/common/pubsub"
@@ -86,6 +87,18 @@ func NewFileSystemPipeline(detector detector.Detector, clusterEntities *clustere
 			p.wg.Add(1)
 			go p.cleanupExpiredBuffers()
 		}
+
+		// Register consumer for fake file activities from fake workloads
+		if err := pubSubDispatcher.RegisterConsumerToLane(
+			pubsub.FakeFileActivityConsumer,
+			pubsub.FakeFileActivityTopic,
+			pubsub.FakeFileActivityLane,
+			p.handleFakeFileActivityEvent,
+		); err != nil {
+			log.Errorf("Failed to register consumer for fake file activities: %v", err)
+		} else {
+			log.Debug("File system pipeline registered consumer for fake file activities")
+		}
 	}
 
 	if p.pubSubDispatcher == nil {
@@ -344,6 +357,30 @@ func (p *Pipeline) processEnrichedIndicator(event pubsub.Event) error {
 	return nil
 }
 
+func (p *Pipeline) handleFakeFileActivityEvent(event pubsub.Event) error {
+	select {
+	case <-p.stopper.Flow().StopRequested():
+		return nil
+	default:
+	}
+
+	fakeEvent, ok := event.(*events.FakeFileActivityEvent)
+	if !ok {
+		log.Errorf("File system pipeline received unexpected event type for fake file activity: %T", event)
+		return fmt.Errorf("unexpected event type: %T", event)
+	}
+
+	if fakeEvent.Activity == nil {
+		return nil
+	}
+
+	// Process fake file activity directly instead of writing to activityChan.
+	// This avoids potential panic on shutdown when the channel is closed by filesystemService.
+	// The activityChan is owned by the gRPC service, which is its only writer.
+	p.processFileActivity(fakeEvent.Activity)
+	return nil
+}
+
 func (p *Pipeline) processFileActivity(fs *sensorAPI.FileActivity) {
 	process := fs.GetProcess()
 	if process == nil {
diff --git a/sensor/common/image/interfaces.go b/sensor/common/image/interfaces.go
index 31660e859fb56..a016d829960dc 100644
--- a/sensor/common/image/interfaces.go
+++ b/sensor/common/image/interfaces.go
@@ -20,6 +20,7 @@ type registryStore interface {
 
 type centralClient interface {
 	ScanImageInternal(context.Context, *v1.ScanImageInternalRequest, ...grpc.CallOption) (*v1.ScanImageInternalResponse, error)
+	ScanImageInternalForAdmission(context.Context, *v1.ScanImageInternalRequest, ...grpc.CallOption) (*v1.ScanImageInternalResponse, error)
 	EnrichLocalImageInternal(context.Context, *v1.EnrichLocalImageInternalRequest, ...grpc.CallOption) (*v1.ScanImageInternalResponse, error)
 }
 
diff --git a/sensor/common/image/mocks/interfaces.go b/sensor/common/image/mocks/interfaces.go
index 0c38b631f0dd3..0de225325e782 100644
--- a/sensor/common/image/mocks/interfaces.go
+++ b/sensor/common/image/mocks/interfaces.go
@@ -167,6 +167,26 @@ func (mr *MockcentralClientMockRecorder) ScanImageInternal(arg0, arg1 any, arg2
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ScanImageInternal", reflect.TypeOf((*MockcentralClient)(nil).ScanImageInternal), varargs...)
 }
 
+// ScanImageInternalForAdmission mocks base method.
+func (m *MockcentralClient) ScanImageInternalForAdmission(arg0 context.Context, arg1 *v1.ScanImageInternalRequest, arg2 ...grpc.CallOption) (*v1.ScanImageInternalResponse, error) {
+	m.ctrl.T.Helper()
+	varargs := []any{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "ScanImageInternalForAdmission", varargs...)
+	ret0, _ := ret[0].(*v1.ScanImageInternalResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ScanImageInternalForAdmission indicates an expected call of ScanImageInternalForAdmission.
+func (mr *MockcentralClientMockRecorder) ScanImageInternalForAdmission(arg0, arg1 any, arg2 ...any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]any{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ScanImageInternalForAdmission", reflect.TypeOf((*MockcentralClient)(nil).ScanImageInternalForAdmission), varargs...)
+}
+
 // MocklocalScan is a mock of localScan interface.
 type MocklocalScan struct {
 	ctrl     *gomock.Controller
diff --git a/sensor/common/image/service_impl.go b/sensor/common/image/service_impl.go
index a3984996c063f..ca56e8cc1af44 100644
--- a/sensor/common/image/service_impl.go
+++ b/sensor/common/image/service_impl.go
@@ -84,7 +84,7 @@ func (s *serviceImpl) GetImage(ctx context.Context, req *sensor.GetImageRequest)
 	v, ok := s.imageCache.Get(cache.GetKey(req.GetImage()))
 	if id != "" && ok {
 		img := v.GetIfDone()
-		if img != nil && (!req.GetScanInline() || img.GetScan() != nil) {
+		if img != nil && img.GetScan() != nil {
 			return &sensor.GetImageResponse{
 				Image: img,
 			}, nil
@@ -110,9 +110,9 @@ func (s *serviceImpl) GetImage(ctx context.Context, req *sensor.GetImageRequest)
 
 	// Ask Central to scan the image if the image is neither internal nor local
 	if !req.GetImage().GetIsClusterLocal() {
-		scanResp, err := s.centralClient.ScanImageInternal(ctx, &v1.ScanImageInternalRequest{
+		scanResp, err := s.centralClient.ScanImageInternalForAdmission(ctx, &v1.ScanImageInternalRequest{
 			Image:      req.GetImage(),
-			CachedOnly: !req.GetScanInline(),
+			CachedOnly: false,
 		})
 		if err != nil {
 			return nil, errors.Wrap(err, "scanning image via central")
diff --git a/sensor/common/image/service_impl_test.go b/sensor/common/image/service_impl_test.go
index 37fa3355c3cf3..db7f80ef61eca 100644
--- a/sensor/common/image/service_impl_test.go
+++ b/sensor/common/image/service_impl_test.go
@@ -72,28 +72,28 @@ func (s *imageServiceSuite) TestGetImage() {
 		expectedResponse  *sensor.GetImageResponse
 	}{
 		"Cache hit and central is unreachable": {
-			request:          createImageRequest(imageName, imageID, false),
+			request:          createImageRequest(imageName, imageID),
 			notify:           common.SensorComponentEventOfflineMode,
 			expectCache:      expectCacheHelper(s.mockCache, 1, createScannedImage(imageName, imageID)),
 			expectedError:    nil,
 			expectedResponse: createImageResponse(imageName, imageID),
 		},
 		"Cache hit and central is reachable": {
-			request:          createImageRequest(imageName, imageID, false),
+			request:          createImageRequest(imageName, imageID),
 			notify:           common.SensorComponentEventCentralReachable,
 			expectCache:      expectCacheHelper(s.mockCache, 1, createScannedImage(imageName, imageID)),
 			expectedError:    nil,
 			expectedResponse: createImageResponse(imageName, imageID),
 		},
 		"Cache miss and central is unreachable": {
-			request:          createImageRequest(imageName, imageID, false),
+			request:          createImageRequest(imageName, imageID),
 			notify:           common.SensorComponentEventOfflineMode,
 			expectCache:      expectCacheHelper(s.mockCache, 1, nil),
 			expectedError:    errCentralNoReachable,
 			expectedResponse: nil,
 		},
 		"Cache miss and central is reachable": {
-			request:           createImageRequest(imageName, imageID, false),
+			request:           createImageRequest(imageName, imageID),
 			notify:            common.SensorComponentEventCentralReachable,
 			expectCache:       expectCacheHelper(s.mockCache, 1, nil),
 			expectRegistry:    expectRegistryHelper(s.mockRegistryStore, 1, false),
@@ -102,7 +102,7 @@ func (s *imageServiceSuite) TestGetImage() {
 			expectedResponse:  createImageResponse(imageName, imageID),
 		},
 		"Cache miss, central is reachable and returns error": {
-			request:           createImageRequest(imageName, imageID, false),
+			request:           createImageRequest(imageName, imageID),
 			notify:            common.SensorComponentEventCentralReachable,
 			expectCache:       expectCacheHelper(s.mockCache, 1, nil),
 			expectRegistry:    expectRegistryHelper(s.mockRegistryStore, 1, false),
@@ -111,14 +111,14 @@ func (s *imageServiceSuite) TestGetImage() {
 			expectedResponse:  nil,
 		},
 		"Cache miss, local scan, central is unreachable": {
-			request:          createImageRequest(imageName, imageID, false),
+			request:          createImageRequest(imageName, imageID),
 			notify:           common.SensorComponentEventOfflineMode,
 			expectCache:      expectCacheHelper(s.mockCache, 1, nil),
 			expectedError:    errCentralNoReachable,
 			expectedResponse: nil,
 		},
 		"Cache miss, local scan, central is reachable": {
-			request:          createImageRequest(imageName, imageID, false),
+			request:          createImageRequest(imageName, imageID),
 			notify:           common.SensorComponentEventCentralReachable,
 			expectCache:      expectCacheHelper(s.mockCache, 1, nil),
 			expectRegistry:   expectRegistryHelper(s.mockRegistryStore, 1, true),
@@ -127,7 +127,7 @@ func (s *imageServiceSuite) TestGetImage() {
 			expectedResponse: createImageResponse(imageName, imageID),
 		},
 		"Cache miss, local scan returns error, central is reachable": {
-			request:          createImageRequest(imageName, imageID, false),
+			request:          createImageRequest(imageName, imageID),
 			notify:           common.SensorComponentEventCentralReachable,
 			expectCache:      expectCacheHelper(s.mockCache, 1, nil),
 			expectRegistry:   expectRegistryHelper(s.mockRegistryStore, 1, true),
@@ -171,7 +171,7 @@ func expectRegistryHelper(mockRegistryStore *imageMocks.MockregistryStore, times
 
 func expectCentralCall(mockCentral *imageMocks.MockcentralClient, times int, retValue *v1.ScanImageInternalResponse, retErr error) expectFn {
 	return func() {
-		mockCentral.EXPECT().ScanImageInternal(gomock.Any(), gomock.Any()).Times(times).
+		mockCentral.EXPECT().ScanImageInternalForAdmission(gomock.Any(), gomock.Any()).Times(times).
 			Return(retValue, retErr)
 	}
 }
@@ -212,9 +212,8 @@ func createScannedImage(name, id string) cache.Value {
 	}}
 }
 
-func createImageRequest(name, id string, scanInline bool) *sensor.GetImageRequest {
+func createImageRequest(name, id string) *sensor.GetImageRequest {
 	return &sensor.GetImageRequest{
-		ScanInline: scanInline,
 		Image: &storage.ContainerImage{
 			Id: id,
 			Name: &storage.ImageName{
diff --git a/sensor/common/pubsub/consumer/buffered.go b/sensor/common/pubsub/consumer/buffered.go
index 7b29e28564bb7..2b5edaac0d409 100644
--- a/sensor/common/pubsub/consumer/buffered.go
+++ b/sensor/common/pubsub/consumer/buffered.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/safe"
 	"github.com/stackrox/rox/sensor/common/pubsub"
 	pubsubErrors "github.com/stackrox/rox/sensor/common/pubsub/errors"
@@ -13,6 +14,8 @@ import (
 
 const (
 	defaultBufferSize = 1000
+
+	bufferedConsumerLoggingRateLimiter = "pubsub-buffered-consumer"
 )
 
 // bufferedEvent wraps an event with its error channel to pipe callback errors back to the caller
@@ -155,6 +158,7 @@ func (c *BufferedConsumer) handleEvent(wrappedEv *bufferedEvent) {
 		// Callback completed - send error if present, otherwise just close errC
 		if err != nil {
 			operation = metrics.ConsumerError
+			logging.GetRateLimitedLogger().ErrorL(bufferedConsumerLoggingRateLimiter, "unable to handle event on lane %s, topic %s: %v", c.laneID, c.topic, err)
 			wrappedEv.errC <- err
 		}
 		// On success (err == nil), defer close handles it without sending
diff --git a/sensor/common/pubsub/consumer/buffered_test.go b/sensor/common/pubsub/consumer/buffered_test.go
index 3890a97634e0c..16c828d3325d3 100644
--- a/sensor/common/pubsub/consumer/buffered_test.go
+++ b/sensor/common/pubsub/consumer/buffered_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/safe"
 	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stackrox/rox/pkg/testutils/goleak"
@@ -58,6 +59,12 @@ func TestBufferedConsumer_ConsumeSuccess(t *testing.T) {
 func TestBufferedConsumer_CallbackError(t *testing.T) {
 	defer goleak.AssertNoGoroutineLeaks(t)
 
+	// Initialize the rate-limited logger before entering the synctest bubble.
+	// It uses a hashicorp LRU that spawns a background timer goroutine;
+	// if created inside the bubble, synctest panics on exit because the
+	// goroutine remains blocked.
+	logging.GetRateLimitedLogger()
+
 	synctest.Test(t, func(t *testing.T) {
 		expectedErr := errors.New("callback error")
 
diff --git a/sensor/common/pubsub/consumer/default.go b/sensor/common/pubsub/consumer/default.go
index fc0e99c0c41c3..bd8fdea3e19e7 100644
--- a/sensor/common/pubsub/consumer/default.go
+++ b/sensor/common/pubsub/consumer/default.go
@@ -5,11 +5,14 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/sensor/common/pubsub"
 	pubsubErrors "github.com/stackrox/rox/sensor/common/pubsub/errors"
 	"github.com/stackrox/rox/sensor/common/pubsub/metrics"
 )
 
+const defaultConsumerLoggingRateLimiter = "pubsub-default-consumer"
+
 func NewDefaultConsumer() pubsub.NewConsumer {
 	return func(laneID pubsub.LaneID, topic pubsub.Topic, consumerID pubsub.ConsumerID, callback pubsub.EventCallback) (pubsub.Consumer, error) {
 		if callback == nil {
@@ -32,7 +35,10 @@ type DefaultConsumer struct {
 }
 
 func (c *DefaultConsumer) Consume(waitable concurrency.Waitable, event pubsub.Event) <-chan error {
-	errC := make(chan error)
+	// Buffered so the send below never blocks on a reader: callers (e.g. concurrentLane)
+	// are not required to drain this channel, and must not need to in order for this
+	// goroutine to exit.
+	errC := make(chan error, 1)
 	go func() {
 		defer close(errC)
 		start := time.Now()
@@ -43,6 +49,7 @@ func (c *DefaultConsumer) Consume(waitable concurrency.Waitable, event pubsub.Ev
 			err := c.callback(event)
 			if err != nil {
 				operation = metrics.ConsumerError
+				logging.GetRateLimitedLogger().ErrorL(defaultConsumerLoggingRateLimiter, "unable to handle event on lane %s, topic %s: %v", c.laneID, c.topic, err)
 			}
 			return err
 		}():
diff --git a/sensor/common/pubsub/consumer/default_test.go b/sensor/common/pubsub/consumer/default_test.go
index a89d665a79367..346dee2f08b55 100644
--- a/sensor/common/pubsub/consumer/default_test.go
+++ b/sensor/common/pubsub/consumer/default_test.go
@@ -27,22 +27,26 @@ func (s *defaultConsumerSuite) TestConsume() {
 		s.Assert().Error(err)
 		s.Assert().Nil(c)
 	})
-	s.Run("should unblock if waitable is done", func() {
+	s.Run("should not leak even if nobody ever reads errC", func() {
+		// concurrentLane fires Consume() and discards the returned channel without
+		// reading it, relying on the consumer to report its own errors. The internal
+		// goroutine must still exit on its own (errC is buffered so the send never
+		// blocks on a reader) rather than depend on the waitable firing.
 		callbackDone := concurrency.NewSignal()
 		c, err := NewDefaultConsumer()(pubsub.DefaultLane, pubsub.DefaultTopic, pubsub.DefaultConsumer, func(_ pubsub.Event) error {
 			defer callbackDone.Signal()
 			return errors.New("some error")
 		})
 		s.Assert().NoError(err)
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx := context.Background()
 		_ = c.Consume(ctx, &testEvent{})
 		select {
 		case <-callbackDone.Done():
 		case <-time.After(500 * time.Millisecond):
 			s.FailNow("callback should be done")
 		}
-		cancel()
-		// The test will fail if there are goroutine leaks
+		// errC is intentionally never read here.
+		// The test will fail if there are goroutine leaks.
 	})
 	s.Run("consume event error", func() {
 		data := "some data"
diff --git a/sensor/common/pubsub/consumerid.go b/sensor/common/pubsub/consumerid.go
index a7d8d11f76901..122c6741b36ed 100644
--- a/sensor/common/pubsub/consumerid.go
+++ b/sensor/common/pubsub/consumerid.go
@@ -9,6 +9,7 @@ const (
 	EnrichedProcessConsumer
 	UnenrichedProcessConsumer
 	FileActivityEnrichedProcessConsumer
+	FakeFileActivityConsumer
 	DetectorProcessIndicatorConsumer
 	DetectorNetworkFlowConsumer
 	DetectorFileAccessConsumer
@@ -28,6 +29,7 @@ var (
 		ResolverConsumer:                       "Resolver",
 		EnrichedProcessConsumer:                "EnrichedProcess",
 		FileActivityEnrichedProcessConsumer:    "FileActivityEnrichedProcess",
+		FakeFileActivityConsumer:               "FakeFileActivity",
 		UnenrichedProcessConsumer:              "UnenrichedProcess",
 		DetectorProcessIndicatorConsumer:       "DetectorProcessIndicator",
 		DetectorNetworkFlowConsumer:            "DetectorNetworkFlow",
diff --git a/sensor/common/pubsub/interfaces.go b/sensor/common/pubsub/interfaces.go
index 512402577c7cb..e0d11e65795a3 100644
--- a/sensor/common/pubsub/interfaces.go
+++ b/sensor/common/pubsub/interfaces.go
@@ -28,6 +28,13 @@ type Lane interface {
 type NewConsumer func(laneID LaneID, topic Topic, consumerID ConsumerID, callback EventCallback) (Consumer, error)
 
 type Consumer interface {
+	// Consume processes event and reports the outcome on the returned channel.
+	// Implementations must not rely on that channel being read: concurrentLane
+	// dispatches Consume() without waiting on or draining the result, so a
+	// consumer that only reports errors through this channel will have them
+	// silently dropped there. Implementations should report their own errors
+	// (e.g. logging/metrics) rather than depending solely on the caller reading
+	// this channel.
 	Consume(concurrency.Waitable, Event) <-chan error
 	Stop()
 }
diff --git a/sensor/common/pubsub/lane/concurrent.go b/sensor/common/pubsub/lane/concurrent.go
index 35a63a0ba77ca..08a40692bf883 100644
--- a/sensor/common/pubsub/lane/concurrent.go
+++ b/sensor/common/pubsub/lane/concurrent.go
@@ -120,22 +120,11 @@ func (l *concurrentLane) handleEvent(event pubsub.Event) {
 		return
 	}
 	for _, c := range consumers {
-		errC := c.Consume(l.stopper.Client().Stopped(), event)
-		// Spawning go routine here to not block other consumers
-		go l.handleConsumerError(errC)
-	}
-}
-
-func (l *concurrentLane) handleConsumerError(errC <-chan error) {
-	// This blocks until the consumer finishes the processing
-	// TODO: Consider adding a timeout here
-	select {
-	case err := <-errC:
-		if err != nil {
-			// TODO: consider adding a callback to inform of the error
-			rateLimitedLog.ErrorL(l.id.String(), "unable to handle event: %v", err)
-		}
-	case <-l.stopper.Flow().StopRequested():
+		// Consume() is expected to return promptly; consumers are responsible for
+		// reporting their own errors (metrics/logs), so the result is not awaited here.
+		// Waiting on it would require a per-event goroutine that outlives this call
+		// whenever the consumer stalls, with no way to bound how many accumulate.
+		c.Consume(l.stopper.Client().Stopped(), event)
 	}
 }
 
diff --git a/sensor/common/pubsub/lane/concurrent_test.go b/sensor/common/pubsub/lane/concurrent_test.go
index c6bd8f29500ef..a5dd8e846481a 100644
--- a/sensor/common/pubsub/lane/concurrent_test.go
+++ b/sensor/common/pubsub/lane/concurrent_test.go
@@ -316,6 +316,46 @@ func TestErrorHandling(t *testing.T) {
 	})
 }
 
+func TestHandleEvent_StalledConsumerDoesNotLeakGoroutines(t *testing.T) {
+	defer goleak.AssertNoGoroutineLeaks(t)
+
+	const numEvents = 50
+	consumeCalled := make(chan struct{}, numEvents)
+	lane := NewConcurrentLane(pubsub.DefaultLane, WithConcurrentLaneConsumer(newStalledConsumer(consumeCalled))).NewLane()
+	require.NotNil(t, lane)
+	defer lane.Stop()
+
+	require.NoError(t, lane.RegisterConsumer(pubsub.DefaultConsumer, pubsub.DefaultTopic, func(_ pubsub.Event) error {
+		return nil
+	}))
+
+	// Snapshot after the lane's own goroutines exist (run loop). Find must run
+	// before Stop(): the old watcher also selected on the stop signal, so
+	// checking only after Stop() would hide a reintroduced leak.
+	ignoreExisting := goleak.IgnoreCurrent()
+
+	for range numEvents {
+		require.NoError(t, lane.Publish(&concurrentTestEvent{}))
+	}
+
+	// Wait until the lane has actually dispatched Consume() for every published
+	// event before checking for leaks - otherwise the check could race ahead of
+	// dispatch and pass trivially regardless of what handleEvent does.
+	for i := range numEvents {
+		select {
+		case <-consumeCalled:
+		case <-time.After(time.Second):
+			t.Fatalf("timed out waiting for stalledConsumer.Consume to be called for event %d/%d", i+1, numEvents)
+		}
+	}
+
+	// This must be checked while the lane is still running, i.e. before Stop().
+	// stalledConsumer's errC is never resolved, so any per-event watcher
+	// goroutine would still be alive here.
+	require.NoError(t, goleak.Find(append([]goleak.Option{ignoreExisting}, goleak.CommonIgnores()...)...),
+		"concurrentLane must not spawn a goroutine per stalled consumer event")
+}
+
 func TestStop(t *testing.T) {
 	defer goleak.AssertNoGoroutineLeaks(t)
 	t.Run("stop should clean up resources", func(t *testing.T) {
@@ -382,3 +422,24 @@ func (m *mockConsumer) Stop() {
 		m.stopFn()
 	}
 }
+
+// newStalledConsumer builds a pubsub.NewConsumer factory whose Consume() returns
+// a channel that is never written to and never closed, simulating a consumer
+// whose processing never resolves. Every Consume() call is reported on
+// consumeCalled, so callers can deterministically wait for dispatch.
+func newStalledConsumer(consumeCalled chan<- struct{}) pubsub.NewConsumer {
+	return func(_ pubsub.LaneID, _ pubsub.Topic, _ pubsub.ConsumerID, _ pubsub.EventCallback) (pubsub.Consumer, error) {
+		return &stalledConsumer{consumeCalled: consumeCalled}, nil
+	}
+}
+
+type stalledConsumer struct {
+	consumeCalled chan<- struct{}
+}
+
+func (c *stalledConsumer) Consume(_ concurrency.Waitable, _ pubsub.Event) <-chan error {
+	c.consumeCalled <- struct{}{}
+	return make(chan error)
+}
+
+func (c *stalledConsumer) Stop() {}
diff --git a/sensor/common/pubsub/laneid.go b/sensor/common/pubsub/laneid.go
index 4ff48be6b60e3..2b238fe7b513f 100644
--- a/sensor/common/pubsub/laneid.go
+++ b/sensor/common/pubsub/laneid.go
@@ -18,6 +18,7 @@ const (
 	ResolvedResourceEventLane
 	SoftRestartLane
 	ResourceSyncFinishedLane
+	FakeFileActivityLane
 )
 
 var (
@@ -37,6 +38,7 @@ var (
 		ResolvedResourceEventLane:      "ResolvedResourceEvent",
 		SoftRestartLane:                "SoftRestart",
 		ResourceSyncFinishedLane:       "ResourceSyncFinished",
+		FakeFileActivityLane:           "FakeFileActivity",
 	}
 )
 
diff --git a/sensor/common/pubsub/topic.go b/sensor/common/pubsub/topic.go
index b7c4ba4214804..ed47c1dd82e83 100644
--- a/sensor/common/pubsub/topic.go
+++ b/sensor/common/pubsub/topic.go
@@ -18,6 +18,7 @@ const (
 	ResolvedResourceEventTopic
 	SoftRestartTopic
 	ResourceSyncFinishedTopic
+	FakeFileActivityTopic
 )
 
 var (
@@ -37,6 +38,7 @@ var (
 		ResolvedResourceEventTopic:      "ResolvedResourceEvent",
 		SoftRestartTopic:                "SoftRestart",
 		ResourceSyncFinishedTopic:       "ResourceSyncFinished",
+		FakeFileActivityTopic:           "FakeFileActivity",
 	}
 )
 
diff --git a/sensor/common/scan/scan.go b/sensor/common/scan/scan.go
index 897f58e37b318..afcfe2346d431 100644
--- a/sensor/common/scan/scan.go
+++ b/sensor/common/scan/scan.go
@@ -154,7 +154,8 @@ func (s *LocalScan) EnrichLocalImageInNamespace(ctx context.Context, centralClie
 
 	// Check if there is a local Scanner.
 	// No need to continue if there is no local Scanner.
-	if s.scannerClientSingleton() == nil {
+	scannerClient := s.scannerClientSingleton()
+	if scannerClient == nil {
 		return nil, errors.Join(ErrNoLocalScanner, ErrEnrichNotStarted)
 	}
 
@@ -197,7 +198,7 @@ func (s *LocalScan) EnrichLocalImageInNamespace(ctx context.Context, centralClie
 	// Only proceed if metadata was fetched successfully
 	if errorList.Empty() {
 		// Perform partial scan (image analysis / identify components) via local scanner.
-		scannerResp = s.fetchImageAnalysis(ctx, errorList, reg, pullSourceImage)
+		scannerResp = s.fetchImageAnalysis(ctx, errorList, reg, pullSourceImage, scannerClient)
 
 		// Fetch signatures associated with image from registry. Do this even if the scan above failed, because that
 		// doesn't necessarily mean signatures cannot be fetched
@@ -413,9 +414,9 @@ func (s *LocalScan) enrichImageWithMetadata(ctx context.Context, errorList *erro
 }
 
 // fetchImageAnalysis analyzes an image via the local scanner.
-func (s *LocalScan) fetchImageAnalysis(ctx context.Context, errorList *errorhelpers.ErrorList, registry registryTypes.ImageRegistry, image *storage.Image) *scannerclient.ImageAnalysis {
+func (s *LocalScan) fetchImageAnalysis(ctx context.Context, errorList *errorhelpers.ErrorList, registry registryTypes.ImageRegistry, image *storage.Image, scannerClient scannerclient.ScannerClient) *scannerclient.ImageAnalysis {
 	// Scan the image via local scanner.
-	scannerResp, err := s.scanImg(ctx, image, registry, s.scannerClientSingleton())
+	scannerResp, err := s.scanImg(ctx, image, registry, scannerClient)
 	if err != nil {
 		log.Debugf("Scan for image %q with id %v failed: %v", image.GetName().GetFullName(), image.GetId(), err)
 		image.Notes = append(image.Notes, storage.Image_MISSING_SCAN_DATA)
diff --git a/sensor/common/scan/scan_test.go b/sensor/common/scan/scan_test.go
index d40bd633c82b4..cb86d76abb3d6 100644
--- a/sensor/common/scan/scan_test.go
+++ b/sensor/common/scan/scan_test.go
@@ -122,6 +122,65 @@ func (suite *scanTestSuite) TestLocalEnrichment() {
 	suite.Assert().True(getRegistriesTriggered, "get registry was not triggered")
 }
 
+// TestScannerClientCapturedOnce is a regression guard for a TOCTOU nil-client
+// dereference: the scanner client singleton must be consulted once per
+// enrichment and the client captured at the nil-check must be the one handed to
+// the scan. Otherwise a concurrent reset of the singleton (e.g. on Central
+// reconnect) could return non-nil at the check but nil at the scan, panicking
+// when a method is invoked on the nil client.
+func (suite *scanTestSuite) TestScannerClientCapturedOnce() {
+	fakeRegStore := &fakeRegistryStore{}
+	mirrorStore := mirrorStoreMocks.NewMockStore(gomock.NewController(suite.T()))
+
+	// Returns a valid client on the first call, then nil, simulating a
+	// concurrent singleton reset occurring mid-enrichment.
+	capturedClient := &emptyClient{}
+	singletonCalls := 0
+	singleton := func() scannerclient.ScannerClient {
+		singletonCalls++
+		if singletonCalls == 1 {
+			return capturedClient
+		}
+		return nil
+	}
+
+	var scannedWithClient scannerclient.ScannerClient
+	recordingScan := func(_ context.Context, _ *storage.Image,
+		reg registryTypes.ImageRegistry, client scannerclient.ScannerClient) (*scannerclient.ImageAnalysis, error) {
+		scannedWithClient = client
+		return successfulScan(context.Background(), nil, reg, client)
+	}
+
+	scan := LocalScan{
+		scanImg:                  recordingScan,
+		fetchSignaturesWithRetry: successfulFetchSignatures,
+		getPullSecretRegistries: func(*storage.ImageName, string, []string) ([]registryTypes.ImageRegistry, error) {
+			return []registryTypes.ImageRegistry{&fakeRegistry{fail: false}}, nil
+		},
+		getGlobalRegistries: func(*storage.ImageName) ([]registryTypes.ImageRegistry, error) {
+			return []registryTypes.ImageRegistry{&fakeRegistry{fail: false}}, nil
+		},
+		scannerClientSingleton: singleton,
+		scanSemaphore:          semaphore.NewWeighted(10),
+		getCentralRegistries:   fakeRegStore.GetMatchingCentralRegistryIntegrations,
+		mirrorStore:            mirrorStore,
+		maxSemaphoreWaitTime:   defaultMaxSemaphoreWaitTime,
+	}
+
+	containerImg, err := utils.GenerateImageFromString("docker.io/nginx")
+	suite.Require().NoError(err, "failed creating test image")
+
+	imageServiceClient := suite.createMockImageServiceClient(types.ToImage(containerImg), false)
+	mirrorStore.EXPECT().PullSources(containerImg.GetName().GetFullName())
+
+	// Must not panic even though the singleton starts returning nil after the check.
+	_, err = scan.EnrichLocalImageInNamespace(context.Background(), imageServiceClient, genScanReq(containerImg, "fake-namespace", "", false))
+	suite.Require().NoError(err, "unexpected error when enriching image")
+
+	suite.Assert().Equal(1, singletonCalls, "scanner client singleton should be consulted exactly once")
+	suite.Assert().Same(capturedClient, scannedWithClient, "scan should use the client captured at the nil-check")
+}
+
 func (suite *scanTestSuite) TestEnrichImageFailures() {
 	type testCase struct {
 		scanImg func(ctx context.Context, image *storage.Image,
diff --git a/sensor/common/scannerclient/grpc_client.go b/sensor/common/scannerclient/grpc_client.go
index 1dd8853914d86..6f689846963b2 100644
--- a/sensor/common/scannerclient/grpc_client.go
+++ b/sensor/common/scannerclient/grpc_client.go
@@ -3,24 +3,18 @@ package scannerclient
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/pkg/errors"
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	"github.com/stackrox/rox/generated/storage"
-	"github.com/stackrox/rox/pkg/clientconn"
 	"github.com/stackrox/rox/pkg/env"
-	"github.com/stackrox/rox/pkg/images/utils"
 	"github.com/stackrox/rox/pkg/logging"
-	"github.com/stackrox/rox/pkg/mtls"
 	"github.com/stackrox/rox/pkg/registries/types"
 	pkgscanner "github.com/stackrox/rox/pkg/scannerv4"
 	"github.com/stackrox/rox/pkg/scannerv4/client"
 	"github.com/stackrox/rox/sensor/common/centralcabundle"
 	scannerV1 "github.com/stackrox/scanner/generated/scanner/api/v1"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials"
 )
 
 var (
@@ -45,13 +39,6 @@ type ImageAnalysis struct {
 	V4Contents   *v4.Contents
 }
 
-// v2Client is the client for StackRox Scanner based on Clair V2, also
-// known as Scanner V2.
-type v2Client struct {
-	scannerV1.ImageScanServiceClient
-	conn *grpc.ClientConn
-}
-
 // v4Client is the client for StackRox Scanner Indexer, also
 // known as Scanner V4 Indexer.
 type v4Client struct {
@@ -103,57 +90,6 @@ func (i *ImageAnalysis) GetIndexerVersion() string {
 	return ""
 }
 
-// getScannerEndpoint reads and validate the Scanner gRPC endpoint setting. If
-// the endpoint is empty or not configured properly (invalid) the value is
-// returned and error will be set.
-func getScannerEndpoint(s env.Setting) (string, error) {
-	e := s.Setting()
-	if e == "" {
-		return e, errors.Errorf("%s is not set or empty", s.EnvVar())
-	}
-	e = strings.TrimPrefix(e, "https://")
-	if strings.Contains(e, "://") {
-		return e, errors.Errorf("%s has unsupported scheme: %s", s.EnvVar(), e)
-	}
-	return e, nil
-}
-
-// dial the scanner and returns a new ScannerClient.  The function is non-blocking and
-// returns a non-nil error upon configuration error.
-func dial(endpoint string, certID mtls.Subject) (*grpc.ClientConn, error) {
-	tlsConfig, err := clientconn.TLSConfig(certID, clientconn.TLSConfigOptions{
-		UseClientCert: clientconn.MustUseClientCert,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("TLS config failed: %w", err)
-	}
-	// This is non-blocking. If we ever want this to block, then add the
-	// grpc.WithBlock() DialOption.
-	log.Infof("dialing scanner at %s", endpoint)
-	conn, err := grpc.Dial(endpoint, grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))
-	if err != nil {
-		return nil, fmt.Errorf("grpc dial failed: %w", err)
-	}
-	return conn, nil
-}
-
-// dialV2 connect to scanner V1 gRPC and return a new ScannerClient.
-func dialV2() (ScannerClient, error) {
-	endpoint, err := getScannerEndpoint(env.ScannerSlimGRPCEndpoint)
-	if err != nil {
-		return nil, err
-	}
-	log.Infof("dialing scanner-v2 client: %s", endpoint)
-	conn, err := dial(endpoint, mtls.ScannerSubject)
-	if err != nil {
-		return nil, err
-	}
-	return &v2Client{
-		ImageScanServiceClient: scannerV1.NewImageScanServiceClient(conn),
-		conn:                   conn,
-	}, nil
-}
-
 // dialV4 connect to scanner V4 gRPC and return a new ScannerClient.
 func dialV4() (ScannerClient, error) {
 	ctx := context.Background()
@@ -172,45 +108,6 @@ func dialV4() (ScannerClient, error) {
 	return &v4Client{client: c}, nil
 }
 
-// GetImageAnalysis retrieves the image analysis results for the given image.
-func (c *v2Client) GetImageAnalysis(ctx context.Context, image *storage.Image, cfg *types.Config) (*ImageAnalysis, error) {
-	imgName := image.GetName().GetFullName()
-
-	// The WaitForReady option will cause invocations to block (until server ready or
-	// ctx done/expires) This was added so that on fresh installation of sensor when
-	// scanner is not ready yet, local scans will not all fail and have to wait for
-	// next reprocess to succeed
-	resp, err := c.GetImageComponents(ctx, &scannerV1.GetImageComponentsRequest{
-		Image: utils.GetFullyQualifiedFullName(image),
-		Registry: &scannerV1.RegistryData{
-			Url:      cfg.URL,
-			Username: cfg.Username,
-			Password: cfg.Password,
-			Insecure: cfg.Insecure,
-		},
-	}, grpc.WaitForReady(true))
-	if err != nil {
-		log.Debugf("Unable to get image components from local Scanner for image %s: %v", imgName, err)
-		return nil, errors.Wrap(err, "getting image components from scanner")
-	}
-
-	log.Debugf("Received image components from local Scanner for image: %q", imgName)
-
-	return &ImageAnalysis{
-		ScanStatus:   resp.GetStatus(),
-		ScanNotes:    resp.GetNotes(),
-		V1Components: resp.GetComponents(),
-	}, nil
-}
-
-// Close closes and cleanup the client connection.
-func (c *v2Client) Close() error {
-	if err := c.conn.Close(); err != nil {
-		return errors.Wrap(err, "closing v2 scanner gRPC connection")
-	}
-	return nil
-}
-
 func convertIndexReportToAnalysis(ir *v4.IndexReport, indexerVersion string) *ImageAnalysis {
 	var st scannerV1.ScanStatus
 	switch ir.GetState() {
diff --git a/sensor/common/scannerclient/singleton.go b/sensor/common/scannerclient/singleton.go
index a1851e02c7187..1b38b06b2cd20 100644
--- a/sensor/common/scannerclient/singleton.go
+++ b/sensor/common/scannerclient/singleton.go
@@ -12,12 +12,14 @@ import (
 var (
 	scannerClient      ScannerClient
 	scannerClientMutex sync.Mutex
+	loggedNoCentralV4  bool
 
 	isScannerV4Enabled = features.ScannerV4.Enabled()
 )
 
 // GRPCClientSingleton returns a gRPC ScannerClient to a local Scanner.
-// Only one ScannerClient per Sensor is required.
+// Only one ScannerClient per Sensor is required. A nil client may
+// be returned.
 func GRPCClientSingleton() ScannerClient {
 	scannerClientMutex.Lock()
 	defer scannerClientMutex.Unlock()
@@ -31,14 +33,27 @@ func GRPCClientSingleton() ScannerClient {
 			env.LocalImageScanningEnabled.EnvVar())
 		return nil
 	}
-	var err error
-	if isScannerV4Enabled && centralcaps.Has(centralsensor.ScannerV4Supported) {
-		log.Info("Creating Scanner V4 client")
-		scannerClient, err = dialV4()
-	} else {
-		log.Info("Creating Scanner V2 client")
-		scannerClient, err = dialV2()
+
+	// Scanner V4 is the only local scanner Sensor connects to. Using it requires
+	// both Scanner V4 to be installed locally and Central to advertise support
+	// for Scanner V4.
+	// When either is missing there is no local scanner to talk to, so we return a nil
+	// client.
+	if !isScannerV4Enabled {
+		log.Warn("Local image scanning is enabled but Scanner V4 is disabled in Sensor; no local scanner will be used")
+		return nil
 	}
+	if !centralcaps.Has(centralsensor.ScannerV4Supported) {
+		if !loggedNoCentralV4 {
+			log.Info("Local image scanning is enabled but Central does not support Scanner V4; no local scanner will be used")
+			loggedNoCentralV4 = true
+		}
+		return nil
+	}
+
+	log.Info("Creating Scanner V4 client")
+	var err error
+	scannerClient, err = dialV4()
 	utils.Should(err)
 
 	return scannerClient
@@ -50,6 +65,7 @@ func resetGRPCClient() {
 	scannerClientMutex.Lock()
 	defer scannerClientMutex.Unlock()
 
+	loggedNoCentralV4 = false
 	if scannerClient == nil {
 		return
 	}
diff --git a/sensor/common/scannerclient/singleton_test.go b/sensor/common/scannerclient/singleton_test.go
new file mode 100644
index 0000000000000..cec1350033c66
--- /dev/null
+++ b/sensor/common/scannerclient/singleton_test.go
@@ -0,0 +1,90 @@
+package scannerclient
+
+import (
+	"strconv"
+	"testing"
+
+	"github.com/stackrox/rox/pkg/centralsensor"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/logging"
+	"github.com/stackrox/rox/sensor/common/centralcaps"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type infoCountingLogger struct {
+	logging.Logger
+	infoCalls int
+}
+
+func (l *infoCountingLogger) Info(_ ...interface{}) {
+	l.infoCalls++
+}
+
+func TestGRPCClientSingleton(t *testing.T) {
+	tests := map[string]struct {
+		localImageScanningEnabled bool
+		scannerV4Enabled          bool
+		centralCaps               []centralsensor.CentralCapability
+	}{
+		"local image scanning disabled": {
+			localImageScanningEnabled: false,
+			scannerV4Enabled:          true,
+			centralCaps:               []centralsensor.CentralCapability{centralsensor.ScannerV4Supported},
+		},
+		"scanner v4 disabled in sensor": {
+			localImageScanningEnabled: true,
+			scannerV4Enabled:          false,
+			centralCaps:               []centralsensor.CentralCapability{centralsensor.ScannerV4Supported},
+		},
+		"central does not support scanner v4": {
+			localImageScanningEnabled: true,
+			scannerV4Enabled:          true,
+			centralCaps:               nil,
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(env.LocalImageScanningEnabled.EnvVar(), strconv.FormatBool(tt.localImageScanningEnabled))
+
+			origScannerV4Enabled := isScannerV4Enabled
+			isScannerV4Enabled = tt.scannerV4Enabled
+			t.Cleanup(func() { isScannerV4Enabled = origScannerV4Enabled })
+
+			centralcaps.Set(tt.centralCaps)
+			t.Cleanup(func() { centralcaps.Set(nil) })
+
+			scannerClient = nil
+			t.Cleanup(func() { scannerClient = nil })
+
+			assert.Nil(t, GRPCClientSingleton())
+		})
+	}
+}
+
+func TestGRPCClientSingletonLogsMissingCentralCapabilityOncePerReset(t *testing.T) {
+	t.Setenv(env.LocalImageScanningEnabled.EnvVar(), "true")
+	centralcaps.Set(nil)
+	t.Cleanup(func() { centralcaps.Set(nil) })
+
+	origScannerV4Enabled := isScannerV4Enabled
+	isScannerV4Enabled = true
+	t.Cleanup(func() { isScannerV4Enabled = origScannerV4Enabled })
+
+	resetGRPCClient()
+	t.Cleanup(resetGRPCClient)
+
+	origLog := log
+	countingLog := &infoCountingLogger{Logger: origLog}
+	log = countingLog
+	t.Cleanup(func() { log = origLog })
+
+	assert.Nil(t, GRPCClientSingleton())
+	assert.Nil(t, GRPCClientSingleton())
+	require.Equal(t, 1, countingLog.infoCalls)
+
+	resetGRPCClient() // The client is still nil, but the log should be enabled again.
+	assert.Nil(t, GRPCClientSingleton())
+	assert.Equal(t, 2, countingLog.infoCalls)
+}
diff --git a/sensor/common/scannerdefinitions/metrics.go b/sensor/common/scannerdefinitions/metrics.go
new file mode 100644
index 0000000000000..1c08f98dd8e38
--- /dev/null
+++ b/sensor/common/scannerdefinitions/metrics.go
@@ -0,0 +1,56 @@
+package scannerdefinitions
+
+import (
+	"sync/atomic"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stackrox/rox/pkg/metrics"
+)
+
+const (
+	repoCPEMappingFetchSuccess   = "success"
+	repoCPEMappingFetchUnchanged = "unchanged"
+	repoCPEMappingFetchError     = "error"
+)
+
+// repoCPEMappingHashChanges counts Sensor replacing its cached mapping when
+// Central's file hashes differently, including the first populate. It is not
+// a per-VM VSOCK sync (see vsock_pull_sync_total).
+var repoCPEMappingHashChanges = prometheus.NewCounter(prometheus.CounterOpts{
+	Namespace: metrics.PrometheusNamespace,
+	Subsystem: metrics.SensorSubsystem.String(),
+	Name:      "repo_cpe_mapping_hash_changes_total",
+	Help:      "Times Sensor replaced its cached repo-to-CPE mapping because the content hash from Central (and its upstream source) has changed. This answers the question 'How often does the repo-to-CPE mapping get updated in general?'",
+})
+
+// repoCPEMappingFetch counts each Central fetch attempt once: success is a
+// hash change, unchanged is HTTP 304 or same-hash 200, error is anything that
+// keeps last-good. It is not a per-VM VSOCK sync.
+var repoCPEMappingFetch = prometheus.NewCounterVec(prometheus.CounterOpts{
+	Namespace: metrics.PrometheusNamespace,
+	Subsystem: metrics.SensorSubsystem.String(),
+	Name:      "repo_cpe_mapping_fetch_total",
+	Help:      "Central repo-to-CPE mapping fetches by result (success: content hash changed; unchanged: HTTP 304 or same-hash 200; error: request, validation, or unexpected status). Not a per-VM VSOCK sync.",
+}, []string{"result"})
+
+// repo2CPELastSuccessUnix is the Unix seconds of cache.lastSuccess, or 0
+// until the first successful fetch. The GaugeFunc reads this so scrapes stay
+// correct without a Sensor tick.
+var repo2CPELastSuccessUnix atomic.Int64
+
+func repo2CPELastSuccessSeconds() float64 {
+	return float64(repo2CPELastSuccessUnix.Load())
+}
+
+// repoCPEMappingLastSuccess is Unix seconds of Sensor's last successful
+// mapping fetch (304 and same-hash 200 count). Zero until the first success.
+var repoCPEMappingLastSuccess = prometheus.NewGaugeFunc(prometheus.GaugeOpts{
+	Namespace: metrics.PrometheusNamespace,
+	Subsystem: metrics.SensorSubsystem.String(),
+	Name:      "repo_cpe_mapping_last_success_timestamp_seconds",
+	Help:      "Unix timestamp of Sensor's last successful repo-to-CPE mapping fetch from Central, including HTTP 304 and same-hash 200. Zero until the first success.",
+}, repo2CPELastSuccessSeconds)
+
+func init() {
+	metrics.EmplaceCollector(repoCPEMappingHashChanges, repoCPEMappingFetch, repoCPEMappingLastSuccess)
+}
diff --git a/sensor/common/scannerdefinitions/repo2cpe.go b/sensor/common/scannerdefinitions/repo2cpe.go
new file mode 100644
index 0000000000000..c088279a9e460
--- /dev/null
+++ b/sensor/common/scannerdefinitions/repo2cpe.go
@@ -0,0 +1,309 @@
+package scannerdefinitions
+
+import (
+	"context"
+	"crypto/x509"
+	"io"
+	"net/http"
+	"net/url"
+	"slices"
+	"sync/atomic"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/pkg/centralsensor"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/sync"
+	"github.com/stackrox/rox/pkg/utils"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
+	"github.com/stackrox/rox/sensor/common"
+	"github.com/stackrox/rox/sensor/common/centralclient"
+	"github.com/stackrox/rox/sensor/common/message"
+	"github.com/stackrox/rox/sensor/common/unimplemented"
+)
+
+const (
+	// repo2CPEFileParam matches sensorMappingsFile in compliance/node/index/indexer.go.
+	repo2CPEFileParam = "repo2cpe"
+
+	// repo2CPERefreshInterval is the steady-state cadence other repo2cpe consumers use.
+	repo2CPERefreshInterval = 4 * time.Hour
+	// repo2CPERetryInterval is short so a cold cache reaches its first success quickly.
+	repo2CPERetryInterval = time.Minute
+	repo2CPEFetchTimeout  = 30 * time.Second
+
+	etagHeader            = "ETag"
+	ifNoneMatchHeader     = "If-None-Match"
+	lastModifiedHeader    = "Last-Modified"
+	ifModifiedSinceHeader = "If-Modified-Since"
+)
+
+var (
+	_ common.SensorComponent = (*Repo2CPE)(nil)
+
+	errStartMoreThanOnce = errors.New("repo-to-CPE refresher already started")
+)
+
+// Repo2CPE caches Central's repo-to-CPE mapping and refreshes it in the
+// background. Sensor starts and stops it like any other component.
+type Repo2CPE struct {
+	unimplemented.Receiver
+
+	centralClient    *http.Client
+	centralReachable atomic.Bool
+	started          atomic.Bool
+	cancel           context.CancelFunc
+
+	timerMu sync.Mutex
+	timer   *time.Timer
+
+	cacheMu sync.Mutex
+	cache   repo2CPECache
+}
+
+// repo2CPECache is Sensor's in-process copy of Central's repo-to-CPE mapping,
+// independent of Handler's per-request proxying, plus enough state to issue
+// a conditional GET and to tell "never fetched" apart from "stale".
+type repo2CPECache struct {
+	mapping      []byte
+	hash         string
+	etag         string
+	lastModified string
+	lastSuccess  time.Time
+}
+
+// NewRepo2CPE creates a refresher that fetches Central's repo-to-CPE mapping.
+func NewRepo2CPE(centralEndpoint string, centralCertificates []*x509.Certificate) (*Repo2CPE, error) {
+	client, err := centralclient.AuthenticatedCentralHTTPClient(centralEndpoint, centralCertificates)
+	if err != nil {
+		return nil, errors.Wrap(err, "instantiating central HTTP transport")
+	}
+	return newRepo2CPE(client), nil
+}
+
+func newRepo2CPE(client *http.Client) *Repo2CPE {
+	return &Repo2CPE{centralClient: client}
+}
+
+func (r *Repo2CPE) Name() string { return "scannerdefinitions.Repo2CPE" }
+
+func (r *Repo2CPE) Capabilities() []centralsensor.SensorCapability { return nil }
+
+func (r *Repo2CPE) ResponsesC() <-chan *message.ExpiringMessage { return nil }
+
+func (r *Repo2CPE) Start() error {
+	if r.started.Swap(true) {
+		return errStartMoreThanOnce
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	timer := time.NewTimer(0)
+	concurrency.WithLock(&r.timerMu, func() {
+		r.cancel = cancel
+		r.timer = timer
+	})
+	go r.run(ctx, timer.C)
+	return nil
+}
+
+func (r *Repo2CPE) Stop() {
+	concurrency.WithLock(&r.timerMu, func() {
+		if r.cancel != nil {
+			r.cancel()
+		}
+		if r.timer != nil {
+			r.timer.Stop()
+		}
+	})
+}
+
+// Notify kicks an immediate fetch when Central becomes reachable, so a cold
+// cache does not wait out the current timer.
+func (r *Repo2CPE) Notify(e common.SensorComponentEvent) {
+	log.Info(common.LogSensorComponentEvent(e, r.Name()))
+	switch e {
+	case common.SensorComponentEventCentralReachable:
+		r.centralReachable.Store(true)
+		r.resetTimer(0)
+	case common.SensorComponentEventOfflineMode:
+		r.centralReachable.Store(false)
+	}
+}
+
+func (r *Repo2CPE) resetTimer(d time.Duration) {
+	concurrency.WithLock(&r.timerMu, func() {
+		if r.timer != nil {
+			r.timer.Reset(d)
+		}
+	})
+}
+
+// run fetches on each receive from ticks, then rearms the component timer.
+func (r *Repo2CPE) run(ctx context.Context, ticks <-chan time.Time) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticks:
+			if ctx.Err() != nil {
+				return
+			}
+			if !r.centralReachable.Load() {
+				r.resetTimer(repo2CPERetryInterval)
+				continue
+			}
+			fetchCtx, cancel := context.WithTimeout(ctx, repo2CPEFetchTimeout)
+			ok := r.attemptRepo2CPERefresh(fetchCtx)
+			cancel()
+			if ctx.Err() != nil {
+				return
+			}
+			delay := repo2CPERetryInterval
+			if ok {
+				delay = repo2CPERefreshInterval
+			}
+			r.resetTimer(delay)
+		}
+	}
+}
+
+// FetchRepo2CPE returns a copy of the cached mapping. ok is false only
+// when Central has never been fetched successfully; unreachable Central
+// still yields the last-good copy.
+func (r *Repo2CPE) FetchRepo2CPE(_ context.Context) (mapping []byte, hash string, ok bool) {
+	return concurrency.WithLock3(&r.cacheMu, func() ([]byte, string, bool) {
+		if r.cache.lastSuccess.IsZero() {
+			return nil, "", false
+		}
+		return slices.Clone(r.cache.mapping), r.cache.hash, true
+	})
+}
+
+// attemptRepo2CPERefresh issues one conditional GET for the repo-to-CPE
+// mapping and updates the cache on success or "unchanged". It reports
+// whether the attempt succeeded, so the caller can pick the next delay.
+func (r *Repo2CPE) attemptRepo2CPERefresh(ctx context.Context) bool {
+	result := repoCPEMappingFetchError
+	defer func() {
+		repoCPEMappingFetch.WithLabelValues(result).Inc()
+	}()
+
+	etag, lastModified := concurrency.WithLock2(&r.cacheMu, func() (string, string) {
+		return r.cache.etag, r.cache.lastModified
+	})
+
+	req, err := r.newRepo2CPERequest(ctx, etag, lastModified)
+	if err != nil {
+		log.Warnf("Failed to build repo-to-CPE mapping request: %v", err)
+		return false
+	}
+
+	resp, err := r.centralClient.Do(req)
+	if err != nil {
+		log.Warnf("Failed to fetch repo-to-CPE mapping from central: %v", err)
+		return false
+	}
+	defer utils.IgnoreError(resp.Body.Close)
+
+	switch resp.StatusCode {
+	case http.StatusNotModified:
+		r.recordRepo2CPEUnchanged(resp)
+		result = repoCPEMappingFetchUnchanged
+		return true
+	case http.StatusOK:
+		body, err := io.ReadAll(io.LimitReader(resp.Body, cpemapping.MaxMappingBytes+1))
+		if err != nil {
+			log.Warnf("Failed to read repo-to-CPE mapping response: %v", err)
+			return false
+		}
+		if err := cpemapping.ValidateMapping(body); err != nil {
+			log.Warnf("Repo-to-CPE mapping failed validation, keeping last-good: %v", err)
+			return false
+		}
+		if r.recordRepo2CPESuccess(body, resp) {
+			result = repoCPEMappingFetchSuccess
+		} else {
+			result = repoCPEMappingFetchUnchanged
+		}
+		return true
+	default:
+		log.Warnf("Unexpected status %d fetching repo-to-CPE mapping from central", resp.StatusCode)
+		return false
+	}
+}
+
+func (r *Repo2CPE) newRepo2CPERequest(ctx context.Context, etag, lastModified string) (*http.Request, error) {
+	centralURL := url.URL{
+		Path:     scannerDefsPath,
+		RawQuery: "file=" + repo2CPEFileParam,
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, centralURL.String(), nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "creating request")
+	}
+	if etag != "" {
+		req.Header.Set(ifNoneMatchHeader, etag)
+	}
+	if lastModified != "" {
+		req.Header.Set(ifModifiedSinceHeader, lastModified)
+	}
+	return req, nil
+}
+
+func (r *Repo2CPE) recordRepo2CPEUnchanged(resp *http.Response) {
+	concurrency.WithLock(&r.cacheMu, func() {
+		r.markRepo2CPESuccessNoLock()
+		r.mergeRepo2CPEValidatorsNoLock(resp)
+	})
+	log.Debug("Repo-to-CPE mapping unchanged (304)")
+}
+
+// recordRepo2CPESuccess keeps the existing cached bytes when the new content
+// hashes the same as what's cached, treating a same-hash 200 like a 304.
+func (r *Repo2CPE) recordRepo2CPESuccess(body []byte, resp *http.Response) bool {
+	hash := cpemapping.HashMapping(body)
+	var oldHash string
+	var changed bool
+	concurrency.WithLock(&r.cacheMu, func() {
+		r.markRepo2CPESuccessNoLock()
+		oldHash = r.cache.hash
+		if hash != r.cache.hash {
+			r.cache.mapping = body
+			r.cache.hash = hash
+			changed = true
+		}
+		r.replaceRepo2CPEValidatorsNoLock(resp)
+	})
+	if changed {
+		repoCPEMappingHashChanges.Inc()
+		log.Infof("Repo-to-CPE mapping content hash changed: old=%q new=%q", oldHash, hash)
+	}
+	log.Debugf("Fetched repo-to-CPE mapping from central, hash=%s", hash)
+	return changed
+}
+
+// markRepo2CPESuccessNoLock publishes lastSuccess to the last-success gauge
+// in the same critical section so scrapes cannot observe a stale timestamp.
+func (r *Repo2CPE) markRepo2CPESuccessNoLock() {
+	now := time.Now()
+	r.cache.lastSuccess = now
+	repo2CPELastSuccessUnix.Store(now.Unix())
+}
+
+// replaceRepo2CPEValidatorsNoLock copies validators from a 200, including
+// empty values, so the next conditional GET cannot reuse a prior mapping's
+// ETag or Last-Modified.
+func (r *Repo2CPE) replaceRepo2CPEValidatorsNoLock(resp *http.Response) {
+	r.cache.etag = resp.Header.Get(etagHeader)
+	r.cache.lastModified = resp.Header.Get(lastModifiedHeader)
+}
+
+// mergeRepo2CPEValidatorsNoLock applies non-empty validators from a 304,
+// which may omit them.
+func (r *Repo2CPE) mergeRepo2CPEValidatorsNoLock(resp *http.Response) {
+	if etag := resp.Header.Get(etagHeader); etag != "" {
+		r.cache.etag = etag
+	}
+	if lm := resp.Header.Get(lastModifiedHeader); lm != "" {
+		r.cache.lastModified = lm
+	}
+}
diff --git a/sensor/common/scannerdefinitions/repo2cpe_test.go b/sensor/common/scannerdefinitions/repo2cpe_test.go
new file mode 100644
index 0000000000000..75eeb89c53f29
--- /dev/null
+++ b/sensor/common/scannerdefinitions/repo2cpe_test.go
@@ -0,0 +1,414 @@
+package scannerdefinitions
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"slices"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stackrox/rox/pkg/httputil"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
+	"github.com/stackrox/rox/sensor/common"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const testRepo2CPEMapping = `{"data":{"foo":{"cpes":["cpe:/o:foo"]}}}`
+
+// newTestCentralClient spins up a real httptest.Server and returns a client
+// whose transport rewrites relative URLs to point at it, mirroring how the
+// production Central transport fills in scheme/host for requests built with
+// only a path (see newRepo2CPERequest).
+func newTestCentralClient(t *testing.T, handler http.HandlerFunc) *http.Client {
+	t.Helper()
+	server := httptest.NewServer(handler)
+	t.Cleanup(server.Close)
+
+	base, err := url.Parse(server.URL)
+	require.NoError(t, err)
+
+	client := server.Client()
+	client.Transport = httputil.RoundTripperFunc(func(req *http.Request) (*http.Response, error) {
+		req = req.Clone(req.Context())
+		req.URL.Scheme = base.Scheme
+		req.URL.Host = base.Host
+		return http.DefaultTransport.RoundTrip(req)
+	})
+	return client
+}
+
+func countingMappingClient(fetches *atomic.Int32, mapping string) *http.Client {
+	return &http.Client{
+		Transport: httputil.RoundTripperFunc(func(_ *http.Request) (*http.Response, error) {
+			fetches.Add(1)
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Header:     make(http.Header),
+				Body:       io.NopCloser(bytes.NewBufferString(mapping)),
+			}, nil
+		}),
+	}
+}
+
+func TestAttemptRepo2CPERefresh(t *testing.T) {
+	const mappingV1 = `{"data":{"foo":{"cpes":["cpe:/o:foo"]}}}`
+	const mappingV2 = `{"data":{"bar":{"cpes":["cpe:/o:bar"]}}}`
+	hashV1 := cpemapping.HashMapping([]byte(mappingV1))
+	hashV2 := cpemapping.HashMapping([]byte(mappingV2))
+	seededSuccess := time.Date(2024, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	tests := map[string]struct {
+		seedCache        repo2CPECache
+		serverHandler    http.HandlerFunc
+		networkErr       bool
+		wantOK           bool
+		wantMapping      string
+		wantHash         string
+		wantEtag         string
+		wantLastModified string
+		wantHashChange   bool
+		wantFetchResult  string
+	}{
+		"first fetch succeeds and populates an empty cache": {
+			serverHandler: func(w http.ResponseWriter, r *http.Request) {
+				assert.Equal(t, repo2CPEFileParam, r.URL.Query().Get("file"))
+				w.Header().Set(etagHeader, `"v1"`)
+				_, _ = w.Write([]byte(mappingV1))
+			},
+			wantOK:          true,
+			wantMapping:     mappingV1,
+			wantHash:        hashV1,
+			wantEtag:        `"v1"`,
+			wantHashChange:  true,
+			wantFetchResult: repoCPEMappingFetchSuccess,
+		},
+		"304 with matching validators keeps the cached mapping": {
+			seedCache: repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, etag: `"v1"`, lastModified: "old", lastSuccess: seededSuccess},
+			serverHandler: func(w http.ResponseWriter, r *http.Request) {
+				assert.Equal(t, `"v1"`, r.Header.Get(ifNoneMatchHeader))
+				w.WriteHeader(http.StatusNotModified)
+			},
+			wantOK:           true,
+			wantMapping:      mappingV1,
+			wantHash:         hashV1,
+			wantEtag:         `"v1"`,
+			wantLastModified: "old",
+			wantFetchResult:  repoCPEMappingFetchUnchanged,
+		},
+		"200 without validators replaces previously cached validators": {
+			seedCache: repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, etag: `"v1"`, lastModified: "old", lastSuccess: seededSuccess},
+			serverHandler: func(w http.ResponseWriter, r *http.Request) {
+				_, _ = w.Write([]byte(mappingV2))
+			},
+			wantOK:          true,
+			wantMapping:     mappingV2,
+			wantHash:        hashV2,
+			wantHashChange:  true,
+			wantFetchResult: repoCPEMappingFetchSuccess,
+		},
+		"200 with a same-hash body is treated as unchanged": {
+			seedCache: repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, lastSuccess: seededSuccess},
+			serverHandler: func(w http.ResponseWriter, r *http.Request) {
+				_, _ = w.Write([]byte(mappingV1))
+			},
+			wantOK:          true,
+			wantMapping:     mappingV1,
+			wantHash:        hashV1,
+			wantFetchResult: repoCPEMappingFetchUnchanged,
+		},
+		"200 with a different hash replaces the cached mapping": {
+			seedCache: repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, lastSuccess: seededSuccess},
+			serverHandler: func(w http.ResponseWriter, r *http.Request) {
+				_, _ = w.Write([]byte(mappingV2))
+			},
+			wantOK:          true,
+			wantMapping:     mappingV2,
+			wantHash:        hashV2,
+			wantHashChange:  true,
+			wantFetchResult: repoCPEMappingFetchSuccess,
+		},
+		"an unexpected status leaves the cache untouched": {
+			seedCache: repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, lastSuccess: seededSuccess},
+			serverHandler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+			},
+			wantOK:          false,
+			wantMapping:     mappingV1,
+			wantHash:        hashV1,
+			wantFetchResult: repoCPEMappingFetchError,
+		},
+		"a network error leaves the cache untouched": {
+			seedCache:       repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, lastSuccess: seededSuccess},
+			networkErr:      true,
+			wantOK:          false,
+			wantMapping:     mappingV1,
+			wantHash:        hashV1,
+			wantFetchResult: repoCPEMappingFetchError,
+		},
+		"an oversized response leaves the cache untouched": {
+			seedCache: repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, lastSuccess: seededSuccess},
+			serverHandler: func(w http.ResponseWriter, _ *http.Request) {
+				_, _ = w.Write(bytes.Repeat([]byte("a"), cpemapping.MaxMappingBytes+1))
+			},
+			wantOK:          false,
+			wantMapping:     mappingV1,
+			wantHash:        hashV1,
+			wantFetchResult: repoCPEMappingFetchError,
+		},
+		"an invalid mapping body leaves the cache untouched": {
+			seedCache: repo2CPECache{mapping: []byte(mappingV1), hash: hashV1, lastSuccess: seededSuccess},
+			serverHandler: func(w http.ResponseWriter, _ *http.Request) {
+				_, _ = w.Write([]byte(`{"not":"a mapping"}`))
+			},
+			wantOK:          false,
+			wantMapping:     mappingV1,
+			wantHash:        hashV1,
+			wantFetchResult: repoCPEMappingFetchError,
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			r := &Repo2CPE{cache: tt.seedCache}
+			if tt.networkErr {
+				r.centralClient = &http.Client{
+					Transport: httputil.RoundTripperFunc(func(_ *http.Request) (*http.Response, error) {
+						return nil, errors.New("connection refused")
+					}),
+				}
+			} else {
+				r.centralClient = newTestCentralClient(t, tt.serverHandler)
+			}
+
+			beforeHashChanges := testutil.ToFloat64(repoCPEMappingHashChanges)
+			beforeFetch := map[string]float64{
+				repoCPEMappingFetchSuccess:   testutil.ToFloat64(repoCPEMappingFetch.WithLabelValues(repoCPEMappingFetchSuccess)),
+				repoCPEMappingFetchUnchanged: testutil.ToFloat64(repoCPEMappingFetch.WithLabelValues(repoCPEMappingFetchUnchanged)),
+				repoCPEMappingFetchError:     testutil.ToFloat64(repoCPEMappingFetch.WithLabelValues(repoCPEMappingFetchError)),
+			}
+			beforeLastSuccess := testutil.ToFloat64(repoCPEMappingLastSuccess)
+			ok := r.attemptRepo2CPERefresh(t.Context())
+
+			assert.Equal(t, tt.wantOK, ok)
+			wantCount := beforeHashChanges
+			if tt.wantHashChange {
+				wantCount++
+			}
+			assert.Equal(t, wantCount, testutil.ToFloat64(repoCPEMappingHashChanges))
+			for result, before := range beforeFetch {
+				want := before
+				if result == tt.wantFetchResult {
+					want++
+				}
+				assert.Equal(t, want, testutil.ToFloat64(repoCPEMappingFetch.WithLabelValues(result)), result)
+			}
+			assert.Equal(t, tt.wantMapping, string(r.cache.mapping))
+			assert.Equal(t, tt.wantHash, r.cache.hash)
+			assert.Equal(t, tt.wantEtag, r.cache.etag)
+			assert.Equal(t, tt.wantLastModified, r.cache.lastModified)
+			if tt.wantOK {
+				assert.False(t, r.cache.lastSuccess.IsZero())
+				assert.Equal(t, float64(r.cache.lastSuccess.Unix()), testutil.ToFloat64(repoCPEMappingLastSuccess))
+			} else {
+				assert.Equal(t, tt.seedCache.lastSuccess, r.cache.lastSuccess)
+				assert.Equal(t, beforeLastSuccess, testutil.ToFloat64(repoCPEMappingLastSuccess))
+			}
+		})
+	}
+}
+
+// TestAttemptRepo2CPERefresh_RetryRecoversWithoutLosingCache calls the
+// refresh helper directly (no timers) to verify a failed attempt keeps
+// serving the last good mapping and a later success can recover.
+func TestAttemptRepo2CPERefresh_RetryRecoversWithoutLosingCache(t *testing.T) {
+	const mapping = `{"data":{"foo":{"cpes":["cpe:/o:foo"]}}}`
+	hash := cpemapping.HashMapping([]byte(mapping))
+
+	var fail atomic.Bool
+	r := newRepo2CPE(newTestCentralClient(t, func(w http.ResponseWriter, _ *http.Request) {
+		if fail.Load() {
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		_, _ = w.Write([]byte(mapping))
+	}))
+
+	require.True(t, r.attemptRepo2CPERefresh(t.Context()))
+	assert.Equal(t, hash, r.cache.hash)
+	require.False(t, r.cache.lastSuccess.IsZero())
+	lastGood := r.cache.lastSuccess
+
+	fail.Store(true)
+	require.False(t, r.attemptRepo2CPERefresh(t.Context()))
+	assert.Equal(t, hash, r.cache.hash, "a failed refresh must not drop the last good mapping")
+	assert.Equal(t, lastGood, r.cache.lastSuccess)
+
+	fail.Store(false)
+	require.True(t, r.attemptRepo2CPERefresh(t.Context()))
+	assert.Equal(t, hash, r.cache.hash)
+}
+
+func TestFetchRepo2CPE(t *testing.T) {
+	mapping := []byte(`{"data":{"foo":{"cpes":["cpe:/o:foo"]}}}`)
+	hash := cpemapping.HashMapping(mapping)
+
+	t.Run("never fetched returns ok=false", func(t *testing.T) {
+		r := newRepo2CPE(&http.Client{})
+		r.centralReachable.Store(false)
+
+		gotMapping, gotHash, ok := r.FetchRepo2CPE(t.Context())
+
+		assert.False(t, ok)
+		assert.Nil(t, gotMapping)
+		assert.Empty(t, gotHash)
+	})
+
+	t.Run("offline serves the last cached mapping with ok=true", func(t *testing.T) {
+		r := newRepo2CPE(&http.Client{})
+		r.cache = repo2CPECache{mapping: mapping, hash: hash, lastSuccess: time.Now()}
+		r.centralReachable.Store(false)
+
+		gotMapping, gotHash, ok := r.FetchRepo2CPE(t.Context())
+
+		assert.True(t, ok)
+		assert.Equal(t, mapping, gotMapping)
+		assert.Equal(t, hash, gotHash)
+	})
+
+	t.Run("returned mapping is a copy of the cache", func(t *testing.T) {
+		r := newRepo2CPE(&http.Client{})
+		r.cache = repo2CPECache{mapping: slices.Clone(mapping), hash: hash, lastSuccess: time.Now()}
+		r.centralReachable.Store(false)
+
+		gotMapping, _, ok := r.FetchRepo2CPE(t.Context())
+		require.True(t, ok)
+		gotMapping[0] = 'X'
+		assert.Equal(t, mapping, r.cache.mapping)
+	})
+}
+
+func TestRepo2CPERun(t *testing.T) {
+	tests := map[string]func(t *testing.T){
+		"should fetch when a tick arrives and central is reachable": func(t *testing.T) {
+			var fetches atomic.Int32
+			r := newRepo2CPE(countingMappingClient(&fetches, testRepo2CPEMapping))
+			r.centralReachable.Store(true)
+
+			ctx, cancel := context.WithCancel(t.Context())
+			t.Cleanup(cancel)
+			ticks := make(chan time.Time)
+			go r.run(ctx, ticks)
+			synctest.Wait()
+			assert.Equal(t, int32(0), fetches.Load())
+
+			ticks <- time.Time{}
+			synctest.Wait()
+			assert.Equal(t, int32(1), fetches.Load())
+		},
+		"should skip the fetch when central is unreachable": func(t *testing.T) {
+			var fetches atomic.Int32
+			r := newRepo2CPE(countingMappingClient(&fetches, testRepo2CPEMapping))
+			r.centralReachable.Store(false)
+
+			ctx, cancel := context.WithCancel(t.Context())
+			t.Cleanup(cancel)
+			ticks := make(chan time.Time)
+			go r.run(ctx, ticks)
+			synctest.Wait()
+
+			ticks <- time.Time{}
+			synctest.Wait()
+			assert.Equal(t, int32(0), fetches.Load())
+		},
+	}
+	for name, fn := range tests {
+		t.Run(name, func(t *testing.T) {
+			synctest.Test(t, fn)
+		})
+	}
+}
+
+func TestRepo2CPEStart(t *testing.T) {
+	tests := map[string]func(t *testing.T){
+		"should fetch immediately on Start when central is reachable": func(t *testing.T) {
+			var fetches atomic.Int32
+			r := newRepo2CPE(countingMappingClient(&fetches, testRepo2CPEMapping))
+			t.Cleanup(r.Stop)
+			r.centralReachable.Store(true)
+
+			require.NoError(t, r.Start())
+			synctest.Wait()
+			assert.Equal(t, int32(1), fetches.Load())
+		},
+		"should return an error on a second Start": func(t *testing.T) {
+			var fetches atomic.Int32
+			r := newRepo2CPE(countingMappingClient(&fetches, testRepo2CPEMapping))
+			t.Cleanup(r.Stop)
+			r.centralReachable.Store(true)
+
+			require.NoError(t, r.Start())
+			synctest.Wait()
+			assert.Equal(t, errStartMoreThanOnce, r.Start())
+			synctest.Wait()
+			assert.Equal(t, int32(1), fetches.Load())
+		},
+		"should stop without further fetches": func(t *testing.T) {
+			var fetches atomic.Int32
+			r := newRepo2CPE(countingMappingClient(&fetches, testRepo2CPEMapping))
+			t.Cleanup(r.Stop)
+			r.centralReachable.Store(true)
+
+			require.NoError(t, r.Start())
+			synctest.Wait()
+			assert.Equal(t, int32(1), fetches.Load())
+
+			r.Stop()
+			synctest.Wait()
+			time.Sleep(repo2CPERefreshInterval)
+			synctest.Wait()
+			assert.Equal(t, int32(1), fetches.Load())
+		},
+		"should refetch after the success interval": func(t *testing.T) {
+			var fetches atomic.Int32
+			r := newRepo2CPE(countingMappingClient(&fetches, testRepo2CPEMapping))
+			t.Cleanup(r.Stop)
+			r.centralReachable.Store(true)
+
+			require.NoError(t, r.Start())
+			synctest.Wait()
+			assert.Equal(t, int32(1), fetches.Load())
+
+			time.Sleep(repo2CPERefreshInterval)
+			synctest.Wait()
+			assert.Equal(t, int32(2), fetches.Load())
+		},
+		"should refetch immediately when Notify kicks a running loop": func(t *testing.T) {
+			var fetches atomic.Int32
+			r := newRepo2CPE(countingMappingClient(&fetches, testRepo2CPEMapping))
+			t.Cleanup(r.Stop)
+			r.centralReachable.Store(true)
+
+			require.NoError(t, r.Start())
+			synctest.Wait()
+			assert.Equal(t, int32(1), fetches.Load())
+
+			r.Notify(common.SensorComponentEventCentralReachable)
+			synctest.Wait()
+			assert.Equal(t, int32(2), fetches.Load())
+		},
+	}
+	for name, fn := range tests {
+		t.Run(name, func(t *testing.T) {
+			synctest.Test(t, fn)
+		})
+	}
+}
diff --git a/sensor/common/sensor/central_communication_impl.go b/sensor/common/sensor/central_communication_impl.go
index 532fa07ce434b..0a60dc70c884d 100644
--- a/sensor/common/sensor/central_communication_impl.go
+++ b/sensor/common/sensor/central_communication_impl.go
@@ -155,6 +155,7 @@ func (s *centralCommunicationImpl) sendEvents(client central.SensorServiceClient
 		capsSet.AddAll(component.Capabilities()...)
 	}
 	capsSet.Add(centralsensor.SendDeduperStateOnReconnect)
+	capsSet.Add(centralsensor.VirtualMachineTelemetryCap)
 	if features.FlattenImageData.Enabled() {
 		capsSet.Add(centralsensor.FlattenImageData)
 	}
diff --git a/sensor/common/sensor/sensor.go b/sensor/common/sensor/sensor.go
index 4be110bce8ce6..edc398271a91b 100644
--- a/sensor/common/sensor/sensor.go
+++ b/sensor/common/sensor/sensor.go
@@ -241,10 +241,10 @@ func (s *Sensor) Start() {
 		route, err := s.newScannerDefinitionsRoute(s.centralEndpoint, centralCertificates)
 		if err != nil {
 			utils.Should(errors.Wrap(err, "Failed to create scanner definition route"))
+		} else {
+			customRoutes = append(customRoutes, *route)
+			s.AddNotifiable(scannerclient.ResetNotifiable())
 		}
-		customRoutes = append(customRoutes, *route)
-
-		s.AddNotifiable(scannerclient.ResetNotifiable())
 	}
 
 	// Enable proxy endpoint for forwarding requests to Central on OpenShift.
diff --git a/sensor/common/virtualmachine/ACK_MODEL.md b/sensor/common/virtualmachine/ACK_MODEL.md
index b6c6a785bfb65..40256ab764153 100644
--- a/sensor/common/virtualmachine/ACK_MODEL.md
+++ b/sensor/common/virtualmachine/ACK_MODEL.md
@@ -2,37 +2,43 @@
 
 VM index reports flow directly from Sensor to Central; Compliance is not involved (see `compliance/ACK_MODEL.md` for the separate node-scanning ACK model, which does go through Compliance).
 
-`VMScraper` pulls reports from each running VM's roxagent over VSOCK and forwards successful reports to Central through `vmIndex.Handler`, the same handler used by every other producer of `v1.IndexReport`s.
+`VMScraper` pulls reports from each running VM's roxagent over VSOCK and forwards successful reports to Central on `ResponsesC`, wrapping the Scanner V4 payload as a `v1.IndexReport`.
 
-A short tick (`ROX_VIRTUAL_MACHINES_SCRAPER_TICK_INTERVAL`, default 10s) walks the per-VM schedule. Each VM is due at its own `nextAttemptAt`. Success and permanent failures reschedule at `ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL`. Retryable pull failures and NACKs share one exponential backoff (`ROX_VIRTUAL_MACHINES_SCRAPER_INITIAL_BACKOFF`, default 10s, doubled each time, capped at `min(poll interval, 30m)`).
+A successful forward already returns the VM to poll cadence. Central's ACK is counted (`IndexReportAcksReceived`) and otherwise ignored. A NACK clears cached `report_token` and applies the shared retry backoff so the next attempt pulls a full report. There is no payload cache and no ACK timeout.
 
-Central's `SensorACK` is delivered to Sensor components whose `Accepts()` matches. Only `VMScraper` accepts `SensorACK_VM_INDEX_REPORT`; `Handler` does not.
+A short tick (`ROX_VIRTUAL_MACHINES_SCRAPER_TICK_INTERVAL`, default 10s) walks the per-VM schedule. Each VM is due at its own `nextAttemptAt`. Success and permanent failures reschedule at `pollInterval + U(0, W)`, where `pollInterval` is `ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL` (default 4h) and `W` is `ROX_VIRTUAL_MACHINES_SCRAPER_STEADY_SPREAD_FRACTION` times that interval (default 2/3).
+
+`C` is `newVMIndexReportWindow`: `min(20m, pollInterval / 3)` (20m at the default 4h poll interval). Newly tracked VMs are first due at `now + U(0, C)`. A tick starts at most `startBudget` of the due set (`ceil(nTracked × tick / C)`, at least 1), then capped by concurrency. `nTracked` is the fleet in `vmState`, not the leftover due pile, so the drain rate stays stable as due VMs are started.
+
+Retryable pull failures and NACKs share one exponential backoff (`ROX_VIRTUAL_MACHINES_SCRAPER_INITIAL_BACKOFF`, default 10s, doubled each time, capped at `min(pollInterval, 30m)`).
+
+Central's `SensorACK` is delivered to Sensor components whose `Accepts()` matches. `VMScraper` advertises `SensorACKSupport` so Central sends these ACKs, and it is the only component that accepts `SensorACK_VM_INDEX_REPORT`.
 
 ```mermaid
 sequenceDiagram
     participant A as roxagent inside VM
     participant Sc as Sensor VMScraper
-    participant H as Sensor Handler
     participant X as Central VM pipeline
 
     Sc->>A: GetReport (VSOCK, when the VM is due)
     A-->>Sc: index report
-    Sc->>H: Send(report)
-    H->>X: SensorEvent(vmID, index report)
+    Sc->>X: SensorEvent(vmID, index report)
     X-->>Sc: SensorACK(vmID:vsockCID, ACK|NACK, reason)
 
-    alt NACK
-        Sc->>Sc: clear cached generation; apply retry backoff
+    alt ACK
+        Note over Sc: recorded; schedule unchanged
+    else NACK
+        Sc->>Sc: clear cached token; apply retry backoff
         Note over Sc,A: next due attempt requests a full report
     end
 ```
 
-`VMScraper` records ACK/NACK volume (`IndexReportAcksReceived`) and, on NACK, resets its cached `report_generation` so the next due attempt re-sends a full report instead of an "unchanged" delta. There is no payload cache.
-
 ## Why the resource ID is `vmID:vsockCID`
 
 Using only the vsock CID is unsafe because a CID can be reused by a different VM later, so a stale ACK could otherwise get attributed to the wrong VM's report. Pairing it with `vmID` removes that ambiguity when parsing logs or correlating an ACK back to a specific VM and connection.
 
-`VMScraper`'s NACK handling only needs the `vmID` half - it extracts that portion (`vmIDFromResourceID`) and looks the VM up by ID in its own store; the CID is not used for VSOCK routing on this path. It stays in the pair purely for debugging/observability, not because pull mode's retry logic requires it.
+`VMScraper`'s NACK handling only needs the `vmID` half: it extracts that portion (`vmIDFromResourceID`) and looks the VM up by ID in its own store. The CID is not used for VSOCK routing on this path; it stays in the pair for debugging.
+
+The pair is not a per-report unique ID: multiple in-flight reports from the same VM with the same CID are still not fully distinguishable, so a stale ACK can match the latest entry instead of the one it was actually for.
 
-One limitation remains: `vmID:vsockCID` is not a per-report unique ID - multiple in-flight reports from the same VM with the same CID are still not fully distinguishable, so a stale ACK can match the latest entry instead of the one it was actually for.
+A NACK that changes `lastToken` or backoff before `commitVMState` runs is not overwritten by that commit. If `lastToken` is already empty and backoff is already at the cap, `nextBackoff` is a no-op, so that NACK is invisible to the commit.
diff --git a/sensor/common/virtualmachine/facts.go b/sensor/common/virtualmachine/facts.go
new file mode 100644
index 0000000000000..d59fbde8e3801
--- /dev/null
+++ b/sensor/common/virtualmachine/facts.go
@@ -0,0 +1,151 @@
+package virtualmachine
+
+import (
+	"strings"
+
+	"github.com/stackrox/rox/generated/internalapi/central"
+	v1 "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
+)
+
+const rhelGuestOS = "Red Hat Enterprise Linux"
+
+// ResponseMeta.facts keys written by roxagent (proto enum String() values).
+const (
+	responseDetectedOSKey        = "detected_os"
+	responseOSVersionKey         = "os_version"
+	responseActivationStatusKey  = "activation_status"
+	responseDNFMetadataStatusKey = "dnf_metadata_status"
+)
+
+// Facts builds the VM facts map sent to Central.
+func Facts(vm *Info) map[string]string {
+	if vm == nil {
+		return nil
+	}
+
+	facts := map[string]string{
+		pkgVM.GuestOSKey: pkgVM.UnknownGuestOS,
+	}
+	if vm.GuestOS != "" {
+		facts[pkgVM.GuestOSKey] = vm.GuestOS
+	}
+	if vm.Description != "" {
+		facts[pkgVM.DescriptionKey] = vm.Description
+	}
+	if vm.NodeName != "" {
+		facts[pkgVM.NodeNameKey] = vm.NodeName
+	}
+	if len(vm.IPAddresses) > 0 {
+		facts[pkgVM.IPAddressesKey] = strings.Join(vm.IPAddresses, ", ")
+	}
+	if len(vm.ActivePods) > 0 {
+		facts[pkgVM.ActivePodsKey] = strings.Join(vm.ActivePods, ", ")
+	}
+	if len(vm.BootOrder) > 0 {
+		facts[pkgVM.BootOrderKey] = strings.Join(vm.BootOrder, ", ")
+	}
+	if len(vm.CDRomDisks) > 0 {
+		facts[pkgVM.CDRomDisksKey] = strings.Join(vm.CDRomDisks, ", ")
+	}
+	// GuestOSKey is informer-owned; roxagent reports DetectedGuestOSKey instead.
+	for k, v := range vm.AgentFacts {
+		if k == pkgVM.GuestOSKey {
+			continue
+		}
+		facts[k] = v
+	}
+	return facts
+}
+
+// AgentFactsFromResponseFacts maps roxagent ResponseMeta.facts to user-facing
+// fact keys. Unrecognized or unspecified enum strings are omitted so Sensor
+// does not surface raw proto names in the UI.
+func AgentFactsFromResponseFacts(facts map[string]string) map[string]string {
+	if len(facts) == 0 {
+		return nil
+	}
+
+	out := map[string]string{}
+	switch facts[responseDetectedOSKey] {
+	case v1.DetectedOS_RHEL.String():
+		guestOS := rhelGuestOS
+		if osVersion := facts[responseOSVersionKey]; osVersion != "" {
+			guestOS += " " + osVersion
+		}
+		out[pkgVM.DetectedGuestOSKey] = guestOS
+	}
+	switch facts[responseActivationStatusKey] {
+	case v1.ActivationStatus_ACTIVE.String():
+		out[pkgVM.ActivationStatusKey] = pkgVM.ActivationStatusActive
+	case v1.ActivationStatus_INACTIVE.String():
+		out[pkgVM.ActivationStatusKey] = pkgVM.ActivationStatusInactive
+	}
+	switch facts[responseDNFMetadataStatusKey] {
+	case v1.DnfMetadataStatus_AVAILABLE.String():
+		out[pkgVM.DNFMetadataStatusKey] = pkgVM.DNFMetadataStatusAvailable
+	case v1.DnfMetadataStatus_UNAVAILABLE.String():
+		out[pkgVM.DNFMetadataStatusKey] = pkgVM.DNFMetadataStatusUnavailable
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// AgentFactsFromResponse merges ResponseMeta.facts with AgentVersion. Version
+// is a sibling proto field, not a fact key, so it is attached here.
+func AgentFactsFromResponse(facts map[string]string, agentVersion string) map[string]string {
+	out := AgentFactsFromResponseFacts(facts)
+	if agentVersion == "" {
+		return out
+	}
+	if out == nil {
+		out = make(map[string]string, 1)
+	}
+	out[pkgVM.AgentVersionKey] = agentVersion
+	return out
+}
+
+// State is RUNNING when the VM instance is up, otherwise STOPPED.
+func State(vm *Info) v1.VirtualMachine_State {
+	if vm == nil {
+		return v1.VirtualMachine_UNKNOWN
+	}
+	if vm.Running {
+		return v1.VirtualMachine_RUNNING
+	}
+	return v1.VirtualMachine_STOPPED
+}
+
+// VSockCID returns the CID and whether it is set.
+func VSockCID(vm *Info) (int32, bool) {
+	if vm == nil || vm.VSOCKCID == nil {
+		return 0, false
+	}
+	return int32(*vm.VSOCKCID), true
+}
+
+// SensorEvent builds the VirtualMachine resource event sent to Central.
+func SensorEvent(action central.ResourceAction, clusterID string, vm *Info) *central.SensorEvent {
+	if vm == nil {
+		return nil
+	}
+	vsockCID, vsockCIDSet := VSockCID(vm)
+	return &central.SensorEvent{
+		Id:     string(vm.ID),
+		Action: action,
+		Resource: &central.SensorEvent_VirtualMachine{
+			VirtualMachine: &v1.VirtualMachine{
+				Id:          string(vm.ID),
+				Namespace:   vm.Namespace,
+				Name:        vm.Name,
+				ClusterId:   clusterID,
+				VsockCid:    vsockCID,
+				VsockCidSet: vsockCIDSet,
+				State:       State(vm),
+				Facts:       Facts(vm),
+			},
+		},
+	}
+}
diff --git a/sensor/common/virtualmachine/facts_test.go b/sensor/common/virtualmachine/facts_test.go
new file mode 100644
index 0000000000000..94d56062b9bd9
--- /dev/null
+++ b/sensor/common/virtualmachine/facts_test.go
@@ -0,0 +1,280 @@
+package virtualmachine
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/internalapi/central"
+	v1 "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFacts(t *testing.T) {
+	cases := map[string]struct {
+		input    *Info
+		expected map[string]string
+	}{
+		"nil Info returns nil": {
+			input:    nil,
+			expected: nil,
+		},
+		"empty Info returns default guestOS": {
+			input: &Info{},
+			expected: map[string]string{
+				pkgVM.GuestOSKey: pkgVM.UnknownGuestOS,
+			},
+		},
+		"populated scalar fields": {
+			input: &Info{
+				GuestOS:     "Red Hat Enterprise Linux 9",
+				Description: "web server",
+				NodeName:    "node-1",
+			},
+			expected: map[string]string{
+				pkgVM.GuestOSKey:     "Red Hat Enterprise Linux 9",
+				pkgVM.DescriptionKey: "web server",
+				pkgVM.NodeNameKey:    "node-1",
+			},
+		},
+		"populated slice fields are joined": {
+			input: &Info{
+				IPAddresses: []string{"10.0.0.1", "10.0.0.2"},
+				ActivePods:  []string{"pod-a=node-1"},
+				BootOrder:   []string{"disk1=1", "disk2=2"},
+				CDRomDisks:  []string{"cdrom0"},
+			},
+			expected: map[string]string{
+				pkgVM.GuestOSKey:     pkgVM.UnknownGuestOS,
+				pkgVM.IPAddressesKey: "10.0.0.1, 10.0.0.2",
+				pkgVM.ActivePodsKey:  "pod-a=node-1",
+				pkgVM.BootOrderKey:   "disk1=1, disk2=2",
+				pkgVM.CDRomDisksKey:  "cdrom0",
+			},
+		},
+		"AgentFacts are merged into result": {
+			input: &Info{
+				GuestOS: "RHEL 9",
+				AgentFacts: map[string]string{
+					pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+					pkgVM.DetectedGuestOSKey:  "Red Hat Enterprise Linux 9.2",
+				},
+			},
+			expected: map[string]string{
+				pkgVM.GuestOSKey:          "RHEL 9",
+				pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+				pkgVM.DetectedGuestOSKey:  "Red Hat Enterprise Linux 9.2",
+			},
+		},
+		"AgentFacts do not overwrite informer guestOS": {
+			input: &Info{
+				GuestOS: "from-informer",
+				AgentFacts: map[string]string{
+					pkgVM.GuestOSKey:          "from-agent",
+					pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+				},
+			},
+			expected: map[string]string{
+				pkgVM.GuestOSKey:          "from-informer",
+				pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, Facts(tc.input))
+		})
+	}
+}
+
+func TestAgentFactsFromResponseFacts(t *testing.T) {
+	cases := map[string]struct {
+		input    map[string]string
+		expected map[string]string
+	}{
+		"RHEL with version and statuses": {
+			input: map[string]string{
+				"detected_os":         v1.DetectedOS_RHEL.String(),
+				"os_version":          "9.2",
+				"activation_status":   v1.ActivationStatus_INACTIVE.String(),
+				"dnf_metadata_status": v1.DnfMetadataStatus_UNAVAILABLE.String(),
+			},
+			expected: map[string]string{
+				pkgVM.DetectedGuestOSKey:   "Red Hat Enterprise Linux 9.2",
+				pkgVM.ActivationStatusKey:  pkgVM.ActivationStatusInactive,
+				pkgVM.DNFMetadataStatusKey: pkgVM.DNFMetadataStatusUnavailable,
+			},
+		},
+		"unspecified enums are omitted": {
+			input: map[string]string{
+				"detected_os":         v1.DetectedOS_UNKNOWN.String(),
+				"activation_status":   v1.ActivationStatus_ACTIVATION_UNSPECIFIED.String(),
+				"dnf_metadata_status": v1.DnfMetadataStatus_DNF_METADATA_UNSPECIFIED.String(),
+			},
+			expected: nil,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, AgentFactsFromResponseFacts(tc.input))
+		})
+	}
+}
+
+func TestAgentFactsFromResponse(t *testing.T) {
+	cases := map[string]struct {
+		facts        map[string]string
+		agentVersion string
+		expected     map[string]string
+	}{
+		"attaches agent version to mapped facts": {
+			facts: map[string]string{
+				"detected_os":       v1.DetectedOS_RHEL.String(),
+				"os_version":        "9.2",
+				"activation_status": v1.ActivationStatus_ACTIVE.String(),
+			},
+			agentVersion: "4.10.0",
+			expected: map[string]string{
+				pkgVM.DetectedGuestOSKey:  "Red Hat Enterprise Linux 9.2",
+				pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+				pkgVM.AgentVersionKey:     "4.10.0",
+			},
+		},
+		"version only when facts do not map": {
+			facts:        map[string]string{"detected_os": v1.DetectedOS_UNKNOWN.String()},
+			agentVersion: "4.10.0",
+			expected:     map[string]string{pkgVM.AgentVersionKey: "4.10.0"},
+		},
+		"omits empty agent version": {
+			facts: map[string]string{
+				"activation_status": v1.ActivationStatus_ACTIVE.String(),
+			},
+			expected: map[string]string{
+				pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+			},
+		},
+		"empty facts and empty version": {
+			expected: nil,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, AgentFactsFromResponse(tc.facts, tc.agentVersion))
+		})
+	}
+}
+
+func TestState(t *testing.T) {
+	cases := map[string]struct {
+		input    *Info
+		expected v1.VirtualMachine_State
+	}{
+		"nil Info returns UNKNOWN": {
+			input:    nil,
+			expected: v1.VirtualMachine_UNKNOWN,
+		},
+		"running returns RUNNING": {
+			input:    &Info{Running: true},
+			expected: v1.VirtualMachine_RUNNING,
+		},
+		"not running returns STOPPED": {
+			input:    &Info{Running: false},
+			expected: v1.VirtualMachine_STOPPED,
+		},
+		"empty Info is treated as STOPPED": {
+			input:    &Info{},
+			expected: v1.VirtualMachine_STOPPED,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, State(tc.input))
+		})
+	}
+}
+
+func TestVSockCID(t *testing.T) {
+	cases := map[string]struct {
+		input       *Info
+		expected    int32
+		expectedSet bool
+	}{
+		"nil Info is unset": {
+			input:       nil,
+			expected:    0,
+			expectedSet: false,
+		},
+		"missing VSOCKCID is unset": {
+			input:       &Info{},
+			expected:    0,
+			expectedSet: false,
+		},
+		"CID 0 is set": {
+			input:       &Info{VSOCKCID: new(uint32(0))},
+			expected:    0,
+			expectedSet: true,
+		},
+		"non-zero CID is set": {
+			input:       &Info{VSOCKCID: new(uint32(0xca7d09))},
+			expected:    int32(0xca7d09),
+			expectedSet: true,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			cid, set := VSockCID(tc.input)
+			assert.Equal(t, tc.expected, cid)
+			assert.Equal(t, tc.expectedSet, set)
+		})
+	}
+}
+
+func TestSensorEvent(t *testing.T) {
+	t.Run("nil Info returns nil", func(t *testing.T) {
+		assert.Nil(t, SensorEvent(central.ResourceAction_UPDATE_RESOURCE, "cluster-1", nil))
+	})
+
+	t.Run("running VM with VSOCK CID", func(t *testing.T) {
+		event := SensorEvent(central.ResourceAction_UPDATE_RESOURCE, "cluster-1", &Info{
+			ID:         "vm-1",
+			Name:       "rhel9",
+			Namespace:  "ns",
+			Running:    true,
+			VSOCKCID:   new(uint32(7)),
+			GuestOS:    "Red Hat Enterprise Linux 9",
+			AgentFacts: map[string]string{pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive},
+		})
+		assert.Equal(t, "vm-1", event.GetId())
+		assert.Equal(t, central.ResourceAction_UPDATE_RESOURCE, event.GetAction())
+		vm := event.GetVirtualMachine()
+		assert.Equal(t, "cluster-1", vm.GetClusterId())
+		assert.Equal(t, int32(7), vm.GetVsockCid())
+		assert.True(t, vm.GetVsockCidSet())
+		assert.Equal(t, v1.VirtualMachine_RUNNING, vm.GetState())
+		assert.Equal(t, map[string]string{
+			pkgVM.GuestOSKey:          "Red Hat Enterprise Linux 9",
+			pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+		}, vm.GetFacts())
+	})
+
+	t.Run("stopped VM without VSOCK CID", func(t *testing.T) {
+		event := SensorEvent(central.ResourceAction_CREATE_RESOURCE, "cluster-2", &Info{
+			ID:        "vm-1",
+			Name:      "rhel9",
+			Namespace: "ns",
+			Running:   false,
+		})
+		assert.Equal(t, "vm-1", event.GetId())
+		assert.Equal(t, central.ResourceAction_CREATE_RESOURCE, event.GetAction())
+		vm := event.GetVirtualMachine()
+		assert.Equal(t, "cluster-2", vm.GetClusterId())
+		assert.Equal(t, int32(0), vm.GetVsockCid())
+		assert.False(t, vm.GetVsockCidSet())
+		assert.Equal(t, v1.VirtualMachine_STOPPED, vm.GetState())
+		assert.Equal(t, map[string]string{
+			pkgVM.GuestOSKey: pkgVM.UnknownGuestOS,
+		}, vm.GetFacts())
+	})
+}
diff --git a/sensor/common/virtualmachine/index/handler.go b/sensor/common/virtualmachine/index/handler.go
deleted file mode 100644
index 1a7126273e119..0000000000000
--- a/sensor/common/virtualmachine/index/handler.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package index
-
-import (
-	"context"
-
-	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
-	"github.com/stackrox/rox/pkg/concurrency"
-	"github.com/stackrox/rox/pkg/sync"
-	"github.com/stackrox/rox/sensor/common"
-	"github.com/stackrox/rox/sensor/common/virtualmachine"
-)
-
-// Handler provides functionality to send virtual machine index reports to Central.
-type Handler interface {
-	common.SensorComponent
-
-	Send(ctx context.Context, vm *virtualmachine.Info, report *v4.IndexReport) error
-}
-
-// VirtualMachineStore interface to the VirtualMachine store
-//
-//go:generate mockgen-wrapper
-type VirtualMachineStore interface {
-	Get(id virtualmachine.VMID) *virtualmachine.Info
-	GetFromCID(cid uint32) *virtualmachine.Info
-}
-
-// NewHandler returns the virtual machine component for Sensor to use.
-func NewHandler(store VirtualMachineStore) Handler {
-	return &handlerImpl{
-		centralReady: concurrency.NewSignal(),
-		lock:         &sync.RWMutex{},
-		stopper:      concurrency.NewStopper(),
-		store:        store,
-	}
-}
diff --git a/sensor/common/virtualmachine/index/handler_impl.go b/sensor/common/virtualmachine/index/handler_impl.go
deleted file mode 100644
index 73fd536ea0b14..0000000000000
--- a/sensor/common/virtualmachine/index/handler_impl.go
+++ /dev/null
@@ -1,295 +0,0 @@
-package index
-
-import (
-	"context"
-	"strconv"
-	"time"
-
-	"github.com/pkg/errors"
-	"github.com/stackrox/rox/generated/internalapi/central"
-	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
-	v1 "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
-	"github.com/stackrox/rox/pkg/centralsensor"
-	"github.com/stackrox/rox/pkg/concurrency"
-	"github.com/stackrox/rox/pkg/env"
-	"github.com/stackrox/rox/pkg/errox"
-	"github.com/stackrox/rox/pkg/logging"
-	"github.com/stackrox/rox/pkg/sync"
-	"github.com/stackrox/rox/pkg/utils"
-	"github.com/stackrox/rox/sensor/common"
-	"github.com/stackrox/rox/sensor/common/centralcaps"
-	"github.com/stackrox/rox/sensor/common/message"
-	"github.com/stackrox/rox/sensor/common/virtualmachine"
-	"github.com/stackrox/rox/sensor/common/virtualmachine/metrics"
-)
-
-var (
-	log = logging.LoggerForModule()
-
-	errCapabilityNotSupported = errors.New("Central does not have virtual machine capability")
-	errCentralNotReachable    = errors.New("Central is not reachable")
-	errInputChanClosed        = errors.New("channel receiving virtual machines is closed")
-	errStartMoreThanOnce      = errors.New("unable to start the handler more than once")
-	errVirtualMachineNotFound = errors.New("virtual machine not found")
-)
-
-type handlerImpl struct {
-	centralReady concurrency.Signal
-	// lock prevents the race condition between Start() [writer] and ResponsesC(), Send() [reader].
-	lock         *sync.RWMutex
-	stopper      concurrency.Stopper
-	toCentral    <-chan *message.ExpiringMessage
-	indexReports chan *v1.IndexReport
-	store        VirtualMachineStore
-}
-
-func (h *handlerImpl) Capabilities() []centralsensor.SensorCapability {
-	return []centralsensor.SensorCapability{centralsensor.SensorACKSupport}
-}
-
-func (h *handlerImpl) Send(ctx context.Context, vm *virtualmachine.Info, report *v4.IndexReport) error {
-	if vm == nil {
-		return errors.New("virtual machine info is nil")
-	}
-	var cidStr string
-	if vm.VSOCKCID != nil {
-		cidStr = strconv.FormatUint(uint64(*vm.VSOCKCID), 10)
-	}
-	indexReport := &v1.IndexReport{
-		VsockCid: cidStr,
-		VmId:     string(vm.ID),
-		IndexV4:  report,
-	}
-
-	if h.stopper.Client().Stopped().IsDone() {
-		return errox.InvariantViolation.CausedBy(errInputChanClosed)
-	}
-	if !centralcaps.Has(centralsensor.VirtualMachinesSupported) {
-		return errox.NotImplemented.CausedBy(errCapabilityNotSupported)
-	}
-	if !h.centralReady.IsDone() {
-		log.Warnf("Cannot send index report for virtual machine with vsock_cid=%q to Central because Central is not reachable", indexReport.GetVsockCid())
-		metrics.IndexReportsSent.With(metrics.StatusCentralNotReadyLabels).Inc()
-		return errox.ResourceExhausted.CausedBy(errCentralNotReachable)
-	}
-
-	h.lock.RLock()
-	defer h.lock.RUnlock()
-
-	blockingStart := time.Now()
-	blocked := false
-	outcome := metrics.IndexReportEnqueueOutcomeSuccess
-	defer func() {
-		if blocked {
-			metrics.IndexReportBlockingEnqueueDurationMilliseconds.
-				WithLabelValues(outcome).
-				Observe(metrics.StartTimeToMS(blockingStart))
-		}
-	}()
-
-	// Fast-path select to detect blocking on the channel for metrics
-	select {
-	case <-ctx.Done():
-		// Handled in the next select statement
-	case h.indexReports <- indexReport:
-		return nil
-	default:
-		blocked = true
-		blockingStart = time.Now()
-		metrics.IndexReportEnqueueBlockedTotal.Inc()
-	}
-
-	select {
-	case <-ctx.Done():
-		if err := ctx.Err(); errors.Is(err, context.DeadlineExceeded) {
-			outcome = metrics.IndexReportEnqueueOutcomeTimeout
-			return err //nolint:wrapcheck
-		}
-		outcome = metrics.IndexReportEnqueueOutcomeCanceled
-		return ctx.Err() //nolint:wrapcheck
-	case h.indexReports <- indexReport:
-		return nil
-	}
-}
-
-func (h *handlerImpl) Name() string {
-	return "virtualmachine.index.handlerImpl"
-}
-
-func (h *handlerImpl) Notify(e common.SensorComponentEvent) {
-	log.Info(common.LogSensorComponentEvent(e))
-	switch e {
-	case common.SensorComponentEventCentralReachable:
-		h.centralReady.Signal()
-	case common.SensorComponentEventOfflineMode:
-		// As clients are expected to retry virtual machine upserts when Sensor is in
-		// offline mode, there is no need to do anything here other than reset the signal.
-		h.centralReady.Reset()
-	}
-}
-
-func (h *handlerImpl) Accepts(_ *central.MsgToSensor) bool {
-	// VM index SensorACKs are consumed only by VMScraper.
-	return false
-}
-
-func (h *handlerImpl) ProcessMessage(_ context.Context, _ *central.MsgToSensor) error {
-	return nil
-}
-
-// ResponsesC returns a channel with messages to Central. It must be called
-// after Start() for the channel to be not nil.
-func (h *handlerImpl) ResponsesC() <-chan *message.ExpiringMessage {
-	h.lock.RLock()
-	defer h.lock.RUnlock()
-	if h.toCentral == nil {
-		log.Panic("Start must be called before ResponsesC")
-	}
-	return h.toCentral
-}
-
-func (h *handlerImpl) Start() error {
-	log.Debug("Starting virtual machine handler")
-	h.lock.Lock()
-	defer h.lock.Unlock()
-	if h.toCentral != nil || h.indexReports != nil {
-		return errStartMoreThanOnce
-	}
-	h.indexReports = make(chan *v1.IndexReport, env.VirtualMachinesIndexReportsBufferSize.IntegerSetting())
-	h.toCentral = h.run(h.indexReports)
-	return nil
-}
-
-func (h *handlerImpl) Stop() {
-	// Stop the stopper FIRST so Send() will see it as stopped and return early
-	// before we close the channel. This prevents panics from sending on closed channel.
-	// Matters mainly for local-sensor, as we care that local-sensor stops cleanly before saving the data to a file.
-	client := h.stopper.Client()
-	if !client.Stopped().IsDone() {
-		defer utils.IgnoreError(client.Stopped().Wait)
-		client.Stop()
-	}
-	// Acquire write lock to prevent concurrent Send() calls from racing with channel close
-	h.lock.Lock()
-	defer h.lock.Unlock()
-	// Now close the channel - this will cause the run() goroutine to exit.
-	// Guard against closing an already-closed channel to make Stop() idempotent
-	if h.indexReports != nil {
-		close(h.indexReports)
-		h.indexReports = nil
-	}
-}
-
-// run handles the virtual machine data and forwards it to Central.
-// This is the only goroutine that writes into the toCentral channel, thus it is
-// responsible for creating and closing that chan.
-func (h *handlerImpl) run(indexReports <-chan *v1.IndexReport) (toCentral <-chan *message.ExpiringMessage) {
-	ch2Central := make(chan *message.ExpiringMessage)
-	go func() {
-		defer func() {
-			h.stopper.Flow().ReportStopped()
-			close(ch2Central)
-		}()
-		log.Debugf("virtual machine index report handler is running")
-		for {
-			select {
-			case <-h.stopper.Flow().StopRequested():
-				return
-			case indexReport, ok := <-indexReports:
-				if !ok {
-					h.stopper.Flow().StopWithError(errInputChanClosed)
-					return
-				}
-				h.handleIndexReport(ch2Central, indexReport)
-			}
-		}
-	}()
-	return ch2Central
-}
-
-func (h *handlerImpl) handleIndexReport(
-	toCentral chan *message.ExpiringMessage,
-	indexReport *v1.IndexReport,
-) {
-	startTime := time.Now()
-	outcome := metrics.IndexReportHandlingMessageToCentralSuccess
-	defer func() {
-		metrics.IndexReportProcessingDurationMilliseconds.
-			WithLabelValues(outcome).
-			Observe(metrics.StartTimeToMS(startTime))
-	}()
-
-	if indexReport == nil {
-		outcome = metrics.IndexReportHandlingMessageToCentralNilReport
-		log.Warn("Received nil virtual machine index report: not sending to Central")
-		return
-	}
-	log.Debugf("Handling virtual machine index report (vm_id=%q vsock_cid=%q)...",
-		indexReport.GetVmId(), indexReport.GetVsockCid())
-
-	msg, outcome, err := h.newMessageToCentral(indexReport)
-	if err != nil {
-		log.Warnf("unable to send index report message for virtual machine (vm_id=%q vsock_cid=%q) to central: %v",
-			indexReport.GetVmId(), indexReport.GetVsockCid(), err)
-		return
-	}
-	h.sendIndexReportEvent(toCentral, msg)
-	metrics.IndexReportsSent.With(metrics.StatusSuccessLabels).Inc()
-}
-
-func (h *handlerImpl) newMessageToCentral(indexReport *v1.IndexReport) (*message.ExpiringMessage, string, error) {
-	vmInfo, outcome, err := h.resolveVM(indexReport)
-	if err != nil {
-		return nil, outcome, err
-	}
-
-	return message.New(&central.MsgFromSensor{
-		Msg: &central.MsgFromSensor_Event{
-			Event: &central.SensorEvent{
-				Id:     string(vmInfo.ID),
-				Action: central.ResourceAction_SYNC_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachineIndexReport{
-					VirtualMachineIndexReport: &v1.IndexReportEvent{
-						Id:    string(vmInfo.ID),
-						Index: indexReport,
-					},
-				},
-			},
-		},
-	}), metrics.IndexReportHandlingMessageToCentralSuccess, nil
-}
-
-// resolveVM prefers vm_id; vsock_cid is only used when the report has no UID.
-func (h *handlerImpl) resolveVM(indexReport *v1.IndexReport) (*virtualmachine.Info, string, error) {
-	if vmID := indexReport.GetVmId(); vmID != "" {
-		vmInfo := h.store.Get(virtualmachine.VMID(vmID))
-		if vmInfo == nil {
-			return nil, metrics.IndexReportHandlingMessageToCentralVMUnknown,
-				errors.Wrapf(errVirtualMachineNotFound, "VirtualMachine %q not found", vmID)
-		}
-		return vmInfo, "", nil
-	}
-
-	cid, err := strconv.ParseUint(indexReport.GetVsockCid(), 10, 32)
-	if err != nil {
-		return nil, metrics.IndexReportHandlingMessageToCentralInvalidCID,
-			errors.Wrapf(err, "Received an invalid Vsock CID: %q", indexReport.GetVsockCid())
-	}
-
-	vmInfo := h.store.GetFromCID(uint32(cid))
-	if vmInfo == nil {
-		return nil, metrics.IndexReportHandlingMessageToCentralVMUnknown,
-			errors.Wrapf(errVirtualMachineNotFound, "VirtualMachine with Vsock CID %q not found", indexReport.GetVsockCid())
-	}
-	return vmInfo, "", nil
-}
-
-func (h *handlerImpl) sendIndexReportEvent(
-	toCentral chan<- *message.ExpiringMessage,
-	msg *message.ExpiringMessage,
-) {
-	select {
-	case <-h.stopper.Flow().StopRequested():
-	case toCentral <- msg:
-	}
-}
diff --git a/sensor/common/virtualmachine/index/handler_impl_test.go b/sensor/common/virtualmachine/index/handler_impl_test.go
deleted file mode 100644
index c27786f09cc6b..0000000000000
--- a/sensor/common/virtualmachine/index/handler_impl_test.go
+++ /dev/null
@@ -1,317 +0,0 @@
-package index
-
-import (
-	"context"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/stackrox/rox/generated/internalapi/central"
-	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
-	v1 "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
-	"github.com/stackrox/rox/pkg/centralsensor"
-	"github.com/stackrox/rox/pkg/concurrency"
-	"github.com/stackrox/rox/pkg/errox"
-	"github.com/stackrox/rox/pkg/sync"
-	"github.com/stackrox/rox/pkg/testutils/goleak"
-	"github.com/stackrox/rox/sensor/common"
-	"github.com/stackrox/rox/sensor/common/centralcaps"
-	"github.com/stackrox/rox/sensor/common/virtualmachine"
-	"github.com/stackrox/rox/sensor/common/virtualmachine/index/mocks"
-	"github.com/stretchr/testify/suite"
-	"go.uber.org/mock/gomock"
-)
-
-func TestVirtualMachineHandler(t *testing.T) {
-	suite.Run(t, new(virtualMachineHandlerSuite))
-}
-
-type virtualMachineHandlerSuite struct {
-	suite.Suite
-	ctrl    *gomock.Controller
-	store   *mocks.MockVirtualMachineStore
-	handler *handlerImpl
-}
-
-func (s *virtualMachineHandlerSuite) SetupTest() {
-	s.ctrl = gomock.NewController(s.T())
-	s.store = mocks.NewMockVirtualMachineStore(s.ctrl)
-	s.handler = &handlerImpl{
-		centralReady: concurrency.NewSignal(),
-		lock:         &sync.RWMutex{},
-		stopper:      concurrency.NewStopper(),
-		store:        s.store,
-	}
-	centralcaps.Set([]centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported})
-}
-
-func (s *virtualMachineHandlerSuite) TearDownTest() {
-	// Reset global capability state to prevent test pollution.
-	// If not reset, subsequent tests may incorrectly assume capabilities are present/absent,
-	// leading to false negatives that could hide regressions.
-	centralcaps.Set(nil)
-	goleak.AssertNoGoroutineLeaks(s.T())
-}
-
-func (s *virtualMachineHandlerSuite) TestSend() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-	s.handler.Notify(common.SensorComponentEventCentralReachable)
-	defer s.handler.Stop()
-	s.Require().NotNil(s.handler.toCentral)
-
-	cid := uint32(1)
-	s.store.EXPECT().Get(gomock.Eq(virtualmachine.VMID("test-vm"))).Times(1).Return(
-		&virtualmachine.Info{
-			ID: "test-vm",
-		})
-
-	go func() {
-		err := s.handler.Send(context.Background(), &virtualmachine.Info{
-			ID:       "test-vm",
-			VSOCKCID: &cid,
-		}, &v4.IndexReport{State: "IndexFinished"})
-		s.Require().NoError(err)
-	}()
-
-	select {
-	case msg := <-s.handler.ResponsesC():
-		s.Require().NotNil(msg)
-		s.Require().NotNil(msg.MsgFromSensor)
-
-		sensorEvent := msg.GetEvent()
-		s.Require().NotNil(sensorEvent)
-		s.Assert().Equal("test-vm", sensorEvent.GetId())
-		s.Assert().Equal(central.ResourceAction_SYNC_RESOURCE, sensorEvent.GetAction())
-		s.Assert().NotNil(sensorEvent.GetVirtualMachineIndexReport())
-		s.Assert().Equal("test-vm", sensorEvent.GetVirtualMachineIndexReport().GetId())
-		index := sensorEvent.GetVirtualMachineIndexReport().GetIndex()
-		s.Require().NotNil(index)
-		s.Assert().Equal("test-vm", index.GetVmId())
-		s.Assert().Equal("1", index.GetVsockCid())
-		s.Assert().Equal("IndexFinished", index.GetIndexV4().GetState())
-	case <-time.After(time.Second):
-		s.Fail("Expected message to be sent to central")
-	}
-}
-
-func (s *virtualMachineHandlerSuite) TestConcurrentSends() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-	s.handler.Notify(common.SensorComponentEventCentralReachable)
-	defer s.handler.Stop()
-
-	ctx := context.Background()
-	numGoroutines := 3
-	numVMsPerGoroutine := 2
-	s.store.EXPECT().Get(gomock.Any()).Times(numGoroutines * numVMsPerGoroutine).
-		DoAndReturn(func(id virtualmachine.VMID) *virtualmachine.Info {
-			return &virtualmachine.Info{ID: id}
-		})
-
-	cont := 0
-	mu := sync.Mutex{}
-	for range numGoroutines {
-		go func() {
-			for range numVMsPerGoroutine {
-				var cid uint32
-				concurrency.WithLock(&mu, func() {
-					cid = uint32(cont)
-					cont++
-				})
-				err := s.handler.Send(ctx, &virtualmachine.Info{
-					ID:       virtualmachine.VMID("test-vm"),
-					VSOCKCID: &cid,
-				}, &v4.IndexReport{})
-				s.Require().NoError(err)
-			}
-		}()
-	}
-
-	// Collect all responses. The timeout breaks the loop so the Assert
-	// below reports the actual vs expected count — do not fail inside
-	// the select; that would abort before the diagnostic assertion.
-	totalResponses := 0
-	for range numGoroutines * numVMsPerGoroutine {
-		select {
-		case <-s.handler.toCentral:
-			totalResponses++
-		case <-time.After(500 * time.Millisecond):
-			s.T().Logf("Timeout waiting for response, got %d responses", totalResponses)
-			s.Assert().Equal(numGoroutines*numVMsPerGoroutine, totalResponses)
-			return
-		}
-	}
-	s.Assert().Equal(numGoroutines*numVMsPerGoroutine, totalResponses)
-}
-
-func (s *virtualMachineHandlerSuite) TestVirtualMachineNotFound() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-	s.handler.Notify(common.SensorComponentEventCentralReachable)
-	defer s.handler.Stop()
-	s.Require().NotNil(s.handler.toCentral)
-
-	cid := uint32(1)
-	s.store.EXPECT().GetFromCID(gomock.Eq(uint32(1))).Times(1).Return(nil)
-
-	wg := sync.WaitGroup{}
-	wg.Go(func() {
-		// Empty ID forces CID-based resolution in the processing path.
-		err := s.handler.Send(context.Background(), &virtualmachine.Info{
-			VSOCKCID: &cid,
-		}, &v4.IndexReport{})
-		s.Require().NoError(err)
-	})
-
-	wg.Wait()
-
-	// No message should be forwarded when the VM cannot be resolved.
-	select {
-	case <-s.handler.ResponsesC():
-		s.Fail("Unexpected message to be sent to central")
-	case <-time.After(500 * time.Millisecond):
-	}
-}
-
-func (s *virtualMachineHandlerSuite) TestResolveVM_InvalidCID() {
-	_, _, err := s.handler.resolveVM(&v1.IndexReport{VsockCid: "invalid-cid"})
-	s.Require().Error(err)
-	s.Assert().ErrorContains(err, "invalid Vsock CID")
-}
-
-func (s *virtualMachineHandlerSuite) TestSend_ResolveByVmID() {
-	vmID := virtualmachine.VMID("test-vm")
-	cases := map[string]struct {
-		vsockCID *uint32
-		wantCID  string
-	}{
-		"should forward when only vm_id is set": {
-			vsockCID: nil,
-			wantCID:  "",
-		},
-		"should include vsock_cid when known": {
-			vsockCID: new(uint32(42)),
-			wantCID:  "42",
-		},
-	}
-	s.store.EXPECT().Get(gomock.Eq(vmID)).Times(len(cases)).Return(&virtualmachine.Info{ID: vmID})
-
-	for name, tc := range cases {
-		s.Run(name, func() {
-			synctest.Test(s.T(), func(t *testing.T) {
-				handler := &handlerImpl{
-					centralReady: concurrency.NewSignal(),
-					lock:         &sync.RWMutex{},
-					stopper:      concurrency.NewStopper(),
-					store:        s.store,
-				}
-				err := handler.Start()
-				s.Require().NoError(err)
-				handler.Notify(common.SensorComponentEventCentralReachable)
-				defer handler.Stop()
-
-				go func() {
-					err := handler.Send(context.Background(), &virtualmachine.Info{
-						ID:       vmID,
-						VSOCKCID: tc.vsockCID,
-					}, &v4.IndexReport{})
-					s.Require().NoError(err)
-				}()
-
-				synctest.Wait()
-
-				msg := <-handler.ResponsesC()
-				s.Require().NotNil(msg)
-				sensorEvent := msg.GetEvent()
-				s.Require().NotNil(sensorEvent)
-				s.Assert().Equal(string(vmID), sensorEvent.GetId())
-				indexEvent := sensorEvent.GetVirtualMachineIndexReport()
-				s.Require().NotNil(indexEvent)
-				s.Assert().Equal(string(vmID), indexEvent.GetId())
-				s.Assert().Equal(string(vmID), indexEvent.GetIndex().GetVmId())
-				s.Assert().Equal(tc.wantCID, indexEvent.GetIndex().GetVsockCid())
-			})
-		})
-	}
-}
-
-func (s *virtualMachineHandlerSuite) TestSend_NilVM() {
-	err := s.handler.Send(context.Background(), nil, &v4.IndexReport{})
-	s.Require().Error(err)
-	s.Assert().ErrorContains(err, "virtual machine info is nil")
-}
-
-func (s *virtualMachineHandlerSuite) TestStop() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-
-	s.handler.Stop()
-
-	select {
-	case <-s.handler.stopper.Client().Stopped().Done():
-	case <-time.After(time.Second):
-		s.Fail("handler should have stopped")
-	}
-}
-
-func (s *virtualMachineHandlerSuite) TestCapabilities() {
-	caps := s.handler.Capabilities()
-	s.Require().Len(caps, 1)
-	s.Contains(caps, centralsensor.SensorACKSupport)
-}
-
-func (s *virtualMachineHandlerSuite) TestResponsesC_BeforeStart() {
-	s.Assert().Panics(func() { _ = s.handler.ResponsesC() })
-}
-
-func (s *virtualMachineHandlerSuite) TestResponsesC_AfterStart() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-	defer s.handler.Stop()
-
-	ch := s.handler.ResponsesC()
-	s.Require().NotNil(ch)
-}
-
-func (s *virtualMachineHandlerSuite) TestSend_CapabilityNotSupported() {
-	// Simulate an older Central that lacks VirtualMachinesSupported.
-	centralcaps.Set(nil)
-
-	err := s.handler.Send(context.Background(), &virtualmachine.Info{ID: "vm-1"}, &v4.IndexReport{})
-	s.Require().Error(err)
-	s.Require().ErrorIs(err, errCapabilityNotSupported)
-	s.Require().ErrorIs(err, errox.NotImplemented)
-	s.Assert().ErrorContains(err, "Central does not have virtual machine capability")
-}
-
-func (s *virtualMachineHandlerSuite) TestSend_AfterStop() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-	s.handler.Stop()
-
-	err = s.handler.Send(context.Background(), &virtualmachine.Info{ID: "vm-1"}, &v4.IndexReport{})
-	s.Require().Error(err)
-	s.Require().ErrorIs(err, errInputChanClosed)
-	s.Require().ErrorIs(err, errox.InvariantViolation)
-}
-
-func (s *virtualMachineHandlerSuite) TestSend_CentralNotReachable() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-	defer s.handler.Stop()
-
-	err = s.handler.Send(context.Background(), &virtualmachine.Info{ID: "vm-1"}, &v4.IndexReport{})
-	s.Require().Error(err)
-	s.Require().ErrorIs(err, errCentralNotReachable)
-	s.Require().ErrorIs(err, errox.ResourceExhausted)
-}
-
-func (s *virtualMachineHandlerSuite) TestStart_CalledTwice() {
-	err := s.handler.Start()
-	s.Require().NoError(err)
-	defer s.handler.Stop()
-
-	err = s.handler.Start()
-	s.Require().ErrorIs(err, errStartMoreThanOnce)
-}
diff --git a/sensor/common/virtualmachine/index/mocks/handler.go b/sensor/common/virtualmachine/index/mocks/handler.go
deleted file mode 100644
index fb928f1e990af..0000000000000
--- a/sensor/common/virtualmachine/index/mocks/handler.go
+++ /dev/null
@@ -1,221 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: handler.go
-//
-// Generated by this command:
-//
-//	mockgen -package mocks -destination mocks/handler.go -source handler.go
-//
-
-// Package mocks is a generated GoMock package.
-package mocks
-
-import (
-	context "context"
-	reflect "reflect"
-
-	central "github.com/stackrox/rox/generated/internalapi/central"
-	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
-	centralsensor "github.com/stackrox/rox/pkg/centralsensor"
-	common "github.com/stackrox/rox/sensor/common"
-	message "github.com/stackrox/rox/sensor/common/message"
-	virtualmachine "github.com/stackrox/rox/sensor/common/virtualmachine"
-	gomock "go.uber.org/mock/gomock"
-)
-
-// MockHandler is a mock of Handler interface.
-type MockHandler struct {
-	ctrl     *gomock.Controller
-	recorder *MockHandlerMockRecorder
-	isgomock struct{}
-}
-
-// MockHandlerMockRecorder is the mock recorder for MockHandler.
-type MockHandlerMockRecorder struct {
-	mock *MockHandler
-}
-
-// NewMockHandler creates a new mock instance.
-func NewMockHandler(ctrl *gomock.Controller) *MockHandler {
-	mock := &MockHandler{ctrl: ctrl}
-	mock.recorder = &MockHandlerMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockHandler) EXPECT() *MockHandlerMockRecorder {
-	return m.recorder
-}
-
-// Accepts mocks base method.
-func (m *MockHandler) Accepts(msg *central.MsgToSensor) bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Accepts", msg)
-	ret0, _ := ret[0].(bool)
-	return ret0
-}
-
-// Accepts indicates an expected call of Accepts.
-func (mr *MockHandlerMockRecorder) Accepts(msg any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Accepts", reflect.TypeOf((*MockHandler)(nil).Accepts), msg)
-}
-
-// Capabilities mocks base method.
-func (m *MockHandler) Capabilities() []centralsensor.SensorCapability {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Capabilities")
-	ret0, _ := ret[0].([]centralsensor.SensorCapability)
-	return ret0
-}
-
-// Capabilities indicates an expected call of Capabilities.
-func (mr *MockHandlerMockRecorder) Capabilities() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Capabilities", reflect.TypeOf((*MockHandler)(nil).Capabilities))
-}
-
-// Name mocks base method.
-func (m *MockHandler) Name() string {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Name")
-	ret0, _ := ret[0].(string)
-	return ret0
-}
-
-// Name indicates an expected call of Name.
-func (mr *MockHandlerMockRecorder) Name() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Name", reflect.TypeOf((*MockHandler)(nil).Name))
-}
-
-// Notify mocks base method.
-func (m *MockHandler) Notify(e common.SensorComponentEvent) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Notify", e)
-}
-
-// Notify indicates an expected call of Notify.
-func (mr *MockHandlerMockRecorder) Notify(e any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Notify", reflect.TypeOf((*MockHandler)(nil).Notify), e)
-}
-
-// ProcessMessage mocks base method.
-func (m *MockHandler) ProcessMessage(ctx context.Context, msg *central.MsgToSensor) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ProcessMessage", ctx, msg)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// ProcessMessage indicates an expected call of ProcessMessage.
-func (mr *MockHandlerMockRecorder) ProcessMessage(ctx, msg any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ProcessMessage", reflect.TypeOf((*MockHandler)(nil).ProcessMessage), ctx, msg)
-}
-
-// ResponsesC mocks base method.
-func (m *MockHandler) ResponsesC() <-chan *message.ExpiringMessage {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ResponsesC")
-	ret0, _ := ret[0].(<-chan *message.ExpiringMessage)
-	return ret0
-}
-
-// ResponsesC indicates an expected call of ResponsesC.
-func (mr *MockHandlerMockRecorder) ResponsesC() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ResponsesC", reflect.TypeOf((*MockHandler)(nil).ResponsesC))
-}
-
-// Send mocks base method.
-func (m *MockHandler) Send(ctx context.Context, vm *virtualmachine.Info, report *v4.IndexReport) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Send", ctx, vm, report)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Send indicates an expected call of Send.
-func (mr *MockHandlerMockRecorder) Send(ctx, vm, report any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Send", reflect.TypeOf((*MockHandler)(nil).Send), ctx, vm, report)
-}
-
-// Start mocks base method.
-func (m *MockHandler) Start() error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Start")
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Start indicates an expected call of Start.
-func (mr *MockHandlerMockRecorder) Start() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Start", reflect.TypeOf((*MockHandler)(nil).Start))
-}
-
-// Stop mocks base method.
-func (m *MockHandler) Stop() {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Stop")
-}
-
-// Stop indicates an expected call of Stop.
-func (mr *MockHandlerMockRecorder) Stop() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Stop", reflect.TypeOf((*MockHandler)(nil).Stop))
-}
-
-// MockVirtualMachineStore is a mock of VirtualMachineStore interface.
-type MockVirtualMachineStore struct {
-	ctrl     *gomock.Controller
-	recorder *MockVirtualMachineStoreMockRecorder
-	isgomock struct{}
-}
-
-// MockVirtualMachineStoreMockRecorder is the mock recorder for MockVirtualMachineStore.
-type MockVirtualMachineStoreMockRecorder struct {
-	mock *MockVirtualMachineStore
-}
-
-// NewMockVirtualMachineStore creates a new mock instance.
-func NewMockVirtualMachineStore(ctrl *gomock.Controller) *MockVirtualMachineStore {
-	mock := &MockVirtualMachineStore{ctrl: ctrl}
-	mock.recorder = &MockVirtualMachineStoreMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockVirtualMachineStore) EXPECT() *MockVirtualMachineStoreMockRecorder {
-	return m.recorder
-}
-
-// Get mocks base method.
-func (m *MockVirtualMachineStore) Get(id virtualmachine.VMID) *virtualmachine.Info {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Get", id)
-	ret0, _ := ret[0].(*virtualmachine.Info)
-	return ret0
-}
-
-// Get indicates an expected call of Get.
-func (mr *MockVirtualMachineStoreMockRecorder) Get(id any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get", reflect.TypeOf((*MockVirtualMachineStore)(nil).Get), id)
-}
-
-// GetFromCID mocks base method.
-func (m *MockVirtualMachineStore) GetFromCID(cid uint32) *virtualmachine.Info {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetFromCID", cid)
-	ret0, _ := ret[0].(*virtualmachine.Info)
-	return ret0
-}
-
-// GetFromCID indicates an expected call of GetFromCID.
-func (mr *MockVirtualMachineStoreMockRecorder) GetFromCID(cid any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetFromCID", reflect.TypeOf((*MockVirtualMachineStore)(nil).GetFromCID), cid)
-}
diff --git a/sensor/common/virtualmachine/metrics/metrics.go b/sensor/common/virtualmachine/metrics/metrics.go
index 8442c64f2a4d9..8b76f04f0e862 100644
--- a/sensor/common/virtualmachine/metrics/metrics.go
+++ b/sensor/common/virtualmachine/metrics/metrics.go
@@ -1,17 +1,10 @@
 package metrics
 
 import (
-	"time"
-
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stackrox/rox/pkg/metrics"
 )
 
-// StartTimeToMS allows to record sub-millisecond durations. Without this, things faster than 1ms are rounded to 0.
-func StartTimeToMS(t time.Time) float64 {
-	return float64(time.Since(t).Nanoseconds()) / float64(time.Millisecond)
-}
-
 var (
 	StatusCentralNotReadyLabels = prometheus.Labels{"status": "central not ready"}
 	StatusErrorLabels           = prometheus.Labels{"status": "error"}
@@ -30,56 +23,13 @@ var IndexReportsSent = prometheus.NewCounterVec(
 	[]string{"status"},
 )
 
-// IndexReportProcessingDuration label values.
-const (
-	// IndexReportHandlingMessageToCentralSuccess marks processing flows that successfully send to Central.
-	IndexReportHandlingMessageToCentralSuccess = "success"
-	// IndexReportHandlingMessageToCentralNilReport marks flows that exit because the report was nil.
-	IndexReportHandlingMessageToCentralNilReport = "nil_report"
-	// IndexReportHandlingMessageToCentralInvalidCID marks flows that exit because the message could not be constructed due to an invalid vsock CID.
-	IndexReportHandlingMessageToCentralInvalidCID = "invalid_vsock_cid"
-	// IndexReportHandlingMessageToCentralVMUnknown marks flows that exit because the virtual machine is not known to Sensor.
-	IndexReportHandlingMessageToCentralVMUnknown = "vm_unknown_to_sensor"
-)
-
-// IndexReportProcessingDurationMilliseconds tracks how long Sensor spends processing index reports after dequeuing them.
-var IndexReportProcessingDurationMilliseconds = prometheus.NewHistogramVec(
-	prometheus.HistogramOpts{
-		Namespace: metrics.PrometheusNamespace,
-		Subsystem: metrics.SensorSubsystem.String(),
-		Name:      "virtual_machine_index_report_processing_duration_milliseconds",
-		Help:      "Distribution of time spent (in ms) processing virtual machine index reports after reading from indexReports and before sending to Central",
-		Buckets:   prometheus.ExponentialBuckets(10, 2, 12),
-	},
-	[]string{"outcome"},
-)
-
-// IndexReportEnqueueOutcome label values for enqueue latency observations.
-const (
-	IndexReportEnqueueOutcomeSuccess  = "success"
-	IndexReportEnqueueOutcomeTimeout  = "context_timeout"
-	IndexReportEnqueueOutcomeCanceled = "context_canceled"
-)
-
-// IndexReportBlockingEnqueueDurationMilliseconds measures how long Sensor waits after detecting backpressure.
-var IndexReportBlockingEnqueueDurationMilliseconds = prometheus.NewHistogramVec(
-	prometheus.HistogramOpts{
-		Namespace: metrics.PrometheusNamespace,
-		Subsystem: metrics.SensorSubsystem.String(),
-		Name:      "virtual_machine_index_report_blocking_enqueue_duration_milliseconds",
-		Help:      "Time spent (in ms) waiting for indexReports capacity after encountering a full channel",
-		Buckets:   append([]float64{1, 5, 10, 50, 100, 250, 500}, prometheus.ExponentialBuckets(1000, 2, 8)...), // 1ms to 128s
-	},
-	[]string{"outcome"},
-)
-
 // IndexReportEnqueueBlockedTotal counts how often the enqueue channel was full.
 var IndexReportEnqueueBlockedTotal = prometheus.NewCounter(
 	prometheus.CounterOpts{
 		Namespace: metrics.PrometheusNamespace,
 		Subsystem: metrics.SensorSubsystem.String(),
 		Name:      "virtual_machine_index_report_enqueue_blocked_total",
-		Help:      "Number of times virtual machine index report enqueue attempts found the indexReports channel full",
+		Help:      "Number of times virtual machine index report enqueue attempts found the channel full",
 	},
 )
 
@@ -105,18 +55,60 @@ var IndexReportAcksReceived = prometheus.NewCounterVec(
 	[]string{"action"}, // "ACK" or "NACK"
 )
 
-// Pull-mode request status label values for PullRequestsTotal.
+// Pull-mode GetReport outcomes are split across three counters so transport,
+// GetReport protocol, and scrape-pipeline results stay distinct. Each
+// GetReport attempt increments exactly one of those. PullSyncTotal counts
+// the optional second VSOCK RPC that pushes a repo-to-CPE mapping.
+
+// Transport-layer status values for PullTransportTotal.
+const (
+	PullTransportDialError     = "dial_error"
+	PullTransportTimeout       = "timeout"
+	PullTransportReadError     = "read_error"
+	PullTransportAbnormalClose = "abnormal_close"
+	PullTransportUnexpected    = "unexpected"
+)
+
+// GetReport protocol status values for PullGetReportTotal.
+const (
+	PullGetReportUnchanged         = "unchanged"
+	PullGetReportNotReady          = "not_ready"
+	PullGetReportMappingRequired   = "mapping_required"
+	PullGetReportUnknownMethod     = "unknown_method"
+	PullGetReportBusy              = "busy"
+	PullGetReportInternalError     = "internal_error"
+	PullGetReportMalformedRequest  = "malformed_request"
+	PullGetReportRequestTooLarge   = "request_too_large"
+	PullGetReportUnknownAgentError = "unknown_agent_error"
+)
+
+// Scrape-pipeline status values for PullScrapeTotal (post-GetReport).
+const (
+	PullScrapeSuccess       = "success"
+	PullScrapeInvalidReport = "invalid_report"
+	PullScrapeSendError     = "send_error"
+)
+
+// Sync-RPC status values for PullSyncTotal.
+const (
+	// PullSyncSuccess counts an accepted push; Updated true/false both count.
+	PullSyncSuccess = "success"
+	// PullSyncError is a sync dial failure or a rejection other than not-Sensor-managed.
+	PullSyncError = "error"
+	// PullSyncNotManaged is a rejection Sensor's own gate should have prevented.
+	PullSyncNotManaged = "not_managed"
+	// PullSyncURLHashMismatch is a URL-managed agent whose hash differs from Sensor's cache; Sensor never dials.
+	PullSyncURLHashMismatch = "url_hash_mismatch"
+	// PullSyncTimeout is a skipped sync because GetReport already consumed the per-VM deadline.
+	PullSyncTimeout = "timeout"
+)
+
+// Mapping-path label values for PullTrackedVMsByMappingPath. Bounded to
+// the three RepoCPEMappingUpdatePath cases so cardinality stays fixed.
 const (
-	PullStatusSuccess       = "success"
-	PullStatusUnchanged     = "unchanged"
-	PullStatusDialError     = "dial_error"
-	PullStatusReadError     = "read_error"
-	PullStatusInvalidReport = "invalid_report"
-	PullStatusSendError     = "send_error"
-	PullStatusNotReady      = "not_ready"
-	PullStatusUnknownMethod = "unknown_method"
-	PullStatusTimeout       = "timeout"
-	PullStatusBusy          = "busy"
+	MappingPathSensor      = "sensor"
+	MappingPathURL         = "url"
+	MappingPathUnspecified = "unspecified"
 )
 
 // PullDialDurationSeconds measures time to establish a websocket connection per VM.
@@ -191,13 +183,53 @@ var PullReportPackages = prometheus.NewHistogram(
 	},
 )
 
-// PullRequestsTotal counts per-VM pull attempts by status.
-var PullRequestsTotal = prometheus.NewCounterVec(
+// PullTransportTotal counts per-VM pull attempts that failed at the VSOCK
+// transport layer (dial / read / abnormal close) before a protocol result.
+var PullTransportTotal = prometheus.NewCounterVec(
 	prometheus.CounterOpts{
 		Namespace: metrics.PrometheusNamespace,
 		Subsystem: metrics.SensorSubsystem.String(),
-		Name:      "vsock_pull_requests_total",
-		Help:      "Per-VM pull attempts by outcome status",
+		Name:      "vsock_pull_transport_total",
+		Help:      "Per-VM pull attempts that failed at the VSOCK transport layer",
+	},
+	[]string{"status"},
+)
+
+// PullGetReportTotal counts per-VM GetReport protocol outcomes (Unchanged,
+// ErrorCode sentinels). Transport failures are counted on PullTransportTotal
+// instead; successful full reports continue into the scrape pipeline and are
+// counted on PullScrapeTotal.
+var PullGetReportTotal = prometheus.NewCounterVec(
+	prometheus.CounterOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_get_report_total",
+		Help:      "Per-VM GetReport protocol outcomes (unchanged and agent ErrorCode results)",
+	},
+	[]string{"status"},
+)
+
+// PullScrapeTotal counts per-VM scrape-pipeline outcomes after a full
+// GetReport payload was received (viability check, send to Central, success).
+var PullScrapeTotal = prometheus.NewCounterVec(
+	prometheus.CounterOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_scrape_total",
+		Help:      "Per-VM scrape-pipeline outcomes after a full GetReport payload was received",
+	},
+	[]string{"status"},
+)
+
+// PullSyncTotal counts the optional second VSOCK RPC that pushes a
+// repo-to-CPE mapping after GetReport. It is not part of the GetReport
+// transport/protocol/scrape partition.
+var PullSyncTotal = prometheus.NewCounterVec(
+	prometheus.CounterOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_sync_total",
+		Help:      "Per-VM repo-to-CPE mapping sync outcomes (second VSOCK RPC after GetReport)",
 	},
 	[]string{"status"},
 )
@@ -223,11 +255,76 @@ var PullTrackedVMs = prometheus.NewGauge(
 	},
 )
 
+// PullTrackedVMsByMappingPath is currently tracked VMs partitioned by
+// repo-to-CPE mapping update path. It is fleet mix, not scrape events;
+// the three series sum to vsock_pull_tracked_vms.
+var PullTrackedVMsByMappingPath = prometheus.NewGaugeVec(
+	prometheus.GaugeOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_tracked_vms_by_mapping_path",
+		Help:      "Number of VMs currently tracked for pull-mode scraping, partitioned by repo-to-CPE mapping update path (sensor, url, unspecified). This is fleet mix, not scrape events.",
+	},
+	[]string{"path"},
+)
+
+// PullDueVMs is how many VMs were eligible to scrape at the start of the last
+// tick (nextAttemptAt had arrived and they were not already in flight).
+var PullDueVMs = prometheus.NewGauge(
+	prometheus.GaugeOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_due_vms",
+		Help:      "How many VMs were eligible to scrape at the beginning of the last scraper tick",
+	},
+)
+
+// PullStartsPerTick is how many VM scrapes each tick launches. Idle ticks
+// (nobody due) are omitted so the histogram is not dominated by zeros.
+var PullStartsPerTick = prometheus.NewHistogram(
+	prometheus.HistogramOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_starts_per_tick",
+		Help: "How many VM scrapes the scraper starts in a single tick. " +
+			"Idle ticks are not observed. Compare with vsock_pull_due_vms: " +
+			"spread due times keep both small; a mass of large starts is a dump.",
+		Buckets: []float64{0, 1, 2, 3, 5, 8, 10, 15, 20, 30, 50, 100},
+	},
+)
+
+// PullForwardInterarrivalSeconds is the Sensor-level gap between consecutive
+// successful forwards to Central. The first forward after start is not observed.
+var PullForwardInterarrivalSeconds = prometheus.NewHistogram(
+	prometheus.HistogramOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_forward_interarrival_seconds",
+		Help: "Seconds between consecutive successful VM index-report forwards " +
+			"from this Sensor to Central. The first forward after Sensor start does not count.",
+		// 10ms to ~47h. Sized for a 24h poll in extreme cases so those
+		// gaps stay in a finite bucket instead of +Inf.
+		Buckets: prometheus.ExponentialBuckets(0.01, 2, 25),
+	},
+)
+
+// PullScheduleOffsetSeconds is the random extra delay drawn when a VM returns
+// to cadence after success or a permanent non-retry outcome (retries/NACKs do not).
+var PullScheduleOffsetSeconds = prometheus.NewHistogram(
+	prometheus.HistogramOpts{
+		Namespace: metrics.PrometheusNamespace,
+		Subsystem: metrics.SensorSubsystem.String(),
+		Name:      "vsock_pull_schedule_offset_seconds",
+		Help: "Random extra delay (seconds) added on top of the poll interval " +
+			"when scheduling a VM's next attempt after a return-to-cadence outcome.",
+		// 250ms to ~36h. Sized for a 24h poll in extreme cases (W up to 24h).
+		Buckets: prometheus.ExponentialBuckets(0.25, 2, 20),
+	},
+)
+
 func init() {
 	prometheus.MustRegister(
 		IndexReportsSent,
-		IndexReportProcessingDurationMilliseconds,
-		IndexReportBlockingEnqueueDurationMilliseconds,
 		IndexReportEnqueueBlockedTotal,
 		VMDiscoveredData,
 		IndexReportAcksReceived,
@@ -237,8 +334,19 @@ func init() {
 		PullTickDurationSeconds,
 		PullReportBytes,
 		PullReportPackages,
-		PullRequestsTotal,
+		PullTransportTotal,
+		PullGetReportTotal,
+		PullScrapeTotal,
+		PullSyncTotal,
 		PullTicksTotal,
 		PullTrackedVMs,
+		PullTrackedVMsByMappingPath,
+		PullDueVMs,
+		PullStartsPerTick,
+		PullForwardInterarrivalSeconds,
+		PullScheduleOffsetSeconds,
 	)
+	for _, path := range []string{MappingPathSensor, MappingPathURL, MappingPathUnspecified} {
+		PullTrackedVMsByMappingPath.WithLabelValues(path).Set(0)
+	}
 }
diff --git a/sensor/common/virtualmachine/virtualmachineinfo.go b/sensor/common/virtualmachine/virtualmachineinfo.go
index eddc96716a01e..9dee29197cd11 100644
--- a/sensor/common/virtualmachine/virtualmachineinfo.go
+++ b/sensor/common/virtualmachine/virtualmachineinfo.go
@@ -1,5 +1,7 @@
 package virtualmachine
 
+import "maps"
+
 type VMID string
 
 // Info information about a VirtualMachine
@@ -22,6 +24,8 @@ type Info struct {
 	BootOrder []string
 	// CDRomDisks lists disk names with CD-ROM devices.
 	CDRomDisks []string
+	// AgentFacts are roxagent-derived facts merged into the VM facts map.
+	AgentFacts map[string]string
 }
 
 // Key returns the identifier ("namespace/name") used to correlate this VM
@@ -61,5 +65,8 @@ func (v *Info) Copy() *Info {
 	if len(v.CDRomDisks) > 0 {
 		ret.CDRomDisks = append([]string(nil), v.CDRomDisks...)
 	}
+	if v.AgentFacts != nil {
+		ret.AgentFacts = maps.Clone(v.AgentFacts)
+	}
 	return ret
 }
diff --git a/sensor/common/virtualmachine/vmscraper/budget.go b/sensor/common/virtualmachine/vmscraper/budget.go
new file mode 100644
index 0000000000000..a0c04e907cd22
--- /dev/null
+++ b/sensor/common/virtualmachine/vmscraper/budget.go
@@ -0,0 +1,17 @@
+package vmscraper
+
+import (
+	"time"
+)
+
+// startBudget is max(1, ceil(n × tick / window)) for positive n, tick, and
+// window. n is tracked fleet size so a leftover due pile keeps a stable drain
+// rate. Zero otherwise so a missing window does not start a scrape.
+func startBudget(n int, tick, window time.Duration) int {
+	if n <= 0 || tick <= 0 || window <= 0 {
+		return 0
+	}
+	num := int64(n) * int64(tick)
+	den := int64(window)
+	return max(1, int((num+den-1)/den))
+}
diff --git a/sensor/common/virtualmachine/vmscraper/budget_test.go b/sensor/common/virtualmachine/vmscraper/budget_test.go
new file mode 100644
index 0000000000000..f9ad40acda9f9
--- /dev/null
+++ b/sensor/common/virtualmachine/vmscraper/budget_test.go
@@ -0,0 +1,48 @@
+package vmscraper
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStartBudget(t *testing.T) {
+	t.Parallel()
+
+	tick := 10 * time.Second
+	cases := map[string]struct {
+		n      int
+		tick   time.Duration
+		window time.Duration
+		want   int
+	}{
+		"n=100 catchUp=20m -> 1": {
+			n: 100, tick: tick, window: 20 * time.Minute, want: 1,
+		},
+		"n=100 steadyWidth=40m -> 1": {
+			n: 100, tick: tick, window: 40 * time.Minute, want: 1,
+		},
+		"n=100 window=5m -> ceil(100*10/300)=4": {
+			n: 100, tick: tick, window: 5 * time.Minute, want: 4,
+		},
+		"n=1 catchUp=20m -> max(1, ceil)": {
+			n: 1, tick: tick, window: 20 * time.Minute, want: 1,
+		},
+		"n=0 -> 0": {
+			n: 0, tick: tick, window: 20 * time.Minute, want: 0,
+		},
+		"zero window -> 0": {
+			n: 10, tick: tick, window: 0, want: 0,
+		},
+		"zero tick -> 0": {
+			n: 10, tick: 0, window: 20 * time.Minute, want: 0,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			assert.Equal(t, tc.want, startBudget(tc.n, tc.tick, tc.window))
+		})
+	}
+}
diff --git a/sensor/common/virtualmachine/vmscraper/facts.go b/sensor/common/virtualmachine/vmscraper/facts.go
new file mode 100644
index 0000000000000..6c05c550e8381
--- /dev/null
+++ b/sensor/common/virtualmachine/vmscraper/facts.go
@@ -0,0 +1,29 @@
+package vmscraper
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/metrics"
+)
+
+// logAndRecordDiscoveredFacts logs and records metrics for the VM facts
+// (detected OS, activation status, DNF metadata status) that roxagent reports
+// alongside every pulled index report.
+func logAndRecordDiscoveredFacts(key string, facts map[string]string) {
+	if len(facts) == 0 {
+		return
+	}
+
+	detectedOS := facts["detected_os"]
+	osVersion := facts["os_version"]
+	activationStatus := facts["activation_status"]
+	dnfMetadataStatus := facts["dnf_metadata_status"]
+
+	log.Debugf("VMScraper: VM discovered data for %q: detected_os=%s, os_version=%q, activation_status=%s, dnf_metadata_status=%s",
+		key, detectedOS, osVersion, activationStatus, dnfMetadataStatus)
+
+	metrics.VMDiscoveredData.With(prometheus.Labels{
+		"detected_os":         detectedOS,
+		"activation_status":   activationStatus,
+		"dnf_metadata_status": dnfMetadataStatus,
+	}).Inc()
+}
diff --git a/sensor/common/virtualmachine/vmscraper/facts_test.go b/sensor/common/virtualmachine/vmscraper/facts_test.go
new file mode 100644
index 0000000000000..9738af4dbe9c8
--- /dev/null
+++ b/sensor/common/virtualmachine/vmscraper/facts_test.go
@@ -0,0 +1,30 @@
+package vmscraper
+
+import (
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/metrics"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLogAndRecordDiscoveredFacts(t *testing.T) {
+	t.Run("empty facts map records nothing", func(t *testing.T) {
+		before := testutil.ToFloat64(metrics.VMDiscoveredData.WithLabelValues("RHEL", "ACTIVE", "AVAILABLE"))
+		logAndRecordDiscoveredFacts("ns/vm-empty", nil)
+		assert.Equal(t, before, testutil.ToFloat64(metrics.VMDiscoveredData.WithLabelValues("RHEL", "ACTIVE", "AVAILABLE")))
+	})
+
+	t.Run("populated facts increment discovered data metric", func(t *testing.T) {
+		facts := map[string]string{
+			"detected_os":         "RHEL",
+			"os_version":          "9.7",
+			"activation_status":   "ACTIVE",
+			"dnf_metadata_status": "AVAILABLE",
+		}
+
+		before := testutil.ToFloat64(metrics.VMDiscoveredData.WithLabelValues("RHEL", "ACTIVE", "AVAILABLE"))
+		logAndRecordDiscoveredFacts("ns/vm-1", facts)
+		assert.Equal(t, before+1, testutil.ToFloat64(metrics.VMDiscoveredData.WithLabelValues("RHEL", "ACTIVE", "AVAILABLE")))
+	})
+}
diff --git a/sensor/common/virtualmachine/vmscraper/schedule.go b/sensor/common/virtualmachine/vmscraper/schedule.go
index 7f62472d748a4..15f4438ed2065 100644
--- a/sensor/common/virtualmachine/vmscraper/schedule.go
+++ b/sensor/common/virtualmachine/vmscraper/schedule.go
@@ -10,6 +10,10 @@ const (
 	maxReconcile   = 5 * time.Minute
 	// defaultTickInterval is the scraper scheduler step. Independent of retry-backoff.
 	defaultTickInterval = 10 * time.Second
+	// maxNewVMIndexReportWindow caps the schedule window for a newly added VM's
+	// first index report when the poll interval is long.
+	maxNewVMIndexReportWindow         = 20 * time.Minute
+	newVMIndexReportWindowPollDivisor = 3
 )
 
 func backoffCap(pollInterval time.Duration) time.Duration {
@@ -28,3 +32,35 @@ func nextBackoff(current, pollInterval, initial time.Duration) time.Duration {
 	}
 	return min(current*2, limit)
 }
+
+// steadySpreadWidth is how wide the post-poll random band is when a VM
+// returns to normal cadence (spreadFraction × pollInterval).
+func steadySpreadWidth(pollInterval time.Duration, spreadFraction float64) time.Duration {
+	if pollInterval <= 0 || spreadFraction <= 0 {
+		return 0
+	}
+	return time.Duration(float64(pollInterval) * spreadFraction)
+}
+
+// newVMIndexReportWindow is the schedule window for a newly added VM's first
+// index report (min(maxNewVMIndexReportWindow, poll/3)).
+func newVMIndexReportWindow(pollInterval time.Duration) time.Duration {
+	if pollInterval <= 0 {
+		return 0
+	}
+	return min(maxNewVMIndexReportWindow, pollInterval/newVMIndexReportWindowPollDivisor)
+}
+
+// randOffset draws a delay in [0, max] from a unit sample in [0, 1].
+func randOffset(max time.Duration, unit float64) time.Duration {
+	if max <= 0 {
+		return 0
+	}
+	if unit < 0 {
+		unit = 0
+	}
+	if unit > 1 {
+		unit = 1
+	}
+	return time.Duration(float64(max) * unit)
+}
diff --git a/sensor/common/virtualmachine/vmscraper/schedule_test.go b/sensor/common/virtualmachine/vmscraper/schedule_test.go
index e22bf8da85726..fdc118dc03ea4 100644
--- a/sensor/common/virtualmachine/vmscraper/schedule_test.go
+++ b/sensor/common/virtualmachine/vmscraper/schedule_test.go
@@ -64,3 +64,26 @@ func TestReconcilePeriod(t *testing.T) {
 	assert.Equal(t, 5*time.Minute, reconcilePeriod(time.Hour))
 	assert.Equal(t, time.Minute, reconcilePeriod(time.Minute))
 }
+
+func TestSteadySpreadWidth(t *testing.T) {
+	t.Parallel()
+	assert.Equal(t, 40*time.Minute, steadySpreadWidth(time.Hour, 2.0/3))
+	assert.Equal(t, 0, int(steadySpreadWidth(time.Hour, 0)))
+	assert.Equal(t, 0, int(steadySpreadWidth(0, 2.0/3)))
+}
+
+func TestNewVMIndexReportWindow(t *testing.T) {
+	t.Parallel()
+	assert.Equal(t, maxNewVMIndexReportWindow, newVMIndexReportWindow(time.Hour))
+	assert.Equal(t, 100*time.Second, newVMIndexReportWindow(5*time.Minute))
+	assert.Equal(t, time.Duration(0), newVMIndexReportWindow(0))
+}
+
+func TestRandOffset(t *testing.T) {
+	t.Parallel()
+	assert.Equal(t, time.Duration(0), randOffset(0, 0.5))
+	assert.Equal(t, 20*time.Minute, randOffset(40*time.Minute, 0.5))
+	assert.Equal(t, time.Duration(0), randOffset(40*time.Minute, 0))
+	assert.Equal(t, 40*time.Minute, randOffset(40*time.Minute, 1))
+	assert.Equal(t, time.Duration(0), randOffset(40*time.Minute, -1))
+}
diff --git a/sensor/common/virtualmachine/vmscraper/scraper.go b/sensor/common/virtualmachine/vmscraper/scraper.go
index aa1811e688b19..b4e5b119af6dd 100644
--- a/sensor/common/virtualmachine/vmscraper/scraper.go
+++ b/sensor/common/virtualmachine/vmscraper/scraper.go
@@ -3,20 +3,27 @@ package vmscraper
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
+	"maps"
+	"math/rand"
+	"strconv"
 	"strings"
 	"sync/atomic"
 	"time"
 
 	"github.com/stackrox/rox/generated/internalapi/central"
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
 	"github.com/stackrox/rox/pkg/centralsensor"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stackrox/rox/sensor/common"
+	"github.com/stackrox/rox/sensor/common/centralcaps"
 	"github.com/stackrox/rox/sensor/common/message"
 	"github.com/stackrox/rox/sensor/common/virtualmachine"
 	"github.com/stackrox/rox/sensor/common/virtualmachine/metrics"
@@ -27,13 +34,19 @@ import (
 )
 
 var (
-	log                  = logging.LoggerForModule()
-	errStartMoreThanOnce = errors.New("unable to start the VM scraper more than once")
+	log                       = logging.LoggerForModule()
+	errStartMoreThanOnce      = errors.New("unable to start the VM scraper more than once")
+	errCapabilityNotSupported = errors.New("Central does not have virtual machine capability")
+	errCentralNotReachable    = errors.New("Central is not reachable")
 )
 
-// minPollInterval clamps ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL to avoid
-// accidental high-churn vsock polling.
-const minPollInterval = time.Minute
+const (
+	// minPollInterval clamps ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL to avoid
+	// accidental high-churn vsock polling.
+	minPollInterval = time.Minute
+
+	sendNotImplementedLogLimiter = "vm-scraper-send-not-implemented"
+)
 
 func getVsockPort() uint32 {
 	return uint32(env.VirtualMachinesVsockPort.IntegerSetting())
@@ -52,6 +65,8 @@ func clampPollInterval(interval time.Duration) time.Duration {
 type RunningVMStore interface {
 	ListRunning() []*virtualmachine.Info
 	Get(id virtualmachine.VMID) *virtualmachine.Info
+	AddOrUpdate(vm *virtualmachine.Info) *virtualmachine.Info
+	SetAgentFacts(id virtualmachine.VMID, facts map[string]string)
 }
 
 // VMDialer connects to a VM's VSOCK port.
@@ -59,22 +74,39 @@ type VMDialer interface {
 	Dial(ctx context.Context, namespace, name string, port uint32, useTLS bool) (io.ReadWriteCloser, error)
 }
 
-// IndexReportSender sends index reports toward Central.
-type IndexReportSender interface {
-	Send(ctx context.Context, vm *virtualmachine.Info, report *v4.IndexReport) error
-}
-
 // ProtocolClient performs the request/response protocol over a stream.
 type ProtocolClient interface {
-	GetReport(ctx context.Context, stream io.ReadWriteCloser, ifNewerThan uint32, knownEpoch uint32) (*vsockclient.GetReportResult, error)
+	GetReport(ctx context.Context, stream io.ReadWriteCloser, lastKnownToken string) (*vsockclient.GetReportResult, error)
+	SyncRepoCPEMapping(ctx context.Context, stream io.ReadWriteCloser, mapping []byte) (updated bool, meta *pb.ResponseMeta, err error)
+}
+
+// Repo2CPEFetcher supplies Sensor's cached repo-to-CPE mapping so maybeSyncRepoCPEMapping
+// can tell whether a VM's agent needs a pushed update.
+type Repo2CPEFetcher interface {
+	FetchRepo2CPE(ctx context.Context) (mapping []byte, hash string, ok bool)
+}
+
+type clusterIDGetter interface {
+	GetNoWait() string
+}
+
+// closeCoder is satisfied by transport errors carrying a structured close
+// code. Declared locally so VMScraper doesn't need to import a concrete
+// dialer's error type to recognize one.
+type closeCoder interface {
+	error
+	CloseCode() (code int, reason string)
 }
 
 // VMScraper polls running VMs and pulls their scan reports via VSOCK.
 type VMScraper struct {
 	store                 RunningVMStore
-	sender                IndexReportSender
 	dialer                VMDialer
 	client                ProtocolClient
+	repo2CPEFetcher       Repo2CPEFetcher
+	clusterID             clusterIDGetter
+	toCentral             chan *message.ExpiringMessage
+	centralReady          concurrency.Signal
 	interval              time.Duration
 	tickInterval          time.Duration
 	initialBackoff        time.Duration
@@ -82,36 +114,55 @@ type VMScraper struct {
 	perVMTimeout          time.Duration
 	mandatoryRefreshAfter time.Duration
 	concurrency           int
+	spreadFraction        float64
 	warnMaxBytes          int
 	stopper               concurrency.Stopper
 	started               atomic.Bool
-	now                   func() time.Time
+	// loggedSkip is set after the first skip log for a feature-disabled stretch
+	// so a 10s ticker does not repeat it until Central is reachable again.
+	loggedSkip atomic.Bool
+	// indexReportsDisabled is set from a feature-disabled ACK and cleared on
+	// CentralReachable so a later connection can scrape again.
+	indexReportsDisabled atomic.Bool
+	now                  func() time.Time
+	// randFloat64 returns a unit sample in [0, 1] for schedule offsets; tests inject a fixed source.
+	randFloat64          func() float64
+	lastSpreadWarnNumVMs int
 
-	mu            sync.Mutex
-	vmState       map[string]*vmState
-	lastReconcile time.Time
-	inFlight      set.StringSet
+	mu              sync.Mutex
+	vmState         map[string]*vmState
+	lastReconcile   time.Time
+	inFlight        set.StringSet
+	lastForwardTime time.Time // Sensor-level; for forward interarrival metric
 }
 
 type vmState struct {
-	lastGeneration  uint32
-	lastEpoch       uint32
-	lastForwardedAt time.Time
-	nextAttemptAt   time.Time
-	backoff         time.Duration
-	vmID            virtualmachine.VMID
+	lastToken        string
+	lastForwardedAt  time.Time
+	nextAttemptAt    time.Time
+	backoff          time.Duration
+	vmID             virtualmachine.VMID
+	lastAgentVersion string
+	// mappingPath is the last RepoCPEMappingUpdatePath seen in ResponseMeta
+	// for this slot (sensor/url/unspecified). New and recreated slots start
+	// unspecified until a scrape with meta arrives.
+	mappingPath string
 }
 
 var _ common.SensorComponent = (*VMScraper)(nil)
 
-// New creates a VMScraper with production defaults.
-func New(store RunningVMStore, sender IndexReportSender, dialer VMDialer, client ProtocolClient) *VMScraper {
+// New creates a VMScraper with production defaults. A nil repo2CPEFetcher leaves
+// maybeSyncRepoCPEMapping a no-op, so pull still works if the repo-to-CPE cache was not built.
+func New(store RunningVMStore, dialer VMDialer, client ProtocolClient, repo2CPEFetcher Repo2CPEFetcher, clusterID clusterIDGetter) *VMScraper {
 	interval := clampPollInterval(env.VirtualMachinesScraperPollInterval.DurationSetting())
 	return &VMScraper{
 		store:                 store,
-		sender:                sender,
 		dialer:                dialer,
 		client:                client,
+		repo2CPEFetcher:       repo2CPEFetcher,
+		clusterID:             clusterID,
+		toCentral:             make(chan *message.ExpiringMessage, env.VirtualMachinesIndexReportsBufferSize.IntegerSetting()),
+		centralReady:          concurrency.NewSignal(),
 		interval:              interval,
 		tickInterval:          env.VirtualMachinesScraperTickInterval.DurationSetting(),
 		initialBackoff:        env.VirtualMachinesScraperInitialBackoff.DurationSetting(),
@@ -119,6 +170,7 @@ func New(store RunningVMStore, sender IndexReportSender, dialer VMDialer, client
 		perVMTimeout:          env.VirtualMachinesScraperPerVMTimeout.DurationSetting(),
 		mandatoryRefreshAfter: env.VirtualMachinesScraperMandatoryRefreshInterval.DurationSetting(),
 		concurrency:           env.VirtualMachinesScraperConcurrency.IntegerSetting(),
+		spreadFraction:        env.VirtualMachinesScraperSteadySpreadFraction.FloatSetting(),
 		// Warn once a report is halfway to the hard response-size ceiling,
 		// so operators get advance notice before reports start actually
 		// being rejected at that limit.
@@ -126,6 +178,7 @@ func New(store RunningVMStore, sender IndexReportSender, dialer VMDialer, client
 		vmState:      make(map[string]*vmState),
 		inFlight:     set.NewStringSet(),
 		now:          time.Now,
+		randFloat64:  rand.Float64,
 	}
 }
 
@@ -144,8 +197,19 @@ func (s *VMScraper) Stop() {
 	s.stopper.Client().Stop()
 }
 
-func (s *VMScraper) Capabilities() []centralsensor.SensorCapability { return nil }
-func (s *VMScraper) Notify(_ common.SensorComponentEvent)           {}
+func (s *VMScraper) Capabilities() []centralsensor.SensorCapability {
+	return []centralsensor.SensorCapability{centralsensor.SensorACKSupport}
+}
+
+func (s *VMScraper) Notify(e common.SensorComponentEvent) {
+	switch e {
+	case common.SensorComponentEventCentralReachable:
+		s.centralReady.Signal()
+		s.indexReportsDisabled.Store(false)
+	case common.SensorComponentEventOfflineMode:
+		s.centralReady.Reset()
+	}
+}
 
 // Accepts reports whether this component wants to see SensorACK messages
 // for VM index reports.
@@ -166,6 +230,10 @@ func (s *VMScraper) ProcessMessage(_ context.Context, msg *central.MsgToSensor)
 
 	switch sensorAck.GetAction() {
 	case central.SensorACK_ACK:
+		if sensorAck.GetReason() == centralsensor.SensorACKReasonFeatureDisabled {
+			s.handleFeatureDisabled()
+			break
+		}
 		log.Debugf("VMScraper: received acknowledgement for resource_id=%q", sensorAck.GetResourceId())
 	case central.SensorACK_NACK:
 		s.handleNACK(sensorAck.GetResourceId())
@@ -175,11 +243,20 @@ func (s *VMScraper) ProcessMessage(_ context.Context, msg *central.MsgToSensor)
 	return nil
 }
 
-// handleNACK clears the cached generation and applies the shared backoff so
-// the next tick resends a full report without tight-looping on persistent NACKs.
-//
-// Race with commitVMState after Send is accepted (same class as today's
-// lastGeneration race): a fast NACK may be overwritten by a late success commit.
+// handleFeatureDisabled stops index pulls for this connection. CentralReachable
+// clears the flag so a later Central can be tried without a Sensor restart.
+func (s *VMScraper) handleFeatureDisabled() {
+	if s.indexReportsDisabled.Swap(true) {
+		return
+	}
+	log.Infof(
+		"VMScraper: Central ACKed a VM index report with reason %q; stopping index pulls for this connection to save resources",
+		centralsensor.SensorACKReasonFeatureDisabled,
+	)
+}
+
+// handleNACK clears lastToken and applies retry backoff so the next tick
+// resends a full report without tight-looping on persistent NACKs.
 func (s *VMScraper) handleNACK(resourceID string) {
 	key := s.findKeyByVMID(vmIDFromResourceID(resourceID))
 	if key == "" {
@@ -193,14 +270,14 @@ func (s *VMScraper) handleNACK(resourceID string) {
 		if !exists {
 			return false
 		}
-		state.lastGeneration = 0
+		state.lastToken = ""
 		state.backoff = nextBackoff(state.backoff, s.interval, s.initialBackoff)
 		state.nextAttemptAt = s.now().Add(state.backoff)
 		backoff = state.backoff
 		return true
 	})
 	if ok {
-		log.Infof("VMScraper: NACK for %q; cleared generation, next attempt in %s", key, backoff)
+		log.Infof("VMScraper: NACK for %q; cleared token, next attempt in %s", key, backoff)
 	}
 }
 
@@ -224,12 +301,18 @@ func vmIDFromResourceID(resourceID string) string {
 	return vmID
 }
 
-func (s *VMScraper) ResponsesC() <-chan *message.ExpiringMessage { return nil }
+func (s *VMScraper) ResponsesC() <-chan *message.ExpiringMessage { return s.toCentral }
 
 func (s *VMScraper) run() {
 	defer s.stopper.Flow().ReportStopped()
 	ctx := concurrency.AsContext(s.stopper.LowLevel().GetStopRequestSignal())
 
+	// Block until stop: there is nothing to poll, but the component stays registered.
+	if s.dialer == nil || s.client == nil {
+		<-ctx.Done()
+		return
+	}
+
 	// Reconcile + scrape immediately so VMs don't wait a full tick on start.
 	s.tick(ctx, true)
 
@@ -247,6 +330,17 @@ func (s *VMScraper) run() {
 }
 
 func (s *VMScraper) tick(ctx context.Context, forceReconcile bool) {
+	if s.indexReportsDisabled.Load() {
+		if s.loggedSkip.CompareAndSwap(false, true) {
+			log.Infof("VMScraper: skipping pulling index reports from VMs; Central ACKed feature disabled")
+		}
+		return
+	}
+	if !centralcaps.Has(centralsensor.VirtualMachinesSupported) {
+		return
+	}
+	s.loggedSkip.Store(false)
+
 	tickStart := s.now()
 	reconcile := forceReconcile
 	if !reconcile {
@@ -259,11 +353,24 @@ func (s *VMScraper) tick(ctx context.Context, forceReconcile bool) {
 	}
 
 	due := s.dueKeys()
-	log.Debugf("VMScraper: tick: %d due VMs %v (concurrency=%d, reconcile=%v)", len(due), due, s.concurrency, reconcile)
-	metrics.PullTicksTotal.Inc()
-	concurrency.WithLock(&s.mu, func() {
-		metrics.PullTrackedVMs.Set(float64(len(s.vmState)))
+	nDue := len(due)
+	// Mapping-path gauges are rewritten on reconcile, removal, and path updates.
+	nTracked := concurrency.WithLock1(&s.mu, func() int {
+		return len(s.vmState)
 	})
+	metrics.PullDueVMs.Set(float64(nDue))
+	capN := min(s.concurrency, startBudget(nTracked, s.tickInterval, newVMIndexReportWindow(s.interval)))
+	if capN < nDue {
+		due = due[:capN]
+	}
+	started := len(due)
+	// Idle ticks stay silent so a 10s scheduler step does not look like an empty cluster.
+	if started > 0 {
+		log.Debugf("VMScraper: tick: %d due of %d tracked, starting %d %v (concurrency=%d, reconcile=%v)",
+			nDue, nTracked, started, due, s.concurrency, reconcile)
+		metrics.PullStartsPerTick.Observe(float64(started))
+	}
+	metrics.PullTicksTotal.Inc()
 
 	var successCount atomic.Int32
 	g, gCtx := errgroup.WithContext(ctx)
@@ -280,32 +387,73 @@ func (s *VMScraper) tick(ctx context.Context, forceReconcile bool) {
 	_ = g.Wait()
 
 	elapsed := s.now().Sub(tickStart)
-	log.Debugf("VMScraper: tick done: %d/%d due VMs succeeded in %s", successCount.Load(), len(due), elapsed.Truncate(time.Millisecond))
+	if started > 0 {
+		log.Debugf("VMScraper: tick done: %d/%d started of %d tracked succeeded in %s",
+			successCount.Load(), started, nTracked, elapsed.Truncate(time.Millisecond))
+	}
 	metrics.PullTickDurationSeconds.Observe(elapsed.Seconds())
 }
 
+// reconcile syncs vmState with currently running VMs: drop gone ones, and
+// schedule first attempts for new ones across the initial scan window (new
+// guests are often still booting; Sensor restart rehydrates many at once).
 func (s *VMScraper) reconcile() {
 	vms := s.store.ListRunning()
 	liveKeys := set.NewStringSet()
+	var numVMs int
 	concurrency.WithLock(&s.mu, func() {
 		now := s.now()
+		newVMWindow := newVMIndexReportWindow(s.interval)
 		for _, vm := range vms {
 			key := vm.Key()
 			liveKeys.Add(key)
 			st, ok := s.vmState[key]
 			if !ok {
-				st = &vmState{nextAttemptAt: now, vmID: vm.ID}
+				nextAt := now.Add(randOffset(newVMWindow, s.randFloat64()))
+				st = &vmState{
+					nextAttemptAt: nextAt,
+					vmID:          vm.ID,
+					mappingPath:   metrics.MappingPathUnspecified,
+				}
+				s.vmState[key] = st
+				log.Infof("VMScraper: queued %q for first index pull in %s (spread window %s)",
+					key, nextAt.Sub(now), newVMWindow)
+			} else if st.vmID != vm.ID {
+				// namespace/name can outlive a KubeVirt recreate; do not inherit scrape state.
+				st = &vmState{
+					nextAttemptAt: now,
+					vmID:          vm.ID,
+					mappingPath:   metrics.MappingPathUnspecified,
+				}
 				s.vmState[key] = st
+				log.Infof("VMScraper: re-queued %q for index pull (VM identity changed)", key)
 			}
-			st.vmID = vm.ID
 		}
 		for key := range s.vmState {
 			if !liveKeys.Contains(key) {
 				delete(s.vmState, key)
 			}
 		}
+		numVMs = len(s.vmState)
 		s.lastReconcile = now
+		s.setTrackedVMGaugesNoLock()
 	})
+	s.warnIfSpreadSaturated(numVMs)
+}
+
+// warnIfSpreadSaturated logs when running VMs exceed what this Sensor's
+// cadence spread can serialize at one scrape per tick.
+func (s *VMScraper) warnIfSpreadSaturated(numVMs int) {
+	if s.tickInterval <= 0 || s.lastSpreadWarnNumVMs == numVMs {
+		return
+	}
+	s.lastSpreadWarnNumVMs = numVMs
+	capacity := int(steadySpreadWidth(s.interval, s.spreadFraction) / s.tickInterval)
+	if capacity <= 0 || numVMs <= capacity {
+		return
+	}
+	log.Warnf("VMScraper: %d running VMs exceed what ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL=%s can space out on this Sensor (about %d); index reports may be forwarded in bursts.",
+		numVMs, s.interval, capacity)
 }
 
 func (s *VMScraper) dueKeys() []string {
@@ -347,7 +495,10 @@ func (s *VMScraper) scrapeKey(ctx context.Context, key string) bool {
 	vm := s.store.Get(vmID)
 	if vm == nil || !vm.Running {
 		concurrency.WithLock(&s.mu, func() {
-			delete(s.vmState, key)
+			if st, ok := s.vmState[key]; ok && st.vmID == vmID {
+				delete(s.vmState, key)
+				s.setTrackedVMGaugesNoLock()
+			}
 		})
 		return false
 	}
@@ -363,25 +514,22 @@ func (s *VMScraper) scrapeVM(ctx context.Context, vm *virtualmachine.Info) bool
 	}
 	log.Infof("VMScraper: scraping %q (reason=%s backoff=%s)", key, reason, snap.backoff)
 
-	vmCtx, cancel := context.WithTimeout(ctx, s.perVMTimeout)
-	defer cancel()
-
 	totalStart := s.now()
 	port := getVsockPort()
 
 	// The mandatory refresh is a deterministic, time-based decision Sensor
 	// can make before dialing at all, so request the full report on this
 	// round trip instead of asking "anything newer?" and dialing again.
-	ifNewerThan, knownEpoch := snap.lastGeneration, snap.lastEpoch
+	lastKnownToken := snap.lastToken
 	mandatoryRefreshDue := s.now().Sub(snap.lastForwardedAt) > s.mandatoryRefreshAfter
 	if mandatoryRefreshDue {
-		ifNewerThan, knownEpoch = 0, 0
+		lastKnownToken = ""
 	}
 
 	log.Debugf("VMScraper: dialing roxagent on %q with TLS", key)
-	result, outcome := s.dialAndGetReport(vmCtx, vm, key, port, ifNewerThan, knownEpoch)
+	result, outcome := s.dialAndGetReport(ctx, vm, key, port, lastKnownToken)
 	if outcome != scrapeOK {
-		next := s.scheduleAfterAttempt(key, outcome)
+		next := s.scheduleAfterAttempt(key, vm.ID, outcome)
 		kind := "retryable"
 		if outcome == scrapeNonRetryable {
 			kind = "non-retryable"
@@ -391,10 +539,11 @@ func (s *VMScraper) scrapeVM(ctx context.Context, vm *virtualmachine.Info) bool
 	}
 
 	if result.Unchanged {
-		next := s.scheduleAfterAttempt(key, scrapeOK)
+		s.forwardAgentFactsIfChanged(ctx, vm, result.Meta)
+		next := s.scheduleAfterAttempt(key, vm.ID, scrapeOK)
 		log.Infof("VMScraper: scrape %q ok outcome=unchanged next=%s", key, next)
-		log.Debugf("VMScraper: unchanged report from roxagent on %q (generation=%d)", key, snap.lastGeneration)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusUnchanged).Inc()
+		log.Debugf("VMScraper: unchanged report from roxagent on %q (token=%s)", key, snap.lastToken)
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportUnchanged).Inc()
 		return true
 	}
 
@@ -403,8 +552,8 @@ func (s *VMScraper) scrapeVM(ctx context.Context, vm *virtualmachine.Info) bool
 		log.Warnf("VM report from %q: %s", key, warning)
 	}
 	if !viable {
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusInvalidReport).Inc()
-		next := s.scheduleAfterAttempt(key, scrapeNonRetryable)
+		metrics.PullScrapeTotal.WithLabelValues(metrics.PullScrapeInvalidReport).Inc()
+		next := s.scheduleAfterAttempt(key, vm.ID, scrapeNonRetryable)
 		log.Infof("VMScraper: scrape %q failed non-retryable next=%s", key, next)
 		return false
 	}
@@ -412,32 +561,64 @@ func (s *VMScraper) scrapeVM(ctx context.Context, vm *virtualmachine.Info) bool
 	reportSize := proto.Size(result.IndexReport)
 	metrics.PullReportBytes.Observe(float64(reportSize))
 	metrics.PullReportPackages.Observe(float64(len(result.IndexReport.GetContents().GetPackages())))
-	recordVMDiscoveredData(result.Meta.GetFacts())
+	logAndRecordDiscoveredFacts(key, result.Meta.GetFacts())
+	if mapped, ok := snapshotAgentFacts(result.Meta); ok {
+		vm.AgentFacts = mapped
+	}
 
-	if err := s.sender.Send(vmCtx, vm, result.IndexReport); err != nil {
-		log.Errorf("VMScraper: sending %q report to Central failed: %v", key, err)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusSendError).Inc()
+	// Mapping sync has its own deadline, so forward uses the scrape parent.
+	if err := s.forwardReport(ctx, vm, result.IndexReport); err != nil {
+		metrics.PullScrapeTotal.WithLabelValues(metrics.PullScrapeSendError).Inc()
+		outcome := scrapeRetryable
+		if errors.Is(err, errox.NotImplemented) {
+			logging.GetRateLimitedLogger().WarnL(sendNotImplementedLogLimiter,
+				"VMScraper: Central cannot consume VM index reports: %v", err)
+			outcome = scrapeNonRetryable
+		} else {
+			log.Errorf("VMScraper: sending %q report to Central failed: %v", key, err)
+		}
 		// Send failures are typically a transient Central connection issue, so
 		// retry on the short backoff rather than waiting a full poll interval.
-		next := s.scheduleAfterAttempt(key, scrapeRetryable)
-		log.Infof("VMScraper: scrape %q failed retryable next=%s", key, next)
+		next := s.scheduleAfterAttempt(key, vm.ID, outcome)
+		kind := "retryable"
+		if outcome == scrapeNonRetryable {
+			kind = "non-retryable"
+		}
+		log.Infof("VMScraper: scrape %q failed %s next=%s", key, kind, next)
 		return false
 	}
+	// Persist facts only after the UPDATE is queued so a dropped send
+	// retries on the next unchanged poll instead of looking like a no-op.
+	if s.tryEnqueueVMUpdate(vm) {
+		s.persistAgentFacts(vm, result.Meta)
+	}
 
-	newGen := result.Meta.GetReportGeneration()
-	s.commitVMState(key, newGen, result.Meta.GetEpoch())
-	next := s.scheduleAfterAttempt(key, scrapeOK)
+	newToken := result.Meta.GetReportToken()
+	next := s.commitVMState(key, vm.ID, snap.lastToken, snap.backoff, newToken, result.Meta.GetAgentVersion())
+	s.observeForwardInterarrival()
 
 	log.Infof("VMScraper: scrape %q ok outcome=forwarded next=%s", key, next)
 	totalElapsed := s.now().Sub(totalStart)
-	log.Debugf("VMScraper: successfully pulled report for %q: generation=%d, packages=%d, size=%d bytes, total=%s",
-		key, newGen, len(result.IndexReport.GetContents().GetPackages()), reportSize,
+	log.Debugf("VMScraper: successfully pulled report for %q: token=%s, packages=%d, size=%d bytes, total=%s",
+		key, newToken, len(result.IndexReport.GetContents().GetPackages()), reportSize,
 		totalElapsed.Truncate(time.Millisecond))
-	metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusSuccess).Inc()
+	metrics.PullScrapeTotal.WithLabelValues(metrics.PullScrapeSuccess).Inc()
 	metrics.PullTotalDurationSeconds.Observe(totalElapsed.Seconds())
 	return true
 }
 
+// observeForwardInterarrival records the Sensor-level gap between successful
+// forwards. The first forward after start does not observe a sample.
+func (s *VMScraper) observeForwardInterarrival() {
+	concurrency.WithLock(&s.mu, func() {
+		now := s.now()
+		if !s.lastForwardTime.IsZero() {
+			metrics.PullForwardInterarrivalSeconds.Observe(now.Sub(s.lastForwardTime).Seconds())
+		}
+		s.lastForwardTime = now
+	})
+}
+
 type scrapeOutcome int
 
 const (
@@ -447,11 +628,13 @@ const (
 )
 
 // scheduleAfterAttempt updates nextAttemptAt/backoff for key and returns the
-// delay until the next attempt (0 if the slot was dropped).
-func (s *VMScraper) scheduleAfterAttempt(key string, outcome scrapeOutcome) time.Duration {
+// delay until the next attempt (0 if the slot was dropped or belongs to another VM).
+// Retries use short exponential backoff; success / permanent failure return to
+// poll cadence with a random offset in [0, steadyWidth].
+func (s *VMScraper) scheduleAfterAttempt(key string, vmID virtualmachine.VMID, outcome scrapeOutcome) time.Duration {
 	return concurrency.WithLock1(&s.mu, func() time.Duration {
 		st, ok := s.vmState[key]
-		if !ok {
+		if !ok || st.vmID != vmID {
 			return 0
 		}
 		now := s.now()
@@ -461,92 +644,288 @@ func (s *VMScraper) scheduleAfterAttempt(key string, outcome scrapeOutcome) time
 			st.nextAttemptAt = now.Add(st.backoff)
 			return st.backoff
 		case scrapeOK, scrapeNonRetryable:
-			// Both return to the normal poll cadence without growing backoff.
 			st.backoff = 0
-			st.nextAttemptAt = now.Add(s.interval)
-			return s.interval
+			offset := randOffset(steadySpreadWidth(s.interval, s.spreadFraction), s.randFloat64())
+			metrics.PullScheduleOffsetSeconds.Observe(offset.Seconds())
+			delay := s.interval + offset
+			st.nextAttemptAt = now.Add(delay)
+			return delay
 		default:
 			return 0
 		}
 	})
 }
 
-// dialAndGetReport dials the VM and issues a single GetReport request,
-// recording dial/read latency metrics and classifying failures.
-func (s *VMScraper) dialAndGetReport(ctx context.Context, vm *virtualmachine.Info, key string, port, ifNewerThan, knownEpoch uint32) (*vsockclient.GetReportResult, scrapeOutcome) {
+// dialAndGetReport uses a separate perVMTimeout for GetReport and for the
+// mapping push so a slow report cannot abort the push.
+func (s *VMScraper) dialAndGetReport(ctx context.Context, vm *virtualmachine.Info, key string, port uint32, lastKnownToken string) (*vsockclient.GetReportResult, scrapeOutcome) {
+	reportCtx, cancel := context.WithTimeout(ctx, s.perVMTimeout)
+	defer cancel()
+
 	dialStart := s.now()
-	stream, err := s.dialer.Dial(ctx, vm.Namespace, vm.Name, port, true)
+	stream, err := s.dialer.Dial(reportCtx, vm.Namespace, vm.Name, port, true)
 	metrics.PullDialDurationSeconds.Observe(s.now().Sub(dialStart).Seconds())
 	if err != nil {
-		if ctx.Err() != nil {
+		if reportCtx.Err() != nil {
 			log.Warnf("VMScraper: dialing roxagent on %q timed out: %v", key, err)
-			metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusTimeout).Inc()
-			if errors.Is(ctx.Err(), context.Canceled) {
+			metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportTimeout).Inc()
+			if errors.Is(reportCtx.Err(), context.Canceled) {
 				// Parent cancel (Sensor stop): do not keep retrying on the short tick.
 				return nil, scrapeNonRetryable
 			}
 			return nil, scrapeRetryable
 		}
 		log.Warnf("VMScraper: dialing roxagent on %q failed: %v", key, err)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusDialError).Inc()
+		metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportDialError).Inc()
 		return nil, scrapeRetryable
 	}
 	defer func() { _ = stream.Close() }()
 
 	readStart := s.now()
-	result, err := s.client.GetReport(ctx, stream, ifNewerThan, knownEpoch)
+	result, err := s.client.GetReport(reportCtx, stream, lastKnownToken)
 	metrics.PullReadDurationSeconds.Observe(s.now().Sub(readStart).Seconds())
 	if err != nil {
-		return nil, s.handleGetReportError(ctx, key, err)
+		// Classify before cancel(): cancel() looks like Sensor stop to
+		// handleGetReportError.
+		outcome := s.handleGetReportError(reportCtx, key, err)
+		// MAPPING_REQUIRED is the only error whose Meta still needs
+		// inspecting: a VM with no mapping at all has nothing to report
+		// except this error, and it's the only way Sensor learns to push one.
+		if errors.Is(err, vsockclient.ErrMappingRequired) {
+			// maybeSyncRepoCPEMapping dials a second connection to the same agent, which
+			// enforces at most one connection at a time: this one must be
+			// closed first, not left to the deferred close on return.
+			_ = stream.Close()
+			cancel()
+			s.maybeSyncRepoCPEMapping(ctx, vm, key, port, resultMeta(result))
+		}
+		return nil, outcome
 	}
+	_ = stream.Close()
+	cancel()
+	s.maybeSyncRepoCPEMapping(ctx, vm, key, port, result.Meta)
 	return result, scrapeOK
 }
 
+// resultMeta returns result.Meta, tolerating a nil result: ProtocolClient
+// implementations are not required to populate a result on every error.
+func resultMeta(result *vsockclient.GetReportResult) *pb.ResponseMeta {
+	if result == nil {
+		return nil
+	}
+	return result.Meta
+}
+
 func (s *VMScraper) handleGetReportError(ctx context.Context, key string, err error) scrapeOutcome {
 	// Timed-out or cancelled reads surface here after Dial's deadline
 	// and/or GetReport's close-on-cancel. Prefer ctx.Err() so those land
 	// as timeout (matching the dial path) rather than as a protocol/read error.
 	if ctx.Err() != nil {
 		log.Warnf("VMScraper: reading report from %q timed out: %v", key, err)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusTimeout).Inc()
+		metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportTimeout).Inc()
 		if errors.Is(ctx.Err(), context.Canceled) {
 			return scrapeNonRetryable
 		}
 		return scrapeRetryable
 	}
+	var closeErr closeCoder
 	switch {
 	case errors.Is(err, vsockclient.ErrNotReady):
 		log.Debugf("VMScraper: roxagent on %q has not yet generated a report", key)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusNotReady).Inc()
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportNotReady).Inc()
+		return scrapeRetryable
+	case errors.Is(err, vsockclient.ErrMappingRequired):
+		log.Debugf("VMScraper: roxagent on %q has no repository-to-CPE mapping yet", key)
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportMappingRequired).Inc()
 		return scrapeRetryable
 	case errors.Is(err, vsockclient.ErrUnknownMethod):
 		log.Warnf("VMScraper: roxagent on %q does not support the GetReport method", key)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusUnknownMethod).Inc()
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportUnknownMethod).Inc()
 		return scrapeNonRetryable
+	case errors.Is(err, vsockclient.ErrBusy):
+		log.Infof("VMScraper: roxagent on %q is busy with another request: %v", key, err)
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportBusy).Inc()
+		return scrapeRetryable
 	case errors.Is(err, vsockclient.ErrInternal):
 		log.Warnf("VMScraper: roxagent on %q reported an internal error: %v", key, err)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusReadError).Inc()
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportInternalError).Inc()
+		return scrapeRetryable
+	case errors.Is(err, vsockclient.ErrMalformedRequest):
+		log.Warnf("VMScraper: roxagent on %q rejected the request as malformed: %v", key, err)
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportMalformedRequest).Inc()
+		return scrapeNonRetryable
+	case errors.Is(err, vsockclient.ErrRequestTooLarge):
+		log.Warnf("VMScraper: roxagent on %q rejected the request as too large: %v", key, err)
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportRequestTooLarge).Inc()
+		return scrapeNonRetryable
+	case errors.Is(err, vsockclient.ErrUnknownAgentError):
+		log.Warnf("VMScraper: roxagent on %q returned an error code this Sensor version doesn't recognize (possible version mismatch): %v", key, err)
+		metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportUnknownAgentError).Inc()
+		return scrapeRetryable
+	case isAbnormalClose(err, &closeErr):
+		// e.g. close code 1006, which is what a TLS handshake failure on the
+		// agent's side looks like from Sensor's end.
+		code, reason := closeErr.CloseCode()
+		log.Warnf("VMScraper: roxagent on %q connection closed abnormally (websocket close code %d: %s) — check roxagent's own logs on the VM for the cause",
+			key, code, reason)
+		metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportAbnormalClose).Inc()
 		return scrapeRetryable
 	case errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF):
 		log.Debugf("VMScraper: roxagent on %q connection closed (agent may be down or restarting): %v", key, err)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusReadError).Inc()
-		return scrapeRetryable
-	case errors.Is(err, vsockclient.ErrBusy):
-		log.Infof("VMScraper: roxagent on %q is busy with another request: %v", key, err)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusBusy).Inc()
+		metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportReadError).Inc()
 		return scrapeRetryable
 	default:
-		log.Warnf("VMScraper: protocol error for %q (possible version mismatch): %v", key, err)
-		metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusReadError).Inc()
-		// ErrUnknownMethod, the only permanent sentinel, is handled above, so
-		// any error reaching here is treated as transient.
+		log.Warnf("VMScraper: unexpected transport or framing error for %q: %v", key, err)
+		metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportUnexpected).Inc()
 		return scrapeRetryable
 	}
 }
 
+// closeCodeNormalClosure is the RFC 6455 status code (1000) for a graceful
+// websocket close. Declared to keep vmscraper decoupled from the transport
+// package.
+const closeCodeNormalClosure = 1000
+
+// isAbnormalClose reports a closeCoder whose close code is neither 0 nor
+// closeCodeNormalClosure (those fall through to the ordinary io.EOF branch).
+func isAbnormalClose(err error, target *closeCoder) bool {
+	if !errors.As(err, target) {
+		return false
+	}
+	code, _ := (*target).CloseCode()
+	return code != 0 && code != closeCodeNormalClosure
+}
+
+// maybeSyncRepoCPEMapping pushes a fresh mapping when the agent is
+// Sensor-managed and its reported hash is stale. A URL-managed agent with
+// a stale hash is only logged and counted, since Sensor doesn't own it.
+func (s *VMScraper) maybeSyncRepoCPEMapping(ctx context.Context, vm *virtualmachine.Info, key string, port uint32, meta *pb.ResponseMeta) {
+	if meta != nil {
+		s.recordMappingPath(key, meta.GetRepoCpeMappingUpdatePath())
+	}
+	updatePath := meta.GetRepoCpeMappingUpdatePath()
+	if updatePath == pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED {
+		return
+	}
+	if s.repo2CPEFetcher == nil {
+		return
+	}
+	mapping, sensorHash, ok := s.repo2CPEFetcher.FetchRepo2CPE(ctx)
+	if !ok {
+		return
+	}
+	if sensorHash == meta.GetRepoCpeMappingHash() {
+		log.Debugf("VMScraper: repo-to-CPE mapping on %q is up to date (hash=%s)", key, sensorHash)
+		return
+	}
+
+	switch updatePath {
+	case pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR:
+		s.syncRepoCPEMapping(ctx, vm, key, port, mapping)
+	case pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL:
+		log.Warnf("VMScraper: roxagent on %q reports a URL-managed repo-to-CPE mapping (hash=%s) that differs from Sensor's own cache (hash=%s)",
+			key, meta.GetRepoCpeMappingHash(), sensorHash)
+		metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncURLHashMismatch).Inc()
+	}
+}
+
+// recordMappingPath stores path on a live slot. Gauges are rewritten only
+// when the path changes; missing keys are ignored so a concurrent prune
+// cannot resurrect a slot.
+func (s *VMScraper) recordMappingPath(key string, path pb.RepoCPEMappingUpdatePath) {
+	label := mappingPathLabel(path)
+	concurrency.WithLock(&s.mu, func() {
+		st, ok := s.vmState[key]
+		if !ok || st.mappingPath == label {
+			return
+		}
+		st.mappingPath = label
+		s.setTrackedVMGaugesNoLock()
+	})
+}
+
+func mappingPathLabel(path pb.RepoCPEMappingUpdatePath) string {
+	switch path {
+	case pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR:
+		return metrics.MappingPathSensor
+	case pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL:
+		return metrics.MappingPathURL
+	default:
+		return metrics.MappingPathUnspecified
+	}
+}
+
+// setTrackedVMGaugesNoLock writes vsock_pull_tracked_vms and the three
+// by-mapping-path series from vmState so the labeled counts always sum
+// to the unlabeled gauge.
+func (s *VMScraper) setTrackedVMGaugesNoLock() {
+	counts := map[string]int{
+		metrics.MappingPathSensor:      0,
+		metrics.MappingPathURL:         0,
+		metrics.MappingPathUnspecified: 0,
+	}
+	for _, st := range s.vmState {
+		path := st.mappingPath
+		if path == "" {
+			path = metrics.MappingPathUnspecified
+		}
+		counts[path]++
+	}
+	metrics.PullTrackedVMs.Set(float64(len(s.vmState)))
+	for path, n := range counts {
+		metrics.PullTrackedVMsByMappingPath.WithLabelValues(path).Set(float64(n))
+	}
+}
+
+// syncRepoCPEMapping pushes mapping on a new connection (one request per
+// connection). The deadline is independent of GetReport's.
+func (s *VMScraper) syncRepoCPEMapping(ctx context.Context, vm *virtualmachine.Info, key string, port uint32, mapping []byte) {
+	syncCtx, cancel := context.WithTimeout(ctx, s.perVMTimeout)
+	defer cancel()
+	if syncCtx.Err() != nil {
+		log.Debugf("VMScraper: skipping repo-to-CPE mapping sync for %q: %v", key, syncCtx.Err())
+		metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout).Inc()
+		return
+	}
+	stream, err := s.dialer.Dial(syncCtx, vm.Namespace, vm.Name, port, true)
+	if err != nil {
+		if syncCtx.Err() != nil {
+			log.Warnf("VMScraper: dialing roxagent on %q for repo-to-CPE mapping sync timed out: %v", key, err)
+			metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout).Inc()
+			return
+		}
+		log.Warnf("VMScraper: dialing roxagent on %q for repo-to-CPE mapping sync failed: %v", key, err)
+		metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError).Inc()
+		return
+	}
+	defer func() { _ = stream.Close() }()
+
+	updated, _, err := s.client.SyncRepoCPEMapping(syncCtx, stream, mapping)
+	if err != nil {
+		// NOT_SENSOR_MANAGED should never happen here: maybeSyncRepoCPEMapping only takes
+		// the SENSOR path for agents it believes accept a push. Counting it
+		// (without retrying) turns a gating bug into a visible signal.
+		if errors.Is(err, vsockclient.ErrMappingNotSensorManaged) {
+			log.Warnf("VMScraper: roxagent on %q rejected repo-to-CPE mapping sync as not Sensor-managed", key)
+			metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncNotManaged).Inc()
+			return
+		}
+		if syncCtx.Err() != nil {
+			log.Warnf("VMScraper: repo-to-CPE mapping sync to %q timed out: %v", key, err)
+			metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout).Inc()
+			return
+		}
+		log.Warnf("VMScraper: repo-to-CPE mapping sync to %q failed: %v", key, err)
+		metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError).Inc()
+		return
+	}
+
+	log.Infof("VMScraper: synced repo-to-CPE mapping to %q (updated=%t)", key, updated)
+	metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncSuccess).Inc()
+}
+
 type vmStateSnapshot struct {
-	lastGeneration  uint32
-	lastEpoch       uint32
+	lastToken       string
 	lastForwardedAt time.Time
 	backoff         time.Duration
 }
@@ -561,43 +940,186 @@ func (s *VMScraper) snapshotVMState(key string) vmStateSnapshot {
 			return vmStateSnapshot{}
 		}
 		return vmStateSnapshot{
-			lastGeneration:  st.lastGeneration,
-			lastEpoch:       st.lastEpoch,
+			lastToken:       st.lastToken,
 			lastForwardedAt: st.lastForwardedAt,
 			backoff:         st.backoff,
 		}
 	})
 }
 
-// commitVMState records the generation/epoch from a just-sent report as key's cached scrape state.
-//
-// Race: If a NACK arrives from Central faster than this function completes, for example, due to:
-//   - a scheduling delay on the caller's goroutine between Send returning and this function
-//     acquiring `s.mu` (a GC pause, CPU throttling, or GOMAXPROCS contention),
-//   - contention on `s.mu` itself, from other concurrent scrapes or NACKs delaying this
-//     function's lock acquisition,
-//
-// then the NACK will overwrite lastGeneration / backoff / nextAttemptAt, and then this code
-// will set generation (and a later scheduleAfterAttempt(scrapeOK) will reset backoff schedule).
-// This race is accepted for v1 (same class as the historical lastGeneration-only race).
-func (s *VMScraper) commitVMState(key string, newGen, newEpoch uint32) {
-	concurrency.WithLock(&s.mu, func() {
+// commitVMState records the just-sent report's token and agent version and
+// applies poll-cadence scheduling in the same lock, so a concurrent NACK
+// that changed lastToken or backoff is not overwritten.
+func (s *VMScraper) commitVMState(key string, vmID virtualmachine.VMID, expectedToken string, expectedBackoff time.Duration, newToken string, agentVersion string) time.Duration {
+	return concurrency.WithLock1(&s.mu, func() time.Duration {
 		state, ok := s.vmState[key]
-		if !ok {
-			return
+		if !ok || state.vmID != vmID {
+			return 0
+		}
+		if state.lastToken != expectedToken || state.backoff != expectedBackoff {
+			return max(0, state.nextAttemptAt.Sub(s.now()))
 		}
-		state.lastGeneration = newGen
-		state.lastEpoch = newEpoch
-		state.lastForwardedAt = s.now()
+		now := s.now()
+		state.lastToken = newToken
+		state.lastForwardedAt = now
+		state.lastAgentVersion = agentVersion
+		state.backoff = 0
+		offset := randOffset(steadySpreadWidth(s.interval, s.spreadFraction), s.randFloat64())
+		metrics.PullScheduleOffsetSeconds.Observe(offset.Seconds())
+		delay := s.interval + offset
+		state.nextAttemptAt = now.Add(delay)
+		return delay
 	})
 }
 
-// recordVMDiscoveredData increments VMDiscoveredData from ResponseMeta.facts
-// keys written by roxagent (detected_os, activation_status, dnf_metadata_status).
-func recordVMDiscoveredData(facts map[string]string) {
-	metrics.VMDiscoveredData.WithLabelValues(
-		facts["detected_os"],
-		facts["activation_status"],
-		facts["dnf_metadata_status"],
-	).Inc()
+func (s *VMScraper) forwardReport(ctx context.Context, vm *virtualmachine.Info, report *v4.IndexReport) error {
+	if err := s.enqueueToCentral(ctx, newIndexReportMessage(vm, report)); err != nil {
+		return err
+	}
+	metrics.IndexReportsSent.With(metrics.StatusSuccessLabels).Inc()
+	return nil
+}
+
+func (s *VMScraper) enqueueToCentral(ctx context.Context, msg *message.ExpiringMessage) error {
+	if !centralcaps.Has(centralsensor.VirtualMachinesSupported) {
+		return errox.NotImplemented.CausedBy(errCapabilityNotSupported)
+	}
+	if !s.centralReady.IsDone() {
+		metrics.IndexReportsSent.With(metrics.StatusCentralNotReadyLabels).Inc()
+		return errox.ResourceExhausted.CausedBy(errCentralNotReachable)
+	}
+
+	select {
+	case <-ctx.Done():
+	case s.toCentral <- msg:
+		return nil
+	default:
+		metrics.IndexReportEnqueueBlockedTotal.Inc()
+	}
+
+	select {
+	case <-ctx.Done():
+		return fmt.Errorf("waiting to forward: %w", ctx.Err())
+	case s.toCentral <- msg:
+		return nil
+	}
+}
+
+func newIndexReportMessage(vm *virtualmachine.Info, report *v4.IndexReport) *message.ExpiringMessage {
+	var cidStr string
+	if vm.VSOCKCID != nil {
+		cidStr = strconv.FormatUint(uint64(*vm.VSOCKCID), 10)
+	}
+	indexReport := &pb.IndexReport{
+		VsockCid: cidStr,
+		VmId:     string(vm.ID),
+		IndexV4:  report,
+	}
+	return message.New(&central.MsgFromSensor{
+		Msg: &central.MsgFromSensor_Event{
+			Event: &central.SensorEvent{
+				Id:     string(vm.ID),
+				Action: central.ResourceAction_SYNC_RESOURCE,
+				Resource: &central.SensorEvent_VirtualMachineIndexReport{
+					VirtualMachineIndexReport: &pb.IndexReportEvent{
+						Id:    string(vm.ID),
+						Index: indexReport,
+					},
+				},
+			},
+		},
+	})
+}
+
+func (s *VMScraper) clusterIDString() string {
+	if s.clusterID == nil {
+		return ""
+	}
+	return s.clusterID.GetNoWait()
+}
+
+func (s *VMScraper) vmUpdateMessage(vm *virtualmachine.Info) *message.ExpiringMessage {
+	event := virtualmachine.SensorEvent(central.ResourceAction_UPDATE_RESOURCE, s.clusterIDString(), vm)
+	if event == nil {
+		return nil
+	}
+	return message.New(&central.MsgFromSensor{
+		Msg: &central.MsgFromSensor_Event{Event: event},
+	})
+}
+
+// tryEnqueueVMUpdate best-effort enqueues a facts UPDATE after a successful
+// index forward. It must not block: a second wait on toCentral would stall
+// the scrape if the buffer is full.
+func (s *VMScraper) tryEnqueueVMUpdate(vm *virtualmachine.Info) bool {
+	if vm == nil || vm.AgentFacts == nil {
+		return false
+	}
+	if s.storedAgentFactsEqual(vm.ID, vm.AgentFacts) {
+		return false
+	}
+	msg := s.vmUpdateMessage(vm)
+	if msg == nil {
+		return false
+	}
+	select {
+	case s.toCentral <- msg:
+		return true
+	default:
+		log.Debugf("VMScraper: agent facts for %q not forwarded; will retry", vm.Key())
+		return false
+	}
+}
+
+func (s *VMScraper) persistAgentFacts(vm *virtualmachine.Info, meta *pb.ResponseMeta) {
+	mapped, ok := snapshotAgentFacts(meta)
+	if !ok {
+		return
+	}
+	vm.AgentFacts = mapped
+	s.store.SetAgentFacts(vm.ID, mapped)
+}
+
+func (s *VMScraper) storedAgentFactsEqual(id virtualmachine.VMID, mapped map[string]string) bool {
+	var prev map[string]string
+	if stored := s.store.Get(id); stored != nil {
+		prev = stored.AgentFacts
+	}
+	return maps.Equal(prev, mapped)
+}
+
+// snapshotAgentFacts maps ResponseMeta onto AgentFacts. A non-empty result
+// replaces the last scrape as a whole; unspecified keys are omitted. ok is
+// false when nothing maps, so last-known values stay.
+func snapshotAgentFacts(meta *pb.ResponseMeta) (mapped map[string]string, ok bool) {
+	if meta == nil {
+		return nil, false
+	}
+	mapped = virtualmachine.AgentFactsFromResponse(meta.GetFacts(), meta.GetAgentVersion())
+	return mapped, len(mapped) > 0
+}
+
+// forwardAgentFactsIfChanged emits a VM update when roxagent facts changed
+// even if the index report is unchanged. The store is updated only after
+// enqueue succeeds so a failed send is retried on the next unchanged scrape.
+func (s *VMScraper) forwardAgentFactsIfChanged(ctx context.Context, vm *virtualmachine.Info, meta *pb.ResponseMeta) {
+	mapped, ok := snapshotAgentFacts(meta)
+	if !ok {
+		return
+	}
+	logAndRecordDiscoveredFacts(vm.Key(), meta.GetFacts())
+	if s.storedAgentFactsEqual(vm.ID, mapped) {
+		return
+	}
+	toSend := vm.Copy()
+	toSend.AgentFacts = mapped
+	msg := s.vmUpdateMessage(toSend)
+	if msg == nil {
+		return
+	}
+	if err := s.enqueueToCentral(ctx, msg); err != nil {
+		log.Debugf("VMScraper: agent facts for %q not forwarded; will retry: %v", vm.Key(), err)
+		return
+	}
+	s.store.SetAgentFacts(vm.ID, mapped)
 }
diff --git a/sensor/common/virtualmachine/vmscraper/scraper_test.go b/sensor/common/virtualmachine/vmscraper/scraper_test.go
index a53f3e72dc518..e2460edbba2ca 100644
--- a/sensor/common/virtualmachine/vmscraper/scraper_test.go
+++ b/sensor/common/virtualmachine/vmscraper/scraper_test.go
@@ -5,28 +5,41 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"sync/atomic"
 	"testing"
 	"testing/synctest"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/testutil"
 	"github.com/stackrox/rox/generated/internalapi/central"
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/centralsensor"
 	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/sync"
+	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
+	"github.com/stackrox/rox/sensor/common"
+	"github.com/stackrox/rox/sensor/common/centralcaps"
+	"github.com/stackrox/rox/sensor/common/message"
 	"github.com/stackrox/rox/sensor/common/virtualmachine"
 	"github.com/stackrox/rox/sensor/common/virtualmachine/metrics"
 	"github.com/stackrox/rox/sensor/common/virtualmachine/vsockclient"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
 )
 
 // --- Mocks ---
 
+// mockStore is used by concurrent scrape workers (persistAgentFacts calls
+// SetAgentFacts), so mu guards vms and listRunningCalls.
 type mockStore struct {
+	mu               sync.Mutex
 	vms              []*virtualmachine.Info
 	listRunningCalls int
 }
@@ -35,34 +48,69 @@ type mockStore struct {
 // with Running set, so tests exercise reconcile pruning rather than the
 // scrapeKey nil-VM guard when a VM stops running.
 func (m *mockStore) ListRunning() []*virtualmachine.Info {
-	m.listRunningCalls++
-	var out []*virtualmachine.Info
-	for _, vm := range m.vms {
-		if vm.Running {
-			out = append(out, vm)
+	return concurrency.WithLock1(&m.mu, func() []*virtualmachine.Info {
+		m.listRunningCalls++
+		var out []*virtualmachine.Info
+		for _, vm := range m.vms {
+			if vm.Running {
+				out = append(out, vm)
+			}
 		}
-	}
-	return out
+		return out
+	})
 }
 
 func (m *mockStore) Get(id virtualmachine.VMID) *virtualmachine.Info {
-	for _, vm := range m.vms {
-		if vm.ID == id {
-			return vm
+	return concurrency.WithLock1(&m.mu, func() *virtualmachine.Info {
+		for _, vm := range m.vms {
+			if vm.ID == id {
+				return vm.Copy()
+			}
 		}
+		return nil
+	})
+}
+
+func (m *mockStore) AddOrUpdate(vm *virtualmachine.Info) *virtualmachine.Info {
+	if vm == nil {
+		return nil
 	}
-	return nil
+	return concurrency.WithLock1(&m.mu, func() *virtualmachine.Info {
+		for i, existing := range m.vms {
+			if existing.ID != vm.ID {
+				continue
+			}
+			if vm.AgentFacts == nil {
+				vm.AgentFacts = existing.AgentFacts
+			}
+			m.vms[i] = vm
+			return vm
+		}
+		m.vms = append(m.vms, vm)
+		return vm
+	})
+}
+
+func (m *mockStore) SetAgentFacts(id virtualmachine.VMID, facts map[string]string) {
+	concurrency.WithLock(&m.mu, func() {
+		for _, vm := range m.vms {
+			if vm.ID != id {
+				continue
+			}
+			vm.AgentFacts = maps.Clone(facts)
+			return
+		}
+	})
 }
 
 type mockDialer struct {
 	err      error
 	errQueue []error
-	callIdx  int
+	callIdx  atomic.Int32
 }
 
 func (m *mockDialer) Dial(_ context.Context, _, _ string, _ uint32, _ bool) (io.ReadWriteCloser, error) {
-	idx := m.callIdx
-	m.callIdx++
+	idx := int(m.callIdx.Add(1) - 1)
 	if idx < len(m.errQueue) && m.errQueue[idx] != nil {
 		return nil, m.errQueue[idx]
 	}
@@ -87,24 +135,82 @@ func (nopCloser) Read([]byte) (int, error)  { return 0, io.EOF }
 func (nopCloser) Write([]byte) (int, error) { return 0, nil }
 func (nopCloser) Close() error              { return nil }
 
+// fakeCloseCoder is a minimal closeCoder for testing without a real dialer.
+type fakeCloseCoder struct {
+	code   int
+	reason string
+}
+
+func (e *fakeCloseCoder) Error() string            { return "connection closed" }
+func (e *fakeCloseCoder) CloseCode() (int, string) { return e.code, e.reason }
+
+// singleConnDialer rejects a Dial while a previously dialed stream is still
+// open, mirroring roxagent's real maxConcurrentConns=1 semaphore, so a
+// caller that dials again before closing its current connection sees the
+// same failure it would against the real agent.
+type singleConnDialer struct {
+	mu   sync.Mutex
+	open bool
+}
+
+func (d *singleConnDialer) Dial(_ context.Context, _, _ string, _ uint32, _ bool) (io.ReadWriteCloser, error) {
+	return concurrency.WithLock2(&d.mu, func() (io.ReadWriteCloser, error) {
+		if d.open {
+			return nil, errors.New("agent is already serving another request; retry after a backoff")
+		}
+		d.open = true
+		return &trackedStream{dialer: d}, nil
+	})
+}
+
+type trackedStream struct {
+	dialer *singleConnDialer
+}
+
+func (t *trackedStream) Read([]byte) (int, error)  { return 0, io.EOF }
+func (t *trackedStream) Write([]byte) (int, error) { return 0, nil }
+func (t *trackedStream) Close() error {
+	concurrency.WithLock(&t.dialer.mu, func() { t.dialer.open = false })
+	return nil
+}
+
 type mockProtocolClient struct {
+	mu          sync.Mutex
 	resultQueue []*vsockclient.GetReportResult
 	errQueue    []error
 	calls       []protocolCall
 	callIdx     int
+
+	getReportDelay  time.Duration
+	syncDelay       time.Duration
+	syncBlocksOnCtx bool
+	syncCalls       [][]byte
+	syncUpdated     bool
+	syncMeta        *pb.ResponseMeta
+	syncErr         error
 }
 
 type protocolCall struct {
-	ifNewerThan uint32
-	knownEpoch  uint32
+	lastKnownToken string
 }
 
-func (m *mockProtocolClient) GetReport(_ context.Context, _ io.ReadWriteCloser, ifNewerThan uint32, knownEpoch uint32) (*vsockclient.GetReportResult, error) {
-	m.calls = append(m.calls, protocolCall{ifNewerThan: ifNewerThan, knownEpoch: knownEpoch})
+func (m *mockProtocolClient) GetReport(_ context.Context, _ io.ReadWriteCloser, lastKnownToken string) (*vsockclient.GetReportResult, error) {
+	if m.getReportDelay > 0 {
+		time.Sleep(m.getReportDelay)
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.calls = append(m.calls, protocolCall{lastKnownToken: lastKnownToken})
 	idx := m.callIdx
 	m.callIdx++
 	if idx < len(m.errQueue) && m.errQueue[idx] != nil {
-		return nil, m.errQueue[idx]
+		// Some errors (e.g. MAPPING_REQUIRED) still carry a queued result
+		// with Meta, mirroring the real client's error-case behavior.
+		var result *vsockclient.GetReportResult
+		if idx < len(m.resultQueue) {
+			result = m.resultQueue[idx]
+		}
+		return result, m.errQueue[idx]
 	}
 	if idx < len(m.resultQueue) {
 		return m.resultQueue[idx], nil
@@ -112,22 +218,38 @@ func (m *mockProtocolClient) GetReport(_ context.Context, _ io.ReadWriteCloser,
 	return nil, errors.New("unexpected call: no more queued results")
 }
 
+func (m *mockProtocolClient) SyncRepoCPEMapping(ctx context.Context, _ io.ReadWriteCloser, mapping []byte) (bool, *pb.ResponseMeta, error) {
+	if m.syncBlocksOnCtx {
+		m.syncCalls = append(m.syncCalls, mapping)
+		<-ctx.Done()
+		return false, nil, ctx.Err()
+	}
+	if m.syncDelay > 0 {
+		time.Sleep(m.syncDelay)
+	}
+	m.syncCalls = append(m.syncCalls, mapping)
+	return m.syncUpdated, m.syncMeta, m.syncErr
+}
+
 func (m *mockProtocolClient) reset() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
 	m.calls = nil
 	m.callIdx = 0
+	m.syncCalls = nil
 }
 
-type mockSender struct {
-	sent []*v4.IndexReport
-	err  error
+// fakeFetcher is a Repo2CPEFetcher test double.
+type fakeFetcher struct {
+	mapping []byte
+	hash    string
+	ok      bool
+	calls   int
 }
 
-func (m *mockSender) Send(_ context.Context, _ *virtualmachine.Info, report *v4.IndexReport) error {
-	if m.err != nil {
-		return m.err
-	}
-	m.sent = append(m.sent, report)
-	return nil
+func (f *fakeFetcher) FetchRepo2CPE(_ context.Context) ([]byte, string, bool) {
+	f.calls++
+	return f.mapping, f.hash, f.ok
 }
 
 // --- Helpers ---
@@ -164,13 +286,14 @@ func (c *testClock) Advance(d time.Duration) {
 	c.t = c.t.Add(d)
 }
 
-func makeReport(gen uint32) *vsockclient.GetReportResult {
+func makeReport(token string) *vsockclient.GetReportResult {
 	return &vsockclient.GetReportResult{
 		IndexReport: &v4.IndexReport{
 			State: "IndexFinished",
 		},
 		Meta: &pb.ResponseMeta{
-			ReportGeneration: gen,
+			ReportToken:  token,
+			AgentVersion: "roxagent-test",
 			Facts: map[string]string{
 				"detected_os":         "RHEL",
 				"activation_status":   "ACTIVE",
@@ -183,26 +306,24 @@ func makeReport(gen uint32) *vsockclient.GetReportResult {
 func unchangedResult() *vsockclient.GetReportResult {
 	return &vsockclient.GetReportResult{
 		Unchanged: true,
-		Meta:      &pb.ResponseMeta{ReportGeneration: 1},
+		Meta:      &pb.ResponseMeta{ReportToken: "1"},
 	}
 }
 
-func makeReportWithEpoch(gen, epoch uint32) *vsockclient.GetReportResult {
-	return &vsockclient.GetReportResult{
-		IndexReport: &v4.IndexReport{
-			State: "IndexFinished",
-		},
-		Meta: &pb.ResponseMeta{
-			ReportGeneration: gen,
-			Epoch:            epoch,
-		},
+func metaWithMapping(hash string, path pb.RepoCPEMappingUpdatePath) *pb.ResponseMeta {
+	return &pb.ResponseMeta{
+		RepoCpeMappingHash:       new(hash),
+		RepoCpeMappingUpdatePath: path.Enum(),
 	}
 }
 
-func unchangedResultWithEpoch(gen, epoch uint32) *vsockclient.GetReportResult {
+func unchangedResultWithFacts(facts map[string]string) *vsockclient.GetReportResult {
 	return &vsockclient.GetReportResult{
 		Unchanged: true,
-		Meta:      &pb.ResponseMeta{ReportGeneration: gen, Epoch: epoch},
+		Meta: &pb.ResponseMeta{
+			ReportToken: "1",
+			Facts:       facts,
+		},
 	}
 }
 
@@ -213,225 +334,448 @@ func TestVMScraper_PollsRunningVMs(t *testing.T) {
 		makeVM("ns1", "vm-a", 100),
 		makeVM("ns2", "vm-b", 200),
 	}}
-	sender := &mockSender{}
 	dialer := &mockDialer{}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReport(1), makeReport(1)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1"), makeReport("1")},
 		errQueue:    []error{nil, nil},
 	}
 
-	s, _ := newTestScraper(store, sender, dialer, client)
+	s, _ := newTestScraper(t, store, dialer, client)
 	discoveredBefore := testutil.ToFloat64(metrics.VMDiscoveredData.WithLabelValues("RHEL", "ACTIVE", "AVAILABLE"))
 	s.pollOnce(context.Background())
 
-	assert.Len(t, sender.sent, 2)
+	assert.Equal(t, 2, forwardedCount(s))
 	assert.Len(t, client.calls, 2)
 	assert.Equal(t, discoveredBefore+2, testutil.ToFloat64(metrics.VMDiscoveredData.WithLabelValues("RHEL", "ACTIVE", "AVAILABLE")))
+	expectedFacts := virtualmachine.AgentFactsFromResponse(map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "ACTIVE",
+		"dnf_metadata_status": "AVAILABLE",
+	}, "roxagent-test")
+	assert.Equal(t, expectedFacts, store.Get(virtualmachine.VMID("ns1/vm-a")).AgentFacts)
+	assert.Equal(t, expectedFacts, store.Get(virtualmachine.VMID("ns2/vm-b")).AgentFacts)
 }
 
-func TestVMScraper_SkipsUnchangedGeneration(t *testing.T) {
+func TestPersistAgentFactsDoesNotAliasStorePointer(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	store := &mockStore{vms: []*virtualmachine.Info{vm.Copy()}}
+	s := &VMScraper{store: store}
+
+	s.persistAgentFacts(vm, &pb.ResponseMeta{
+		AgentVersion: "roxagent-test",
+		Facts: map[string]string{
+			"detected_os":         "RHEL",
+			"activation_status":   "ACTIVE",
+			"dnf_metadata_status": "AVAILABLE",
+		},
+	})
+	vm.GuestOS = "mutated-after-persist"
+
+	stored := store.Get(vm.ID)
+	require.NotNil(t, stored)
+	assert.NotEqual(t, "mutated-after-persist", stored.GuestOS)
+	assert.Equal(t, virtualmachine.AgentFactsFromResponse(map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "ACTIVE",
+		"dnf_metadata_status": "AVAILABLE",
+	}, "roxagent-test"), stored.AgentFacts)
+}
+
+func TestPersistAgentFactsDoesNotClobberInstanceFields(t *testing.T) {
+	stored := makeVM("ns1", "vm-a", 100)
+	stored.GuestOS = "from-informer"
+	stored.Description = "from-informer"
+	store := &mockStore{vms: []*virtualmachine.Info{stored}}
+	s := &VMScraper{store: store}
+
+	stale := stored.Copy()
+	stale.GuestOS = "stale-scrape-copy"
+	stale.Description = "stale-scrape-copy"
+	s.persistAgentFacts(stale, &pb.ResponseMeta{
+		AgentVersion: "roxagent-test",
+		Facts: map[string]string{
+			"detected_os":         "RHEL",
+			"activation_status":   "ACTIVE",
+			"dnf_metadata_status": "AVAILABLE",
+		},
+	})
+
+	got := store.Get(stored.ID)
+	require.NotNil(t, got)
+	assert.Equal(t, "from-informer", got.GuestOS)
+	assert.Equal(t, "from-informer", got.Description)
+	assert.Equal(t, virtualmachine.AgentFactsFromResponse(map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "ACTIVE",
+		"dnf_metadata_status": "AVAILABLE",
+	}, "roxagent-test"), got.AgentFacts)
+}
+
+// TestVMScraper_SkipsWhenCentralLacksCapability covers a store already
+// populated (for example after reconnecting to an older Central) so the
+// scraper must not dial or forward.
+func TestVMScraper_SkipsWhenCentralLacksCapability(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{
+		makeVM("ns1", "vm-a", 100),
+	}}
+	dialer := &mockDialer{}
+	client := &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+	}
+
+	s, _ := newTestScraper(t, store, dialer, client)
+	centralcaps.Set(nil)
+
+	s.pollOnce(context.Background())
+
+	assert.Equal(t, 0, store.listRunningCalls, "should not reconcile when Central cannot consume reports")
+	assert.Zero(t, dialer.callIdx.Load())
+	assert.Zero(t, forwardedCount(s))
+	assert.Empty(t, client.calls)
+}
+
+// TestVMScraper_SilentWhileCapabilityMissing covers a missing-capability
+// stretch: ticks do not Info-log Central's missing cap, and they do not dial.
+func TestVMScraper_SilentWhileCapabilityMissing(t *testing.T) {
+	core, logs := observer.New(zap.InfoLevel)
+	orig := log
+	log = &logging.LoggerImpl{InnerLogger: zap.New(core).Sugar()}
+	t.Cleanup(func() { log = orig })
+
+	s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{
+		makeVM("ns1", "vm-a", 100),
+	}}, &mockDialer{}, &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+	})
+	centralcaps.Set(nil)
+
+	s.pollOnce(t.Context())
+	s.pollOnce(t.Context())
+	assert.Equal(t, 0, logs.FilterMessageSnippet("skipping pull").Len())
+	assert.Zero(t, forwardedCount(s))
+
+	centralcaps.Set([]centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported})
+	s.pollOnce(t.Context())
+	assert.Equal(t, 0, logs.FilterMessageSnippet("will pull index reports").Len())
+	assert.Equal(t, 1, forwardedCount(s))
+}
+
+func TestVMScraper_SkipsUnchangedToken(t *testing.T) {
 	store := &mockStore{vms: []*virtualmachine.Info{
 		makeVM("ns1", "vm-a", 100),
 	}}
-	sender := &mockSender{}
 	dialer := &mockDialer{}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReport(1)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 	}
 
-	s, clock := newTestScraper(store, sender, dialer, client)
+	s, clock := newTestScraper(t, store, dialer, client)
 
 	s.pollOnce(context.Background())
-	require.Len(t, sender.sent, 1)
+	require.Equal(t, 1, forwardedCount(s))
 
 	// Second poll returns unchanged
 	client.reset()
 	client.resultQueue = []*vsockclient.GetReportResult{unchangedResult()}
 	clock.Advance(s.interval)
 	s.pollOnce(context.Background())
-	assert.Len(t, sender.sent, 1, "should not forward unchanged report")
+	assert.Zero(t, forwardedCount(s), "should not forward unchanged report")
 }
 
-func TestVMScraper_RemainsScheduledAcrossUnchangedPolls(t *testing.T) {
+func TestVMScraper_ForwardsChangedAgentFactsOnUnchangedReport(t *testing.T) {
 	store := &mockStore{vms: []*virtualmachine.Info{
 		makeVM("ns1", "vm-a", 100),
 	}}
-	sender := &mockSender{}
 	dialer := &mockDialer{}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReport(1)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 	}
 
-	s, clock := newTestScraper(store, sender, dialer, client)
+	s, clock := newTestScraper(t, store, dialer, client)
+	s.pollOnce(context.Background())
+	require.Equal(t, 1, forwardedCount(s))
 
+	client.reset()
+	client.resultQueue = []*vsockclient.GetReportResult{unchangedResultWithFacts(map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "INACTIVE",
+		"dnf_metadata_status": "UNAVAILABLE",
+	})}
+	clock.Advance(s.interval)
 	s.pollOnce(context.Background())
-	require.True(t, hasScheduleSlot(t, s, "ns1/vm-a"))
+
+	expected := virtualmachine.AgentFactsFromResponseFacts(map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "INACTIVE",
+		"dnf_metadata_status": "UNAVAILABLE",
+	})
+	updates := drainVMUpdates(s)
+	require.Len(t, updates, 1, "unchanged report should not be forwarded")
+	assert.Equal(t, expected[pkgVM.ActivationStatusKey], updates[0].GetFacts()[pkgVM.ActivationStatusKey])
+	assert.Equal(t, expected, store.Get(virtualmachine.VMID("ns1/vm-a")).AgentFacts)
 
 	client.reset()
-	client.resultQueue = []*vsockclient.GetReportResult{unchangedResult()}
+	client.resultQueue = []*vsockclient.GetReportResult{unchangedResultWithFacts(map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "INACTIVE",
+		"dnf_metadata_status": "UNAVAILABLE",
+	})}
 	clock.Advance(s.interval)
 	s.pollOnce(context.Background())
+	assert.Empty(t, drainToCentral(s), "should not emit a VM update when agent facts are unchanged")
+}
 
-	assert.Len(t, sender.sent, 1, "should not forward unchanged report")
-	assert.True(t, hasScheduleSlot(t, s, "ns1/vm-a"))
+func TestVMScraper_ForwardsAgentVersionChangeOnUnchangedReport(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{
+		makeVM("ns1", "vm-a", 100),
+	}}
+	dialer := &mockDialer{}
+	client := &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+	}
+
+	s, clock := newTestScraper(t, store, dialer, client)
+	s.pollOnce(context.Background())
+	require.Equal(t, 1, forwardedCount(s))
+
+	sameFacts := map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "ACTIVE",
+		"dnf_metadata_status": "AVAILABLE",
+	}
+	client.reset()
+	client.resultQueue = []*vsockclient.GetReportResult{{
+		Unchanged: true,
+		Meta: &pb.ResponseMeta{
+			ReportToken:  "1",
+			AgentVersion: "roxagent-upgraded",
+			Facts:        sameFacts,
+		},
+	}}
+	clock.Advance(s.interval)
+	s.pollOnce(context.Background())
+
+	expected := virtualmachine.AgentFactsFromResponse(sameFacts, "roxagent-upgraded")
+	updates := drainVMUpdates(s)
+	require.Len(t, updates, 1)
+	assert.Equal(t, expected[pkgVM.AgentVersionKey], updates[0].GetFacts()[pkgVM.AgentVersionKey])
+	assert.Equal(t, expected, store.Get(virtualmachine.VMID("ns1/vm-a")).AgentFacts)
 }
 
-func TestVMScraper_ForwardsAfter4Hours(t *testing.T) {
+func TestVMScraper_RetriesAgentFactsAfterIndexEnqueueFillsBuffer(t *testing.T) {
 	store := &mockStore{vms: []*virtualmachine.Info{
 		makeVM("ns1", "vm-a", 100),
 	}}
-	sender := &mockSender{}
 	dialer := &mockDialer{}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReport(1)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 	}
 
-	s, clock := newTestScraper(store, sender, dialer, client)
+	s, clock := newTestScraper(t, store, dialer, client)
+	s.toCentral = make(chan *message.ExpiringMessage, 1)
 
 	s.pollOnce(context.Background())
-	require.Len(t, sender.sent, 1)
+	msgs := drainToCentral(s)
+	require.Len(t, msgs, 1)
+	assert.NotNil(t, msgs[0].GetEvent().GetVirtualMachineIndexReport())
+	assert.Nil(t, store.Get(virtualmachine.VMID("ns1/vm-a")).AgentFacts)
+
+	sameFacts := map[string]string{
+		"detected_os":         "RHEL",
+		"activation_status":   "ACTIVE",
+		"dnf_metadata_status": "AVAILABLE",
+	}
+	client.reset()
+	client.resultQueue = []*vsockclient.GetReportResult{{
+		Unchanged: true,
+		Meta: &pb.ResponseMeta{
+			ReportToken:  "1",
+			AgentVersion: "roxagent-test",
+			Facts:        sameFacts,
+		},
+	}}
+	clock.Advance(s.interval)
+	s.pollOnce(context.Background())
 
-	// Past both the success schedule and the mandatory refresh window.
-	clock.Advance(s.mandatoryRefreshAfter + time.Second)
+	expected := virtualmachine.AgentFactsFromResponse(sameFacts, "roxagent-test")
+	updates := drainVMUpdates(s)
+	require.Len(t, updates, 1)
+	assert.Equal(t, expected[pkgVM.ActivationStatusKey], updates[0].GetFacts()[pkgVM.ActivationStatusKey])
+	assert.Equal(t, expected, store.Get(virtualmachine.VMID("ns1/vm-a")).AgentFacts)
+}
+
+func TestVMScraper_SkipsFactsUpdateWhenUnchangedOnNewIndex(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{
+		makeVM("ns1", "vm-a", 100),
+	}}
+	dialer := &mockDialer{}
+	client := &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+	}
+
+	s, clock := newTestScraper(t, store, dialer, client)
+	s.pollOnce(context.Background())
+	require.Equal(t, 1, forwardedCount(s))
+	require.NotNil(t, store.Get(virtualmachine.VMID("ns1/vm-a")).AgentFacts)
 
-	// The mandatory refresh is known before dialing, so a single call
-	// requesting the full report (ifNewerThan=0) is enough.
 	client.reset()
-	client.resultQueue = []*vsockclient.GetReportResult{makeReport(1)}
+	client.resultQueue = []*vsockclient.GetReportResult{makeReport("2")}
+	clock.Advance(s.interval)
 	s.pollOnce(context.Background())
 
-	require.Len(t, client.calls, 1, "mandatory refresh should resolve in a single round trip")
-	assert.Equal(t, uint32(0), client.calls[0].ifNewerThan, "mandatory refresh forces the full report on the only call")
-	assert.Equal(t, uint32(0), client.calls[0].knownEpoch, "mandatory refresh forces the full report on the only call")
-	assert.Len(t, sender.sent, 2, "should forward after 4h even if unchanged")
+	msgs := drainToCentral(s)
+	require.Len(t, msgs, 1)
+	assert.NotNil(t, msgs[0].GetEvent().GetVirtualMachineIndexReport())
+	assert.Nil(t, msgs[0].GetEvent().GetVirtualMachine())
 }
 
-// TestVMScraper_ForwardsOnEpochChangeInSingleDial covers a current agent that
-// resolves restart-coincidence in one response (full report, new epoch).
-func TestVMScraper_ForwardsOnEpochChangeInSingleDial(t *testing.T) {
+func TestVMScraper_RemainsScheduledAcrossUnchangedPolls(t *testing.T) {
 	store := &mockStore{vms: []*virtualmachine.Info{
 		makeVM("ns1", "vm-a", 100),
 	}}
-	sender := &mockSender{}
 	dialer := &mockDialer{}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReportWithEpoch(5, 100)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 	}
 
-	s, clock := newTestScraper(store, sender, dialer, client)
+	s, clock := newTestScraper(t, store, dialer, client)
+
 	s.pollOnce(context.Background())
-	require.Len(t, sender.sent, 1)
+	require.True(t, hasScheduleSlot(t, s, "ns1/vm-a"))
+	require.Equal(t, 1, forwardedCount(s))
 
 	client.reset()
-	client.resultQueue = []*vsockclient.GetReportResult{makeReportWithEpoch(5, 200)}
+	client.resultQueue = []*vsockclient.GetReportResult{unchangedResult()}
 	clock.Advance(s.interval)
 	s.pollOnce(context.Background())
 
-	require.Len(t, client.calls, 1, "current agent serves the full report in one dial")
-	assert.Equal(t, uint32(5), client.calls[0].ifNewerThan)
-	assert.Equal(t, uint32(100), client.calls[0].knownEpoch)
-	assert.Len(t, sender.sent, 2)
+	assert.Zero(t, forwardedCount(s), "should not forward unchanged report")
+	assert.True(t, hasScheduleSlot(t, s, "ns1/vm-a"))
 }
 
-// TestVMScraper_SendsKnownEpochOnRequest verifies Sensor sends its
-// last-cached epoch on every request, letting a current roxagent resolve a
-// restart-coincidence false match in a single round trip.
-func TestVMScraper_SendsKnownEpochOnRequest(t *testing.T) {
+func TestVMScraper_ForwardsAfter4Hours(t *testing.T) {
 	store := &mockStore{vms: []*virtualmachine.Info{
 		makeVM("ns1", "vm-a", 100),
 	}}
-	sender := &mockSender{}
 	dialer := &mockDialer{}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReportWithEpoch(1, 100)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 	}
 
-	s, clock := newTestScraper(store, sender, dialer, client)
+	s, clock := newTestScraper(t, store, dialer, client)
+
+	s.pollOnce(context.Background())
+	require.Equal(t, 1, forwardedCount(s))
+
+	// Past both the success schedule and the mandatory refresh window.
+	clock.Advance(s.mandatoryRefreshAfter + time.Second)
+
+	// The mandatory refresh is known before dialing, so a single call
+	// requesting the full report (empty last_known_token) is enough.
+	client.reset()
+	client.resultQueue = []*vsockclient.GetReportResult{makeReport("1")}
+	s.pollOnce(context.Background())
+
+	require.Len(t, client.calls, 1, "mandatory refresh should resolve in a single round trip")
+	assert.Empty(t, client.calls[0].lastKnownToken, "mandatory refresh forces the full report on the only call")
+	assert.Equal(t, 1, forwardedCount(s), "should forward after 4h even if unchanged")
+}
+
+// TestVMScraper_SendsLastKnownTokenOnRequest verifies Sensor sends its
+// last-cached token on every request so a matching scan reports unchanged.
+func TestVMScraper_SendsLastKnownTokenOnRequest(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{
+		makeVM("ns1", "vm-a", 100),
+	}}
+	dialer := &mockDialer{}
+	client := &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("tok-100")},
+	}
+
+	s, clock := newTestScraper(t, store, dialer, client)
 	s.pollOnce(context.Background())
 
 	require.Len(t, client.calls, 1)
-	assert.Equal(t, uint32(0), client.calls[0].knownEpoch, "first-ever request for a VM has no cached epoch")
+	assert.Empty(t, client.calls[0].lastKnownToken, "first-ever request for a VM has no cached token")
 
 	client.reset()
-	client.resultQueue = []*vsockclient.GetReportResult{unchangedResultWithEpoch(1, 100)}
+	client.resultQueue = []*vsockclient.GetReportResult{unchangedResult()}
 	clock.Advance(s.interval)
 	s.pollOnce(context.Background())
 
-	require.Len(t, client.calls, 1, "matching epoch and generation should resolve in a single round trip")
-	assert.Equal(t, uint32(100), client.calls[0].knownEpoch, "subsequent requests send the cached epoch")
+	require.Len(t, client.calls, 1, "matching token should resolve in a single round trip")
+	assert.Equal(t, "tok-100", client.calls[0].lastKnownToken, "subsequent requests send the cached token")
 }
 
-func TestVMScraper_ForwardsOnGenerationChange(t *testing.T) {
+func TestVMScraper_ForwardsOnTokenChange(t *testing.T) {
 	store := &mockStore{vms: []*virtualmachine.Info{
 		makeVM("ns1", "vm-a", 100),
 	}}
-	sender := &mockSender{}
 	dialer := &mockDialer{}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReport(1)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 	}
 
-	s, clock := newTestScraper(store, sender, dialer, client)
+	s, clock := newTestScraper(t, store, dialer, client)
 	s.pollOnce(context.Background())
-	require.Len(t, sender.sent, 1)
+	require.Equal(t, 1, forwardedCount(s))
 
-	// New generation
+	// New token
 	client.reset()
-	client.resultQueue = []*vsockclient.GetReportResult{makeReport(2)}
+	client.resultQueue = []*vsockclient.GetReportResult{makeReport("2")}
 	clock.Advance(s.interval)
 	s.pollOnce(context.Background())
-	assert.Len(t, sender.sent, 2, "should forward on generation change")
+	assert.Equal(t, 1, forwardedCount(s), "should forward on token change")
 }
 
 // TestVMScraper_NACK reproduces a scenario where Central NACKs a report
 // (e.g. Scanner was still starting up). Without resetting the cached
-// generation, the next poll would see roxagent report "unchanged"
-// (report_generation didn't change) and skip resending, stranding the VM
-// until mandatoryRefreshAfter (4h) instead of retrying on the next poll
-// interval. It also verifies that a NACK is a no-op when it doesn't resolve
-// to a currently-running, known VM (unrelated VM ID, malformed resource ID,
-// or a VM that stopped running), and that an ACK never touches the cached
-// generation.
+// token, the next poll would see roxagent report "unchanged" and skip
+// resending, stranding the VM until mandatoryRefreshAfter (4h) instead of
+// retrying on the next poll interval. It also verifies that a NACK is a
+// no-op when it doesn't resolve to a currently-running, known VM (unrelated
+// VM ID, malformed resource ID, or a VM that stopped running), and that an
+// ACK never touches the cached token.
 func TestVMScraper_NACK(t *testing.T) {
 	cases := map[string]struct {
-		ackAction                  central.SensorACK_Action
-		nackResourceID             string
-		vmRunning                  bool
-		pollResultAfterNack        *vsockclient.GetReportResult
-		advanceAfterAck            time.Duration
-		wantCalls                  int
-		wantIfNewerThanOnRetryPoll uint32
-		wantTotalSent              int
+		ackAction                     central.SensorACK_Action
+		nackResourceID                string
+		vmRunning                     bool
+		pollResultAfterNack           *vsockclient.GetReportResult
+		advanceAfterAck               time.Duration
+		wantCalls                     int
+		wantLastKnownTokenOnRetryPoll string
+		wantTotalSent                 int
 	}{
-		"resets generation and resends after backoff when NACK matches the running VM": {
-			ackAction:                  central.SensorACK_NACK,
-			nackResourceID:             "vm-a-id:100",
-			vmRunning:                  true,
-			pollResultAfterNack:        makeReport(1),
-			advanceAfterAck:            initialBackoff,
-			wantCalls:                  1,
-			wantIfNewerThanOnRetryPoll: 0,
-			wantTotalSent:              2,
+		"resets token and resends after backoff when NACK matches the running VM": {
+			ackAction:                     central.SensorACK_NACK,
+			nackResourceID:                "vm-a-id:100",
+			vmRunning:                     true,
+			pollResultAfterNack:           makeReport("1"),
+			advanceAfterAck:               initialBackoff,
+			wantCalls:                     1,
+			wantLastKnownTokenOnRetryPoll: "",
+			wantTotalSent:                 2,
 		},
 		"is a no-op when NACK references an unrelated VM ID": {
-			ackAction:                  central.SensorACK_NACK,
-			nackResourceID:             "unknown-vm-id:999",
-			vmRunning:                  true,
-			pollResultAfterNack:        unchangedResult(),
-			advanceAfterAck:            5 * time.Minute,
-			wantCalls:                  1,
-			wantIfNewerThanOnRetryPoll: 1,
-			wantTotalSent:              1,
+			ackAction:                     central.SensorACK_NACK,
+			nackResourceID:                "unknown-vm-id:999",
+			vmRunning:                     true,
+			pollResultAfterNack:           unchangedResult(),
+			advanceAfterAck:               5 * time.Minute,
+			wantCalls:                     1,
+			wantLastKnownTokenOnRetryPoll: "1",
+			wantTotalSent:                 1,
 		},
 		"is a no-op when the resource ID has no vsockCID suffix": {
-			ackAction:                  central.SensorACK_NACK,
-			nackResourceID:             "vm-a-id-with-no-colon",
-			vmRunning:                  true,
-			pollResultAfterNack:        unchangedResult(),
-			advanceAfterAck:            5 * time.Minute,
-			wantCalls:                  1,
-			wantIfNewerThanOnRetryPoll: 1,
-			wantTotalSent:              1,
+			ackAction:                     central.SensorACK_NACK,
+			nackResourceID:                "vm-a-id-with-no-colon",
+			vmRunning:                     true,
+			pollResultAfterNack:           unchangedResult(),
+			advanceAfterAck:               5 * time.Minute,
+			wantCalls:                     1,
+			wantLastKnownTokenOnRetryPoll: "1",
+			wantTotalSent:                 1,
 		},
 		"is a no-op when the NACKed VM is no longer running": {
 			ackAction:           central.SensorACK_NACK,
@@ -443,14 +787,14 @@ func TestVMScraper_NACK(t *testing.T) {
 			wantTotalSent:       1,
 		},
 		"is a no-op for an ACK": {
-			ackAction:                  central.SensorACK_ACK,
-			nackResourceID:             "vm-a-id:100",
-			vmRunning:                  true,
-			pollResultAfterNack:        unchangedResult(),
-			advanceAfterAck:            5 * time.Minute,
-			wantCalls:                  1,
-			wantIfNewerThanOnRetryPoll: 1,
-			wantTotalSent:              1,
+			ackAction:                     central.SensorACK_ACK,
+			nackResourceID:                "vm-a-id:100",
+			vmRunning:                     true,
+			pollResultAfterNack:           unchangedResult(),
+			advanceAfterAck:               5 * time.Minute,
+			wantCalls:                     1,
+			wantLastKnownTokenOnRetryPoll: "1",
+			wantTotalSent:                 1,
 		},
 	}
 
@@ -459,19 +803,21 @@ func TestVMScraper_NACK(t *testing.T) {
 			vmA := makeVM("ns1", "vm-a", 100)
 			vmA.ID = "vm-a-id"
 			store := &mockStore{vms: []*virtualmachine.Info{vmA}}
-			sender := &mockSender{}
 			dialer := &mockDialer{}
 			client := &mockProtocolClient{
-				resultQueue: []*vsockclient.GetReportResult{makeReport(1)},
+				resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 			}
 
-			s, clock := newTestScraper(store, sender, dialer, client)
+			s, clock := newTestScraper(t, store, dialer, client)
 			s.pollOnce(context.Background())
-			require.Len(t, sender.sent, 1)
+			require.Equal(t, 1, forwardedCount(s))
 
 			// Flip Running only after the first poll, so the VM is scraped normally
-			// once before the ACK/NACK under test is delivered.
-			vmA.Running = tc.vmRunning
+			// once before the ACK/NACK under test is delivered. The scraper
+			// stores a copy, so mutate the store's current object rather than vmA.
+			concurrency.WithLock(&store.mu, func() {
+				store.vms[0].Running = tc.vmRunning
+			})
 
 			acksBefore := testutil.ToFloat64(metrics.IndexReportAcksReceived.WithLabelValues(tc.ackAction.String()))
 			err := s.ProcessMessage(context.Background(), &central.MsgToSensor{
@@ -493,84 +839,184 @@ func TestVMScraper_NACK(t *testing.T) {
 
 			require.Len(t, client.calls, tc.wantCalls)
 			if tc.wantCalls > 0 {
-				assert.Equal(t, tc.wantIfNewerThanOnRetryPoll, client.calls[0].ifNewerThan,
-					"generation the scraper requests on the poll following the NACK")
+				assert.Equal(t, tc.wantLastKnownTokenOnRetryPoll, client.calls[0].lastKnownToken,
+					"token the scraper requests on the poll following the NACK")
 			}
-			assert.Len(t, sender.sent, tc.wantTotalSent, "total reports handed to the sender across both polls")
+			assert.Equal(t, tc.wantTotalSent-1, forwardedCount(s), "additional reports forwarded after the ACK/NACK poll")
 		})
 	}
 }
 
-// gateSender blocks the Nth Send (1-based) until release is closed.
-type gateSender struct {
-	blockAt int
-	release chan struct{}
-	mu      sync.Mutex
-	n       int
-	sent    []*v4.IndexReport
-}
-
-func (g *gateSender) Send(_ context.Context, _ *virtualmachine.Info, report *v4.IndexReport) error {
-	g.mu.Lock()
-	g.n++
-	n := g.n
-	g.sent = append(g.sent, report)
-	g.mu.Unlock()
-	if n == g.blockAt {
-		<-g.release
+// TestVMScraper_ACKFeatureDisabledStopsScraping covers a 4.11 Central that
+// advertises VirtualMachinesSupported then ACKs index reports as feature-disabled.
+func TestVMScraper_ACKFeatureDisabledStopsScraping(t *testing.T) {
+	cases := map[string]struct {
+		reason      string
+		wantScrapes bool
+	}{
+		"stops scraping after a feature-disabled ACK": {
+			reason:      centralsensor.SensorACKReasonFeatureDisabled,
+			wantScrapes: false,
+		},
+		"keeps scraping after an ACK with an empty reason": {
+			reason:      "",
+			wantScrapes: true,
+		},
+		"keeps scraping after an ACK with an unrelated reason": {
+			reason:      centralsensor.SensorACKReasonRateLimited,
+			wantScrapes: true,
+		},
 	}
-	return nil
-}
 
-// TestVMScraper_InFlightSendCanOverwriteNACKReset exercises a known race involving
-// an unusually slow execution of `commitVMState` and a quick NACK from Central.
-func TestVMScraper_InFlightSendCanOverwriteNACKReset(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		vmA := makeVM("ns1", "vm-a", 100)
-		vmA.ID = "vm-a-id"
-		store := &mockStore{vms: []*virtualmachine.Info{vmA}}
-		client := &mockProtocolClient{resultQueue: []*vsockclient.GetReportResult{makeReport(1)}}
-		s, clock := newTestScraper(store, &mockSender{}, &mockDialer{}, client)
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			vmA := makeVM("ns1", "vm-a", 100)
+			vmA.ID = "vm-a-id"
+			store := &mockStore{vms: []*virtualmachine.Info{vmA}}
+			dialer := &mockDialer{}
+			client := &mockProtocolClient{
+				resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+			}
 
-		s.pollOnce(t.Context())
-		require.Equal(t, uint32(1), cachedGeneration(t, s, "ns1/vm-a"))
+			s, clock := newTestScraper(t, store, dialer, client)
+			s.pollOnce(t.Context())
+			require.Equal(t, 1, forwardedCount(s))
+			require.True(t, centralcaps.Has(centralsensor.VirtualMachinesSupported))
+			reconcilesAfterFirst := store.listRunningCalls
+			dialsAfterFirst := dialer.callIdx.Load()
 
-		gate := &gateSender{
-			blockAt: 1,
-			release: make(chan struct{}),
-		}
-		s.sender = gate
-		client.reset()
-		client.resultQueue = []*vsockclient.GetReportResult{makeReport(2)}
-		clock.Advance(s.interval)
+			require.NoError(t, s.ProcessMessage(t.Context(), &central.MsgToSensor{
+				Msg: &central.MsgToSensor_SensorAck{
+					SensorAck: &central.SensorACK{
+						MessageType: central.SensorACK_VM_INDEX_REPORT,
+						Action:      central.SensorACK_ACK,
+						ResourceId:  "vm-a-id:100",
+						Reason:      tc.reason,
+					},
+				},
+			}))
+			require.True(t, centralcaps.Has(centralsensor.VirtualMachinesSupported),
+				"hello capabilities are left unchanged")
+			assert.Equal(t, !tc.wantScrapes, s.indexReportsDisabled.Load())
 
-		done := make(chan struct{})
-		go func() {
-			defer close(done)
+			client.reset()
+			client.resultQueue = []*vsockclient.GetReportResult{unchangedResult()}
+			clock.Advance(5 * time.Minute)
 			s.pollOnce(t.Context())
-		}()
 
-		// Block until the scrape goroutine is durably blocked inside Send,
-		// i.e. the report has been handed off but not yet committed.
-		synctest.Wait()
+			if tc.wantScrapes {
+				require.Len(t, client.calls, 1)
+				assert.Equal(t, reconcilesAfterFirst+1, store.listRunningCalls)
+				assert.Equal(t, dialsAfterFirst+1, dialer.callIdx.Load())
+			} else {
+				assert.Empty(t, client.calls)
+				assert.Equal(t, reconcilesAfterFirst, store.listRunningCalls)
+				assert.Equal(t, dialsAfterFirst, dialer.callIdx.Load())
+			}
+		})
+	}
+}
 
-		require.NoError(t, s.ProcessMessage(t.Context(), &central.MsgToSensor{
-			Msg: &central.MsgToSensor_SensorAck{
-				SensorAck: &central.SensorACK{
-					MessageType: central.SensorACK_VM_INDEX_REPORT,
-					Action:      central.SensorACK_NACK,
-					ResourceId:  "vm-a-id:100",
-				},
+// TestVMScraper_ACKFeatureDisabledResumesOnCentralReachable covers reconnect
+// after a feature-disabled ACK: the next Central is tried without a Sensor restart.
+func TestVMScraper_ACKFeatureDisabledResumesOnCentralReachable(t *testing.T) {
+	vmA := makeVM("ns1", "vm-a", 100)
+	vmA.ID = "vm-a-id"
+	store := &mockStore{vms: []*virtualmachine.Info{vmA}}
+	dialer := &mockDialer{}
+	client := &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+	}
+
+	s, clock := newTestScraper(t, store, dialer, client)
+	s.pollOnce(t.Context())
+	require.Equal(t, 1, forwardedCount(s))
+
+	require.NoError(t, s.ProcessMessage(t.Context(), &central.MsgToSensor{
+		Msg: &central.MsgToSensor_SensorAck{
+			SensorAck: &central.SensorACK{
+				MessageType: central.SensorACK_VM_INDEX_REPORT,
+				Action:      central.SensorACK_ACK,
+				ResourceId:  "vm-a-id:100",
+				Reason:      centralsensor.SensorACKReasonFeatureDisabled,
 			},
-		}))
-		assert.Equal(t, uint32(0), cachedGeneration(t, s, "ns1/vm-a"),
-			"NACK applies immediately while the send it targets is still in flight")
+		},
+	}))
+	require.True(t, s.indexReportsDisabled.Load())
 
-		close(gate.release)
-		<-done
-		assert.Equal(t, uint32(2), cachedGeneration(t, s, "ns1/vm-a"),
-			"the in-flight send's commit runs after the NACK reset and overwrites it unconditionally")
-	})
+	client.reset()
+	client.resultQueue = []*vsockclient.GetReportResult{unchangedResult()}
+	clock.Advance(5 * time.Minute)
+	s.pollOnce(t.Context())
+	assert.Empty(t, client.calls)
+
+	s.Notify(common.SensorComponentEventCentralReachable)
+	require.False(t, s.indexReportsDisabled.Load())
+
+	s.pollOnce(t.Context())
+	require.Len(t, client.calls, 1)
+}
+
+// TestVMScraper_InFlightSendDoesNotOverwriteNACKReset covers NACK while
+// forwardReport is blocked: commit must not restore lastToken or clear NACK backoff.
+func TestVMScraper_InFlightSendDoesNotOverwriteNACKReset(t *testing.T) {
+	cases := map[string]struct {
+		priorPoll bool
+		sendToken string
+	}{
+		"after a prior successful commit": {priorPoll: true, sendToken: "2"},
+		"when lastToken is already empty": {priorPoll: false, sendToken: "1"},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				vmA := makeVM("ns1", "vm-a", 100)
+				vmA.ID = "vm-a-id"
+				store := &mockStore{vms: []*virtualmachine.Info{vmA}}
+				client := &mockProtocolClient{resultQueue: []*vsockclient.GetReportResult{makeReport("1")}}
+				s, clock := newTestScraper(t, store, &mockDialer{}, client)
+
+				if tc.priorPoll {
+					s.pollOnce(t.Context())
+					require.Equal(t, "1", cachedToken(t, s, "ns1/vm-a"))
+					clock.Advance(s.interval)
+				}
+
+				s.toCentral = make(chan *message.ExpiringMessage)
+				client.reset()
+				client.resultQueue = []*vsockclient.GetReportResult{makeReport(tc.sendToken)}
+
+				done := make(chan struct{})
+				go func() {
+					defer close(done)
+					s.pollOnce(t.Context())
+				}()
+
+				// Block until the scrape goroutine is durably blocked in forwardReport,
+				// i.e. the report is on toCentral but not yet committed.
+				synctest.Wait()
+
+				require.NoError(t, s.ProcessMessage(t.Context(), &central.MsgToSensor{
+					Msg: &central.MsgToSensor_SensorAck{
+						SensorAck: &central.SensorACK{
+							MessageType: central.SensorACK_VM_INDEX_REPORT,
+							Action:      central.SensorACK_NACK,
+							ResourceId:  "vm-a-id:100",
+						},
+					},
+				}))
+				assert.Empty(t, cachedToken(t, s, "ns1/vm-a"),
+					"NACK applies immediately while the send it targets is still in flight")
+
+				<-s.toCentral
+				<-done
+				assert.Empty(t, cachedToken(t, s, "ns1/vm-a"),
+					"the in-flight send must not restore lastToken after a NACK")
+				assert.Equal(t, initialBackoff, cachedBackoff(t, s, "ns1/vm-a"),
+					"success scheduling must not clear the NACK backoff")
+			})
+		})
+	}
 }
 
 func TestVMScraper_HandlesDialAndProtocolFailures(t *testing.T) {
@@ -589,7 +1035,7 @@ func TestVMScraper_HandlesDialAndProtocolFailures(t *testing.T) {
 	}{
 		"should still send for vm-b when vm-a hits a protocol error": {
 			dialer:      &mockDialer{},
-			resultQueue: []*vsockclient.GetReportResult{nil, makeReport(1)},
+			resultQueue: []*vsockclient.GetReportResult{nil, makeReport("1")},
 			errQueue:    []error{errors.New("connection refused"), nil},
 			wantCalls:   2,
 			wantSent:    1,
@@ -598,7 +1044,7 @@ func TestVMScraper_HandlesDialAndProtocolFailures(t *testing.T) {
 			dialer: &mockDialer{
 				errQueue: []error{errors.New("dial failed"), nil},
 			},
-			resultQueue: []*vsockclient.GetReportResult{makeReport(1)},
+			resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
 			wantCalls:   1,
 			wantSent:    1,
 		},
@@ -612,25 +1058,24 @@ func TestVMScraper_HandlesDialAndProtocolFailures(t *testing.T) {
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			sender := &mockSender{}
 			client := &mockProtocolClient{
 				resultQueue: tc.resultQueue,
 				errQueue:    tc.errQueue,
 			}
-			s, _ := newTestScraper(&mockStore{vms: vms}, sender, tc.dialer, client)
+			s, _ := newTestScraper(t, &mockStore{vms: vms}, tc.dialer, client)
 			if tc.perVMTimeout > 0 {
 				s.perVMTimeout = tc.perVMTimeout
 			}
 			s.pollOnce(context.Background())
 
 			assert.Len(t, client.calls, tc.wantCalls)
-			assert.Len(t, sender.sent, tc.wantSent)
+			assert.Equal(t, tc.wantSent, forwardedCount(s))
 		})
 	}
 }
 
 func TestVMScraper_StartRejectsSecondCall(t *testing.T) {
-	s, _ := newTestScraper(&mockStore{}, &mockSender{}, &mockDialer{}, &mockProtocolClient{})
+	s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, &mockProtocolClient{})
 	require.NoError(t, s.Start())
 	t.Cleanup(s.Stop)
 
@@ -645,19 +1090,19 @@ func TestVMScraper_GetReportTimeoutClassified(t *testing.T) {
 	client := &mockProtocolClient{
 		errQueue: []error{errors.New("i/o timeout")},
 	}
-	s, _ := newTestScraper(&mockStore{vms: []*virtualmachine.Info{vm}}, &mockSender{}, &mockDialer{}, client)
+	s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, client)
 
-	timeoutBefore := testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusTimeout))
-	readErrBefore := testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusReadError))
+	timeoutBefore := testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportTimeout))
+	readErrBefore := testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportReadError))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
-	_, outcome := s.dialAndGetReport(ctx, vm, "ns1/vm-a", 1, 0, 0)
+	_, outcome := s.dialAndGetReport(ctx, vm, "ns1/vm-a", 1, "")
 
 	assert.Equal(t, scrapeNonRetryable, outcome,
 		"parent cancellation must not schedule a retry on the short tick")
-	assert.Equal(t, timeoutBefore+1, testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusTimeout)))
-	assert.Equal(t, readErrBefore, testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusReadError)),
+	assert.Equal(t, timeoutBefore+1, testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportTimeout)))
+	assert.Equal(t, readErrBefore, testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportReadError)),
 		"timed-out read must not be counted as a protocol/read error")
 }
 
@@ -669,12 +1114,12 @@ func TestVMScraper_GetReportDeadlineExceededClassified(t *testing.T) {
 	client := &mockProtocolClient{
 		errQueue: []error{errors.New("i/o timeout")},
 	}
-	s, _ := newTestScraper(&mockStore{vms: []*virtualmachine.Info{vm}}, &mockSender{}, &mockDialer{}, client)
+	s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, client)
 
 	ctx, cancel := context.WithTimeout(context.Background(), time.Nanosecond)
 	defer cancel()
 	<-ctx.Done()
-	_, outcome := s.dialAndGetReport(ctx, vm, "ns1/vm-a", 1, 0, 0)
+	_, outcome := s.dialAndGetReport(ctx, vm, "ns1/vm-a", 1, "")
 
 	assert.Equal(t, scrapeRetryable, outcome, "a per-VM deadline is retried on the short tick")
 }
@@ -686,45 +1131,238 @@ func TestVMScraper_GetReportBusyClassified(t *testing.T) {
 	client := &mockProtocolClient{
 		errQueue: []error{vsockclient.ErrBusy},
 	}
-	s, _ := newTestScraper(&mockStore{vms: []*virtualmachine.Info{vm}}, &mockSender{}, &mockDialer{}, client)
+	s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, client)
 
-	busyBefore := testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusBusy))
-	readErrBefore := testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusReadError))
+	busyBefore := testutil.ToFloat64(metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportBusy))
+	readErrBefore := testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportReadError))
 
-	_, outcome := s.dialAndGetReport(context.Background(), vm, "ns1/vm-a", 1, 0, 0)
+	_, outcome := s.dialAndGetReport(context.Background(), vm, "ns1/vm-a", 1, "")
 
 	assert.Equal(t, scrapeRetryable, outcome)
-	assert.Equal(t, busyBefore+1, testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusBusy)))
-	assert.Equal(t, readErrBefore, testutil.ToFloat64(metrics.PullRequestsTotal.WithLabelValues(metrics.PullStatusReadError)),
+	assert.Equal(t, busyBefore+1, testutil.ToFloat64(metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportBusy)))
+	assert.Equal(t, readErrBefore, testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportReadError)),
 		"a busy response must not be counted as a generic protocol/read error")
 }
 
-func TestVMScraper_PrunesStaleState(t *testing.T) {
-	store := &mockStore{vms: []*virtualmachine.Info{
-		makeVM("ns1", "vm-a", 100),
-		makeVM("ns2", "vm-b", 200),
-	}}
-	sender := &mockSender{}
-	dialer := &mockDialer{}
-	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReport(1), makeReport(1)},
-	}
+func TestVMScraper_ReconcileVMState(t *testing.T) {
+	t.Run("should prune keys no longer in the running set", func(t *testing.T) {
+		store := &mockStore{vms: []*virtualmachine.Info{
+			makeVM("ns1", "vm-a", 100),
+			makeVM("ns2", "vm-b", 200),
+		}}
+		dialer := &mockDialer{}
+		client := &mockProtocolClient{
+			resultQueue: []*vsockclient.GetReportResult{makeReport("1"), makeReport("1")},
+		}
 
-	s, clock := newTestScraper(store, sender, dialer, client)
-	s.pollOnce(context.Background())
-	assert.Len(t, s.vmState, 2)
-	assert.True(t, hasScheduleSlot(t, s, "ns1/vm-a"))
+		s, clock := newTestScraper(t, store, dialer, client)
+		s.pollOnce(context.Background())
+		assert.Len(t, s.vmState, 2)
+		assert.True(t, hasScheduleSlot(t, s, "ns1/vm-a"))
 
-	// Remove vm-a from running set
-	store.vms = []*virtualmachine.Info{makeVM("ns2", "vm-b", 200)}
-	client.reset()
-	client.resultQueue = []*vsockclient.GetReportResult{makeReport(2)}
-	clock.Advance(s.interval)
-	s.pollOnce(context.Background())
+		store.vms = []*virtualmachine.Info{makeVM("ns2", "vm-b", 200)}
+		client.reset()
+		client.resultQueue = []*vsockclient.GetReportResult{makeReport("2")}
+		clock.Advance(s.interval)
+		s.pollOnce(context.Background())
+
+		assert.Len(t, s.vmState, 1, "stale vm-a state should be pruned")
+		assert.False(t, hasScheduleSlot(t, s, "ns1/vm-a"), "vm-a should no longer be scheduled")
+		assert.True(t, hasScheduleSlot(t, s, "ns2/vm-b"))
+	})
 
-	assert.Len(t, s.vmState, 1, "stale vm-a state should be pruned")
-	assert.False(t, hasScheduleSlot(t, s, "ns1/vm-a"), "vm-a should no longer be scheduled")
-	assert.True(t, hasScheduleSlot(t, s, "ns2/vm-b"))
+	t.Run("should reset scrape state when VM ID changes at the same key", func(t *testing.T) {
+		const key = "ns1/vm-a"
+		oldVM := &virtualmachine.Info{
+			ID:        "uid-old",
+			Namespace: "ns1",
+			Name:      "vm-a",
+			VSOCKCID:  new(uint32(100)),
+			Running:   true,
+		}
+		store := &mockStore{vms: []*virtualmachine.Info{oldVM}}
+		s, clock := newTestScraper(t, store, &mockDialer{}, &mockProtocolClient{
+			resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+		})
+
+		s.pollOnce(context.Background())
+		require.Equal(t, "1", cachedToken(t, s, key))
+		require.Equal(t, 1, s.Stats().VMsScanned)
+		require.Equal(t, clock.Now().Add(s.interval), cachedNextAttemptAt(t, s, key),
+			"successful scrape schedules the next poll")
+
+		store.vms = []*virtualmachine.Info{{
+			ID:        "uid-new",
+			Namespace: "ns1",
+			Name:      "vm-a",
+			VSOCKCID:  new(uint32(101)),
+			Running:   true,
+		}}
+		s.reconcile()
+
+		require.Equal(t, virtualmachine.VMID("uid-new"), concurrency.WithLock1(&s.mu, func() virtualmachine.VMID {
+			return s.vmState[key].vmID
+		}))
+		assert.Empty(t, cachedToken(t, s, key))
+		assert.Equal(t, 1, s.Stats().TrackedVMs)
+		assert.Zero(t, s.Stats().VMsScanned, "replacement must not inherit prior scrape state")
+		assert.Equal(t, clock.Now(), cachedNextAttemptAt(t, s, key),
+			"replacement must be due immediately, not on the prior poll timer")
+		assert.Contains(t, s.dueKeys(), key)
+	})
+}
+
+// TestVMScraper_IgnoresLateScrapeAfterVMReplacement covers a KubeVirt recreate
+// while a scrape of the predecessor is still forwarding: the late commit must not
+// mark the replacement as already scanned or push its next poll out by interval.
+func TestVMScraper_IgnoresLateScrapeAfterVMReplacement(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const key = "ns1/vm-a"
+		oldVM := &virtualmachine.Info{
+			ID:        "uid-old",
+			Namespace: "ns1",
+			Name:      "vm-a",
+			VSOCKCID:  new(uint32(100)),
+			Running:   true,
+		}
+		store := &mockStore{vms: []*virtualmachine.Info{oldVM}}
+		s, clock := newTestScraper(t, store, &mockDialer{}, &mockProtocolClient{
+			resultQueue: []*vsockclient.GetReportResult{makeReport("99")},
+		})
+		s.toCentral = make(chan *message.ExpiringMessage)
+
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			s.pollOnce(t.Context())
+		}()
+		synctest.Wait()
+
+		store.vms = []*virtualmachine.Info{{
+			ID:        "uid-new",
+			Namespace: "ns1",
+			Name:      "vm-a",
+			VSOCKCID:  new(uint32(101)),
+			Running:   true,
+		}}
+		s.reconcile()
+
+		require.Equal(t, virtualmachine.VMID("uid-new"), concurrency.WithLock1(&s.mu, func() virtualmachine.VMID {
+			return s.vmState[key].vmID
+		}))
+		require.Zero(t, s.Stats().VMsScanned)
+		require.Equal(t, clock.Now(), cachedNextAttemptAt(t, s, key))
+
+		<-s.toCentral
+		<-done
+
+		assert.Equal(t, virtualmachine.VMID("uid-new"), concurrency.WithLock1(&s.mu, func() virtualmachine.VMID {
+			return s.vmState[key].vmID
+		}))
+		assert.Empty(t, cachedToken(t, s, key), "late commit must not stamp the replacement")
+		assert.Zero(t, s.Stats().VMsScanned, "replacement must stay unscanned until its own scrape")
+		assert.Equal(t, clock.Now(), cachedNextAttemptAt(t, s, key),
+			"late schedule must not inherit the predecessor's poll timer")
+		assert.Contains(t, s.dueKeys(), key)
+	})
+}
+
+// TestVMScraper_TrackedVMsByMappingPath covers the currently-tracked gauge
+// mix. Path updates use maybeSyncRepoCPEMapping so they do not need a VSOCK push.
+func TestVMScraper_TrackedVMsByMappingPath(t *testing.T) {
+	const key = "ns1/vm-a"
+
+	tests := map[string]func(t *testing.T){
+		"a new VM starts as unspecified": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			assertTrackedByMappingPath(t, 0, 0, 1)
+		},
+		"SENSOR meta moves the recount to sensor": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR))
+			assertTrackedByMappingPath(t, 1, 0, 0)
+		},
+		"URL meta moves the recount to url": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL))
+			assertTrackedByMappingPath(t, 0, 1, 0)
+		},
+		"unspecified meta stays unspecified": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED))
+			assertTrackedByMappingPath(t, 0, 0, 1)
+		},
+		"nil meta does not change a live slot": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR))
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, nil)
+			assertTrackedByMappingPath(t, 1, 0, 0)
+		},
+		"repeating SENSOR meta keeps the mix": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR))
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR))
+			assertTrackedByMappingPath(t, 1, 0, 0)
+		},
+		"URL meta after SENSOR recounts to url": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR))
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL))
+			assertTrackedByMappingPath(t, 0, 1, 0)
+		},
+		"a VM leaving vmState drops its series": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			store := &mockStore{vms: []*virtualmachine.Info{vm}}
+			s, _ := newTestScraper(t, store, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR))
+			require.Equal(t, 1.0, testutil.ToFloat64(metrics.PullTrackedVMsByMappingPath.WithLabelValues(metrics.MappingPathSensor)))
+			store.vms = nil
+			s.reconcile()
+			assertTrackedByMappingPath(t, 0, 0, 0)
+		},
+		"a vmID recreate returns to unspecified": func(t *testing.T) {
+			vm := makeVM("ns1", "vm-a", 100)
+			store := &mockStore{vms: []*virtualmachine.Info{vm}}
+			s, _ := newTestScraper(t, store, &mockDialer{}, &mockProtocolClient{})
+			s.reconcile()
+			s.maybeSyncRepoCPEMapping(t.Context(), vm, key, 1, metaWithMapping("h", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR))
+			store.vms = []*virtualmachine.Info{{
+				ID:        "uid-new",
+				Namespace: "ns1",
+				Name:      "vm-a",
+				VSOCKCID:  new(uint32(101)),
+				Running:   true,
+			}}
+			s.reconcile()
+			assertTrackedByMappingPath(t, 0, 0, 1)
+		},
+	}
+	for name, fn := range tests {
+		t.Run(name, fn)
+	}
+}
+
+func assertTrackedByMappingPath(t *testing.T, sensor, url, unspecified float64) {
+	t.Helper()
+	assert.Equal(t, sensor, testutil.ToFloat64(metrics.PullTrackedVMsByMappingPath.WithLabelValues(metrics.MappingPathSensor)), "sensor")
+	assert.Equal(t, url, testutil.ToFloat64(metrics.PullTrackedVMsByMappingPath.WithLabelValues(metrics.MappingPathURL)), "url")
+	assert.Equal(t, unspecified, testutil.ToFloat64(metrics.PullTrackedVMsByMappingPath.WithLabelValues(metrics.MappingPathUnspecified)), "unspecified")
+	assert.Equal(t, sensor+url+unspecified, testutil.ToFloat64(metrics.PullTrackedVMs), "labeled series must sum to vsock_pull_tracked_vms")
 }
 
 // hasScheduleSlot reports whether key has a vmState slot (reconcile membership).
@@ -736,46 +1374,284 @@ func hasScheduleSlot(t *testing.T, s *VMScraper, key string) bool {
 	})
 }
 
-// cachedGeneration reads a VM's cached generation under s.mu, so the read is
+// cachedToken reads a VM's cached token under s.mu, so the read is
 // race-safe regardless of what locking handleNACK or commitVMState use internally.
-func cachedGeneration(t *testing.T, s *VMScraper, key string) uint32 {
+func cachedToken(t *testing.T, s *VMScraper, key string) string {
 	t.Helper()
-	return concurrency.WithLock1(&s.mu, func() uint32 {
+	return concurrency.WithLock1(&s.mu, func() string {
 		st, ok := s.vmState[key]
 		require.True(t, ok, "no cached state for %q", key)
-		return st.lastGeneration
+		return st.lastToken
 	})
 }
 
-func newTestScraper(store RunningVMStore, sender IndexReportSender, dialer VMDialer, client ProtocolClient) (*VMScraper, *testClock) {
+type pullOutcomeSample struct {
+	vec   *prometheus.CounterVec
+	label string
+}
+
+func allPullOutcomeSamples() []pullOutcomeSample {
+	var out []pullOutcomeSample
+	for _, label := range []string{
+		metrics.PullTransportDialError,
+		metrics.PullTransportTimeout,
+		metrics.PullTransportReadError,
+		metrics.PullTransportAbnormalClose,
+		metrics.PullTransportUnexpected,
+	} {
+		out = append(out, pullOutcomeSample{metrics.PullTransportTotal, label})
+	}
+	for _, label := range []string{
+		metrics.PullGetReportUnchanged,
+		metrics.PullGetReportNotReady,
+		metrics.PullGetReportMappingRequired,
+		metrics.PullGetReportUnknownMethod,
+		metrics.PullGetReportBusy,
+		metrics.PullGetReportInternalError,
+		metrics.PullGetReportMalformedRequest,
+		metrics.PullGetReportRequestTooLarge,
+		metrics.PullGetReportUnknownAgentError,
+	} {
+		out = append(out, pullOutcomeSample{metrics.PullGetReportTotal, label})
+	}
+	for _, label := range []string{
+		metrics.PullScrapeSuccess,
+		metrics.PullScrapeInvalidReport,
+		metrics.PullScrapeSendError,
+	} {
+		out = append(out, pullOutcomeSample{metrics.PullScrapeTotal, label})
+	}
+	return out
+}
+
+func snapshotPullOutcomes() map[pullOutcomeSample]float64 {
+	snap := make(map[pullOutcomeSample]float64, len(allPullOutcomeSamples()))
+	for _, sample := range allPullOutcomeSamples() {
+		snap[sample] = testutil.ToFloat64(sample.vec.WithLabelValues(sample.label))
+	}
+	return snap
+}
+
+func assertOnlyPullOutcomeIncremented(t *testing.T, before map[pullOutcomeSample]float64, wantVec *prometheus.CounterVec, wantLabel string) {
+	t.Helper()
+	for _, sample := range allPullOutcomeSamples() {
+		got := testutil.ToFloat64(sample.vec.WithLabelValues(sample.label))
+		want := before[sample]
+		if sample.vec == wantVec && sample.label == wantLabel {
+			want++
+		}
+		assert.Equal(t, want, got, "status %q", sample.label)
+	}
+}
+
+// TestHandleGetReportError_ClassifiesEveryErrorCode locks the mapping from
+// each error to its metric label and retry classification.
+func TestHandleGetReportError_ClassifiesEveryErrorCode(t *testing.T) {
+	cases := map[string]struct {
+		err         error
+		wantMetric  *prometheus.CounterVec
+		wantLabel   string
+		wantOutcome scrapeOutcome
+	}{
+		"NOT_READY maps to get_report not_ready": {
+			err:         fmt.Errorf("%w: still scanning", vsockclient.ErrNotReady),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportNotReady,
+			wantOutcome: scrapeRetryable,
+		},
+		"MAPPING_REQUIRED maps to get_report mapping_required": {
+			err:         fmt.Errorf("%w: no mapping yet", vsockclient.ErrMappingRequired),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportMappingRequired,
+			wantOutcome: scrapeRetryable,
+		},
+		"UNKNOWN_METHOD maps to get_report unknown_method": {
+			err:         fmt.Errorf("%w: no get_report", vsockclient.ErrUnknownMethod),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportUnknownMethod,
+			wantOutcome: scrapeNonRetryable,
+		},
+		"BUSY maps to get_report busy": {
+			err:         fmt.Errorf("%w: another request in flight", vsockclient.ErrBusy),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportBusy,
+			wantOutcome: scrapeRetryable,
+		},
+		"INTERNAL maps to get_report internal_error": {
+			err:         fmt.Errorf("%w: panic recovered", vsockclient.ErrInternal),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportInternalError,
+			wantOutcome: scrapeRetryable,
+		},
+		"MALFORMED_REQUEST maps to get_report malformed_request": {
+			err:         fmt.Errorf("%w: empty request_id", vsockclient.ErrMalformedRequest),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportMalformedRequest,
+			wantOutcome: scrapeNonRetryable,
+		},
+		"REQUEST_TOO_LARGE maps to get_report request_too_large": {
+			err:         fmt.Errorf("%w: payload too big", vsockclient.ErrRequestTooLarge),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportRequestTooLarge,
+			wantOutcome: scrapeNonRetryable,
+		},
+		"unrecognized agent error code maps to get_report unknown_agent_error": {
+			err:         fmt.Errorf("%w: agent error (99): ?", vsockclient.ErrUnknownAgentError),
+			wantMetric:  metrics.PullGetReportTotal,
+			wantLabel:   metrics.PullGetReportUnknownAgentError,
+			wantOutcome: scrapeRetryable,
+		},
+		"abnormal websocket close maps to transport abnormal_close": {
+			err:         fmt.Errorf("reading response: %w", &fakeCloseCoder{code: 1006, reason: "abnormal closure"}),
+			wantMetric:  metrics.PullTransportTotal,
+			wantLabel:   metrics.PullTransportAbnormalClose,
+			wantOutcome: scrapeRetryable,
+		},
+		"plain io.EOF maps to transport read_error": {
+			err:         io.EOF,
+			wantMetric:  metrics.PullTransportTotal,
+			wantLabel:   metrics.PullTransportReadError,
+			wantOutcome: scrapeRetryable,
+		},
+		"io.ErrUnexpectedEOF maps to transport read_error": {
+			err:         io.ErrUnexpectedEOF,
+			wantMetric:  metrics.PullTransportTotal,
+			wantLabel:   metrics.PullTransportReadError,
+			wantOutcome: scrapeRetryable,
+		},
+		"unrecognized transport/framing error maps to transport unexpected": {
+			err:         errors.New("unmarshaling response: unexpected EOF in the middle of a varint"),
+			wantMetric:  metrics.PullTransportTotal,
+			wantLabel:   metrics.PullTransportUnexpected,
+			wantOutcome: scrapeRetryable,
+		},
+	}
+
+	s := &VMScraper{}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			before := snapshotPullOutcomes()
+			outcome := s.handleGetReportError(t.Context(), "ns/vm", tc.err)
+			assert.Equal(t, tc.wantOutcome, outcome)
+			assertOnlyPullOutcomeIncremented(t, before, tc.wantMetric, tc.wantLabel)
+		})
+	}
+}
+
+// TestIsAbnormalClose locks which close codes take the abnormal-close path
+// versus the ordinary EOF path.
+func TestIsAbnormalClose(t *testing.T) {
+	cases := map[string]struct {
+		err  error
+		want bool
+	}{
+		"normal closure (1000) is not abnormal": {
+			err:  &fakeCloseCoder{code: closeCodeNormalClosure, reason: "bye"},
+			want: false,
+		},
+		"zero code (no structured signal) is not abnormal": {
+			err:  &fakeCloseCoder{code: 0},
+			want: false,
+		},
+		"abnormal closure (1006) is abnormal": {
+			err:  &fakeCloseCoder{code: 1006, reason: "abnormal closure"},
+			want: true,
+		},
+		"a plain io.EOF is not a closeCoder at all": {
+			err:  io.EOF,
+			want: false,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			var target closeCoder
+			assert.Equal(t, tc.want, isAbnormalClose(tc.err, &target))
+		})
+	}
+}
+
+func drainToCentral(s *VMScraper) []*message.ExpiringMessage {
+	var out []*message.ExpiringMessage
+	for {
+		select {
+		case msg := <-s.toCentral:
+			out = append(out, msg)
+		default:
+			return out
+		}
+	}
+}
+
+func forwardedCount(s *VMScraper) int {
+	n := 0
+	for _, msg := range drainToCentral(s) {
+		if msg.GetEvent().GetVirtualMachineIndexReport() != nil {
+			n++
+		}
+	}
+	return n
+}
+
+func drainVMUpdates(s *VMScraper) []*pb.VirtualMachine {
+	var out []*pb.VirtualMachine
+	for _, msg := range drainToCentral(s) {
+		if vm := msg.GetEvent().GetVirtualMachine(); vm != nil {
+			out = append(out, vm)
+		}
+	}
+	return out
+}
+
+type staticClusterID string
+
+func (c staticClusterID) GetNoWait() string { return string(c) }
+
+func newTestScraper(t *testing.T, store RunningVMStore, dialer VMDialer, client ProtocolClient) (*VMScraper, *testClock) {
+	t.Helper()
+	centralcaps.Set([]centralsensor.CentralCapability{centralsensor.VirtualMachinesSupported})
+	t.Cleanup(func() { centralcaps.Set(nil) })
+
 	clock := newTestClock()
 	interval := 5 * time.Minute
-	return &VMScraper{
+	s := &VMScraper{
 		store:                 store,
-		sender:                sender,
 		dialer:                dialer,
 		client:                client,
+		clusterID:             staticClusterID("test-cluster"),
+		toCentral:             make(chan *message.ExpiringMessage, 256),
+		centralReady:          concurrency.NewSignal(),
 		interval:              interval,
 		tickInterval:          defaultTickInterval,
 		initialBackoff:        initialBackoff,
 		reconcileEvery:        reconcilePeriod(interval),
 		perVMTimeout:          10 * time.Second,
 		mandatoryRefreshAfter: 4 * time.Hour,
-		concurrency:           1,
+		concurrency:           20,
 		// Half of the 16MiB default pull response-size ceiling — same
 		// derivation New() uses from env.VirtualMachinesPullMaxResponseSizeKB.
-		warnMaxBytes: 8 << 20,
-		vmState:      make(map[string]*vmState),
-		inFlight:     set.NewStringSet(),
-		now:          clock.Now,
-	}, clock
+		warnMaxBytes:   8 << 20,
+		spreadFraction: 2.0 / 3,
+		vmState:        make(map[string]*vmState),
+		inFlight:       set.NewStringSet(),
+		now:            clock.Now,
+		randFloat64:    func() float64 { return 0 },
+	}
+	s.centralReady.Signal()
+	setTickToDrain(s)
+	return s, clock
 }
 
-// pollOnce forces a reconcile and scrapes every due slot.
+// pollOnce forces a reconcile and scrapes due slots (subject to the per-tick start cap).
 func (s *VMScraper) pollOnce(ctx context.Context) {
 	s.tick(ctx, true)
 }
 
+// setTickToDrain sets tickInterval to the new-VM index report window so one
+// tick can start every never-scraped due VM under concurrency.
+func setTickToDrain(s *VMScraper) {
+	s.tickInterval = newVMIndexReportWindow(s.interval)
+}
+
 // --- Thread-safe mocks for concurrent tests ---
 
 // delayDialer sleeps for delay on every Dial and tracks the highest number
@@ -803,27 +1679,19 @@ func (d *delayDialer) Dial(_ context.Context, _, _ string, _ uint32, _ bool) (io
 
 type safeProtocolClient struct {
 	mu    sync.Mutex
-	gen   uint32
+	token string
 	calls int
 }
 
-func (c *safeProtocolClient) GetReport(_ context.Context, _ io.ReadWriteCloser, _ uint32, _ uint32) (*vsockclient.GetReportResult, error) {
+func (c *safeProtocolClient) GetReport(_ context.Context, _ io.ReadWriteCloser, _ string) (*vsockclient.GetReportResult, error) {
 	c.mu.Lock()
 	c.calls++
 	c.mu.Unlock()
-	return makeReport(c.gen), nil
+	return makeReport(c.token), nil
 }
 
-type safeSender struct {
-	mu   sync.Mutex
-	sent int
-}
-
-func (s *safeSender) Send(_ context.Context, _ *virtualmachine.Info, _ *v4.IndexReport) error {
-	s.mu.Lock()
-	s.sent++
-	s.mu.Unlock()
-	return nil
+func (c *safeProtocolClient) SyncRepoCPEMapping(_ context.Context, _ io.ReadWriteCloser, _ []byte) (bool, *pb.ResponseMeta, error) {
+	return false, nil, nil
 }
 
 func TestVMScraper_ConcurrentFasterThanSequential(t *testing.T) {
@@ -839,11 +1707,10 @@ func TestVMScraper_ConcurrentFasterThanSequential(t *testing.T) {
 	}
 
 	store := &mockStore{vms: vms}
-	sender := &safeSender{}
 	dialer := &delayDialer{delay: dialDelay}
-	client := &safeProtocolClient{gen: 1}
+	client := &safeProtocolClient{token: "1"}
 
-	s, _ := newTestScraper(store, sender, dialer, client)
+	s, _ := newTestScraper(t, store, dialer, client)
 	s.concurrency = concurrency
 	// This test measures real dial overlap via delayDialer's timers, so it
 	// needs the wall clock rather than the fake test clock.
@@ -851,7 +1718,7 @@ func TestVMScraper_ConcurrentFasterThanSequential(t *testing.T) {
 
 	s.pollOnce(context.Background())
 
-	assert.Equal(t, numVMs, sender.sent)
+	assert.Equal(t, numVMs, forwardedCount(s))
 	assert.Equal(t, numVMs, client.calls)
 	// Direct concurrency signal instead of a wall-clock inference: with
 	// concurrency == numVMs, all dials should be in flight together at some
@@ -868,7 +1735,7 @@ func TestVMScraper_RetryableFailureSchedulesBackoff(t *testing.T) {
 	client := &mockProtocolClient{
 		errQueue: []error{vsockclient.ErrNotReady},
 	}
-	s, clock := newTestScraper(store, &mockSender{}, &mockDialer{}, client)
+	s, clock := newTestScraper(t, store, &mockDialer{}, client)
 
 	s.pollOnce(context.Background())
 	require.Len(t, client.calls, 1)
@@ -876,7 +1743,7 @@ func TestVMScraper_RetryableFailureSchedulesBackoff(t *testing.T) {
 
 	client.reset()
 	client.errQueue = nil
-	client.resultQueue = []*vsockclient.GetReportResult{makeReport(1)}
+	client.resultQueue = []*vsockclient.GetReportResult{makeReport("1")}
 	s.pollOnce(context.Background())
 	assert.Len(t, client.calls, 0, "should skip while backoff has not elapsed")
 
@@ -905,62 +1772,74 @@ func TestVMScraper_RetryableFailureSchedulesBackoff(t *testing.T) {
 func TestVMScraper_SchedulesByOutcome(t *testing.T) {
 	const key = "ns1/vm-a"
 	cases := map[string]struct {
-		client      *mockProtocolClient
-		sender      *mockSender
-		wantBackoff time.Duration
-		wantGap     time.Duration
+		client          *mockProtocolClient
+		centralNotReady bool
+		wantBackoff     time.Duration
+		wantGap         time.Duration
 	}{
 		"send failure should retry using backoff": {
-			client:      &mockProtocolClient{resultQueue: []*vsockclient.GetReportResult{makeReport(1)}},
-			sender:      &mockSender{err: errors.New("central unavailable")},
-			wantBackoff: initialBackoff,
-			wantGap:     initialBackoff,
+			client:          &mockProtocolClient{resultQueue: []*vsockclient.GetReportResult{makeReport("1")}},
+			centralNotReady: true,
+			wantBackoff:     initialBackoff,
+			wantGap:         initialBackoff,
 		},
 		"ErrInternal should retry using backoff": {
 			client:      &mockProtocolClient{errQueue: []error{vsockclient.ErrInternal}},
-			sender:      &mockSender{},
+			wantBackoff: initialBackoff,
+			wantGap:     initialBackoff,
+		},
+		"ErrMappingRequired should retry using backoff": {
+			client:      &mockProtocolClient{errQueue: []error{vsockclient.ErrMappingRequired}},
 			wantBackoff: initialBackoff,
 			wantGap:     initialBackoff,
 		},
 		"io.EOF should retry using backoff": {
 			client:      &mockProtocolClient{errQueue: []error{io.EOF}},
-			sender:      &mockSender{},
 			wantBackoff: initialBackoff,
 			wantGap:     initialBackoff,
 		},
 		"io.ErrUnexpectedEOF should retry using backoff": {
 			client:      &mockProtocolClient{errQueue: []error{io.ErrUnexpectedEOF}},
-			sender:      &mockSender{},
 			wantBackoff: initialBackoff,
 			wantGap:     initialBackoff,
 		},
 		"unhandled protocol error should retry using backoff": {
 			client:      &mockProtocolClient{errQueue: []error{errors.New("bogus frame")}},
-			sender:      &mockSender{},
 			wantBackoff: initialBackoff,
 			wantGap:     initialBackoff,
 		},
 		"ErrUnknownMethod should not retry using backoff": {
 			client:      &mockProtocolClient{errQueue: []error{vsockclient.ErrUnknownMethod}},
-			sender:      &mockSender{},
 			wantBackoff: 0,
 			wantGap:     5 * time.Minute, // matches newTestScraper interval
 		},
+		"ErrMalformedRequest should not retry using backoff": {
+			client:      &mockProtocolClient{errQueue: []error{vsockclient.ErrMalformedRequest}},
+			wantBackoff: 0,
+			wantGap:     5 * time.Minute,
+		},
+		"ErrRequestTooLarge should not retry using backoff": {
+			client:      &mockProtocolClient{errQueue: []error{vsockclient.ErrRequestTooLarge}},
+			wantBackoff: 0,
+			wantGap:     5 * time.Minute,
+		},
 		"invalid report should not retry using backoff": {
 			client: &mockProtocolClient{resultQueue: []*vsockclient.GetReportResult{{
-				Meta: &pb.ResponseMeta{ReportGeneration: 1},
+				Meta: &pb.ResponseMeta{ReportToken: "1"},
 			}}},
-			sender:      &mockSender{},
 			wantBackoff: 0,
 			wantGap:     5 * time.Minute,
 		},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			s, clock := newTestScraper(
+			s, clock := newTestScraper(t,
 				&mockStore{vms: []*virtualmachine.Info{makeVM("ns1", "vm-a", 100)}},
-				tc.sender, &mockDialer{}, tc.client,
+				&mockDialer{}, tc.client,
 			)
+			if tc.centralNotReady {
+				s.centralReady.Reset()
+			}
 			start := clock.Now()
 			s.pollOnce(context.Background())
 
@@ -970,6 +1849,87 @@ func TestVMScraper_SchedulesByOutcome(t *testing.T) {
 	}
 }
 
+func TestVMScraper_MaybeSyncRepoCPEMapping(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+
+	cases := map[string]struct {
+		meta          *pb.ResponseMeta
+		fetcher       *fakeFetcher
+		noFetcher     bool
+		syncErr       error
+		wantSyncCalls int
+		wantMetric    string
+	}{
+		"hash match on the SENSOR path should not dial a second time": {
+			meta:    metaWithMapping("same-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			fetcher: &fakeFetcher{ok: true, hash: "same-hash"},
+		},
+		"SENSOR mismatch should dial and sync": {
+			meta:          metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			fetcher:       &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")},
+			wantSyncCalls: 1,
+			wantMetric:    metrics.PullSyncSuccess,
+		},
+		"URL mismatch should log and count but never dial": {
+			meta:       metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_URL),
+			fetcher:    &fakeFetcher{ok: true, hash: "new-hash"},
+			wantMetric: metrics.PullSyncURLHashMismatch,
+		},
+		"UNSPECIFIED update path should never sync": {
+			meta:    metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_UNSPECIFIED),
+			fetcher: &fakeFetcher{ok: true, hash: "new-hash"},
+		},
+		"nil meta (agent predates this feature) should never sync": {
+			meta:    nil,
+			fetcher: &fakeFetcher{ok: true, hash: "new-hash"},
+		},
+		"fetcher not ok should never sync even on a SENSOR mismatch": {
+			meta:    metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			fetcher: &fakeFetcher{ok: false},
+		},
+		"no fetcher ever set should be a no-op": {
+			meta:      metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			noFetcher: true,
+		},
+		"NOT_SENSOR_MANAGED on the sync dial should log and count, not retry": {
+			meta:          metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			fetcher:       &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")},
+			syncErr:       vsockclient.ErrMappingNotSensorManaged,
+			wantSyncCalls: 1,
+			wantMetric:    metrics.PullSyncNotManaged,
+		},
+		"a generic sync failure should log and count": {
+			meta:          metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			fetcher:       &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")},
+			syncErr:       errors.New("connection reset"),
+			wantSyncCalls: 1,
+			wantMetric:    metrics.PullSyncError,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			client := &mockProtocolClient{syncErr: tc.syncErr}
+			s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, client)
+			if !tc.noFetcher {
+				s.repo2CPEFetcher = tc.fetcher
+			}
+
+			var before float64
+			if tc.wantMetric != "" {
+				before = testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(tc.wantMetric))
+			}
+
+			s.maybeSyncRepoCPEMapping(context.Background(), vm, "ns1/vm-a", 9999, tc.meta)
+
+			assert.Len(t, client.syncCalls, tc.wantSyncCalls)
+			if tc.wantMetric != "" {
+				assert.Equal(t, before+1, testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(tc.wantMetric)))
+			}
+		})
+	}
+}
+
 // TestVMScraper_NonForcedTickSkipsReconcileWhenNotDue verifies that the
 // production ticker's non-forced tick only reconciles (calling ListRunning)
 // once lastReconcile is at least reconcileEvery old, keeping ListRunning off
@@ -977,9 +1937,9 @@ func TestVMScraper_SchedulesByOutcome(t *testing.T) {
 func TestVMScraper_NonForcedTickSkipsReconcileWhenNotDue(t *testing.T) {
 	store := &mockStore{vms: []*virtualmachine.Info{makeVM("ns1", "vm-a", 100)}}
 	client := &mockProtocolClient{
-		resultQueue: []*vsockclient.GetReportResult{makeReport(1), makeReport(1)},
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1"), makeReport("1")},
 	}
-	s, clock := newTestScraper(store, &mockSender{}, &mockDialer{}, client)
+	s, clock := newTestScraper(t, store, &mockDialer{}, client)
 
 	s.pollOnce(context.Background())
 	require.Equal(t, 1, store.listRunningCalls, "pollOnce forces exactly one reconcile")
@@ -1011,6 +1971,217 @@ func cachedNextAttemptAt(t *testing.T, s *VMScraper, key string) time.Time {
 	})
 }
 
+// TestVMScraper_DialAndGetReport_SyncTriggering exercises maybeSyncRepoCPEMapping's
+// integration point inside dialAndGetReport: only a successful exchange or
+// MAPPING_REQUIRED carries usable Meta, so only those should ever reach the
+// fetcher/second dial.
+func TestVMScraper_DialAndGetReport_SyncTriggering(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	staleFetcher := func() *fakeFetcher {
+		return &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")}
+	}
+
+	cases := map[string]struct {
+		resultQueue   []*vsockclient.GetReportResult
+		errQueue      []error
+		wantOutcome   scrapeOutcome
+		wantSyncCalls int
+	}{
+		"MAPPING_REQUIRED error triggers a sync attempt": {
+			resultQueue:   []*vsockclient.GetReportResult{{Meta: metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR)}},
+			errQueue:      []error{vsockclient.ErrMappingRequired},
+			wantOutcome:   scrapeRetryable,
+			wantSyncCalls: 1,
+		},
+		"NOT_READY never triggers a sync attempt": {
+			errQueue:    []error{vsockclient.ErrNotReady},
+			wantOutcome: scrapeRetryable,
+		},
+		"a generic protocol error never triggers a sync attempt": {
+			errQueue:    []error{errors.New("connection refused")},
+			wantOutcome: scrapeRetryable,
+		},
+		"a successful report with a stale Sensor-managed hash also triggers a sync": {
+			resultQueue: []*vsockclient.GetReportResult{{
+				IndexReport: &v4.IndexReport{State: "IndexFinished"},
+				Meta:        metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			}},
+			wantOutcome:   scrapeOK,
+			wantSyncCalls: 1,
+		},
+		"an Unchanged report with a matching hash never triggers a sync": {
+			resultQueue: []*vsockclient.GetReportResult{{
+				Unchanged: true,
+				Meta:      metaWithMapping("new-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			}},
+			wantOutcome: scrapeOK,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			client := &mockProtocolClient{resultQueue: tc.resultQueue, errQueue: tc.errQueue}
+			s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, client)
+			s.repo2CPEFetcher = staleFetcher()
+
+			_, outcome := s.dialAndGetReport(context.Background(), vm, "ns1/vm-a", 1, "")
+
+			assert.Equal(t, tc.wantOutcome, outcome)
+			assert.Len(t, client.syncCalls, tc.wantSyncCalls)
+		})
+	}
+}
+
+// TestVMScraper_SyncRepoCPEMapping_CanceledParent_ClassifiedAsTimeout covers
+// Sensor stop counting as PullSyncTimeout, not PullSyncError.
+func TestVMScraper_SyncRepoCPEMapping_CanceledParent_ClassifiedAsTimeout(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	dialer := &mockDialer{err: errors.New("dial must not be attempted")}
+	s, _ := newTestScraper(t, &mockStore{}, dialer, &mockProtocolClient{})
+
+	timeoutBefore := testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout))
+	syncErrBefore := testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	s.syncRepoCPEMapping(ctx, vm, "ns1/vm-a", 1, []byte("payload"))
+
+	assert.Zero(t, dialer.callIdx.Load(), "a canceled parent must not be dialed at all")
+	assert.Equal(t, timeoutBefore+1, testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout)))
+	assert.Equal(t, syncErrBefore, testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError)),
+		"a canceled parent must not be counted as a sync error")
+}
+
+// TestVMScraper_SyncRepoCPEMapping_DialTimeout_ClassifiedAsTimeout covers
+// perVMTimeout expiring during Dial counting as PullSyncTimeout, not
+// PullSyncError (same rule as dialAndGetReport).
+func TestVMScraper_SyncRepoCPEMapping_DialTimeout_ClassifiedAsTimeout(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	s, _ := newTestScraper(t, &mockStore{}, blockingDialer{}, &mockProtocolClient{})
+	s.perVMTimeout = 20 * time.Millisecond
+
+	timeoutBefore := testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout))
+	syncErrBefore := testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError))
+
+	s.syncRepoCPEMapping(context.Background(), vm, "ns1/vm-a", 1, []byte("payload"))
+
+	assert.Equal(t, timeoutBefore+1, testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout)))
+	assert.Equal(t, syncErrBefore, testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError)),
+		"a dial timeout must not be counted as a sync error")
+}
+
+// TestVMScraper_SyncRepoCPEMapping_SyncTimeout_ClassifiedAsTimeout covers
+// perVMTimeout expiring during SyncRepoCPEMapping counting as
+// PullSyncTimeout, not PullSyncError (same rule as handleGetReportError).
+func TestVMScraper_SyncRepoCPEMapping_SyncTimeout_ClassifiedAsTimeout(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	client := &mockProtocolClient{syncBlocksOnCtx: true}
+	s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, client)
+	s.perVMTimeout = 20 * time.Millisecond
+
+	timeoutBefore := testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout))
+	syncErrBefore := testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError))
+
+	s.syncRepoCPEMapping(context.Background(), vm, "ns1/vm-a", 1, []byte("payload"))
+
+	require.Len(t, client.syncCalls, 1)
+	assert.Equal(t, timeoutBefore+1, testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncTimeout)))
+	assert.Equal(t, syncErrBefore, testutil.ToFloat64(metrics.PullSyncTotal.WithLabelValues(metrics.PullSyncError)),
+		"a sync timeout must not be counted as a sync error")
+}
+
+// TestVMScraper_SendSucceedsAfterSyncOverrunsGetReportDeadline covers Send
+// succeeding after GetReport and mapping sync each consume a full timeout.
+func TestVMScraper_SendSucceedsAfterSyncOverrunsGetReportDeadline(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		vm := makeVM("ns1", "vm-a", 100)
+		rep := makeReport("1")
+		rep.Meta.RepoCpeMappingHash = new("old-hash")
+		rep.Meta.RepoCpeMappingUpdatePath = pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR.Enum()
+		client := &mockProtocolClient{
+			resultQueue:    []*vsockclient.GetReportResult{rep},
+			getReportDelay: 15 * time.Millisecond,
+			syncDelay:      15 * time.Millisecond,
+		}
+		s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, client)
+		s.perVMTimeout = 20 * time.Millisecond
+		s.repo2CPEFetcher = &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")}
+
+		s.pollOnce(t.Context())
+
+		require.Equal(t, 1, forwardedCount(s), "GetReport's deadline must not fail forward after a mapping sync")
+		require.Len(t, client.syncCalls, 1)
+	})
+}
+
+// TestVMScraper_MappingRequiredClassifiedDespiteSlowSync covers MAPPING_REQUIRED
+// staying mapping_required when mapping sync overruns GetReport's deadline.
+func TestVMScraper_MappingRequiredClassifiedDespiteSlowSync(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		vm := makeVM("ns1", "vm-a", 100)
+		client := &mockProtocolClient{
+			resultQueue: []*vsockclient.GetReportResult{{
+				Meta: metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+			}},
+			errQueue:       []error{vsockclient.ErrMappingRequired},
+			getReportDelay: 15 * time.Millisecond,
+			syncDelay:      15 * time.Millisecond,
+		}
+		s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, client)
+		s.perVMTimeout = 20 * time.Millisecond
+		s.repo2CPEFetcher = &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")}
+
+		mappingBefore := testutil.ToFloat64(metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportMappingRequired))
+		timeoutBefore := testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportTimeout))
+
+		s.pollOnce(t.Context())
+
+		require.Len(t, client.syncCalls, 1)
+		assert.Equal(t, mappingBefore+1, testutil.ToFloat64(metrics.PullGetReportTotal.WithLabelValues(metrics.PullGetReportMappingRequired)))
+		assert.Equal(t, timeoutBefore, testutil.ToFloat64(metrics.PullTransportTotal.WithLabelValues(metrics.PullTransportTimeout)),
+			"a slow mapping sync must not rewrite MAPPING_REQUIRED as a transport timeout")
+	})
+}
+
+// TestVMScraper_DialAndGetReport_ClosesConnectionBeforeSync guards against
+// maybeSyncRepoCPEMapping's second dial racing the first GetReport connection: roxagent
+// allows only one connection at a time, so dialAndGetReport must close its
+// stream before calling maybeSyncRepoCPEMapping, not rely solely on its deferred close.
+func TestVMScraper_DialAndGetReport_ClosesConnectionBeforeSync(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	dialer := &singleConnDialer{}
+	client := &mockProtocolClient{resultQueue: []*vsockclient.GetReportResult{{
+		IndexReport: &v4.IndexReport{State: "IndexFinished"},
+		Meta:        metaWithMapping("old-hash", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR),
+	}}}
+	s, _ := newTestScraper(t, &mockStore{}, dialer, client)
+	s.repo2CPEFetcher = &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")}
+
+	_, outcome := s.dialAndGetReport(context.Background(), vm, "ns1/vm-a", 1, "")
+
+	require.Equal(t, scrapeOK, outcome)
+	require.Len(t, client.syncCalls, 1, "maybeSyncRepoCPEMapping's dial must succeed, not be rejected as busy by a still-open first connection")
+}
+
+// TestVMScraper_DialAndGetReport_MappingRequired_ClosesConnectionBeforeSync
+// is the MAPPING_REQUIRED-error counterpart: that path closes and syncs
+// from a different branch than the success path above.
+func TestVMScraper_DialAndGetReport_MappingRequired_ClosesConnectionBeforeSync(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	dialer := &singleConnDialer{}
+	client := &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{{Meta: metaWithMapping("", pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR)}},
+		errQueue:    []error{vsockclient.ErrMappingRequired},
+	}
+	s, _ := newTestScraper(t, &mockStore{}, dialer, client)
+	s.repo2CPEFetcher = &fakeFetcher{ok: true, hash: "new-hash", mapping: []byte("payload")}
+
+	_, outcome := s.dialAndGetReport(context.Background(), vm, "ns1/vm-a", 1, "")
+
+	require.Equal(t, scrapeRetryable, outcome)
+	require.Len(t, client.syncCalls, 1, "maybeSyncRepoCPEMapping's dial must succeed, not be rejected as busy by a still-open first connection")
+}
+
 func TestClampPollInterval(t *testing.T) {
 	cases := map[string]struct {
 		in   time.Duration
@@ -1035,3 +2206,32 @@ func TestClampPollInterval(t *testing.T) {
 		})
 	}
 }
+
+func TestVMScraper_Capabilities(t *testing.T) {
+	s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, &mockProtocolClient{})
+	assert.Equal(t, []centralsensor.SensorCapability{centralsensor.SensorACKSupport}, s.Capabilities())
+}
+
+func TestVMScraper_ForwardReport(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+	require.NoError(t, s.forwardReport(t.Context(), vm, makeReport("tok-1").IndexReport))
+	assert.Equal(t, 1, forwardedCount(s))
+}
+
+func TestVMScraper_ForwardReport_EnqueueBlocked(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		vm := makeVM("ns1", "vm-a", 100)
+		s, _ := newTestScraper(t, &mockStore{vms: []*virtualmachine.Info{vm}}, &mockDialer{}, &mockProtocolClient{})
+		s.toCentral = make(chan *message.ExpiringMessage)
+		blockedBefore := testutil.ToFloat64(metrics.IndexReportEnqueueBlockedTotal)
+		done := make(chan error, 1)
+		go func() {
+			done <- s.forwardReport(t.Context(), vm, makeReport("tok-1").IndexReport)
+		}()
+		synctest.Wait()
+		assert.Equal(t, blockedBefore+1, testutil.ToFloat64(metrics.IndexReportEnqueueBlockedTotal))
+		<-s.toCentral
+		require.NoError(t, <-done)
+	})
+}
diff --git a/sensor/common/virtualmachine/vmscraper/spreading_test.go b/sensor/common/virtualmachine/vmscraper/spreading_test.go
new file mode 100644
index 0000000000000..ee0870931bb79
--- /dev/null
+++ b/sensor/common/virtualmachine/vmscraper/spreading_test.go
@@ -0,0 +1,447 @@
+package vmscraper
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/stackrox/rox/pkg/concurrency"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/logging"
+	"github.com/stackrox/rox/sensor/common/virtualmachine"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/metrics"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/vsockclient"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
+)
+
+// recordingDialer counts Dial calls so tests can assert how many scrapes a tick started.
+type recordingDialer struct {
+	calls atomic.Int32
+}
+
+func (d *recordingDialer) Dial(_ context.Context, _, _ string, _ uint32, _ bool) (io.ReadWriteCloser, error) {
+	d.calls.Add(1)
+	return nopCloser{}, nil
+}
+
+// sequencedRand returns successive values from seq, then the last value.
+func sequencedRand(seq []float64) func() float64 {
+	var i atomic.Int32
+	return func() float64 {
+		idx := int(i.Add(1) - 1)
+		if idx >= len(seq) {
+			return seq[len(seq)-1]
+		}
+		return seq[idx]
+	}
+}
+
+func TestVMScraper_CadenceRescheduleUsesSteadyBand(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{makeVM("ns", "vm-a", 1)}}
+	s, clock := newTestScraper(t, store, &mockDialer{}, &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+	})
+	s.spreadFraction = 2.0 / 3
+	// First draw (reconcile insert) keeps the VM due now; second is the cadence offset.
+	s.randFloat64 = sequencedRand([]float64{0, 0.5})
+
+	start := clock.Now()
+	s.pollOnce(context.Background())
+
+	steadyWidth := steadySpreadWidth(s.interval, s.spreadFraction)
+	want := start.Add(s.interval + steadyWidth/2)
+	assert.Equal(t, want, cachedNextAttemptAt(t, s, "ns/vm-a"))
+	assert.Greater(t, histogramSampleCount(t, metrics.PullScheduleOffsetSeconds), uint64(0))
+}
+
+func TestVMScraper_ManyCadencedSuccessesSpanSteadyBand(t *testing.T) {
+	const numVMs = 5
+	vms := make([]*virtualmachine.Info, 0, numVMs)
+	for i := range numVMs {
+		vms = append(vms, makeVM("ns", fmt.Sprintf("vm-%d", i), uint32(10+i)))
+	}
+	store := &mockStore{vms: vms}
+	s, clock := newTestScraper(t, store, &mockDialer{}, &safeProtocolClient{token: "1"})
+	s.concurrency = numVMs
+	s.interval = time.Hour
+	s.spreadFraction = 2.0 / 3
+	s.tickInterval = newVMIndexReportWindow(s.interval)
+	s.reconcileEvery = reconcilePeriod(s.interval)
+	s.randFloat64 = sequencedRand([]float64{0, 0.25, 0.5, 0.75, 1})
+
+	now := clock.Now()
+	concurrency.WithLock(&s.mu, func() {
+		for _, vm := range vms {
+			s.vmState[vm.Key()] = &vmState{
+				vmID:          vm.ID,
+				nextAttemptAt: now,
+			}
+		}
+		s.lastReconcile = now
+	})
+
+	s.tick(context.Background(), false)
+
+	steadyWidth := steadySpreadWidth(s.interval, s.spreadFraction)
+	minNext, maxNext := now.Add(s.interval), now.Add(s.interval+steadyWidth)
+	var earliest, latest time.Time
+	concurrency.WithLock(&s.mu, func() {
+		for _, st := range s.vmState {
+			if earliest.IsZero() || st.nextAttemptAt.Before(earliest) {
+				earliest = st.nextAttemptAt
+			}
+			if latest.IsZero() || st.nextAttemptAt.After(latest) {
+				latest = st.nextAttemptAt
+			}
+			assert.False(t, st.nextAttemptAt.Before(minNext))
+			assert.False(t, st.nextAttemptAt.After(maxNext))
+		}
+	})
+	assert.GreaterOrEqual(t, latest.Sub(earliest), steadyWidth/2,
+		"distinct RNG draws should spread nextAttemptAt across a wide band")
+}
+
+func TestVMScraper_MassFirstInsertSpansNewVMIndexReportWindow(t *testing.T) {
+	const numVMs = 10
+	vms := make([]*virtualmachine.Info, 0, numVMs)
+	for i := range numVMs {
+		vms = append(vms, makeVM("ns", fmt.Sprintf("vm-%d", i), uint32(100+i)))
+	}
+	store := &mockStore{vms: vms}
+	s, clock := newTestScraper(t, store, &mockDialer{}, &safeProtocolClient{token: "1"})
+	s.concurrency = numVMs
+	s.interval = time.Hour
+	units := make([]float64, numVMs)
+	for i := range units {
+		units[i] = float64(i) / float64(numVMs-1)
+	}
+	s.randFloat64 = sequencedRand(units)
+
+	s.reconcile()
+
+	newVMWindow := newVMIndexReportWindow(s.interval)
+	now := clock.Now()
+	var earliest, latest time.Time
+	concurrency.WithLock(&s.mu, func() {
+		require.Len(t, s.vmState, numVMs)
+		for _, st := range s.vmState {
+			assert.False(t, st.nextAttemptAt.Before(now))
+			assert.False(t, st.nextAttemptAt.After(now.Add(newVMWindow)))
+			if earliest.IsZero() || st.nextAttemptAt.Before(earliest) {
+				earliest = st.nextAttemptAt
+			}
+			if latest.IsZero() || st.nextAttemptAt.After(latest) {
+				latest = st.nextAttemptAt
+			}
+		}
+	})
+	assert.Greater(t, latest.Sub(earliest), time.Duration(0),
+		"mass insert must not schedule every VM at exactly now")
+	assert.GreaterOrEqual(t, latest.Sub(earliest), newVMWindow/2)
+}
+
+func TestVMScraper_SingleInsertUsesNewVMIndexReportSpread(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{makeVM("ns", "only", 1)}}
+	s, clock := newTestScraper(t, store, &mockDialer{}, &safeProtocolClient{token: "1"})
+	s.concurrency = 20
+	s.randFloat64 = func() float64 { return 0.5 }
+
+	s.reconcile()
+
+	newVMWindow := newVMIndexReportWindow(s.interval)
+	assert.Equal(t, clock.Now().Add(newVMWindow/2), cachedNextAttemptAt(t, s, "ns/only"),
+		"every first schedule uses the new-VM index report window, including a lone insert with free slots")
+}
+
+func TestVMScraper_MultiInsertUsesNewVMIndexReportSpread(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{
+		makeVM("ns", "a", 1),
+		makeVM("ns", "b", 2),
+	}}
+	s, clock := newTestScraper(t, store, &mockDialer{}, &safeProtocolClient{token: "1"})
+	s.concurrency = 20
+	s.randFloat64 = sequencedRand([]float64{0.25, 0.75})
+
+	s.reconcile()
+
+	newVMWindow := newVMIndexReportWindow(s.interval)
+	assert.Equal(t, clock.Now().Add(newVMWindow/4), cachedNextAttemptAt(t, s, "ns/a"))
+	assert.Equal(t, clock.Now().Add(3*newVMWindow/4), cachedNextAttemptAt(t, s, "ns/b"))
+}
+
+func TestVMScraper_RetryPathDoesNotUseSteadyBand(t *testing.T) {
+	store := &mockStore{vms: []*virtualmachine.Info{makeVM("ns1", "vm-a", 100)}}
+	client := &mockProtocolClient{errQueue: []error{vsockclient.ErrNotReady}}
+	s, clock := newTestScraper(t, store, &mockDialer{}, client)
+	// Insert due now; a later unit of 1 would be full steadyWidth if cadence used RNG.
+	s.randFloat64 = sequencedRand([]float64{0, 1})
+
+	start := clock.Now()
+	s.pollOnce(context.Background())
+	assert.Equal(t, initialBackoff, cachedNextAttemptAt(t, s, "ns1/vm-a").Sub(start),
+		"retryable path must use short backoff, not pollInterval+steadyWidth")
+	assert.Equal(t, initialBackoff, cachedBackoff(t, s, "ns1/vm-a"))
+}
+
+func TestVMScraper_NACKPathDoesNotUseSteadyBand(t *testing.T) {
+	vm := makeVM("ns1", "vm-a", 100)
+	store := &mockStore{vms: []*virtualmachine.Info{vm}}
+	s, clock := newTestScraper(t, store, &mockDialer{}, &mockProtocolClient{
+		resultQueue: []*vsockclient.GetReportResult{makeReport("1")},
+	})
+	s.randFloat64 = sequencedRand([]float64{0, 1})
+	s.pollOnce(context.Background())
+
+	start := clock.Now()
+	s.handleNACK(string(vm.ID) + ":1")
+	assert.Equal(t, initialBackoff, cachedNextAttemptAt(t, s, "ns1/vm-a").Sub(start))
+	assert.Equal(t, initialBackoff, cachedBackoff(t, s, "ns1/vm-a"))
+}
+
+func TestVMScraper_DuePileIsPacedByStartBudget(t *testing.T) {
+	const numVMs = 10
+	vms := make([]*virtualmachine.Info, 0, numVMs)
+	for i := range numVMs {
+		vms = append(vms, makeVM("ns", fmt.Sprintf("vm-%d", i), uint32(100+i)))
+	}
+	dialer := &recordingDialer{}
+	s, _ := newTestScraper(t, &mockStore{vms: vms}, dialer, &safeProtocolClient{token: "1"})
+	s.concurrency = numVMs
+	s.interval = time.Hour
+	s.tickInterval = defaultTickInterval
+	s.reconcileEvery = reconcilePeriod(s.interval)
+
+	now := s.now()
+	concurrency.WithLock(&s.mu, func() {
+		for _, vm := range vms {
+			s.vmState[vm.Key()] = &vmState{
+				vmID:          vm.ID,
+				nextAttemptAt: now,
+			}
+		}
+		s.lastReconcile = now
+	})
+
+	window := newVMIndexReportWindow(s.interval)
+	want := startBudget(numVMs, s.tickInterval, window)
+	require.Equal(t, 1, want)
+	require.Greater(t, want, 0)
+	require.Less(t, want, numVMs)
+	require.LessOrEqual(t, want, s.concurrency)
+
+	s.tick(context.Background(), false)
+	assert.Equal(t, int32(want), dialer.calls.Load())
+
+	dialer.calls.Store(0)
+	s.tick(context.Background(), false)
+	assert.Equal(t, int32(want), dialer.calls.Load(), "leftovers stay due for later ticks")
+}
+
+// TestVMScraper_AllDueClumpDrainsWithinIndexWindow covers a 100-VM all-due
+// clump: fleet-sized budget drains it in one index window.
+func TestVMScraper_AllDueClumpDrainsWithinIndexWindow(t *testing.T) {
+	const numVMs = 100
+	vms := make([]*virtualmachine.Info, 0, numVMs)
+	for i := range numVMs {
+		vms = append(vms, makeVM("ns", fmt.Sprintf("vm-%d", i), uint32(100+i)))
+	}
+	dialer := &recordingDialer{}
+	s, _ := newTestScraper(t, &mockStore{vms: vms}, dialer, &safeProtocolClient{token: "1"})
+	s.concurrency = numVMs
+	s.tickInterval = defaultTickInterval
+	s.reconcileEvery = reconcilePeriod(s.interval)
+
+	now := s.now()
+	concurrency.WithLock(&s.mu, func() {
+		for _, vm := range vms {
+			s.vmState[vm.Key()] = &vmState{
+				vmID:          vm.ID,
+				nextAttemptAt: now,
+			}
+		}
+		s.lastReconcile = now
+	})
+
+	window := newVMIndexReportWindow(s.interval)
+	require.Equal(t, 100*time.Second, window)
+	perTick := startBudget(numVMs, s.tickInterval, window)
+	require.Equal(t, 10, perTick, "ceil(100 × 10s / 100s) = 10")
+	ticks := (numVMs + perTick - 1) / perTick
+	require.Equal(t, 10, ticks)
+
+	for range ticks {
+		s.tick(context.Background(), false)
+	}
+	assert.Equal(t, int32(numVMs), dialer.calls.Load(),
+		"a shrinking-n budget would start only 55 of 100 in 10 ticks (10+9+…+1)")
+	assert.Empty(t, s.dueKeys(), "the clump should have left the due pile within the index window")
+}
+
+// TestVMScraper_SpreadDuePileStartsAtFleetRate covers VMs already spread by
+// nextAttemptAt: the due snapshot is smaller than the fleet, but the rate
+// must still be the fleet cap so every currently-due VM can start.
+func TestVMScraper_SpreadDuePileStartsAtFleetRate(t *testing.T) {
+	const (
+		numVMs = 100
+		nDue   = 10
+	)
+	vms := make([]*virtualmachine.Info, 0, numVMs)
+	for i := range numVMs {
+		vms = append(vms, makeVM("ns", fmt.Sprintf("vm-%d", i), uint32(100+i)))
+	}
+	dialer := &recordingDialer{}
+	s, _ := newTestScraper(t, &mockStore{vms: vms}, dialer, &safeProtocolClient{token: "1"})
+	s.concurrency = numVMs
+	s.tickInterval = defaultTickInterval
+	s.reconcileEvery = reconcilePeriod(s.interval)
+
+	now := s.now()
+	concurrency.WithLock(&s.mu, func() {
+		for i, vm := range vms {
+			st := &vmState{
+				vmID:          vm.ID,
+				nextAttemptAt: now.Add(time.Hour),
+			}
+			if i < nDue {
+				st.nextAttemptAt = now
+			}
+			s.vmState[vm.Key()] = st
+		}
+		s.lastReconcile = now
+	})
+	require.Len(t, s.dueKeys(), nDue)
+
+	s.tick(context.Background(), false)
+	assert.Equal(t, int32(nDue), dialer.calls.Load(),
+		"a due-pile budget would start 1 (ceil(10 × 10s / 100s)), not all 10 due")
+	assert.Empty(t, s.dueKeys())
+}
+
+func TestSpreadFractionEnvDefault(t *testing.T) {
+	assert.InDelta(t, 2.0/3, env.VirtualMachinesScraperSteadySpreadFraction.DefaultValue(), 1e-9)
+	assert.InDelta(t, 2.0/3, env.VirtualMachinesScraperSteadySpreadFraction.FloatSetting(), 1e-9)
+}
+
+func TestVMScraper_StartsPerTickObservesLaunchCount(t *testing.T) {
+	const numVMs = 5
+	vms := make([]*virtualmachine.Info, 0, numVMs)
+	for i := range numVMs {
+		vms = append(vms, makeVM("ns", fmt.Sprintf("vm-%d", i), uint32(10+i)))
+	}
+	s, clock := newTestScraper(t, &mockStore{vms: vms}, &mockDialer{}, &safeProtocolClient{token: "1"})
+	s.concurrency = numVMs
+	s.reconcileEvery = reconcilePeriod(s.interval)
+
+	now := clock.Now()
+	concurrency.WithLock(&s.mu, func() {
+		for _, vm := range vms {
+			s.vmState[vm.Key()] = &vmState{
+				vmID:          vm.ID,
+				nextAttemptAt: now,
+			}
+		}
+		s.lastReconcile = now
+	})
+
+	beforeCount := histogramSampleCount(t, metrics.PullStartsPerTick)
+	beforeSum := histogramSampleSum(t, metrics.PullStartsPerTick)
+	s.tick(context.Background(), false)
+	assert.Equal(t, beforeCount+1, histogramSampleCount(t, metrics.PullStartsPerTick))
+	assert.InDelta(t, beforeSum+float64(numVMs), histogramSampleSum(t, metrics.PullStartsPerTick), 1e-9)
+}
+
+func TestVMScraper_StartsPerTickSkipsIdleTicks(t *testing.T) {
+	s, clock := newTestScraper(t, &mockStore{}, &mockDialer{}, &mockProtocolClient{})
+	now := clock.Now()
+	concurrency.WithLock(&s.mu, func() {
+		s.lastReconcile = now
+	})
+
+	before := histogramSampleCount(t, metrics.PullStartsPerTick)
+	s.tick(context.Background(), false)
+	assert.Equal(t, before, histogramSampleCount(t, metrics.PullStartsPerTick),
+		"idle ticks must not observe starts-per-tick")
+}
+
+func TestVMScraper_WarnIfSpreadSaturated(t *testing.T) {
+	// newTestScraper uses a 5m poll, 2/3 spread, 10s tick (capacity 20).
+	cases := map[string]struct {
+		numVMs         int
+		tickInterval   time.Duration
+		spreadFraction float64
+		wantLogs       int
+	}{
+		"under capacity does not warn": {
+			numVMs:         20,
+			tickInterval:   defaultTickInterval,
+			spreadFraction: 2.0 / 3,
+		},
+		"over capacity warns": {
+			numVMs:         21,
+			tickInterval:   defaultTickInterval,
+			spreadFraction: 2.0 / 3,
+			wantLogs:       1,
+		},
+		"zero tick does not warn": {
+			numVMs:         100,
+			tickInterval:   time.Duration(0),
+			spreadFraction: 2.0 / 3,
+		},
+		"zero spread does not warn": {
+			numVMs:         100,
+			tickInterval:   defaultTickInterval,
+			spreadFraction: 0,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			// Must not use t.Parallel() because it temporarily modifies the package logger.
+			core, logs := observer.New(zap.WarnLevel)
+			orig := log
+			log = &logging.LoggerImpl{InnerLogger: zap.New(core).Sugar()}
+			t.Cleanup(func() { log = orig })
+
+			s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, &mockProtocolClient{})
+			s.tickInterval = tc.tickInterval
+			s.spreadFraction = tc.spreadFraction
+			s.warnIfSpreadSaturated(tc.numVMs)
+			// Counting the number of Warn logs emitted to not assert on the log msg text.
+			assert.Equal(t, tc.wantLogs, logs.Len())
+		})
+	}
+}
+
+func TestVMScraper_ForwardInterarrivalObservesAfterFirst(t *testing.T) {
+	s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, &mockProtocolClient{})
+	before := histogramSampleCount(t, metrics.PullForwardInterarrivalSeconds)
+	s.observeForwardInterarrival()
+	assert.Equal(t, before, histogramSampleCount(t, metrics.PullForwardInterarrivalSeconds),
+		"first forward does not observe a gap")
+	s.observeForwardInterarrival()
+	assert.Equal(t, before+1, histogramSampleCount(t, metrics.PullForwardInterarrivalSeconds))
+}
+
+func histogramSampleCount(t *testing.T, h prometheus.Histogram) uint64 {
+	t.Helper()
+	return histogramMetric(t, h).GetSampleCount()
+}
+
+func histogramSampleSum(t *testing.T, h prometheus.Histogram) float64 {
+	t.Helper()
+	return histogramMetric(t, h).GetSampleSum()
+}
+
+func histogramMetric(t *testing.T, h prometheus.Histogram) *dto.Histogram {
+	t.Helper()
+	var m dto.Metric
+	require.NoError(t, h.(prometheus.Metric).Write(&m))
+	return m.GetHistogram()
+}
diff --git a/sensor/common/virtualmachine/vmscraper/stats.go b/sensor/common/virtualmachine/vmscraper/stats.go
new file mode 100644
index 0000000000000..87e3609b08930
--- /dev/null
+++ b/sensor/common/virtualmachine/vmscraper/stats.go
@@ -0,0 +1,81 @@
+package vmscraper
+
+import (
+	"slices"
+	"strings"
+)
+
+const (
+	maxVersionBuckets   = 20
+	unknownAgentVersion = "unknown"
+	otherAgentVersion   = "other"
+)
+
+// Stats is a point-in-time snapshot of the scraper's fleet state.
+type Stats struct {
+	TrackedVMs    int
+	VMsScanned    int
+	VersionCounts map[string]int // scanned VMs only; empty AgentVersion is "unknown"
+}
+
+// Stats returns a point-in-time snapshot of fleet statistics.
+// VersionCounts omits never-scraped VMs: those have no agent version to report.
+func (s *VMScraper) Stats() Stats {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return computeStats(s.vmState)
+}
+
+func computeStats(vmState map[string]*vmState) Stats {
+	st := Stats{
+		TrackedVMs:    len(vmState),
+		VersionCounts: make(map[string]int, min(len(vmState), maxVersionBuckets+1)),
+	}
+
+	for _, vs := range vmState {
+		if vs.lastForwardedAt.IsZero() {
+			continue
+		}
+		st.VMsScanned++
+		ver := vs.lastAgentVersion
+		if ver == "" {
+			ver = unknownAgentVersion
+		}
+		st.VersionCounts[ver]++
+	}
+
+	capVersionCounts(st.VersionCounts)
+	return st
+}
+
+// capVersionCounts keeps only the top-N versions by count, folding the rest
+// into an "other" bucket so the map size is bounded regardless of fleet size.
+func capVersionCounts(counts map[string]int) {
+	if len(counts) <= maxVersionBuckets {
+		return
+	}
+
+	type entry struct {
+		ver   string
+		count int
+	}
+	entries := make([]entry, 0, len(counts))
+	for v, c := range counts {
+		entries = append(entries, entry{v, c})
+	}
+	slices.SortFunc(entries, func(a, b entry) int {
+		if a.count != b.count {
+			return b.count - a.count // descending by count
+		}
+		return strings.Compare(a.ver, b.ver) // stable tiebreak
+	})
+
+	otherTotal := 0
+	for _, e := range entries[maxVersionBuckets:] {
+		otherTotal += e.count
+		delete(counts, e.ver)
+	}
+	if otherTotal > 0 {
+		counts[otherAgentVersion] += otherTotal
+	}
+}
diff --git a/sensor/common/virtualmachine/vmscraper/stats_test.go b/sensor/common/virtualmachine/vmscraper/stats_test.go
new file mode 100644
index 0000000000000..91664565cf591
--- /dev/null
+++ b/sensor/common/virtualmachine/vmscraper/stats_test.go
@@ -0,0 +1,108 @@
+package vmscraper
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+const (
+	testAgentVersion470  = "4.7.0-12-gabcdef0123" // typical ldflags / git describe build
+	testAgentVersion480  = "4.8.0-3-gfedcba9876"
+	testAgentDevelopment = "development" // local default before ldflags injection
+)
+
+// testGitDescribeBuild returns git-describe-shaped version strings; commitNum is
+// zero-padded so lexical order matches numeric order in the cap tie-break test.
+func testGitDescribeBuild(commitNum int) string {
+	return fmt.Sprintf("4.7.0-%02d-g01234567%02d", commitNum, commitNum)
+}
+
+func TestVMScraper_Stats(t *testing.T) {
+	tests := map[string]struct {
+		setup        func(s *VMScraper)
+		wantTracked  int
+		wantScanned  int
+		wantVersions map[string]int
+	}{
+		"should return zeros when no VMs are tracked": {
+			setup:        func(_ *VMScraper) {},
+			wantTracked:  0,
+			wantScanned:  0,
+			wantVersions: map[string]int{},
+		},
+		"should count tracked and scanned VMs correctly": {
+			setup: func(s *VMScraper) {
+				now := s.now()
+				s.vmState["ns1/vm-a"] = &vmState{
+					lastForwardedAt:  now,
+					lastAgentVersion: testAgentVersion470,
+				}
+				s.vmState["ns1/vm-b"] = &vmState{
+					lastAgentVersion: testAgentVersion470,
+				}
+				s.vmState["ns2/vm-c"] = &vmState{
+					lastForwardedAt:  now,
+					lastAgentVersion: testAgentVersion480,
+				}
+			},
+			wantTracked: 3,
+			wantScanned: 2,
+			wantVersions: map[string]int{
+				testAgentVersion470: 1,
+				testAgentVersion480: 1,
+			},
+		},
+		"should bucket empty agent version of a scanned VM as unknown": {
+			setup: func(s *VMScraper) {
+				s.vmState["ns1/vm-a"] = &vmState{
+					lastForwardedAt: s.now(),
+				}
+				s.vmState["ns1/vm-b"] = &vmState{
+					lastAgentVersion: testAgentDevelopment,
+					lastForwardedAt:  s.now(),
+				}
+			},
+			wantTracked: 2,
+			wantScanned: 2,
+			wantVersions: map[string]int{
+				unknownAgentVersion:  1,
+				testAgentDevelopment: 1,
+			},
+		},
+		"should cap version map to top N and fold remainder into other": {
+			setup: func(s *VMScraper) {
+				for i := range maxVersionBuckets + 5 {
+					s.vmState[fmt.Sprintf("ns/vm-%d", i)] = &vmState{
+						lastAgentVersion: testGitDescribeBuild(i),
+						lastForwardedAt:  s.now(),
+					}
+				}
+			},
+			wantTracked: maxVersionBuckets + 5,
+			wantScanned: maxVersionBuckets + 5,
+			wantVersions: func() map[string]int {
+				m := make(map[string]int, maxVersionBuckets+1)
+				for i := range maxVersionBuckets {
+					m[testGitDescribeBuild(i)] = 1
+				}
+				m[otherAgentVersion] = 5
+				return m
+			}(),
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			s, _ := newTestScraper(t, &mockStore{}, &mockDialer{}, &mockProtocolClient{})
+			tc.setup(s)
+			stats := s.Stats()
+
+			assert.Equal(t, tc.wantTracked, stats.TrackedVMs)
+			assert.Equal(t, tc.wantScanned, stats.VMsScanned)
+
+			assert.Equal(t, tc.wantVersions, stats.VersionCounts)
+		})
+	}
+}
diff --git a/sensor/common/virtualmachine/vsockclient/client.go b/sensor/common/virtualmachine/vsockclient/client.go
index 38ce4c9cf3346..56246054a2cba 100644
--- a/sensor/common/virtualmachine/vsockclient/client.go
+++ b/sensor/common/virtualmachine/vsockclient/client.go
@@ -27,8 +27,20 @@ var (
 	ErrUnknownMethod = errors.New("agent does not support the requested method")
 	// ErrInternal indicates the agent encountered an internal error.
 	ErrInternal = errors.New("agent internal error")
+	// ErrMalformedRequest indicates the agent rejected the request as invalid.
+	ErrMalformedRequest = errors.New("agent rejected request as malformed")
+	// ErrRequestTooLarge indicates the request exceeded the agent's size limit.
+	ErrRequestTooLarge = errors.New("agent rejected request as too large")
 	// ErrBusy indicates the agent's single connection slot is held by another request.
 	ErrBusy = errors.New("agent is busy with another request")
+	// ErrUnknownAgentError indicates a well-formed ErrorResponse whose code
+	// this client doesn't recognize (e.g. a future ErrorCode value).
+	ErrUnknownAgentError = errors.New("unrecognized agent error code")
+	// ErrMappingRequired indicates the agent has no repository-to-CPE mapping yet.
+	ErrMappingRequired = errors.New("agent has no repository-to-CPE mapping yet")
+	// ErrMappingNotSensorManaged indicates the agent rejected a
+	// SyncRepoCPEMapping because it is URL-managed, not Sensor-managed.
+	ErrMappingNotSensorManaged = errors.New("agent does not accept a sensor-pushed mapping")
 )
 
 // GetReportResult holds the parsed response from a GetReport call.
@@ -65,17 +77,15 @@ func NewClient(capabilities []string, maxResponseSize int) *Client {
 	return &Client{capabilities: capabilities, maxResponseSize: maxResponseSize}
 }
 
-// GetReport sends a GetReportRequest and returns the response. knownEpoch is
-// the last epoch Sensor observed for this VM (see ResponseMeta.epoch); pass 0
-// when unknown. Sending it lets the agent detect a restart-coincidence false
-// match and serve the full report in this same round trip, instead of the
-// caller needing a second, forced request.
+// GetReport sends a GetReportRequest and returns the response. lastKnownToken
+// is the last report_token Sensor observed for this VM; pass "" when unknown
+// or when forcing a full report (mandatory refresh).
 //
 // The stream must be an io.ReadWriteCloser (from MultiDialer.Dial). If ctx is
 // cancelled while a write or read is in progress, the stream is closed so the
 // blocked I/O unblocks promptly — needed on Sensor shutdown, where parent
 // cancel does not rewrite the dial-time socket deadline.
-func (c *Client) GetReport(ctx context.Context, stream io.ReadWriteCloser, ifNewerThan uint32, knownEpoch uint32) (*GetReportResult, error) {
+func (c *Client) GetReport(ctx context.Context, stream io.ReadWriteCloser, lastKnownToken string) (*GetReportResult, error) {
 	stop := context.AfterFunc(ctx, func() {
 		_ = stream.Close()
 	})
@@ -88,8 +98,7 @@ func (c *Client) GetReport(ctx context.Context, stream io.ReadWriteCloser, ifNew
 		},
 		Method: &pb.VMServiceRequest_GetReport{
 			GetReport: &pb.GetReportRequest{
-				LastKnownGeneration: ifNewerThan,
-				KnownEpoch:          knownEpoch,
+				LastKnownToken: lastKnownToken,
 			},
 		},
 	}
@@ -123,12 +132,62 @@ func (c *Client) GetReport(ctx context.Context, stream io.ReadWriteCloser, ifNew
 			Meta:        resp.GetMeta(),
 		}, nil
 	case *pb.VMServiceResponse_Error:
-		return nil, errorFromResponse(r.Error)
+		// Meta is still returned alongside the error: a VM with no mapping
+		// at all has nothing to report except MAPPING_REQUIRED, and that
+		// error's Meta is the only way the caller learns it needs to push one.
+		return &GetReportResult{Meta: resp.GetMeta()}, errorFromResponse(r.Error)
 	default:
 		return nil, fmt.Errorf("unexpected response type: %T", resp.GetResult())
 	}
 }
 
+// SyncRepoCPEMapping pushes mapping to the agent over stream and reports
+// whether the agent applied it. Mirrors GetReport's request/response framing
+// and error classification for the sync_repo_cpe_mapping method.
+func (c *Client) SyncRepoCPEMapping(ctx context.Context, stream io.ReadWriteCloser, mapping []byte) (updated bool, meta *pb.ResponseMeta, err error) {
+	stop := context.AfterFunc(ctx, func() {
+		_ = stream.Close()
+	})
+	defer stop()
+
+	req := &pb.VMServiceRequest{
+		Meta: &pb.RequestMeta{
+			RequestId:    uuid.NewV4().String(),
+			Capabilities: c.capabilities,
+		},
+		Method: &pb.VMServiceRequest_SyncRepoCpeMapping{
+			SyncRepoCpeMapping: &pb.SyncRepoCPEMappingRequest{Mapping: mapping},
+		},
+	}
+
+	reqData, err := proto.Marshal(req)
+	if err != nil {
+		return false, nil, fmt.Errorf("marshaling request: %w", err)
+	}
+	if err := vsockframing.WriteFrame(stream, reqData); err != nil {
+		return false, nil, wrapStreamErr(ctx, "sending request", err)
+	}
+
+	respData, err := vsockframing.ReadFrame(stream, uint32(c.maxResponseSize))
+	if err != nil {
+		return false, nil, wrapStreamErr(ctx, "reading response", err)
+	}
+
+	var resp pb.VMServiceResponse
+	if err := proto.Unmarshal(respData, &resp); err != nil {
+		return false, nil, fmt.Errorf("unmarshaling response: %w", err)
+	}
+
+	switch r := resp.GetResult().(type) {
+	case *pb.VMServiceResponse_SyncRepoCpeMapping:
+		return r.SyncRepoCpeMapping.GetUpdated(), resp.GetMeta(), nil
+	case *pb.VMServiceResponse_Error:
+		return false, resp.GetMeta(), errorFromResponse(r.Error)
+	default:
+		return false, nil, fmt.Errorf("unexpected response type: %T", resp.GetResult())
+	}
+}
+
 func wrapStreamErr(ctx context.Context, op string, err error) error {
 	if ctxErr := ctx.Err(); ctxErr != nil {
 		return fmt.Errorf("%s: %w", op, ctxErr)
@@ -144,9 +203,17 @@ func errorFromResponse(e *pb.ErrorResponse) error {
 		return fmt.Errorf("%w: %s", ErrUnknownMethod, e.GetMessage())
 	case pb.ErrorCode_ERROR_CODE_INTERNAL:
 		return fmt.Errorf("%w: %s", ErrInternal, e.GetMessage())
+	case pb.ErrorCode_ERROR_CODE_MALFORMED_REQUEST:
+		return fmt.Errorf("%w: %s", ErrMalformedRequest, e.GetMessage())
+	case pb.ErrorCode_ERROR_CODE_REQUEST_TOO_LARGE:
+		return fmt.Errorf("%w: %s", ErrRequestTooLarge, e.GetMessage())
 	case pb.ErrorCode_ERROR_CODE_BUSY:
 		return fmt.Errorf("%w: %s", ErrBusy, e.GetMessage())
+	case pb.ErrorCode_ERROR_CODE_MAPPING_REQUIRED:
+		return fmt.Errorf("%w: %s", ErrMappingRequired, e.GetMessage())
+	case pb.ErrorCode_ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED:
+		return fmt.Errorf("%w: %s", ErrMappingNotSensorManaged, e.GetMessage())
 	default:
-		return fmt.Errorf("agent error (%s): %s", e.GetCode(), e.GetMessage())
+		return fmt.Errorf("%w: agent error (%s): %s", ErrUnknownAgentError, e.GetCode(), e.GetMessage())
 	}
 }
diff --git a/sensor/common/virtualmachine/vsockclient/client_integration_test.go b/sensor/common/virtualmachine/vsockclient/client_integration_test.go
index f7ca53bbdd583..0fd7183a52446 100644
--- a/sensor/common/virtualmachine/vsockclient/client_integration_test.go
+++ b/sensor/common/virtualmachine/vsockclient/client_integration_test.go
@@ -2,8 +2,10 @@ package vsockclient
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
+	"path/filepath"
 	"testing"
 	"testing/synctest"
 	"time"
@@ -11,12 +13,30 @@ import (
 	roxagentvsock "github.com/stackrox/rox/compliance/virtualmachines/roxagent/vsockserver"
 	v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
 	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/virtualmachine/cpemapping"
 	"github.com/stackrox/rox/pkg/vsockframing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
 )
 
+// fakeMappingProvider is a MappingProvider test double whose Ready/Hash/
+// UpdatePath are directly settable; Bytes/Path are unused by the Handler
+// and always error.
+type fakeMappingProvider struct {
+	ready      bool
+	hash       string
+	updatePath pb.RepoCPEMappingUpdatePath
+}
+
+func (f *fakeMappingProvider) Ready() bool                             { return f.ready }
+func (f *fakeMappingProvider) Hash() string                            { return f.hash }
+func (f *fakeMappingProvider) UpdatePath() pb.RepoCPEMappingUpdatePath { return f.updatePath }
+func (f *fakeMappingProvider) Bytes() ([]byte, error)                  { return nil, errors.New("not implemented") }
+func (f *fakeMappingProvider) Path() (string, error)                   { return "", errors.New("not implemented") }
+
+var _ roxagentvsock.MappingProvider = (*fakeMappingProvider)(nil)
+
 // exchangeTimeout bounds a single client/handler exchange. Under synctest the
 // fake clock advances this duration instantly once every goroutine is durably
 // blocked (e.g. a protocol deadlock on net.Pipe), so GetReport's context
@@ -55,26 +75,26 @@ func newProtocolHarness(t *testing.T, opts protocolHarnessOptions) *protocolHarn
 
 	cache := &roxagentvsock.ReportCache{}
 	if opts.seedReport != nil {
-		cache.SetReport(opts.seedReport, opts.seedFacts)
+		cache.SetReport(opts.seedReport, opts.seedFacts, "")
 	}
 
 	return &protocolHarness{
 		client:  NewClient(opts.capabilities, opts.maxResponseSize),
 		cache:   cache,
-		handler: roxagentvsock.NewHandler(cache, opts.agentVersion),
+		handler: roxagentvsock.NewHandler(cache, opts.agentVersion, &fakeMappingProvider{ready: true}, nil),
 	}
 }
 
-func (h *protocolHarness) getReport(t *testing.T, ifNewerThan, knownEpoch uint32) (*GetReportResult, error) {
+func (h *protocolHarness) getReport(t *testing.T, lastKnownToken string) (*GetReportResult, error) {
 	t.Helper()
-	return exchangeOnce(t, h.client, ifNewerThan, knownEpoch, h.handler.HandleConn)
+	return exchangeOnce(t, h.client, lastKnownToken, h.handler.HandleConn)
 }
 
 // exchangeOnce runs a single GetReport against responder over net.Pipe()
 // inside a synctest bubble. A stuck peer makes the exchange timeout fire on
 // the fake clock (via GetReport's AfterFunc stream close) instead of hanging
 // the package on wall time.
-func exchangeOnce(t *testing.T, client *Client, ifNewerThan, knownEpoch uint32, responder func(net.Conn)) (*GetReportResult, error) {
+func exchangeOnce(t *testing.T, client *Client, lastKnownToken string, responder func(net.Conn)) (*GetReportResult, error) {
 	t.Helper()
 
 	var result *GetReportResult
@@ -91,7 +111,7 @@ func exchangeOnce(t *testing.T, client *Client, ifNewerThan, knownEpoch uint32,
 			responder(agentConn)
 		}()
 
-		result, err = client.GetReport(ctx, clientConn, ifNewerThan, knownEpoch)
+		result, err = client.GetReport(ctx, clientConn, lastKnownToken)
 		// Close the client end before waiting so a responder blocked in WriteFrame
 		// (or similar) is unblocked even when GetReport already returned.
 		_ = clientConn.Close()
@@ -109,11 +129,10 @@ func exchangeOnce(t *testing.T, client *Client, ifNewerThan, knownEpoch uint32,
 func TestGetReportIntegration(t *testing.T) {
 	cases := map[string]struct {
 		// Arguments
-		seedReport   *v4.IndexReport
-		seedFacts    map[string]string
-		agentVersion string
-		ifNewerThan  uint32
-		knownEpoch   uint32
+		seedReport     *v4.IndexReport
+		seedFacts      map[string]string
+		agentVersion   string
+		lastKnownToken string
 		// Expectations
 		wantErr     error
 		checkResult func(t *testing.T, result *GetReportResult)
@@ -132,30 +151,22 @@ func TestGetReportIntegration(t *testing.T) {
 
 				require.NotNil(t, result.Meta)
 				assert.Equal(t, "roxagent-0.3.1-deadbeef", result.Meta.GetAgentVersion())
-				assert.Equal(t, uint32(1), result.Meta.GetReportGeneration())
+				assert.NotEmpty(t, result.Meta.GetReportToken())
 				assert.NotNil(t, result.Meta.GetReportGeneratedAt())
 				assert.Contains(t, result.Meta.GetSupportedMethods(), "get_report")
 				assert.Equal(t, "rhel", result.Meta.GetFacts()["os"])
 				assert.Equal(t, "x86_64", result.Meta.GetFacts()["arch"])
 			},
 		},
-		"should return unchanged when generation matches": {
-			seedReport:  &v4.IndexReport{HashId: "unchanged-hash"},
-			ifNewerThan: 1,
+		"should return full report when last known token does not match": {
+			seedReport:     &v4.IndexReport{HashId: "post-restart-hash"},
+			lastKnownToken: "stale-token",
 			checkResult: func(t *testing.T, result *GetReportResult) {
-				assert.True(t, result.Unchanged)
-				assert.Nil(t, result.IndexReport)
-				assert.Equal(t, uint32(1), result.Meta.GetReportGeneration())
-			},
-		},
-		"should return full report when sensor generation exceeds agent after restart": {
-			seedReport:  &v4.IndexReport{HashId: "post-restart-hash"},
-			ifNewerThan: 5,
-			checkResult: func(t *testing.T, result *GetReportResult) {
-				assert.False(t, result.Unchanged, "agent restarted (gen=1 < requested=5), must serve full report")
+				assert.False(t, result.Unchanged)
 				require.NotNil(t, result.IndexReport)
 				assert.Equal(t, "post-restart-hash", result.IndexReport.GetHashId())
-				assert.Equal(t, uint32(1), result.Meta.GetReportGeneration())
+				assert.NotEmpty(t, result.Meta.GetReportToken())
+				assert.NotEqual(t, "stale-token", result.Meta.GetReportToken())
 				assert.NotNil(t, result.Meta.GetReportGeneratedAt())
 				assert.Contains(t, result.Meta.GetSupportedMethods(), "get_report")
 			},
@@ -170,7 +181,7 @@ func TestGetReportIntegration(t *testing.T) {
 				agentVersion: tc.agentVersion,
 			})
 
-			result, err := h.getReport(t, tc.ifNewerThan, tc.knownEpoch)
+			result, err := h.getReport(t, tc.lastKnownToken)
 
 			if tc.wantErr != nil {
 				require.Error(t, err)
@@ -185,45 +196,99 @@ func TestGetReportIntegration(t *testing.T) {
 	}
 }
 
-// TestGetReportIntegration_KnownEpochSingleRoundTrip drives a real Client
-// against a real roxagent Handler to verify the single-round-trip contract.
-// report_generation resets to 1 on every roxagent restart, so a restarted
-// agent can coincidentally match a generation Sensor already has cached.
-// known_epoch lets the agent detect that restart itself, in a single round
-// trip, by comparing Sensor's last-seen epoch against its current one.
-func TestGetReportIntegration_KnownEpochSingleRoundTrip(t *testing.T) {
+// TestGetReportIntegration_TokenRoundTrip drives a real Client against a
+// real roxagent Handler: matching token is unchanged, a different token
+// (restart or new scan) serves the full report in the same round trip.
+func TestGetReportIntegration_TokenRoundTrip(t *testing.T) {
 	h := newProtocolHarness(t, protocolHarnessOptions{
-		seedReport: &v4.IndexReport{HashId: "epoch-test-hash"},
+		seedReport: &v4.IndexReport{HashId: "token-test-hash"},
 	})
 
-	// First-ever request for this VM: Sensor has no cached epoch yet.
-	first, err := h.getReport(t, 0, 0)
+	first, err := h.getReport(t, "")
 	require.NoError(t, err)
 	require.False(t, first.Unchanged)
-	epoch := first.Meta.GetEpoch()
-	require.NotZero(t, epoch, "agent should seed a non-zero epoch")
+	token := first.Meta.GetReportToken()
+	require.NotEmpty(t, token)
 
-	t.Run("unchanged in a single round trip when known epoch matches", func(t *testing.T) {
-		result, err := h.getReport(t, 1, epoch)
+	t.Run("unchanged in a single round trip when last known token matches", func(t *testing.T) {
+		result, err := h.getReport(t, token)
 		require.NoError(t, err)
 		assert.True(t, result.Unchanged)
 		assert.Nil(t, result.IndexReport)
+		assert.Equal(t, token, result.Meta.GetReportToken())
 	})
 
-	t.Run("full report in a single round trip when known epoch mismatches despite matching generation", func(t *testing.T) {
-		result, err := h.getReport(t, 1, epoch+1)
+	t.Run("full report in a single round trip when last known token mismatches", func(t *testing.T) {
+		result, err := h.getReport(t, "other-token")
 		require.NoError(t, err)
-		assert.False(t, result.Unchanged, "epoch mismatch must be resolved in this same response, not a second dial")
+		assert.False(t, result.Unchanged)
 		require.NotNil(t, result.IndexReport)
-		assert.Equal(t, "epoch-test-hash", result.IndexReport.GetHashId())
-		assert.Equal(t, epoch, result.Meta.GetEpoch(), "response must carry the agent's current epoch")
+		assert.Equal(t, "token-test-hash", result.IndexReport.GetHashId())
+		assert.Equal(t, token, result.Meta.GetReportToken())
 	})
+}
 
-	t.Run("unchanged when known epoch is zero (backward compat: falls back to generation-only)", func(t *testing.T) {
-		result, err := h.getReport(t, 1, 0)
-		require.NoError(t, err)
-		assert.True(t, result.Unchanged)
+// syncOnce mirrors exchangeOnce for a single SyncRepoCPEMapping exchange.
+func syncOnce(t *testing.T, client *Client, mapping []byte, responder func(net.Conn)) (bool, *pb.ResponseMeta, error) {
+	t.Helper()
+
+	var updated bool
+	var meta *pb.ResponseMeta
+	var err error
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(t.Context(), exchangeTimeout)
+		defer cancel()
+
+		clientConn, agentConn := net.Pipe()
+
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			responder(agentConn)
+		}()
+
+		updated, meta, err = client.SyncRepoCPEMapping(ctx, clientConn, mapping)
+		_ = clientConn.Close()
+		select {
+		case <-done:
+		case <-ctx.Done():
+			if err == nil {
+				err = fmt.Errorf("waiting for responder: %w", ctx.Err())
+			}
+		}
 	})
+	return updated, meta, err
+}
+
+// TestSyncRepoCPEMappingIntegration_FullRoundTrip drives a real Client and
+// Handler through GetReport (MAPPING_REQUIRED) -> SyncRepoCPEMapping ->
+// GetReport again; every seam here is otherwise only unit-tested against fakes.
+func TestSyncRepoCPEMappingIntegration_FullRoundTrip(t *testing.T) {
+	mapping := []byte(`{"data":{"rhel-9-server-rpms":{"cpes":["cpe:/o:redhat:enterprise_linux:9"]}}}`)
+	updater := roxagentvsock.NewSensorUpdater(filepath.Join(t.TempDir(), "cache.json"), "", nil)
+	cache := &roxagentvsock.ReportCache{}
+	handler := roxagentvsock.NewHandler(cache, "test-agent", updater, updater)
+	client := NewClient([]string{CapabilityReportV1}, 10<<20)
+
+	first, err := exchangeOnce(t, client, "", handler.HandleConn)
+	require.ErrorIs(t, err, ErrMappingRequired, "no bootstrapped mapping must surface as MAPPING_REQUIRED")
+	require.NotNil(t, first.Meta)
+	assert.Equal(t, pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR, first.Meta.GetRepoCpeMappingUpdatePath())
+	assert.Empty(t, first.Meta.GetRepoCpeMappingHash())
+
+	updated, syncMeta, err := syncOnce(t, client, mapping, handler.HandleConn)
+	require.NoError(t, err)
+	assert.True(t, updated)
+	wantHash := cpemapping.HashMapping(mapping)
+	assert.Equal(t, wantHash, syncMeta.GetRepoCpeMappingHash())
+
+	cache.SetReport(&v4.IndexReport{HashId: "sync-integration-hash"}, nil, wantHash)
+
+	second, err := exchangeOnce(t, client, "", handler.HandleConn)
+	require.NoError(t, err)
+	require.NotNil(t, second.IndexReport)
+	assert.Equal(t, "sync-integration-hash", second.IndexReport.GetHashId())
+	assert.Equal(t, wantHash, second.Meta.GetRepoCpeMappingHash(), "the follow-up GetReport must reflect the mapping pushed via Sync")
 }
 
 // --- Compatibility persona helpers ---
@@ -262,16 +327,15 @@ func respondOnce(t testing.TB, conn net.Conn, build func(*pb.VMServiceRequest) *
 // oldAgentResponder models a plausible older roxagent that:
 //   - supports only get_report
 //   - does not advertise supported_methods
-//   - does not include facts, report_generated_at, or epoch
-//   - always returns the full report (ignores last_known_generation and known_epoch)
+//   - does not include facts, report_generated_at, or report_token
+//   - always returns the full report (ignores last_known_token)
 //   - returns UNKNOWN_METHOD for anything else
-func oldAgentResponder(t testing.TB, report *v4.IndexReport, generation uint32) func(net.Conn) {
+func oldAgentResponder(t testing.TB, report *v4.IndexReport) func(net.Conn) {
 	return func(conn net.Conn) {
 		respondOnce(t, conn, func(req *pb.VMServiceRequest) *pb.VMServiceResponse {
 			resp := &pb.VMServiceResponse{
 				Meta: &pb.ResponseMeta{
-					AgentVersion:     "roxagent-0.1.0",
-					ReportGeneration: generation,
+					AgentVersion: "roxagent-0.1.0",
 				},
 			}
 			if req.GetGetReport() != nil {
@@ -295,22 +359,22 @@ func oldAgentResponder(t testing.TB, report *v4.IndexReport, generation uint32)
 //   - advertises extra supported_methods beyond get_report
 //   - still handles get_report correctly
 //   - includes richer metadata (facts, supported_methods)
-//   - supports last_known_generation (unchanged semantics)
+//   - supports last_known_token (unchanged semantics)
 //   - returns UNKNOWN_METHOD for methods it doesn't recognize
-func futureAgentResponder(t testing.TB, report *v4.IndexReport, generation uint32) func(net.Conn) {
+func futureAgentResponder(t testing.TB, report *v4.IndexReport, token string) func(net.Conn) {
 	return func(conn net.Conn) {
 		respondOnce(t, conn, func(req *pb.VMServiceRequest) *pb.VMServiceResponse {
 			resp := &pb.VMServiceResponse{
 				Meta: &pb.ResponseMeta{
 					AgentVersion:     "roxagent-2.0.0-future",
-					ReportGeneration: generation,
+					ReportToken:      token,
 					SupportedMethods: []string{"get_report", "get_config", "submit_event"},
 					Facts:            map[string]string{"os_id": "rhel", "protocol_version": "2"},
 				},
 			}
 			switch {
 			case req.GetGetReport() != nil:
-				if req.GetGetReport().GetLastKnownGeneration() == generation {
+				if req.GetGetReport().GetLastKnownToken() == token {
 					resp.Result = &pb.VMServiceResponse_GetReport{
 						GetReport: &pb.GetReportResponse{Unchanged: true},
 					}
@@ -341,7 +405,7 @@ func assertOldAgentReport(t *testing.T, result *GetReportResult) {
 	require.NotNil(t, result.IndexReport)
 	assert.Equal(t, "compat-hash", result.IndexReport.GetHashId())
 	assert.Equal(t, "roxagent-0.1.0", result.Meta.GetAgentVersion())
-	assert.Equal(t, uint32(1), result.Meta.GetReportGeneration())
+	assert.Empty(t, result.Meta.GetReportToken())
 	assert.Empty(t, result.Meta.GetSupportedMethods())
 	assert.Empty(t, result.Meta.GetFacts())
 }
@@ -353,63 +417,52 @@ func TestGetReportCompatibility(t *testing.T) {
 	cases := map[string]struct {
 		// Arguments
 		makeResponderFunc func(t testing.TB) func(net.Conn)
-		ifNewerThan       uint32
-		knownEpoch        uint32
+		lastKnownToken    string
 		// Expectations
 		checkResult func(t *testing.T, result *GetReportResult)
 	}{
 		"old agent should serve get_report to current sensor": {
-			makeResponderFunc: func(t testing.TB) func(net.Conn) { return oldAgentResponder(t, report, 1) },
+			makeResponderFunc: func(t testing.TB) func(net.Conn) { return oldAgentResponder(t, report) },
 			checkResult: func(t *testing.T, result *GetReportResult) {
 				assert.False(t, result.Unchanged)
 				assertOldAgentReport(t, result)
 			},
 		},
-		"old agent should always return full report ignoring last_known_generation": {
-			makeResponderFunc: func(t testing.TB) func(net.Conn) { return oldAgentResponder(t, report, 1) },
-			ifNewerThan:       1,
+		"old agent should always return full report ignoring last_known_token": {
+			makeResponderFunc: func(t testing.TB) func(net.Conn) { return oldAgentResponder(t, report) },
+			lastKnownToken:    "tok-1",
 			checkResult: func(t *testing.T, result *GetReportResult) {
 				assert.False(t, result.Unchanged, "old agent does not support unchanged optimization")
 				assertOldAgentReport(t, result)
 			},
 		},
-		"old agent should tolerate non-zero known_epoch and omit epoch in response": {
-			makeResponderFunc: func(t testing.TB) func(net.Conn) { return oldAgentResponder(t, report, 1) },
-			ifNewerThan:       1,
-			knownEpoch:        42,
-			checkResult: func(t *testing.T, result *GetReportResult) {
-				assert.False(t, result.Unchanged)
-				assertOldAgentReport(t, result)
-				assert.Zero(t, result.Meta.GetEpoch(), "old agent does not populate epoch")
-			},
-		},
 		"future agent should serve get_report to current sensor": {
-			makeResponderFunc: func(t testing.TB) func(net.Conn) { return futureAgentResponder(t, report, 1) },
+			makeResponderFunc: func(t testing.TB) func(net.Conn) { return futureAgentResponder(t, report, "tok-1") },
 			checkResult: func(t *testing.T, result *GetReportResult) {
 				assert.False(t, result.Unchanged)
 				require.NotNil(t, result.IndexReport)
 				assert.Equal(t, "compat-hash", result.IndexReport.GetHashId())
 				assert.Equal(t, "roxagent-2.0.0-future", result.Meta.GetAgentVersion())
-				assert.Equal(t, uint32(1), result.Meta.GetReportGeneration())
+				assert.Equal(t, "tok-1", result.Meta.GetReportToken())
 				assert.Equal(t, []string{"get_report", "get_config", "submit_event"}, result.Meta.GetSupportedMethods())
 				assert.Equal(t, "rhel", result.Meta.GetFacts()["os_id"])
 				assert.Equal(t, "2", result.Meta.GetFacts()["protocol_version"])
 			},
 		},
-		"future agent should return unchanged when generation matches": {
-			makeResponderFunc: func(t testing.TB) func(net.Conn) { return futureAgentResponder(t, report, 3) },
-			ifNewerThan:       3,
+		"future agent should return unchanged when last known token matches": {
+			makeResponderFunc: func(t testing.TB) func(net.Conn) { return futureAgentResponder(t, report, "tok-3") },
+			lastKnownToken:    "tok-3",
 			checkResult: func(t *testing.T, result *GetReportResult) {
 				assert.True(t, result.Unchanged)
 				assert.Nil(t, result.IndexReport)
-				assert.Equal(t, uint32(3), result.Meta.GetReportGeneration())
+				assert.Equal(t, "tok-3", result.Meta.GetReportToken())
 			},
 		},
 	}
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			result, err := exchangeOnce(t, client, tc.ifNewerThan, tc.knownEpoch, tc.makeResponderFunc(t))
+			result, err := exchangeOnce(t, client, tc.lastKnownToken, tc.makeResponderFunc(t))
 
 			require.NoError(t, err)
 			if tc.checkResult != nil {
diff --git a/sensor/common/virtualmachine/vsockclient/client_test.go b/sensor/common/virtualmachine/vsockclient/client_test.go
index e26e671b3a3fc..ffd701dafa6b3 100644
--- a/sensor/common/virtualmachine/vsockclient/client_test.go
+++ b/sensor/common/virtualmachine/vsockclient/client_test.go
@@ -40,7 +40,7 @@ func TestSendGetReport_Success(t *testing.T) {
 	defer utils.IgnoreError(clientConn.Close)
 
 	go serveOnce(t, agentConn, &pb.VMServiceResponse{
-		Meta: &pb.ResponseMeta{AgentVersion: "test-agent", ReportGeneration: 1},
+		Meta: &pb.ResponseMeta{AgentVersion: "test-agent", ReportToken: "tok-1"},
 		Result: &pb.VMServiceResponse_GetReport{
 			GetReport: &pb.GetReportResponse{
 				IndexReport: &v4.IndexReport{HashId: "test-hash"},
@@ -49,14 +49,14 @@ func TestSendGetReport_Success(t *testing.T) {
 	}, func(req *pb.VMServiceRequest) {
 		assert.NotEmpty(t, req.GetMeta().GetRequestId())
 		assert.Equal(t, []string{CapabilityReportV1}, req.GetMeta().GetCapabilities())
-		assert.Equal(t, uint32(0), req.GetGetReport().GetLastKnownGeneration())
+		assert.Empty(t, req.GetGetReport().GetLastKnownToken())
 	})
 
-	result, err := client.GetReport(context.Background(), clientConn, 0, 0)
+	result, err := client.GetReport(context.Background(), clientConn, "")
 	require.NoError(t, err)
 	assert.Equal(t, "test-hash", result.IndexReport.GetHashId())
 	assert.False(t, result.Unchanged)
-	assert.Equal(t, uint32(1), result.Meta.GetReportGeneration())
+	assert.Equal(t, "tok-1", result.Meta.GetReportToken())
 }
 
 func TestSendGetReport_Unchanged(t *testing.T) {
@@ -65,20 +65,19 @@ func TestSendGetReport_Unchanged(t *testing.T) {
 	defer utils.IgnoreError(clientConn.Close)
 
 	go serveOnce(t, agentConn, &pb.VMServiceResponse{
-		Meta: &pb.ResponseMeta{AgentVersion: "test-agent", ReportGeneration: 5},
+		Meta: &pb.ResponseMeta{AgentVersion: "test-agent", ReportToken: "tok-5"},
 		Result: &pb.VMServiceResponse_GetReport{
 			GetReport: &pb.GetReportResponse{Unchanged: true},
 		},
 	}, func(req *pb.VMServiceRequest) {
-		assert.Equal(t, uint32(5), req.GetGetReport().GetLastKnownGeneration())
-		assert.Equal(t, uint32(42), req.GetGetReport().GetKnownEpoch())
+		assert.Equal(t, "tok-5", req.GetGetReport().GetLastKnownToken())
 	})
 
-	result, err := client.GetReport(context.Background(), clientConn, 5, 42)
+	result, err := client.GetReport(context.Background(), clientConn, "tok-5")
 	require.NoError(t, err)
 	assert.Nil(t, result.IndexReport)
 	assert.True(t, result.Unchanged)
-	assert.Equal(t, uint32(5), result.Meta.GetReportGeneration())
+	assert.Equal(t, "tok-5", result.Meta.GetReportToken())
 }
 
 func TestSendGetReport_NilReportRejected(t *testing.T) {
@@ -87,13 +86,13 @@ func TestSendGetReport_NilReportRejected(t *testing.T) {
 	defer utils.IgnoreError(clientConn.Close)
 
 	go serveOnce(t, agentConn, &pb.VMServiceResponse{
-		Meta: &pb.ResponseMeta{AgentVersion: "test-agent", ReportGeneration: 1},
+		Meta: &pb.ResponseMeta{AgentVersion: "test-agent", ReportToken: "tok-1"},
 		Result: &pb.VMServiceResponse_GetReport{
 			GetReport: &pb.GetReportResponse{},
 		},
 	}, nil)
 
-	_, err := client.GetReport(context.Background(), clientConn, 0, 0)
+	_, err := client.GetReport(context.Background(), clientConn, "")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "IndexReport is nil")
 }
@@ -121,10 +120,38 @@ func TestSendGetReport_ErrorCodes(t *testing.T) {
 			wantErr:   ErrInternal,
 			wantInMsg: "scan crashed",
 		},
+		"should wrap ErrMalformedRequest for MALFORMED_REQUEST": {
+			code:      pb.ErrorCode_ERROR_CODE_MALFORMED_REQUEST,
+			message:   "empty request_id",
+			wantErr:   ErrMalformedRequest,
+			wantInMsg: "empty request_id",
+		},
+		"should wrap ErrRequestTooLarge for REQUEST_TOO_LARGE": {
+			code:      pb.ErrorCode_ERROR_CODE_REQUEST_TOO_LARGE,
+			message:   "payload exceeds 10MB limit",
+			wantErr:   ErrRequestTooLarge,
+			wantInMsg: "10MB",
+		},
 		"should wrap ErrBusy for BUSY": {
-			code:    pb.ErrorCode_ERROR_CODE_BUSY,
-			message: "agent is already serving another request",
-			wantErr: ErrBusy,
+			code:      pb.ErrorCode_ERROR_CODE_BUSY,
+			message:   "agent is already serving another request",
+			wantErr:   ErrBusy,
+			wantInMsg: "another request",
+		},
+		"should wrap ErrUnknownAgentError for UNSPECIFIED": {
+			code:    pb.ErrorCode_ERROR_CODE_UNSPECIFIED,
+			message: "",
+			wantErr: ErrUnknownAgentError,
+		},
+		"should wrap ErrMappingRequired for MAPPING_REQUIRED": {
+			code:    pb.ErrorCode_ERROR_CODE_MAPPING_REQUIRED,
+			message: "repository-to-CPE mapping not yet available",
+			wantErr: ErrMappingRequired,
+		},
+		"should wrap ErrMappingNotSensorManaged for MAPPING_NOT_SENSOR_MANAGED": {
+			code:    pb.ErrorCode_ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED,
+			message: "url-managed",
+			wantErr: ErrMappingNotSensorManaged,
 		},
 	}
 	for name, tc := range cases {
@@ -140,7 +167,7 @@ func TestSendGetReport_ErrorCodes(t *testing.T) {
 				},
 			}, nil)
 
-			_, err := client.GetReport(context.Background(), clientConn, 0, 0)
+			_, err := client.GetReport(context.Background(), clientConn, "")
 			require.Error(t, err)
 			assert.ErrorIs(t, err, tc.wantErr)
 			if tc.wantInMsg != "" {
@@ -150,6 +177,87 @@ func TestSendGetReport_ErrorCodes(t *testing.T) {
 	}
 }
 
+// TestSendGetReport_ErrorCarriesMeta verifies that an error response's Meta
+// is still returned alongside the error, not dropped: MAPPING_REQUIRED is
+// the only way a VM with no mapping at all can tell Sensor it needs one.
+func TestSendGetReport_ErrorCarriesMeta(t *testing.T) {
+	client := NewClient(nil, 10<<20)
+	clientConn, agentConn := net.Pipe()
+	defer utils.IgnoreError(clientConn.Close)
+
+	go serveOnce(t, agentConn, &pb.VMServiceResponse{
+		Meta: &pb.ResponseMeta{
+			AgentVersion:             "test-agent",
+			RepoCpeMappingHash:       new(""),
+			RepoCpeMappingUpdatePath: pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR.Enum(),
+		},
+		Result: &pb.VMServiceResponse_Error{
+			Error: &pb.ErrorResponse{Code: pb.ErrorCode_ERROR_CODE_MAPPING_REQUIRED, Message: "no mapping yet"},
+		},
+	}, nil)
+
+	result, err := client.GetReport(context.Background(), clientConn, "")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrMappingRequired)
+	require.NotNil(t, result, "error result must still carry Meta")
+	require.NotNil(t, result.Meta)
+	assert.Equal(t, pb.RepoCPEMappingUpdatePath_REPO_CPE_MAPPING_UPDATE_PATH_SENSOR, result.Meta.GetRepoCpeMappingUpdatePath())
+	assert.Empty(t, result.Meta.GetRepoCpeMappingHash())
+}
+
+func TestSendSyncRepoCPEMapping(t *testing.T) {
+	cases := map[string]struct {
+		resp        *pb.VMServiceResponse
+		wantUpdated bool
+		wantErr     error
+	}{
+		"should report updated true on success": {
+			resp: &pb.VMServiceResponse{
+				Meta:   &pb.ResponseMeta{AgentVersion: "test-agent"},
+				Result: &pb.VMServiceResponse_SyncRepoCpeMapping{SyncRepoCpeMapping: &pb.SyncRepoCPEMappingResponse{Updated: true}},
+			},
+			wantUpdated: true,
+		},
+		"should report updated false when the mapping already matched": {
+			resp: &pb.VMServiceResponse{
+				Meta:   &pb.ResponseMeta{AgentVersion: "test-agent"},
+				Result: &pb.VMServiceResponse_SyncRepoCpeMapping{SyncRepoCpeMapping: &pb.SyncRepoCPEMappingResponse{Updated: false}},
+			},
+			wantUpdated: false,
+		},
+		"should wrap ErrMappingNotSensorManaged when the agent is URL-managed": {
+			resp: &pb.VMServiceResponse{
+				Meta: &pb.ResponseMeta{AgentVersion: "test-agent"},
+				Result: &pb.VMServiceResponse_Error{
+					Error: &pb.ErrorResponse{Code: pb.ErrorCode_ERROR_CODE_MAPPING_NOT_SENSOR_MANAGED, Message: "url-managed"},
+				},
+			},
+			wantErr: ErrMappingNotSensorManaged,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			client := NewClient(nil, 10<<20)
+			clientConn, agentConn := net.Pipe()
+			defer utils.IgnoreError(clientConn.Close)
+
+			go serveOnce(t, agentConn, tc.resp, func(req *pb.VMServiceRequest) {
+				assert.Equal(t, []byte("mapping-bytes"), req.GetSyncRepoCpeMapping().GetMapping())
+			})
+
+			updated, meta, err := client.SyncRepoCPEMapping(context.Background(), clientConn, []byte("mapping-bytes"))
+			if tc.wantErr != nil {
+				require.Error(t, err)
+				assert.ErrorIs(t, err, tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantUpdated, updated)
+			assert.Equal(t, "test-agent", meta.GetAgentVersion())
+		})
+	}
+}
+
 // Cancelling ctx must unblock a GetReport that is stuck waiting for a
 // response — shutdown cancel does not rewrite the dial-time deadline, so
 // GetReport closes the stream itself.
@@ -171,7 +279,7 @@ func TestSendGetReport_ContextCancelUnblocks(t *testing.T) {
 
 	errCh := make(chan error, 1)
 	go func() {
-		_, err := client.GetReport(ctx, clientConn, 0, 0)
+		_, err := client.GetReport(ctx, clientConn, "")
 		errCh <- err
 	}()
 
diff --git a/sensor/debugger/certs/cert_fetcher_test.go b/sensor/debugger/certs/cert_fetcher_test.go
index c29d1543208d9..46a30fa58244e 100644
--- a/sensor/debugger/certs/cert_fetcher_test.go
+++ b/sensor/debugger/certs/cert_fetcher_test.go
@@ -18,7 +18,6 @@ import (
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/fake"
-	"k8s.io/client-go/rest"
 )
 
 func createTestSecret(name, namespace string, data map[string][]byte) *v1.Secret {
@@ -35,10 +34,6 @@ type testClient struct {
 	k8s kubernetes.Interface
 }
 
-func (t *testClient) RESTConfig() *rest.Config {
-	return nil
-}
-
 func (t *testClient) Kubernetes() kubernetes.Interface {
 	return t.k8s
 }
diff --git a/sensor/debugger/k8s/k8sclient.go b/sensor/debugger/k8s/k8sclient.go
index 776cbed85a014..c6cf88ec4371f 100644
--- a/sensor/debugger/k8s/k8sclient.go
+++ b/sensor/debugger/k8s/k8sclient.go
@@ -40,14 +40,12 @@ func MakeFakeClientFromRest(restConfig *rest.Config) *ClientSet {
 	}
 
 	return &ClientSet{
-		restConfig: restConfig,
-		k8s:        client,
+		k8s: client,
 	}
 }
 
 // ClientSet is a test version of kubernetes.ClientSet
 type ClientSet struct {
-	restConfig        *rest.Config
 	dynamic           dynamic.Interface
 	k8s               kubernetes.Interface
 	openshiftApps     appVersioned.Interface
@@ -70,7 +68,6 @@ func MakeOutOfClusterClient() (*ClientSet, error) {
 	}
 
 	return &ClientSet{
-		restConfig:        config,
 		k8s:               k8sClient,
 		dynamic:           mustCreateDynamicClient(config),
 		openshiftApps:     mustCreateOpenshiftAppsClient(config),
@@ -132,11 +129,6 @@ func mustCreateDynamicClient(config *rest.Config) dynamic.Interface {
 	return client
 }
 
-// RESTConfig returns the REST config used to create this client
-func (c *ClientSet) RESTConfig() *rest.Config {
-	return c.restConfig
-}
-
 // Kubernetes returns the kubernetes interface
 func (c *ClientSet) Kubernetes() kubernetes.Interface {
 	return c.k8s
diff --git a/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init.go b/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init.go
index 838872925cd82..fba435a8f8c9d 100644
--- a/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init.go
+++ b/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init.go
@@ -18,8 +18,6 @@ func NewServiceCertificatesRepo(ownerReference metav1.OwnerReference, namespace
 		storage.ServiceType_SENSOR_SERVICE:             certrepo.NewServiceCertSecretSpec(securedcluster.SensorTLSSecretName),
 		storage.ServiceType_COLLECTOR_SERVICE:          certrepo.NewServiceCertSecretSpec(securedcluster.CollectorTLSSecretName),
 		storage.ServiceType_ADMISSION_CONTROL_SERVICE:  certrepo.NewServiceCertSecretSpec(securedcluster.AdmissionControlTLSSecretName),
-		storage.ServiceType_SCANNER_SERVICE:            certrepo.NewServiceCertSecretSpec(securedcluster.ScannerTLSSecretName),
-		storage.ServiceType_SCANNER_DB_SERVICE:         certrepo.NewServiceCertSecretSpec(securedcluster.ScannerDbTLSSecretName),
 		storage.ServiceType_SCANNER_V4_INDEXER_SERVICE: certrepo.NewServiceCertSecretSpec(securedcluster.ScannerV4IndexerTLSSecretName),
 		storage.ServiceType_SCANNER_V4_DB_SERVICE:      certrepo.NewServiceCertSecretSpec(securedcluster.ScannerV4DbTLSSecretName),
 	}
diff --git a/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init_test.go b/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init_test.go
index f3ac390b6485b..cd10a0d06ae85 100644
--- a/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init_test.go
+++ b/sensor/kubernetes/certrefresh/securedcluster/cert_repo_init_test.go
@@ -27,8 +27,6 @@ var (
 			createServiceCertificate(storage.ServiceType_SENSOR_SERVICE),
 			createServiceCertificate(storage.ServiceType_ADMISSION_CONTROL_SERVICE),
 			createServiceCertificate(storage.ServiceType_COLLECTOR_SERVICE),
-			createServiceCertificate(storage.ServiceType_SCANNER_SERVICE),
-			createServiceCertificate(storage.ServiceType_SCANNER_DB_SERVICE),
 			createServiceCertificate(storage.ServiceType_SCANNER_V4_INDEXER_SERVICE),
 			createServiceCertificate(storage.ServiceType_SCANNER_V4_DB_SERVICE),
 		},
@@ -50,8 +48,6 @@ func TestEnsureServiceCertificates(t *testing.T) {
 		securedcluster.SensorTLSSecretName,
 		securedcluster.CollectorTLSSecretName,
 		securedcluster.AdmissionControlTLSSecretName,
-		securedcluster.ScannerTLSSecretName,
-		securedcluster.ScannerDbTLSSecretName,
 		securedcluster.ScannerV4IndexerTLSSecretName,
 		securedcluster.ScannerV4DbTLSSecretName,
 	}
diff --git a/sensor/kubernetes/certrefresh/securedcluster_tls_issuer_test.go b/sensor/kubernetes/certrefresh/securedcluster_tls_issuer_test.go
index ac083120f992f..576357e1f0021 100644
--- a/sensor/kubernetes/certrefresh/securedcluster_tls_issuer_test.go
+++ b/sensor/kubernetes/certrefresh/securedcluster_tls_issuer_test.go
@@ -43,8 +43,6 @@ const (
 	sensorSecretName           = securedcluster.SensorTLSSecretName
 	collectorSecretName        = securedcluster.CollectorTLSSecretName
 	admissionControlSecretName = securedcluster.AdmissionControlTLSSecretName
-	scannerSecretName          = securedcluster.ScannerTLSSecretName
-	scannerDbSecretName        = securedcluster.ScannerDbTLSSecretName
 	scannerV4IndexerSecretName = securedcluster.ScannerV4IndexerTLSSecretName
 	scannerV4DbSecretName      = securedcluster.ScannerV4DbTLSSecretName
 )
@@ -397,19 +395,12 @@ func (s *securedClusterTLSIssuerIntegrationTests) TestSuccessfulRefresh() {
 				secretsData: map[string]map[string][]byte{sensorSecretName: nil},
 			},
 		},
-		"corrupted data in scanner DB secret": {
-			k8sClientConfig: fakeK8sClientConfig{
-				secretsData: map[string]map[string][]byte{scannerDbSecretName: nil},
-			},
-		},
 		"corrupted data in all secured cluster secrets": {
 			k8sClientConfig: fakeK8sClientConfig{
 				secretsData: map[string]map[string][]byte{
 					sensorSecretName:           nil,
 					collectorSecretName:        nil,
 					admissionControlSecretName: nil,
-					scannerSecretName:          nil,
-					scannerDbSecretName:        nil,
 					scannerV4IndexerSecretName: nil,
 					scannerV4DbSecretName:      nil,
 				},
@@ -573,14 +564,11 @@ func (s *securedClusterTLSIssuerIntegrationTests) TestUnexpectedOwnerStop() {
 	testCases := map[string]struct {
 		secretNames []string
 	}{
-		"wrong owner for sensor secret":                  {secretNames: []string{sensorSecretName}},
-		"wrong owner for collector secret":               {secretNames: []string{collectorSecretName}},
-		"wrong owner for admission controller secret":    {secretNames: []string{admissionControlSecretName}},
-		"wrong owner for scanner secret":                 {secretNames: []string{scannerSecretName}},
-		"wrong owner for scanner db secret":              {secretNames: []string{scannerDbSecretName}},
-		"wrong owner for scanner v4 indexer secret":      {secretNames: []string{scannerV4IndexerSecretName}},
-		"wrong owner for scanner v4 db secret":           {secretNames: []string{scannerV4DbSecretName}},
-		"wrong owner for scanner and scanner db secrets": {secretNames: []string{scannerSecretName, scannerDbSecretName}},
+		"wrong owner for sensor secret":               {secretNames: []string{sensorSecretName}},
+		"wrong owner for collector secret":            {secretNames: []string{collectorSecretName}},
+		"wrong owner for admission controller secret": {secretNames: []string{admissionControlSecretName}},
+		"wrong owner for scanner v4 indexer secret":   {secretNames: []string{scannerV4IndexerSecretName}},
+		"wrong owner for scanner v4 db secret":        {secretNames: []string{scannerV4DbSecretName}},
 	}
 	for tcName, tc := range testCases {
 		s.Run(tcName, func() {
@@ -801,8 +789,6 @@ func getAllSecuredClusterCertificates(t require.TestingT) map[string]*mtls.Issue
 		sensorSecretName:           getCertificate(t, storage.ServiceType_SENSOR_SERVICE),
 		collectorSecretName:        getCertificate(t, storage.ServiceType_COLLECTOR_SERVICE),
 		admissionControlSecretName: getCertificate(t, storage.ServiceType_ADMISSION_CONTROL_SERVICE),
-		scannerSecretName:          getCertificate(t, storage.ServiceType_SCANNER_SERVICE),
-		scannerDbSecretName:        getCertificate(t, storage.ServiceType_SCANNER_DB_SERVICE),
 		scannerV4IndexerSecretName: getCertificate(t, storage.ServiceType_SCANNER_V4_INDEXER_SERVICE),
 		scannerV4DbSecretName:      getCertificate(t, storage.ServiceType_SCANNER_V4_DB_SERVICE),
 	}
@@ -829,8 +815,6 @@ func getSecuredClusterIssueCertsSuccessResponse(
 		sensorSecretName:           storage.ServiceType_SENSOR_SERVICE,
 		collectorSecretName:        storage.ServiceType_COLLECTOR_SERVICE,
 		admissionControlSecretName: storage.ServiceType_ADMISSION_CONTROL_SERVICE,
-		scannerSecretName:          storage.ServiceType_SCANNER_SERVICE,
-		scannerDbSecretName:        storage.ServiceType_SCANNER_DB_SERVICE,
 		scannerV4IndexerSecretName: storage.ServiceType_SCANNER_V4_INDEXER_SERVICE,
 		scannerV4DbSecretName:      storage.ServiceType_SCANNER_V4_DB_SERVICE,
 	}
diff --git a/sensor/kubernetes/client/client.go b/sensor/kubernetes/client/client.go
index c7f2b86903fb9..95f8cb60a5f4c 100644
--- a/sensor/kubernetes/client/client.go
+++ b/sensor/kubernetes/client/client.go
@@ -19,9 +19,6 @@ var (
 
 // Interface implements an interface that bridges Kubernetes and Openshift
 type Interface interface {
-	// RESTConfig returns the underlying REST configuration.
-	// Callers must not modify the returned value; use rest.CopyConfig first if mutation is needed.
-	RESTConfig() *rest.Config
 	Kubernetes() kubernetes.Interface
 	Dynamic() dynamic.Interface
 	OpenshiftApps() appVersioned.Interface
@@ -31,7 +28,6 @@ type Interface interface {
 }
 
 type clientSet struct {
-	restConfig        *rest.Config
 	dynamic           dynamic.Interface
 	k8s               kubernetes.Interface
 	openshiftApps     appVersioned.Interface
@@ -95,7 +91,6 @@ func mustCreateDynamicClient(config *rest.Config) dynamic.Interface {
 // MustCreateInterfaceFromRest creates a client interface using a rest config as a parameter
 func MustCreateInterfaceFromRest(config *rest.Config) Interface {
 	return &clientSet{
-		restConfig:        config,
 		dynamic:           mustCreateDynamicClient(config),
 		k8s:               k8sutil.MustCreateK8sClient(config),
 		openshiftApps:     mustCreateOpenshiftAppsClient(config),
@@ -114,10 +109,6 @@ func MustCreateInterface() Interface {
 	return MustCreateInterfaceFromRest(config)
 }
 
-func (c *clientSet) RESTConfig() *rest.Config {
-	return c.restConfig
-}
-
 func (c *clientSet) Kubernetes() kubernetes.Interface {
 	return c.k8s
 }
diff --git a/sensor/kubernetes/clusterhealth/updater.go b/sensor/kubernetes/clusterhealth/updater.go
index 3b206f7f82869..c902553822d82 100644
--- a/sensor/kubernetes/clusterhealth/updater.go
+++ b/sensor/kubernetes/clusterhealth/updater.go
@@ -33,9 +33,6 @@ const (
 	admissionControlDeploymentName = "admission-control"
 	admissionControlContainerName  = "admission-control"
 
-	localScannerDeploymentName   = "scanner"
-	localScannerDBDeploymentName = "scanner-db"
-
 	localScannerV4IndexerDeploymentName = "scanner-v4-indexer"
 	localScannerV4DBDeploymentName      = "scanner-v4-db"
 )
@@ -205,19 +202,29 @@ func (u *updaterImpl) getLocalScannerInfo() *storage.ScannerHealthInfo {
 		return nil
 	}
 
-	// It's possible that both Scanner and Scanner V4 are installed in the secured cluster
-	// at the same time, but only one will be used by Sensor at any given time, therefore
-	// only report the health of the active scanner.
-	scannerV4Active := features.ScannerV4.Enabled() && centralcaps.Has(centralsensor.ScannerV4Supported)
-
-	analyzerDeploymentName := localScannerDeploymentName
-	dbDeploymentName := localScannerDBDeploymentName
-	if scannerV4Active {
-		analyzerDeploymentName = localScannerV4IndexerDeploymentName
-		dbDeploymentName = localScannerV4DBDeploymentName
+	// Local image scanning requires Scanner V4; Scanner V2 is no longer supported.
+	// When Scanner V4 is not active, local scanning cannot function. Pod state is irrelevant
+	// in these cases. The two failure modes are reported distinctly:
+	//   - Scanner V4 is not enabled on this secured cluster, or
+	//   - Scanner V4 is enabled but Central does not advertise Scanner V4 support.
+	if !features.ScannerV4.Enabled() {
+		return &storage.ScannerHealthInfo{
+			StatusErrors: []string{
+				"local image scanning is enabled but Scanner V4 is not enabled in secured cluster; local image " +
+					"scanning requires Scanner V4",
+			},
+		}
+	}
+	if !centralcaps.Has(centralsensor.ScannerV4Supported) {
+		return &storage.ScannerHealthInfo{
+			StatusErrors: []string{
+				"local image scanning and Scanner V4 are enabled in secured cluster, but Central is not reporting " +
+					"support for Scanner V4; enable Scanner V4 in Central to enable local image scanning",
+			},
+		}
 	}
 
-	result := u.getScannerHealthInfo(analyzerDeploymentName, dbDeploymentName)
+	result := u.getScannerHealthInfo(localScannerV4IndexerDeploymentName, localScannerV4DBDeploymentName)
 	if len(result.GetStatusErrors()) > 0 {
 		log.Errorf("Errors while getting local scanner info: %v", result.GetStatusErrors())
 	}
diff --git a/sensor/kubernetes/clusterhealth/updater_test.go b/sensor/kubernetes/clusterhealth/updater_test.go
index ff1c9e8d2f0b2..7f2ea8ea312fa 100644
--- a/sensor/kubernetes/clusterhealth/updater_test.go
+++ b/sensor/kubernetes/clusterhealth/updater_test.go
@@ -9,8 +9,11 @@ import (
 
 	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/centralsensor"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/namespaces"
 	"github.com/stackrox/rox/sensor/common"
+	"github.com/stackrox/rox/sensor/common/centralcaps"
 	"github.com/stackrox/rox/sensor/common/message"
 	"github.com/stretchr/testify/suite"
 	appsV1 "k8s.io/api/apps/v1"
@@ -290,6 +293,81 @@ func (s *UpdaterTestSuite) TestExpiredMessage() {
 	}
 }
 
+func (s *UpdaterTestSuite) TestLocalScannerDisabled() {
+	s.T().Setenv("ROX_LOCAL_IMAGE_SCANNING_ENABLED", "false")
+
+	updater := s.createNewUpdater(updateInterval)
+	s.Nil(updater.getLocalScannerInfo(), "no scanner health info should be reported when local scanning is disabled")
+}
+
+func (s *UpdaterTestSuite) TestLocalScannerV4NotSupportedByCentral() {
+	s.T().Setenv("ROX_LOCAL_IMAGE_SCANNING_ENABLED", "true")
+	s.T().Setenv(features.ScannerV4.EnvVar(), "true")
+	s.setCentralCaps() // Central does not advertise ScannerV4Supported.
+
+	updater := s.createNewUpdater(updateInterval)
+	info := updater.getLocalScannerInfo()
+
+	s.Require().NotNil(info)
+	// Pod counts must not be reported: the failure is a misconfiguration, not pod state.
+	s.Nil(info.GetTotalDesiredAnalyzerPodsOpt())
+	s.Nil(info.GetTotalReadyAnalyzerPodsOpt())
+	s.Require().Len(info.GetStatusErrors(), 1)
+	s.Contains(info.GetStatusErrors()[0], "Central is not reporting support for Scanner V4")
+}
+
+func (s *UpdaterTestSuite) TestLocalScannerV4FeatureDisabled() {
+	s.T().Setenv("ROX_LOCAL_IMAGE_SCANNING_ENABLED", "true")
+	s.T().Setenv(features.ScannerV4.EnvVar(), "false")
+	s.setCentralCaps(centralsensor.ScannerV4Supported)
+
+	updater := s.createNewUpdater(updateInterval)
+	info := updater.getLocalScannerInfo()
+
+	s.Require().NotNil(info)
+	s.Nil(info.GetTotalDesiredAnalyzerPodsOpt())
+	s.Require().Len(info.GetStatusErrors(), 1)
+	s.Contains(info.GetStatusErrors()[0], "Scanner V4 is not enabled")
+	// This case is distinct from Central lacking Scanner V4 support.
+	s.NotContains(info.GetStatusErrors()[0], "Central")
+}
+
+func (s *UpdaterTestSuite) TestLocalScannerV4Healthy() {
+	s.T().Setenv("ROX_LOCAL_IMAGE_SCANNING_ENABLED", "true")
+	s.T().Setenv(features.ScannerV4.EnvVar(), "true")
+	s.setCentralCaps(centralsensor.ScannerV4Supported)
+	s.addDeployment(makeScannerDeployment("scanner-v4-indexer", 3, 3))
+	s.addDeployment(makeScannerDeployment("scanner-v4-db", 1, 1))
+
+	updater := s.createNewUpdater(updateInterval)
+	info := updater.getLocalScannerInfo()
+
+	s.Require().NotNil(info)
+	s.Empty(info.GetStatusErrors())
+	s.Equal(int32(3), info.GetTotalDesiredAnalyzerPods())
+	s.Equal(int32(3), info.GetTotalReadyAnalyzerPods())
+	s.Equal(int32(1), info.GetTotalDesiredDbPods())
+	s.Equal(int32(1), info.GetTotalReadyDbPods())
+}
+
+func (s *UpdaterTestSuite) setCentralCaps(caps ...centralsensor.CentralCapability) {
+	centralcaps.Set(caps)
+	s.T().Cleanup(func() { centralcaps.Set(nil) })
+}
+
+func makeScannerDeployment(name string, replicas, ready int32) appsV1.Deployment {
+	return appsV1.Deployment{
+		ObjectMeta: metaV1.ObjectMeta{
+			Name:      name,
+			Namespace: "stackrox-mock-ns",
+		},
+		Status: appsV1.DeploymentStatus{
+			Replicas:      replicas,
+			ReadyReplicas: ready,
+		},
+	}
+}
+
 func (s *UpdaterTestSuite) createNewUpdater(interval time.Duration) *updaterImpl {
 	updaterComponent := NewUpdater(s.client, interval)
 	updater, ok := updaterComponent.(*updaterImpl)
diff --git a/sensor/kubernetes/clustermetrics/cluster_metrics.go b/sensor/kubernetes/clustermetrics/cluster_metrics.go
index 5ac9ad01b2443..3954955f7a1c7 100644
--- a/sensor/kubernetes/clustermetrics/cluster_metrics.go
+++ b/sensor/kubernetes/clustermetrics/cluster_metrics.go
@@ -10,10 +10,12 @@ import (
 	"github.com/stackrox/rox/pkg/centralsensor"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/logging"
+	"github.com/stackrox/rox/pkg/reflectutils"
 	"github.com/stackrox/rox/sensor/common"
 	"github.com/stackrox/rox/sensor/common/message"
 	metricsPkg "github.com/stackrox/rox/sensor/common/metrics"
 	"github.com/stackrox/rox/sensor/common/unimplemented"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/vmscraper"
 	"github.com/stackrox/rox/sensor/kubernetes/complianceoperator"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
@@ -41,13 +43,14 @@ type ClusterMetrics interface {
 	common.SensorComponent
 }
 
-// New returns a new cluster metrics Sensor component.
-func New(clusterID clusterIDPeeker, k8sClient kubernetes.Interface) ClusterMetrics {
-	return NewWithInterval(clusterID, k8sClient, defaultInterval)
+// New returns a cluster metrics component using defaultInterval.
+// A nil vmStats omits VirtualMachineMetrics from each snapshot.
+func New(clusterID clusterIDPeeker, k8sClient kubernetes.Interface, vmStats VMStatsSource) ClusterMetrics {
+	return NewWithInterval(clusterID, k8sClient, defaultInterval, vmStats)
 }
 
 // NewWithInterval returns a new cluster metrics Sensor component.
-func NewWithInterval(clusterID clusterIDPeeker, k8sClient kubernetes.Interface, pollInterval time.Duration) ClusterMetrics {
+func NewWithInterval(clusterID clusterIDPeeker, k8sClient kubernetes.Interface, pollInterval time.Duration, vmStats VMStatsSource) ClusterMetrics {
 	ticker := time.NewTicker(pollInterval)
 	ticker.Stop()
 	return &clusterMetricsImpl{
@@ -58,6 +61,7 @@ func NewWithInterval(clusterID clusterIDPeeker, k8sClient kubernetes.Interface,
 		k8sClient:       k8sClient,
 		pollTicker:      ticker,
 		clusterID:       clusterID,
+		vmStats:         vmStats,
 	}
 }
 
@@ -65,6 +69,11 @@ type clusterIDPeeker interface {
 	GetNoWait() string
 }
 
+// VMStatsSource provides a snapshot of VM scraper statistics for telemetry.
+type VMStatsSource interface {
+	Stats() vmscraper.Stats
+}
+
 type clusterMetricsImpl struct {
 	unimplemented.Receiver
 
@@ -78,6 +87,7 @@ type clusterMetricsImpl struct {
 	pollTicker      *time.Ticker
 
 	clusterID clusterIDPeeker
+	vmStats   VMStatsSource
 }
 
 func (cm *clusterMetricsImpl) Name() string {
@@ -174,5 +184,26 @@ func (cm *clusterMetricsImpl) collectMetrics() (*central.ClusterMetrics, error)
 			coVersion = complianceOperUnavailable
 		}
 	}
-	return &central.ClusterMetrics{NodeCount: nodeCount, CpuCapacity: capacity, ComplianceOperatorVersion: coVersion}, nil
+	result := &central.ClusterMetrics{NodeCount: nodeCount, CpuCapacity: capacity, ComplianceOperatorVersion: coVersion}
+	if stats, ok := vmStatsSnapshot(cm.vmStats); ok {
+		versionCounts := make(map[string]int32, len(stats.VersionCounts))
+		for v, c := range stats.VersionCounts {
+			versionCounts[v] = int32(c)
+		}
+		result.VirtualMachineMetrics = &central.VirtualMachineMetrics{
+			TrackedVms:            int32(stats.TrackedVMs),
+			VmsScanned:            int32(stats.VMsScanned),
+			RoxagentVersionCounts: versionCounts,
+		}
+	}
+	return result, nil
+}
+
+// vmStatsSnapshot returns fleet stats when src is a usable VMStatsSource.
+// A nil interface or typed-nil pointer stored in it is treated as absent.
+func vmStatsSnapshot(src VMStatsSource) (vmscraper.Stats, bool) {
+	if reflectutils.IsNil(src) {
+		return vmscraper.Stats{}, false
+	}
+	return src.Stats(), true
 }
diff --git a/sensor/kubernetes/clustermetrics/cluster_metrics_test.go b/sensor/kubernetes/clustermetrics/cluster_metrics_test.go
index fd5c29f3a95f3..f6f52a5508264 100644
--- a/sensor/kubernetes/clustermetrics/cluster_metrics_test.go
+++ b/sensor/kubernetes/clustermetrics/cluster_metrics_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/pkg/protoassert"
 	"github.com/stackrox/rox/sensor/common"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/vmscraper"
 	"github.com/stretchr/testify/suite"
 	coreV1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -19,6 +20,8 @@ const (
 	// Must be larger than defaultInterval. You may want to increase it if you plan
 	// to step through the code with a debugger.
 	metricsTimeout = 300 * time.Millisecond
+
+	testAgentVersion470 = "4.7.0-12-gabcdef0123"
 )
 
 func TestClusterMetrics(t *testing.T) {
@@ -96,7 +99,7 @@ func (f *fakeClusterIDPeeker) GetNoWait() string {
 }
 
 func (s *ClusterMetricsTestSuite) createNewClusterMetrics(interval time.Duration) *clusterMetricsImpl {
-	metricsComponent := NewWithInterval(&fakeClusterIDPeeker{}, s.client, interval)
+	metricsComponent := NewWithInterval(&fakeClusterIDPeeker{}, s.client, interval, nil)
 	metrics, ok := metricsComponent.(*clusterMetricsImpl)
 	s.Require().True(ok, "New should return a struct of type *clusterMetricsImpl")
 	return metrics
@@ -123,7 +126,7 @@ func (s *ClusterMetricsTestSuite) assertOfflineMode(state common.SensorComponent
 
 func (s *ClusterMetricsTestSuite) getClusterMetrics() *central.ClusterMetrics {
 	timer := time.NewTimer(metricsTimeout)
-	clusterMetricsStream := New(&fakeClusterIDPeeker{}, s.client)
+	clusterMetricsStream := New(&fakeClusterIDPeeker{}, s.client, nil)
 
 	clusterMetricsStream.Notify(common.SensorComponentEventCentralReachable)
 	err := clusterMetricsStream.Start()
@@ -151,3 +154,61 @@ func (s *ClusterMetricsTestSuite) addNode(name coreV1.ResourceName, cpu resource
 	}, metaV1.CreateOptions{})
 	s.Require().NoError(err)
 }
+
+type fakeVMStatsSource struct {
+	stats vmscraper.Stats
+}
+
+func (f *fakeVMStatsSource) Stats() vmscraper.Stats {
+	return f.stats
+}
+
+func (s *ClusterMetricsTestSuite) TestNilVMStatsSource() {
+	metrics := NewWithInterval(&fakeClusterIDPeeker{}, s.client, defaultInterval, nil)
+	impl, ok := metrics.(*clusterMetricsImpl)
+	s.Require().True(ok)
+
+	cm, err := impl.collectMetrics()
+	s.Require().NoError(err)
+	s.Nil(cm.GetVirtualMachineMetrics(),
+		"nil vmStatsSource must produce nil virtual_machine_metrics, not a zero-valued one")
+}
+
+func (s *ClusterMetricsTestSuite) TestTypedNilVMStatsSource() {
+	metrics := NewWithInterval(&fakeClusterIDPeeker{}, s.client, defaultInterval, (*vmscraper.VMScraper)(nil))
+	impl, ok := metrics.(*clusterMetricsImpl)
+	s.Require().True(ok)
+
+	cm, err := impl.collectMetrics()
+	s.Require().NoError(err)
+	s.Nil(cm.GetVirtualMachineMetrics(),
+		"typed-nil *VMScraper must not panic and must omit virtual_machine_metrics")
+}
+
+func (s *ClusterMetricsTestSuite) TestVMMetricsEndToEnd() {
+	src := &fakeVMStatsSource{
+		stats: vmscraper.Stats{
+			TrackedVMs: 5,
+			VMsScanned: 3,
+			VersionCounts: map[string]int{
+				testAgentVersion470: 2,
+				"unknown":           1,
+			},
+		},
+	}
+	cm := NewWithInterval(&fakeClusterIDPeeker{}, s.client, 10*time.Millisecond, src)
+	s.Require().NoError(cm.Start())
+	defer cm.Stop()
+	cm.Notify(common.SensorComponentEventCentralReachable)
+
+	select {
+	case msg := <-cm.ResponsesC():
+		vmm := msg.GetClusterMetrics().GetVirtualMachineMetrics()
+		s.Require().NotNil(vmm, "VirtualMachineMetrics must be present when vmStatsSource is non-nil")
+		s.Equal(int32(5), vmm.GetTrackedVms())
+		s.Equal(int32(3), vmm.GetVmsScanned())
+		s.Equal(map[string]int32{testAgentVersion470: 2, "unknown": 1}, vmm.GetRoxagentVersionCounts())
+	case <-time.After(metricsTimeout):
+		s.Fail("timeout waiting for cluster metrics with VM data")
+	}
+}
diff --git a/sensor/kubernetes/clusterstatus/updater_test.go b/sensor/kubernetes/clusterstatus/updater_test.go
index 4d8f6a31bd48e..41904afaf3a6c 100644
--- a/sensor/kubernetes/clusterstatus/updater_test.go
+++ b/sensor/kubernetes/clusterstatus/updater_test.go
@@ -22,7 +22,6 @@ import (
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/fake"
-	"k8s.io/client-go/rest"
 )
 
 type updaterSuite struct {
@@ -39,10 +38,6 @@ type fakeClientSet struct {
 	config configVersioned.Interface
 }
 
-func (c *fakeClientSet) RESTConfig() *rest.Config {
-	return nil
-}
-
 func (c *fakeClientSet) Kubernetes() kubernetes.Interface {
 	return c.k8s
 }
diff --git a/sensor/kubernetes/fake/common.go b/sensor/kubernetes/fake/common.go
index 92e0e453550d5..d91426c4182da 100644
--- a/sensor/kubernetes/fake/common.go
+++ b/sensor/kubernetes/fake/common.go
@@ -1,7 +1,6 @@
 package fake
 
 import (
-	"fmt"
 	"math/rand"
 	"time"
 
@@ -13,14 +12,6 @@ func newUUID() types.UID {
 	return types.UID(uuid.NewV4().String())
 }
 
-// fakeVMUUID generates a deterministic UUID-like string from an index.
-// This ensures the same index always produces the same ID, and the ID
-// is a valid UUID format that Central will accept.
-// Format: 00000000-0000-4000-8000-{12-digit-index}
-func fakeVMUUID(index int) string {
-	return fmt.Sprintf("00000000-0000-4000-8000-%012d", index)
-}
-
 const charset = "abcdef0123456789"
 
 func randStringWithLength(n int) string {
diff --git a/sensor/kubernetes/fake/fake.go b/sensor/kubernetes/fake/fake.go
index cb9ee59bdff8d..efa58b0412389 100644
--- a/sensor/kubernetes/fake/fake.go
+++ b/sensor/kubernetes/fake/fake.go
@@ -15,16 +15,13 @@ import (
 	routeVersioned "github.com/openshift/client-go/route/clientset/versioned"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/env"
-	"github.com/stackrox/rox/pkg/fixtures/vmindexreport"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/sync"
 	vmPkg "github.com/stackrox/rox/pkg/virtualmachine"
 	"github.com/stackrox/rox/sensor/common"
 	"github.com/stackrox/rox/sensor/common/networkflow/manager"
 	"github.com/stackrox/rox/sensor/common/signal"
-	"github.com/stackrox/rox/sensor/common/virtualmachine/index"
 	"github.com/stackrox/rox/sensor/kubernetes/client"
-	vmStore "github.com/stackrox/rox/sensor/kubernetes/listener/resources/virtualmachine/store"
 	"go.yaml.in/yaml/v3"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -36,56 +33,14 @@ import (
 	fakeDynamic "k8s.io/client-go/dynamic/fake"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/fake"
-	"k8s.io/client-go/rest"
 )
 
 const (
 	workloadPath = "/var/scale/stackrox/workload.yaml"
 
 	defaultNamespaceNum = 30
-
-	// Starting CID for VM population. This is used as a part of the name and its value does not matter
-	// as long as it is unique and different than 0, 1, and 2 (reserved values).
-	vmBaseVSOCKCID = uint32(1000)
-
-	// reportGeneratorSeed is the seed for deterministic package selection in VM index reports.
-	reportGeneratorSeed = int64(42)
 )
 
-// vmReadiness encapsulates the three readiness signals needed before VM workload can start
-type vmReadiness struct {
-	handlerReady concurrency.Signal
-	storeReady   concurrency.Signal
-	centralReady concurrency.Signal
-}
-
-func newVMReadiness() *vmReadiness {
-	return &vmReadiness{
-		handlerReady: concurrency.NewSignal(),
-		storeReady:   concurrency.NewSignal(),
-		centralReady: concurrency.NewSignal(),
-	}
-}
-
-func (r *vmReadiness) signalHandlerReady() { r.handlerReady.Signal() }
-func (r *vmReadiness) signalStoreReady()   { r.storeReady.Signal() }
-func (r *vmReadiness) signalCentralReady() { r.centralReady.Signal() }
-func (r *vmReadiness) resetCentralReady()  { r.centralReady.Reset() }
-
-// Wait blocks until all three signals are ready. Returns true if all ready, false if context cancelled.
-func (r *vmReadiness) Wait(ctx context.Context) bool {
-	if !concurrency.WaitInContext(&r.handlerReady, ctx) {
-		return false
-	}
-	if !concurrency.WaitInContext(&r.storeReady, ctx) {
-		return false
-	}
-	if !concurrency.WaitInContext(&r.centralReady, ctx) {
-		return false
-	}
-	return true
-}
-
 var (
 	log = logging.LoggerForModule()
 )
@@ -102,7 +57,6 @@ func init() {
 
 // clientSetImpl implements our client.Interface
 type clientSetImpl struct {
-	restConfig        *rest.Config
 	kubernetes        kubernetes.Interface
 	dynamic           dynamic.Interface
 	openshiftApps     appVersioned.Interface
@@ -111,11 +65,6 @@ type clientSetImpl struct {
 	openshiftOperator operatorVersioned.Interface
 }
 
-// RESTConfig returns the REST configuration injected via WithRESTConfig, or nil if none was set.
-func (c *clientSetImpl) RESTConfig() *rest.Config {
-	return c.restConfig
-}
-
 // Kubernetes returns the fake Kubernetes clientset
 func (c *clientSetImpl) Kubernetes() kubernetes.Interface {
 	return c.kubernetes
@@ -152,7 +101,6 @@ type WorkloadManager struct {
 	fakeClient                *fake.Clientset
 	dynamicClient             *fakeDynamic.FakeDynamicClient
 	client                    client.Interface
-	restConfig                *rest.Config
 	processPool               *ProcessPool
 	labelsPool                *labelsPoolPerNamespace
 	endpointPool              *EndpointPool
@@ -165,14 +113,10 @@ type WorkloadManager struct {
 	dockerSecretNamespaces    []string
 
 	// signals services
-	servicesInitialized  concurrency.Signal
-	processes            signal.Pipeline
-	networkManager       manager.Manager
-	vmIndexReportHandler index.Handler
-	vmStore              *vmStore.VirtualMachineStore
-
-	// VM readiness coordinator
-	vmPrerequisitesReady *vmReadiness
+	servicesInitialized concurrency.Signal
+	processes           signal.Pipeline
+	networkManager      manager.Manager
+	pubSubDispatcher    common.PubSubDispatcher
 
 	// shutdown coordination
 	shutdownCtx    context.Context
@@ -190,7 +134,6 @@ type WorkloadManagerConfig struct {
 	externalIpPool *pool
 	containerPool  *pool
 	storagePath    string
-	restConfig     *rest.Config
 }
 
 // ConfigDefaults default configuration
@@ -255,12 +198,6 @@ func (c *WorkloadManagerConfig) WithStoragePath(path string) *WorkloadManagerCon
 	return c
 }
 
-// WithRESTConfig configures the WorkloadManagerConfig's REST config.
-func (c *WorkloadManagerConfig) WithRESTConfig(restConfig *rest.Config) *WorkloadManagerConfig {
-	c.restConfig = restConfig
-	return c
-}
-
 // Client returns the mock client
 func (w *WorkloadManager) Client() client.Interface {
 	return w.client
@@ -295,20 +232,18 @@ func NewWorkloadManager(config *WorkloadManagerConfig) *WorkloadManager {
 	}
 	shutdownCtx, shutdownCancel := context.WithCancel(context.Background())
 	mgr := &WorkloadManager{
-		db:                   db,
-		workload:             &workload,
-		originatorCache:      NewOriginatorCache(),
-		restConfig:           config.restConfig,
-		labelsPool:           config.labelsPool,
-		endpointPool:         config.endpointPool,
-		ipPool:               config.ipPool,
-		externalIpPool:       config.externalIpPool,
-		containerPool:        config.containerPool,
-		processPool:          config.processPool,
-		servicesInitialized:  concurrency.NewSignal(),
-		vmPrerequisitesReady: newVMReadiness(),
-		shutdownCtx:          shutdownCtx,
-		shutdownCancel:       shutdownCancel,
+		db:                  db,
+		workload:            &workload,
+		originatorCache:     NewOriginatorCache(),
+		labelsPool:          config.labelsPool,
+		endpointPool:        config.endpointPool,
+		ipPool:              config.ipPool,
+		externalIpPool:      config.externalIpPool,
+		containerPool:       config.containerPool,
+		processPool:         config.processPool,
+		servicesInitialized: concurrency.NewSignal(),
+		shutdownCtx:         shutdownCtx,
+		shutdownCancel:      shutdownCancel,
 	}
 	mgr.initializePreexistingResources()
 
@@ -347,30 +282,9 @@ func (w *WorkloadManager) SetSignalHandlers(processPipeline signal.Pipeline, net
 	w.servicesInitialized.Signal()
 }
 
-// SetVMIndexReportHandler sets the handler that will accept VM index reports
-func (w *WorkloadManager) SetVMIndexReportHandler(handler index.Handler) {
-	w.vmIndexReportHandler = handler
-	w.vmPrerequisitesReady.signalHandlerReady()
-}
-
-// SetVMStore sets the VirtualMachineStore
-func (w *WorkloadManager) SetVMStore(store *vmStore.VirtualMachineStore) {
-	log.Debugf("SetVMStore called: store=%p, poolSize=%d", store, w.workload.VirtualMachineWorkload.PoolSize)
-	w.vmStore = store
-	w.vmPrerequisitesReady.signalStoreReady()
-	log.Debugf("SetVMStore completed (VMs will be populated by informer events)")
-}
-
-// Notify implements common.Notifiable to receive Sensor component event notifications
-func (w *WorkloadManager) Notify(e common.SensorComponentEvent) {
-	switch e {
-	case common.SensorComponentEventCentralReachable:
-		log.Debugf("WorkloadManager: Central is reachable, signaling VM workload can start")
-		w.vmPrerequisitesReady.signalCentralReady()
-	case common.SensorComponentEventOfflineMode:
-		log.Debugf("WorkloadManager: Central went offline, resetting reachability signal")
-		w.vmPrerequisitesReady.resetCentralReady()
-	}
+// SetPubSubDispatcher sets the pub/sub dispatcher for publishing synthetic file activities
+func (w *WorkloadManager) SetPubSubDispatcher(dispatcher common.PubSubDispatcher) {
+	w.pubSubDispatcher = dispatcher
 }
 
 // Stop gracefully stops all background goroutines managed by WorkloadManager.
@@ -503,7 +417,6 @@ func (w *WorkloadManager) initializePreexistingResources() {
 	dynClient := fakeDynamic.NewSimpleDynamicClientWithCustomListKinds(scheme, customListKinds)
 
 	clientSet := &clientSetImpl{
-		restConfig: w.restConfig,
 		kubernetes: w.fakeClient,
 		dynamic:    dynClient,
 	}
@@ -552,28 +465,17 @@ func (w *WorkloadManager) initializePreexistingResources() {
 	w.wg.Add(1)
 	go w.manageFlows(w.shutdownCtx)
 
+	if w.workload.FileActivityWorkload.ActivityInterval > 0 {
+		w.wg.Add(1)
+		go w.manageFileActivity(w.shutdownCtx)
+	}
+
 	// Start VirtualMachine/VirtualMachineInstance workload if configured.
-	// This unified workload handles both informer events AND index reports.
-	// Index reports are only sent while VMs are "alive" in the lifecycle.
 	if w.workload.VirtualMachineWorkload.PoolSize > 0 {
-		// Initialize report generator if index reports are enabled
-		var reportGen *vmindexreport.Generator
-		if w.workload.VirtualMachineWorkload.ReportInterval > 0 {
-			reportGen = vmindexreport.NewGeneratorWithSeed(
-				w.workload.VirtualMachineWorkload.NumPackages,
-				reportGeneratorSeed,
-			)
-			log.Infof("VM index reports enabled: interval=%s, packages=%d",
-				w.workload.VirtualMachineWorkload.ReportInterval,
-				w.workload.VirtualMachineWorkload.NumPackages)
-		}
-
-		// Fork management of VM/VMI resources (including index reports if enabled)
 		workload := w.workload.VirtualMachineWorkload
 		for i := range workload.PoolSize {
 			w.wg.Add(1)
-			cid := vmBaseVSOCKCID + uint32(i)
-			go w.manageVirtualMachine(w.shutdownCtx, workload, cid, reportGen)
+			go w.manageVirtualMachine(w.shutdownCtx, workload, i)
 		}
 	}
 }
diff --git a/sensor/kubernetes/fake/fileactivity.go b/sensor/kubernetes/fake/fileactivity.go
new file mode 100644
index 0000000000000..d782108b2c505
--- /dev/null
+++ b/sensor/kubernetes/fake/fileactivity.go
@@ -0,0 +1,207 @@
+package fake
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"time"
+
+	sensorAPI "github.com/stackrox/rox/generated/internalapi/sensor"
+	"github.com/stackrox/rox/pkg/uuid"
+	"github.com/stackrox/rox/sensor/common/events"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+var fileActivityDirs = []string{
+	"/etc/security",
+	"/etc/pam.d",
+	"/etc/ssh",
+	"/var/log",
+	"/var/run",
+	"/tmp",
+	"/etc/kubernetes",
+	"/etc/cni",
+	"/etc/sysconfig",
+	"/etc/audit",
+}
+
+func (w *WorkloadManager) manageFileActivity(ctx context.Context) {
+	defer w.wg.Done()
+	w.sanitizeFileActivityParams()
+
+	ticker := time.NewTicker(w.workload.FileActivityWorkload.ActivityInterval)
+	defer ticker.Stop()
+	paths := generateFileActivityPaths(w.workload.FileActivityWorkload.NumPaths)
+
+	var nodeNames []string
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+
+		if !w.servicesInitialized.IsDone() {
+			continue
+		}
+
+		if w.pubSubDispatcher == nil {
+			continue
+		}
+
+		if len(nodeNames) == 0 {
+			nodeNames = w.listNodeNames(ctx)
+			if len(nodeNames) == 0 {
+				continue
+			}
+		}
+
+		for range w.workload.FileActivityWorkload.BatchSize {
+			hostname := nodeNames[rand.Intn(len(nodeNames))]
+			activity := w.generateFileActivity(paths, hostname)
+			if activity == nil {
+				continue
+			}
+
+			event := &events.FakeFileActivityEvent{
+				Activity: activity,
+			}
+
+			if err := w.pubSubDispatcher.Publish(event); err != nil {
+				if ctx.Err() != nil {
+					return
+				}
+				log.Fatalf("Failed to publish fake file activity: %v", err)
+			}
+
+			select {
+			case <-ctx.Done():
+				return
+			default:
+			}
+		}
+	}
+}
+
+func (w *WorkloadManager) listNodeNames(ctx context.Context) []string {
+	nodeResp, err := w.fakeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		log.Errorf("error listing nodes for file activity: %v", err)
+		return nil
+	}
+	names := make([]string, 0, len(nodeResp.Items))
+	for _, node := range nodeResp.Items {
+		names = append(names, node.Name)
+	}
+	return names
+}
+
+func (w *WorkloadManager) generateFileActivity(paths []string, hostname string) *sensorAPI.FileActivity {
+	path := paths[rand.Intn(len(paths))]
+	now := timestamppb.Now()
+
+	var process *sensorAPI.ProcessSignal
+	if rand.Intn(100) >= w.workload.FileActivityWorkload.NodeEventPercent {
+		// Container event - try to get from pool or generate with container ID
+		containerID, ok := w.containerPool.randomElem()
+		if ok {
+			process = getRandomSensorProcess(containerID, w.processPool)
+		}
+	}
+
+	if process == nil {
+		// Node event (or no container available) - generate process with empty container ID
+		process = getRandomNodeProcess()
+	}
+
+	base := &sensorAPI.FileActivityBase{
+		Path:     path,
+		HostPath: "/host" + path,
+	}
+
+	activity := &sensorAPI.FileActivity{
+		Timestamp: now,
+		Process:   process,
+		Hostname:  hostname,
+	}
+
+	switch rand.Intn(6) {
+	case 0:
+		activity.File = &sensorAPI.FileActivity_Open{
+			Open: &sensorAPI.FileOpen{Activity: base},
+		}
+	case 1:
+		activity.File = &sensorAPI.FileActivity_Creation{
+			Creation: &sensorAPI.FileCreation{Activity: base},
+		}
+	case 2:
+		activity.File = &sensorAPI.FileActivity_Unlink{
+			Unlink: &sensorAPI.FileUnlink{Activity: base},
+		}
+	case 3:
+		newPath := paths[rand.Intn(len(paths))]
+		activity.File = &sensorAPI.FileActivity_Rename{
+			Rename: &sensorAPI.FileRename{
+				Old: base,
+				New: &sensorAPI.FileActivityBase{
+					Path:     newPath,
+					HostPath: "/host" + newPath,
+				},
+			},
+		}
+	case 4:
+		activity.File = &sensorAPI.FileActivity_Permission{
+			Permission: &sensorAPI.FilePermissionChange{
+				Activity: base,
+				Mode:     0644,
+			},
+		}
+	case 5:
+		activity.File = &sensorAPI.FileActivity_Ownership{
+			Ownership: &sensorAPI.FileOwnershipChange{
+				Activity: base,
+				Uid:      1000,
+				Gid:      1000,
+				Username: "testuser",
+				Group:    "testgroup",
+			},
+		}
+	}
+
+	return activity
+}
+
+func (w *WorkloadManager) sanitizeFileActivityParams() {
+	fa := &w.workload.FileActivityWorkload
+	if fa.NumPaths <= 0 {
+		defaultNumPaths := 50
+		log.Infof("FileActivityWorkload: numPaths=%d is invalid, defaulting to %d", fa.NumPaths, defaultNumPaths)
+		fa.NumPaths = defaultNumPaths
+	}
+	if fa.BatchSize <= 0 {
+		defaultBatchSize := 1
+		log.Infof("FileActivityWorkload: batchSize=%d is invalid, defaulting to %d", fa.BatchSize, defaultBatchSize)
+		fa.BatchSize = defaultBatchSize
+	}
+	if fa.NodeEventPercent < 0 || fa.NodeEventPercent > 100 {
+		defaultNodeEventPercent := 50
+		log.Infof("FileActivityWorkload: nodeEventPercent=%d is invalid, defaulting to %d", fa.NodeEventPercent, defaultNodeEventPercent)
+		fa.NodeEventPercent = defaultNodeEventPercent
+	}
+	if fa.ActivityInterval <= 0 {
+		defaultActivityInterval := 50 * time.Millisecond
+		log.Infof("FileActivityWorkload: activityInterval=%s is invalid, defaulting to %s", fa.ActivityInterval, defaultActivityInterval)
+		fa.ActivityInterval = defaultActivityInterval
+	}
+}
+
+func generateFileActivityPaths(n int) []string {
+	paths := make([]string, 0, n)
+	for range n {
+		dir := fileActivityDirs[rand.Intn(len(fileActivityDirs))]
+		paths = append(paths, fmt.Sprintf("%s/file-%s.conf", dir, uuid.NewV4().String()[:8]))
+	}
+	return paths
+}
diff --git a/sensor/kubernetes/fake/fileactivity_test.go b/sensor/kubernetes/fake/fileactivity_test.go
new file mode 100644
index 0000000000000..0f5c1ebc8b87d
--- /dev/null
+++ b/sensor/kubernetes/fake/fileactivity_test.go
@@ -0,0 +1,293 @@
+package fake
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSanitizeFileActivityParams(t *testing.T) {
+	tests := map[string]struct {
+		input                    FileActivityWorkload
+		expectedNumPaths         int
+		expectedBatchSize        int
+		expectedNodeEventPercent int
+		expectedActivityInterval time.Duration
+	}{
+		"all valid parameters should remain unchanged": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        10,
+				NodeEventPercent: 25,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        10,
+			expectedNodeEventPercent: 25,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"zero NumPaths should default to 50": {
+			input: FileActivityWorkload{
+				NumPaths:         0,
+				BatchSize:        5,
+				NodeEventPercent: 50,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         50,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"negative NumPaths should default to 50": {
+			input: FileActivityWorkload{
+				NumPaths:         -10,
+				BatchSize:        5,
+				NodeEventPercent: 50,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         50,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"zero BatchSize should default to 1": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        0,
+				NodeEventPercent: 50,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        1,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"negative BatchSize should default to 1": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        -5,
+				NodeEventPercent: 50,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        1,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"negative NodeEventPercent should default to 50": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        5,
+				NodeEventPercent: -10,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"NodeEventPercent above 100 should default to 50": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        5,
+				NodeEventPercent: 150,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"NodeEventPercent of 0 (all container events) should remain 0": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        5,
+				NodeEventPercent: 0,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 0,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"NodeEventPercent of 100 (all node events) should remain 100": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        5,
+				NodeEventPercent: 100,
+				ActivityInterval: 100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 100,
+			expectedActivityInterval: 100 * time.Millisecond,
+		},
+		"zero ActivityInterval should default to 50ms": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        5,
+				NodeEventPercent: 50,
+				ActivityInterval: 0,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 50 * time.Millisecond,
+		},
+		"negative ActivityInterval should default to 50ms": {
+			input: FileActivityWorkload{
+				NumPaths:         100,
+				BatchSize:        5,
+				NodeEventPercent: 50,
+				ActivityInterval: -100 * time.Millisecond,
+			},
+			expectedNumPaths:         100,
+			expectedBatchSize:        5,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 50 * time.Millisecond,
+		},
+		"all invalid parameters should all be defaulted": {
+			input: FileActivityWorkload{
+				NumPaths:         -5,
+				BatchSize:        -10,
+				NodeEventPercent: 200,
+				ActivityInterval: -50 * time.Millisecond,
+			},
+			expectedNumPaths:         50,
+			expectedBatchSize:        1,
+			expectedNodeEventPercent: 50,
+			expectedActivityInterval: 50 * time.Millisecond,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			// Create a minimal WorkloadManager with the test workload
+			wm := &WorkloadManager{
+				workload: &Workload{
+					FileActivityWorkload: tc.input,
+				},
+			}
+
+			// Run sanitization
+			wm.sanitizeFileActivityParams()
+
+			// Verify results
+			assert.Equal(t, tc.expectedNumPaths, wm.workload.FileActivityWorkload.NumPaths,
+				"NumPaths mismatch")
+			assert.Equal(t, tc.expectedBatchSize, wm.workload.FileActivityWorkload.BatchSize,
+				"BatchSize mismatch")
+			assert.Equal(t, tc.expectedNodeEventPercent, wm.workload.FileActivityWorkload.NodeEventPercent,
+				"NodeEventPercent mismatch")
+			assert.Equal(t, tc.expectedActivityInterval, wm.workload.FileActivityWorkload.ActivityInterval,
+				"ActivityInterval mismatch")
+		})
+	}
+}
+
+func TestGenerateFileActivityPaths(t *testing.T) {
+	tests := map[string]struct {
+		numPaths int
+	}{
+		"generate 10 paths": {
+			numPaths: 10,
+		},
+		"generate 50 paths": {
+			numPaths: 50,
+		},
+		"generate 100 paths": {
+			numPaths: 100,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			paths := generateFileActivityPaths(tc.numPaths)
+
+			// Verify correct number of paths
+			assert.Len(t, paths, tc.numPaths, "Should generate exactly the requested number of paths")
+
+			// Verify all paths are non-empty and start with a known directory
+			for _, path := range paths {
+				assert.NotEmpty(t, path, "Path should not be empty")
+
+				// Verify path starts with one of the known directories
+				foundPrefix := false
+				for _, dir := range fileActivityDirs {
+					if len(path) > len(dir) && path[:len(dir)] == dir {
+						foundPrefix = true
+						break
+					}
+				}
+				assert.True(t, foundPrefix, "Path should start with a known directory prefix")
+			}
+		})
+	}
+}
+
+func TestGenerateFileActivity(t *testing.T) {
+	tests := map[string]struct {
+		nodeEventPercent     int
+		expectNodeEvent      bool // if true, we expect container ID to be empty (node event)
+		expectContainerEvent bool // if true, we expect container ID to be non-empty (container event)
+	}{
+		"NodeEventPercent 100 should always generate node events": {
+			nodeEventPercent:     100,
+			expectNodeEvent:      true,
+			expectContainerEvent: false,
+		},
+		"NodeEventPercent 0 should always generate container events": {
+			nodeEventPercent:     0,
+			expectNodeEvent:      false,
+			expectContainerEvent: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			wm := &WorkloadManager{
+				workload: &Workload{
+					FileActivityWorkload: FileActivityWorkload{
+						NodeEventPercent: tc.nodeEventPercent,
+					},
+				},
+				containerPool: newPool(),
+				processPool:   newProcessPool(),
+			}
+
+			// Add test containers to the pool for container event testing
+			if tc.expectContainerEvent {
+				wm.containerPool.add("test-container-1")
+				wm.containerPool.add("test-container-2")
+			}
+
+			paths := generateFileActivityPaths(10)
+			hostname := "test-node"
+
+			// Generate multiple activities to test randomness
+			for range 50 {
+				activity := wm.generateFileActivity(paths, hostname)
+
+				assert.NotNil(t, activity, "Activity should not be nil")
+				assert.NotNil(t, activity.GetProcess(), "Process should not be nil")
+				assert.Equal(t, hostname, activity.GetHostname(), "Hostname should match")
+				assert.NotNil(t, activity.GetTimestamp(), "Timestamp should not be nil")
+				assert.NotNil(t, activity.GetFile(), "File activity type should be set")
+
+				// Verify process signal
+				process := activity.GetProcess()
+				assert.NotEmpty(t, process.GetId(), "Process ID should not be empty")
+				assert.NotEmpty(t, process.GetName(), "Process name should not be empty")
+				assert.NotEmpty(t, process.GetExecFilePath(), "Exec file path should not be empty")
+
+				if tc.expectNodeEvent {
+					assert.Empty(t, process.GetContainerId(), "Container ID should be empty for node events")
+				}
+				if tc.expectContainerEvent {
+					assert.NotEmpty(t, process.GetContainerId(), "Container ID should not be empty for container events")
+				}
+			}
+		})
+	}
+}
diff --git a/sensor/kubernetes/fake/pools.go b/sensor/kubernetes/fake/pools.go
index bb711b657445d..fd3a210d291fc 100644
--- a/sensor/kubernetes/fake/pools.go
+++ b/sensor/kubernetes/fake/pools.go
@@ -8,6 +8,7 @@ import (
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/sync"
+	"github.com/stackrox/rox/pkg/uuid"
 )
 
 // pool is a thread-safe string pool using set.StringSet
@@ -141,19 +142,20 @@ func generateAndAddIPToPool(ipPool *pool) string {
 	return ip
 }
 
-func getRandomOriginator(containerID string, pool *ProcessPool) *storage.NetworkProcessUniqueKey {
-	var process *storage.ProcessSignal
-	var percentMatchedProcess float32 = 0.5
-	p := rand.Float32()
-	if p < percentMatchedProcess {
+func getRandomProcessSignal(containerID string, pool *ProcessPool) *storage.ProcessSignal {
+	if rand.Float32() < 0.5 {
 		// There is a chance that the process has been filtered out or hasn't gotten to
 		// the central-db for some other reason so this is not a guarantee that the
 		// process is in the central-db
-		process = pool.getRandomProcess(containerID)
-	} else {
-		process = getGoodProcess(containerID)
+		if process := pool.getRandomProcess(containerID); process != nil {
+			return process
+		}
 	}
+	return getGoodProcess(containerID)
+}
 
+func getRandomOriginator(containerID string, pool *ProcessPool) *storage.NetworkProcessUniqueKey {
+	process := getRandomProcessSignal(containerID, pool)
 	return getNetworkProcessUniqueKeyFromProcess(process)
 }
 
@@ -168,3 +170,26 @@ func getNetworkProcessUniqueKeyFromProcess(process *storage.ProcessSignal) *stor
 
 	return nil
 }
+
+func getSensorProcessFromStorageProcess(process *storage.ProcessSignal) *sensor.ProcessSignal {
+	return &sensor.ProcessSignal{
+		Id:           uuid.NewV4().String(),
+		ContainerId:  process.GetContainerId(),
+		Name:         process.GetName(),
+		Args:         process.GetArgs(),
+		ExecFilePath: process.GetExecFilePath(),
+		Pid:          uint32(rand.Intn(65535) + 1),
+		Uid:          1000,
+		Gid:          1000,
+	}
+}
+
+func getRandomSensorProcess(containerID string, pool *ProcessPool) *sensor.ProcessSignal {
+	process := getRandomProcessSignal(containerID, pool)
+	return getSensorProcessFromStorageProcess(process)
+}
+
+func getRandomNodeProcess() *sensor.ProcessSignal {
+	process := getGoodProcess("")
+	return getSensorProcessFromStorageProcess(process)
+}
diff --git a/sensor/kubernetes/fake/process.go b/sensor/kubernetes/fake/process.go
index 2d6f5bf34ce33..6bb5b74d60168 100644
--- a/sensor/kubernetes/fake/process.go
+++ b/sensor/kubernetes/fake/process.go
@@ -472,8 +472,13 @@ func getActiveProcesses(containerID string) []*storage.ProcessSignal {
 }
 
 func getProcess(path, name, containerID string) *storage.ProcessSignal {
+	// For node events, containerID is empty
+	cid := containerID
+	if len(containerID) >= 12 {
+		cid = containerID[:12]
+	}
 	return &storage.ProcessSignal{
-		ContainerId:  containerID[:12],
+		ContainerId:  cid,
 		Time:         protocompat.TimestampNow(),
 		Name:         name,
 		Args:         "abc def ghi jkl lmn op qrs tuv",
diff --git a/sensor/kubernetes/fake/rest_config_test.go b/sensor/kubernetes/fake/rest_config_test.go
deleted file mode 100644
index ae0d9e1419f21..0000000000000
--- a/sensor/kubernetes/fake/rest_config_test.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package fake
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"k8s.io/client-go/rest"
-)
-
-func TestWorkloadManagerClientRESTConfigReturnsConfiguredValue(t *testing.T) {
-	workloadFile := filepath.Join(t.TempDir(), "workload.yaml")
-	require.NoError(t, os.WriteFile(workloadFile, []byte("{}\n"), 0o600))
-
-	wantConfig := &rest.Config{Host: "https://example.stackrox.invalid"}
-	config := ConfigDefaults().
-		WithWorkloadFile(workloadFile).
-		WithStoragePath("").
-		WithRESTConfig(wantConfig)
-
-	manager := NewWorkloadManager(config)
-	require.NotNil(t, manager)
-	t.Cleanup(manager.Stop)
-
-	assert.Same(t, wantConfig, manager.Client().RESTConfig())
-}
diff --git a/sensor/kubernetes/fake/virtualmachines.go b/sensor/kubernetes/fake/virtualmachines.go
index 85aa743087d8c..07139406828dc 100644
--- a/sensor/kubernetes/fake/virtualmachines.go
+++ b/sensor/kubernetes/fake/virtualmachines.go
@@ -7,12 +7,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/stackrox/rox/pkg/fixtures/vmindexreport"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
 	kubeVirtV1 "kubevirt.io/api/core/v1"
 )
 
@@ -25,12 +23,6 @@ func setNestedField(obj *unstructured.Unstructured, value interface{}, fields ..
 const (
 	defaultVMLifecycleDuration = 30 * time.Minute
 	defaultVMUpdateInterval    = 3 * time.Minute
-	// initialReportMaxDeviation is the maximum relative deviation applied to the initial report delay.
-	// With 0.2 (20%), a 30s delay will vary uniformly between 24s-36s.
-	initialReportMaxDeviation = 0.2
-	// reportIntervalMaxDeviation is the maximum relative deviation applied to report intervals.
-	// With 0.05 (5%), a 60s interval will vary uniformly between 57s-63s.
-	reportIntervalMaxDeviation = 0.05
 	// lifecycleMaxDeviation is the maximum relative deviation applied to VM lifecycle duration.
 	// With 0.5 (50%), a 60s lifecycle will vary uniformly between 30s-90s.
 	lifecycleMaxDeviation = 0.5
@@ -91,33 +83,15 @@ func validateVMWorkload(workload VirtualMachineWorkload) (VirtualMachineWorkload
 		return workload, fmt.Errorf("%s. %s may cause some VMs to never receive an update. %s",
 			lifecycleText, causeText("updateInterval", workload.UpdateInterval), actionText("updateInterval"))
 	}
-	if workload.ReportInterval > 0 {
-		if workload.ReportInterval > upperBoundVMLifetime {
-			return workload, fmt.Errorf("%s. %s causes the workload to never send any index reports. %s",
-				lifecycleText, causeText("reportInterval", workload.ReportInterval), actionText("reportInterval"))
-		}
-		if workload.ReportInterval > lowerBoundVMLifetime {
-			return workload, fmt.Errorf("%s. %s may cause some VMs to never send any index reports. %s",
-				lifecycleText, causeText("reportInterval", workload.ReportInterval), actionText("reportInterval"))
-		}
-		if workload.InitialReportDelay > upperBoundVMLifetime {
-			return workload, fmt.Errorf("%s. %s causes the workload to never send any index reports. %s",
-				lifecycleText, causeText("initialReportDelay", workload.InitialReportDelay), actionText("initialReportDelay"))
-		}
-		if workload.InitialReportDelay > lowerBoundVMLifetime {
-			return workload, fmt.Errorf("%s. %s may cause some VMs to never send any index reports. %s",
-				lifecycleText, causeText("initialReportDelay", workload.InitialReportDelay), actionText("initialReportDelay"))
-		}
-	}
 	return workload, nil
 }
 
-func getRandomVMPair(vsockCID uint32, guestOSes []string) (*unstructured.Unstructured, *unstructured.Unstructured) {
-	// Use deterministic UUID based on template index to match index report generation.
-	// This ensures the VM UID in informer events matches the VM ID used in index reports.
-	vmUID := types.UID(fakeVMUUID(int(vsockCID)))
-	vmName := fmt.Sprintf("%s-%d", "vm", vsockCID)
-	os := guestOSes[int(vsockCID)%len(guestOSes)]
+func getRandomVMPair(slot int, guestOSes []string) (*unstructured.Unstructured, *unstructured.Unstructured) {
+	// A new UID per lifecycle: Central REMOVE/CREATE and the scraper's
+	// UID-change path both treat a recycled slot as a new VM.
+	vmUID := newUUID()
+	vmName := fmt.Sprintf("vm-%d", slot)
+	os := guestOSes[slot%len(guestOSes)]
 
 	vm := &kubeVirtV1.VirtualMachine{
 		TypeMeta: metav1.TypeMeta{
@@ -139,10 +113,8 @@ func getRandomVMPair(vsockCID uint32, guestOSes []string) (*unstructured.Unstruc
 		},
 	}
 
-	// VMI gets a unique UUID based on template index and iteration
-	// Format: 00000000-0000-4000-9000-{12-digit-vsockCID}
-	vmiUID := types.UID(fmt.Sprintf("00000000-0000-4000-9000-%012d", vsockCID))
-	vmiName := fmt.Sprintf("vm-%d-vmi", vsockCID)
+	vmiUID := newUUID()
+	vmiName := fmt.Sprintf("vm-%d-vmi", slot)
 	vmi := &kubeVirtV1.VirtualMachineInstance{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "VirtualMachineInstance",
@@ -167,8 +139,7 @@ func getRandomVMPair(vsockCID uint32, guestOSes []string) (*unstructured.Unstruc
 			},
 		},
 		Status: kubeVirtV1.VirtualMachineInstanceStatus{
-			Phase:    kubeVirtV1.Running,
-			VSOCKCID: &vsockCID,
+			Phase: kubeVirtV1.Running,
 			GuestOSInfo: kubeVirtV1.VirtualMachineInstanceGuestOSInfo{
 				Name: os,
 			},
@@ -196,15 +167,18 @@ func toUnstructuredVM(vm *kubeVirtV1.VirtualMachine) *unstructured.Unstructured
 	return &unstructured.Unstructured{Object: unstructuredObj}
 }
 
-// toUnstructuredVMI converts a VirtualMachineInstance to unstructured.Unstructured
+// toUnstructuredVMI converts a VirtualMachineInstance to unstructured.Unstructured.
 func toUnstructuredVMI(vmi *kubeVirtV1.VirtualMachineInstance) *unstructured.Unstructured {
-	unstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(vmi)
+	// A uint64 above MaxInt64 makes unstructured conversion fail the whole object.
+	sanitized := *vmi
+	sanitized.Status.RuntimeUser = uint64(jsonSafeUint64(sanitized.Status.RuntimeUser))
+	unstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&sanitized)
 	if err != nil {
-		log.Warnf("failed to convert VMI %s to unstructured object: %v", vmi.GetName(), err)
+		log.Warnf("failed to convert VMI %s to unstructured object: %v", sanitized.GetName(), err)
 		return &unstructured.Unstructured{Object: map[string]interface{}{}}
 	}
 	obj := &unstructured.Unstructured{Object: unstructuredObj}
-	normalizeVMIUnsignedFields(obj, vmi.Status)
+	normalizeVMIUnsignedFields(obj, sanitized.Status)
 	return obj
 }
 
@@ -227,8 +201,7 @@ func jsonSafeUint64(value uint64) int64 {
 func (w *WorkloadManager) manageVirtualMachine(
 	ctx context.Context,
 	workload VirtualMachineWorkload,
-	vsockCID uint32,
-	reportGen *vmindexreport.Generator,
+	slot int,
 ) {
 	defer w.wg.Done()
 
@@ -237,20 +210,17 @@ func (w *WorkloadManager) manageVirtualMachine(
 		if ctx.Err() != nil {
 			return
 		}
-		vm, vmi := getRandomVMPair(vsockCID, defaultGuestOSPool)
-		w.runVMLifecycle(ctx, workload, vsockCID, vm, vmi, reportGen)
+		vm, vmi := getRandomVMPair(slot, defaultGuestOSPool)
+		w.runVMLifecycle(ctx, workload, vm, vmi)
 	}
 }
 
 // runVMLifecycle runs a single VM/VMI lifecycle.
 // It blocks until the lifecycle ends (timer fires) or context is cancelled.
-// If index reports are enabled (reportGen != nil), it sends index reports while the VM is alive.
 func (w *WorkloadManager) runVMLifecycle(
 	ctx context.Context,
 	workload VirtualMachineWorkload,
-	vsockCID uint32,
 	vm, vmi *unstructured.Unstructured,
-	reportGen *vmindexreport.Generator,
 ) {
 	lifecycleTimer := newTimerWithJitter(randomizedInterval(workload.LifecycleDuration, lifecycleMaxDeviation))
 	defer lifecycleTimer.Stop()
@@ -273,27 +243,6 @@ func (w *WorkloadManager) runVMLifecycle(
 		// Continue even if VMI creation fails
 	}
 
-	// Start index report generation if enabled (runs while VM is alive)
-	var reportCancel context.CancelFunc
-	if reportGen != nil && workload.ReportInterval > 0 {
-		var reportCtx context.Context
-		reportCtx, reportCancel = context.WithCancel(ctx)
-		go w.sendIndexReportsWhileAlive(
-			reportCtx,
-			reportGen,
-			vsockCID,
-			workload.ReportInterval,
-			workload.InitialReportDelay,
-		)
-	}
-
-	// Ensure report generation stops when this function exits
-	defer func() {
-		if reportCancel != nil {
-			reportCancel()
-		}
-	}()
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -329,74 +278,20 @@ func (w *WorkloadManager) runVMLifecycle(
 	}
 }
 
-// sendIndexReportsWhileAlive sends index reports for a VM at the configured interval.
-// It waits for prerequisites (handler, store, central) before starting, then runs
-// until the context is cancelled (when the VM lifecycle ends).
-func (w *WorkloadManager) sendIndexReportsWhileAlive(
-	ctx context.Context,
-	reportGen *vmindexreport.Generator,
-	vsockCID uint32,
-	interval time.Duration,
-	initialDelay time.Duration,
-) {
-	// Wait for all prerequisites before sending reports
-	if !w.vmPrerequisitesReady.Wait(ctx) {
-		log.Debugf("Prerequisites not ready to start sending fake index reports")
-		return
-	}
-
-	log.Debugf("Starting index report generation for a VM (vsockCID=%d, interval=%s, initialDelay=%s)", vsockCID, interval, initialDelay)
-
-	reportTicker := time.NewTicker(randomizedInterval(interval, reportIntervalMaxDeviation))
-	if initialDelay > 0 {
-		firstPeriod := randomizedInterval(initialDelay, initialReportMaxDeviation)
-		reportTicker.Reset(firstPeriod)
-	} else {
-		w.sendOneIndexReport(ctx, reportGen, vsockCID)
-	}
-	defer reportTicker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			log.Debugf("Stopping index report generation for VM with vsockCID %d (lifecycle ended)", vsockCID)
-			return
-		case <-reportTicker.C:
-			reportTicker.Reset(randomizedInterval(interval, reportIntervalMaxDeviation))
-			w.sendOneIndexReport(ctx, reportGen, vsockCID)
-		}
-	}
+// HasFakeVMWorkload reports whether this manager is simulating KubeVirt VMs.
+func (w *WorkloadManager) HasFakeVMWorkload() bool {
+	return w != nil && w.workload != nil && w.workload.VirtualMachineWorkload.PoolSize > 0
 }
 
-// sendOneIndexReport generates and sends a single index report for a VM.
-func (w *WorkloadManager) sendOneIndexReport(
-	ctx context.Context,
-	reportGen *vmindexreport.Generator,
-	vsockCID uint32,
-) {
-	if ctx.Err() != nil {
-		return
-	}
-
-	if w.vmIndexReportHandler == nil {
-		log.Debugf("VM index report handler not set, skipping report for VM %d", vsockCID)
-		return
-	}
-	if w.vmStore == nil {
-		log.Debugf("VM store not set, skipping report for VM %d", vsockCID)
-		return
-	}
-
-	vm := w.vmStore.GetFromCID(vsockCID)
-	if vm == nil {
-		log.Debugf("VM with vsockCID %d not found in store, skipping index report", vsockCID)
-		return
-	}
+// HasFakeVMIndexReports reports whether the fake agent should serve index reports.
+func (w *WorkloadManager) HasFakeVMIndexReports() bool {
+	return w.HasFakeVMWorkload() && w.workload.VirtualMachineWorkload.ReportInterval > 0
+}
 
-	if err := w.vmIndexReportHandler.Send(ctx, vm, reportGen.GenerateV4IndexReport()); err != nil {
-		// Don't log errors during shutdown
-		if ctx.Err() == nil {
-			log.Debugf("Failed to send index report for VM %d: %v", vsockCID, err)
-		}
+// FakeVMNumPackages is the package count used in generated fake index reports.
+func (w *WorkloadManager) FakeVMNumPackages() int {
+	if w == nil || w.workload == nil {
+		return 0
 	}
+	return w.workload.VirtualMachineWorkload.NumPackages
 }
diff --git a/sensor/kubernetes/fake/virtualmachines_test.go b/sensor/kubernetes/fake/virtualmachines_test.go
index 74485e3f5e14b..4e43e91a2ed03 100644
--- a/sensor/kubernetes/fake/virtualmachines_test.go
+++ b/sensor/kubernetes/fake/virtualmachines_test.go
@@ -1,12 +1,10 @@
 package fake
 
 import (
-	"fmt"
 	"math"
 	"testing"
 	"time"
 
-	"github.com/stackrox/rox/pkg/fixtures/vmindexreport"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -105,32 +103,16 @@ func TestValidateVMWorkload(t *testing.T) {
 				`Setting "updateInterval"=1m40s causes none of the VMs to ever receive an update. ` +
 				`Lower the value of "updateInterval" or increase the 'lifecycleDuration'.`,
 		},
-		"reportInterval in jitter range warns": {
+		"reportInterval does not affect lifecycle validation": {
 			input: VirtualMachineWorkload{
 				PoolSize:          5,
 				LifecycleDuration: 60 * time.Second, // bounds: 30s-90s
 				UpdateInterval:    20 * time.Second, // < lower bound, OK
-				ReportInterval:    45 * time.Second, // in range
+				ReportInterval:    45 * time.Second,
 			},
 			wantLifecycleDuration: 60 * time.Second,
 			wantUpdateInterval:    20 * time.Second,
-			wantErr: `The VM will live for a random duration between 30s and 1m30s. ` +
-				`Setting "reportInterval"=45s may cause some VMs to never send any index reports. ` +
-				`Lower the value of "reportInterval" or increase the 'lifecycleDuration'.`,
-		},
-		"initialReportDelay in jitter range warns": {
-			input: VirtualMachineWorkload{
-				PoolSize:           5,
-				LifecycleDuration:  60 * time.Second, // bounds: 30s-90s
-				UpdateInterval:     20 * time.Second, // < lower bound, OK
-				ReportInterval:     20 * time.Second, // < lower bound, OK
-				InitialReportDelay: 45 * time.Second, // in range
-			},
-			wantLifecycleDuration: 60 * time.Second,
-			wantUpdateInterval:    20 * time.Second,
-			wantErr: `The VM will live for a random duration between 30s and 1m30s. ` +
-				`Setting "initialReportDelay"=45s may cause some VMs to never send any index reports. ` +
-				`Lower the value of "initialReportDelay" or increase the 'lifecycleDuration'.`,
+			wantErr:               "",
 		},
 	}
 
@@ -151,41 +133,6 @@ func TestValidateVMWorkload(t *testing.T) {
 	}
 }
 
-func TestGenerateFakeIndexReport(t *testing.T) {
-	gen := vmindexreport.NewGeneratorWithSeed(10, 42) // 10 packages, seed=42 for reproducibility
-	tests := map[string]uint32{
-		"basic report": 1234,
-		"different VM": 9999,
-	}
-	for name, vsockCID := range tests {
-		t.Run(name, func(t *testing.T) {
-			report := gen.GenerateV1IndexReport(vsockCID)
-
-			// Verify vsockCID is set as string
-			assert.Equal(t, fmt.Sprintf("%d", vsockCID), report.GetVsockCid(), "vsockCID mismatch")
-
-			// Verify index report structure
-			require.NotNil(t, report.GetIndexV4(), "IndexV4 should not be nil")
-			assert.Equal(t, "IndexFinished", report.GetIndexV4().GetState(), "State mismatch")
-			assert.True(t, report.GetIndexV4().GetSuccess(), "Success should be true")
-
-			// Verify contents
-			require.NotNil(t, report.GetIndexV4().GetContents(), "Contents should not be nil")
-			assert.Len(t, report.GetIndexV4().GetContents().GetPackages(), 10, "expected 10 packages")
-			assert.Len(t, report.GetIndexV4().GetContents().GetRepositories(), 3, "expected 3 real repositories")
-
-			// Verify packages have valid CPEs (regression test for WFN error)
-			for _, pkg := range report.GetIndexV4().GetContents().GetPackages() {
-				assert.NotEmpty(t, pkg.GetCpe(), "package CPE should not be empty")
-				assert.Contains(t, pkg.GetCpe(), "cpe:2.3:", "package CPE should be valid format")
-				if pkg.GetSource() != nil {
-					assert.NotEmpty(t, pkg.GetSource().GetCpe(), "source package CPE should not be empty")
-				}
-			}
-		})
-	}
-}
-
 func TestToUnstructuredVMI(t *testing.T) {
 	tests := map[string]struct {
 		vsockCID         *uint32
@@ -253,3 +200,89 @@ func TestToUnstructuredVMI(t *testing.T) {
 		})
 	}
 }
+
+func TestGetRandomVMPair_OmitsVSOCKCID(t *testing.T) {
+	_, vmi := getRandomVMPair(3, defaultGuestOSPool)
+	_, found, err := unstructured.NestedInt64(vmi.Object, "status", "vsockCID")
+	require.NoError(t, err)
+	assert.False(t, found)
+}
+
+func TestGetRandomVMPair_NewUIDEachLifecycle(t *testing.T) {
+	vm1, vmi1 := getRandomVMPair(3, defaultGuestOSPool)
+	vm2, vmi2 := getRandomVMPair(3, defaultGuestOSPool)
+
+	require.NotEmpty(t, vm1.GetUID())
+	require.Len(t, vmi1.GetOwnerReferences(), 1)
+	assert.Equal(t, vm1.GetUID(), vmi1.GetOwnerReferences()[0].UID)
+	assert.NotEqual(t, vm1.GetUID(), vmi1.GetUID())
+
+	assert.NotEqual(t, vm1.GetUID(), vm2.GetUID(), "same slot must not reuse a VM UID across lifecycles")
+	assert.NotEqual(t, vmi1.GetUID(), vmi2.GetUID(), "same slot must not reuse a VMI UID across lifecycles")
+}
+
+func TestWorkloadManager_HasFakeVMWorkload(t *testing.T) {
+	tests := map[string]struct {
+		mgr  *WorkloadManager
+		want bool
+	}{
+		"nil manager": {},
+		"nil workload": {
+			mgr: &WorkloadManager{},
+		},
+		"zero pool": {
+			mgr: &WorkloadManager{workload: &Workload{}},
+		},
+		"pool set": {
+			mgr:  &WorkloadManager{workload: &Workload{VirtualMachineWorkload: VirtualMachineWorkload{PoolSize: 3}}},
+			want: true,
+		},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.mgr.HasFakeVMWorkload())
+		})
+	}
+}
+
+func TestWorkloadManager_HasFakeVMIndexReports(t *testing.T) {
+	tests := map[string]struct {
+		mgr  *WorkloadManager
+		want bool
+	}{
+		"nil manager": {},
+		"pool without reports": {
+			mgr: &WorkloadManager{workload: &Workload{VirtualMachineWorkload: VirtualMachineWorkload{PoolSize: 3}}},
+		},
+		"pool with reports": {
+			mgr: &WorkloadManager{workload: &Workload{VirtualMachineWorkload: VirtualMachineWorkload{
+				PoolSize:       3,
+				ReportInterval: time.Minute,
+			}}},
+			want: true,
+		},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.mgr.HasFakeVMIndexReports())
+		})
+	}
+}
+
+func TestWorkloadManager_FakeVMNumPackages(t *testing.T) {
+	tests := map[string]struct {
+		mgr  *WorkloadManager
+		want int
+	}{
+		"nil manager": {},
+		"packages set": {
+			mgr:  &WorkloadManager{workload: &Workload{VirtualMachineWorkload: VirtualMachineWorkload{NumPackages: 700}}},
+			want: 700,
+		},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.mgr.FakeVMNumPackages())
+		})
+	}
+}
diff --git a/sensor/kubernetes/fake/vmagent/client.go b/sensor/kubernetes/fake/vmagent/client.go
new file mode 100644
index 0000000000000..6532fecb7f1f2
--- /dev/null
+++ b/sensor/kubernetes/fake/vmagent/client.go
@@ -0,0 +1,68 @@
+package vmagent
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	pb "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
+	"github.com/stackrox/rox/pkg/fixtures/vmindexreport"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/vmscraper"
+	"github.com/stackrox/rox/sensor/common/virtualmachine/vsockclient"
+)
+
+var _ vmscraper.ProtocolClient = (*Client)(nil)
+
+const (
+	reportGeneratorSeed = int64(42)
+	agentVersion        = "fake"
+)
+
+// Client is a ProtocolClient that returns generated v4 reports without speaking vsock framing.
+type Client struct {
+	gen     *vmindexreport.Generator
+	token   string
+	enabled bool
+}
+
+// NewClient returns a Client. When enabled is false, GetReport always returns Unchanged.
+func NewClient(numPackages int, enabled bool) *Client {
+	c := &Client{enabled: enabled}
+	if !enabled {
+		return c
+	}
+	c.gen = vmindexreport.NewGeneratorWithSeed(numPackages, reportGeneratorSeed)
+	c.token = fmt.Sprintf("fake-%d", numPackages)
+	return c
+}
+
+// GetReport ignores stream and returns a generated report, or Unchanged when the token matches.
+func (c *Client) GetReport(ctx context.Context, _ io.ReadWriteCloser, lastKnownToken string) (*vsockclient.GetReportResult, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, fmt.Errorf("fake vm get report: %w", err)
+	}
+	if !c.enabled {
+		return &vsockclient.GetReportResult{Unchanged: true}, nil
+	}
+	if lastKnownToken != "" && lastKnownToken == c.token {
+		return &vsockclient.GetReportResult{
+			Unchanged: true,
+			Meta:      &pb.ResponseMeta{ReportToken: c.token, AgentVersion: agentVersion},
+		}, nil
+	}
+	return &vsockclient.GetReportResult{
+		IndexReport: c.gen.GenerateV4IndexReport(),
+		Meta: &pb.ResponseMeta{
+			ReportToken:  c.token,
+			AgentVersion: agentVersion,
+		},
+	}, nil
+}
+
+// SyncRepoCPEMapping is a no-op: fake reports do not advertise a Sensor-managed mapping.
+func (c *Client) SyncRepoCPEMapping(ctx context.Context, _ io.ReadWriteCloser, _ []byte) (bool, *pb.ResponseMeta, error) {
+	if err := ctx.Err(); err != nil {
+		return false, nil, fmt.Errorf("fake vm sync mapping: %w", err)
+	}
+	return false, nil, nil
+}
diff --git a/sensor/kubernetes/fake/vmagent/client_test.go b/sensor/kubernetes/fake/vmagent/client_test.go
new file mode 100644
index 0000000000000..e3bbfe4730b35
--- /dev/null
+++ b/sensor/kubernetes/fake/vmagent/client_test.go
@@ -0,0 +1,128 @@
+package vmagent_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stackrox/rox/sensor/kubernetes/fake/vmagent"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestClient_GetReport(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		numPackages    int
+		enabled        bool
+		lastKnownToken string
+		wantUnchanged  bool
+		wantPackages   int
+		wantAgent      string
+	}{
+		"disabled returns unchanged": {
+			numPackages:   10,
+			enabled:       false,
+			wantUnchanged: true,
+		},
+		"empty token returns full report": {
+			numPackages:  7,
+			enabled:      true,
+			wantPackages: 7,
+			wantAgent:    "fake",
+		},
+		"mismatched token returns full report": {
+			numPackages:    7,
+			enabled:        true,
+			lastKnownToken: "stale",
+			wantPackages:   7,
+			wantAgent:      "fake",
+		},
+		"zero packages still returns a report": {
+			numPackages:  0,
+			enabled:      true,
+			wantPackages: 0,
+			wantAgent:    "fake",
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			result, err := vmagent.NewClient(tt.numPackages, tt.enabled).GetReport(t.Context(), nil, tt.lastKnownToken)
+			require.NoError(t, err)
+			require.NotNil(t, result)
+			assert.Equal(t, tt.wantUnchanged, result.Unchanged)
+
+			if tt.wantUnchanged {
+				assert.Nil(t, result.IndexReport)
+				return
+			}
+
+			require.NotNil(t, result.IndexReport)
+			assert.Equal(t, tt.wantPackages, len(result.IndexReport.GetContents().GetPackages()))
+			require.NotNil(t, result.Meta)
+			assert.NotEmpty(t, result.Meta.GetReportToken())
+			assert.Equal(t, tt.wantAgent, result.Meta.GetAgentVersion())
+		})
+	}
+}
+
+func TestClient_GetReport_MatchingTokenReturnsUnchanged(t *testing.T) {
+	t.Parallel()
+
+	client := vmagent.NewClient(7, true)
+	first, err := client.GetReport(t.Context(), nil, "")
+	require.NoError(t, err)
+	require.NotNil(t, first)
+	require.NotEmpty(t, first.Meta.GetReportToken())
+
+	second, err := client.GetReport(t.Context(), nil, first.Meta.GetReportToken())
+	require.NoError(t, err)
+	require.NotNil(t, second)
+	assert.True(t, second.Unchanged)
+	assert.Nil(t, second.IndexReport)
+}
+
+func TestClient_GetReport_TokenStableAcrossFullReports(t *testing.T) {
+	t.Parallel()
+
+	client := vmagent.NewClient(7, true)
+	a, err := client.GetReport(t.Context(), nil, "stale")
+	require.NoError(t, err)
+	require.NotNil(t, a)
+	b, err := client.GetReport(t.Context(), nil, "stale")
+	require.NoError(t, err)
+	require.NotNil(t, b)
+	assert.Equal(t, a.Meta.GetReportToken(), b.Meta.GetReportToken())
+}
+
+func TestClient_GetReport_CancelledContext(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	_, err := vmagent.NewClient(7, true).GetReport(ctx, nil, "")
+	assert.ErrorIs(t, err, context.Canceled)
+}
+
+func TestDialThenGetReport(t *testing.T) {
+	t.Parallel()
+
+	stream, err := vmagent.NewDialer().Dial(t.Context(), "default", "vm-0", 1, true)
+	require.NoError(t, err)
+	require.NotNil(t, stream)
+	t.Cleanup(func() {
+		if stream != nil {
+			_ = stream.Close()
+		}
+	})
+
+	result, err := vmagent.NewClient(3, true).GetReport(t.Context(), stream, "")
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	require.NotNil(t, result.IndexReport)
+	assert.Equal(t, 3, len(result.IndexReport.GetContents().GetPackages()))
+}
diff --git a/sensor/kubernetes/fake/vmagent/dialer.go b/sensor/kubernetes/fake/vmagent/dialer.go
new file mode 100644
index 0000000000000..030cfe5a0f6da
--- /dev/null
+++ b/sensor/kubernetes/fake/vmagent/dialer.go
@@ -0,0 +1,35 @@
+package vmagent
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/stackrox/rox/sensor/common/virtualmachine/vmscraper"
+)
+
+var _ vmscraper.VMDialer = (*Dialer)(nil)
+
+// Dialer is a VMDialer that returns a nop stream instead of opening VSOCK.
+type Dialer struct{}
+
+// NewDialer returns a Dialer.
+func NewDialer() *Dialer {
+	return &Dialer{}
+}
+
+// Dial returns a nop stream so VMScraper can run its poll path without VSOCK.
+func (*Dialer) Dial(ctx context.Context, _, _ string, _ uint32, _ bool) (io.ReadWriteCloser, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, fmt.Errorf("fake vm dial: %w", err)
+	}
+	return nopStream{}, nil
+}
+
+type nopStream struct{}
+
+func (nopStream) Read([]byte) (int, error) { return 0, io.EOF }
+
+func (nopStream) Write(p []byte) (int, error) { return len(p), nil }
+
+func (nopStream) Close() error { return nil }
diff --git a/sensor/kubernetes/fake/vmagent/dialer_test.go b/sensor/kubernetes/fake/vmagent/dialer_test.go
new file mode 100644
index 0000000000000..8bd0930298571
--- /dev/null
+++ b/sensor/kubernetes/fake/vmagent/dialer_test.go
@@ -0,0 +1,39 @@
+package vmagent_test
+
+import (
+	"context"
+	"io"
+	"testing"
+
+	"github.com/stackrox/rox/sensor/kubernetes/fake/vmagent"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDialer_Dial_ReturnsCloseableStream(t *testing.T) {
+	t.Parallel()
+
+	stream, err := vmagent.NewDialer().Dial(t.Context(), "default", "vm-1", 1, true)
+	require.NoError(t, err)
+	require.NotNil(t, stream)
+
+	n, err := stream.Write([]byte("ignored"))
+	assert.NoError(t, err)
+	assert.Equal(t, len("ignored"), n)
+
+	_, err = stream.Read(make([]byte, 1))
+	assert.ErrorIs(t, err, io.EOF)
+
+	require.NoError(t, stream.Close())
+	require.NoError(t, stream.Close())
+}
+
+func TestDialer_Dial_CancelledContext(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	_, err := vmagent.NewDialer().Dial(ctx, "default", "vm-1", 1, true)
+	assert.ErrorIs(t, err, context.Canceled)
+}
diff --git a/sensor/kubernetes/fake/vmagent/doc.go b/sensor/kubernetes/fake/vmagent/doc.go
new file mode 100644
index 0000000000000..9c1855fce8217
--- /dev/null
+++ b/sensor/kubernetes/fake/vmagent/doc.go
@@ -0,0 +1,4 @@
+// Package vmagent is an in-process stand-in for roxagent used by fake VM workloads.
+// Dial returns a nop stream; GetReport ignores it and returns a generated v4 report
+// so VMScraper poll, spread, backoff, and forward run without VSOCK or TLS.
+package vmagent
diff --git a/sensor/kubernetes/fake/workload.go b/sensor/kubernetes/fake/workload.go
index 4d5172a0a8431..eba851290f793 100644
--- a/sensor/kubernetes/fake/workload.go
+++ b/sensor/kubernetes/fake/workload.go
@@ -91,9 +91,7 @@ type SecretWorkload struct {
 }
 
 // VirtualMachineWorkload defines the workload for VirtualMachine and VirtualMachineInstance CRDs.
-// This is the unified config for both VM/VMI informer events AND VM index reports.
-// Index reports are only generated when ReportInterval > 0, and they follow the VM lifecycle
-// (reports are sent only while the VM is "alive" in the informer simulation).
+// ReportInterval > 0 enables the in-process fake agent; VMScraper poll and spread set cadence.
 type VirtualMachineWorkload struct {
 	// PoolSize is the number of VM/VMI templates to maintain in the pool.
 	// This controls how many unique VMs exist at any given time.
@@ -104,18 +102,25 @@ type VirtualMachineWorkload struct {
 	LifecycleDuration time.Duration `yaml:"lifecycleDuration"`
 	// NumLifecycles is the number of times to recreate VMs/VMIs (0 = infinite)
 	NumLifecycles int `yaml:"numLifecycles"`
-	// InitialReportDelay delays the first index report for each VM by a user-provided duration.
-	// A ±20% jitter is always applied to spread the initial burst; when unset, the first index
-	// report is sent immediately (no delay, no jitter) once prerequisites are ready.
-	InitialReportDelay time.Duration `yaml:"initialReportDelay"`
 
-	// ReportInterval is how often each VM sends an index report (0 = no reports).
-	// Index reports are only sent while the VM is alive in the informer simulation.
+	// ReportInterval greater than zero enables fake index reports. Cadence is
+	// VMScraper poll and spread, not this interval.
 	ReportInterval time.Duration `yaml:"reportInterval"`
 	// NumPackages is the number of fake packages to include in each index report
 	NumPackages int `yaml:"numPackages"`
 }
 
+// FileActivityWorkload defines the rate and shape of file activity events
+type FileActivityWorkload struct {
+	ActivityInterval time.Duration `yaml:"activityInterval"`
+	BatchSize        int           `yaml:"batchSize"`
+	NumPaths         int           `yaml:"numPaths"`
+	// NodeEventPercent is the percentage of events generated as node-level (0-100).
+	// The remainder are deployment-level events with a container ID.
+	// Default: 50
+	NodeEventPercent int `yaml:"nodeEventPercent"`
+}
+
 // Workload is the definition of a scale workload
 type Workload struct {
 	DeploymentWorkload     []DeploymentWorkload    `yaml:"deploymentWorkload"`
@@ -126,6 +131,7 @@ type Workload struct {
 	ServiceWorkload        ServiceWorkload         `yaml:"serviceWorkload"`
 	SecretWorkload         SecretWorkload          `yaml:"secretWorkload"`
 	VirtualMachineWorkload VirtualMachineWorkload  `yaml:"virtualMachineWorkload"`
+	FileActivityWorkload   FileActivityWorkload    `yaml:"fileActivityWorkload"`
 	NumNamespaces          int                     `yaml:"numNamespaces"`
 	MatchLabels            bool                    `yaml:"matchLabels"`
 }
diff --git a/sensor/kubernetes/listener/resources/convert.go b/sensor/kubernetes/listener/resources/convert.go
index 79650f98be89c..7329c81b51fb4 100644
--- a/sensor/kubernetes/listener/resources/convert.go
+++ b/sensor/kubernetes/listener/resources/convert.go
@@ -476,14 +476,14 @@ func (w *deploymentWrap) getLabelSelector(spec reflect.Value) (*metav1.LabelSele
 	}
 
 	// Selector is of map type for replication controller
-	if labelMap, ok := s.Interface().(map[string]string); ok {
+	if labelMap, ok := reflect.TypeAssert[map[string]string](s); ok {
 		return &metav1.LabelSelector{
 			MatchLabels: labelMap,
 		}, nil
 	}
 
 	// All other resources uses labelSelector.
-	if ls, ok := s.Interface().(*metav1.LabelSelector); ok {
+	if ls, ok := reflect.TypeAssert[*metav1.LabelSelector](s); ok {
 		return ls, nil
 	}
 
diff --git a/sensor/kubernetes/listener/resources/route.go b/sensor/kubernetes/listener/resources/route.go
index d9bf38affd1a7..54c6375d36085 100644
--- a/sensor/kubernetes/listener/resources/route.go
+++ b/sensor/kubernetes/listener/resources/route.go
@@ -30,7 +30,7 @@ func (r *routeDispatcher) ProcessEvent(obj, _ interface{}, action central.Resour
 		return nil
 	}
 
-	if action == central.ResourceAction_CREATE_RESOURCE || action == central.ResourceAction_UPDATE_RESOURCE {
+	if action == central.ResourceAction_CREATE_RESOURCE || action == central.ResourceAction_UPDATE_RESOURCE || action == central.ResourceAction_SYNC_RESOURCE {
 		r.serviceStore.upsertRoute(route)
 	}
 	if action == central.ResourceAction_REMOVE_RESOURCE {
diff --git a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/utils.go b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/utils.go
index c7c576f93a67f..abf2dac6721bd 100644
--- a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/utils.go
+++ b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/utils.go
@@ -1,10 +1,7 @@
 package dispatcher
 
 import (
-	"strings"
-
 	"github.com/stackrox/rox/generated/internalapi/central"
-	virtualMachineV1 "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
 	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
 	sensorVirtualMachine "github.com/stackrox/rox/sensor/common/virtualmachine"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -21,73 +18,19 @@ func getVirtualMachineOwnerReference(owners []metav1.OwnerReference) (*metav1.Ow
 	return nil, false
 }
 
-func getVirtualMachineState(vm *sensorVirtualMachine.Info) virtualMachineV1.VirtualMachine_State {
-	if vm == nil {
-		return virtualMachineV1.VirtualMachine_UNKNOWN
-	}
-	if vm.Running {
-		return virtualMachineV1.VirtualMachine_RUNNING
-	}
-	return virtualMachineV1.VirtualMachine_STOPPED
-}
-
-func getVirtualMachineVSockCID(vm *sensorVirtualMachine.Info) (int32, bool) {
-	if vm == nil {
-		return int32(0), false
-	}
-	if vm.VSOCKCID == nil {
-		return int32(0), false
-	}
-	return int32(*vm.VSOCKCID), true
-}
-
-func getFacts(vm *sensorVirtualMachine.Info) map[string]string {
-	facts := map[string]string{
-		pkgVM.GuestOSKey: pkgVM.UnknownGuestOS,
-	}
-	if vm.GuestOS != "" {
-		facts[pkgVM.GuestOSKey] = vm.GuestOS
-	}
-	if vm.Description != "" {
-		facts[pkgVM.DescriptionKey] = vm.Description
-	}
-	if vm.NodeName != "" {
-		facts[pkgVM.NodeNameKey] = vm.NodeName
-	}
-	if len(vm.IPAddresses) > 0 {
-		facts[pkgVM.IPAddressesKey] = strings.Join(vm.IPAddresses, ", ")
-	}
-	if len(vm.ActivePods) > 0 {
-		facts[pkgVM.ActivePodsKey] = strings.Join(vm.ActivePods, ", ")
-	}
-	if len(vm.BootOrder) > 0 {
-		facts[pkgVM.BootOrderKey] = strings.Join(vm.BootOrder, ", ")
-	}
-	if len(vm.CDRomDisks) > 0 {
-		facts[pkgVM.CDRomDisksKey] = strings.Join(vm.CDRomDisks, ", ")
-	}
-	return facts
+func createEvent(action central.ResourceAction, clusterID string, vm *sensorVirtualMachine.Info) *central.SensorEvent {
+	return sensorVirtualMachine.SensorEvent(action, clusterID, vm)
 }
 
-func createEvent(action central.ResourceAction, clusterID string, vm *sensorVirtualMachine.Info) *central.SensorEvent {
+// attachStoredAgentFacts copies scrape-owned facts onto vm. Informer UPDATEs are
+// built from the VMI and would otherwise replace Central's facts map without them.
+func attachStoredAgentFacts(store virtualMachineStore, vm *sensorVirtualMachine.Info) {
 	if vm == nil {
-		return nil
+		return
 	}
-	vSockCID, vSockCIDSet := getVirtualMachineVSockCID(vm)
-	return &central.SensorEvent{
-		Id:     string(vm.ID),
-		Action: action,
-		Resource: &central.SensorEvent_VirtualMachine{
-			VirtualMachine: &virtualMachineV1.VirtualMachine{
-				Id:          string(vm.ID),
-				Namespace:   vm.Namespace,
-				Name:        vm.Name,
-				ClusterId:   clusterID,
-				VsockCid:    vSockCID,
-				VsockCidSet: vSockCIDSet,
-				State:       getVirtualMachineState(vm),
-				Facts:       getFacts(vm),
-			},
-		},
+	stored := store.Get(vm.ID)
+	if stored == nil || len(stored.AgentFacts) == 0 {
+		return
 	}
+	vm.AgentFacts = stored.AgentFacts
 }
diff --git a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/utils_test.go b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/utils_test.go
deleted file mode 100644
index 56649d39911b5..0000000000000
--- a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/utils_test.go
+++ /dev/null
@@ -1,397 +0,0 @@
-package dispatcher
-
-import (
-	"testing"
-
-	"github.com/stackrox/rox/generated/internalapi/central"
-	virtualMachineV1 "github.com/stackrox/rox/generated/internalapi/virtualmachine/v1"
-	"github.com/stackrox/rox/pkg/fixtures/fixtureconsts"
-	"github.com/stackrox/rox/pkg/protoassert"
-	"github.com/stackrox/rox/pkg/uuid"
-	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
-	sensorVirtualMachine "github.com/stackrox/rox/sensor/common/virtualmachine"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetVirtualMachineState(t *testing.T) {
-	tests := []struct {
-		name     string
-		vm       *sensorVirtualMachine.Info
-		expected virtualMachineV1.VirtualMachine_State
-	}{
-		{
-			name:     "nil input",
-			vm:       nil,
-			expected: virtualMachineV1.VirtualMachine_UNKNOWN,
-		},
-		{
-			name: "running machine",
-			vm: &sensorVirtualMachine.Info{
-				Running: true,
-			},
-			expected: virtualMachineV1.VirtualMachine_RUNNING,
-		},
-		{
-			name: "stopped machine",
-			vm: &sensorVirtualMachine.Info{
-				Running: false,
-			},
-			expected: virtualMachineV1.VirtualMachine_STOPPED,
-		},
-		{
-			name:     "machine with partial data is assumed not running",
-			vm:       &sensorVirtualMachine.Info{},
-			expected: virtualMachineV1.VirtualMachine_STOPPED,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(it *testing.T) {
-			state := getVirtualMachineState(tc.vm)
-			assert.Equal(it, tc.expected, state)
-		})
-	}
-}
-
-func TestGetVirtualMachineVSockCID(t *testing.T) {
-	const expectedZero = int32(0)
-	zeroCID := uint32(0)
-	someCID := uint32(0xca7d09)
-	tests := []struct {
-		name        string
-		vm          *sensorVirtualMachine.Info
-		expected    int32
-		expectedSet bool
-	}{
-		{
-			name:        "nil input",
-			vm:          nil,
-			expected:    expectedZero,
-			expectedSet: false,
-		},
-		{
-			name:        "virtual machine with partial data is not assumed to have a VSock",
-			vm:          &sensorVirtualMachine.Info{},
-			expected:    expectedZero,
-			expectedSet: false,
-		},
-		{
-			name: "hypervisor",
-			vm: &sensorVirtualMachine.Info{
-				VSOCKCID: &zeroCID,
-			},
-			expected:    expectedZero,
-			expectedSet: true,
-		},
-		{
-			name: "virtual machine",
-			vm: &sensorVirtualMachine.Info{
-				VSOCKCID: &someCID,
-			},
-			expected:    int32(someCID),
-			expectedSet: true,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(it *testing.T) {
-			vSockCID, vSockCIDSet := getVirtualMachineVSockCID(tc.vm)
-			assert.Equal(it, tc.expected, vSockCID)
-			assert.Equal(it, tc.expectedSet, vSockCIDSet)
-		})
-	}
-}
-
-func TestGetFacts(t *testing.T) {
-	tests := map[string]struct {
-		vm       *sensorVirtualMachine.Info
-		expected map[string]string
-	}{
-		"should include description and network facts when present": {
-			vm: &sensorVirtualMachine.Info{
-				GuestOS:     "Red Hat Enterprise Linux",
-				Description: "test description",
-				NodeName:    "node-1",
-				IPAddresses: []string{"10.0.0.2", "10.0.0.1"},
-				ActivePods:  []string{"pod-2=node-b", "pod-1=node-a"},
-				BootOrder:   []string{"disk2=2", "disk1=1"},
-				CDRomDisks:  []string{"cd2", "cd1"},
-			},
-			expected: map[string]string{
-				pkgVM.GuestOSKey:     "Red Hat Enterprise Linux",
-				pkgVM.DescriptionKey: "test description",
-				pkgVM.NodeNameKey:    "node-1",
-				pkgVM.IPAddressesKey: "10.0.0.2, 10.0.0.1",
-				pkgVM.ActivePodsKey:  "pod-2=node-b, pod-1=node-a",
-				pkgVM.BootOrderKey:   "disk2=2, disk1=1",
-				pkgVM.CDRomDisksKey:  "cd2, cd1",
-			},
-		},
-		"should preserve boot order sequence": {
-			vm: &sensorVirtualMachine.Info{
-				GuestOS:   "Red Hat Enterprise Linux",
-				BootOrder: []string{"disk-b=1", "disk-a=1", "disk-c=2"},
-			},
-			expected: map[string]string{
-				pkgVM.GuestOSKey:   "Red Hat Enterprise Linux",
-				pkgVM.BootOrderKey: "disk-b=1, disk-a=1, disk-c=2",
-			},
-		},
-		"should return unknown guest os when optional data is missing": {
-			vm: &sensorVirtualMachine.Info{},
-			expected: map[string]string{
-				pkgVM.GuestOSKey: pkgVM.UnknownGuestOS,
-			},
-		},
-	}
-	for name, tt := range tests {
-		t.Run(name, func(it *testing.T) {
-			facts := getFacts(tt.vm)
-			assert.Equal(it, tt.expected, facts)
-		})
-	}
-}
-
-func TestCreateEvent(t *testing.T) {
-	const ns1 = "namespace-1"
-	var vm1ID = uuid.NewTestUUID(1).String()
-	const vm1Name = "Test VM 1"
-	var vm2ID = uuid.NewTestUUID(2).String()
-	const vm2Name = "Test VM 2"
-	vm2VSockCID := uint32(0xd09ca7)
-	wireVM2VSockCID := int32(vm2VSockCID)
-
-	tests := []struct {
-		name      string
-		action    central.ResourceAction
-		clusterID string
-		inputVM   *sensorVirtualMachine.Info
-		expected  *central.SensorEvent
-	}{
-		{
-			name:      "nil input",
-			action:    central.ResourceAction_UPDATE_RESOURCE,
-			clusterID: fixtureconsts.Cluster1,
-			inputVM:   nil,
-			expected:  nil,
-		},
-		{
-			name:      "create stopped virtual machine",
-			action:    central.ResourceAction_CREATE_RESOURCE,
-			clusterID: fixtureconsts.Cluster2,
-			inputVM: &sensorVirtualMachine.Info{
-				ID:        sensorVirtualMachine.VMID(vm1ID),
-				Name:      vm1Name,
-				Namespace: ns1,
-				VSOCKCID:  nil,
-				Running:   false,
-			},
-			expected: &central.SensorEvent{
-				Id:     vm1ID,
-				Action: central.ResourceAction_CREATE_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachine{
-					VirtualMachine: &virtualMachineV1.VirtualMachine{
-						Id:          vm1ID,
-						Namespace:   ns1,
-						Name:        vm1Name,
-						ClusterId:   fixtureconsts.Cluster2,
-						VsockCid:    0,
-						VsockCidSet: false,
-						State:       virtualMachineV1.VirtualMachine_STOPPED,
-						Facts:       getFactsForTest(t, pkgVM.UnknownGuestOS),
-					},
-				},
-			},
-		},
-		{
-			name:      "create running virtual machine",
-			action:    central.ResourceAction_CREATE_RESOURCE,
-			clusterID: fixtureconsts.Cluster2,
-			inputVM: &sensorVirtualMachine.Info{
-				ID:        sensorVirtualMachine.VMID(vm2ID),
-				Name:      vm2Name,
-				Namespace: ns1,
-				VSOCKCID:  &vm2VSockCID,
-				Running:   true,
-				GuestOS:   "Red Hat Enterprise Linux",
-			},
-			expected: &central.SensorEvent{
-				Id:     vm2ID,
-				Action: central.ResourceAction_CREATE_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachine{
-					VirtualMachine: &virtualMachineV1.VirtualMachine{
-						Id:          vm2ID,
-						Namespace:   ns1,
-						Name:        vm2Name,
-						ClusterId:   fixtureconsts.Cluster2,
-						VsockCid:    wireVM2VSockCID,
-						VsockCidSet: true,
-						State:       virtualMachineV1.VirtualMachine_RUNNING,
-						Facts: map[string]string{
-							pkgVM.GuestOSKey: "Red Hat Enterprise Linux",
-						},
-					},
-				},
-			},
-		},
-		{
-			name:      "sync stopped virtual machine",
-			action:    central.ResourceAction_SYNC_RESOURCE,
-			clusterID: fixtureconsts.Cluster2,
-			inputVM: &sensorVirtualMachine.Info{
-				ID:        sensorVirtualMachine.VMID(vm1ID),
-				Name:      vm1Name,
-				Namespace: ns1,
-				VSOCKCID:  nil,
-				Running:   false,
-			},
-			expected: &central.SensorEvent{
-				Id:     vm1ID,
-				Action: central.ResourceAction_SYNC_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachine{
-					VirtualMachine: &virtualMachineV1.VirtualMachine{
-						Id:          vm1ID,
-						Namespace:   ns1,
-						Name:        vm1Name,
-						ClusterId:   fixtureconsts.Cluster2,
-						VsockCid:    0,
-						VsockCidSet: false,
-						State:       virtualMachineV1.VirtualMachine_STOPPED,
-						Facts:       getFactsForTest(t, pkgVM.UnknownGuestOS),
-					},
-				},
-			},
-		},
-		{
-			name:      "sync running virtual machine",
-			action:    central.ResourceAction_SYNC_RESOURCE,
-			clusterID: fixtureconsts.Cluster2,
-			inputVM: &sensorVirtualMachine.Info{
-				ID:        sensorVirtualMachine.VMID(vm2ID),
-				Name:      vm2Name,
-				Namespace: ns1,
-				VSOCKCID:  &vm2VSockCID,
-				Running:   true,
-				GuestOS:   "Red Hat Enterprise Linux",
-			},
-			expected: &central.SensorEvent{
-				Id:     vm2ID,
-				Action: central.ResourceAction_SYNC_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachine{
-					VirtualMachine: &virtualMachineV1.VirtualMachine{
-						Id:          vm2ID,
-						Namespace:   ns1,
-						Name:        vm2Name,
-						ClusterId:   fixtureconsts.Cluster2,
-						VsockCid:    wireVM2VSockCID,
-						VsockCidSet: true,
-						State:       virtualMachineV1.VirtualMachine_RUNNING,
-						Facts: map[string]string{
-							pkgVM.GuestOSKey: "Red Hat Enterprise Linux",
-						},
-					},
-				},
-			},
-		},
-		{
-			name:      "update running virtual machine",
-			action:    central.ResourceAction_UPDATE_RESOURCE,
-			clusterID: fixtureconsts.Cluster2,
-			inputVM: &sensorVirtualMachine.Info{
-				ID:        sensorVirtualMachine.VMID(vm2ID),
-				Name:      vm2Name,
-				Namespace: ns1,
-				VSOCKCID:  &vm2VSockCID,
-				Running:   true,
-				GuestOS:   "Red Hat Enterprise Linux",
-			},
-			expected: &central.SensorEvent{
-				Id:     vm2ID,
-				Action: central.ResourceAction_UPDATE_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachine{
-					VirtualMachine: &virtualMachineV1.VirtualMachine{
-						Id:          vm2ID,
-						Namespace:   ns1,
-						Name:        vm2Name,
-						ClusterId:   fixtureconsts.Cluster2,
-						VsockCid:    wireVM2VSockCID,
-						VsockCidSet: true,
-						State:       virtualMachineV1.VirtualMachine_RUNNING,
-						Facts: map[string]string{
-							pkgVM.GuestOSKey: "Red Hat Enterprise Linux",
-						},
-					},
-				},
-			},
-		},
-		{
-			name:      "remove stopped virtual machine",
-			action:    central.ResourceAction_REMOVE_RESOURCE,
-			clusterID: fixtureconsts.Cluster2,
-			inputVM: &sensorVirtualMachine.Info{
-				ID:        sensorVirtualMachine.VMID(vm1ID),
-				Name:      vm1Name,
-				Namespace: ns1,
-				VSOCKCID:  nil,
-				Running:   false,
-			},
-			expected: &central.SensorEvent{
-				Id:     vm1ID,
-				Action: central.ResourceAction_REMOVE_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachine{
-					VirtualMachine: &virtualMachineV1.VirtualMachine{
-						Id:          vm1ID,
-						Namespace:   ns1,
-						Name:        vm1Name,
-						ClusterId:   fixtureconsts.Cluster2,
-						VsockCid:    0,
-						VsockCidSet: false,
-						State:       virtualMachineV1.VirtualMachine_STOPPED,
-						Facts:       getFactsForTest(t, pkgVM.UnknownGuestOS),
-					},
-				},
-			},
-		},
-		{
-			name:      "remove running virtual machine",
-			action:    central.ResourceAction_REMOVE_RESOURCE,
-			clusterID: fixtureconsts.Cluster2,
-			inputVM: &sensorVirtualMachine.Info{
-				ID:        sensorVirtualMachine.VMID(vm2ID),
-				Name:      vm2Name,
-				Namespace: ns1,
-				VSOCKCID:  &vm2VSockCID,
-				Running:   true,
-				GuestOS:   "Red Hat Enterprise Linux",
-			},
-			expected: &central.SensorEvent{
-				Id:     vm2ID,
-				Action: central.ResourceAction_REMOVE_RESOURCE,
-				Resource: &central.SensorEvent_VirtualMachine{
-					VirtualMachine: &virtualMachineV1.VirtualMachine{
-						Id:          vm2ID,
-						Namespace:   ns1,
-						Name:        vm2Name,
-						ClusterId:   fixtureconsts.Cluster2,
-						VsockCid:    wireVM2VSockCID,
-						VsockCidSet: true,
-						State:       virtualMachineV1.VirtualMachine_RUNNING,
-						Facts: map[string]string{
-							pkgVM.GuestOSKey: "Red Hat Enterprise Linux",
-						},
-					},
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(it *testing.T) {
-			event := createEvent(tt.action, tt.clusterID, tt.inputVM)
-			protoassert.Equal(it, tt.expected, event)
-		})
-	}
-}
-
-func getFactsForTest(_ *testing.T, guestOS string) map[string]string {
-	return map[string]string{
-		pkgVM.GuestOSKey: guestOS,
-	}
-}
diff --git a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances.go b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances.go
index 7bcbbb0f1a699..e1a9bccc1fa50 100644
--- a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances.go
+++ b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances.go
@@ -80,10 +80,16 @@ func (d *VirtualMachineInstanceDispatcher) ProcessEvent(
 		BootOrder:   extractBootOrder(disks),
 		CDRomDisks:  extractCDRomDisks(disks),
 	}
-	// If the instance is NOT handled by a VirtualMachine
-	// Process the instance as a VirtualMachine
+	// Ownerless VMIs are the authoritative instance: UpdateStateOrCreate writes
+	// Running so a later boot is visible to ListRunning.
 	if !handled {
-		return processVirtualMachine(vm, action, d.clusterID, d.store)
+		if action == central.ResourceAction_REMOVE_RESOURCE {
+			d.store.Remove(vm.ID)
+		} else {
+			d.store.UpdateStateOrCreate(vm)
+		}
+		attachStoredAgentFacts(d.store, vm)
+		return component.NewEvent(createEvent(action, d.clusterID, vm))
 	}
 
 	// This is an instance that is handled by a VirtualMachine
@@ -110,6 +116,8 @@ func (d *VirtualMachineInstanceDispatcher) ProcessEvent(
 		return nil
 	}
 
+	attachStoredAgentFacts(d.store, vm)
+
 	// Send an Update event for the VirtualMachine that handles this instance
 	return component.NewEvent(createEvent(central.ResourceAction_UPDATE_RESOURCE, d.clusterID, vm))
 }
diff --git a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances_test.go b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances_test.go
index d507df2c629b9..5359ce202e5e5 100644
--- a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances_test.go
+++ b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachineinstances_test.go
@@ -13,6 +13,7 @@ import (
 	vmInfo "github.com/stackrox/rox/sensor/common/virtualmachine"
 	"github.com/stackrox/rox/sensor/kubernetes/eventpipeline/component"
 	"github.com/stackrox/rox/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/mocks"
+	vmstore "github.com/stackrox/rox/sensor/kubernetes/listener/resources/virtualmachine/store"
 	"github.com/stretchr/testify/suite"
 	"go.uber.org/mock/gomock"
 	"google.golang.org/protobuf/proto"
@@ -104,6 +105,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 							Running:   false,
 						}),
 					).Times(1),
+					s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1).Return(nil),
 				)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
@@ -136,6 +138,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 							Running:   false,
 						}),
 					).Times(1),
+					s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1).Return(nil),
 				)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
@@ -160,6 +163,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 				gomock.InOrder(
 					s.store.EXPECT().Has(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1).Return(true),
 					s.store.EXPECT().ClearState(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1),
+					s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1).Return(nil),
 				)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
@@ -177,6 +181,45 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 				},
 			}),
 		},
+		"remove event keeps stored agent facts": {
+			action: central.ResourceAction_REMOVE_RESOURCE,
+			obj:    toUnstructured(newVirtualMachineInstance(vmiUID, vmiName, vmiNamespace, ownerUID, nil, v1.Scheduled)),
+			expectFn: func() {
+				gomock.InOrder(
+					s.store.EXPECT().Has(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1).Return(true),
+					s.store.EXPECT().ClearState(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1),
+					s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1).Return(&vmInfo.Info{
+						ID: ownerUID,
+						AgentFacts: map[string]string{
+							pkgVM.DetectedGuestOSKey:   "Red Hat Enterprise Linux 9.8",
+							pkgVM.ActivationStatusKey:  pkgVM.ActivationStatusActive,
+							pkgVM.DNFMetadataStatusKey: pkgVM.DNFMetadataStatusAvailable,
+							pkgVM.AgentVersionKey:      "development",
+						},
+					}),
+				)
+			},
+			expectedMsg: component.NewEvent(&central.SensorEvent{
+				Id:     ownerUID,
+				Action: central.ResourceAction_UPDATE_RESOURCE,
+				Resource: &central.SensorEvent_VirtualMachine{
+					VirtualMachine: &virtualMachineV1.VirtualMachine{
+						Id:        ownerUID,
+						Name:      vmiName,
+						Namespace: vmiNamespace,
+						ClusterId: clusterID,
+						State:     virtualMachineV1.VirtualMachine_STOPPED,
+						Facts: map[string]string{
+							pkgVM.GuestOSKey:           pkgVM.UnknownGuestOS,
+							pkgVM.DetectedGuestOSKey:   "Red Hat Enterprise Linux 9.8",
+							pkgVM.ActivationStatusKey:  pkgVM.ActivationStatusActive,
+							pkgVM.DNFMetadataStatusKey: pkgVM.DNFMetadataStatusAvailable,
+							pkgVM.AgentVersionKey:      "development",
+						},
+					},
+				},
+			}),
+		},
 		"no unstructured object": {
 			action:      central.ResourceAction_REMOVE_RESOURCE,
 			obj:         newVirtualMachineInstance(vmiUID, vmiName, vmiNamespace, ownerUID, nil, v1.Scheduled),
@@ -193,7 +236,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 			action: central.ResourceAction_CREATE_RESOURCE,
 			obj:    toUnstructured(newVirtualMachineInstanceWithOwnerKind(vmiUID, vmiName, vmiNamespace, ownerUID, "Not-VirtualMachine", nil, v1.Scheduled)),
 			expectFn: func() {
-				s.store.EXPECT().AddOrUpdate(gomock.Eq(
+				s.store.EXPECT().UpdateStateOrCreate(gomock.Eq(
 					&vmInfo.Info{
 						ID:        vmiUID,
 						Name:      vmiName,
@@ -201,14 +244,8 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 						VSOCKCID:  nil,
 						Running:   false,
 					}),
-				).Times(1).Return(
-					&vmInfo.Info{
-						ID:        vmiUID,
-						Name:      vmiName,
-						Namespace: vmiNamespace,
-						VSOCKCID:  nil,
-						Running:   false,
-					})
+				).Times(1)
+				s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(vmiUID))).Times(1).Return(nil)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
 				Id:     vmiUID,
@@ -229,7 +266,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 			action: central.ResourceAction_UPDATE_RESOURCE,
 			obj:    toUnstructured(newVirtualMachineInstanceWithOwnerKind(vmiUID, vmiName, vmiNamespace, ownerUID, "Not-VirtualMachine", nil, v1.Scheduled)),
 			expectFn: func() {
-				s.store.EXPECT().AddOrUpdate(gomock.Eq(
+				s.store.EXPECT().UpdateStateOrCreate(gomock.Eq(
 					&vmInfo.Info{
 						ID:        vmiUID,
 						Name:      vmiName,
@@ -237,14 +274,8 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 						VSOCKCID:  nil,
 						Running:   false,
 					}),
-				).Times(1).Return(
-					&vmInfo.Info{
-						ID:        vmiUID,
-						Name:      vmiName,
-						Namespace: vmiNamespace,
-						VSOCKCID:  nil,
-						Running:   false,
-					})
+				).Times(1)
+				s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(vmiUID))).Times(1).Return(nil)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
 				Id:     vmiUID,
@@ -266,6 +297,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 			obj:    toUnstructured(newVirtualMachineInstanceWithOwnerKind(vmiUID, vmiName, vmiNamespace, ownerUID, "Not-VirtualMachine", nil, v1.Scheduled)),
 			expectFn: func() {
 				s.store.EXPECT().Remove(gomock.Eq(vmInfo.VMID(vmiUID))).Times(1)
+				s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(vmiUID))).Times(1).Return(nil)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
 				Id:     vmiUID,
@@ -286,7 +318,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 			action: central.ResourceAction_SYNC_RESOURCE,
 			obj:    toUnstructured(newVirtualMachineInstanceWithOwnerKind(vmiUID, vmiName, vmiNamespace, ownerUID, "Not-VirtualMachine", nil, v1.Scheduled)),
 			expectFn: func() {
-				s.store.EXPECT().AddOrUpdate(gomock.Eq(
+				s.store.EXPECT().UpdateStateOrCreate(gomock.Eq(
 					&vmInfo.Info{
 						ID:        vmiUID,
 						Name:      vmiName,
@@ -294,14 +326,8 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 						VSOCKCID:  nil,
 						Running:   false,
 					}),
-				).Times(1).Return(
-					&vmInfo.Info{
-						ID:        vmiUID,
-						Name:      vmiName,
-						Namespace: vmiNamespace,
-						VSOCKCID:  nil,
-						Running:   false,
-					})
+				).Times(1)
+				s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(vmiUID))).Times(1).Return(nil)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
 				Id:     vmiUID,
@@ -352,6 +378,7 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 							Running:   true,
 						}),
 					).Times(1),
+					s.store.EXPECT().Get(gomock.Eq(vmInfo.VMID(ownerUID))).Times(1).Return(nil),
 				)
 			},
 			expectedMsg: component.NewEvent(&central.SensorEvent{
@@ -409,6 +436,54 @@ func (s *virtualMachineInstanceSuite) Test_VirtualMachineInstanceEvents() {
 	}
 }
 
+// Test_OwnerlessVMIScheduledThenRunningIsScrapable covers an ownerless VMI first
+// seen before Running: later Running must reach the store and ListRunning.
+func (s *virtualMachineInstanceSuite) Test_OwnerlessVMIScheduledThenRunningIsScrapable() {
+	cases := map[string]struct {
+		buildVMI func(phase v1.VirtualMachineInstancePhase) *v1.VirtualMachineInstance
+	}{
+		"should mark ownerless VMI running after Scheduled then Running": {
+			buildVMI: func(phase v1.VirtualMachineInstancePhase) *v1.VirtualMachineInstance {
+				vmi := newVirtualMachineInstanceWithOwnerKind(vmiUID, vmiName, vmiNamespace, "", "", nil, phase)
+				vmi.OwnerReferences = nil
+				return vmi
+			},
+		},
+		"should mark ReplicaSet-owned VMI running after Scheduled then Running": {
+			buildVMI: func(phase v1.VirtualMachineInstancePhase) *v1.VirtualMachineInstance {
+				return newVirtualMachineInstanceWithOwnerKind(vmiUID, vmiName, vmiNamespace, ownerUID, "VirtualMachineInstanceReplicaSet", nil, phase)
+			},
+		},
+	}
+	for name, tc := range cases {
+		s.Run(name, func() {
+			realStore := vmstore.NewVirtualMachineStore()
+			d := NewVirtualMachineInstanceDispatcher(clusterID, realStore)
+
+			scheduled := d.ProcessEvent(toUnstructured(tc.buildVMI(v1.Scheduled)), nil, central.ResourceAction_CREATE_RESOURCE)
+			s.Require().NotNil(scheduled)
+			stored := realStore.Get(vmInfo.VMID(vmiUID))
+			s.Require().NotNil(stored)
+			s.False(stored.Running)
+			s.Empty(realStore.ListRunning())
+
+			running := d.ProcessEvent(toUnstructured(tc.buildVMI(v1.Running)), nil, central.ResourceAction_UPDATE_RESOURCE)
+			s.Require().NotNil(running)
+			s.Require().Len(running.ForwardMessages, 1)
+			vmEvent := running.ForwardMessages[0].GetVirtualMachine()
+			s.Require().NotNil(vmEvent)
+			s.Equal(virtualMachineV1.VirtualMachine_RUNNING, vmEvent.GetState())
+
+			stored = realStore.Get(vmInfo.VMID(vmiUID))
+			s.Require().NotNil(stored)
+			s.True(stored.Running)
+			runningList := realStore.ListRunning()
+			s.Require().Len(runningList, 1)
+			s.Equal(vmInfo.VMID(vmiUID), runningList[0].ID)
+		})
+	}
+}
+
 func newVirtualMachineInstanceWithOwnerKind(uid, name, namespace, owner, kind string, vsock *uint32, phase v1.VirtualMachineInstancePhase) *v1.VirtualMachineInstance {
 	return &v1.VirtualMachineInstance{
 		ObjectMeta: metav1.ObjectMeta{
diff --git a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachines_test.go b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachines_test.go
index a39a4862562c7..cf7b63c18124b 100644
--- a/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachines_test.go
+++ b/sensor/kubernetes/listener/resources/virtualmachine/dispatcher/virtualmachines_test.go
@@ -317,3 +317,9 @@ func newVirtualMachine(uid, name, namespace string, status v1.VirtualMachinePrin
 		},
 	}
 }
+
+func getFactsForTest(_ *testing.T, guestOS string) map[string]string {
+	return map[string]string{
+		pkgVM.GuestOSKey: guestOS,
+	}
+}
diff --git a/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store.go b/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store.go
index 4a376b116d252..29a5384f12277 100644
--- a/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store.go
+++ b/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store.go
@@ -1,6 +1,8 @@
 package store
 
 import (
+	"maps"
+
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/set"
 	"github.com/stackrox/rox/pkg/sync"
@@ -15,8 +17,6 @@ var (
 type VirtualMachineStore struct {
 	lock sync.RWMutex
 
-	cidToID         map[uint32]virtualmachine.VMID
-	idToCID         map[virtualmachine.VMID]uint32
 	namespaceToID   map[string]set.Set[virtualmachine.VMID]
 	virtualMachines map[virtualmachine.VMID]*virtualmachine.Info
 }
@@ -26,8 +26,6 @@ func NewVirtualMachineStore() *VirtualMachineStore {
 	return &VirtualMachineStore{
 		virtualMachines: make(map[virtualmachine.VMID]*virtualmachine.Info),
 		namespaceToID:   make(map[string]set.Set[virtualmachine.VMID]),
-		cidToID:         make(map[uint32]virtualmachine.VMID),
-		idToCID:         make(map[virtualmachine.VMID]uint32),
 	}
 }
 
@@ -49,11 +47,26 @@ func (s *VirtualMachineStore) AddOrUpdate(vm *virtualmachine.Info) *virtualmachi
 		vm.IPAddresses = copyStringSlice(oldVM.IPAddresses)
 		vm.ActivePods = copyStringSlice(oldVM.ActivePods)
 		vm.NodeName = oldVM.NodeName
+		if vm.AgentFacts == nil {
+			vm.AgentFacts = oldVM.AgentFacts
+		}
 	}
 	s.addOrUpdateNoLock(vm)
 	return vm
 }
 
+// SetAgentFacts replaces scrape-owned facts on an existing VM. A missing ID
+// is ignored so persist cannot recreate a VM the informer already removed.
+func (s *VirtualMachineStore) SetAgentFacts(id virtualmachine.VMID, facts map[string]string) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	vm, ok := s.virtualMachines[id]
+	if !ok {
+		return
+	}
+	vm.AgentFacts = maps.Clone(facts)
+}
+
 // UpdateStateOrCreate updates the VirtualMachine state
 // If the VirtualMachine is not present we create a new VirtualMachine
 func (s *VirtualMachineStore) UpdateStateOrCreate(vm *virtualmachine.Info) {
@@ -82,8 +95,6 @@ func (s *VirtualMachineStore) Cleanup() {
 	defer s.lock.Unlock()
 	clear(s.virtualMachines)
 	clear(s.namespaceToID)
-	clear(s.cidToID)
-	clear(s.idToCID)
 }
 
 // OnNamespaceDeleted removes the VirtualMachines in the given namespace.
@@ -131,26 +142,13 @@ func (s *VirtualMachineStore) ListRunning() []*virtualmachine.Info {
 	return out
 }
 
-// GetFromCID returns the VirtualMachineInfo associated with a given VSOCK CID
-func (s *VirtualMachineStore) GetFromCID(cid uint32) *virtualmachine.Info {
-	s.lock.RLock()
-	defer s.lock.RUnlock()
-	uid, ok := s.cidToID[cid]
-	if !ok {
-		return nil
-	}
-	return s.virtualMachines[uid].Copy()
-}
-
 func (s *VirtualMachineStore) addOrUpdateNoLock(vm *virtualmachine.Info) {
-	// Replace VSOCK info
-	// If the new VirtualMachineInfo (vm) does not have a VSOCK,
-	// then we use the previous value
 	vm.VSOCKCID = s.replaceVSOCKInfoNoLock(vm)
 
 	// Upsert the VirtualMachineInfo
 	vmIDsByNamespace := s.getOrCreateNamespaceSet(vm.Namespace)
 	vmIDsByNamespace.Add(vm.ID)
+	vm.AgentFacts = maps.Clone(vm.AgentFacts)
 	s.virtualMachines[vm.ID] = vm
 }
 
@@ -171,10 +169,7 @@ func (s *VirtualMachineStore) updateStatusOrCreateNoLock(updateInfo *virtualmach
 		s.addOrUpdateNoLock(updateInfo)
 		return
 	}
-	// Remove previous VSOCK info
-	s.removeVSOCKInfoNoLock(prev.ID, prev.VSOCKCID)
-	// Update new VSOCK maps
-	prev.VSOCKCID = s.addOrUpdateVSOCKInfoNoLock(updateInfo.ID, updateInfo.VSOCKCID)
+	prev.VSOCKCID = copyVSOCKCID(updateInfo.VSOCKCID)
 	prev.Running = updateInfo.Running
 	prev.GuestOS = updateInfo.GuestOS
 	prev.IPAddresses = copyStringSlice(updateInfo.IPAddresses)
@@ -183,46 +178,27 @@ func (s *VirtualMachineStore) updateStatusOrCreateNoLock(updateInfo *virtualmach
 	prev.Description = updateInfo.Description
 	prev.BootOrder = copyStringSlice(updateInfo.BootOrder)
 	prev.CDRomDisks = copyStringSlice(updateInfo.CDRomDisks)
-}
-
-func (s *VirtualMachineStore) addOrUpdateVSOCKInfoNoLock(id virtualmachine.VMID, vsockCID *uint32) *uint32 {
-	if vsockCID == nil {
-		return nil
+	if updateInfo.AgentFacts != nil {
+		prev.AgentFacts = maps.Clone(updateInfo.AgentFacts)
 	}
-	s.idToCID[id] = *vsockCID
-	s.cidToID[*vsockCID] = id
-	// copy value before return
-	val := *vsockCID
-	return &val
 }
 
-func (s *VirtualMachineStore) removeVSOCKInfoNoLock(id virtualmachine.VMID, vsockCID *uint32) {
-	if vsockCID == nil {
-		return
+// copyVSOCKCID returns a new pointer so later changes to the caller's value
+// cannot change what the store holds.
+func copyVSOCKCID(cid *uint32) *uint32 {
+	if cid == nil {
+		return nil
 	}
-	delete(s.idToCID, id)
-	delete(s.cidToID, *vsockCID)
+	return new(*cid)
 }
 
 func (s *VirtualMachineStore) replaceVSOCKInfoNoLock(vm *virtualmachine.Info) *uint32 {
-	// Remove previous VSOCK info
-	// This is needed in case the VSOCK value updates
-	prev, found := s.virtualMachines[vm.ID]
-	if found {
-		s.removeVSOCKInfoNoLock(vm.ID, prev.VSOCKCID)
-	}
-	// Update VSOCKCID info
+	prev := s.virtualMachines[vm.ID]
+	// A VM update may omit CID; keep the last known value.
 	if vm.VSOCKCID == nil && prev != nil {
 		vm.VSOCKCID = prev.VSOCKCID
 	}
-	// Upsert VSOCKCID info
-	// CRITICAL: addOrUpdateVSOCKInfoNoLock always returns a heap-allocated copy so the store owns
-	// its own pointer. Reusing vm.VSOCKCID would let the caller mutate the same pointer later.
-	// Added regression test: Test_replaceVSOCKInfoNoLockCopiesIncomingPointer.
-	if vm.VSOCKCID != nil {
-		return s.addOrUpdateVSOCKInfoNoLock(vm.ID, vm.VSOCKCID)
-	}
-	return vm.VSOCKCID
+	return copyVSOCKCID(vm.VSOCKCID)
 }
 
 func (s *VirtualMachineStore) removeNoLock(id virtualmachine.VMID) {
@@ -231,7 +207,6 @@ func (s *VirtualMachineStore) removeNoLock(id virtualmachine.VMID) {
 		return
 	}
 	delete(s.virtualMachines, vm.ID)
-	s.removeVSOCKInfoNoLock(vm.ID, vm.VSOCKCID)
 	vmIDsByNamespace, found := s.namespaceToID[vm.Namespace]
 	if !found {
 		log.Errorf("namespace %q was not found", vm.Namespace)
@@ -248,7 +223,6 @@ func (s *VirtualMachineStore) clearStatusNoLock(id virtualmachine.VMID) {
 	if !ok {
 		return
 	}
-	s.removeVSOCKInfoNoLock(vm.ID, vm.VSOCKCID)
 	vm.VSOCKCID = nil
 	// If the instance is removed the VirtualMachine will transition to Stopped
 	vm.Running = false
diff --git a/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store_test.go b/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store_test.go
index 712678ad268eb..c984cb820dd47 100644
--- a/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store_test.go
+++ b/sensor/kubernetes/listener/resources/virtualmachine/store/virtual_machine_store_test.go
@@ -3,6 +3,7 @@ package store
 import (
 	"testing"
 
+	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
 	"github.com/stackrox/rox/sensor/common/virtualmachine"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
@@ -285,13 +286,6 @@ func (s *storeSuite) Test_UpdateVirtualMachine() {
 			nsIOs, ok := s.store.namespaceToID[tCase.new.Namespace]
 			s.Assert().True(ok)
 			s.Assert().Len(nsIOs, 1)
-			if tCase.new.VSOCKCID == nil {
-				s.Assert().Len(s.store.cidToID, 0)
-				s.Assert().Len(s.store.idToCID, 0)
-			} else {
-				s.Assert().Len(s.store.cidToID, 1)
-				s.Assert().Len(s.store.idToCID, 1)
-			}
 		})
 	}
 }
@@ -451,9 +445,6 @@ func (s *storeSuite) Test_replaceVSOCKInfoNoLockCopiesIncomingPointer() {
 
 	vsock = 456
 	s.Equal(uint32(123), *storePtr, "store-managed pointer should remain unchanged even if informer pointer is mutated")
-
-	s.Equal(uint32(123), s.store.idToCID[vmID], "idToCID map should track the original value")
-	s.Equal(virtualmachine.VMID(vmID), s.store.cidToID[123], "cidToID map should continue to refer back to the VM")
 }
 
 func (s *storeSuite) Test_UpdateStateOrCreate() {
@@ -726,6 +717,56 @@ func (s *storeSuite) Test_UpdateStateOrCreateShouldRefreshRuntimeFields() {
 	}
 }
 
+func (s *storeSuite) Test_RuntimeUpdatesShouldPreserveAgentFacts() {
+	agentFacts := map[string]string{
+		pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive,
+	}
+
+	s.Run("AddOrUpdate preserves when nil", func() {
+		s.store.AddOrUpdate(&virtualmachine.Info{
+			ID: vmID, Name: vmName, Namespace: vmNamespace, AgentFacts: agentFacts,
+		})
+		s.store.AddOrUpdate(&virtualmachine.Info{
+			ID: vmID, Name: vmName, Namespace: vmNamespace, Description: "updated",
+		})
+		assert.Equal(s.T(), agentFacts, s.store.Get(vmID).AgentFacts)
+	})
+
+	s.Run("UpdateStateOrCreate preserves when nil", func() {
+		s.store = NewVirtualMachineStore()
+		s.store.AddOrUpdate(&virtualmachine.Info{
+			ID: vmID, Name: vmName, Namespace: vmNamespace, AgentFacts: agentFacts,
+		})
+		s.store.UpdateStateOrCreate(&virtualmachine.Info{
+			ID: vmID, Name: vmName, Namespace: vmNamespace, Running: true, VSOCKCID: new(uint32(1)),
+		})
+		assert.Equal(s.T(), agentFacts, s.store.Get(vmID).AgentFacts)
+	})
+}
+
+func (s *storeSuite) Test_SetAgentFacts() {
+	s.Run("replaces facts on an existing VM", func() {
+		s.store.AddOrUpdate(&virtualmachine.Info{
+			ID:          vmID,
+			Name:        vmName,
+			Namespace:   vmNamespace,
+			GuestOS:     "from-informer",
+			Description: "kept",
+		})
+		facts := map[string]string{pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive}
+		s.store.SetAgentFacts(vmID, facts)
+		got := s.store.Get(vmID)
+		assert.Equal(s.T(), facts, got.AgentFacts)
+		assert.Equal(s.T(), "from-informer", got.GuestOS)
+		assert.Equal(s.T(), "kept", got.Description)
+	})
+
+	s.Run("ignores a missing VM", func() {
+		s.store.SetAgentFacts(vmID, map[string]string{pkgVM.ActivationStatusKey: pkgVM.ActivationStatusActive})
+		assert.Nil(s.T(), s.store.Get(vmID))
+	})
+}
+
 func (s *storeSuite) Test_RemoveVirtualMachine() {
 	vsockCID1 := new(uint32(1))
 	cases := map[string]struct {
@@ -1118,73 +1159,11 @@ func (s *storeSuite) Test_HasVirtualMachine() {
 	})
 }
 
-func (s *storeSuite) Test_GetVirtualMachineFromCID() {
-	cases := map[string]struct {
-		vm         *virtualmachine.Info
-		cid        uint32
-		expectedVM *virtualmachine.Info
-	}{
-		"should find a valid CID": {
-			vm: &virtualmachine.Info{
-				ID:        vmID,
-				Name:      vmName,
-				Namespace: vmNamespace,
-				VSOCKCID:  new(uint32(1)),
-				Running:   true,
-			},
-			cid: 1,
-			expectedVM: &virtualmachine.Info{
-				ID:        vmID,
-				Name:      vmName,
-				Namespace: vmNamespace,
-				VSOCKCID:  new(uint32(1)),
-				Running:   true,
-			},
-		},
-		"should return nil an invalid CID": {
-			vm: &virtualmachine.Info{
-				ID:        vmID,
-				Name:      vmName,
-				Namespace: vmNamespace,
-				VSOCKCID:  new(uint32(1)),
-				Running:   true,
-			},
-			cid:        2, // Invalid CID
-			expectedVM: nil,
-		},
-		"should return nil if the VM does not have a Vsock CID yet": {
-			vm: &virtualmachine.Info{
-				ID:        vmID,
-				Name:      vmName,
-				Namespace: vmNamespace,
-				VSOCKCID:  nil,
-				Running:   true,
-			},
-			cid:        1, // VM does not have a cid
-			expectedVM: nil,
-		},
-	}
-	for tName, tCase := range cases {
-		s.Run(tName, func() {
-			s.store.AddOrUpdate(tCase.vm)
-			s.assertVM(tCase.vm)
-			actual := s.store.GetFromCID(tCase.cid)
-			if tCase.expectedVM == nil {
-				s.Assert().Nil(actual)
-			} else {
-				assertVMs(s.T(), tCase.expectedVM, actual)
-			}
-		})
-	}
-}
-
 func (s *storeSuite) assertEmpty() {
 	s.store.lock.Lock()
 	defer s.store.lock.Unlock()
 	s.Assert().Len(s.store.virtualMachines, 0)
 	s.Assert().Len(s.store.namespaceToID, 0)
-	s.Assert().Len(s.store.cidToID, 0)
-	s.Assert().Len(s.store.idToCID, 0)
 }
 
 func (s *storeSuite) assertVM(expected *virtualmachine.Info) {
@@ -1201,15 +1180,6 @@ func (s *storeSuite) assertVM(expected *virtualmachine.Info) {
 	nsIDs, ok := s.store.namespaceToID[expected.Namespace]
 	s.Assert().True(ok)
 	s.Assert().Contains(nsIDs, expected.ID)
-	if expected.VSOCKCID == nil {
-		return
-	}
-	cid, ok := s.store.idToCID[expected.ID]
-	s.Assert().True(ok)
-	s.Assert().Equal(*expected.VSOCKCID, cid)
-	id, ok := s.store.cidToID[*expected.VSOCKCID]
-	s.Assert().True(ok)
-	s.Assert().Equal(expected.ID, id)
 }
 
 func assertVMs(t *testing.T, expected *virtualmachine.Info, actual *virtualmachine.Info) {
diff --git a/sensor/kubernetes/main.go b/sensor/kubernetes/main.go
index 142b808d58637..142b84cfc3f96 100644
--- a/sensor/kubernetes/main.go
+++ b/sensor/kubernetes/main.go
@@ -127,6 +127,9 @@ func main() {
 		select {
 		case sig := <-sigs:
 			log.Infof("Caught %s signal", sig)
+			if workloadManager != nil {
+				workloadManager.Stop()
+			}
 			s.Stop()
 			gcp.Singleton().Stop()
 		case <-s.Stopped().Done():
diff --git a/sensor/kubernetes/sensor/pubsub.go b/sensor/kubernetes/sensor/pubsub.go
index 4d05a2f1735ee..a8c3400b6544a 100644
--- a/sensor/kubernetes/sensor/pubsub.go
+++ b/sensor/kubernetes/sensor/pubsub.go
@@ -49,6 +49,7 @@ func buildPubSubDispatcher(eventPipelineQueueSize int) (common.PubSubDispatcher,
 			lane.NewBlockingLane(pubsub.DetectorDeployAlertOutputLane),
 			lane.NewBlockingLane(pubsub.SoftRestartLane),
 			lane.NewBlockingLane(pubsub.ResourceSyncFinishedLane),
+			lane.NewBlockingLane(pubsub.FakeFileActivityLane),
 		},
 	))
 	if err != nil {
diff --git a/sensor/kubernetes/sensor/sensor.go b/sensor/kubernetes/sensor/sensor.go
index 6ff0c17db3025..375e6da32f837 100644
--- a/sensor/kubernetes/sensor/sensor.go
+++ b/sensor/kubernetes/sensor/sensor.go
@@ -44,10 +44,10 @@ import (
 	"github.com/stackrox/rox/sensor/common/processsignal"
 	"github.com/stackrox/rox/sensor/common/reprocessor"
 	"github.com/stackrox/rox/sensor/common/scan"
+	"github.com/stackrox/rox/sensor/common/scannerdefinitions"
 	"github.com/stackrox/rox/sensor/common/sensor"
 	signalService "github.com/stackrox/rox/sensor/common/signal"
 	"github.com/stackrox/rox/sensor/common/store"
-	vmIndex "github.com/stackrox/rox/sensor/common/virtualmachine/index"
 	"github.com/stackrox/rox/sensor/common/virtualmachine/vmscraper"
 	"github.com/stackrox/rox/sensor/common/virtualmachine/vsockclient"
 	"github.com/stackrox/rox/sensor/kubernetes/certrefresh"
@@ -57,6 +57,7 @@ import (
 	"github.com/stackrox/rox/sensor/kubernetes/complianceoperator"
 	"github.com/stackrox/rox/sensor/kubernetes/enforcer"
 	"github.com/stackrox/rox/sensor/kubernetes/eventpipeline"
+	"github.com/stackrox/rox/sensor/kubernetes/fake/vmagent"
 	"github.com/stackrox/rox/sensor/kubernetes/helm"
 	"github.com/stackrox/rox/sensor/kubernetes/listener/resources"
 	"github.com/stackrox/rox/sensor/kubernetes/networkpolicies"
@@ -178,6 +179,43 @@ func CreateSensor(cfg *CreateOptions) (*sensor.Sensor, error) {
 	networkFlowManager :=
 		manager.NewManager(storeProvider.Entities(), externalsrcs.StoreInstance(), policyDetector, pubSub, internalMessageDispatcher, updatecomputer.New(), manager.WithEnrichTicker(cfg.networkFlowTicker))
 	enhancer := deploymentenhancer.CreateEnhancer(storeProvider)
+
+	var vmScraper *vmscraper.VMScraper
+	var vmStats clustermetrics.VMStatsSource
+	var repo2CPE *scannerdefinitions.Repo2CPE
+	if features.VirtualMachines.Enabled() {
+		pullMaxBytes := int64(env.VirtualMachinesPullMaxResponseSizeKB.IntegerSetting()) * 1024
+		var dialer vmscraper.VMDialer
+		var vmProtoClient vmscraper.ProtocolClient
+		if cfg.workloadManager != nil && cfg.workloadManager.HasFakeVMWorkload() {
+			numPackages := cfg.workloadManager.FakeVMNumPackages()
+			reportsEnabled := cfg.workloadManager.HasFakeVMIndexReports()
+			dialer = vmagent.NewDialer()
+			vmProtoClient = vmagent.NewClient(numPackages, reportsEnabled)
+			log.Infof("VMScraper using in-process fake agent (reports=%t packages=%d)", reportsEnabled, numPackages)
+		} else {
+			d, err := vsockdialer.NewMultiDialer()
+			if err != nil {
+				log.Errorf("VSOCK pull mode disabled: failed to construct dialer: %v", err)
+			} else {
+				dialer = d
+			}
+			vmProtoClient = vsockclient.NewClient([]string{vsockclient.CapabilityReportV1}, int(pullMaxBytes))
+		}
+		repo2CPE, err = scannerdefinitions.NewRepo2CPE(env.CentralEndpoint.Setting(), cfg.certLoader())
+		if err != nil {
+			log.Errorf("Failed to create repo-to-CPE refresher: %v", err)
+		}
+		// A typed-nil *Repo2CPE is a non-nil Repo2CPEFetcher, so
+		// maybeSyncRepoCPEMapping would call FetchRepo2CPE on a nil receiver.
+		var repo2CPEFetcher vmscraper.Repo2CPEFetcher
+		if repo2CPE != nil {
+			repo2CPEFetcher = repo2CPE
+		}
+		vmScraper = vmscraper.New(storeProvider.VirtualMachines(), dialer, vmProtoClient, repo2CPEFetcher, clusterID)
+		vmStats = vmScraper
+	}
+
 	components := []common.SensorComponent{
 		admCtrlMsgForwarder,
 		enforcer,
@@ -185,7 +223,7 @@ func CreateSensor(cfg *CreateOptions) (*sensor.Sensor, error) {
 		networkpolicies.NewCommandHandler(cfg.k8sClient.Kubernetes()),
 		clusterstatus.NewUpdater(cfg.k8sClient),
 		clusterhealth.NewUpdater(cfg.k8sClient.Kubernetes(), 0),
-		clustermetrics.New(clusterID, cfg.k8sClient.Kubernetes()),
+		clustermetrics.New(clusterID, cfg.k8sClient.Kubernetes(), vmStats),
 		complianceCommandHandler,
 		processSignals,
 		telemetry.NewCommandHandler(cfg.k8sClient.Kubernetes(), storeProvider),
@@ -198,21 +236,11 @@ func CreateSensor(cfg *CreateOptions) (*sensor.Sensor, error) {
 		enhancer,
 		complianceService,
 	}
-
-	var virtualMachineHandler vmIndex.Handler
-	if features.VirtualMachines.Enabled() {
-		virtualMachineHandler = vmIndex.NewHandler(storeProvider.VirtualMachines())
-		components = append(components, virtualMachineHandler)
-
-		if kvConfig := cfg.k8sClient.RESTConfig(); kvConfig != nil {
-			pullMaxBytes := int64(env.VirtualMachinesPullMaxResponseSizeKB.IntegerSetting()) * 1024
-			vmDial := vsockdialer.NewMultiDialer(kvConfig, pullMaxBytes)
-			vmProtoClient := vsockclient.NewClient([]string{vsockclient.CapabilityReportV1}, int(pullMaxBytes))
-			scraper := vmscraper.New(storeProvider.VirtualMachines(), virtualMachineHandler, vmDial, vmProtoClient)
-			components = append(components, scraper)
-		} else {
-			log.Warn("VSOCK pull mode disabled (no REST config available)")
-		}
+	if repo2CPE != nil {
+		components = append(components, repo2CPE)
+	}
+	if vmScraper != nil {
+		components = append(components, vmScraper)
 	}
 
 	matcher := compliance.NewNodeIDMatcher(storeProvider.Nodes())
@@ -280,13 +308,8 @@ func CreateSensor(cfg *CreateOptions) (*sensor.Sensor, error) {
 	}
 
 	if cfg.workloadManager != nil {
+		cfg.workloadManager.SetPubSubDispatcher(internalMessageDispatcher)
 		cfg.workloadManager.SetSignalHandlers(processPipeline, networkFlowManager)
-		if features.VirtualMachines.Enabled() && virtualMachineHandler != nil {
-			cfg.workloadManager.SetVMIndexReportHandler(virtualMachineHandler)
-			cfg.workloadManager.SetVMStore(storeProvider.VirtualMachines())
-			// Register WorkloadManager as a Notifiable so it receives SensorComponentEvent notifications
-			s.AddNotifiable(cfg.workloadManager)
-		}
 	}
 
 	var networkFlowService service.Service
diff --git a/sensor/kubernetes/virtualmachine/vsockdialer/dialer.go b/sensor/kubernetes/virtualmachine/vsockdialer/dialer.go
index 1842b2e42dce9..13db8a99b8a2b 100644
--- a/sensor/kubernetes/virtualmachine/vsockdialer/dialer.go
+++ b/sensor/kubernetes/virtualmachine/vsockdialer/dialer.go
@@ -1,14 +1,7 @@
 // Package vsockdialer dials KubeVirt VM VSOCK ports via the Kubernetes API.
 //
-// This replaces kubevirt.io/client-go's AsyncSubresourceHelper with a
-// self-contained websocket dialer built on k8s.io/client-go/transport/websocket
-// (the same building block client-go itself uses for `kubectl exec`/
-// `port-forward` over WebSocket) plus gorilla/websocket for the connection
-// type. We cannot import kubevirt.io/client-go directly yet — kubevirt#16951
-// is no longer a blocker, but kubevirt#18382 and kubevirt#18408 still are.
-// See https://github.com/stackrox/stackrox/pull/21587 for tracking; re-evaluate
-// once both land in a tagged release. Do not switch to a personal fork for
-// production use.
+// It uses kubevirt client-go's AsyncSubresourceHelper so Sensor can keep a
+// small Dial(namespace, name, port) surface for the pull-mode scraper.
 package vsockdialer
 
 import (
@@ -16,166 +9,120 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
+	"net"
 	"net/url"
 	"strconv"
 
 	"github.com/gorilla/websocket"
+	"github.com/stackrox/rox/pkg/k8sutil"
 	"k8s.io/client-go/rest"
-	wstransport "k8s.io/client-go/transport/websocket"
-)
-
-const (
-	subresourceAPIGroup = "subresources.kubevirt.io"
-	apiVersion          = "v1"
-	wsSubprotocol       = "plain.kubevirt.io"
+	kvcorev1 "kubevirt.io/client-go/kubevirt/typed/core/v1"
 )
 
 // MultiDialer dials VMs across namespaces via the KubeVirt subresource API.
 type MultiDialer struct {
-	config      *rest.Config
-	wsReadLimit int64
+	config *rest.Config
+}
+
+// NewMultiDialer creates a dialer from in-cluster Kubernetes config.
+func NewMultiDialer() (*MultiDialer, error) {
+	config, err := k8sutil.GetK8sInClusterConfig()
+	if err != nil {
+		return nil, fmt.Errorf("loading in-cluster config: %w", err)
+	}
+	return NewMultiDialerFromConfig(config), nil
 }
 
-// NewMultiDialer creates a dialer from in-cluster (or kubeconfig) REST config.
-// wsReadLimit sets the maximum WebSocket message size in bytes.
-func NewMultiDialer(config *rest.Config, wsReadLimit int64) *MultiDialer {
-	return &MultiDialer{config: config, wsReadLimit: wsReadLimit}
+// NewMultiDialerFromConfig builds a dialer from an existing REST config so
+// tests and local runs can skip in-cluster service-account lookup.
+func NewMultiDialerFromConfig(config *rest.Config) *MultiDialer {
+	return &MultiDialer{config: config}
 }
 
 // Dial connects to the named VMI's VSOCK port in the given namespace.
-// The context controls dial timeout and, if it carries a deadline, that
-// deadline is propagated to the connection's read/write deadlines so the
-// per-VM timeout budget covers dial + request + response.
-//
-// Deadline propagation alone does not abort an in-flight read when the
-// parent context is cancelled without a nearer deadline (e.g. Sensor
-// shutdown). GetReport closes the stream on ctx cancel for that case.
+// ctx's deadline is applied to the established connection only: the
+// WebSocket handshake does not take ctx, so it cannot be cancelled.
 func (d *MultiDialer) Dial(ctx context.Context, namespace, name string, port uint32, useTLS bool) (io.ReadWriteCloser, error) {
 	params := url.Values{}
 	params.Set("port", strconv.FormatUint(uint64(port), 10))
 	params.Set("tls", strconv.FormatBool(useTLS))
-
-	wsURL, err := buildWSURL(d.config, "virtualmachineinstances", namespace, name, "vsock", params)
+	stream, err := kvcorev1.AsyncSubresourceHelper(
+		d.config, "virtualmachineinstances", namespace, name, "vsock", params,
+	)
 	if err != nil {
 		return nil, fmt.Errorf("VSOCK dial %s/%s:%d: %w", namespace, name, port, err)
 	}
-
-	conn, err := dialSubresource(ctx, d.config, wsURL)
-	if err != nil {
-		return nil, fmt.Errorf("VSOCK dial %s/%s:%d: %w", namespace, name, port, err)
-	}
-	conn.SetReadLimit(d.wsReadLimit)
+	conn := stream.AsConn()
 	if deadline, ok := ctx.Deadline(); ok {
-		_ = conn.SetReadDeadline(deadline)
-		_ = conn.SetWriteDeadline(deadline)
+		_ = conn.SetDeadline(deadline)
 	}
-	return &wsStream{conn: conn}, nil
+	return &closeCodeConn{Conn: conn}, nil
 }
 
-// dialSubresource negotiates a WebSocket connection to wsURL using
-// k8s.io/client-go/transport/websocket. That package builds the
-// RoundTripper straight from the REST config — TLS, proxying, and auth
-// (bearer token, client certs, impersonation, exec/OIDC credential
-// plugins) — the same way a real apiserver request would, so we don't
-// have to reimplement auth-header extraction here.
-//
-// Trade-off: the negotiated connection's I/O buffers are fixed at ~33KiB by
-// client-go's RoundTripper, smaller than a hand-rolled dialer could use.
-// This only affects how many read/write syscalls a large message takes —
-// messages are chunked across frames regardless of buffer size — so it
-// doesn't affect correctness.
-func dialSubresource(ctx context.Context, config *rest.Config, wsURL string) (*websocket.Conn, error) {
-	rt, holder, err := wstransport.RoundTripperFor(config)
-	if err != nil {
-		return nil, fmt.Errorf("building websocket round tripper: %w", err)
-	}
+// closeCodeConn remaps kubevirt AsConn() close errors into closedError so
+// callers can recover the websocket close code via errors.As against their
+// own CloseCode() interface, without importing this package.
+type closeCodeConn struct {
+	net.Conn
+}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, wsURL, nil)
-	if err != nil {
-		return nil, fmt.Errorf("building request: %w", err)
+func (c *closeCodeConn) Read(p []byte) (int, error) {
+	n, err := c.Conn.Read(p)
+	if closeErr := transportClosedErr(err); closeErr != nil {
+		return n, closeErr
 	}
+	return n, err //nolint:wrapcheck // implements io.Reader
+}
 
-	conn, err := wstransport.Negotiate(rt, holder, req, wsSubprotocol)
-	if err != nil {
-		return nil, fmt.Errorf("websocket dial: %w", err)
+func (c *closeCodeConn) Write(p []byte) (int, error) {
+	n, err := c.Conn.Write(p)
+	if closeErr := transportClosedErr(err); closeErr != nil {
+		return n, closeErr
 	}
-	return conn, nil
+	return n, err //nolint:wrapcheck // implements io.Writer
 }
 
-func buildWSURL(config *rest.Config, resource, namespace, name, subresource string, queryParams url.Values) (string, error) {
-	u, err := url.Parse(config.Host)
-	if err != nil {
-		return "", fmt.Errorf("parsing host: %w", err)
+// transportClosedErr returns a *closedError if err represents a closed
+// connection, or nil if it's some other read failure.
+func transportClosedErr(err error) *closedError {
+	if err == nil {
+		return nil
 	}
-
-	// Keep http/https: client-go's websocket RoundTripper rewrites to ws/wss
-	// itself and rejects a pre-rewritten wss/ws scheme with "unknown url scheme".
-	switch u.Scheme {
-	case "https", "http":
-	default:
-		return "", fmt.Errorf("unsupported scheme %q", u.Scheme)
+	if ce, ok := errors.AsType[*websocket.CloseError](err); ok {
+		return &closedError{code: ce.Code, reason: ce.Text}
 	}
-
-	u = u.JoinPath("apis", subresourceAPIGroup, apiVersion, "namespaces", namespace, resource, name, subresource)
-	if len(queryParams) > 0 {
-		u.RawQuery = queryParams.Encode()
+	if errors.Is(err, io.EOF) {
+		return &closedError{}
 	}
-	return u.String(), nil
+	return nil
 }
 
-// wsStream adapts a websocket.Conn into an io.ReadWriteCloser that reads
-// across websocket binary message boundaries and writes binary messages.
-type wsStream struct {
-	conn   *websocket.Conn
-	reader io.Reader
+// closedError indicates the websocket connection closed before a complete
+// VMServiceResponse could be read. Kept unexported and dependency-free so
+// callers recover it structurally (via errors.As against their own
+// CloseCode() interface) rather than importing this package.
+type closedError struct {
+	code   int
+	reason string
 }
 
-func (s *wsStream) Read(p []byte) (int, error) {
-	for {
-		if s.reader == nil {
-			msgType, rd, err := s.conn.NextReader()
-			if err != nil {
-				if isWSClose(err) {
-					return 0, io.EOF
-				}
-				return 0, err //nolint:wrapcheck // implements io.Reader
-			}
-			if msgType == websocket.CloseMessage {
-				return 0, io.EOF
-			}
-			s.reader = rd
-		}
-
-		n, err := s.reader.Read(p)
-		if err == io.EOF {
-			s.reader = nil
-			if n > 0 {
-				return n, nil
-			}
-			continue
-		}
-		return n, err //nolint:wrapcheck // implements io.Reader
+func (e *closedError) Error() string {
+	if e.code == 0 {
+		return "websocket connection closed"
 	}
+	return fmt.Sprintf("websocket connection closed (code %d): %s", e.code, e.reason)
 }
 
-func (s *wsStream) Write(p []byte) (int, error) {
-	if err := s.conn.WriteMessage(websocket.BinaryMessage, p); err != nil {
-		return 0, fmt.Errorf("writing websocket message: %w", err)
+// Is reports whether this close is an io.EOF-equivalent (no code, or a
+// normal 1000 close). Abnormal codes such as 1006 are not EOF.
+func (e *closedError) Is(target error) bool {
+	if target != io.EOF {
+		return false
 	}
-	return len(p), nil
+	return e.code == 0 || e.code == websocket.CloseNormalClosure
 }
 
-func (s *wsStream) Close() error {
-	if err := s.conn.Close(); err != nil {
-		return fmt.Errorf("closing websocket: %w", err)
-	}
-	return nil
-}
-
-func isWSClose(err error) bool {
-	if _, ok := errors.AsType[*websocket.CloseError](err); ok {
-		return true
-	}
-	return errors.Is(err, io.EOF)
+// CloseCode returns the close code and reason; code is 0 if unstructured.
+func (e *closedError) CloseCode() (code int, reason string) {
+	return e.code, e.reason
 }
diff --git a/sensor/kubernetes/virtualmachine/vsockdialer/dialer_test.go b/sensor/kubernetes/virtualmachine/vsockdialer/dialer_test.go
index ef2f5f60f9765..1a68da0c9a93e 100644
--- a/sensor/kubernetes/virtualmachine/vsockdialer/dialer_test.go
+++ b/sensor/kubernetes/virtualmachine/vsockdialer/dialer_test.go
@@ -1,50 +1,57 @@
 package vsockdialer
 
 import (
-	"net/url"
+	"errors"
+	"fmt"
+	"io"
 	"testing"
 
+	"github.com/gorilla/websocket"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"k8s.io/client-go/rest"
 )
 
-func TestBuildWSURL(t *testing.T) {
-	params := url.Values{}
-	params.Set("port", "1024")
-	params.Set("tls", "true")
-
+func TestTransportClosedErr(t *testing.T) {
 	cases := map[string]struct {
-		host    string
-		wantURL string
-		wantErr string // substring to match against the error; empty means no error expected
+		err      error
+		wantNil  bool
+		wantCode int
+		wantEOF  bool
 	}{
-		"should keep https for client-go websocket RoundTripper": {
-			host:    "https://api.example.com:6443",
-			wantURL: "https://api.example.com:6443/apis/subresources.kubevirt.io/v1/namespaces/ns1/virtualmachineinstances/vm-a/vsock?port=1024&tls=true",
+		"should return nil for a non-close error": {
+			err:     errors.New("boom"),
+			wantNil: true,
 		},
-		"should keep http for client-go websocket RoundTripper": {
-			host:    "http://localhost:8080",
-			wantURL: "http://localhost:8080/apis/subresources.kubevirt.io/v1/namespaces/ns1/virtualmachineinstances/vm-a/vsock?port=1024&tls=true",
+		"should classify a plain io.EOF with no structured code": {
+			err:      io.EOF,
+			wantCode: 0,
+			wantEOF:  true,
 		},
-		"should reject unsupported scheme": {
-			host:    "ftp://api.example.com",
-			wantErr: "unsupported scheme",
+		"should preserve the close code from a websocket.CloseError": {
+			err:      &websocket.CloseError{Code: websocket.CloseAbnormalClosure, Text: "abnormal closure"},
+			wantCode: websocket.CloseAbnormalClosure,
 		},
-		"should reject unparseable host": {
-			host:    "https://api.example.com:abc",
-			wantErr: "parsing host",
+		"should treat a normal closure as io.EOF": {
+			err:      fmt.Errorf("read: %w", &websocket.CloseError{Code: websocket.CloseNormalClosure, Text: "bye"}),
+			wantCode: websocket.CloseNormalClosure,
+			wantEOF:  true,
 		},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			got, err := buildWSURL(&rest.Config{Host: tc.host}, "virtualmachineinstances", "ns1", "vm-a", "vsock", params)
-			if tc.wantErr != "" {
-				require.ErrorContains(t, err, tc.wantErr)
+			got := transportClosedErr(tc.err)
+			if tc.wantNil {
+				assert.Nil(t, got)
+				return
+			}
+			require.NotNil(t, got)
+			code, _ := got.CloseCode()
+			assert.Equal(t, tc.wantCode, code)
+			if tc.wantEOF {
+				assert.ErrorIs(t, got, io.EOF)
 				return
 			}
-			require.NoError(t, err)
-			assert.Equal(t, tc.wantURL, got)
+			assert.NotErrorIs(t, got, io.EOF)
 		})
 	}
 }
diff --git a/sensor/tests/resource/service/service_test.go b/sensor/tests/resource/service/service_test.go
index 44ab97af680c7..67b025f99bc4e 100644
--- a/sensor/tests/resource/service/service_test.go
+++ b/sensor/tests/resource/service/service_test.go
@@ -209,9 +209,11 @@ func (s *DeploymentExposureSuite) Test_NodePortPermutation() {
 		setDynamicFieldsInSlice(c.orderedResources, c.portConfig, serviceNodePortFmt, getPort(s.T()), c.selector, setNodePort, setPortConfigNode)
 		s.testContext.RunTest(s.T(), helper.WithResources(c.orderedResources), helper.WithTestCase(func(t *testing.T, testC *helper.TestContext, _ map[string]k8s.Object) {
 			// Test context already takes care of creating and destroying resources
-			testC.LastDeploymentState(t, nginxDeploymentName,
-				assertLastDeploymentHasPortExposure(c.portConfig), "'PortConfig' for Node Port service test not found")
-			testC.LastViolationState(t, nginxDeploymentName,
+			testC.LastDeploymentStateWithTimeout(t, nginxDeploymentName,
+				assertLastDeploymentHasPortExposure(c.portConfig),
+				"'PortConfig' for Node Port service test not found",
+				10*time.Second)
+			testC.LastViolationStateWithTimeout(t, nginxDeploymentName,
 				assertAlertTriggered(
 					&storage.Alert{
 						Policy: &storage.Policy{
@@ -220,7 +222,8 @@ func (s *DeploymentExposureSuite) Test_NodePortPermutation() {
 						State: storage.ViolationState_ACTIVE,
 					},
 				),
-				fmt.Sprintf("Alert '%s' should be triggered", servicePolicyName))
+				fmt.Sprintf("Alert '%s' should be triggered", servicePolicyName),
+				10*time.Second)
 			testC.GetFakeCentral().ClearReceivedBuffer()
 		}), helper.WithRetryCallback(func(err error, obj k8s.Object) error {
 			// Only checking services
diff --git a/sensor/upgrader/common/bundle_resources_completeness_test.go b/sensor/upgrader/common/bundle_resources_completeness_test.go
index 91061a51bcdfe..065bc075d33d6 100644
--- a/sensor/upgrader/common/bundle_resources_completeness_test.go
+++ b/sensor/upgrader/common/bundle_resources_completeness_test.go
@@ -46,18 +46,15 @@ func TestBundleResourcesComplete(t *testing.T) {
 			MainVersion:      "3.0.49.0",
 			CollectorVersion: "1.2.3",
 		},
-		MainRegistry:           "stackrox.io", // TODO: custom?
-		ImageRemote:            "main",
-		ImageTag:               "3.0.49.0",
-		CollectorRegistry:      "collector.stackrox.io",
-		CollectorImageRemote:   "collector",
-		CollectorImageTag:      "1.2.3",
-		FactRegistry:           "fact.stackrox.io",
-		FactImageRemote:        "fact",
-		FactImageTag:           "0.1.0",
-		ScannerImageRemote:     "scanner",
-		ScannerSlimImageRemote: "scanner",
-		ScannerImageTag:        "1.2.3",
+		MainRegistry:         "stackrox.io", // TODO: custom?
+		ImageRemote:          "main",
+		ImageTag:             "3.0.49.0",
+		CollectorRegistry:    "collector.stackrox.io",
+		CollectorImageRemote: "collector",
+		CollectorImageTag:    "1.2.3",
+		FactRegistry:         "fact.stackrox.io",
+		FactImageRemote:      "fact",
+		FactImageTag:         "0.1.0",
 		ChartRepo: defaults.ChartRepo{
 			URL:     "http://mirror.openshift.com/pub/rhacs/charts",
 			IconURL: "https://raw.githubusercontent.com/stackrox/stackrox/master/image/templates/helm/shared/assets/Red_Hat-Hat_icon.png",
diff --git a/status.sh b/status.sh
index 86abea6859457..5aed6d6bad31a 100755
--- a/status.sh
+++ b/status.sh
@@ -4,6 +4,5 @@
 echo "STABLE_MAIN_VERSION $(make --quiet --no-print-directory tag)"
 echo "STABLE_COLLECTOR_VERSION $(make --quiet --no-print-directory collector-tag)"
 echo "STABLE_FACT_VERSION $(make --quiet --no-print-directory fact-tag)"
-echo "STABLE_SCANNER_VERSION $(make --quiet --no-print-directory scanner-tag)"
 echo "STABLE_SCANNER_V4_VULNERABILITY_VERSION $(cat scanner/VULNERABILITY_VERSION)"
 echo "STABLE_GIT_SHORT_SHA $(make --quiet --no-print-directory shortcommit)"
diff --git a/tests/api_test.go b/tests/api_test.go
index e5312dbb20e8c..21db9b41c6d94 100644
--- a/tests/api_test.go
+++ b/tests/api_test.go
@@ -14,7 +14,7 @@ import (
 
 func TestPing(t *testing.T) {
 
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
 	conn := centralgrpc.GRPCConnectionToCentral(t)
diff --git a/tests/byodb/lib.sh b/tests/byodb/lib.sh
index 55fe4e0d82f90..38ebe7f5e7ed9 100644
--- a/tests/byodb/lib.sh
+++ b/tests/byodb/lib.sh
@@ -19,7 +19,8 @@ deploy_external_postgres() {
     kubectl create namespace database
     envsubst < ./tests/byodb/simple-postgres.yaml | kubectl apply -f -
 
-    kubectl wait --for=condition=Ready pod -l app=postgres -n database --timeout=180s
+    # The StatefulSet exists, but its pod may not have been created yet.
+    kubectl rollout status statefulset/postgres -n database --timeout=180s
 }
 
 preamble() {
diff --git a/tests/cli_download_test.go b/tests/cli_download_test.go
new file mode 100644
index 0000000000000..5f9510c9d73ff
--- /dev/null
+++ b/tests/cli_download_test.go
@@ -0,0 +1,153 @@
+//go:build test_e2e
+
+package tests
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stackrox/rox/pkg/testutils/centralgrpc"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fetchIsReleaseBuild calls /v1/metadata and returns whether Central was built as a release build.
+func fetchIsReleaseBuild(t *testing.T) bool {
+	t.Helper()
+	client := centralgrpc.HTTPClientForCentral(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "/v1/metadata", nil)
+	require.NoError(t, err)
+
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, resp.Body.Close()) })
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	var metadata struct {
+		ReleaseBuild bool `json:"release_build"`
+	}
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&metadata))
+	return metadata.ReleaseBuild
+}
+
+func TestCLIDownload(t *testing.T) {
+	t.Run("all platform binaries are downloadable", func(t *testing.T) {
+		type binaryCase struct {
+			filename string
+			magic    []byte
+		}
+
+		const (
+			// Magic byte sequences that identify each platform's binary format.
+			linuxMagic   = "\x7fELF"
+			darwinMagic  = "\xcf\xfa\xed\xfe"
+			windowsMagic = "MZ"
+
+			// stubPrefix is the known prefix of CI stub files created by
+			// .github/workflows/build.yaml in "Create CLI stub files" step
+			// for non-native-arch binaries in non-release builds.
+			stubPrefix = "This is a placeholder"
+
+			// headerBytes must cover the longest magic sequence (4 bytes) and the stub prefix (21 bytes).
+			headerBytes = max(len(linuxMagic), len(darwinMagic), len(windowsMagic), len(stubPrefix))
+		)
+
+		testCases := []binaryCase{
+			{"roxctl-linux-amd64", []byte(linuxMagic)},
+			{"roxctl-linux-arm64", []byte(linuxMagic)},
+			{"roxctl-linux-ppc64le", []byte(linuxMagic)},
+			{"roxctl-linux-s390x", []byte(linuxMagic)},
+			{"roxctl-darwin-amd64", []byte(darwinMagic)},
+			{"roxctl-darwin-arm64", []byte(darwinMagic)},
+			{"roxctl-windows-amd64.exe", []byte(windowsMagic)},
+		}
+
+		releaseBuild := fetchIsReleaseBuild(t)
+
+		for _, tc := range testCases {
+			t.Run(tc.filename, func(t *testing.T) {
+				client := centralgrpc.HTTPClientForCentral(t)
+				client.Timeout = 2 * time.Minute
+
+				ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+				defer cancel()
+
+				req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+					"/api/cli/download/"+tc.filename, nil)
+				require.NoError(t, err)
+
+				resp, err := client.Do(req)
+				require.NoError(t, err)
+				t.Cleanup(func() { assert.NoError(t, resp.Body.Close()) })
+
+				require.Equal(t, http.StatusOK, resp.StatusCode)
+
+				header := make([]byte, headerBytes)
+				_, err = io.ReadFull(resp.Body, header)
+				require.NoError(t, err)
+
+				hasMagic := bytes.Equal(header[:len(tc.magic)], tc.magic)
+
+				if releaseBuild || tc.filename == "roxctl-linux-amd64" {
+					// Release build contains real binaries for all platforms.
+					// In PR CI builds, linux-amd64 is the native runner arch and thus always real.
+					assert.True(t, hasMagic, "%s: expected binary magic bytes %x, got: %q",
+						tc.filename, tc.magic, header)
+				} else if !hasMagic {
+					// Non-release builds may serve CI stub files for non-native arches.
+					// Anything other than real binary or known stub is unexpected.
+					assert.True(t, strings.HasPrefix(string(header), stubPrefix),
+						"%s: expected binary magic bytes or CI stub content, got: %q", tc.filename, header)
+				}
+
+				_, err = io.Copy(io.Discard, resp.Body)
+				require.NoError(t, err)
+			})
+		}
+	})
+
+	t.Run("nonexistent binary returns 404", func(t *testing.T) {
+		client := centralgrpc.HTTPClientForCentral(t)
+
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+			"/api/cli/download/roxctl-nonexistent", nil)
+		require.NoError(t, err)
+
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		t.Cleanup(func() { assert.NoError(t, resp.Body.Close()) })
+
+		assert.Equal(t, http.StatusNotFound, resp.StatusCode)
+	})
+
+	t.Run("unauthenticated returns 401", func(t *testing.T) {
+		unauthClient := centralgrpc.UnauthenticatedHTTPClientForCentral(t)
+		unauthClient.Timeout = 30 * time.Second
+
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+			"/api/cli/download/roxctl-linux-amd64", nil)
+		require.NoError(t, err)
+
+		resp, err := unauthClient.Do(req)
+		require.NoError(t, err)
+		t.Cleanup(func() { assert.NoError(t, resp.Body.Close()) })
+
+		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+	})
+}
diff --git a/tests/cluster_delete_test.go b/tests/cluster_delete_test.go
index 10ea65ad63a29..149e04acce00c 100644
--- a/tests/cluster_delete_test.go
+++ b/tests/cluster_delete_test.go
@@ -32,6 +32,14 @@ func (a *allCounts) AllZero() bool {
 	return allIntsZero(a.PodCount, a.ClusterCount, a.NodeCount, a.DeploymentCount, a.SecretCount)
 }
 
+func (a *allCounts) Less(other *allCounts) bool {
+	return a.PodCount < other.PodCount ||
+		a.ClusterCount < other.ClusterCount ||
+		a.NodeCount < other.NodeCount ||
+		a.DeploymentCount < other.DeploymentCount ||
+		a.SecretCount < other.SecretCount
+}
+
 type summaryCountsResp struct {
 	ClusterCount, NodeCount, ViolationCount, DeploymentCount, SecretCount int
 }
@@ -105,7 +113,7 @@ func TestClusterDeletion(t *testing.T) {
 			t.Logf("deployment count is still not zero: %d", counts.DeploymentCount)
 		}
 
-		if previous.DeploymentCount > 0 && previous.DeploymentCount > counts.DeploymentCount {
+		if counts.Less(&previous) {
 			noChangeCount = 0
 		} else {
 			noChangeCount++
diff --git a/tests/common.go b/tests/common.go
index fe774a13c956f..945cc36266b0e 100644
--- a/tests/common.go
+++ b/tests/common.go
@@ -836,30 +836,44 @@ func deleteNamespace(t *testing.T, name string) {
 
 // execInDeployment executes a command in a pod from the given deployment.
 // Assumes deployment pods have label app=<deploymentName> (set by privilegedDeploymentSpec).
+//
+// The pod is re-resolved and `kubectl exec` is retried within a bounded window
+// to tolerate transient exec failures (e.g. "error: EOF" from a dropped exec
+// stream) shortly after the deployment has been rolled/restarted (see
+// ROX-36497).
 func execInDeployment(t *testing.T, client kubernetes.Interface, deploymentName, namespace string, command ...string) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
 	defer cancel()
 
-	podList, err := client.CoreV1().Pods(namespace).List(ctx, metaV1.ListOptions{
-		LabelSelector: fmt.Sprintf("app=%s", deploymentName),
-	})
-	require.NoError(t, err, "listing pods for deployment %q", deploymentName)
-	require.NotEmpty(t, podList.Items, "no pods found for deployment %q", deploymentName)
+	var lastPod string
+	mustEventually(t, ctx, func() error {
+		podList, err := client.CoreV1().Pods(namespace).List(ctx, metaV1.ListOptions{
+			LabelSelector: fmt.Sprintf("app=%s", deploymentName),
+		})
+		if err != nil {
+			return fmt.Errorf("listing pods for deployment %q: %w", deploymentName, err)
+		}
+		if len(podList.Items) == 0 {
+			return fmt.Errorf("no pods found for deployment %q", deploymentName)
+		}
 
-	podName := podList.Items[0].Name
+		podName := podList.Items[0].Name
+		lastPod = podName
 
-	args := make([]string, 0, 5+len(command))
-	args = append(args, "exec", "-n", namespace, podName, "--")
-	args = append(args, command...)
+		args := make([]string, 0, 5+len(command))
+		args = append(args, "exec", "-n", namespace, podName, "--")
+		args = append(args, command...)
 
-	cmd := exec.CommandContext(ctx, "kubectl", args...)
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Logf("kubectl exec output: %s", string(output))
-	}
-	require.NoError(t, err, "executing command %v in pod %q", command, podName)
+		execCtx, execCancel := context.WithTimeout(ctx, 30*time.Second)
+		defer execCancel()
+		output, err := exec.CommandContext(execCtx, "kubectl", args...).CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("executing command %v in pod %q: %w: %s", command, podName, err, string(output))
+		}
+		return nil
+	}, 10*time.Second, "kubectl exec failed, retrying")
 
-	t.Logf("Executed command %v in pod %q (deployment %q)", command, podName, deploymentName)
+	t.Logf("Executed command %v in pod %q (deployment %q)", command, lastPod, deploymentName)
 }
 
 func waitForCondition(t testutils.T, condition func() bool, desc string, timeout time.Duration, frequency time.Duration) {
@@ -1096,7 +1110,12 @@ func mustEventually(t *testing.T, ctx context.Context, f func() error, pauseInte
 		retry.Tries(math.MaxInt),
 		retry.WithContext(ctx),
 		retry.BetweenAttempts(func(_ int) {
-			time.Sleep(pauseInterval)
+			timer := time.NewTimer(pauseInterval)
+			defer timer.Stop()
+			select {
+			case <-timer.C:
+			case <-ctx.Done():
+			}
 		}),
 		retry.OnFailedAttempts(func(err error) { logf(t, failureMsgPrefix+": %s", err) })))
 }
@@ -1424,6 +1443,11 @@ func isOpenshift() bool {
 	return os.Getenv("ORCHESTRATOR_FLAVOR") == "openshift"
 }
 
+// usingKonfluxImages returns true when StackRox was deployed from Konflux-built images.
+func usingKonfluxImages() bool {
+	return os.Getenv("USE_KONFLUX_IMAGES") == "true"
+}
+
 // mustGetCluster returns the details of the one and only known secured cluster.
 func mustGetCluster(t *testing.T, ctx context.Context) *storage.Cluster {
 	conn := centralgrpc.GRPCConnectionToCentral(t)
diff --git a/tests/complianceoperator/create.sh b/tests/complianceoperator/create.sh
index 4a7491d827d7c..969273e109817 100755
--- a/tests/complianceoperator/create.sh
+++ b/tests/complianceoperator/create.sh
@@ -15,5 +15,22 @@ if ! kubectl get crd compliancecheckresults.compliance.openshift.io; then
     while IFS='' read -r single_crd; do all_crds+=("$single_crd"); done < <(grep -rh '^  name:.*\.compliance\.openshift\.io' "${DIR}/crds/" | awk '{print "crd/" $2}')
     kubectl wait --for condition=established --timeout=60s "${all_crds[@]}"
 
+    # `kubectl wait --for condition=established` can fail immediately
+    # (not time out) when a just-applied CRD has not had its
+    # .status.conditions populated by the API server yet.
+    established=false
+    for _ in $(seq 1 5); do
+        if kubectl wait --for condition=established --timeout=60s "${all_crds[@]}"; then
+            established=true
+            break
+        fi
+        echo "kubectl wait for established compliance CRDs failed (status may not be populated yet); retrying in 5s..."
+        sleep 5
+    done
+    if [ "${established}" != "true" ]; then
+        echo "ERROR: compliance CRDs did not become established in time" >&2
+        exit 1
+    fi
+
     kubectl apply -R -f "${DIR}/resources"
 fi
diff --git a/tests/delegated_scanning_test.go b/tests/delegated_scanning_test.go
index 8e014122ff79d..8b932e00991e2 100644
--- a/tests/delegated_scanning_test.go
+++ b/tests/delegated_scanning_test.go
@@ -124,8 +124,8 @@ var (
 		// delegation, the scan attempt should be retried.
 		//
 		// ex:
-		// - no connection to "a21b168a-280e-40d1-a175-e84d14ed8232"
-		"no connection to",
+		// - no connection to cluster "remote", verify the cluster is healthy and connected
+		"no connection to cluster",
 
 		// A registry having gateway issues (Quay.io in particular) may return a 502 (Bad Gateway)
 		// or 504 (Gateway Timeout) along with some HTML, retry when this happens.
diff --git a/tests/e2e/bats/feature_flag_env.bats b/tests/e2e/bats/feature_flag_env.bats
new file mode 100644
index 0000000000000..39d9ef84ddb1a
--- /dev/null
+++ b/tests/e2e/bats/feature_flag_env.bats
@@ -0,0 +1,97 @@
+#!/usr/bin/env bats
+
+# bats tests/e2e/bats/feature_flag_env.bats
+
+# shellcheck disable=SC1091
+load "../../../scripts/test_helpers.bats"
+
+function setup() {
+    source "${BATS_TEST_DIRNAME}/../../../deploy/common/feature-flag-env.sh"
+}
+
+@test "feature_flag_env_assignments is empty when list.go is missing" {
+    run feature_flag_env_assignments "${BATS_TEST_TMPDIR}/does-not-exist.go"
+    assert_success
+    assert_output --partial "WARNING"
+    refute_line --regexp '^ROX_'
+}
+
+@test "feature_flag_env_assignments emits only set, non-empty feature flags" {
+    list_file="${BATS_TEST_TMPDIR}/list.go"
+    cat > "${list_file}" <<'EOF'
+	Foo = registerFeature("foo", "ROX_CISA_KEV")
+	Bar = registerFeature("bar", "ROX_VULN_MGMT_LEGACY_SNOOZE")
+	Baz = registerFeature("baz", "ROX_NETWORK_GRAPH_EXTERNAL_IPS")
+	// URL via the ROX_SCANNER_V4_MAVEN_SEARCH_URL environment variable.
+	Qux = registerFeature("qux", "ROX_SCANNER_V4_MAVEN_SEARCH")
+EOF
+    export ROX_CISA_KEV=true
+    export ROX_NETWORK_GRAPH_EXTERNAL_IPS=false
+    export ROX_SCANNER_V4_MAVEN_SEARCH_URL=http://example.invalid
+    unset ROX_VULN_MGMT_LEGACY_SNOOZE || true
+    export ROX_SCANNER_V4_MAVEN_SEARCH=""
+
+    run feature_flag_env_assignments "${list_file}"
+    assert_success
+    assert_line "ROX_CISA_KEV=true"
+    assert_line "ROX_NETWORK_GRAPH_EXTERNAL_IPS=false"
+    refute_line --partial "ROX_VULN_MGMT_LEGACY_SNOOZE"
+    refute_line --partial "ROX_SCANNER_V4_MAVEN_SEARCH_URL"
+    refute_line --partial "ROX_SCANNER_V4_MAVEN_SEARCH="
+}
+
+@test "feature_flag_env_assignments reads pkg/features/list.go" {
+    export ROX_CISA_KEV=true
+    run feature_flag_env_assignments "${BATS_TEST_DIRNAME}/../../../pkg/features/list.go"
+    assert_success
+    assert_line "ROX_CISA_KEV=true"
+}
+
+@test "is_helm_owned_feature_flag covers Central chart first-class scanner env" {
+    run is_helm_owned_feature_flag ROX_SCANNER_V4
+    assert_success
+    run is_helm_owned_feature_flag ROX_LEGACY_SCANNER
+    assert_success
+    run is_helm_owned_feature_flag ROX_CISA_KEV
+    assert_failure
+    run is_helm_owned_feature_flag ROX_VIRTUAL_MACHINES
+    assert_failure
+}
+
+@test "omit_helm_owned_feature_flags drops chart-owned names and keeps the rest" {
+    run omit_helm_owned_feature_flags <<'EOF'
+ROX_CISA_KEV=true
+ROX_SCANNER_V4=true
+ROX_LEGACY_SCANNER=false
+ROX_NETWORK_GRAPH_EXTERNAL_IPS=false
+EOF
+    assert_success
+    assert_line "ROX_CISA_KEV=true"
+    assert_line "ROX_NETWORK_GRAPH_EXTERNAL_IPS=false"
+    refute_line --partial "ROX_SCANNER_V4"
+    refute_line --partial "ROX_LEGACY_SCANNER"
+}
+
+@test "feature_flag_env_assignments still emits helm-owned flags for kubectl inject" {
+    list_file="${BATS_TEST_TMPDIR}/list.go"
+    cat > "${list_file}" <<'EOF'
+	ScannerV4 = registerFeature("scanner v4", "ROX_SCANNER_V4")
+	Legacy = registerFeature("legacy scanner", "ROX_LEGACY_SCANNER")
+	Foo = registerFeature("foo", "ROX_CISA_KEV")
+EOF
+    export ROX_SCANNER_V4=true
+    export ROX_LEGACY_SCANNER=false
+    export ROX_CISA_KEV=true
+
+    run feature_flag_env_assignments "${list_file}"
+    assert_success
+    assert_line "ROX_SCANNER_V4=true"
+    assert_line "ROX_LEGACY_SCANNER=false"
+    assert_line "ROX_CISA_KEV=true"
+
+    run omit_helm_owned_feature_flags < <(feature_flag_env_assignments "${list_file}")
+    assert_success
+    assert_line "ROX_CISA_KEV=true"
+    refute_line --partial "ROX_SCANNER_V4"
+    refute_line --partial "ROX_LEGACY_SCANNER"
+}
diff --git a/tests/e2e/bats/fixtures/check-restart-logs-output.txt b/tests/e2e/bats/fixtures/check-restart-logs-output.txt
index a9d54d0dbc2b3..8149952e93bdd 100644
--- a/tests/e2e/bats/fixtures/check-restart-logs-output.txt
+++ b/tests/e2e/bats/fixtures/check-restart-logs-output.txt
@@ -3,6 +3,6 @@ collector-11111-node-inventory-previous.log copied to Artifacts
 Example for DaemonSet container
 collector-22222-node-inventory-previous.log copied to Artifacts
 Example for deployment container
-scanner-v4-111111111-11111-matcher-previous.log copied to Artifacts
+scanner-v4-matcher-111111111-11111-matcher-previous.log copied to Artifacts
 Example for unknown pod
 unknown-pod-111111111-11111-container-previous.log copied to Artifacts
diff --git a/tests/e2e/bats/junit_report_pod_restarts.bats b/tests/e2e/bats/junit_report_pod_restarts.bats
index 26e38df35634e..1a0022e0b7643 100644
--- a/tests/e2e/bats/junit_report_pod_restarts.bats
+++ b/tests/e2e/bats/junit_report_pod_restarts.bats
@@ -2,6 +2,23 @@
 
 load "../../../scripts/test_helpers.bats"
 
+# Real previous-log names from collect-service-logs.sh: <pod>-<container>-previous.log.
+# Matcher/indexer pods are scanner-v4-matcher-* / scanner-v4-indexer-*, not scanner-v4-*.
+@test "POD_CONTAINERS_MAP matches scanner-v4-matcher and indexer previous logs" {
+    source "${BATS_TEST_DIRNAME}/../lib.sh"
+
+    local matcher_re indexer_re
+    matcher_re="${POD_CONTAINERS_MAP["pod: scanner-v4-matcher - container: matcher"]}"
+    indexer_re="${POD_CONTAINERS_MAP["pod: scanner-v4-indexer - container: indexer"]}"
+
+    [[ -n "${matcher_re}" ]]
+    [[ -n "${indexer_re}" ]]
+    [[ "scanner-v4-matcher-b49db6cbf-kg6p8-matcher-previous.log" =~ ${matcher_re} ]]
+    [[ "scanner-v4-indexer-65d57884b9-c8dt2-indexer-previous.log" =~ ${indexer_re} ]]
+    # Combined scanner-v4-<rs>-<hash> names must not match (those pods do not exist).
+    [[ ! "scanner-v4-111111111-11111-matcher-previous.log" =~ ${matcher_re} ]]
+}
+
 @test "junit_report_pod_restarts - clean" {
     source "${BATS_TEST_DIRNAME}/../lib.sh"
 
@@ -37,7 +54,7 @@ load "../../../scripts/test_helpers.bats"
     POD_CONTAINERS_MAP=()
 
     # Deployment failure
-    POD_CONTAINERS_MAP["pod: scanner-v4 - container: matcher"]="scanner-v4-[A-Za-z0-9]+-[A-Za-z0-9]+-matcher-previous.log"
+    POD_CONTAINERS_MAP["pod: scanner-v4-matcher - container: matcher"]="scanner-v4-matcher-[A-Za-z0-9]+-[A-Za-z0-9]+-matcher-previous.log"
     # DaemonSet failure (with two pods failed)
     POD_CONTAINERS_MAP["pod: collector - container: node-inventory"]="collector-[A-Za-z0-9]+-node-inventory-previous.log"
     # No failure
@@ -49,7 +66,7 @@ load "../../../scripts/test_helpers.bats"
     # 1 without failure and 3 failed (4 in output, but 1 de-duplicated)
     [ "${#lines[@]}" -eq 4 ]
     assert_line 'Success: Check unexpected pod restarts pod: sensor - container: sensor'
-    assert_line 'Fail: Check unexpected pod restarts pod: scanner-v4 - container: matcher'
+    assert_line 'Fail: Check unexpected pod restarts pod: scanner-v4-matcher - container: matcher'
     assert_line 'Fail: Check unexpected pod restarts pod: collector - container: node-inventory'
     assert_line 'Fail: Check unexpected pod restarts unknown'
 }
diff --git a/tests/e2e/lib-compat.sh b/tests/e2e/lib-compat.sh
index c7983564ed3f9..396d78b901c77 100644
--- a/tests/e2e/lib-compat.sh
+++ b/tests/e2e/lib-compat.sh
@@ -85,6 +85,9 @@ roxie_config_from_environment_compat() {
 
     handle_pod_security_policies
 
+    info "Configuring Konflux images..."
+    handle_konflux_images "$config_file"
+
     info "Configuring TRUSTED_CA_FILE..."
     handle_trusted_ca_file "$config_file"
 
@@ -94,6 +97,13 @@ roxie_config_from_environment_compat() {
     info "Configuring load balancer..."
     handle_load_balancer_setting "$config_file"
 
+    handle_endpoints_for_test "$config_file" # Echoes info internally.
+
+    if [[ -n "${EXTERNAL_DB:-}" ]]; then
+        info "Configuring external database..."
+        handle_external_database_settings "$config_file" "$namespace"
+    fi
+
     info "Configuring custom central environment..."
     while read -r var_val; do
         local name="${var_val%%=*}"
@@ -153,6 +163,10 @@ roxie_config_from_environment_compat() {
         env_with_default ROX_NETFLOW_BATCHING "true"       # pkg/env/sensor.go.
         env_with_default ROX_NETFLOW_CACHE_LIMITING "true" # pkg/env/sensor.go.
 
+        # Scan every 9-11 minutes in roxie-deployed QA tests, including GHA.
+        env_with_default ROX_NODE_SCANNING_INTERVAL "10m"
+        env_with_default ROX_NODE_SCANNING_INTERVAL_DEVIATION "60s"
+
         collect_feature_flags
     )
 
@@ -176,9 +190,18 @@ roxie_config_from_environment_compat() {
         fi
     )
 
+    info "Configuring storage classes..."
+    handle_storage_classes "$config_file"
+
     info "Configuring scanner V4..."
-    handle_scanner_v4_setting "$config_file" ".central.spec.scannerV4.scannerComponent"
-    handle_scanner_v4_setting "$config_file" ".securedCluster.spec.scannerV4.scannerComponent"
+    if [[ ${ROX_SCANNER_V4:-} == false ]]; then
+        handle_scanner_v4_setting "$config_file" ".central.spec.scannerV4.scannerComponent" "Disabled"
+        handle_scanner_v4_setting "$config_file" ".securedCluster.spec.scannerV4.scannerComponent" "Disabled"
+    else
+        handle_scanner_v4_setting "$config_file" ".central.spec.scannerV4.scannerComponent" "Enabled"
+        handle_scanner_v4_setting "$config_file" ".securedCluster.spec.scannerV4.scannerComponent" "AutoSense"
+        handle_scanner_v4_vuln_readiness "$config_file"
+    fi
 
     info "Configuring declarative configuration..."
     handle_declarative_configuration "$config_file"
@@ -190,6 +213,32 @@ roxie_config_from_environment_compat() {
     handle_virtual_machines_configuration "$config_file"
 }
 
+handle_external_database_settings() {
+    local config_file="$1"
+    local namespace="$2"
+
+    merge_yaml "$config_file" <<EOF
+central:
+  spec:
+    central:
+      db:
+        connectionString: "host=${EXTERNAL_DATABASE_HOST} client_encoding=UTF8 user=${EXTERNAL_DB_USER} dbname=${EXTERNAL_DATABASE_NAME} statement_timeout=1200000"
+        passwordSecret:
+          name: "central-external-db-password"
+EOF
+    retrying_kubectl -n "${namespace}" apply -f - <<EOF
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: central-external-db-password
+  labels:
+    app.kubernetes.io/managed-by: "${managed_by}"
+data:
+  password: $(echo -n "${EXTERNAL_DB_PASSWORD}" | base64 | tr -d '\n')
+EOF
+}
+
 # Emit feature flags, enabling injection into a roxie configuration, rendering them overwritable using
 # environment variables.
 collect_feature_flags() {
@@ -199,10 +248,16 @@ collect_feature_flags() {
     env_with_default ROX_NODE_VULNERABILITY_REPORTS "true"
     env_with_default ROX_TAILORED_PROFILES "true"
     env_with_default ROX_INIT_CONTAINER_SUPPORT "true"
+    env_with_default ROX_POLICY_WORKLOAD_KIND_EXCLUSION "true"
+    env_with_default ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL "true"
     env_with_default ROX_LABEL_BASED_POLICY_SCOPING "true"
-    env_with_default ROX_POLICY_CRITERIA_MODAL "true"
     env_with_default ROX_VULN_MGMT_LEGACY_SNOOZE "true"
     env_with_default ROX_NETWORK_GRAPH_AGGREGATE_EXT_IPS "true"
+    env_with_default ROX_COMPLIANCE_SURFACE_STALE_DATA "true"
+    env_with_default ROX_COMPLIANCE_CUSTOM_NODE_ROLES "true"
+    env_with_default ROX_UI_SECRETS_PAGE_MIGRATION "true"
+    env_with_default ROX_AI_INTEGRATIONS "true"
+    env_with_default ROX_LIGHTSPEED_RISK_SUMMARY "true"
 
     # Enabled by default in StackRox, but disabled by default for test deployments.
     env_with_default ROX_NETWORK_GRAPH_EXTERNAL_IPS "false"
@@ -212,6 +267,15 @@ collect_feature_flags() {
     env_with_default ROX_BASE_IMAGE_DETECTION
 }
 
+handle_konflux_images() {
+    local config_file="$1"
+
+    if [[ "${USE_KONFLUX_IMAGES:-false}" == "true" ]]; then
+        info "USE_KONFLUX_IMAGES=true: deploying with Konflux-built images"
+        patch_yaml "$config_file" ".roxie.konfluxImages = true"
+    fi
+}
+
 handle_pod_security_policies() {
     local pod_security_policies="${POD_SECURITY_POLICIES:-false}"
     if [[ "$pod_security_policies" == "true" ]]; then
@@ -221,14 +285,40 @@ handle_pod_security_policies() {
     ci_export POD_SECURITY_POLICIES "$POD_SECURITY_POLICIES"
 }
 
+handle_storage_classes() {
+    local config_file="$1"
+    local storage_class="${STORAGE_CLASS:-}"
+    local scanner_v4_db_storage_class="${SCANNER_V4_DB_STORAGE_CLASS:-}"
+
+    if [[ "$storage_class" == "faster" || "$scanner_v4_db_storage_class" == "faster" ]]; then
+        info "  applying SSD StorageClass manifest"
+        retrying_kubectl apply -f "${TEST_ROOT}/deploy/common/ssd-storageclass.yaml" </dev/null
+    fi
+
+    if [[ -n "$storage_class" ]]; then
+        info "  central DB storageClassName=${storage_class}"
+        patch_yaml "$config_file" ".central.spec.central.db.persistence.persistentVolumeClaim.storageClassName = \"${storage_class}\""
+    fi
+
+    if [[ -n "$scanner_v4_db_storage_class" ]]; then
+        info "  scanner V4 DB storageClassName=${scanner_v4_db_storage_class}"
+        patch_yaml "$config_file" ".central.spec.scannerV4.db.persistence.persistentVolumeClaim.storageClassName = \"${scanner_v4_db_storage_class}\""
+        patch_yaml "$config_file" ".securedCluster.spec.scannerV4.db.persistence.persistentVolumeClaim.storageClassName = \"${scanner_v4_db_storage_class}\""
+    fi
+}
+
+# handle_scanner_v4_setting patches scannerV4.scannerComponent. enabled_value is
+# the CRD enum when V4 is on: Central uses Enabled, SecuredCluster uses AutoSense.
 handle_scanner_v4_setting() {
     local config_file="$1"
     local path="$2"
-    local rox_scanner_v4="${ROX_SCANNER_V4:-false}" # To match the previous defaulting
+    local enabled_value="$3"
+    # Scanner V4 is the default scanner. Jobs that must omit it set ROX_SCANNER_V4=false.
+    local rox_scanner_v4="${ROX_SCANNER_V4:-true}"
 
     case "$rox_scanner_v4" in
         true)
-            patch_yaml "$config_file" "${path} = \"Enabled\""
+            patch_yaml "$config_file" "${path} = \"${enabled_value}\""
             ;;
         false)
             patch_yaml "$config_file" "${path} = \"Disabled\""
@@ -239,6 +329,36 @@ handle_scanner_v4_setting() {
     esac
 }
 
+# handle_scanner_v4_vuln_readiness gates the scanner-v4-matcher pod's readiness
+# probe on the vulnerability bundle being fully loaded. The matcher's default
+# readiness is "database" (ready as soon as Postgres is reachable), so without
+# this the deployment reports ready while vulns are still importing and tests
+# would scan before any vuln data exists. Setting
+# SCANNER_V4_MATCHER_READINESS=vulnerability keeps the matcher unready until the
+# initial load completes, so the deploy step waits for it. The env vars go into
+# the Central CR's customize.envVars, which the operator propagates to
+# scanner-v4-matcher.
+handle_scanner_v4_vuln_readiness() {
+    local config_file="$1"
+
+    # Only meaningful when Scanner V4 is enabled.
+    if [[ "${ROX_SCANNER_V4:-true}" == "false" ]]; then
+        return
+    fi
+
+    # export_test_environment establishes the default (true); jobs that don't
+    # need gating (e.g. install-only) set SCANNER_V4_VULN_READINESS=false.
+    if [[ "${SCANNER_V4_VULN_READINESS:-false}" == "true" ]]; then
+        info "  gating scanner-v4-matcher readiness on vulnerability load"
+        set_custom_env "$config_file" "central" "SCANNER_V4_MATCHER_READINESS" "vulnerability"
+    fi
+
+    if [[ -n "${SCANNER_V4_CI_VULN_BUNDLE_ALLOWLIST:-}" ]]; then
+        info "  restricting vuln bundle sources to ${SCANNER_V4_CI_VULN_BUNDLE_ALLOWLIST}"
+        set_custom_env "$config_file" "central" "SCANNER_V4_MATCHER_VULN_BUNDLE_ALLOWLIST" "${SCANNER_V4_CI_VULN_BUNDLE_ALLOWLIST}"
+    fi
+}
+
 handle_trusted_ca_file() {
     local config_file="$1"
     local trusted_ca_file="${TRUSTED_CA_FILE:-}"
@@ -310,6 +430,44 @@ handle_load_balancer_setting() {
     esac
 }
 
+# Populate a roxie config file with the endpoint settings required by endpoints_test.go:
+# plaintext endpoints (8080/8081) and the full central-endpoints ConfigMap (8082, 8444-8448).
+# Values are taken from the ROX_PLAINTEXT_ENDPOINTS and ROXDEPLOY_CONFIG_FILE_MAP env vars,
+# which are exported by test_preamble() of the jobs that run endpoints_test.go. Jobs that do
+# not set these are left untouched, so this is safe to call unconditionally from such a job.
+handle_endpoints_for_test() {
+    local config_file="$1"
+
+    # Expose plaintext endpoints required by endpoints_test.go.
+    if [[ -n "${ROX_PLAINTEXT_ENDPOINTS:-}" ]]; then
+        info "Configuring central ROX_PLAINTEXT_ENDPOINTS to ${ROX_PLAINTEXT_ENDPOINTS}..."
+        set_custom_env "$config_file" "central" "ROX_PLAINTEXT_ENDPOINTS" "${ROX_PLAINTEXT_ENDPOINTS}"
+    fi
+
+    # Inject the full endpoint config into the central-endpoints ConfigMap so that
+    # Central also listens on ports 8082 and 8444-8448 (used by endpoints_test.go).
+    if [[ -n "${ROXDEPLOY_CONFIG_FILE_MAP:-}" && -f "${ROXDEPLOY_CONFIG_FILE_MAP}" ]]; then
+        info "Configuring central-endpoints ConfigMap from ${ROXDEPLOY_CONFIG_FILE_MAP}..."
+        local overlay_tmp; overlay_tmp="$(mktemp)"
+        # \. in the path escapes the dot so the operator treats "endpoints.yaml" as a
+        # single ConfigMap key rather than a path separator. verbatim preserves newlines.
+        cat > "$overlay_tmp" <<'OVERLAY'
+central:
+  spec:
+    overlays:
+    - apiVersion: v1
+      kind: ConfigMap
+      name: central-endpoints
+      patches:
+      - path: data.endpoints\.yaml
+        verbatim: |
+OVERLAY
+        sed 's/^/          /' "${ROXDEPLOY_CONFIG_FILE_MAP}" >> "$overlay_tmp"
+        merge_yaml "$config_file" < "$overlay_tmp"
+        rm -f "$overlay_tmp"
+    fi
+}
+
 handle_declarative_configuration() {
     local config_file="$1"
     merge_yaml "$config_file" <<EOF
@@ -343,27 +501,12 @@ handle_file_activity_monitoring() {
 
 handle_virtual_machines_configuration() {
     local config_file="$1"
-    local virtual_machines="${ROX_VIRTUAL_MACHINES:-false}"
     local poll_interval="${ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL:-1m}"
-    local vm_mode_setting
-
-    case "$virtual_machines" in
-    true)
-        vm_mode_setting="Enabled"
-        ;;
-    false)
-        vm_mode_setting="Disabled"
-        ;;
-    *)
-        die "Unsupported value for ROX_VIRTUAL_MACHINES: ${ROX_VIRTUAL_MACHINES}"
-        ;;
-    esac
 
     merge_yaml "$config_file" <<EOF
 securedCluster:
   spec:
     virtualMachines:
-      mode: "${vm_mode_setting}"
       scraper:
         pollInterval: "${poll_interval}"
 EOF
diff --git a/tests/e2e/lib.sh b/tests/e2e/lib.sh
index 4c72d0ba13340..cfd9b1c1438a1 100755
--- a/tests/e2e/lib.sh
+++ b/tests/e2e/lib.sh
@@ -39,18 +39,15 @@ POD_CONTAINERS_MAP["pod: central - container: central"]="central-[A-Za-z0-9]+-[A
 POD_CONTAINERS_MAP["pod: central-db - container: init-db"]="central-db-[A-Za-z0-9]+-[A-Za-z0-9]+-init-db-previous.log"
 POD_CONTAINERS_MAP["pod: central-db - container: central-db"]="central-db-[A-Za-z0-9]+-[A-Za-z0-9]+-central-db-previous.log"
 POD_CONTAINERS_MAP["pod: config-controller - container: manager"]="config-controller-[A-Za-z0-9]+-[A-Za-z0-9]+-manager-previous.log"
-POD_CONTAINERS_MAP["pod: scanner - container: scanner"]="scanner-[A-Za-z0-9]+-[A-Za-z0-9]+-scanner-previous.log"
-POD_CONTAINERS_MAP["pod: scanner-db - container: init-db"]="scanner-db-[A-Za-z0-9]+-[A-Za-z0-9]+-init-db-previous.log"
-POD_CONTAINERS_MAP["pod: scanner-db - container: db"]="scanner-db-[A-Za-z0-9]+-[A-Za-z0-9]+-db-previous.log"
-POD_CONTAINERS_MAP["pod: scanner-v4 - container: matcher"]="scanner-v4-[A-Za-z0-9]+-[A-Za-z0-9]+-matcher-previous.log"
-POD_CONTAINERS_MAP["pod: scanner-v4 - container: indexer"]="scanner-v4-[A-Za-z0-9]+-[A-Za-z0-9]+-indexer-previous.log"
+# Matcher and indexer are separate deployments: scanner-v4-matcher-*, scanner-v4-indexer-*.
+POD_CONTAINERS_MAP["pod: scanner-v4-matcher - container: matcher"]="scanner-v4-matcher-[A-Za-z0-9]+-[A-Za-z0-9]+-matcher-previous.log"
+POD_CONTAINERS_MAP["pod: scanner-v4-indexer - container: indexer"]="scanner-v4-indexer-[A-Za-z0-9]+-[A-Za-z0-9]+-indexer-previous.log"
 POD_CONTAINERS_MAP["pod: scanner-v4-db - container: init-db"]="scanner-v4-db-[A-Za-z0-9]+-[A-Za-z0-9]+-init-db-previous.log"
 POD_CONTAINERS_MAP["pod: scanner-v4-db - container: db"]="scanner-v4-db-[A-Za-z0-9]+-[A-Za-z0-9]+-db-previous.log"
 POD_CONTAINERS_MAP["pod: sensor - container: sensor"]="sensor-[A-Za-z0-9]+-[A-Za-z0-9]+-sensor-previous.log"
 POD_CONTAINERS_MAP["pod: admission-control - container: admission-control"]="admission-control-[A-Za-z0-9]+-[A-Za-z0-9]+-admission-control-previous.log"
 POD_CONTAINERS_MAP["pod: collector - container: collector"]="collector-[A-Za-z0-9]+-collector-previous.log"
 POD_CONTAINERS_MAP["pod: collector - container: compliance"]="collector-[A-Za-z0-9]+-compliance-previous.log"
-POD_CONTAINERS_MAP["pod: collector - container: node-inventory"]="collector-[A-Za-z0-9]+-node-inventory-previous.log"
 
 # Note: the caller must make sure to redirect stdin to /dev/null where needed.
 retrying_kubectl() {
@@ -95,6 +92,38 @@ deploy_stackrox() {
     touch "${STATE_DEPLOYED}"
 }
 
+# Ensure the roxie CLI is installed and on PATH. run.sh runs under both GitHub Actions and
+# OpenShift CI (Prow); on Prow the GHA roxie/install-cli action is unavailable and the test
+# image may ship an older roxie, so we rely on the self-installing scripts/roxie.sh wrapper,
+# which downloads the version pinned in ROXIE_VERSION into bin/<os>_<arch>/roxie and put it
+# ahead of any pre-installed roxie on PATH.
+ensure_roxie_on_path() {
+    local os arch
+    case "$(uname -s)" in
+        Linux*) os="linux" ;;
+        Darwin*) os="darwin" ;;
+        *) die "Unsupported operating system: $(uname -s)" ;;
+    esac
+    case "$(uname -m)" in
+        x86_64) arch="amd64" ;;
+        arm64|aarch64) arch="arm64" ;;
+        *) die "Unsupported architecture: $(uname -m)" ;;
+    esac
+
+    # Triggers the download/install of the pinned roxie version if it is not present yet.
+    "$ROOT/scripts/roxie.sh" version
+
+    # Put ONLY roxie at the front of PATH, via a dedicated directory. We must not prepend
+    # "$ROOT/bin/${os}_${arch}" directly: it also contains roxctl, which the bats tests move out
+    # of that directory mid-run, after which bare `roxctl` would resolve to the now-missing path
+    # (instead of the stable /usr/local/bin/roxctl copy) and later phases (e.g. proxy tests) fail.
+    local roxie_bindir; roxie_bindir="$(mktemp -d)"
+    ln -sf "$ROOT/bin/${os}_${arch}/roxie" "${roxie_bindir}/roxie"
+    export PATH="${roxie_bindir}:$PATH"
+
+    check_for_roxie
+}
+
 # Deploy StackRox using roxie.
 #
 # This is the preferred way of deploying StackRox for tests as of 2026Q2.
@@ -128,8 +157,6 @@ deploy_stackrox_with_roxie() {
     ROX_ADMIN_PASSWORD="$(gen_admin_password)"
     export ROX_ADMIN_PASSWORD # Let roxie pick it up automatically.
 
-    prepare_for_konflux "$config_file"
-
     workaround_label_length_limitation "$config_file"
 
     # Print out the config file in use for transparency.
@@ -148,31 +175,31 @@ deploy_stackrox_with_roxie() {
     # - wait_for_api (implicit)
     local roxie_envrc; roxie_envrc="$(mktemp)"
 
+    # Note, we use early-readiness=false here so that roxie waits until all workloads are ready.
+    # For Scanner V4 this means that it will also wait until vulnerabilities are loaded into the DB.
     roxie deploy \
+        --early-readiness=false --central-wait=2h --secured-cluster-wait=2h \
         --envrc "$roxie_envrc" \
         --config "$config_file"
 
     # Persist and load (extended) roxie environment, mimicking the effect of ci_export in a more concise way.
     extend_roxie_envrc "$roxie_envrc"
-    if [[ -n "${BASH_ENV:-}" ]]; then
-        cat "$roxie_envrc" >> "$BASH_ENV"
-    fi
     # shellcheck source=/dev/null
     source "$roxie_envrc"
 
+    # Re-export every variable from the envrc via ci_export so that it is
+    # persisted correctly for subsequent GHA steps (GITHUB_ENV) or Prow
+    # (BASH_ENV).  The envrc has already been sourced above, so we read
+    # the properly unquoted values from the current shell environment
+    # instead of trying to strip Go %q quoting from the file.
+    local var_name
+    while IFS= read -r envrc_line; do
+        var_name="${envrc_line#export }"  # strip "export " prefix
+        var_name="${var_name%%=*}"      # strip "=value" suffix
+        ci_export "$var_name" "${!var_name}"
+    done < <(grep '^export ' "$roxie_envrc")
     record_build_info "${central_namespace}"
 
-    # This implements something between roxie's (upcoming) `--early-readiness=true` and `--early-readiness=false`.
-    # It just waits for sensor and collector workloads to be up and running.
-    # We use the same mechanism here instead of `--early-readiness=false`, because the latter
-    # would also wait for scanner (v2), which takes an enormous amount of time to be properly initialized
-    # and we don't want to slow down this deployment path using roxie.
-    sensor_wait "$securedcluster_namespace"
-    wait_for_collectors_to_be_operational "$securedcluster_namespace"
-    if retrying_kubectl </dev/null -n "$central_namespace" get deployment scanner-v4-indexer >/dev/null 2>&1; then
-        wait_for_scanner_V4 "$central_namespace"
-    fi
-
     touch "${STATE_DEPLOYED}"
     rm -f "$roxie_envrc"
 
@@ -183,35 +210,6 @@ deploy_stackrox_with_roxie() {
     info "╚═════════════════════╝"
 }
 
-prepare_for_konflux() {
-    local config_file="$1"
-    local use_konflux
-    use_konflux=$(yq eval ".roxie.konfluxImages" "$config_file")
-    local main_image_tag
-    main_image_tag=$(yq eval ".roxie.version" "$config_file")
-    if [[ "$use_konflux" == "true" ]]; then
-        # We need to be able to pull operator bundle images.
-        registry_ro_login "quay.io/rhacs-eng"
-
-        info "Checking if ACS main image tag needs to be patched for Konflux usage: current tag is ${main_image_tag}"
-        if is_CI; then
-            # get_branch_name() may only be called in CI context.
-            local branch_name
-            branch_name="$(get_branch_name)"
-            if [[ "$branch_name" =~ ^release- ]]; then
-                info "On release branch (${branch_name}), skipping main image tag patching for Konflux usage"
-                return
-            fi
-        fi
-        info "Patching main image tag for Konflux usage: using ${main_image_tag}"
-        if [[ "$main_image_tag" != *-fast ]]; then
-            main_image_tag="${main_image_tag}-fast"
-            patch_yaml "$config_file" ".roxie.version = \"${main_image_tag}\""
-            info "Main image tag patched for Konflux usage: ${main_image_tag}"
-        fi
-    fi
-}
-
 # When deploying Konflux-built images, we might get an additional "-fast" suffix on the main image version,
 # which can easily cause the Helm chart labels to exceed the 63 character limit. To work around this, we
 # use shorter labels for the the roxie-deployed resources.
@@ -268,6 +266,7 @@ extend_roxie_envrc() {
 export CLUSTER="${CLUSTER}"
 export API_HOSTNAME="${API_HOSTNAME}"
 export API_PORT="${API_PORT}"
+export ROX_USERNAME="admin"
 EOF
 }
 
@@ -275,77 +274,107 @@ gen_admin_password() {
     head -c 20 </dev/urandom | base64
 }
 
-# shellcheck disable=SC2120
+# Deploy StackRox for compatibility testing using roxie.
+# Deploys central at central_version and secured cluster at sensor_version.
 deploy_stackrox_with_custom_central_and_sensor_versions() {
     if [[ "$#" -ne 2 ]]; then
-        die "expected central chart version and sensor chart version as parameters in \
-          deploy_stackrox_with_custom_central_and_sensor_versions: \
-          deploy_stackrox_with_custom_central_and_sensor_versions <central chart version> <sensor chart version>"
+        die "usage: deploy_stackrox_with_custom_central_and_sensor_versions <central_version> <sensor_version>"
     fi
     local central_version="$1"
     local sensor_version="$2"
 
-    ci_export DEPLOY_STACKROX_VIA_OPERATOR "false"
-    ci_export OUTPUT_FORMAT "helm"
+    local roxie="${TEST_ROOT}/scripts/roxie.sh"
 
-    # Repo name can't be too long or `helm search repo [REPO_NAME] -l` cuts off part of the name and the regex below fails.
-    local helm_repo_name="tmp-srox-compat"
-    local helm_chart_url="https://raw.githubusercontent.com/stackrox/helm-charts/main/opensource"
-    if ! helm repo list -o json | jq -e --arg name "$helm_repo_name" --arg url "$helm_chart_url" \
-        'any(.[]; .name == $name and .url == $url)'; then
-        helm repo add --force-update "${helm_repo_name}" "${helm_chart_url}"
-    fi
+    info "Deploying for compatibility test: Central ${central_version}, Sensor ${sensor_version}"
+
+    local namespace="stackrox"
+    local config_file; config_file="$(mktemp)"
+    local roxie_envrc; roxie_envrc="$(mktemp)"
+
+    # Fix the cluster name so setup_generated_certs_for_test can look it up by name.
+    merge_yaml "$config_file" <<EOF
+securedCluster:
+  spec:
+    clusterName: remote
+EOF
 
-    current_tag="$(make tag --quiet --no-print-directory)"
+    # Scan every 9-11 minutes during compatibility tests.
+    set_custom_env "$config_file" "securedCluster" "ROX_NODE_SCANNING_INTERVAL" "10m"
+    set_custom_env "$config_file" "securedCluster" "ROX_NODE_SCANNING_INTERVAL_DEVIATION" "60s"
 
-    helm_charts="$(helm search repo "${helm_repo_name}" -l)"
-    central_regex="${helm_repo_name}/stackrox-central-services[ \t]*.${central_version}[ \t]*.([0-9]+\.[0-9]+\.[0-9]+)"
-    sensor_regex="${helm_repo_name}/stackrox-secured-cluster-services[ \t]*.${sensor_version}[ \t]*.([0-9]+\.[0-9]+\.[0-9]+)"
+    # Configure the endpoints required by endpoints_test.go.
+    handle_endpoints_for_test "$config_file"
 
-    charts_dir="$(mktemp -d ./charts-dir.XXXXXX)"
+    # Speed up baseline generation so TestPod can observe process events within the test window.
+    # The default is 1h; tests time out long before baselines would be generated.
+    set_custom_env "$config_file" "central" "ROX_BASELINE_GENERATION_DURATION" "1m"
+    set_custom_env "$config_file" "central" "ROX_NETWORK_BASELINE_OBSERVATION_PERIOD" "2m"
 
-    # If the central version is the same as the current_tag, the default behavior of deploy_central() is correct for compatibility tests
-    chart_name="stackrox-central-services"
-    if  [[ $helm_charts =~ $central_regex ]]; then
-        central_chart="${helm_repo_name}/${chart_name}"
-        ci_export CENTRAL_CHART_DIR_OVERRIDE "${charts_dir}/${chart_name}"
-        helm pull "${central_chart}" --version "${central_version}" --untar --untardir "${charts_dir}"
-        echo "Pulled helm chart for ${chart_name} to ${CENTRAL_CHART_DIR_OVERRIDE}"
-    elif [[ "$current_tag" != "${central_version}" ]]; then
-        echo >&2 "${chart_name} helm chart for version ${central_version} not found in ${helm_repo_name} repo nor is it the current tag."
-        exit 1
+    # Add the test CA so Central accepts client-cert auth during endpoints_test.go.
+    if [[ -n "${TRUSTED_CA_FILE:-}" && -f "${TRUSTED_CA_FILE}" ]]; then
+        local trusted_ca_content
+        trusted_ca_content="$(jq -Rs . < "${TRUSTED_CA_FILE}")"
+        merge_yaml "$config_file" <<EOF
+central:
+  spec:
+    tls:
+      additionalCAs:
+      - name: additional-ca
+        content: ${trusted_ca_content}
+EOF
     fi
 
-    # If the sensor version is the same as the current_tag the default behavior of deploy_sensor() is incorrect, because it will deploy
-    # a sensor version to match the central version. In our tests we want to test current sensor vs older central too,
-    # and since current sensor is not available in the repo either the chart is created here in the elif case.
-    chart_name="stackrox-secured-cluster-services"
-    if [[ $helm_charts =~ $sensor_regex ]]; then
-        sensor_chart="${helm_repo_name}/${chart_name}"
-        ci_export SENSOR_CHART_DIR_OVERRIDE "${charts_dir}/${chart_name}"
-        helm pull "${sensor_chart}" --version "${sensor_version}" --untar --untardir "${charts_dir}"
-        echo "Pulled helm chart for ${chart_name} to ${SENSOR_CHART_DIR_OVERRIDE}"
-    elif [[ "$current_tag" == "${sensor_version}" ]]; then
-        if [[ $(roxctl version) != "$current_tag" ]]; then
-            echo >&2 "Reported roxctl version $(roxctl version) is different from requested tag ${current_tag}. It won't be possible to get helm charts for ${current_tag}. Please check test setup."
-            exit 1
-        fi
-        ci_export SENSOR_CHART_DIR_OVERRIDE "${charts_dir}/${chart_name}"
-        local sensor_image_flavor
-        sensor_image_flavor="${ROXCTL_ROX_IMAGE_FLAVOR:-$(make --quiet --no-print-directory -C "${TEST_ROOT}" image-flavor)}"
-        roxctl helm output secured-cluster-services --image-defaults="${sensor_image_flavor}" --output-dir "${SENSOR_CHART_DIR_OVERRIDE}" --remove
-        echo "Downloaded ${chart_name} helm chart for version ${sensor_version} to ${SENSOR_CHART_DIR_OVERRIDE} (image-defaults=${sensor_image_flavor})"
-    else
-        echo >&2 "${chart_name} helm chart for version ${sensor_version} not found in ${helm_repo_name} repo nor is it the latest tag."
-        exit 1
+    # Create a TLS secret and reference it in the Central CR (for TLS cert tests).
+    if [[ -n "${ROX_DEFAULT_TLS_KEY_FILE:-}" && -n "${ROX_DEFAULT_TLS_CERT_FILE:-}" ]]; then
+        local tls_secret_name="central-default-tls-secret"
+
+        # Ensure the namespace exists.
+        retrying_kubectl create ns "$namespace" --dry-run=client -o yaml </dev/null \
+            | retrying_kubectl apply -f -
+
+        retrying_kubectl -n "$namespace" create secret tls "$tls_secret_name" \
+            --cert="$ROX_DEFAULT_TLS_CERT_FILE" \
+            --key="$ROX_DEFAULT_TLS_KEY_FILE" \
+            --dry-run=client -o yaml </dev/null \
+            | retrying_kubectl -n "$namespace" apply -f -
+        merge_yaml "$config_file" <<EOF
+central:
+  spec:
+    central:
+      defaultTLSSecret:
+        name: "${tls_secret_name}"
+EOF
+    fi
+
+    ROX_ADMIN_PASSWORD="$(gen_admin_password)"
+    export ROX_ADMIN_PASSWORD
+
+    "$roxie" --verbose deploy \
+        --single-namespace \
+        --tag "${central_version}" \
+        --secured-cluster-tag "${sensor_version}" \
+        --resources ci \
+        --pause-reconciliation \
+        --config "$config_file" \
+        --envrc "$roxie_envrc"
+
+
+    extend_roxie_envrc "$roxie_envrc"
+    if [[ -n "${BASH_ENV:-}" ]]; then
+        cat "$roxie_envrc" >> "$BASH_ENV"
     fi
+    # shellcheck source=/dev/null
+    source "$roxie_envrc"
+    ci_export API_ENDPOINT "$API_ENDPOINT"
+    ci_export ROX_ADMIN_PASSWORD "$ROX_ADMIN_PASSWORD"
 
-    deploy_stackrox
+    rm -f "$config_file" "$roxie_envrc"
 
-    rm -rf "$charts_dir"
+    # TODO(https://github.com/stackrox/roxie/issues/269): replace with --early-readiness=false roxie flag,
+    # once we no longer need to deploy 4.9
+    wait_for_collectors_to_be_operational stackrox
 
-    ci_export CENTRAL_CHART_DIR_OVERRIDE ""
-    ci_export SENSOR_CHART_DIR_OVERRIDE ""
+    info "Stackrox deployed with Central version: ${central_version}, Sensor version: ${sensor_version}"
 }
 
 # export_test_environment() - Persist environment variables for the remainder of
@@ -372,6 +401,8 @@ export_test_environment() {
     ci_export ROX_COMPLIANCE_ENHANCEMENTS "${ROX_COMPLIANCE_ENHANCEMENTS:-true}"
     ci_export ROX_TELEMETRY_STORAGE_KEY_V1 "DISABLED"
     ci_export ROX_COMPLIANCE_REPORTING "${ROX_COMPLIANCE_REPORTING:-true}"
+    ci_export ROX_COMPLIANCE_SURFACE_STALE_DATA "${ROX_COMPLIANCE_SURFACE_STALE_DATA:-true}"
+    ci_export ROX_COMPLIANCE_CUSTOM_NODE_ROLES "${ROX_COMPLIANCE_CUSTOM_NODE_ROLES:-true}"
     ci_export ROX_REGISTRY_RESPONSE_TIMEOUT "${ROX_REGISTRY_RESPONSE_TIMEOUT:-90s}"
     ci_export ROX_REGISTRY_CLIENT_TIMEOUT "${ROX_REGISTRY_CLIENT_TIMEOUT:-120s}"
     ci_export ROX_SCAN_SCHEDULE_REPORT_JOBS "${ROX_SCAN_SCHEDULE_REPORT_JOBS:-true}"
@@ -384,7 +415,6 @@ export_test_environment() {
     ci_export ROX_CUSTOMIZABLE_PLATFORM_COMPONENTS "${ROX_CUSTOMIZABLE_PLATFORM_COMPONENTS:-true}"
     ci_export ROX_ADMISSION_CONTROLLER_CONFIG "${ROX_ADMISSION_CONTROLLER_CONFIG:-true}"
     ci_export ROX_CISA_KEV "${ROX_CISA_KEV:-true}"
-    ci_export ROX_DEPRECATED_COMPLIANCE_DASHBOARD "${ROX_DEPRECATED_COMPLIANCE_DASHBOARD:-true}"
     ci_export ROX_SENSITIVE_FILE_ACTIVITY "${ROX_SENSITIVE_FILE_ACTIVITY:-true}"
     ci_export ROX_CVE_FIX_TIMESTAMP "${ROX_CVE_FIX_TIMESTAMP:-true}"
     ci_export ROX_BASE_IMAGE_DETECTION "${ROX_BASE_IMAGE_DETECTION:-true}"
@@ -394,7 +424,11 @@ export_test_environment() {
     ci_export ROX_NETFLOW_BATCHING "${ROX_NETFLOW_BATCHING:-true}"
     ci_export ROX_NETFLOW_CACHE_LIMITING "${ROX_NETFLOW_CACHE_LIMITING:-true}"
     ci_export ROX_INIT_CONTAINER_SUPPORT "${ROX_INIT_CONTAINER_SUPPORT:-true}"
+    ci_export ROX_POLICY_WORKLOAD_KIND_EXCLUSION "${ROX_POLICY_WORKLOAD_KIND_EXCLUSION:-true}"
+    ci_export ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL "${ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL:-true}"
     ci_export ROX_UI_SECRETS_PAGE_MIGRATION "${ROX_UI_SECRETS_PAGE_MIGRATION:-true}"
+    ci_export ROX_AI_INTEGRATIONS "${ROX_AI_INTEGRATIONS:-true}"
+    ci_export ROX_LIGHTSPEED_RISK_SUMMARY "${ROX_LIGHTSPEED_RISK_SUMMARY:-true}"
     ci_export SCANNER_V4_VULN_READINESS "${SCANNER_V4_VULN_READINESS:-true}"
 
     if is_in_PR_context && pr_has_label ci-fail-fast; then
@@ -523,10 +557,16 @@ deploy_central_via_operator() {
     customize_envVars+=$'\n        value: "'"${ROX_TELEMETRY_STORAGE_KEY_V1:-DISABLED}"'"'
     customize_envVars+=$'\n      - name: ROX_RISK_REPROCESSING_INTERVAL'
     customize_envVars+=$'\n        value: "15s"'
+    customize_envVars+=$'\n      - name: ROX_REDHAT_SIGNING_KEY_WATCH_INTERVAL'
+    customize_envVars+=$'\n        value: "5s"'
     customize_envVars+=$'\n      - name: ROX_COMPLIANCE_ENHANCEMENTS'
     customize_envVars+=$'\n        value: "true"'
     customize_envVars+=$'\n      - name: ROX_COMPLIANCE_REPORTING'
     customize_envVars+=$'\n        value: "true"'
+    customize_envVars+=$'\n      - name: ROX_COMPLIANCE_SURFACE_STALE_DATA'
+    customize_envVars+=$'\n        value: "true"'
+    customize_envVars+=$'\n      - name: ROX_COMPLIANCE_CUSTOM_NODE_ROLES'
+    customize_envVars+=$'\n        value: "true"'
     customize_envVars+=$'\n      - name: ROX_REGISTRY_RESPONSE_TIMEOUT'
     customize_envVars+=$'\n        value: '"${ROX_REGISTRY_RESPONSE_TIMEOUT:-90s}"
     customize_envVars+=$'\n      - name: ROX_REGISTRY_CLIENT_TIMEOUT'
@@ -553,8 +593,6 @@ deploy_central_via_operator() {
     customize_envVars+=$'\n        value: "true"'
     customize_envVars+=$'\n      - name: ROX_CISA_KEV'
     customize_envVars+=$'\n        value: "true"'
-    customize_envVars+=$'\n      - name: ROX_DEPRECATED_COMPLIANCE_DASHBOARD'
-    customize_envVars+=$'\n        value: "true"'
     customize_envVars+=$'\n      - name: ROX_SENSITIVE_FILE_ACTIVITY'
     customize_envVars+=$'\n        value: "'"${ROX_SENSITIVE_FILE_ACTIVITY}"'"'
     customize_envVars+=$'\n      - name: ROX_CVE_FIX_TIMESTAMP'
@@ -569,8 +607,16 @@ deploy_central_via_operator() {
     customize_envVars+=$'\n        value: "true"'
     customize_envVars+=$'\n      - name: ROX_INIT_CONTAINER_SUPPORT'
     customize_envVars+=$'\n        value: "true"'
+    customize_envVars+=$'\n      - name: ROX_POLICY_WORKLOAD_KIND_EXCLUSION'
+    customize_envVars+=$'\n        value: "true"'
+    customize_envVars+=$'\n      - name: ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL'
+    customize_envVars+=$'\n        value: "'"${ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL:-true}"'"'
     customize_envVars+=$'\n      - name: ROX_UI_SECRETS_PAGE_MIGRATION'
     customize_envVars+=$'\n        value: "'"${ROX_UI_SECRETS_PAGE_MIGRATION}"'"'
+    customize_envVars+=$'\n      - name: ROX_AI_INTEGRATIONS'
+    customize_envVars+=$'\n        value: "'"${ROX_AI_INTEGRATIONS}"'"'
+    customize_envVars+=$'\n      - name: ROX_LIGHTSPEED_RISK_SUMMARY'
+    customize_envVars+=$'\n        value: "'"${ROX_LIGHTSPEED_RISK_SUMMARY}"'"'
     if [[ "${ROX_VIRTUAL_MACHINES:-}" == "true" ]]; then
         customize_envVars+=$'\n      - name: ROX_VIRTUAL_MACHINES'
         customize_envVars+=$'\n        value: "true"'
@@ -653,14 +699,6 @@ deploy_sensor() {
         ROX_CA_CERT_FILE="" # force sensor.sh to fetch the actual cert.
         CENTRAL_NAMESPACE="${central_namespace}" SENSOR_NAMESPACE="${sensor_namespace}" "${ROOT}/${DEPLOY_DIR}/sensor.sh"
     fi
-
-    if [[ "${ORCHESTRATOR_FLAVOR}" == "openshift" ]]; then
-        # Sensor is CPU starved under OpenShift causing all manner of test failures:
-        # https://stack-rox.atlassian.net/browse/ROX-5334
-        # https://stack-rox.atlassian.net/browse/ROX-6891
-        # et al.
-        retrying_kubectl </dev/null -n "${sensor_namespace}" set resources deploy/sensor -c sensor --requests 'cpu=2' --limits 'cpu=4'
-    fi
 }
 
 # shellcheck disable=SC2120
@@ -670,8 +708,7 @@ deploy_sensor_via_operator() {
     local validate=${3:-true}
     local scanner_component_setting="Disabled"
     local fam_mode_setting="Disabled"
-    local vm_mode_setting="Disabled"
-    # Test-only setting: VM scraper poll interval to 1m (floor is 1m) to shorten e2e test runtime. Production default is 5m.
+    # Test-only setting: VM scraper poll interval to 1m (floor is 1m) to shorten e2e test runtime. Production default is 4h.
     local vm_scraper_poll_interval="${ROX_VIRTUAL_MACHINES_SCRAPER_POLL_INTERVAL:-1m}"
     local central_endpoint="central.${central_namespace}.svc:443"
 
@@ -690,10 +727,6 @@ deploy_sensor_via_operator() {
         --output -' \
     | retrying_kubectl -n "${sensor_namespace}" apply -f -
 
-    if [[ "${SENSOR_SCANNER_SUPPORT:-}" == "true" ]]; then
-        scanner_component_setting="AutoSense"
-    fi
-
     local secured_cluster_yaml_path="tests/e2e/yaml/secured-cluster-cr.envsubst.yaml"
     if [[ "${ROX_SCANNER_V4:-false}" == "true" ]]; then
         secured_cluster_yaml_path="tests/e2e/yaml/secured-cluster-cr-with-scanner-v4.envsubst.yaml"
@@ -704,11 +737,12 @@ deploy_sensor_via_operator() {
        fam_mode_setting="Enabled"
     fi
 
-    if [[ "${ROX_VIRTUAL_MACHINES:-}" == "true" ]]; then
-        vm_mode_setting="Enabled"
-    fi
-
     customize_envVars=""
+    # Scan every 9-11 minutes during operator-deployed e2e tests.
+    customize_envVars+=$'\n    - name: ROX_NODE_SCANNING_INTERVAL'
+    customize_envVars+=$'\n      value: "10m"'
+    customize_envVars+=$'\n    - name: ROX_NODE_SCANNING_INTERVAL_DEVIATION'
+    customize_envVars+=$'\n      value: "60s"'
     if [[ -n "${ROX_NETFLOW_BATCHING:-}" ]]; then
         customize_envVars+=$'\n    - name: ROX_NETFLOW_BATCHING'
         customize_envVars+=$'\n      value: "'"${ROX_NETFLOW_BATCHING}"'"'
@@ -726,6 +760,10 @@ deploy_sensor_via_operator() {
         customize_envVars+=$'\n    - name: ROX_INIT_CONTAINER_SUPPORT'
         customize_envVars+=$'\n      value: "'"${ROX_INIT_CONTAINER_SUPPORT}"'"'
     fi
+    if [[ -n "${ROX_POLICY_WORKLOAD_KIND_EXCLUSION:-}" ]]; then
+        customize_envVars+=$'\n    - name: ROX_POLICY_WORKLOAD_KIND_EXCLUSION'
+        customize_envVars+=$'\n      value: "'"${ROX_POLICY_WORKLOAD_KIND_EXCLUSION}"'"'
+    fi
 
     local scannerV4DbPersistenceYaml
     scannerV4DbPersistenceYaml="$(_scanner_v4_db_persistence_yaml)"
@@ -733,7 +771,6 @@ deploy_sensor_via_operator() {
     env - \
       scanner_component_setting="$scanner_component_setting" \
       fam_mode_setting="$fam_mode_setting" \
-      vm_mode_setting="$vm_mode_setting" \
       vm_scraper_poll_interval="$vm_scraper_poll_interval" \
       central_endpoint="$central_endpoint" \
       customize_envVars="$customize_envVars" \
@@ -1594,7 +1631,8 @@ wait_for_scanner_V4() {
         info "Listing available storage classes:"
         kubectl describe storageclasses 2>/dev/null || true
 
-        matcher_max_seconds=${SCANNER_V4_VULN_READINESS_TIMEOUT:-3600}
+        # (todo) re-visit the default timeout of 2h and make vuln loading more performant
+        matcher_max_seconds=${SCANNER_V4_VULN_READINESS_TIMEOUT:-7200}
         info "Waiting ${matcher_max_seconds}s for matcher vulnerability readiness..."
     fi
 
@@ -1756,17 +1794,21 @@ _record_build_info() {
     set_ci_shared_export "build" "${build_info}"
 }
 
-restore_4_6_postgres_backup() {
-    info "Restoring a 4.6 postgres backup"
+restore_postgres_backup() {
+    info "Restoring a postgres backup"
 
     require_environment "API_ENDPOINT"
     require_environment "ROX_ADMIN_PASSWORD"
 
-    setup_gcp
-    gsutil cp gs://stackrox-ci-upgrade-test-fixtures/upgrade-test-dbs/postgres_db_4_6.sql.zip .
+    # CI activates the stackrox SA via setup_gcp. Local runs keep the caller's
+    # gcloud credentials; this bucket is readable with typical ACS engineer ADC.
+    if is_CI; then
+        setup_gcp
+    fi
+    gsutil cp gs://stackrox-ci-upgrade-test-fixtures/upgrade-test-dbs/postgres_db_4.10.0.sql.zip .
 
     roxctl -e "$API_ENDPOINT" --ca "" --insecure-skip-tls-verify \
-            central db restore --timeout 5m postgres_db_4_6.sql.zip
+            central db restore --timeout 5m postgres_db_4.10.0.sql.zip
 }
 
 update_public_config() {
@@ -1822,31 +1864,19 @@ db_backup_and_restore_test() {
 handle_e2e_progress_failures() {
     info "Checking for progress events"
 
-    local images_available=("Image_Availability" "Were the required images built successfully by GitHub Actions?")
     local stackrox_deployed=("Stackrox_Deployment" "Was Stackrox deployed to the cluster?")
 
     local check_deployment=false
 
     if [[ -f "${STATE_IMAGES_AVAILABLE}" ]]; then
-        save_junit_success "${images_available[@]}"
         check_deployment=true
-    else
-        local build_results="build results are unknown"
-        if [[ -f "${STATE_BUILD_RESULTS}" ]]; then
-            build_results="$(cat "${STATE_BUILD_RESULTS}")"
-        fi
-        read -r -d '' build_details <<- _EO_DETAILS_ || true
-Check the build workflow runs on GitHub:
-${build_results}
-_EO_DETAILS_
-        save_junit_failure "${images_available[@]}" "${build_details}"
     fi
 
     case "$CI_JOB_NAME" in
-    *gke-upgrade-tests)
+    *gke-upgrade-tests*)
         record_upgrade_test_progess
         ;;
-    *operator-e2e-tests)
+    *operator-e2e-tests|*-version-compatibility-tests|*-nongroovy-compatibility-tests)
         check_deployment=false
         ;;
     *)
@@ -1876,13 +1906,16 @@ record_upgrade_test_progess() {
     # tracking files that the upgrade test leaves in its wake as it progresses.
 
     # tests/upgrade/postgres_sensor_run.sh
-    record_progress_step "${UPGRADE_PROGRESS_SENSOR_BUNDLE}" "${STATE_DEPLOYED}" \
-        "postgres_sensor_run" "roxctl sensor bundle test"
-    record_progress_step "${UPGRADE_PROGRESS_UPGRADER}" "${UPGRADE_PROGRESS_SENSOR_BUNDLE}" \
-        "postgres_sensor_run" "bin/upgrader tests"
+    if [[ "$CI_JOB_NAME" == "gke-upgrade-tests-sensor" ]]; then
+        record_progress_step "${UPGRADE_PROGRESS_SENSOR_BUNDLE}" "${STATE_DEPLOYED}" \
+            "postgres_sensor_run" "roxctl sensor bundle test"
+        record_progress_step "${UPGRADE_PROGRESS_UPGRADER}" "${UPGRADE_PROGRESS_SENSOR_BUNDLE}" \
+            "postgres_sensor_run" "bin/upgrader tests"
+        return
+    fi
 
-    # tests/upgrade/postgres_run.sh
-    record_progress_step "${UPGRADE_PROGRESS_POSTGRES_PREP}" "${UPGRADE_PROGRESS_UPGRADER}" \
+    # tests/upgrade/postgres_run.sh and tests/upgrade/postgres_upgrade_run.sh
+    record_progress_step "${UPGRADE_PROGRESS_POSTGRES_PREP}" "${STATE_DEPLOYED}" \
         "postgres_run" "Preparation for postgres testing"
     record_progress_step "${UPGRADE_PROGRESS_POSTGRES_EARLIER_CENTRAL}" "${UPGRADE_PROGRESS_POSTGRES_PREP}" \
         "postgres_run" "Deployed earlier postgres central"
@@ -1890,6 +1923,9 @@ record_upgrade_test_progess() {
         "postgres_run" "Bounced central"
     record_progress_step "${UPGRADE_PROGRESS_POSTGRES_CENTRAL_DB_BOUNCE}" "${UPGRADE_PROGRESS_POSTGRES_CENTRAL_BOUNCE}" \
         "postgres_run" "Bounced central-db"
+
+    # tests/upgrade/postgres_run.sh only
+    [[ "$CI_JOB_NAME" == "gke-upgrade-tests-central" ]] || return
     record_progress_step "${UPGRADE_PROGRESS_POSTGRES_MIGRATIONS}" "${UPGRADE_PROGRESS_POSTGRES_CENTRAL_DB_BOUNCE}" \
         "postgres_run" "Test migrations with an upgrade to current"
     record_progress_step "${UPGRADE_PROGRESS_POSTGRES_ROLLBACK}" "${UPGRADE_PROGRESS_POSTGRES_MIGRATIONS}" \
diff --git a/tests/e2e/run-compatibility.sh b/tests/e2e/run-compatibility.sh
index ec533e6766e1e..2cc54e5fc25bc 100755
--- a/tests/e2e/run-compatibility.sh
+++ b/tests/e2e/run-compatibility.sh
@@ -45,23 +45,18 @@ _run_compatibility_tests() {
     require_environment "KUBECONFIG"
 
     export_test_environment
-    ci_export CENTRAL_PERSISTENCE_NONE "true"
-
-    export SENSOR_HELM_DEPLOY=true
-    export ROX_ACTIVE_VULN_REFRESH_INTERVAL=1m
-    export ROX_NETPOL_FIELDS=true
-    export ROX_SENSOR_UPGRADER_ENABLED=false
 
     test_preamble
     setup_deployment_env false false
 
-    remove_existing_stackrox_resources
+    "$ROOT/scripts/roxie.sh" teardown all --single-namespace || true
     setup_default_TLS_certs
     info "Creating mocked compliance operator data for compliance v1 tests"
     "$ROOT/tests/complianceoperator/create.sh"
 
     deploy_stackrox_with_custom_central_and_sensor_versions "${central_version}" "${sensor_version}"
-    echo "Stackrox deployed with Central version - ${central_version}, Sensor version - ${sensor_version}"
+
+    setup_client_TLS_certs
 
     rm -f FAIL
 
diff --git a/tests/e2e/run-scale.sh b/tests/e2e/run-scale.sh
index 82d06b803668c..0fb12cb9c5cb6 100755
--- a/tests/e2e/run-scale.sh
+++ b/tests/e2e/run-scale.sh
@@ -38,8 +38,19 @@ scale_test() {
 }
 
 deploy_stackrox_in_scale_mode() {
-    "$ROOT/deploy/k8s/deploy.sh"
-    
+    local roxie_envrc; roxie_envrc="$(mktemp)"
+
+    "${ROOT}/scripts/roxie.sh" --verbose deploy \
+            --single-namespace \
+            --resources ci \
+            --pause-reconciliation \
+            --envrc "$roxie_envrc"
+
+    extend_roxie_envrc "$roxie_envrc"
+    # shellcheck source=/dev/null
+    source "$roxie_envrc"
+    rm -f "$roxie_envrc"
+
     DEPLOY_DIR="deploy/${ORCHESTRATOR_FLAVOR}" \
     export_central_basic_auth_creds
 
diff --git a/tests/e2e/run-scanner-v4-install.bats b/tests/e2e/run-scanner-v4-install.bats
index 90d25fd9016dc..0f1311b8c9b48 100755
--- a/tests/e2e/run-scanner-v4-install.bats
+++ b/tests/e2e/run-scanner-v4-install.bats
@@ -462,7 +462,6 @@ EOT
     )
 
     _begin "verify-scanners-are-deployed"
-    verify_scannerV2_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_scannerV4_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_deployment_scannerV4_env_var_set "$CUSTOM_CENTRAL_NAMESPACE" "central"
 
@@ -471,7 +470,8 @@ EOT
         --reuse-values
 
     _begin "verify-scanners-are-deployed"
-    verify_scannerV2_deployed "$CUSTOM_CENTRAL_NAMESPACE"
+    # TODO(ROX-36705): Remove when 5.1 is cut.
+    verify_no_scannerV2_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_scannerV4_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_deployment_scannerV4_env_var_set "$CUSTOM_CENTRAL_NAMESPACE" "central"
 
@@ -484,7 +484,6 @@ EOT
         "$secured_cluster_name" "$ROX_ADMIN_PASSWORD" "$central_endpoint"
 
     _begin "verify-scanners-are-deployed"
-    verify_scannerV2_deployed "$CUSTOM_SENSOR_NAMESPACE"
     verify_scannerV4_indexer_deployed "$CUSTOM_SENSOR_NAMESPACE"
     verify_deployment_scannerV4_env_var_set "$CUSTOM_SENSOR_NAMESPACE" "sensor"
 
@@ -492,7 +491,8 @@ EOT
     deploy_sensor_with_helm "$CUSTOM_CENTRAL_NAMESPACE" "$CUSTOM_SENSOR_NAMESPACE" "" "" "" "" ""
 
     _begin "verify-scanners-are-deployed"
-    verify_scannerV2_deployed "$CUSTOM_SENSOR_NAMESPACE"
+    # TODO(ROX-36705): Remove when 5.1 is cut.
+    verify_no_scannerV2_deployed "$CUSTOM_SENSOR_NAMESPACE"
     verify_scannerV4_indexer_deployed "$CUSTOM_SENSOR_NAMESPACE"
     verify_deployment_scannerV4_env_var_set "$CUSTOM_SENSOR_NAMESPACE" "sensor"
 
@@ -537,13 +537,11 @@ EOT
 
     ######################
     _begin "verifying-central-scanners-deployed"
-    verify_scannerV2_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_scannerV4_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_deployment_scannerV4_env_var_set "$CUSTOM_CENTRAL_NAMESPACE" "central"
 
     ######################
     _begin "verifying-sensor-scanners-deployed"
-    verify_scannerV2_deployed "$CUSTOM_SENSOR_NAMESPACE"
     verify_scannerV4_indexer_deployed "$CUSTOM_SENSOR_NAMESPACE"
     run verify_deployment_scannerV4_env_var_set "$CUSTOM_SENSOR_NAMESPACE" "sensor"
 
@@ -564,14 +562,12 @@ EOT
     ######################
     _begin "verifying-central-scanners-deployed"
     info "Verifying that scanners are still installed"
-    verify_scannerV2_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_scannerV4_deployed "$CUSTOM_CENTRAL_NAMESPACE"
     verify_deployment_scannerV4_env_var_set "$CUSTOM_CENTRAL_NAMESPACE" "central"
 
     ######################
     _begin "verifying-sensor-scanners-deployed"
     info "Verifying that scanners are still installed"
-    verify_scannerV2_deployed "$CUSTOM_SENSOR_NAMESPACE"
     verify_scannerV4_indexer_deployed "$CUSTOM_SENSOR_NAMESPACE"
     run verify_deployment_scannerV4_env_var_set "$CUSTOM_SENSOR_NAMESPACE" "sensor"
 
@@ -629,7 +625,6 @@ EOT
     ######################
     _begin "verifying-central-scanners-deployed"
     info "Verifying that scanners are deployed"
-    verify_scannerV2_deployed "$namespace"
     verify_scannerV4_deployed "$namespace"
     info "Verifying that scanner V4 is enabled for sensor"
     verify_deployment_scannerV4_env_var_set "$namespace" "central"
@@ -656,7 +651,6 @@ EOT
     ######################
     _begin "verifying-central-scanners-deployed"
     info "Verifying that scanners are still installed"
-    verify_scannerV2_deployed "$namespace"
     verify_scannerV4_deployed "$namespace"
     verify_deployment_scannerV4_env_var_set "$namespace" "central"
 
@@ -704,12 +698,9 @@ EOT
     # shellcheck disable=SC2030,SC2031
     export OUTPUT_FORMAT=helm
     # shellcheck disable=SC2030,SC2031
-    export SENSOR_SCANNER_SUPPORT=true
-    # shellcheck disable=SC2030,SC2031
     export SENSOR_SCANNER_V4_SUPPORT=true
     _deploy_stackrox "" "$central_namespace" "$sensor_namespace"
 
-    verify_scannerV2_deployed "$central_namespace"
     verify_scannerV4_deployed "$central_namespace"
     verify_deployment_scannerV4_env_var_set "$central_namespace" "central"
     verify_scannerV4_indexer_deployed "$sensor_namespace"
@@ -744,7 +735,6 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed
     verify_no_scannerV4_deployed
     run ! verify_deployment_scannerV4_env_var_set "stackrox" "central"
 
@@ -779,8 +769,6 @@ EOT
     export ROX_SCANNER_V4="" # Scanner V4 enabled by default.
     # shellcheck disable=SC2030,SC2031
     export DEPLOY_STACKROX_VIA_OPERATOR="true"
-    # shellcheck disable=SC2030,SC2031
-    export SENSOR_SCANNER_SUPPORT=true
 
     _begin "deploy-stackrox"
 
@@ -789,7 +777,6 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed "stackrox"
     verify_scannerV4_deployed "stackrox"
     verify_deployment_scannerV4_env_var_set "stackrox" "central"
     verify_deployment_scannerV4_env_var_set "stackrox" "sensor"
@@ -816,8 +803,6 @@ EOT
     export ROX_SCANNER_V4="" # Scanner V4 enabled by default.
     # shellcheck disable=SC2030,SC2031
     export DEPLOY_STACKROX_VIA_OPERATOR="true"
-    # shellcheck disable=SC2030,SC2031
-    export SENSOR_SCANNER_SUPPORT=true
 
     _begin "deploy-stackrox"
 
@@ -826,11 +811,9 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed "${CUSTOM_CENTRAL_NAMESPACE}"
     verify_scannerV4_deployed "${CUSTOM_CENTRAL_NAMESPACE}"
     verify_deployment_scannerV4_env_var_set "${CUSTOM_CENTRAL_NAMESPACE}" "central"
 
-    verify_scannerV2_deployed "${CUSTOM_SENSOR_NAMESPACE}"
     verify_scannerV4_indexer_deployed "${CUSTOM_SENSOR_NAMESPACE}"
     verify_deployment_scannerV4_env_var_set "${CUSTOM_SENSOR_NAMESPACE}" "sensor"
 
@@ -850,8 +833,6 @@ EOT
     # shellcheck disable=SC2030,SC2031
     export DEPLOY_STACKROX_VIA_OPERATOR="true"
     # shellcheck disable=SC2030,SC2031
-    export SENSOR_SCANNER_SUPPORT=true
-    # shellcheck disable=SC2030,SC2031
     export ROX_SCANNER_V4="" # Scanner V4 enabled by default.
 
     _begin "deploy-stackrox"
@@ -863,10 +844,9 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed "${CUSTOM_CENTRAL_NAMESPACE}"
     verify_scannerV4_deployed "${CUSTOM_CENTRAL_NAMESPACE}"
     verify_deployment_scannerV4_env_var_set "${CUSTOM_CENTRAL_NAMESPACE}" "central"
-    verify_scannerV2_deployed "${CUSTOM_SENSOR_NAMESPACE}"
+    # Scanner V2 in sensor is disabled via operator deployment path.
     verify_scannerV4_indexer_deployed "${CUSTOM_SENSOR_NAMESPACE}"
     verify_deployment_scannerV4_env_var_set "${CUSTOM_SENSOR_NAMESPACE}" "sensor"
 
@@ -885,10 +865,10 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed "${CUSTOM_CENTRAL_NAMESPACE}"
+    verify_no_scannerV2_deployed "${CUSTOM_CENTRAL_NAMESPACE}"
     verify_scannerV4_deployed "${CUSTOM_CENTRAL_NAMESPACE}"
     verify_deployment_scannerV4_env_var_set "${CUSTOM_CENTRAL_NAMESPACE}" "central"
-    verify_scannerV2_deployed "${CUSTOM_SENSOR_NAMESPACE}"
+    verify_no_scannerV2_deployed "${CUSTOM_SENSOR_NAMESPACE}"
     verify_scannerV4_indexer_deployed "${CUSTOM_SENSOR_NAMESPACE}"
     verify_deployment_scannerV4_env_var_set "${CUSTOM_SENSOR_NAMESPACE}" "sensor"
 
@@ -942,7 +922,6 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed "stackrox"
     verify_scannerV4_deployed "stackrox"
     verify_deployment_scannerV4_env_var_set "stackrox" "central"
 
@@ -965,7 +944,15 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed
+    # Note: The above deployment machinery is using the deployment scripts from this branch under the hood for working with
+    # manifest bundles generated by the previous roxctl version.
+    # The support in these scripts for deploying scanner V2 has been removed. Hence we cannot check here for installability
+    # of scanner V2.
+    #
+    # Also, we wouldn't be able to confirm any behaviour such as "existing scanner V2 is removed on upgrade", because
+    # manifest bundles don't provide this functionality.
+    #
+    # Bottom line is, this test case is now purely a V4 test case.
     verify_no_scannerV4_deployed
     run ! verify_deployment_scannerV4_env_var_set "stackrox" "central"
     run ! verify_deployment_scannerV4_env_var_set "stackrox" "sensor"
@@ -977,7 +964,6 @@ EOT
 
     _begin "verify"
 
-    verify_scannerV2_deployed
     verify_scannerV4_deployed
     verify_deployment_scannerV4_env_var_set "stackrox" "central"
     run ! verify_deployment_scannerV4_env_var_set "stackrox" "sensor" # no Scanner V4 support in Sensor with roxctl
@@ -1077,16 +1063,6 @@ verify_no_scannerV4_matcher_deployed() {
     refute_output --regexp "scanner-v4-matcher"
 }
 
-# TODO: For now, Scanner v2 is expected to run in parallel.
-# This must be removed when Scanner v2 will be phased out.
-verify_scannerV2_deployed() {
-    local namespace=${1:-stackrox}
-    info "Waiting for Scanner V2 deployment to appear in namespace ${namespace}..."
-    wait_for_object_to_appear "$namespace" deploy/scanner-db 600
-    wait_for_object_to_appear "$namespace" deploy/scanner 300
-    info "** Scanner V2 is deployed in namespace ${namespace}"
-}
-
 verify_no_scannerV2_deployed() {
     local namespace=${1:-stackrox}
     echo "Verifying that scanner V2 is not deployed"
@@ -1695,15 +1671,15 @@ create_central_pull_secrets() {
     local namespace="$1"
     info "Creating image pull secrets for central in namespace $namespace..."
     echo "{ \"apiVersion\": \"v1\", \"kind\": \"Namespace\", \"metadata\": { \"name\": \"$namespace\" } }" | "${ORCH_CMD}" apply -f -
-    "${ROOT}/deploy/common/pull-secret.sh" stackrox "$DEFAULT_IMAGE_REGISTRY_HOST" | "${ORCH_CMD}" -n "$central_namespace" apply -f -
+    "${ROOT}/scripts/pull-secret.sh" stackrox "$DEFAULT_IMAGE_REGISTRY_HOST" | "${ORCH_CMD}" -n "$central_namespace" apply -f -
 }
 
 create_sensor_pull_secrets() {
     local namespace="$1"
     info "Creating image pull secrets for secured cluster in namespace $namespace..."
     echo "{ \"apiVersion\": \"v1\", \"kind\": \"Namespace\", \"metadata\": { \"name\": \"$namespace\" } }" | "${ORCH_CMD}" apply -f -
-    "${ROOT}/deploy/common/pull-secret.sh" stackrox "$DEFAULT_IMAGE_REGISTRY_HOST" | "${ORCH_CMD}" -n "$namespace" apply -f -
-    "${ROOT}/deploy/common/pull-secret.sh" collector-stackrox "$DEFAULT_IMAGE_REGISTRY_HOST" | "${ORCH_CMD}" -n "$namespace" apply -f -
+    "${ROOT}/scripts/pull-secret.sh" stackrox "$DEFAULT_IMAGE_REGISTRY_HOST" | "${ORCH_CMD}" -n "$namespace" apply -f -
+    "${ROOT}/scripts/pull-secret.sh" collector-stackrox "$DEFAULT_IMAGE_REGISTRY_HOST" | "${ORCH_CMD}" -n "$namespace" apply -f -
 }
 
 resolve_previous_version() {
diff --git a/tests/e2e/run-ui-e2e.sh b/tests/e2e/run-ui-e2e.sh
index 26fc0f439c808..5ad7dfa5d33ff 100755
--- a/tests/e2e/run-ui-e2e.sh
+++ b/tests/e2e/run-ui-e2e.sh
@@ -60,14 +60,26 @@ test_ui_e2e() {
     export DEPLOY_DIR="deploy/${ORCHESTRATOR_FLAVOR}"
 
     export_test_environment
-
     setup_deployment_env false false
     remove_existing_stackrox_resources
     setup_default_TLS_certs
 
     # deploy the optional components before stackrox
     deploy_optional_e2e_components
-    deploy_stackrox
+    ensure_roxie_on_path
+    local roxie_config; roxie_config="$(mktemp)"
+    cat <<EOF > "${roxie_config}"
+central:
+  pauseReconciliation: true
+  namespace: stackrox
+  resourceProfile: ci
+securedCluster:
+  pauseReconciliation: true
+  namespace: stackrox
+  resourceProfile: ci
+EOF
+    deploy_stackrox_with_roxie_compat "$roxie_config"
+    rm -f "$roxie_config"
 
     # Enable the console plugin for OpenShift if the ConsolePlugin resource exists
     if [[ "${ORCHESTRATOR_FLAVOR}" == "openshift" ]] && kubectl get consoleplugin advanced-cluster-security &>/dev/null; then
diff --git a/tests/e2e/run-vm-scanning.sh b/tests/e2e/run-vm-scanning.sh
index 6a2f4158bf308..e54198d332529 100755
--- a/tests/e2e/run-vm-scanning.sh
+++ b/tests/e2e/run-vm-scanning.sh
@@ -30,8 +30,15 @@ test_vm_scanning_e2e() {
 
     if ! ensure_virtctl_binary; then
         if is_CI; then
-            warn "Secure virtctl download failed. Falling back to insecure curl -k download path in CI."
-            ensure_virtctl_binary_insecure
+            if [[ "${_VIRTCTL_CLUSTER_DOWNLOAD_NONGZIP:-0}" != 1 ]]; then
+                warn "Secure virtctl download failed. Falling back to insecure curl -k download path in CI."
+                ensure_virtctl_binary_insecure || true
+            fi
+            if ! command -v virtctl >/dev/null; then
+                warn "Cluster ConsoleCLIDownload did not serve virtctl. Falling back to the matching KubeVirt GitHub release."
+                _install_virtctl_from_kubevirt_release \
+                    || die "Failed to install virtctl from cluster ConsoleCLIDownload and KubeVirt GitHub release"
+            fi
         else
             die "Secure virtctl download failed. Refusing insecure curl -k fallback outside CI. Set VIRTCTL_PATH or fix cluster ingress trust material."
         fi
@@ -40,6 +47,8 @@ test_vm_scanning_e2e() {
     deploy_stackrox
 
     cd "$ROOT"
+    ensure_vm_scan_ssh_identity
+    persist_vm_scan_virtctl
     rm -f FAIL
     # Run the full VM scanning e2e suite.
     make -C tests TESTFLAGS="-race -p 1 -timeout 90m" vm-scanning-tests || touch FAIL
diff --git a/tests/e2e/run.sh b/tests/e2e/run.sh
index 04a2c1a505d55..17557806f0f44 100755
--- a/tests/e2e/run.sh
+++ b/tests/e2e/run.sh
@@ -35,6 +35,7 @@ test_e2e() {
     setup_deployment_env false false
     remove_existing_stackrox_resources
     setup_default_TLS_certs
+    setup_client_TLS_certs
     info "Creating mocked compliance operator data for compliance v1 tests"
     "$ROOT/tests/complianceoperator/create.sh"
     kubectl get compliancecheckresults.compliance.openshift.io -n openshift-compliance
@@ -43,7 +44,30 @@ test_e2e() {
 
     # If deploy_optional_e2e_components is called after deploy_stackrox it causes an unnecessary Sensor restart
     deploy_optional_e2e_components
-    deploy_stackrox
+
+    # Make sure we use the roxie version pinned in ROXIE_VERSION. Under Prow the test image
+    # ships an older roxie that does not recognize a generic (non-Infra) GKE cluster: it reports
+    # "cluster type: Unknown" and defaults Central exposure to a localhost port-forward instead of
+    # the LoadBalancer. That breaks endpoints_test.go, which dials all of Central's ports at the
+    # API host. The pinned version detects GKE and exposes Central via the LoadBalancer, matching
+    # the GHA runner (which installs the pinned version explicitly).
+    ensure_roxie_on_path
+
+    local roxie_config
+    roxie_config="$(mktemp)"
+    merge_yaml "$roxie_config" <<'EOF'
+central:
+  namespace: stackrox
+  pauseReconciliation: true
+  resourceProfile: ci
+securedCluster:
+  namespace: stackrox
+  pauseReconciliation: true
+  resourceProfile: ci
+EOF
+
+    deploy_stackrox_with_roxie_compat "$roxie_config"
+    rm -f "$roxie_config"
 
     # Background streamers are not explicitly stopped. They die when the CI
     # runner terminates, same as the port-forward processes in setup_proxy_tests.
@@ -94,7 +118,7 @@ test_e2e() {
 
     # Give some time for previous tests to finish up
     wait_for_api
-    restore_4_6_postgres_backup
+    restore_postgres_backup
 
     wait_for_api
     trap cleanup_workload_identities EXIT
diff --git a/tests/e2e/vm-scanning-lib.sh b/tests/e2e/vm-scanning-lib.sh
index b46dde96a9d8f..87d65f137746d 100755
--- a/tests/e2e/vm-scanning-lib.sh
+++ b/tests/e2e/vm-scanning-lib.sh
@@ -13,16 +13,37 @@ ensure_vm_scanning_cluster_prereqs() {
     require_environment "KUBECONFIG"
     require_environment "VM_IMAGES"
 
-    # Build a docker config JSON for pulling private container-disk images
-    # (e.g. quay.io/rhacs-eng/vm-images/*) inside the VM test namespace.
+    # Quadlet pulls the cluster main image. Construct MAIN_IMAGE the same way
+    # deploy.sh does when the caller only exported MAIN_IMAGE_TAG.
+    if [[ -z "${ROXAGENT_IMAGE:-}" && -z "${MAIN_IMAGE:-}" ]]; then
+        if [[ -z "${MAIN_IMAGE_TAG:-}" ]]; then
+            MAIN_IMAGE_TAG="$(make --quiet --no-print-directory -C "$_VM_SCANNING_LIB_ROOT" tag)"
+            export MAIN_IMAGE_TAG
+        fi
+        if [[ -z "${MAIN_IMAGE_REPO:-}" ]]; then
+            MAIN_IMAGE_REPO="$(make --quiet --no-print-directory -C "$_VM_SCANNING_LIB_ROOT" default-image-registry)/main"
+            export MAIN_IMAGE_REPO
+        fi
+        export MAIN_IMAGE="${MAIN_IMAGE_REPO}:${MAIN_IMAGE_TAG}"
+        info "MAIN_IMAGE set to ${MAIN_IMAGE} for Quadlet roxagent"
+    fi
+
+    # Kubernetes imagePullSecret (username/password dockerconfig) and a separate
+    # containers-auth file for guest Podman. RHEL 8 Podman requires the auth field.
     if [[ -n "${QUAY_RHACS_ENG_RO_USERNAME:-}" && -n "${QUAY_RHACS_ENG_RO_PASSWORD:-}" ]]; then
-        local vm_pull_secret
+        local vm_pull_secret vm_podman_auth quay_auth
         vm_pull_secret="$(mktemp)"
+        vm_podman_auth="$(mktemp)"
         cat > "$vm_pull_secret" <<EOF
 {"auths":{"quay.io":{"username":"${QUAY_RHACS_ENG_RO_USERNAME}","password":"${QUAY_RHACS_ENG_RO_PASSWORD}"}}}
 EOF
+        quay_auth="$(printf '%s:%s' "${QUAY_RHACS_ENG_RO_USERNAME}" "${QUAY_RHACS_ENG_RO_PASSWORD}" | base64 | tr -d '\n')"
+        printf '{"auths":{"quay.io":{"auth":"%s"}}}\n' "$quay_auth" > "$vm_podman_auth"
+        chmod 600 "$vm_podman_auth"
         export VM_IMAGE_PULL_SECRET_PATH="$vm_pull_secret"
+        export VM_PODMAN_AUTH_FILE="$vm_podman_auth"
         info "VM image pull secret written to ${vm_pull_secret}"
+        info "VM Podman auth file written to ${vm_podman_auth}"
     else
         info "QUAY_RHACS_ENG_RO_USERNAME/PASSWORD not set; VM images must be publicly accessible"
     fi
@@ -66,44 +87,174 @@ _fetch_cluster_ingress_ca() {
     printf '%s\n' "$ca_bundle"
 }
 
+# Directory to install a downloaded virtctl binary into.
+# PATH is not updated here: callers invoke this via command substitution, which
+# would discard an export. Call _virtctl_add_install_dir_to_path after assigning dest.
+_virtctl_install_dir() {
+    local dest="/usr/local/bin"
+    if [[ ! -w "$dest" ]]; then
+        dest="$(mktemp -d)"
+    fi
+    printf '%s\n' "$dest"
+}
+
+_virtctl_add_install_dir_to_path() {
+    local dest="$1"
+    [[ "$dest" == "/usr/local/bin" ]] || export PATH="${dest}:${PATH}"
+}
+
+# Set to 1 when ConsoleCLIDownload returned a body that was not a gzip tarball.
+# TLS retry (-k) cannot help in that case; callers should skip it.
+_VIRTCTL_CLUSTER_DOWNLOAD_NONGZIP=0
+
 # Downloads and installs virtctl using the provided curl TLS arguments.
+# Returns 1 on failure (does not die) so callers can fall back.
 # Usage: _download_and_install_virtctl [curl_tls_args...]
 # Example: _download_and_install_virtctl --cacert /path/to/ca.pem
 #          _download_and_install_virtctl -k
 _download_and_install_virtctl() {
     # CI Prow workers are always Linux x86_64 (n2-standard-8 machine type).
-    local download_url
-    download_url="$(oc get consoleclidownload virtctl-clidownloads-kubevirt-hyperconverged \
-        -o jsonpath='{.spec.links[?(@.text=="Download virtctl for Linux for x86_64")].href}' 2>/dev/null || true)"
+    local dest
+    dest="$(_virtctl_install_dir)"
+    _virtctl_add_install_dir_to_path "$dest"
+    _VIRTCTL_CLUSTER_DOWNLOAD_NONGZIP=0
+
+    # ConsoleCLIDownload can exist while the ingress backend still serves HTML.
+    # Wait for the href, then retry until the body is a gzip tarball.
+    local download_url=""
+    local attempt=0
+    while (( attempt < 30 )); do
+        attempt=$((attempt + 1))
+        download_url="$(oc get consoleclidownload virtctl-clidownloads-kubevirt-hyperconverged \
+            -o jsonpath='{.spec.links[?(@.text=="Download virtctl for Linux for x86_64")].href}' 2>/dev/null || true)"
+        if [[ -n "$download_url" ]]; then
+            break
+        fi
+        info "Waiting for ConsoleCLIDownload virtctl href (${attempt}/30)"
+        sleep 10
+    done
     if [[ -z "$download_url" ]]; then
-        die "virtctl not found on PATH and ConsoleCLIDownload resource not available"
+        warn "virtctl not found on PATH and ConsoleCLIDownload resource not available"
+        return 1
     fi
 
-    local dest="/usr/local/bin"
-    if [[ ! -w "$dest" ]]; then
-        dest="$(mktemp -d)"
-        export PATH="${dest}:${PATH}"
+    local cli_deploy="hyperconverged-cluster-cli-download"
+    if oc get deploy -n openshift-cnv "$cli_deploy" >/dev/null 2>&1; then
+        info "Waiting for ${cli_deploy} rollout..."
+        oc rollout status "deploy/${cli_deploy}" -n openshift-cnv --timeout=300s || true
     fi
 
+    local archive saw_nongzip=0
+    archive="$(mktemp)"
     info "Downloading virtctl from ${download_url}"
-    if ! curl -sSL "$@" "$download_url" | tar xz -C "$dest" virtctl; then
-        die "Failed to download virtctl from ${download_url}"
+    attempt=0
+    while (( attempt < 30 )); do
+        attempt=$((attempt + 1))
+        if curl -sSL --connect-timeout 30 --max-time 120 "$@" -o "$archive" "$download_url"; then
+            if gzip -t "$archive" 2>/dev/null \
+                && tar xz -C "$dest" virtctl -f "$archive" \
+                && [[ -f "${dest}/virtctl" ]]; then
+                rm -f "$archive"
+                chmod +x "${dest}/virtctl"
+                info "virtctl installed at ${dest}/virtctl"
+                return 0
+            fi
+            saw_nongzip=1
+        fi
+        info "virtctl tarball not ready yet (attempt ${attempt}/30), retrying in 10s"
+        sleep 10
+    done
+    rm -f "$archive"
+    _VIRTCTL_CLUSTER_DOWNLOAD_NONGZIP=$saw_nongzip
+    warn "Failed to download virtctl from ${download_url}"
+    return 1
+}
+
+# True when $1 is a kubevirt/kubevirt GitHub release tag (v1.6.0 or 1.6.0).
+# Image digests (sha256:...) and two-part versions (v1.6) are not release tags.
+_is_kubevirt_github_release_tag() {
+    [[ "$1" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
+}
+
+_normalize_kubevirt_github_tag() {
+    local v="$1"
+    if [[ "$v" == v* ]]; then
+        printf '%s\n' "$v"
+    else
+        printf 'v%s\n' "$v"
     fi
-    if [[ ! -f "${dest}/virtctl" ]]; then
-        die "Downloaded archive from ${download_url} does not contain virtctl"
+}
+
+# Prints a kubevirt/kubevirt GitHub release tag to stdout (logs go to stderr).
+# CNV digest-pins operand images, so observedKubeVirtVersion is often sha256:...;
+# those values are skipped. If the CR has no tag, use GitHub's latest release.
+_kubevirt_github_release_tag() {
+    local v
+    while IFS= read -r v; do
+        [[ -n "$v" ]] || continue
+        if _is_kubevirt_github_release_tag "$v"; then
+            _normalize_kubevirt_github_tag "$v"
+            return 0
+        fi
+        warn "Ignoring KubeVirt version ${v}: not a GitHub release tag" >&2
+    done <<EOF
+$(oc get kubevirt -n openshift-cnv -o jsonpath='{.items[0].status.observedKubeVirtVersion}' 2>/dev/null || true)
+$(oc get kubevirt -n openshift-cnv -o jsonpath='{.items[0].status.targetKubeVirtVersion}' 2>/dev/null || true)
+$(oc get deploy virt-operator -n openshift-cnv -o jsonpath='{range .spec.template.spec.containers[*].env[?(@.name=="KUBEVIRT_VERSION")]}{.value}{"\n"}{end}' 2>/dev/null || true)
+EOF
+
+    local latest_url tag
+    latest_url="$(curl -fsSL --connect-timeout 30 --max-time 60 --retry 5 --retry-delay 5 -o /dev/null -w '%{url_effective}' \
+        https://github.com/kubevirt/kubevirt/releases/latest)" || return 1
+    tag="${latest_url##*/}"
+    if ! _is_kubevirt_github_release_tag "$tag"; then
+        warn "GitHub latest release URL did not end in a tag: ${latest_url}" >&2
+        return 1
     fi
-    chmod +x "${dest}/virtctl"
-    info "virtctl installed at ${dest}/virtctl"
+    tag="$(_normalize_kubevirt_github_tag "$tag")"
+    info "No cluster KubeVirt GitHub tag; using latest release ${tag}" >&2
+    printf '%s\n' "$tag"
+    return 0
+}
+
+# Installs virtctl from a kubevirt/kubevirt GitHub release.
+# ConsoleCLIDownload can stay on HTML while CNV's CSV is Installing or Failed.
+_install_virtctl_from_kubevirt_release() {
+    local version dest url bin
+    version="$(_kubevirt_github_release_tag)" || {
+        warn "Could not resolve a kubevirt/kubevirt GitHub release tag for virtctl"
+        return 1
+    }
+
+    dest="$(_virtctl_install_dir)"
+    _virtctl_add_install_dir_to_path "$dest"
+    url="https://github.com/kubevirt/kubevirt/releases/download/${version}/virtctl-${version}-linux-amd64"
+    bin="${dest}/virtctl"
+    info "Downloading virtctl ${version} from ${url}"
+    if ! curl -fsSL --connect-timeout 30 --max-time 120 --retry 5 --retry-delay 5 -o "$bin" "$url"; then
+        warn "GitHub virtctl download failed from ${url}"
+        rm -f "$bin"
+        return 1
+    fi
+    if [[ "$(head -c 4 "$bin")" != $'\x7fELF' ]]; then
+        warn "GitHub virtctl download was not an ELF binary"
+        rm -f "$bin"
+        return 1
+    fi
+    chmod +x "$bin"
+    info "virtctl installed at ${bin}"
+    return 0
 }
 
 # Downloads virtctl from ConsoleCLIDownload using verified TLS only.
 ensure_virtctl_binary() {
     _use_existing_virtctl_binary_if_available && return
 
-    local ca_bundle
+    local ca_bundle rc=0
     ca_bundle="$(_fetch_cluster_ingress_ca)"
-    _download_and_install_virtctl --cacert "$ca_bundle"
+    _download_and_install_virtctl --cacert "$ca_bundle" || rc=$?
     rm -f "$ca_bundle"
+    return "$rc"
 }
 
 # Downloads virtctl from ConsoleCLIDownload with curl -k.
@@ -119,3 +270,79 @@ ensure_virtctl_binary_insecure() {
     is_CI || die "Secure virtctl download failed; refusing insecure curl -k fallback outside CI. Set VIRTCTL_PATH or fix cluster ingress trust material."
     _download_and_install_virtctl -k
 }
+
+# Host-side files shared between the Go suite (via exported env) and post-test
+# guest journal collection. Kept out of test_outputs so the private key is not
+# uploaded as a CI artifact.
+vm_scan_e2e_dir() {
+    printf '%s\n' "${VM_SCAN_E2E_DIR:-/tmp/vm-scan-e2e}"
+}
+
+# export_vm_scan_public_key fills VM_SSH_PUBLIC_KEY from identity when unset.
+# LoadVMScanConfig requires both halves of the keypair.
+export_vm_scan_public_key() {
+    local identity="$1"
+    if [[ -n "${VM_SSH_PUBLIC_KEY:-}" ]]; then
+        return 0
+    fi
+    if [[ -f "${identity}.pub" ]]; then
+        VM_SSH_PUBLIC_KEY="$(<"${identity}.pub")"
+        export VM_SSH_PUBLIC_KEY
+        return 0
+    fi
+    VM_SSH_PUBLIC_KEY="$(ssh-keygen -y -f "$identity")"
+    printf '%s\n' "$VM_SSH_PUBLIC_KEY" > "${identity}.pub"
+    export VM_SSH_PUBLIC_KEY
+}
+
+# ensure_vm_scan_ssh_identity writes or reuses an SSH key under vm_scan_e2e_dir
+# so the Go suite and post-test guest log collection share the same identity.
+ensure_vm_scan_ssh_identity() {
+    local dir identity
+    dir="$(vm_scan_e2e_dir)"
+    mkdir -p "$dir"
+    identity="${dir}/ssh-identity"
+
+    if [[ -n "${VM_SSH_PRIVATE_KEY:-}" ]]; then
+        printf '%s\n' "${VM_SSH_PRIVATE_KEY}" > "$identity"
+        chmod 600 "$identity"
+        export VM_SSH_PRIVATE_KEY_PATH="$identity"
+        export_vm_scan_public_key "$identity"
+        return 0
+    fi
+
+    if [[ -f "$identity" ]]; then
+        export VM_SSH_PRIVATE_KEY_PATH="$identity"
+        VM_SSH_PRIVATE_KEY="$(<"$identity")"
+        export VM_SSH_PRIVATE_KEY
+        export_vm_scan_public_key "$identity"
+        return 0
+    fi
+
+    ssh-keygen -t ed25519 -f "$identity" -N "" -C "stackrox-vm-scan-e2e" >/dev/null
+    chmod 600 "$identity"
+    VM_SSH_PRIVATE_KEY="$(<"$identity")"
+    VM_SSH_PUBLIC_KEY="$(<"${identity}.pub")"
+    export VM_SSH_PRIVATE_KEY VM_SSH_PUBLIC_KEY VM_SSH_PRIVATE_KEY_PATH="$identity"
+    info "Ephemeral VM scan SSH identity written to ${identity}"
+}
+
+# persist_vm_scan_virtctl copies virtctl next to the SSH identity and records
+# the resolved path so post-test can find it after the test process's PATH
+# goes away.
+persist_vm_scan_virtctl() {
+    local dir src dest
+    dir="$(vm_scan_e2e_dir)"
+    mkdir -p "$dir"
+    src="$(command -v virtctl)" || {
+        info "virtctl not on PATH; post-test guest journal collection will skip"
+        return 0
+    }
+    printf '%s\n' "$src" > "${dir}/virtctl-path"
+    dest="${dir}/virtctl"
+    if cp "$src" "$dest" && chmod +x "$dest"; then
+        info "Persisted virtctl to ${dest} for post-test guest journal collection"
+    else
+        info "Could not copy virtctl to ${dest}; post-test will use ${src}"
+    fi
+}
diff --git a/tests/e2e/yaml/central-cr-with-scanner-v4.envsubst.yaml b/tests/e2e/yaml/central-cr-with-scanner-v4.envsubst.yaml
index 033de928d570a..2dd550ae2f319 100644
--- a/tests/e2e/yaml/central-cr-with-scanner-v4.envsubst.yaml
+++ b/tests/e2e/yaml/central-cr-with-scanner-v4.envsubst.yaml
@@ -59,10 +59,8 @@ $centralAdditionalCAIndented
       resources:
         requests:
           cpu: "400m"
-          memory: "2000Mi"
         limits:
           cpu: "6000m"
-          memory: "2000Mi"
     db:
       resources:
         requests:
diff --git a/tests/e2e/yaml/secured-cluster-cr-with-scanner-v4.envsubst.yaml b/tests/e2e/yaml/secured-cluster-cr-with-scanner-v4.envsubst.yaml
index 562c133c359e7..095b276054fc0 100644
--- a/tests/e2e/yaml/secured-cluster-cr-with-scanner-v4.envsubst.yaml
+++ b/tests/e2e/yaml/secured-cluster-cr-with-scanner-v4.envsubst.yaml
@@ -34,7 +34,6 @@ spec:
           memory: "100Mi"
           cpu: "100m"
   virtualMachines:
-    mode: $vm_mode_setting
     scraper:
       pollInterval: $vm_scraper_poll_interval
   processIndicators:
diff --git a/tests/e2e/yaml/secured-cluster-cr.envsubst.yaml b/tests/e2e/yaml/secured-cluster-cr.envsubst.yaml
index 93f2755175b2c..08e63724423ac 100644
--- a/tests/e2e/yaml/secured-cluster-cr.envsubst.yaml
+++ b/tests/e2e/yaml/secured-cluster-cr.envsubst.yaml
@@ -9,7 +9,6 @@ spec:
     fileActivityMonitoring:
       mode: $fam_mode_setting
   virtualMachines:
-    mode: $vm_mode_setting
     scraper:
       pollInterval: $vm_scraper_poll_interval
   processIndicators:
diff --git a/tests/excluded_scopes_test.go b/tests/excluded_scopes_test.go
index b21757b007652..f1fd7e827fa97 100644
--- a/tests/excluded_scopes_test.go
+++ b/tests/excluded_scopes_test.go
@@ -20,7 +20,7 @@ func TestExcludedScopes(t *testing.T) {
 	deploymentName := fmt.Sprintf("test-excluded-scopes-%d", rand.Intn(10000))
 
 	setupDeploymentInNamespace(t, "quay.io/rhacs-eng/qa-multi-arch-nginx:latest", deploymentName, "default")
-	defer teardownDeploymentWithoutCheck(t, deploymentName, "default")
+	defer teardownDeployment(t, deploymentName, "default")
 	waitForDeploymentInCentral(t, deploymentName)
 
 	verifyNoAlertForExcludedScopes(t, deploymentName)
@@ -48,10 +48,9 @@ func verifyNoAlertForExcludedScopes(t *testing.T, deploymentName string) {
 	require.NoError(t, err)
 
 	latestPolicy.Exclusions = []*storage.Exclusion{
-		{
-			Deployment: &storage.Exclusion_Deployment{
-				Name: deploymentName,
-			},
+		{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+			Name: deploymentName,
+		}},
 		},
 	}
 	ctx, cancel = context.WithTimeout(context.Background(), time.Minute)
diff --git a/tests/external_backup_test.go b/tests/external_backup_test.go
index 36617867a31f8..f8646549caf38 100644
--- a/tests/external_backup_test.go
+++ b/tests/external_backup_test.go
@@ -31,11 +31,17 @@ import (
 	"google.golang.org/grpc/status"
 )
 
+const (
+	backupRetryTries         = 5
+	backupRetryInterval      = 10 * time.Second
+	centralReadinessMaxTries = 10
+)
+
 type backupTestCase struct {
 	name  string
 	setup func(t *testing.T) (
 		backup *storage.ExternalBackup,
-		countBackups func(ctx context.Context, t *testing.T, prefix string) int,
+		countBackups func(ctx context.Context, t *testing.T, prefix string) (int, error),
 		cleanupBackups func(ctx context.Context, t *testing.T, prefix string),
 	)
 }
@@ -51,7 +57,7 @@ func newObjectPrefix() string {
 }
 
 func newGCSBucketFuncs(t *testing.T, bucket, serviceAccount string) (
-	countFn func(ctx context.Context, t *testing.T, prefix string) int,
+	countFn func(ctx context.Context, t *testing.T, prefix string) (int, error),
 	cleanupFn func(ctx context.Context, t *testing.T, prefix string),
 ) {
 	var opts []option.ClientOption
@@ -62,15 +68,17 @@ func newGCSBucketFuncs(t *testing.T, bucket, serviceAccount string) (
 	require.NoError(t, err)
 
 	bkt := client.Bucket(bucket)
-	countFn = func(ctx context.Context, t *testing.T, prefix string) int {
+	countFn = func(ctx context.Context, _ *testing.T, prefix string) (int, error) {
 		it := bkt.Objects(ctx, &googleStorage.Query{Prefix: prefix})
 		count := 0
 		var iterErr error
 		for _, iterErr = it.Next(); iterErr == nil; _, iterErr = it.Next() {
 			count++
 		}
-		require.Equal(t, iterator.Done, iterErr)
-		return count
+		if iterErr != iterator.Done {
+			return 0, iterErr
+		}
+		return count, nil
 	}
 	cleanupFn = func(ctx context.Context, t *testing.T, prefix string) {
 		it := bkt.Objects(ctx, &googleStorage.Query{Prefix: prefix})
@@ -95,8 +103,9 @@ func gcsTestCases() []backupTestCase {
 	return []backupTestCase{
 		{
 			name: "GCS/service_account_key",
-			setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) int, func(context.Context, *testing.T, string)) {
-				env := testutils.EnvOrFail(t,
+			setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) (int, error), func(context.Context, *testing.T, string)) {
+				env := testutils.EnvOrFail(
+					t,
 					"GCP_GCS_BACKUP_TEST_BUCKET_NAME_V2",
 					"GOOGLE_GCS_BACKUP_SERVICE_ACCOUNT_V2",
 				)
@@ -113,7 +122,7 @@ func gcsTestCases() []backupTestCase {
 		},
 		{
 			name: "GCS/workload_identity",
-			setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) int, func(context.Context, *testing.T, string)) {
+			setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) (int, error), func(context.Context, *testing.T, string)) {
 				env := testutils.EnvOrSkip(t, "GCP_GCS_BACKUP_TEST_BUCKET_NAME_V2", "SETUP_WORKLOAD_IDENTITIES")
 				if env["SETUP_WORKLOAD_IDENTITIES"] != "true" {
 					t.Skip("SETUP_WORKLOAD_IDENTITIES not set to true")
@@ -132,10 +141,11 @@ func gcsTestCases() []backupTestCase {
 }
 
 func newS3BucketFuncs(t *testing.T, endpoint, region, accessKeyID, secretAccessKey, bucket string, pathStyle bool) (
-	countFn func(ctx context.Context, t *testing.T, prefix string) int,
+	countFn func(ctx context.Context, t *testing.T, prefix string) (int, error),
 	cleanupFn func(ctx context.Context, t *testing.T, prefix string),
 ) {
-	cfg, err := awsConfig.LoadDefaultConfig(context.Background(),
+	cfg, err := awsConfig.LoadDefaultConfig(
+		context.Background(),
 		awsConfig.WithRegion(region),
 		awsConfig.WithCredentialsProvider(
 			credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, ""),
@@ -159,13 +169,15 @@ func newS3BucketFuncs(t *testing.T, endpoint, region, accessKeyID, secretAccessK
 	}
 	client := s3.NewFromConfig(cfg, clientOpts...)
 
-	countFn = func(ctx context.Context, t *testing.T, prefix string) int {
+	countFn = func(ctx context.Context, _ *testing.T, prefix string) (int, error) {
 		out, err := client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
 			Bucket: aws.String(bucket),
 			Prefix: aws.String(prefix),
 		})
-		require.NoError(t, err)
-		return int(aws.ToInt32(out.KeyCount))
+		if err != nil {
+			return 0, err
+		}
+		return int(aws.ToInt32(out.KeyCount)), nil
 	}
 	cleanupFn = func(ctx context.Context, t *testing.T, prefix string) {
 		out, err := client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
@@ -192,7 +204,7 @@ func newAWSS3Setup(name string, makeConfig func(t *testing.T) *storage.S3Config)
 	fullName := "AWS_S3/" + name
 	return backupTestCase{
 		name: fullName,
-		setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) int, func(context.Context, *testing.T, string)) {
+		setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) (int, error), func(context.Context, *testing.T, string)) {
 			config := makeConfig(t)
 			config.ObjectPrefix = newObjectPrefix()
 			countFn, cleanupFn := newS3BucketFuncs(t, "", config.GetRegion(),
@@ -208,7 +220,8 @@ func newAWSS3Setup(name string, makeConfig func(t *testing.T) *storage.S3Config)
 
 func awsS3Config(withEndpoint bool) func(t *testing.T) *storage.S3Config {
 	return func(t *testing.T) *storage.S3Config {
-		env := testutils.EnvOrFail(t,
+		env := testutils.EnvOrFail(
+			t,
 			"AWS_S3_BACKUP_TEST_BUCKET_NAME",
 			"AWS_S3_BACKUP_TEST_BUCKET_REGION",
 			"AWS_ACCESS_KEY_ID",
@@ -238,7 +251,7 @@ func newS3CompatibleSetup(name string, makeConfig func(t *testing.T) *storage.S3
 	fullName := "S3Compatible/" + name
 	return backupTestCase{
 		name: fullName,
-		setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) int, func(context.Context, *testing.T, string)) {
+		setup: func(t *testing.T) (*storage.ExternalBackup, func(context.Context, *testing.T, string) (int, error), func(context.Context, *testing.T, string)) {
 			config := makeConfig(t)
 			config.ObjectPrefix = newObjectPrefix()
 			pathStyle := config.GetUrlStyle() == storage.S3URLStyle_S3_URL_STYLE_PATH
@@ -255,7 +268,8 @@ func newS3CompatibleSetup(name string, makeConfig func(t *testing.T) *storage.S3
 
 func r2Config(withScheme bool, urlStyle storage.S3URLStyle) func(t *testing.T) *storage.S3Compatible {
 	return func(t *testing.T) *storage.S3Compatible {
-		env := testutils.EnvOrFail(t,
+		env := testutils.EnvOrFail(
+			t,
 			"CLOUDFLARE_R2_BACKUP_TEST_ACCOUNT_ID",
 			"CLOUDFLARE_R2_BACKUP_TEST_BUCKET_NAME",
 			"CLOUDFLARE_R2_BACKUP_TEST_REGION",
@@ -276,7 +290,8 @@ func r2Config(withScheme bool, urlStyle storage.S3URLStyle) func(t *testing.T) *
 
 func odfConfig(withScheme bool) func(t *testing.T) *storage.S3Compatible {
 	return func(t *testing.T) *storage.S3Compatible {
-		env := testutils.EnvOrFail(t,
+		env := testutils.EnvOrFail(
+			t,
 			"ODF_S3_BACKUP_TEST_ENDPOINT",
 			"ODF_S3_BACKUP_TEST_BUCKET_NAME",
 			"ODF_S3_BACKUP_TEST_REGION",
@@ -310,11 +325,40 @@ func s3CompatibleTestCases() []backupTestCase {
 	}
 }
 
+func requireBackupCount(
+	t *testing.T,
+	countBackups func(ctx context.Context, t *testing.T, prefix string) (int, error),
+	prefix string,
+	expected int,
+) error {
+	return retry.WithRetry(
+		func() error {
+			ctx, cancel := context.WithTimeout(context.Background(), backupRetryInterval)
+			defer cancel()
+			n, err := countBackups(ctx, t, prefix)
+			if err != nil {
+				return err
+			}
+			if n != expected {
+				return fmt.Errorf("expected %d backups, got %d", expected, n)
+			}
+			return nil
+		},
+		retry.Tries(backupRetryTries),
+		retry.BetweenAttempts(func(_ int) {
+			time.Sleep(backupRetryInterval)
+		}),
+		retry.OnFailedAttempts(func(err error) {
+			t.Logf("Error verifying backup count: %v", err)
+		}),
+	)
+}
+
 func runBackupLifecycleTest(
 	t *testing.T,
 	service v1.ExternalBackupServiceClient,
 	backup *storage.ExternalBackup,
-	countBackups func(ctx context.Context, t *testing.T, prefix string) int,
+	countBackups func(ctx context.Context, t *testing.T, prefix string) (int, error),
 	cleanupBackups func(ctx context.Context, t *testing.T, prefix string),
 ) {
 	var prefix string
@@ -330,15 +374,16 @@ func runBackupLifecycleTest(
 	t.Logf("Using object prefix: %s", prefix)
 
 	// Retry TestExternalBackup in case Central is not fully ready yet.
-	err := retry.WithRetry(func() error {
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-		_, err := service.TestExternalBackup(ctx, backup)
-		return err
-	},
-		retry.Tries(10),
+	err := retry.WithRetry(
+		func() error {
+			ctx, cancel := context.WithTimeout(context.Background(), backupRetryInterval)
+			defer cancel()
+			_, err := service.TestExternalBackup(ctx, backup)
+			return err
+		},
+		retry.Tries(centralReadinessMaxTries),
 		retry.BetweenAttempts(func(_ int) {
-			time.Sleep(10 * time.Second)
+			time.Sleep(backupRetryInterval)
 		}),
 		retry.OnFailedAttempts(func(err error) {
 			t.Logf("Error testing external backup: %v", err)
@@ -364,9 +409,7 @@ func runBackupLifecycleTest(
 		}
 	})
 
-	countCtx, countCancel := context.WithTimeout(context.Background(), 10*time.Second)
-	assert.Equal(t, 0, countBackups(countCtx, t, prefix))
-	countCancel()
+	require.NoError(t, requireBackupCount(t, countBackups, prefix, 0))
 
 	for i := 1; i <= 3; i++ {
 		triggerCtx, triggerCancel := context.WithTimeout(context.Background(), 2*time.Minute)
@@ -375,31 +418,12 @@ func runBackupLifecycleTest(
 		triggerCancel()
 
 		if i <= 2 {
-			verifyCtx, verifyCancel := context.WithTimeout(context.Background(), 10*time.Second)
-			assert.Equal(t, i, countBackups(verifyCtx, t, prefix))
-			verifyCancel()
+			assert.NoError(t, requireBackupCount(t, countBackups, prefix, i))
 		}
 	}
 
 	// Third backup should prune the first, keeping only BackupsToKeep=2.
-	err = retry.WithRetry(func() error {
-		retryCtx, retryCancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer retryCancel()
-		n := countBackups(retryCtx, t, prefix)
-		if n != 2 {
-			return fmt.Errorf("expected 2 backups after pruning, got %d", n)
-		}
-		return nil
-	},
-		retry.Tries(10),
-		retry.BetweenAttempts(func(_ int) {
-			time.Sleep(1 * time.Second)
-		}),
-		retry.OnFailedAttempts(func(err error) {
-			t.Logf("Error waiting for backup pruning: %v", err)
-		}),
-	)
-	require.NoError(t, err)
+	require.NoError(t, requireBackupCount(t, countBackups, prefix, 2))
 }
 
 func TestExternalBackup(t *testing.T) {
diff --git a/tests/feature_flag_test.go b/tests/feature_flag_test.go
index 06fc74f723500..8a6f15ffea975 100644
--- a/tests/feature_flag_test.go
+++ b/tests/feature_flag_test.go
@@ -28,6 +28,8 @@ var (
 	}
 )
 
+// TestFeatureFlagSettings asserts Central's live flags match flag.Enabled()
+// computed in this process from the same environment and build type.
 func TestFeatureFlagSettings(t *testing.T) {
 	if os.Getenv("ORCHESTRATOR_FLAVOR") == "openshift" {
 		t.Skip("Skipping on OCP: ci_export uses cci-export which does not set shell variables, causing systemic mismatch between test runner and Central")
@@ -37,23 +39,13 @@ func TestFeatureFlagSettings(t *testing.T) {
 
 	conn := centralgrpc.GRPCConnectionToCentral(t)
 
-	metadataService := v1.NewMetadataServiceClient(conn)
-	metadata, err := metadataService.GetMetadata(ctx, &v1.Empty{})
-	require.NoError(t, err, "failed to retrieve metadata")
-
 	expectedFlagVals := make(map[string]bool)
 	for _, flag := range features.Flags {
 		if skipFeatures[flag.EnvVar()] {
 			continue
 		}
 
-		// For non-release builds, test that feature flag settings match the local environment;
-		// for release builds, test that they match the defaults.
-		expectedVal := flag.Enabled()
-		if metadata.GetReleaseBuild() {
-			expectedVal = flag.Default()
-		}
-		expectedFlagVals[flag.EnvVar()] = expectedVal
+		expectedFlagVals[flag.EnvVar()] = flag.Enabled()
 	}
 
 	featureFlagService := v1.NewFeatureFlagServiceClient(conn)
diff --git a/tests/init_container_test.go b/tests/init_container_test.go
index ebf7a61e4b431..c7b108dbbf12a 100644
--- a/tests/init_container_test.go
+++ b/tests/init_container_test.go
@@ -180,12 +180,38 @@ func (s *InitContainerSuite) createPolicyWithCleanup(policy *storage.Policy) *st
 }
 
 func (s *InitContainerSuite) waitForViolationAlert(deploymentName, policyName string, expectedCount int) {
+	waitForAlert(s.T(), s.alertService, s.violationAlertRequest(deploymentName, policyName), expectedCount)
+}
+
+// activeViolationText waits until one active alert exists and returns its violation messages.
+func (s *InitContainerSuite) activeViolationText(deploymentName, policyName string) string {
+	s.waitForViolationAlert(deploymentName, policyName, 1)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+	listResp, err := s.alertService.ListAlerts(ctx, s.violationAlertRequest(deploymentName, policyName))
+	cancel()
+	s.Require().NoError(err)
+	s.Require().Len(listResp.GetAlerts(), 1)
+
+	ctx, cancel = context.WithTimeout(context.Background(), time.Minute)
+	alert, err := s.alertService.GetAlert(ctx, &v1.ResourceByID{Id: listResp.GetAlerts()[0].GetId()})
+	cancel()
+	s.Require().NoError(err)
+	s.Require().NotEmpty(alert.GetViolations())
+
+	messages := make([]string, 0, len(alert.GetViolations()))
+	for _, violation := range alert.GetViolations() {
+		messages = append(messages, violation.GetMessage())
+	}
+	return strings.Join(messages, "\n")
+}
+
+func (s *InitContainerSuite) violationAlertRequest(deploymentName, policyName string) *v1.ListAlertsRequest {
 	query := search.NewQueryBuilder().
 		AddStrings(search.DeploymentName, deploymentName).
 		AddStrings(search.PolicyName, policyName).
 		AddStrings(search.ViolationState, storage.ViolationState_ACTIVE.String())
-
-	waitForAlert(s.T(), s.alertService, &v1.ListAlertsRequest{Query: query.Query()}, expectedCount)
+	return &v1.ListAlertsRequest{Query: query.Query()}
 }
 
 func (s *InitContainerSuite) TestInitContainerExtraction() {
@@ -381,28 +407,85 @@ func (s *InitContainerSuite) TestPolicyEvaluatesBothContainerTypes() {
 	t.Logf("Verified: both init and regular containers with :latest tag triggered policy violation")
 }
 
-func (s *InitContainerSuite) TestEvaluationFilterSkipsInitContainers() {
+func (s *InitContainerSuite) TestEvaluationFilterSkipsContainers() {
 	t := s.T()
 	ns := fmt.Sprintf("init-test-filter-%d", rand.IntN(10000))
 	createNamespaceWithLabels(t, ns, nil)
 	defer deleteNamespace(t, ns)
 
-	policy := s.newLatestTagPolicy(
-		fmt.Sprintf("Test - Skip Init %d", rand.IntN(10000)), ns,
-	)
-	policy.EvaluationFilter = &storage.EvaluationFilter{
-		SkipContainerTypes: []storage.ContainerType{storage.ContainerType_INIT},
-	}
-	createdPolicy := s.createPolicyWithCleanup(policy)
+	unfiltered := s.createPolicyWithCleanup(s.newLatestTagPolicy(
+		fmt.Sprintf("Test - Evaluate Init %d", rand.IntN(10000)), ns,
+	))
+
+	s.Require().Empty(unfiltered.GetEvaluationFilter().GetSkipContainerTypes())
 
-	// Init uses :latest (would violate), regular uses tagged image (no violation).
-	// With skip-init filter, the only violating container is skipped — expect 0 alerts.
+	// Both containers use :latest. Require an alert naming both before checking filters.
 	deployName := fmt.Sprintf("init-filter-skip-%d", rand.IntN(10000))
-	s.createDeploymentWithInitContainers(deployName, ns, []string{busyboxLatest}, nginxTagged)
+	s.createDeploymentWithInitContainers(deployName, ns, []string{busyboxLatest}, nginxLatest)
 	defer teardownDeploymentWithoutCheck(t, deployName, ns)
 
-	s.waitForDeploymentWithContainers(deployName, 2)
+	dep := s.waitForDeploymentWithContainers(deployName, 2)
+	var initContainer, regularContainer *storage.Container
+	for _, c := range dep.GetContainers() {
+		switch c.GetType() {
+		case storage.ContainerType_INIT:
+			initContainer = c
+		case storage.ContainerType_REGULAR:
+			regularContainer = c
+		}
+	}
+	s.Require().NotNil(initContainer, "expected an init container")
+	s.Require().NotNil(regularContainer, "expected a regular container")
+	s.Equal("init-0", initContainer.GetName())
+	s.Equal(deployName, regularContainer.GetName())
+	s.Contains(initContainer.GetImage().GetName().GetFullName(), "busybox")
+	s.Contains(regularContainer.GetImage().GetName().GetFullName(), "nginx")
 
-	s.waitForViolationAlert(deployName, createdPolicy.GetName(), 0)
-	t.Logf("Verified: policy with skip init filter produced no violations")
+	regularContainerRef := fmt.Sprintf("Container '%s'", deployName)
+	unfilteredText := s.activeViolationText(deployName, unfiltered.GetName())
+	s.Require().Contains(unfilteredText, regularContainerRef)
+	s.Require().Contains(unfilteredText, "Container 'init-0'")
+	s.Require().Contains(unfilteredText, "tag 'latest'")
+	t.Logf("Verified unfiltered alert names both containers: %s", unfilteredText)
+
+	tests := map[string]struct {
+		skipType           storage.ContainerType
+		evaluatedContainer string
+		skippedContainer   string
+		skippedImage       string
+	}{
+		"skip init": {
+			skipType:           storage.ContainerType_INIT,
+			evaluatedContainer: deployName,
+			skippedContainer:   "init-0",
+			skippedImage:       "busybox",
+		},
+		"skip regular": {
+			skipType:           storage.ContainerType_REGULAR,
+			evaluatedContainer: "init-0",
+			skippedContainer:   deployName,
+			skippedImage:       "nginx",
+		},
+	}
+	for name, tc := range tests {
+		s.Run(name, func() {
+			policy := s.newLatestTagPolicy(fmt.Sprintf("Test - %s %d", name, rand.IntN(10000)), ns)
+			policy.EvaluationFilter = &storage.EvaluationFilter{
+				SkipContainerTypes: []storage.ContainerType{tc.skipType},
+			}
+			filtered := s.createPolicyWithCleanup(policy)
+
+			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+			storedPolicy, err := s.policyService.GetPolicy(ctx, &v1.ResourceByID{Id: filtered.GetId()})
+			cancel()
+			s.Require().NoError(err)
+			s.Require().Equal([]storage.ContainerType{tc.skipType}, storedPolicy.GetEvaluationFilter().GetSkipContainerTypes())
+
+			filteredText := s.activeViolationText(deployName, filtered.GetName())
+			s.Require().Contains(filteredText, fmt.Sprintf("Container '%s'", tc.evaluatedContainer))
+			s.Require().Contains(filteredText, "tag 'latest'")
+			s.Require().NotContains(filteredText, fmt.Sprintf("Container '%s'", tc.skippedContainer))
+			s.Require().NotContains(filteredText, tc.skippedImage)
+		})
+	}
 }
diff --git a/tests/metadata_test.go b/tests/metadata_test.go
index fa9521ff7ffb8..e7af3d35aca39 100644
--- a/tests/metadata_test.go
+++ b/tests/metadata_test.go
@@ -5,25 +5,62 @@ package tests
 import (
 	"context"
 	"os"
+	"strings"
 	"testing"
 	"time"
 
 	v1 "github.com/stackrox/rox/generated/api/v1"
 	"github.com/stackrox/rox/pkg/buildinfo"
+	"github.com/stackrox/rox/pkg/clientconn"
 	"github.com/stackrox/rox/pkg/testutils/centralgrpc"
 	"github.com/stackrox/rox/pkg/version"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
 )
 
 func getMetadata(t *testing.T, conn *grpc.ClientConn) *v1.Metadata {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 	service := v1.NewMetadataServiceClient(conn)
-	metadata, err := service.GetMetadata(ctx, &v1.Empty{})
+	resp, err := service.GetMetadata(ctx, &v1.Empty{})
 	require.NoError(t, err)
-	return metadata
+	return resp
+}
+
+func TestCentralVersionHeader(t *testing.T) {
+	conn := centralgrpc.GRPCConnectionToCentral(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	var metadataMD metadata.MD
+	resp, err := v1.NewMetadataServiceClient(conn).GetMetadata(ctx, &v1.Empty{}, grpc.Header(&metadataMD))
+	require.NoError(t, err)
+
+	metadataVals := metadataMD.Get(clientconn.CentralVersionHeader)
+	require.Len(t, metadataVals, 1, "expected %s response header from GetMetadata", clientconn.CentralVersionHeader)
+	assert.Equal(t, resp.GetVersion(), metadataVals[0])
+
+	pingVals := pingAndGetHeader(t, conn, ctx)
+	require.Len(t, pingVals, 1, "expected %s response header from Ping", clientconn.CentralVersionHeader)
+	assert.Equal(t, metadataVals[0], pingVals[0], "version header must be consistent across services")
+}
+
+func TestCentralVersionHeader_AbsentForAnonymous(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	vals := pingAndGetHeader(t, centralgrpc.UnauthenticatedGRPCConnectionToCentral(t), ctx)
+	assert.Empty(t, vals, "anonymous requests must not receive %s", clientconn.CentralVersionHeader)
+}
+
+func pingAndGetHeader(t *testing.T, conn *grpc.ClientConn, ctx context.Context) []string {
+	var md metadata.MD
+	_, err := v1.NewPingServiceClient(conn).Ping(ctx, &v1.Empty{}, grpc.Header(&md))
+	require.NoError(t, err)
+	return md.Get(clientconn.CentralVersionHeader)
 }
 
 func TestMetadataIsSetCorrectly(t *testing.T) {
@@ -33,7 +70,14 @@ func TestMetadataIsSetCorrectly(t *testing.T) {
 	}
 
 	metadataWithAuth := getMetadata(t, centralgrpc.GRPCConnectionToCentral(t))
-	assert.Equal(t, buildinfo.BuildFlavor, metadataWithAuth.GetBuildFlavor())
-	assert.Equal(t, buildinfo.ReleaseBuild, metadataWithAuth.GetReleaseBuild())
-	assert.Equal(t, version.GetMainVersion(), metadataWithAuth.GetVersion())
+
+	if usingKonfluxImages() {
+		assert.Equal(t, "release", metadataWithAuth.GetBuildFlavor())
+		assert.True(t, metadataWithAuth.GetReleaseBuild())
+		assert.Equal(t, strings.TrimSuffix(version.GetMainVersion(), "-fast"), strings.TrimSuffix(metadataWithAuth.GetVersion(), "-fast"))
+	} else {
+		assert.Equal(t, buildinfo.BuildFlavor, metadataWithAuth.GetBuildFlavor())
+		assert.Equal(t, buildinfo.ReleaseBuild, metadataWithAuth.GetReleaseBuild())
+		assert.Equal(t, version.GetMainVersion(), metadataWithAuth.GetVersion())
+	}
 }
diff --git a/tests/node_report_test.go b/tests/node_report_test.go
new file mode 100644
index 0000000000000..8d1d586d0d35f
--- /dev/null
+++ b/tests/node_report_test.go
@@ -0,0 +1,661 @@
+//go:build test_e2e
+
+package tests
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+	"time"
+
+	apiV2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/pkg/testutils/centralgrpc"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestNodeReport(t *testing.T) {
+	suite.Run(t, new(NodeReportSuite))
+}
+
+type NodeReportSuite struct {
+	suite.Suite
+
+	ctx          context.Context
+	cancel       context.CancelFunc
+	service      apiV2.NodeReportServiceClient
+	imageService apiV2.ReportServiceClient
+	configIDs    []string
+}
+
+func (s *NodeReportSuite) SetupSuite() {
+	s.ctx, s.cancel = context.WithTimeout(context.Background(), 30*time.Minute)
+	conn := centralgrpc.GRPCConnectionToCentral(s.T())
+	s.service = apiV2.NewNodeReportServiceClient(conn)
+	s.imageService = apiV2.NewReportServiceClient(conn)
+	s.waitForCentralReady()
+}
+
+func (s *NodeReportSuite) waitForCentralReady() {
+	s.T().Log("Waiting for Central to be ready...")
+	s.Require().Eventually(func() bool {
+		ctx, cancel := context.WithTimeout(s.ctx, 5*time.Second)
+		defer cancel()
+		_, err := s.service.CountNodeReportConfigurations(ctx, &apiV2.RawQuery{})
+		return err == nil
+	}, 2*time.Minute, 2*time.Second, "Central did not become ready")
+}
+
+func (s *NodeReportSuite) TearDownSuite() {
+	defer s.cancel()
+	for _, id := range s.configIDs {
+		ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+		_, err := s.service.DeleteNodeReportConfiguration(ctx, &apiV2.ResourceByID{Id: id})
+		cancel()
+		if err != nil {
+			s.T().Logf("Failed to delete report config %s: %v", id, err)
+		}
+	}
+}
+
+func (s *NodeReportSuite) newNodeReportConfig(name, query string) *apiV2.ReportConfiguration {
+	return &apiV2.ReportConfiguration{
+		Name:        name,
+		Description: "E2E test node vulnerability report",
+		Type:        apiV2.ReportConfiguration_NODE_VULNERABILITY,
+		Filter: &apiV2.ReportConfiguration_NodeVulnReportFilters{
+			NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{AllVuln: true},
+				Query:     query,
+			},
+		},
+		ResourceScope: &apiV2.ResourceScope{
+			ScopeReference: &apiV2.ResourceScope_EntityScope{
+				EntityScope: &apiV2.EntityScope{
+					Rules: []*apiV2.EntityScopeRule{
+						{
+							Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+							Field:  apiV2.ScopeField_FIELD_NAME,
+							Values: []*apiV2.RuleValue{
+								{Value: "remote", MatchType: apiV2.MatchType_EXACT},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (s *NodeReportSuite) TestCreateNodeReportConfig() {
+	config := s.newNodeReportConfig("e2e-node-report-create", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err, "creating node report config")
+	s.Require().NotEmpty(created.GetId())
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	assert.Equal(s.T(), config.GetName(), created.GetName())
+	assert.Equal(s.T(), apiV2.ReportConfiguration_NODE_VULNERABILITY, created.GetType())
+
+	scope := created.GetResourceScope().GetEntityScope()
+	s.Require().NotNil(scope, "entity scope should be set on the created config")
+	s.Require().Len(scope.GetRules(), 1)
+
+	rule := scope.GetRules()[0]
+	assert.Equal(s.T(), apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER, rule.GetEntity())
+	assert.Equal(s.T(), apiV2.ScopeField_FIELD_NAME, rule.GetField())
+	s.Require().Len(rule.GetValues(), 1)
+	assert.Equal(s.T(), "remote", rule.GetValues()[0].GetValue())
+	assert.Equal(s.T(), apiV2.MatchType_EXACT, rule.GetValues()[0].GetMatchType())
+
+	filters := created.GetNodeVulnReportFilters()
+	s.Require().NotNil(filters)
+	assert.Equal(s.T(), "CVSS:>=7", filters.GetQuery())
+	assert.True(s.T(), filters.GetAllVuln())
+
+	getCtx, getCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer getCancel()
+
+	fetched, err := s.service.GetNodeReportConfiguration(getCtx, &apiV2.ResourceByID{Id: created.GetId()})
+	s.Require().NoError(err, "fetching created report config")
+	assert.Equal(s.T(), created.GetId(), fetched.GetId())
+	assert.Equal(s.T(), "CVSS:>=7", fetched.GetNodeVulnReportFilters().GetQuery())
+}
+
+func (s *NodeReportSuite) TestUpdateNodeReportConfig() {
+	config := s.newNodeReportConfig("e2e-node-report-update", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	updated, ok := proto.Clone(created).(*apiV2.ReportConfiguration)
+	s.Require().True(ok)
+	updated.Id = created.GetId()
+	updated.Description = "Updated description"
+	updated.GetNodeVulnReportFilters().Query = "Severity:CRITICAL"
+	updated.ResourceScope = &apiV2.ResourceScope{
+		ScopeReference: &apiV2.ResourceScope_EntityScope{
+			EntityScope: &apiV2.EntityScope{
+				Rules: []*apiV2.EntityScopeRule{
+					{
+						Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+						Field:  apiV2.ScopeField_FIELD_NAME,
+						Values: []*apiV2.RuleValue{
+							{Value: "prod-.*", MatchType: apiV2.MatchType_REGEX},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	updateCtx, updateCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer updateCancel()
+
+	_, err = s.service.UpdateNodeReportConfiguration(updateCtx, updated)
+	s.Require().NoError(err, "updating node report config")
+
+	getCtx, getCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer getCancel()
+
+	fetched, err := s.service.GetNodeReportConfiguration(getCtx, &apiV2.ResourceByID{Id: created.GetId()})
+	s.Require().NoError(err)
+
+	assert.Equal(s.T(), "Updated description", fetched.GetDescription())
+	assert.Equal(s.T(), "Severity:CRITICAL", fetched.GetNodeVulnReportFilters().GetQuery())
+
+	fetchedScope := fetched.GetResourceScope().GetEntityScope()
+	s.Require().NotNil(fetchedScope)
+	s.Require().Len(fetchedScope.GetRules(), 1)
+
+	fetchedRule := fetchedScope.GetRules()[0]
+	assert.Equal(s.T(), apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER, fetchedRule.GetEntity())
+	assert.Equal(s.T(), apiV2.ScopeField_FIELD_NAME, fetchedRule.GetField())
+	s.Require().Len(fetchedRule.GetValues(), 1)
+	assert.Equal(s.T(), "prod-.*", fetchedRule.GetValues()[0].GetValue())
+	assert.Equal(s.T(), apiV2.MatchType_REGEX, fetchedRule.GetValues()[0].GetMatchType())
+}
+
+func (s *NodeReportSuite) TestListAndCountNodeReportConfigs() {
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	config1, err := s.service.PostNodeReportConfiguration(ctx, s.newNodeReportConfig("e2e-node-list-1", "CVSS:>=7"))
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, config1.GetId())
+
+	config2, err := s.service.PostNodeReportConfiguration(ctx, s.newNodeReportConfig("e2e-node-list-2", "CVSS:>=8"))
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, config2.GetId())
+
+	config3, err := s.service.PostNodeReportConfiguration(ctx, s.newNodeReportConfig("e2e-node-list-3", "CVSS:>=9"))
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, config3.GetId())
+
+	listCtx, listCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer listCancel()
+
+	listResp, err := s.service.ListNodeReportConfigurations(listCtx, &apiV2.RawQuery{})
+	s.Require().NoError(err)
+	s.Require().GreaterOrEqual(len(listResp.GetReportConfigs()), 3, "should have at least 3 configs")
+
+	countCtx, countCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer countCancel()
+
+	countResp, err := s.service.CountNodeReportConfigurations(countCtx, &apiV2.RawQuery{})
+	s.Require().NoError(err)
+	s.Require().GreaterOrEqual(countResp.GetCount(), int32(3), "count should be at least 3")
+
+	for _, config := range listResp.GetReportConfigs() {
+		assert.Equal(s.T(), apiV2.ReportConfiguration_NODE_VULNERABILITY, config.GetType(),
+			"list should only return NODE_VULNERABILITY type configs")
+	}
+}
+
+func (s *NodeReportSuite) TestImageServiceDoesNotExposeNodeConfigs() {
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, s.newNodeReportConfig("e2e-node-not-in-image-list", "CVSS:>=7"))
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	_, err = s.imageService.GetReportConfiguration(ctx, &apiV2.ResourceByID{Id: created.GetId()})
+	s.Require().Error(err, "image report service must not return node configurations")
+
+	listResp, err := s.imageService.ListReportConfigurations(ctx, &apiV2.RawQuery{})
+	s.Require().NoError(err)
+	for _, cfg := range listResp.GetReportConfigs() {
+		s.NotEqual(created.GetId(), cfg.GetId())
+		s.NotEqual(apiV2.ReportConfiguration_NODE_VULNERABILITY, cfg.GetType())
+	}
+}
+
+func (s *NodeReportSuite) TestViewBasedNodeReport() {
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	runResp, err := s.service.PostViewBasedNodeReport(ctx, &apiV2.ReportRequestViewBased{
+		Type:          apiV2.ReportRequestViewBased_NODE_VULNERABILITY,
+		AreaOfConcern: "e2e-node-view-based",
+		Filter: &apiV2.ReportRequestViewBased_NodeVulnReportFilters{
+			NodeVulnReportFilters: &apiV2.NodeVulnerabilityReportFilters{
+				Query:     "CVSS:>=7",
+				CvesSince: &apiV2.NodeVulnerabilityReportFilters_AllVuln{AllVuln: true},
+			},
+		},
+	})
+	s.Require().NoError(err)
+	s.Require().NotEmpty(runResp.GetReportID())
+
+	histResp, err := s.service.GetViewBasedMyNodeReportHistory(ctx, &apiV2.GetViewBasedReportHistoryRequest{})
+	s.Require().NoError(err)
+	found := false
+	for _, snap := range histResp.GetReportSnapshots() {
+		if snap.GetReportJobId() == runResp.GetReportID() {
+			found = true
+			s.Equal(apiV2.ReportSnapshot_NODE_VULNERABILITY, snap.GetType())
+			break
+		}
+	}
+	s.True(found, "view-based history should include the submitted job")
+}
+
+func (s *NodeReportSuite) TestRunAndDownloadNodeReport() {
+	config := s.newNodeReportConfig("e2e-node-report-run", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	runCtx, runCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer runCancel()
+
+	runResp, err := s.service.RunNodeReport(runCtx, &apiV2.RunReportRequest{
+		ReportConfigId:           created.GetId(),
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.Require().NoError(err, "submitting node report run request")
+	s.Require().NotEmpty(runResp.GetReportId())
+
+	reportID := runResp.GetReportId()
+	s.T().Logf("Node report job submitted: config=%s report=%s", created.GetId(), reportID)
+
+	s.waitForReportCompletion(reportID)
+	s.downloadReport(reportID)
+}
+
+func (s *NodeReportSuite) TestNodeReportHistory() {
+	config := s.newNodeReportConfig("e2e-node-report-history", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	runCtx, runCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer runCancel()
+
+	runResp, err := s.service.RunNodeReport(runCtx, &apiV2.RunReportRequest{
+		ReportConfigId:           created.GetId(),
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.Require().NoError(err)
+
+	s.waitForReportCompletion(runResp.GetReportId())
+
+	histCtx, histCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer histCancel()
+
+	histResp, err := s.service.GetNodeReportHistory(histCtx, &apiV2.GetReportHistoryRequest{
+		Id: created.GetId(),
+	})
+	s.Require().NoError(err)
+	s.Require().NotEmpty(histResp.GetReportSnapshots(), "should have at least one snapshot in history")
+
+	snapshot := histResp.GetReportSnapshots()[0]
+	assert.Equal(s.T(), created.GetId(), snapshot.GetReportConfigId())
+
+	snapshotScope := snapshot.GetResourceScope()
+	s.Require().NotNil(snapshotScope, "snapshot should have resource scope")
+	entityScope := snapshotScope.GetEntityScope()
+	s.Require().NotNil(entityScope, "snapshot should have entity scope")
+	assert.NotEmpty(s.T(), entityScope.GetRules())
+
+	snapshotFilters := snapshot.GetNodeVulnReportFilters()
+	s.Require().NotNil(snapshotFilters, "snapshot should have node vuln report filters")
+	assert.Equal(s.T(), "CVSS:>=7", snapshotFilters.GetQuery())
+}
+
+func (s *NodeReportSuite) TestMyNodeReportHistory() {
+	config := s.newNodeReportConfig("e2e-node-report-my-history", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	runCtx, runCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer runCancel()
+
+	runResp, err := s.service.RunNodeReport(runCtx, &apiV2.RunReportRequest{
+		ReportConfigId:           created.GetId(),
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.Require().NoError(err)
+
+	s.waitForReportCompletion(runResp.GetReportId())
+
+	histCtx, histCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer histCancel()
+
+	histResp, err := s.service.GetMyNodeReportHistory(histCtx, &apiV2.GetReportHistoryRequest{
+		Id: created.GetId(),
+	})
+	s.Require().NoError(err)
+	s.Require().NotEmpty(histResp.GetReportSnapshots(), "should have at least one snapshot in user history")
+
+	snapshot := histResp.GetReportSnapshots()[0]
+	assert.Equal(s.T(), created.GetId(), snapshot.GetReportConfigId())
+	s.Require().NotNil(snapshot.GetUser(), "snapshot should have user information")
+}
+
+func (s *NodeReportSuite) TestInvalidEntityScope_NonClusterType() {
+	config := s.newNodeReportConfig("e2e-node-invalid-entity", "CVSS:>=7")
+	config.ResourceScope = &apiV2.ResourceScope{
+		ScopeReference: &apiV2.ResourceScope_EntityScope{
+			EntityScope: &apiV2.EntityScope{
+				Rules: []*apiV2.EntityScopeRule{
+					{
+						Entity: apiV2.ScopeEntity_SCOPE_ENTITY_DEPLOYMENT,
+						Field:  apiV2.ScopeField_FIELD_NAME,
+						Values: []*apiV2.RuleValue{
+							{Value: "test", MatchType: apiV2.MatchType_EXACT},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	_, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().Error(err, "should reject config with deployment entity type")
+}
+
+func (s *NodeReportSuite) TestInvalidEntityScope_UnsupportedField() {
+	config := s.newNodeReportConfig("e2e-node-invalid-field", "CVSS:>=7")
+	config.ResourceScope = &apiV2.ResourceScope{
+		ScopeReference: &apiV2.ResourceScope_EntityScope{
+			EntityScope: &apiV2.EntityScope{
+				Rules: []*apiV2.EntityScopeRule{
+					{
+						Entity: apiV2.ScopeEntity_SCOPE_ENTITY_CLUSTER,
+						Field:  apiV2.ScopeField_FIELD_ANNOTATION,
+						Values: []*apiV2.RuleValue{
+							{Value: "key=value", MatchType: apiV2.MatchType_EXACT},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	_, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().Error(err, "should reject config with annotation field")
+}
+
+func (s *NodeReportSuite) TestDeleteNodeReportConfig() {
+	config := s.newNodeReportConfig("e2e-node-delete", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+
+	deleteCtx, deleteCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer deleteCancel()
+
+	_, err = s.service.DeleteNodeReportConfiguration(deleteCtx, &apiV2.ResourceByID{Id: created.GetId()})
+	s.Require().NoError(err, "deleting node report config")
+
+	getCtx, getCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer getCancel()
+
+	_, err = s.service.GetNodeReportConfiguration(getCtx, &apiV2.ResourceByID{Id: created.GetId()})
+	s.Require().Error(err, "should return error when getting deleted config")
+}
+
+func (s *NodeReportSuite) TestDeleteNodeReportConfig_WithRunningJob() {
+	config := s.newNodeReportConfig("e2e-node-delete-running", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	runCtx, runCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer runCancel()
+
+	_, err = s.service.RunNodeReport(runCtx, &apiV2.RunReportRequest{
+		ReportConfigId:           created.GetId(),
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.Require().NoError(err)
+
+	deleteCtx, deleteCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer deleteCancel()
+
+	_, err = s.service.DeleteNodeReportConfiguration(deleteCtx, &apiV2.ResourceByID{Id: created.GetId()})
+	if err == nil {
+		s.T().Log("job finished before delete; config was removable")
+		return
+	}
+	s.Error(err, "delete must fail while a job is still running")
+}
+
+func (s *NodeReportSuite) TestCancelNodeReport() {
+	config := s.newNodeReportConfig("e2e-node-cancel", "CVSS:>=7")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	runCtx, runCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer runCancel()
+
+	runResp, err := s.service.RunNodeReport(runCtx, &apiV2.RunReportRequest{
+		ReportConfigId:           created.GetId(),
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.Require().NoError(err)
+
+	cancelCtx, cancelCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancelCancel()
+
+	_, err = s.service.CancelNodeReport(cancelCtx, &apiV2.ResourceByID{Id: runResp.GetReportId()})
+	if err != nil {
+		s.T().Logf("Cancel returned error (job may have already finished): %v", err)
+	}
+
+	// Cancellation is processed asynchronously; poll until the report reaches a terminal state.
+	var finalStatus *apiV2.ReportStatus
+	s.Require().Eventually(func() bool {
+		ctx, cancel := context.WithTimeout(s.ctx, 10*time.Second)
+		defer cancel()
+		statusResp, err := s.service.GetNodeReportStatus(ctx, &apiV2.ResourceByID{Id: runResp.GetReportId()})
+		if err != nil {
+			if status.Code(err) == codes.NotFound {
+				s.T().Logf("Report not found after cancel: %v", err)
+				return true
+			}
+			s.T().Logf("Error checking report status after cancel: %v", err)
+			return false
+		}
+		finalStatus = statusResp.GetStatus()
+		state := finalStatus.GetRunState()
+		s.T().Logf("Report state after cancel: %s", state)
+		return state == apiV2.ReportStatus_FAILURE ||
+			state == apiV2.ReportStatus_GENERATED ||
+			state == apiV2.ReportStatus_DELIVERED
+	}, 2*time.Minute, 5*time.Second, "report did not reach terminal state after cancel")
+
+	if finalStatus == nil {
+		return // not-found case handled above
+	}
+	switch finalStatus.GetRunState() {
+	case apiV2.ReportStatus_FAILURE:
+		s.Equal("report cancelled by user", finalStatus.GetErrorMsg(), "cancelled report should have cancellation message")
+	case apiV2.ReportStatus_GENERATED, apiV2.ReportStatus_DELIVERED:
+		s.T().Log("report completed before cancel took effect")
+	}
+}
+
+func (s *NodeReportSuite) TestQueryFiltering() {
+	config := s.newNodeReportConfig("e2e-node-query-filter", "CVE:CVE-2024-*+CVSS:>=9")
+
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	created, err := s.service.PostNodeReportConfiguration(ctx, config)
+	s.Require().NoError(err)
+	s.configIDs = append(s.configIDs, created.GetId())
+
+	runCtx, runCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer runCancel()
+
+	runResp, err := s.service.RunNodeReport(runCtx, &apiV2.RunReportRequest{
+		ReportConfigId:           created.GetId(),
+		ReportNotificationMethod: apiV2.NotificationMethod_DOWNLOAD,
+	})
+	s.Require().NoError(err)
+
+	s.waitForReportCompletion(runResp.GetReportId())
+
+	getCtx, getCancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer getCancel()
+
+	fetched, err := s.service.GetNodeReportConfiguration(getCtx, &apiV2.ResourceByID{Id: created.GetId()})
+	s.Require().NoError(err)
+	assert.Equal(s.T(), "CVE:CVE-2024-*+CVSS:>=9", fetched.GetNodeVulnReportFilters().GetQuery(),
+		"query filter should be preserved")
+}
+
+func (s *NodeReportSuite) waitForReportCompletion(reportID string) {
+	s.T().Logf("Waiting for node report %s to complete...", reportID)
+
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+
+	timer := time.NewTimer(5 * time.Minute)
+	defer timer.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			ctx, cancel := context.WithTimeout(s.ctx, 10*time.Second)
+			statusResp, err := s.service.GetNodeReportStatus(ctx, &apiV2.ResourceByID{Id: reportID})
+			cancel()
+			if err != nil {
+				s.T().Logf("Error checking report status: %v", err)
+				continue
+			}
+
+			state := statusResp.GetStatus().GetRunState()
+			s.T().Logf("Node report %s state: %s", reportID, state)
+
+			switch state {
+			case apiV2.ReportStatus_GENERATED, apiV2.ReportStatus_DELIVERED:
+				s.T().Logf("Node report %s completed successfully", reportID)
+				return
+			case apiV2.ReportStatus_FAILURE:
+				s.Require().Failf("Node report generation failed",
+					"Report %s failed: %s", reportID, statusResp.GetStatus().GetErrorMsg())
+				return
+			}
+		case <-timer.C:
+			s.Require().Failf("Timed out", "Node report %s did not complete within 5 minutes", reportID)
+			return
+		}
+	}
+}
+
+func (s *NodeReportSuite) downloadReport(reportID string) {
+	endpoint := centralgrpc.RoxAPIEndpoint(s.T())
+	password := centralgrpc.RoxPassword(s.T())
+	username := centralgrpc.RoxUsername(s.T())
+
+	downloadURL := fmt.Sprintf("https://%s/api/reports/node/jobs/download?id=%s", endpoint, reportID)
+	s.T().Logf("Downloading node report from %s", downloadURL)
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		},
+		Timeout: 60 * time.Second,
+	}
+
+	var resp *http.Response
+	s.Require().Eventually(func() bool {
+		req, err := http.NewRequestWithContext(s.ctx, http.MethodGet, downloadURL, nil)
+		s.Require().NoError(err)
+		req.SetBasicAuth(username, password)
+
+		newResp, err := client.Do(req)
+		if err != nil {
+			s.T().Logf("Download attempt failed: %v", err)
+			return false
+		}
+		if newResp.StatusCode != http.StatusOK {
+			s.T().Logf("Download attempt returned %d", newResp.StatusCode)
+			_ = newResp.Body.Close()
+			return false
+		}
+		resp = newResp
+		return true
+	}, 2*time.Minute, 5*time.Second, "failed to download node report after retries")
+	defer func() { _ = resp.Body.Close() }()
+
+	body, err := io.ReadAll(resp.Body)
+	s.Require().NoError(err)
+
+	require.Equal(s.T(), http.StatusOK, resp.StatusCode,
+		"expected 200 OK downloading node report, got %d: %s", resp.StatusCode, string(body))
+	assert.Equal(s.T(), "application/zip", resp.Header.Get("Content-Type"))
+	assert.NotEmpty(s.T(), body, "downloaded node report should not be empty")
+
+	s.T().Logf("Downloaded node report: %d bytes, Content-Type: %s", len(body), resp.Header.Get("Content-Type"))
+}
diff --git a/tests/performance/load/package-lock.json b/tests/performance/load/package-lock.json
index 4bad4b72afc51..2dd22a073539b 100644
--- a/tests/performance/load/package-lock.json
+++ b/tests/performance/load/package-lock.json
@@ -258,10 +258,11 @@
             "dev": true
         },
         "node_modules/brace-expansion": {
-            "version": "1.1.16",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-            "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+            "version": "1.1.21",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+            "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
             "dev": true,
+            "license": "MIT",
             "dependencies": {
                 "balanced-match": "^1.0.0",
                 "concat-map": "0.0.1"
@@ -1487,9 +1488,9 @@
             "dev": true
         },
         "node_modules/js-yaml": {
-            "version": "4.3.0",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-            "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+            "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
             "dev": true,
             "funding": [
                 {
@@ -1697,10 +1698,11 @@
             }
         },
         "node_modules/moment": {
-            "version": "2.29.4",
-            "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
-            "integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==",
+            "version": "2.31.0",
+            "resolved": "https://registry.npmjs.org/moment/-/moment-2.31.0.tgz",
+            "integrity": "sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==",
             "dev": true,
+            "license": "MIT",
             "engines": {
                 "node": "*"
             }
@@ -1718,10 +1720,17 @@
             "dev": true
         },
         "node_modules/nanoid": {
-            "version": "3.3.4",
-            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-            "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==",
+            "version": "3.3.19",
+            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+            "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
             "dev": true,
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/ai"
+                }
+            ],
+            "license": "MIT",
             "bin": {
                 "nanoid": "bin/nanoid.cjs"
             },
@@ -2708,9 +2717,9 @@
             "dev": true
         },
         "brace-expansion": {
-            "version": "1.1.16",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-            "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+            "version": "1.1.21",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+            "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
             "dev": true,
             "requires": {
                 "balanced-match": "^1.0.0",
@@ -3668,9 +3677,9 @@
             "dev": true
         },
         "js-yaml": {
-            "version": "4.3.0",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-            "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+            "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
             "dev": true,
             "requires": {
                 "argparse": "^2.0.1"
@@ -3837,9 +3846,9 @@
             }
         },
         "moment": {
-            "version": "2.29.4",
-            "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
-            "integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==",
+            "version": "2.31.0",
+            "resolved": "https://registry.npmjs.org/moment/-/moment-2.31.0.tgz",
+            "integrity": "sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==",
             "dev": true
         },
         "ms": {
@@ -3855,9 +3864,9 @@
             "dev": true
         },
         "nanoid": {
-            "version": "3.3.4",
-            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-            "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==",
+            "version": "3.3.19",
+            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+            "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
             "dev": true
         },
         "natural-compare": {
diff --git a/tests/performance/scale/config/orion-acs-cluster-density-v2.yml b/tests/performance/scale/config/orion-acs-cluster-density-v2.yml
index 19c9ff985dca6..074142cabc914 100644
--- a/tests/performance/scale/config/orion-acs-cluster-density-v2.yml
+++ b/tests/performance/scale/config/orion-acs-cluster-density-v2.yml
@@ -13,6 +13,7 @@ tests :
       ocpVersion: {{ version }}
       networkType: OVNKubernetes
       jobType: {{ jobtype | default('periodic') }}
+      pullNumber: "{{ pull_number | default(0) }}"
       not:
         stream: okd
 
diff --git a/tests/performance/scale/go.mod b/tests/performance/scale/go.mod
index 5f1e9d10747f4..711815f73608c 100644
--- a/tests/performance/scale/go.mod
+++ b/tests/performance/scale/go.mod
@@ -4,11 +4,11 @@ go 1.26.0
 
 require (
 	github.com/cloud-bulldozer/go-commons v1.0.19
-	github.com/go-git/go-git/v5 v5.19.2
+	github.com/go-git/go-git/v5 v5.19.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/spf13/cobra v1.10.2
 	go.yaml.in/yaml/v3 v3.0.5
-	k8s.io/client-go v0.36.3
+	k8s.io/client-go v0.37.1
 )
 
 require (
@@ -20,53 +20,61 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.9.0 // indirect
+	github.com/go-git/go-billy/v5 v5.9.2 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pjbgf/sha1cd v0.6.0 // indirect
+	github.com/pjbgf/sha1cd v0.7.0 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.39.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.36.3 // indirect
-	k8s.io/apimachinery v0.36.3 // indirect
+	k8s.io/api v0.37.1 // indirect
+	k8s.io/apimachinery v0.37.1 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
-	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/tests/performance/scale/go.sum b/tests/performance/scale/go.sum
index 70bebf92c5e24..7962276a38121 100644
--- a/tests/performance/scale/go.sum
+++ b/tests/performance/scale/go.sum
@@ -14,7 +14,6 @@ github.com/cloud-bulldozer/go-commons v1.0.19/go.mod h1:CKmdWhyxN6p4leLhdwKxQHJ3
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
 github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -27,28 +26,54 @@ github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bF
 github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
-github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
+github.com/go-git/go-billy/v5 v5.9.2 h1:OXFSRyz4g20upsGDJgQG9Bak1l/ZEv8GHVYB52O71sE=
+github.com/go-git/go-billy/v5 v5.9.2/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
-github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
+github.com/go-git/go-git/v5 v5.19.3 h1:qHttbZ+Am7wEjdTpR1XMQ4rl42FK9SIXzZ4o9x7s6M4=
+github.com/go-git/go-git/v5 v5.19.3/go.mod h1:Ye4C8dVigkqrv9UsB4NMdSLV4yAIkLiIhW61gcOyhl4=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
@@ -66,24 +91,17 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -94,8 +112,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
-github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
-github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
+github.com/pjbgf/sha1cd v0.7.0 h1:ZRNPKHj+gfkLBf0KJv/p1Hmz+7bqCT5o311YX0nq+DA=
+github.com/pjbgf/sha1cd v0.7.0/go.mod h1:pKR5Li+qTCo+ebqITZfwPlJGoCFCvSO00qxjbNtTUFQ=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -111,56 +129,52 @@ github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnB
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
-golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
-golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
@@ -176,26 +190,25 @@ gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.36.3 h1:NxB+05W2UGqXWFXcLO0RB5cnqnUPP5v5sVlaOH0Iz4w=
-k8s.io/api v0.36.3/go.mod h1:JzLQKqRHC5+I8RVj/lS3lCg0mg6nWI9Fo/Sk3ElxHzg=
-k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=
-k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=
-k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg=
-k8s.io/client-go v0.36.3/go.mod h1:gcPwr0c87vjjG6HB6pWEqOeuYVoXSsREjzux2j6GF30=
+k8s.io/api v0.37.1 h1:l6N77U7tjwB5L056bgrBTJIEdevac/naBZ3iSvDNfpM=
+k8s.io/api v0.37.1/go.mod h1:zSlbB1YpJ1YQlFVQy20UYll81UJSJJUMLhkhvg6Z78M=
+k8s.io/apimachinery v0.37.1 h1:hGCYyvKHCwtwMitj2vU4vYx0Z16N9GyZk9BBnz0wDAE=
+k8s.io/apimachinery v0.37.1/go.mod h1:jF84AyUi/IRIXRot5f+lm6MpxoWI+F1XgjaMmwCdTFw=
+k8s.io/client-go v0.37.1 h1:QTv/5ha4jAHtW9qxxVBkQVFBRDb4jHfFopQqqMdc+wM=
+k8s.io/client-go v0.37.1/go.mod h1:dnAPtTnCNY38Ho04D2KdY1F4IKausa9UbqaAZKl60SY=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
-k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
-k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.3 h1:u08YRbVUi59ri4YD6cg0UqNM4Dimn0sIl+wldcx5PYw=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.3/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/tests/pods_test.go b/tests/pods_test.go
index a2e3b911163bd..b96ade2c69aed 100644
--- a/tests/pods_test.go
+++ b/tests/pods_test.go
@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/graph-gophers/graphql-go"
-	"github.com/stackrox/rox/central/graphql/resolvers/inputtypes"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/sliceutils"
 	"github.com/stackrox/rox/pkg/testutils"
@@ -194,18 +193,6 @@ func getPods(t testutils.T, deploymentID string) []Pod {
 		Pods []Pod `json:"pods"`
 	}
 
-	// Using this to ensure pagination does not fail.
-	offset := int32(0)
-	limit := int32(10)
-	field := "Pod Name"
-	pagination := inputtypes.Pagination{
-		Offset: &offset,
-		Limit:  &limit,
-		SortOption: &inputtypes.SortOption{
-			Field: &field,
-		},
-	}
-
 	makeGraphQLRequest(t, `
 		query getPods($podsQuery: String, $pagination: Pagination) {
 			pods(query: $podsQuery, pagination: $pagination) {
@@ -221,7 +208,7 @@ func getPods(t testutils.T, deploymentID string) []Pod {
 		}
 	`, map[string]interface{}{
 		"podsQuery":  fmt.Sprintf("Deployment ID: %s", deploymentID),
-		"pagination": pagination,
+		"pagination": nil,
 	}, &respData, timeout)
 	t.Logf("%+v", respData)
 
diff --git a/tests/policy_as_code_test.go b/tests/policy_as_code_test.go
index 9a77111bb791d..2a023d61826b3 100644
--- a/tests/policy_as_code_test.go
+++ b/tests/policy_as_code_test.go
@@ -468,28 +468,39 @@ func (pc *PolicyAsCodeSuite) createCRAndObserveInCentral(policyCR *v1alpha1.Secu
 			}
 		}
 		assert.NotEmpty(collect, policyId)
-	}, time.Second*5, time.Millisecond*30)
+	}, time.Second*30, time.Millisecond*30)
 	return policyId
 }
 
 func (pc *PolicyAsCodeSuite) TestCRWithEvaluationFilter() {
-	k8sPolicy := createBasePolicyStruct("test-eval-filter-cr")
-	k8sPolicy.Spec.EvaluationFilter = &v1alpha1.EvaluationFilter{
-		SkipContainerTypes: []v1alpha1.ContainerType{"INIT"},
+	tests := map[string]struct {
+		containerType v1alpha1.ContainerType
+		protoType     storage.ContainerType
+	}{
+		"init":    {containerType: "INIT", protoType: storage.ContainerType_INIT},
+		"regular": {containerType: "REGULAR", protoType: storage.ContainerType_REGULAR},
 	}
+	for name, tc := range tests {
+		pc.Run(name, func() {
+			k8sPolicy := createBasePolicyStruct("test-eval-filter-cr-" + name)
+			k8sPolicy.Spec.EvaluationFilter = &v1alpha1.EvaluationFilter{
+				SkipContainerTypes: []v1alpha1.ContainerType{tc.containerType},
+			}
 
-	id := pc.createCRAndObserveInCentral(k8sPolicy)
-	pc.Require().NotEmpty(id)
+			id := pc.createCRAndObserveInCentral(k8sPolicy)
+			pc.Require().NotEmpty(id)
 
-	policy, err := pc.policyClient.GetPolicy(pc.ctx, &v1.ResourceByID{Id: id})
-	pc.Require().NoError(err)
-	pc.policies = append(pc.policies, policy)
+			policy, err := pc.policyClient.GetPolicy(pc.ctx, &v1.ResourceByID{Id: id})
+			pc.Require().NoError(err)
+			pc.policies = append(pc.policies, policy)
 
-	pc.Require().NotNil(policy.GetEvaluationFilter())
-	pc.Require().Equal(
-		[]storage.ContainerType{storage.ContainerType_INIT},
-		policy.GetEvaluationFilter().GetSkipContainerTypes(),
-	)
+			pc.Require().NotNil(policy.GetEvaluationFilter())
+			pc.Require().Equal(
+				[]storage.ContainerType{tc.protoType},
+				policy.GetEvaluationFilter().GetSkipContainerTypes(),
+			)
+		})
+	}
 }
 
 func (pc *PolicyAsCodeSuite) TearDownSuite() {
diff --git a/tests/policy_test.go b/tests/policy_test.go
index ab1ba5a7bb1ac..fd57f8515840e 100644
--- a/tests/policy_test.go
+++ b/tests/policy_test.go
@@ -519,12 +519,11 @@ func verifyExclusionsRemoved(t *testing.T) {
 	policy.Id = "verifyExcludedScopesRemoved policy ID"
 	policy.Name = "verifyExcludedScopesRemoved is a valid policy"
 	policy.Exclusions = []*storage.Exclusion{
-		{
-			Deployment: &storage.Exclusion_Deployment{
-				Scope: &storage.Scope{
-					Cluster: "This is not a cluster",
-				},
+		{Matcher: &storage.Exclusion_Deployment_{Deployment: &storage.Exclusion_Deployment{
+			Scope: &storage.Scope{
+				Cluster: "This is not a cluster",
 			},
+		}},
 		},
 	}
 
diff --git a/tests/redhat_signing_key_test.go b/tests/redhat_signing_key_test.go
index bf931bb4841d7..6b7befb31b467 100644
--- a/tests/redhat_signing_key_test.go
+++ b/tests/redhat_signing_key_test.go
@@ -71,28 +71,24 @@ func TestRedHatSigningKey(t *testing.T) {
 
 func (s *RedHatSigningKeySuite) SetupSuite() {
 	s.KubernetesSuite.SetupSuite()
-	s.conn = centralgrpc.GRPCConnectionToCentral(s.T())
 
-	// Set once for the whole suite instead of per sub-test: every sub-test
-	// needs the watcher to poll quickly, and each Central restart costs
-	// ~30s, so sharing this one restart across sub-tests instead of paying
-	// it twice per sub-test saves several minutes of suite time.
+	// Deploy scripts (tests/e2e/lib.sh, deploy/common/k8sbased.sh) set
+	// watchIntervalEnv=5s at deploy time, so Central already polls quickly.
+	// This is a same-value no-op safety net for setups that deploy Central
+	// without the baked-in env var (e.g. local dev clusters).
 	ns := namespaces.StackRox
 	ctx, cancel := context.WithTimeout(context.Background(), waitTimeout+time.Minute)
 	defer cancel()
-	s.logf("Setting %s=%s on central for the whole suite", watchIntervalEnv, shortWatchInterval)
-	s.mustSetDeploymentEnvVal(ctx, ns, "central", "central", watchIntervalEnv, shortWatchInterval)
-	s.waitUntilK8sDeploymentReady(ctx, ns, "central")
-}
+	s.logf("Ensuring %s=%s on central", watchIntervalEnv, shortWatchInterval)
+	currentVal, _ := s.getDeploymentEnvVal(ctx, ns, "central", "central", watchIntervalEnv)
+	if currentVal == shortWatchInterval {
+		s.logf("%s already set to %s, skipping patch", watchIntervalEnv, shortWatchInterval)
+	} else {
+		s.mustSetDeploymentEnvVal(ctx, ns, "central", "central", watchIntervalEnv, shortWatchInterval)
+	}
 
-// TearDownSuite reverts the watch-interval override applied in SetupSuite.
-func (s *RedHatSigningKeySuite) TearDownSuite() {
-	ns := namespaces.StackRox
-	ctx, cancel := context.WithTimeout(context.Background(), waitTimeout+time.Minute)
-	defer cancel()
-	s.logf("Cleanup: removing %s env var", watchIntervalEnv)
-	s.mustDeleteDeploymentEnvVar(ctx, ns, "central", watchIntervalEnv)
-	s.waitUntilK8sDeploymentReady(ctx, ns, "central")
+	s.conn = centralgrpc.GRPCConnectionToCentral(s.T())
+	s.waitForCentralReady(ctx)
 }
 
 func (s *RedHatSigningKeySuite) siClient() v1.SignatureIntegrationServiceClient {
@@ -103,6 +99,20 @@ func (s *RedHatSigningKeySuite) listIntegrations(ctx context.Context) (*v1.ListS
 	return s.siClient().ListSignatureIntegrations(ctx, &v1.Empty{})
 }
 
+// waitForCentralReady waits for Central's k8s deployment readiness AND gRPC
+// API responsiveness. On OCP with HAProxy Routes, gRPC connection recovery
+// after a backend restart lags 10-30s beyond k8s deployment readiness.
+func (s *RedHatSigningKeySuite) waitForCentralReady(ctx context.Context) {
+	ns := namespaces.StackRox
+	s.waitUntilK8sDeploymentReady(ctx, ns, "central")
+	mustEventually(s.T(), ctx, func() error {
+		rpcCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+		_, err := s.listIntegrations(rpcCtx)
+		return err
+	}, 2*time.Second, "Central gRPC API not yet responsive after restart")
+}
+
 // waitForIntegrationKeys polls until the Red Hat integration has exactly the expected key names.
 func (s *RedHatSigningKeySuite) waitForIntegrationKeys(ctx context.Context, expectedNames []string, description string) {
 	t := s.T()
@@ -431,7 +441,7 @@ func (s *RedHatSigningKeySuite) TestUpdaterDownloadsBundleFromHTTP() {
 	defer func() {
 		s.logf("Cleanup: removing updater env var from Central")
 		s.mustDeleteDeploymentEnvVar(overallCtx, ns, "central", bundleURLEnv)
-		s.waitUntilK8sDeploymentReady(overallCtx, ns, "central")
+		s.waitForCentralReady(overallCtx)
 	}()
 
 	// The update interval isn't set: it always gets clamped to a 5-minute
@@ -439,7 +449,7 @@ func (s *RedHatSigningKeySuite) TestUpdaterDownloadsBundleFromHTTP() {
 	// depends on the unconditional first download at startup (see above).
 	s.logf("Setting %s on central", bundleURLEnv)
 	s.mustSetDeploymentEnvVal(testCtx, ns, "central", "central", bundleURLEnv, bundleURL)
-	s.waitUntilK8sDeploymentReady(testCtx, ns, "central")
+	s.waitForCentralReady(testCtx)
 
 	s.logf("Waiting for updater to download the bundle and watcher to upsert keys")
 	s.waitForIntegrationKeys(testCtx, []string{"updater-key-1", "updater-key-2"},
@@ -567,7 +577,7 @@ func (s *RedHatSigningKeySuite) TestOfflineModeIgnoresHTTPUpdater() {
 		s.logf("Cleanup: removing env vars from Central")
 		s.mustDeleteDeploymentEnvVar(overallCtx, ns, "central", offlineModeEnv)
 		s.mustDeleteDeploymentEnvVar(overallCtx, ns, "central", bundleURLEnv)
-		s.waitUntilK8sDeploymentReady(overallCtx, ns, "central")
+		s.waitForCentralReady(overallCtx)
 	}()
 
 	// The update interval isn't set here for the same reason as in
@@ -578,7 +588,7 @@ func (s *RedHatSigningKeySuite) TestOfflineModeIgnoresHTTPUpdater() {
 
 	// --- Step 3: Wait for Central to restart ---
 
-	s.waitUntilK8sDeploymentReady(testCtx, ns, "central")
+	s.waitForCentralReady(testCtx)
 
 	// --- Step 4: Verify the HTTP updater did NOT fetch the decoy bundle ---
 
diff --git a/tests/roxctl/bats-tests/cluster/scanner-generate.bats b/tests/roxctl/bats-tests/cluster/scanner-generate.bats
index 278cffff40682..048856fe37ee4 100755
--- a/tests/roxctl/bats-tests/cluster/scanner-generate.bats
+++ b/tests/roxctl/bats-tests/cluster/scanner-generate.bats
@@ -37,7 +37,7 @@ run_scanner_generate_and_check() {
 }
 
 assert_number_of_k8s_resources() {
-    local -r k8s_resources_count=$(cat "${output_dir}/scanner/"*.yaml | grep -c "^apiVersion") || true
+    local -r k8s_resources_count=$(cat "${output_dir}/scanner-v4/"*.yaml | grep -c "^apiVersion") || true
 
     [[ "${k8s_resources_count}" = "${1}" ]] || fail "Unexpected number of k8s resources: expected ${1}, got ${k8s_resources_count}"
 }
@@ -45,31 +45,25 @@ assert_number_of_k8s_resources() {
 @test "[openshift4] roxctl scanner generate" {
   run_scanner_generate_and_check openshift4
 
-  assert_file_exist "${output_dir}/scanner/02-scanner-06-deployment.yaml"
+  assert_file_exist "${output_dir}/scanner-v4/02-scanner-v4-07-indexer-deployment.yaml"
 
-  # The only difference between OpenShift and OpenShift 4 configurations is that OpenShift 4 configuration has
-  # additional mounted volume. It's called "trusted-ca-volume" and we use it to identify OpenShift 4 configuration.
-  run -0 grep -q 'trusted-ca-volume' "${output_dir}/scanner/02-scanner-06-deployment.yaml"
-  run -0 grep -q 'ROX_OPENSHIFT_API' "${output_dir}/scanner/02-scanner-06-deployment.yaml"
-  assert_number_of_k8s_resources 14
+  run -0 grep -q 'ROX_OPENSHIFT_API' "${output_dir}/scanner-v4/02-scanner-v4-07-indexer-deployment.yaml"
+  assert_number_of_k8s_resources 24
 }
 
 @test "[k8s] roxctl scanner generate" {
   run_scanner_generate_and_check k8s
 
-  assert_file_exist "${output_dir}/scanner/scripts/setup.sh"
-  run -0 grep -q 'KUBE_COMMAND:-kubectl' "${output_dir}/scanner/scripts/setup.sh"
+  assert_file_exist "${output_dir}/scanner-v4/02-scanner-v4-07-indexer-deployment.yaml"
+  run -1 grep -q 'ROX_OPENSHIFT_API' "${output_dir}/scanner-v4/02-scanner-v4-07-indexer-deployment.yaml"
 
-  assert_file_exist "${output_dir}/scanner/02-scanner-06-deployment.yaml"
-  run -1 grep -q 'ROX_OPENSHIFT_API' "${output_dir}/scanner/02-scanner-06-deployment.yaml"
-
-  assert_number_of_k8s_resources 12
+  assert_number_of_k8s_resources 20
 }
 
-@test "[k8s scanner-image] roxctl scanner generate" {
-  run_scanner_generate_and_check k8s --scanner-image bats-tests
+@test "[k8s scanner-v4-image] roxctl scanner generate" {
+  run_scanner_generate_and_check k8s --scanner-v4-image bats-tests
 
-  assert_file_exist "${output_dir}/scanner/02-scanner-06-deployment.yaml"
-  run -0 grep -q "bats-tests" "${output_dir}/scanner/02-scanner-06-deployment.yaml"
-  assert_number_of_k8s_resources 12
+  assert_file_exist "${output_dir}/scanner-v4/02-scanner-v4-07-indexer-deployment.yaml"
+  run -0 grep -q "bats-tests" "${output_dir}/scanner-v4/02-scanner-v4-07-indexer-deployment.yaml"
+  assert_number_of_k8s_resources 20
 }
diff --git a/tests/roxctl/bats-tests/cluster/sensor-generate-image-overrides.bats b/tests/roxctl/bats-tests/cluster/sensor-generate-image-overrides.bats
index 2ea36893fcd2b..e42e1558289bb 100755
--- a/tests/roxctl/bats-tests/cluster/sensor-generate-image-overrides.bats
+++ b/tests/roxctl/bats-tests/cluster/sensor-generate-image-overrides.bats
@@ -3,7 +3,7 @@
 load "../helpers.bash"
 
 out_dir=""
-cluster_name="override-test-cluster"
+cluster_name=""
 central_flavor=""
 
 setup_file() {
@@ -11,11 +11,20 @@ setup_file() {
   command -v yq || skip "Tests in this file require yq"
   [[ -n "$API_ENDPOINT" ]] || fail "API_ENDPOINT environment variable required"
   [[ -n "$ROX_ADMIN_PASSWORD" ]] || fail "ROX_ADMIN_PASSWORD environment variable required"
-  central_flavor="$(kubectl -n stackrox exec -it deployment/central -- env | grep -i ROX_IMAGE_FLAVOR | sed 's/ROX_IMAGE_FLAVOR=//')"
 }
 
 setup() {
   out_dir="$(mktemp -d -u)"
+  # Unique cluster name per test so that tests with different overrides don't affect
+  # each other due to '--continue-if-exists'.
+  cluster_name="override-test-cluster-${BATS_TEST_NUMBER}"
+  central_flavor="$(kubectl -n stackrox exec deployment/central -- env 2>&1 | grep -i '^ROX_IMAGE_FLAVOR=' | sed 's/ROX_IMAGE_FLAVOR=//' | tr -d '\r\n')"
+  if [[ -z "$central_flavor" ]]; then
+    echo "Failed to detect Central image flavor. Checking Central pod status:" >&3
+    kubectl -n stackrox get pod -l app=central >&3 || true
+    fail "Could not detect Central image flavor from deployment/central"
+  fi
+  echo "Detected central flavor: '$central_flavor'" >&3
 }
 
 teardown() {
@@ -30,41 +39,58 @@ registry_from_flavor() {
   "opensource")
     echo "quay.io/stackrox-io"
     ;;
+  "rhacs")
+    echo "registry.redhat.io/advanced-cluster-security"
+    ;;
+  *)
+    fail "Unknown central flavor: '$central_flavor'"
+    ;;
+  esac
+}
+
+image_name_from_flavor() {
+  local component="$1"
+  case "$central_flavor" in
+  "rhacs")
+    echo "rhacs-${component}-rhel9"
+    ;;
+  *)
+    echo "$component"
+    ;;
   esac
 }
 
-any_version_latest="${any_version}[0-9]+\-latest"
-any_version_slim="${any_version}[0-9]+\-slim"
+any_version_regex="${any_version}(x|[0-9]+)(-.*)?$"
 
 @test "roxctl sensor generate: no overrides" {
   generate_bundle k8s --name "$cluster_name"
   assert_success
-  assert_bundle_registry "$out_dir" "sensor" "$(registry_from_flavor)/main:$any_version"
-  assert_bundle_registry "$out_dir" "collector" "$(registry_from_flavor)/collector:$any_version"
+  assert_bundle_registry "$out_dir" "sensor" "$(registry_from_flavor)/$(image_name_from_flavor main):$any_version_regex"
+  assert_bundle_registry "$out_dir" "collector" "$(registry_from_flavor)/$(image_name_from_flavor collector):$any_version_regex"
   delete_cluster "$cluster_name"
 }
 
 @test "roxctl sensor generate: with main image override. Collector should be derived from main override" {
   generate_bundle k8s "--main-image-repository=example.com/stackrox/main" --name "$cluster_name"
   assert_success
-  assert_bundle_registry "$out_dir" "sensor" "example\.com/stackrox/main:$any_version"
-  assert_bundle_registry "$out_dir" "collector" "example\.com/stackrox/collector:$any_version"
+  assert_bundle_registry "$out_dir" "sensor" "example\.com/stackrox/main:$any_version_regex"
+  assert_bundle_registry "$out_dir" "collector" "example\.com/stackrox/$(image_name_from_flavor collector):$any_version_regex"
   delete_cluster "$cluster_name"
 }
 
 @test "roxctl sensor generate: with collector override" {
   generate_bundle k8s "--collector-image-repository=example2.com/stackrox/collector" --name "$cluster_name"
   assert_success
-  assert_bundle_registry "$out_dir" "sensor" "$(registry_from_flavor)/main:$any_version"
-  assert_bundle_registry "$out_dir" "collector" "example2\.com/stackrox/collector:$any_version"
+  assert_bundle_registry "$out_dir" "sensor" "$(registry_from_flavor)/$(image_name_from_flavor main):$any_version_regex"
+  assert_bundle_registry "$out_dir" "collector" "example2\.com/stackrox/collector:$any_version_regex"
   delete_cluster "$cluster_name"
 }
 
 @test "roxctl sensor generate: with different overrides" {
   generate_bundle k8s "--main-image-repository=example.com/stackrox/main" "--collector-image-repository=example2.com/stackrox/collector" --name "$cluster_name"
   assert_success
-  assert_bundle_registry "$out_dir" "sensor" "example\.com/stackrox/main:$any_version"
-  assert_bundle_registry "$out_dir" "collector" "example2\.com/stackrox/collector:$any_version"
+  assert_bundle_registry "$out_dir" "sensor" "example\.com/stackrox/main:$any_version_regex"
+  assert_bundle_registry "$out_dir" "collector" "example2\.com/stackrox/collector:$any_version_regex"
   delete_cluster "$cluster_name"
 }
 
diff --git a/tests/roxctl/bats-tests/helpers.bash b/tests/roxctl/bats-tests/helpers.bash
index 19416b9678967..09b5c884b3cea 100644
--- a/tests/roxctl/bats-tests/helpers.bash
+++ b/tests/roxctl/bats-tests/helpers.bash
@@ -93,7 +93,7 @@ helm_template_central() {
     --output-dir="$out_dir/rendered"
   assert_success
   assert_output --partial "wrote $out_dir/rendered/stackrox-central-services/templates/01-central-13-deployment.yaml"
-  assert_output --partial "wrote $out_dir/rendered/stackrox-central-services/templates/02-scanner-06-deployment.yaml"
+  assert_output --partial "wrote $out_dir/rendered/stackrox-central-services/templates/02-scanner-v4-07-indexer-deployment.yaml"
 }
 
 # helm_template shall be used instead of `helm template --output-dir` to avoid potential overwriting of resulting manifests
@@ -193,6 +193,9 @@ component_image() {
       admission-controller|sensor)
         echo "main"
         ;;
+      scanner-v4-indexer)
+        echo "scanner-v4"
+        ;;
       *)
         echo "$1"
         ;;
@@ -219,11 +222,11 @@ assert_components_registry() {
       central-db)
         assert_registry_version_file "${dir}/01-central-12-central-db.yaml" 0 "central-db" "$regex"
         ;;
-      scanner)
-        assert_registry_version_file "${dir}/02-scanner-06-deployment.yaml" 0 "scanner" "$regex"
+      scanner-v4-indexer)
+        assert_registry_version_file "${dir}/02-scanner-v4-07-indexer-deployment.yaml" 0 "indexer" "$regex"
         ;;
-      scanner-db)
-        assert_registry_version_file "${dir}/02-scanner-06-deployment.yaml" 1 "db" "$regex"
+      scanner-v4-db)
+        assert_registry_version_file "${dir}/02-scanner-v4-07-db-deployment.yaml" 0 "db" "$regex"
         ;;
       collector) # only when generated by helm output
         assert_registry_version_file "${dir}/stackrox-secured-cluster-services/templates/collector.yaml" 0 "collector" "$regex"
@@ -290,7 +293,7 @@ image_reference_regex() {
 # $1 - path to roxctl binary
 # $2 - orchestrator (k8s, openshift)
 # $3 - registry-slug for expected main registry (see 'image_reference_regex()' for the list of currently supported registry-slugs)
-# $4 - registry-slug for expected scanner and scanner-db registries (see 'image_reference_regex()' for the list of currently supported registry-slugs)
+# $4 - registry-slug for expected scanner-v4 registries (see 'image_reference_regex()' for the list of currently supported registry-slugs)
 # $@ - open-ended list of other parameters that should be passed into 'roxctl central generate'
 run_image_defaults_registry_test() {
   local roxctl_bin="$1"; shift;
@@ -304,7 +307,7 @@ run_image_defaults_registry_test() {
   run "$roxctl_bin" central generate "$orch" "${extra_params[@]}" pvc --output-dir "$out_dir"
   assert_success
   assert_components_registry "$out_dir/central" "$expected_main_registry" "$any_version" 'main'
-  assert_components_registry "$out_dir/scanner" "$expected_scanner_registry" "$any_version" 'scanner' 'scanner-db'
+  assert_components_registry "$out_dir/scanner-v4" "$expected_scanner_registry" "$any_version" 'scanner-v4-indexer' 'scanner-v4-db'
   assert_components_registry "$out_dir/central" "$expected_main_registry" "$any_version" 'central-db'
 }
 
diff --git a/tests/roxctl/bats-tests/local/central-generate-development.bats b/tests/roxctl/bats-tests/local/central-generate-development.bats
index 876b057b31ec4..ae4204c7fc345 100755
--- a/tests/roxctl/bats-tests/local/central-generate-development.bats
+++ b/tests/roxctl/bats-tests/local/central-generate-development.bats
@@ -33,8 +33,8 @@ teardown() {
     'example.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-development central generate k8s should work when main and scanner are from different registries" {
@@ -43,8 +43,8 @@ teardown() {
     'example2.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example2.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example2.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example2.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example2.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-development central generate k8s should work when main is from custom registry and --image-defaults are used" {
@@ -84,8 +84,8 @@ teardown() {
     'example.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-development central generate openshift should work when main and scanner are from different registries" {
@@ -94,8 +94,8 @@ teardown() {
     'example2.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example2.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example2.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example2.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example2.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-development central generate openshift should work when main is from custom registry and --image-defaults are used" {
diff --git a/tests/roxctl/bats-tests/local/central-generate-interactive-flavors.bats b/tests/roxctl/bats-tests/local/central-generate-interactive-flavors.bats
index fb6706fbd7b3a..a67d0e7ceea0e 100755
--- a/tests/roxctl/bats-tests/local/central-generate-interactive-flavors.bats
+++ b/tests/roxctl/bats-tests/local/central-generate-interactive-flavors.bats
@@ -34,10 +34,10 @@ bitfield_to_failure() {
     msg="$msg main"
   fi
   if ((status & 2)); then
-    msg="$msg scanner-db"
+    msg="$msg scanner-v4-db"
   fi
   if ((status & 1)); then
-    msg="$msg scanner"
+    msg="$msg scanner-v4"
   fi
   fail "$msg - status $status"
 }
@@ -52,22 +52,22 @@ assert_flavor_prompt_release() {
 
 assert_prompts_development() {
   # partial line matching allows to avoid problems with leading an trailing whitespaces
-  # main/scanner/scanner-db are constants from code
+  # main/scanner-v4/scanner-v4-db are constants from code
   assert_line --regexp '^The main .* "quay.io/rhacs-eng/main:'
-  assert_line --regexp '^The scanner-db .* "quay.io/rhacs-eng/scanner-db:'
-  assert_line --regexp '^The scanner .* "quay.io/rhacs-eng/scanner:'
+  assert_line --regexp '^The scanner-v4-db .* "quay.io/rhacs-eng/scanner-v4-db:'
+  assert_line --regexp '^The scanner-v4 .* "quay.io/rhacs-eng/scanner-v4:'
 }
 
 assert_prompts_opensource() {
   assert_line --regexp '^The main .* "quay.io/stackrox-io/main:'
-  assert_line --regexp '^The scanner-db .* "quay.io/stackrox-io/scanner-db:'
-  assert_line --regexp '^The scanner .* "quay.io/stackrox-io/scanner:'
+  assert_line --regexp '^The scanner-v4-db .* "quay.io/stackrox-io/scanner-v4-db:'
+  assert_line --regexp '^The scanner-v4 .* "quay.io/stackrox-io/scanner-v4:'
 }
 
 assert_prompts_rhacs() {
   assert_line --regexp '^The main .* "registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9:'
-  assert_line --regexp '^The scanner-db .* "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9:'
-  assert_line --regexp '^The scanner .* "registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9:'
+  assert_line --regexp '^The scanner-v4-db .* "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9:'
+  assert_line --regexp '^The scanner-v4 .* "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel9:'
 }
 
 @test "roxctl-development central generate interactive flavor=dummy should ask for valid value" {
@@ -85,7 +85,7 @@ assert_prompts_rhacs() {
   assert_flavor_prompt_development
   sleep 2 # due to frequent flakes of missing yaml files
   assert_components_registry "$out_dir/central" "quay.io/rhacs-eng" "$any_version" 'main'
-  assert_components_registry "$out_dir/scanner" "quay.io/rhacs-eng" "$any_version" 'scanner' 'scanner-db'
+  assert_components_registry "$out_dir/scanner-v4" "quay.io/rhacs-eng" "$any_version" 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-development central generate interactive flavor=opensource" {
@@ -97,7 +97,7 @@ assert_prompts_rhacs() {
   assert_flavor_prompt_development
   sleep 2 # due to frequent flakes of missing yaml files
   assert_components_registry "$out_dir/central" "quay.io/stackrox-io" "$any_version" 'main'
-  assert_components_registry "$out_dir/scanner" "quay.io/stackrox-io" "$any_version" 'scanner' 'scanner-db'
+  assert_components_registry "$out_dir/scanner-v4" "quay.io/stackrox-io" "$any_version" 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-development central generate interactive flavor=rhacs" {
@@ -109,7 +109,7 @@ assert_prompts_rhacs() {
   assert_flavor_prompt_development
   sleep 2 # due to frequent flakes of missing yaml files
   assert_components_registry "$out_dir/central" "registry.redhat.io" "$any_version" 'main'
-  assert_components_registry "$out_dir/scanner" "registry.redhat.io" "$any_version" 'scanner' 'scanner-db'
+  assert_components_registry "$out_dir/scanner-v4" "registry.redhat.io" "$any_version" 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 # RELEASE
@@ -129,7 +129,7 @@ assert_prompts_rhacs() {
   assert_flavor_prompt_release
   sleep 2 # due to frequent flakes of missing yaml files
   assert_components_registry "$out_dir/central" "quay.io/stackrox-io" "$any_version" 'main'
-  assert_components_registry "$out_dir/scanner" "quay.io/stackrox-io" "$any_version" 'scanner' 'scanner-db'
+  assert_components_registry "$out_dir/scanner-v4" "quay.io/stackrox-io" "$any_version" 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-release central generate interactive flavor=rhacs" {
@@ -141,5 +141,5 @@ assert_prompts_rhacs() {
   assert_flavor_prompt_release
   sleep 2 # due to frequent flakes of missing yaml files
   assert_components_registry "$out_dir/central" "registry.redhat.io" "$any_version" 'main'
-  assert_components_registry "$out_dir/scanner" "registry.redhat.io" "$any_version" 'scanner' 'scanner-db'
+  assert_components_registry "$out_dir/scanner-v4" "registry.redhat.io" "$any_version" 'scanner-v4-indexer' 'scanner-v4-db'
 }
diff --git a/tests/roxctl/bats-tests/local/central-generate-release.bats b/tests/roxctl/bats-tests/local/central-generate-release.bats
index fe103a6a6139a..d4d46f9097103 100755
--- a/tests/roxctl/bats-tests/local/central-generate-release.bats
+++ b/tests/roxctl/bats-tests/local/central-generate-release.bats
@@ -32,8 +32,8 @@ teardown() {
     'example.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-release central generate k8s should work when main and scanner are from different registries" {
@@ -42,8 +42,8 @@ teardown() {
     'example2.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example2.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example2.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example2.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example2.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-release central generate k8s should work when main is from custom registry and --image-defaults are used" {
@@ -83,8 +83,8 @@ teardown() {
     'example.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-release central generate openshift should work when main and scanner are from different registries" {
@@ -93,8 +93,8 @@ teardown() {
     'example2.com' \
     '--main-image' 'example.com/main:1.2.3' \
     '--central-db-image' 'example.com/central-db:1.2.3' \
-    '--scanner-image' 'example2.com/scanner:1.2.3' \
-    '--scanner-db-image' 'example2.com/scanner-db:1.2.3'
+    '--scanner-v4-image' 'example2.com/scanner-v4:1.2.3' \
+    '--scanner-v4-db-image' 'example2.com/scanner-v4-db:1.2.3'
 }
 
 @test "roxctl-release central generate openshift should work when main is from custom registry and --image-defaults are used" {
diff --git a/tests/roxctl/bats-tests/local/expect/flavor-interactive.expect.tcl b/tests/roxctl/bats-tests/local/expect/flavor-interactive.expect.tcl
index c3bf7c76f62e0..e734d7449388e 100755
--- a/tests/roxctl/bats-tests/local/expect/flavor-interactive.expect.tcl
+++ b/tests/roxctl/bats-tests/local/expect/flavor-interactive.expect.tcl
@@ -21,8 +21,8 @@ set registry [lindex $argv 3]
 # exitWith is an integer interpreted as binary field, where each bit denotes a different error
 # 8 - a question has not been displayed
 # 4 - prompt for entering main-image       is missing default value hint
-# 2 - prompt for entering scanner-db-image is missing default value hint
-# 1 - prompt for entering scanner-image    is missing default value hint
+# 2 - prompt for entering scanner-v4-db-image is missing default value hint
+# 1 - prompt for entering scanner-v4-image    is missing default value hint
 # 0 - no error
 set exitWith 0
 
@@ -100,55 +100,7 @@ expect "List of config maps to add as declarative configuration*:" { send "\n" }
 expect "The deployment tool to use (kubectl, helm, helm-values)*:" { send "\n" }
 expect "Istio version when deploying into an Istio-enabled cluster*:" { send "\n" }
 
-# The scanner-db image to use (default: "docker.io/stackrox/scanner-db:2.21.0-15-g448f2dc8fa"):
-# The scanner-db image to use (default: "quay.io/stackrox-io/scanner-db:3.67.x-296-g56df6a892d"):
-# The scanner-db image to use (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9:3.68.x-30-g516b4e7a6c-dirty"):
-expect {
-  default {
-    send_user "\nFATAL: No question about scanner-db image\n"
-    exit 8
-  }
-  "The scanner-db * (if unset, the default will be used):" {
-    send_user "WARNING: roxctl does not suggest any registry for scanner-db"
-    send "\n"
-    set exitWith [expr {$exitWith + 2}]
-  }
-  "The scanner-db * (default: \"$registry/scanner-db:*\"):" {
-    send_user "roxctl suggests correct registry for scanner-db"
-    send "\n"
-  }
-  # Special case for RHACS to avoid writing a regexp in TCL
-  "The scanner-db * (default: \"$registry/rhacs-scanner-db-rhel9:*\"):" {
-    send_user "roxctl suggests correct registry for scanner-db"
-    send "\n"
-  }
-}
-# The scanner image to use (default: "docker.io/stackrox/scanner:2.21.0-15-g448f2dc8fa"):
-# The scanner image to use (default: "quay.io/stackrox-io/scanner:3.67.x-296-g56df6a892d"):
-expect {
-  default {
-    send_user "\nFATAL: No question about scanner image\n"
-    exit 8
-  }
-  "The scanner * (if unset, the default will be used):" {
-    send_user "exitWith before $exitWith"
-    send_user "WARNING: roxctl does not suggest any registry for scanner"
-    send "\n"
-    set exitWith [expr {$exitWith + 1}]
-    send_user "exitWith is now $exitWith"
-  }
-  "The scanner * (default: \"$registry/scanner:*\"):" {
-    send_user "roxctl suggests correct registry for scanner"
-    send "\n"
-  }
-  # Special case for RHACS to avoid writing a regexp in TCL
-  "The scanner * (default: \"$registry/rhacs-scanner-rhel9:*\"):" {
-    send_user "roxctl suggests correct registry for scanner"
-    send "\n"
-  }
-}
-
-# The scanner-v4-db image to use (if unset, a default will be used according to --image-defaults) (default: "quay.io/rhacs-eng/scanner-v4:4.3.x-1304-g0b0cc2d4f7"):
+# The scanner-v4-db image to use (if unset, a default will be used according to --image-defaults) (default: "quay.io/rhacs-eng/scanner-v4-db:4.3.x-1304-g0b0cc2d4f7"):
 expect {
   default {
     send_user "\nFATAL: No question about scanner-v4-db image\n"
diff --git a/tests/roxctl/bats-tests/local/roxctl-helm-output-central-development.bats b/tests/roxctl/bats-tests/local/roxctl-helm-output-central-development.bats
index 2a38b8e73229b..3b44a7b116139 100755
--- a/tests/roxctl/bats-tests/local/roxctl-helm-output-central-development.bats
+++ b/tests/roxctl/bats-tests/local/roxctl-helm-output-central-development.bats
@@ -42,7 +42,7 @@ teardown() {
   run roxctl-development helm output central-services --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'quay.io/rhacs-eng' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'quay.io/rhacs-eng' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-development helm output central-services --rhacs should use redhat.io registry and display deprecation warning" {
@@ -50,7 +50,7 @@ teardown() {
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
   has_deprecation_warning
-  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-development helm output central-services --image-defaults=dummy should fail" {
@@ -63,21 +63,21 @@ teardown() {
   run roxctl-development helm output central-services --image-defaults=rhacs --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-development helm output central-services --image-defaults=development_build should use quay.io/rhacs-eng registry" {
   run roxctl-development helm output central-services --image-defaults=development_build --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'quay.io/rhacs-eng' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'quay.io/rhacs-eng' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-development helm output central-services --image-defaults=opensource should use quay.io/stackrox-io registry" {
   run roxctl-development helm output central-services --image-defaults=opensource --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'quay.io/stackrox-io' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'quay.io/stackrox-io' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-development helm output central-services --rhacs --image-defaults=development_build should return error about --rhacs colliding with --image-defaults" {
diff --git a/tests/roxctl/bats-tests/local/roxctl-helm-output-central-release.bats b/tests/roxctl/bats-tests/local/roxctl-helm-output-central-release.bats
index cd0b995fa5804..b0dcb17d8001e 100755
--- a/tests/roxctl/bats-tests/local/roxctl-helm-output-central-release.bats
+++ b/tests/roxctl/bats-tests/local/roxctl-helm-output-central-release.bats
@@ -30,7 +30,7 @@ teardown() {
   run roxctl-release helm output central-services --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-release helm output central-services --rhacs should use registry.redhat.io registry and display deprecation warning" {
@@ -38,28 +38,28 @@ teardown() {
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
   has_deprecation_warning
-  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-release helm output central-services --image-defaults=rhacs should use registry.redhat.io registry" {
   run roxctl-release helm output central-services --image-defaults=rhacs --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'registry.redhat.io' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-release helm output central-services --image-defaults=development_build should use quay.io/rhacs-eng registry" {
   run roxctl-release helm output central-services --image-defaults=development_build --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'quay.io/rhacs-eng' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'quay.io/rhacs-eng' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-release helm output central-services --image-defaults=opensource should use quay.io/stackrox-io registry" {
   run roxctl-release helm output central-services --image-defaults=opensource --output-dir "$out_dir"
   assert_success
   assert_output --partial "Written Helm chart central-services to directory"
-  assert_helm_template_central_registry "$out_dir" 'quay.io/stackrox-io' "$any_version" 'main' 'scanner' 'scanner-db'
+  assert_helm_template_central_registry "$out_dir" 'quay.io/stackrox-io' "$any_version" 'main' 'scanner-v4-indexer' 'scanner-v4-db'
 }
 
 @test "roxctl-release helm output central-services --image-defaults='' should fail with unexpected value of --image-defaults" {
diff --git a/tests/roxctl/token-file.sh b/tests/roxctl/token-file.sh
index 96651e7a76f92..1962935b62896 100755
--- a/tests/roxctl/token-file.sh
+++ b/tests/roxctl/token-file.sh
@@ -13,22 +13,68 @@ eecho() {
   echo "$@" >&2
 }
 
+die() {
+  eecho "$@"
+  exit 1
+}
+
 curl_cfg() { # Use built-in echo to not expose $2 in the process list.
   echo -n "$1 = \"${2//[\"\\]/\\&}\""
 }
 
-# Retrieve API token
+# token_file_has_token rejects jq's "null" for a missing .token field.
+token_file_has_token() {
+  local token
+  token="$(cat "$TOKEN_FILE")"
+  [ -n "$token" ] && [ "$token" != "null" ]
+}
+
+request_api_token() {
+  # wait_for_api_token owns retries; curl --retry would multiply generate POSTs.
+  curl -k -f \
+    --config <(curl_cfg user "admin:$ROX_ADMIN_PASSWORD") \
+    -d '{"name": "test", "role": "Admin"}' \
+    --connect-timeout 10 \
+    --max-time 30 \
+    "https://$API_ENDPOINT/v1/apitokens/generate"
+}
+
+write_token_file() {
+  local response
+  response="$(request_api_token)" || return 1
+  printf '%s' "$response" | jq -r .token > "$TOKEN_FILE" || return 1
+  token_file_has_token
+}
+
+# sleep_before_next_attempt waits 1s, 2s, 4s, then 8s after attempts 1-4.
+sleep_before_next_attempt() {
+  case "$1" in
+    1) sleep 1 ;;
+    2) sleep 2 ;;
+    3) sleep 4 ;;
+    4) sleep 8 ;;
+  esac
+}
+
+wait_for_api_token() {
+  local attempt=1
+  local max_attempts=5
+
+  while [ "$attempt" -le "$max_attempts" ]; do
+    if write_token_file; then
+      return 0
+    fi
+    if [ "$attempt" -eq "$max_attempts" ]; then
+      die "Failed to retrieve API token after ${max_attempts} attempts: token file is empty"
+    fi
+    eecho "Token generate attempt ${attempt}/${max_attempts} failed, retrying..."
+    sleep_before_next_attempt "$attempt"
+    attempt=$((attempt + 1))
+  done
+}
+
 TOKEN_FILE=$(mktemp)
-curl -k -f \
-  --config <(curl_cfg user "admin:$ROX_ADMIN_PASSWORD") \
-  -d '{"name": "test", "role": "Admin"}' \
-  --retry 5 \
-  --retry-connrefused \
-  "https://$API_ENDPOINT/v1/apitokens/generate" \
-  | jq -r .token \
-  > "$TOKEN_FILE"
-
-[ -n "$(cat "$TOKEN_FILE")" ]
+wait_for_api_token
 
 test_roxctl_cmd() {
   echo "Testing command: roxctl " "$@"
diff --git a/tests/upgrade/lib.sh b/tests/upgrade/lib.sh
index 58b62ce1cb8ca..7755bacf0b10b 100644
--- a/tests/upgrade/lib.sh
+++ b/tests/upgrade/lib.sh
@@ -5,19 +5,28 @@ set -euo pipefail
 
 # Test utility functions for upgrades
 
+central_deployment_count() {
+    curl -sSk --config <(curl_cfg user "admin:$ROX_ADMIN_PASSWORD") -X POST \
+        -d '{"operationName":"summary_counts","variables":{},"query":"query summary_counts { clusterCount nodeCount violationCount deploymentCount imageCount secretCount }"}' \
+        "https://$API_ENDPOINT/api/graphql" | jq '.data.deploymentCount' -r
+}
+
 wait_for_central_reconciliation() {
     info "Waiting for central reconciliation"
 
-    # Reconciliation is rather slow in this case, since the central has a DB with a bunch of deployments,
-    # none of which exist. So when sensor connects, the reconciliation deletion takes a while to flush.
-    # This causes flakiness with the smoke tests.
-    # To mitigate this, wait for the deployments to get deleted before running the tests.
+    # Sensor reconnect flushes deployments that no longer exist on the
+    # cluster. Smoke flakes if that leftover count is still high.
     local success=0
+    local i
     for i in $(seq 1 90); do
         local numDeployments
-        numDeployments="$(curl -sSk --config <(curl_cfg user "admin:$ROX_ADMIN_PASSWORD") -X POST -d "{\"operationName\":\"summary_counts\",\"variables\":{},\"query\":\"query summary_counts {\n  clusterCount\n  nodeCount\n  violationCount\n  deploymentCount\n  imageCount\n  secretCount\n}\"}" "https://$API_ENDPOINT/api/graphql" | jq '.data.deploymentCount' -r)"
+        numDeployments="$(central_deployment_count)"
         echo "Try number ${i}. Number of deployments in Central: $numDeployments"
-        [[ -n "$numDeployments" ]]
+        # GraphQL returns null while Central is still coming up; retry.
+        if [[ -z "$numDeployments" || "$numDeployments" == "null" ]]; then
+            sleep 10
+            continue
+        fi
         if [[ "$numDeployments" -lt 100 ]]; then
             success=1
             break
@@ -27,29 +36,6 @@ wait_for_central_reconciliation() {
     [[ "$success" == 1 ]]
 }
 
-wait_for_scanner_to_be_ready() {
-    echo "Waiting for scanner to be ready"
-    start_time="$(date '+%s')"
-    while true; do
-      scanner_json="$(kubectl -n stackrox get deploy/scanner -o json)"
-      replicas="$(jq '.status.replicas' <<<"${scanner_json}")"
-      readyReplicas="$(jq '.status.readyReplicas' <<<"${scanner_json}")"
-      echo "scanner replicas: $replicas"
-      echo "scanner readyReplicas: $readyReplicas"
-      if [[  "$replicas" == "$readyReplicas" ]]; then
-        break
-      fi
-      if (( $(date '+%s') - start_time > 1200 )); then
-        kubectl -n stackrox get pod -o wide
-        kubectl -n stackrox get deploy -o wide
-        echo >&2 "Timed out after 20m"
-        exit 1
-      fi
-      sleep 5
-    done
-    echo "Scanner is ready"
-}
-
 validate_upgrade() {
     if [[ "$#" -ne 3 ]]; then
         die "missing args. usage: validate_upgrade <stage name> <stage description> <upgrade_cluster_id>"
@@ -84,65 +70,114 @@ function roxcurl() {
   curl --config <(curl_cfg user "admin:${ROX_ADMIN_PASSWORD}") -k "https://${API_ENDPOINT}${url}" "$@"
 }
 
-deploy_earlier_postgres_central() {
+wait_for_background_migrations() {
+    info "Waiting for background migrations to complete..."
+    local retries=10
+    local interval=30
+    local i
+    local target_seqnum
+    target_seqnum=$(get_target_bg_migration_seqnum)
+    local db_password
+    db_password=$(kubectl -n stackrox get secret central-db-password -o jsonpath='{.data.password}' | base64 -d) || true
+    info "Target background migration seqnum: $target_seqnum"
+    for ((i=0; i<retries; i++)); do
+        local db_seqnum
+        if db_seqnum=$(kubectl -n stackrox exec deploy/central-db -c central-db -- \
+            bash -c "PGPASSWORD='${db_password}' psql -U postgres -d central_active -tAc 'SELECT seqnum FROM background_migration_versions LIMIT 1'" 2>&1); then
+            db_seqnum=$(echo "$db_seqnum" | tr -d '[:space:]')
+            if [[ "$db_seqnum" -ge "$target_seqnum" ]] 2>/dev/null; then
+                info "Background migrations complete (seqnum: $db_seqnum)"
+                return 0
+            fi
+            info "Background migrations not yet complete (seqnum: ${db_seqnum:-null}, target: $target_seqnum), attempt $((i+1))/$retries"
+        else
+            info "DB query failed (attempt $((i+1))/$retries): $db_seqnum"
+        fi
+        if (( i < retries - 1 )); then
+            sleep "$interval"
+        fi
+    done
+    die "Background migrations did not complete within $((retries * interval)) seconds"
+}
+
+get_target_bg_migration_seqnum() {
+    sed -n 's/^const CurrentBgMigrationSeqNum = \([0-9][0-9]*\)$/\1/p' \
+        "$TEST_ROOT/central/backgroundmigrations/seq_num.go"
+}
+
+deploy_earlier_tag_central() {
     info "Deploying: $EARLIER_TAG..."
 
-    make cli
-
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" command -v roxctl
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl version
-
-    # Let's try helm
-    ROX_ADMIN_PASSWORD="$(tr -dc _A-Z-a-z-0-9 < /dev/urandom | head -c12 || true)"
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl helm output central-services --image-defaults opensource --output-dir /tmp/early-stackrox-central-services-chart --remove
-
-    helm install -n stackrox --create-namespace stackrox-central-services /tmp/early-stackrox-central-services-chart \
-         --set central.adminPassword.value="${ROX_ADMIN_PASSWORD}" \
-         --set central.db.enabled=true \
-         --set central.db.persistence.persistentVolumeClaim.size="${PVC_SIZE:-100Gi}" \
-         --set central.persistence.none=true \
-         --set central.exposure.loadBalancer.enabled=true \
-         --set system.enablePodSecurityPolicies=false \
-         --set central.image.tag="${EARLIER_TAG}" \
-         --set central.db.image.tag="${EARLIER_TAG}" \
-         --set scanner.image.tag="$(cat SCANNER_VERSION)" \
-         --set scanner.dbImage.tag="$(cat SCANNER_VERSION)" \
-         --set scanner.resources.limits.memory="6Gi"
-
-    # Installing this way returns faster than the scripts but everything isn't running when it finishes like with
-    # the scripts.  So we will give it a minute for things to get started before we proceed
-    sleep 60
-
-    ROX_USERNAME="admin"
+    local roxie_envrc
+    roxie_envrc="$(mktemp)"
+    roxie deploy central --verbose \
+        --single-namespace \
+        --envrc "${roxie_envrc}" \
+        --tag "${EARLIER_TAG}" \
+        --resources ci \
+        --pause-reconciliation `# subsequent tests mangle resources and image` \
+        --exposure loadbalancer \
+        --set central.spec.central.db.persistence.persistentVolumeClaim.storageClassName=premium-rwo `# i.e. type: pd-ssd` \
+        --set central.spec.scannerV4.db.persistence.persistentVolumeClaim.storageClassName=premium-rwo \
+        "$@"
+    # shellcheck disable=SC1090
+    source "${roxie_envrc}"
+    rm -f "${roxie_envrc}"
     ci_export "ROX_USERNAME" "$ROX_USERNAME"
     ci_export "ROX_ADMIN_PASSWORD" "$ROX_ADMIN_PASSWORD"
 }
 
-restore_4_6_backup() {
-    info "Restoring a 4.6 backup into a newer central"
+# upgrade_operator_to_head upgrades the operator to the HEAD version
+# and resumes central reconciliation so the upgrade is processed.
+upgrade_operator_to_head() {
+    local namespace="${1:-stackrox}"
+    local image_tag="${2:-$CURRENT_TAG}"
 
-    restore_4_6_postgres_backup
+    info "Upgrading central to HEAD version with Scanner V4"
+
+    roxie deploy operator --verbose \
+        --single-namespace \
+        --tag "${image_tag}"
+
+    # SCANNER_V4_MATCHER_READINESS=vulnerability keeps matcher unready until
+    # the vuln DB is loaded, which wait_for_scanner_V4 then waits on.
+    kubectl -n "${namespace}" patch centrals.platform.stackrox.io stackrox-central-services --type merge \
+        -p '{"spec":{"customize":{"envVars":[{"name": "SCANNER_V4_MATCHER_READINESS","value":"vulnerability"}]}}}'
+
+    kubectl annotate -n "${namespace}" centrals.platform.stackrox.io stackrox-central-services \
+        stackrox.io/pause-reconcile-
+
+    export SCANNER_V4_VULN_READINESS=true
+    wait_for_api "$namespace"
+    wait_for_central_db "$namespace"
+    wait_for_scanner_V4 "$namespace"
+}
+
+restore_backup() {
+    info "Restoring a backup into a newer central"
+
+    restore_postgres_backup
 }
 
 force_rollback() {
-    info "Forcing a rollback to $FORCE_ROLLBACK_VERSION"
+    info "Forcing a rollback to ${EARLIER_TAG}"
 
     local upgradeStatus
     upgradeStatus=$(curl -sSk -X GET --config <(curl_cfg user "admin:${ROX_ADMIN_PASSWORD}") https://"${API_ENDPOINT}"/v1/centralhealth/upgradestatus)
     echo "upgrade status: ${upgradeStatus}"
     test_equals_non_silent "$(echo "$upgradeStatus" | jq '.upgradeStatus.version' -r)" "$(make --quiet --no-print-directory tag)"
-    test_equals_non_silent "$(echo "$upgradeStatus" | jq '.upgradeStatus.forceRollbackTo' -r)" "$FORCE_ROLLBACK_VERSION"
+    test_equals_non_silent "$(echo "$upgradeStatus" | jq '.upgradeStatus.forceRollbackTo' -r)" "${EARLIER_TAG}"
     test_equals_non_silent "$(echo "$upgradeStatus" | jq '.upgradeStatus.canRollbackAfterUpgrade' -r)" "true"
 
     kubectl -n stackrox get configmap/central-config -o yaml | yq e '{"data": .data}' - >/tmp/force_rollback_patch
     local central_config
-    central_config=$(yq e '.data["central-config.yaml"]' /tmp/force_rollback_patch | yq e ".maintenance.forceRollbackVersion = \"$FORCE_ROLLBACK_VERSION\"" -)
+    central_config=$(yq e '.data["central-config.yaml"]' /tmp/force_rollback_patch | yq e ".maintenance.forceRollbackVersion = \"${EARLIER_TAG}\"" -)
     local config_patch
     config_patch=$(yq e ".data[\"central-config.yaml\"] |= \"$central_config\"" /tmp/force_rollback_patch)
     echo "config patch: $config_patch"
 
     kubectl -n stackrox patch configmap/central-config -p "$config_patch"
-    kubectl -n stackrox set image deploy/central "central=$REGISTRY/main:$FORCE_ROLLBACK_VERSION"
+    kubectl -n stackrox set image deploy/central "central=$REGISTRY/main:${EARLIER_TAG}"
 }
 
 validate_sensor_bundle_via_upgrader() {
@@ -453,3 +488,35 @@ preamble() {
         require_executable yq
     fi
 }
+
+deploy_scaled_workload() {
+    info "Deploying a scaled workload"
+
+    roxie deploy secured-cluster --verbose \
+        --single-namespace \
+        --tag "${EARLIER_TAG}" \
+        --resources ci \
+        --pause-reconciliation \
+        --early-readiness \
+        --set securedCluster.spec.clusterName=scale-remote
+
+    ./scale/launch_workload.sh scale-test
+
+    # The historical scale script requests 5 CPUs per component. Leave room for
+    # both scanners by reducing Central and Central DB's CPU reservations.
+    kubectl -n stackrox patch deploy/central --type=strategic -p \
+        '{"spec":{"template":{"spec":{"containers":[{"name":"central","resources":{"requests":{"cpu":"2"}}}]}}}}'
+    # Init-container requests also count toward the pod's CPU reservation.
+    kubectl -n stackrox patch deploy/central-db --type=strategic -p \
+        '{"spec":{"template":{"spec":{"containers":[{"name":"central-db","resources":{"requests":{"cpu":"2"}}}],"initContainers":[{"name":"init-db","resources":{"requests":{"cpu":"2"}}}]}}}}'
+    wait_for_api
+
+    info "Sleep for a bit to let the scale build"
+    # shellcheck disable=SC2034
+    for i in $(seq 1 150); do
+        echo -n .
+        sleep 5
+    done
+
+    info "Done with our nap for scaling"
+}
diff --git a/tests/upgrade/postgres_run.sh b/tests/upgrade/postgres_run.sh
index 59a9e0c769849..5e28c565a78fa 100755
--- a/tests/upgrade/postgres_run.sh
+++ b/tests/upgrade/postgres_run.sh
@@ -7,12 +7,11 @@ set -euo pipefail
 
 TEST_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)"
 
-EARLIER_TAG="4.6.2"
-EARLIER_SHA="ecff2a443c8b9a2dc7bf606162da89da81dd8e9e"
+EARLIER_TAG="4.10.0"
+EARLIER_SHA="7b817fa511ac4533cdf2d79a1b8e04d4d7557ad2"
 CURRENT_TAG="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory tag)"}"
 COLLECTOR_TAG="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory collector-tag)"}"
-SCANNER_TAG="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory scanner-tag)"}"
-PREVIOUS_RELEASES=("4.6.10" "4.7.9" "4.8.11" "4.9.10" "4.10.6" "4.11.2")
+PREVIOUS_RELEASES=("4.10.7" "4.11.3")
 
 # shellcheck source=../../scripts/lib.sh
 source "$TEST_ROOT/scripts/lib.sh"
@@ -44,18 +43,13 @@ test_upgrade() {
 
     # repo for old version with legacy database
     REPO_FOR_TIME_TRAVEL="/tmp/rox-postgres-upgrade-test"
-    DEPLOY_DIR="deploy/k8s"
-    QUAY_REPO="stackrox-io"
+    QUAY_REPO="rhacs-eng"
     REGISTRY="quay.io/$QUAY_REPO"
 
-    export OUTPUT_FORMAT="helm"
-    export STORAGE="pvc"
     export CLUSTER_TYPE_FOR_TEST=K8S
 
     if is_CI; then
         export ROXCTL_IMAGE_REPO="quay.io/$QUAY_REPO/roxctl"
-        require_environment "LONGTERM_LICENSE"
-        export ROX_LICENSE_KEY="${LONGTERM_LICENSE}"
     fi
 
     preamble
@@ -77,9 +71,6 @@ test_upgrade_paths() {
 
     local log_output_dir="$1"
 
-    # To test we remain backwards compatible rollback to 4.6.x
-    FORCE_ROLLBACK_VERSION="${EARLIER_TAG}"
-
     cd "$REPO_FOR_TIME_TRAVEL"
     git checkout "$EARLIER_SHA"
 
@@ -90,13 +81,20 @@ test_upgrade_paths() {
     export MAX_WAIT_SECONDS=600
 
     ########################################################################################
-    # Use roxctl to generate helm files and deploy older central                           #
+    # Use roxie to deploy older central                                                    #
     ########################################################################################
-    deploy_earlier_postgres_central
+    deploy_earlier_tag_central
     wait_for_api
     setup_client_TLS_certs
 
-    restore_4_6_backup
+    # Older checkouts force GOTOOLCHAIN=local during dependency checks.
+    # Put the toolchain selected for this checkout first on PATH for the build.
+    # Needed for restore_backup to find roxctl.
+    local build_goroot
+    build_goroot="$(go env GOROOT)"
+    PATH="${build_goroot}/bin:${PATH}" make cli
+
+    restore_backup
     wait_for_api
 
     # Run with some scale to have data populated to migrate
@@ -134,8 +132,6 @@ test_upgrade_paths() {
     kubectl -n stackrox delete po "$(kubectl -n stackrox get po -l app=central -o=jsonpath='{.items[0].metadata.name}')" --grace-period=0
     wait_for_api
     sensor_wait
-    # Bounce collectors to avoid restarts on initial module pull
-    kubectl -n stackrox delete pod -l app=collector --grace-period=0
 
     # Verify data is still there
     checkForPostgresAccessScopes
@@ -190,6 +186,7 @@ test_upgrade_paths() {
     kubectl -n stackrox set image deploy/central "*=$REGISTRY/main:$CURRENT_TAG"
     kubectl -n stackrox set image deploy/central-db "*=$REGISTRY/central-db:$CURRENT_TAG"
     wait_for_api
+    wait_for_background_migrations
 
     # Verify data is still there
     checkForPostgresAccessScopes
@@ -216,40 +213,36 @@ test_upgrade_paths() {
 
     touch "${UPGRADE_PROGRESS_POSTGRES_ROLLBACK}"
 
-    # Now go back to the current release
-    kubectl -n stackrox set image deploy/central "*=$REGISTRY/main:$CURRENT_TAG"
-    kubectl -n stackrox set image deploy/central-db "*=$REGISTRY/central-db:$CURRENT_TAG"
-
-    wait_for_api
+    # Now go back to the current release. The HEAD installs Scanner V4,
+    # which smoke test needs. Secured cluster still has reconciliation paused at this point.
+    upgrade_operator_to_head
+    wait_for_background_migrations
 
     # Cleanup the scaled sensor before smoke tests
-    helm uninstall -n stackrox stackrox-secured-cluster-services
+    roxie teardown secured-cluster --verbose --single-namespace
 
     # Remove scaled Sensor from Central
-    "$TEST_ROOT/bin/$TEST_HOST_PLATFORM/roxctl" -e "$API_ENDPOINT" --ca "" --insecure-skip-tls-verify cluster delete --name scale-remote
+    "$TEST_ROOT/bin/$TEST_HOST_PLATFORM/roxctl" cluster delete --name scale-remote
 
-    info "Fetching a sensor bundle for cluster 'remote'"
+    info "Fetching an init bundle for cluster 'remote'"
+    # This is necessary since the cluster already exists in the database restored from backup, so the CRS
+    # created by roxie is useless (you cannot re-register a cluster using CRS by design).
+    # TODO(ROX-37449): switch to just sensor cert when possible.
     "$TEST_ROOT/bin/$TEST_HOST_PLATFORM/roxctl" version
-    rm -rf sensor-remote
-    "$TEST_ROOT/bin/$TEST_HOST_PLATFORM/roxctl" -e "$API_ENDPOINT" --ca "" --insecure-skip-tls-verify sensor get-bundle remote
-    [[ -d sensor-remote ]]
+    local init_bundle
+    init_bundle="$(mktemp)"
+    "$TEST_ROOT/bin/$TEST_HOST_PLATFORM/roxctl" central init-bundles generate remote --output-secrets - > "${init_bundle}"
+    kubectl apply -n stackrox -f "${init_bundle}"
+    rm -f "${init_bundle}"
 
     info "Installing sensor"
-    ./sensor-remote/sensor.sh
-    kubectl -n stackrox set image deploy/sensor "*=$REGISTRY/main:$CURRENT_TAG"
-    kubectl -n stackrox set image deploy/admission-control "*=$REGISTRY/main:$CURRENT_TAG"
-    kubectl -n stackrox set image ds/collector "collector=$REGISTRY/collector:${COLLECTOR_TAG}" \
-        "compliance=$REGISTRY/main:$CURRENT_TAG"
-    if [[ "$(kubectl -n stackrox get ds/collector -o=jsonpath='{$.spec.template.spec.containers[*].name}')" == *"node-inventory"* ]]; then
-        echo "Upgrading node-inventory container"
-        kubectl -n stackrox set image ds/collector "node-inventory=$REGISTRY/scanner-slim:${SCANNER_TAG}"
-    else
-        echo "Skipping node-inventory container as this is not Openshift 4"
-    fi
+    roxie deploy secured-cluster --verbose \
+        --single-namespace \
+        --tag "${CURRENT_TAG}" \
+        --resources ci \
+        --set securedCluster.spec.clusterName=remote
 
     sensor_wait
-    # Bounce collectors to avoid restarts on initial module pull
-    kubectl -n stackrox delete pod -l app=collector --grace-period=0
 
     wait_for_central_reconciliation
 
@@ -267,7 +260,7 @@ test_upgrade_paths() {
 }
 
 force_rollback_to_previous_postgres() {
-    info "Forcing a rollback to $FORCE_ROLLBACK_VERSION"
+    info "Forcing a rollback to ${EARLIER_TAG}"
 
     local upgradeStatus
     upgradeStatus=$(curl -sSk -X GET --config <(curl_cfg user "admin:${ROX_ADMIN_PASSWORD}") https://"${API_ENDPOINT}"/v1/centralhealth/upgradestatus)
@@ -277,7 +270,7 @@ force_rollback_to_previous_postgres() {
 
     kubectl -n stackrox get configmap/central-config -o yaml | yq e '{"data": .data}' - >/tmp/force_rollback_patch
     local central_config
-    central_config=$(yq e '.data["central-config.yaml"]' /tmp/force_rollback_patch | yq e ".maintenance.forceRollbackVersion = \"$FORCE_ROLLBACK_VERSION\"" -)
+    central_config=$(yq e '.data["central-config.yaml"]' /tmp/force_rollback_patch | yq e ".maintenance.forceRollbackVersion = \"${EARLIER_TAG}\"" -)
     local config_patch
     config_patch=$(yq e ".data[\"central-config.yaml\"] |= \"$central_config\"" /tmp/force_rollback_patch)
     echo "config patch: $config_patch"
@@ -291,43 +284,10 @@ force_rollback_to_previous_postgres() {
     kubectl -n stackrox set env deploy/sensor ROX_PROCESSES_LISTENING_ON_PORT=false
 
     kubectl -n stackrox patch configmap/central-config -p "$config_patch"
-    kubectl -n stackrox set image deploy/central "central=$REGISTRY/main:$FORCE_ROLLBACK_VERSION"
-
-    # Do not rollback central-db image, since downgrade from PG15 to PG13 is
-    # not possible.
-}
-
-deploy_scaled_workload() {
-    info "Deploying a scaled workload"
-
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl version
-
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl helm output secured-cluster-services --image-defaults opensource --output-dir /tmp/early-stackrox-secured-services-chart --remove
-
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl -e "$API_ENDPOINT" central init-bundles generate scale-remote --output /tmp/cluster-init-bundle.yaml
-
-    helm install -n stackrox --create-namespace \
-        stackrox-secured-cluster-services /tmp/early-stackrox-secured-services-chart \
-        -f /tmp/cluster-init-bundle.yaml \
-        --set system.enablePodSecurityPolicies=false \
-        --set clusterName=scale-remote \
-        --set image.main.tag="${EARLIER_TAG}" \
-        --set image.collector.tag="${EARLIER_TAG}" \
-        --set centralEndpoint="$API_ENDPOINT"
-
-    sensor_wait
-
-    ./scale/launch_workload.sh scale-test
-    wait_for_api
-
-    info "Sleep for a bit to let the scale build"
-    # shellcheck disable=SC2034
-    for i in $(seq 1 150); do
-        echo -n .
-        sleep 5
-    done
+    kubectl -n stackrox set image deploy/central "central=$REGISTRY/main:${EARLIER_TAG}"
 
-    info "Done with our nap for scaling"
+    # Keep the upgraded central-db image when rolling Central back, since the
+    # upgraded data directory cannot be used by an older PostgreSQL major version.
 }
 
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
diff --git a/tests/upgrade/postgres_upgrade_run.sh b/tests/upgrade/postgres_upgrade_run.sh
index 28c1e62969ece..4fc0762258ab2 100755
--- a/tests/upgrade/postgres_upgrade_run.sh
+++ b/tests/upgrade/postgres_upgrade_run.sh
@@ -3,29 +3,67 @@
 
 set -euo pipefail
 
-# Tests upgrade to Postgres.
+# Tests PostgreSQL major-version upgrades.
 
 TEST_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)"
 
-EARLIER_TAG="4.7.2"
-EARLIER_SHA="ef2060ed332c7b8513cb9eb52b9745df9a8285cc"
-CURRENT_TAG="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory tag)"}"
-PREVIOUS_RELEASES=("4.7.3")
+EARLIER_TAG="4.10.0"
+EARLIER_SHA="7b817fa511ac4533cdf2d79a1b8e04d4d7557ad2"
 
 # shellcheck source=../../scripts/lib.sh
 source "$TEST_ROOT/scripts/lib.sh"
-# shellcheck source=../../scripts/ci/lib.sh
-source "$TEST_ROOT/scripts/ci/lib.sh"
-# shellcheck source=../../scripts/ci/sensor-wait.sh
-source "$TEST_ROOT/scripts/ci/sensor-wait.sh"
-# shellcheck source=../../scripts/setup-certs.sh
-source "$TEST_ROOT/tests/scripts/setup-certs.sh"
-# shellcheck source=../../tests/e2e/lib.sh
-source "$TEST_ROOT/tests/e2e/lib.sh"
-# shellcheck source=../../tests/upgrade/lib.sh
-source "$TEST_ROOT/tests/upgrade/lib.sh"
-# shellcheck source=../../tests/upgrade/validation.sh
-source "$TEST_ROOT/tests/upgrade/validation.sh"
+
+postgres_major_version() {
+    # Current images use ARG PG_VERSION; older releases put the major directly in FROM.
+    local version
+    version="$(sed -n \
+        -e 's/^[[:space:]]*ARG[[:space:]]\+PG_VERSION=\([1-9][0-9]*\)[[:space:]]*$/\1/p' \
+        -e 's/^[[:space:]]*FROM[[:space:]].*\/postgresql-\([1-9][0-9]*\)-.*$/\1/p')"
+    # Missing or ambiguous versions must fail the check, not silently skip coverage.
+    [[ "$version" =~ ^[1-9][0-9]*$ ]] || return 1
+    echo "$version"
+}
+
+check_postgres_upgrade() {
+    local earlier_version current_version
+    earlier_version="$(git -C "$TEST_ROOT" show "$EARLIER_SHA:image/postgres/Dockerfile" | postgres_major_version)" || \
+        die "Cannot determine PostgreSQL major version for $EARLIER_TAG ($EARLIER_SHA)"
+    current_version="$(postgres_major_version < "$TEST_ROOT/image/postgres/Dockerfile")" || \
+        die "Cannot determine PostgreSQL major version for the current checkout"
+
+    EARLIER_POSTGRES_VERSION="$earlier_version"
+    CURRENT_POSTGRES_VERSION="$current_version"
+
+    POSTGRES_UPGRADE_REQUIRED=false
+    if (( current_version > earlier_version )); then
+        POSTGRES_UPGRADE_REQUIRED=true
+        POSTGRES_UPGRADE_REASON="Running PostgreSQL upgrade suite: $EARLIER_TAG uses PostgreSQL $earlier_version; current checkout uses PostgreSQL $current_version."
+    else
+        POSTGRES_UPGRADE_REASON="Skipping PostgreSQL upgrade suite: $EARLIER_TAG uses PostgreSQL $earlier_version; current checkout uses PostgreSQL $current_version. No major-version upgrade."
+    fi
+    info "$POSTGRES_UPGRADE_REASON"
+}
+
+check_postgres_version() {
+    local expected_version="$1"
+    local db_password actual_version
+
+    kubectl -n stackrox rollout status deployment/central-db --timeout="${MAX_WAIT_SECONDS:-300}s" || \
+        die "Central DB rollout did not complete"
+
+    db_password="$(kubectl -n stackrox get secret central-db-password -o jsonpath='{.data.password}' | base64 -d)" || \
+        die "Cannot read the Central DB password"
+
+    # Pass the password on stdin so it does not appear in the exec command.
+    # shellcheck disable=SC2016
+    actual_version="$(kubectl -n stackrox exec -i deploy/central-db -c central-db -- \
+        bash -c 'PGPASSWORD="$(cat)" \
+            psql -X -w -h 127.0.0.1 -U postgres -d postgres -v ON_ERROR_STOP=1 -Atc "SHOW server_version"' <<< "$db_password")" || \
+        die "Cannot query the running PostgreSQL version"
+
+    info "Central DB is running PostgreSQL $actual_version; expected major version $expected_version"
+    test_equals_non_silent "${actual_version%%.*}" "$expected_version"
+}
 
 test_upgrade() {
     info "Starting postgres upgrade test"
@@ -42,18 +80,13 @@ test_upgrade() {
 
     # repo for old version with legacy database
     REPO_FOR_TIME_TRAVEL="/tmp/rox-postgres-upgrade-test"
-    DEPLOY_DIR="deploy/k8s"
-    QUAY_REPO="stackrox-io"
+    QUAY_REPO="rhacs-eng"
     REGISTRY="quay.io/$QUAY_REPO"
 
-    export OUTPUT_FORMAT="helm"
-    export STORAGE="pvc"
     export CLUSTER_TYPE_FOR_TEST=K8S
 
     if is_CI; then
         export ROXCTL_IMAGE_REPO="quay.io/$QUAY_REPO/roxctl"
-        require_environment "LONGTERM_LICENSE"
-        export ROX_LICENSE_KEY="${LONGTERM_LICENSE}"
     fi
 
     preamble
@@ -65,7 +98,7 @@ test_upgrade() {
 
     test_upgrade_path "$log_output_dir"
 
-    remove_existing_stackrox_resources
+    roxie teardown both --verbose --single-namespace
 
     test_not_enough_disk_space "$log_output_dir"
 }
@@ -79,8 +112,6 @@ test_upgrade_path() {
 
     local log_output_dir="$1"
 
-    FORCE_ROLLBACK_VERSION="4.7.2"
-
     cd "$REPO_FOR_TIME_TRAVEL"
     git checkout "$EARLIER_SHA"
 
@@ -91,15 +122,23 @@ test_upgrade_path() {
     export MAX_WAIT_SECONDS=600
 
     ########################################################################################
-    # Use roxctl to generate helm files and deploy older central                           #
+    # Use roxie to deploy older central                                                    #
     ########################################################################################
-    deploy_earlier_postgres_central
+    deploy_earlier_tag_central
     wait_for_api
+    check_postgres_version "$EARLIER_POSTGRES_VERSION"
     setup_client_TLS_certs
 
+    # Older checkouts force GOTOOLCHAIN=local during dependency checks.
+    # Put the toolchain selected for this checkout first on PATH for the build.
+    # Needed for restore_backup to find roxctl.
+    local build_goroot
+    build_goroot="$(go env GOROOT)"
+    PATH="${build_goroot}/bin:${PATH}" make cli
+
     # It's damn fiddly, restore is needed because later test will search for a
     # default secured cluster, created by it :(
-    restore_4_6_backup
+    restore_backup
     wait_for_api
 
     # Run with some scale to have data populated to migrate
@@ -133,11 +172,12 @@ test_upgrade_path() {
     # Extend the MUTEX timeout for this case as a restart of the db will cause locks to be held longer as it should
     kubectl -n stackrox set env deploy/central MUTEX_WATCHDOG_TIMEOUT_SECS=600
 
-    # Upgrade the image to PG15
+    # Upgrade the image to PG16
     info "Upgrade ${EARLIER_TAG} => ${CURRENT_TAG}"
     kubectl -n stackrox set image deploy/central "*=${REGISTRY}/main:${CURRENT_TAG}"
     kubectl -n stackrox set image deploy/central-db "*=${REGISTRY}/central-db:${CURRENT_TAG}"
     wait_for_api
+    check_postgres_version "$CURRENT_POSTGRES_VERSION"
 
     ########################################################################################
     # Bounce central to ensure everything starts back up.                                  #
@@ -146,8 +186,6 @@ test_upgrade_path() {
     kubectl -n stackrox delete po "$(kubectl -n stackrox get po -l app=central -o=jsonpath='{.items[0].metadata.name}')" --grace-period=0
     wait_for_api
     sensor_wait
-    # Bounce collectors to avoid restarts on initial module pull
-    kubectl -n stackrox delete pod -l app=collector --grace-period=0
 
     # Verify data is still there
     checkForPostgresAccessScopes
@@ -165,6 +203,7 @@ test_upgrade_path() {
     kubectl -n stackrox delete po "$(kubectl -n stackrox get po -l app=central-db -o=jsonpath='{.items[0].metadata.name}')" --grace-period=0
     wait_for_api
     wait_for_central_db
+    check_postgres_version "$CURRENT_POSTGRES_VERSION"
 
     # Verify data is still there
     checkForPostgresAccessScopes
@@ -191,8 +230,6 @@ test_not_enough_disk_space() {
 
     local log_output_dir="$1"
 
-    FORCE_ROLLBACK_VERSION="4.7.2"
-
     cd "$REPO_FOR_TIME_TRAVEL"
     git checkout "$EARLIER_SHA"
 
@@ -205,15 +242,15 @@ test_not_enough_disk_space() {
     ########################################################################################
     # Deploy older central using small PVC to face disk space shortage                     #
     ########################################################################################
-    PVC_SIZE="1Gi"
-    deploy_earlier_postgres_central
-    unset PVC_SIZE
+    deploy_earlier_tag_central \
+        --set central.spec.central.db.persistence.persistentVolumeClaim.size=1Gi
     wait_for_api
+    check_postgres_version "$EARLIER_POSTGRES_VERSION"
     setup_client_TLS_certs
 
     # It's damn fiddly, restore is needed because later test will search for a
     # default secured cluster, created by it :(
-    restore_4_6_backup
+    restore_backup
     wait_for_api
 
     # Do not apply scaled workload to control disk space, do fallocate instead
@@ -253,7 +290,7 @@ test_not_enough_disk_space() {
     # Extend the MUTEX timeout for this case as a restart of the db will cause locks to be held longer as it should
     kubectl -n stackrox set env deploy/central MUTEX_WATCHDOG_TIMEOUT_SECS=600
 
-    # Upgrade the image to PG15
+    # Upgrade the image to PG16
     info "Upgrade ${EARLIER_TAG} => ${CURRENT_TAG}"
     kubectl -n stackrox set image \
         deploy/central "*=${REGISTRY}/main:${CURRENT_TAG}"
@@ -266,83 +303,42 @@ test_not_enough_disk_space() {
         '{"spec": {"resources": {"requests": {"storage": "4Gi"}}}}'
     kubectl -n stackrox rollout restart deployment/central-db
     wait_for_api
+    check_postgres_version "$CURRENT_POSTGRES_VERSION"
 
     # Make sure we can restore from a physical backup and run with old binaries
     # after upgrade if needed.
-    kubectl -n stackrox set env deploy/central-db RESTORE_BACKUP=true
-    kubectl -n stackrox set env deploy/central-db FORCE_OLD_BINARIES=true
+    kubectl -n stackrox set env deploy/central-db RESTORE_BACKUP=true FORCE_OLD_BINARIES=true
     wait_for_api
+    check_postgres_version "$EARLIER_POSTGRES_VERSION"
 
     collect_and_check_stackrox_logs "$log_output_dir" "disk_space_01_final"
 }
 
-force_rollback_to_previous_postgres() {
-    info "Forcing a rollback to $FORCE_ROLLBACK_VERSION"
-
-    local upgradeStatus
-    upgradeStatus=$(curl -sSk -X GET --config <(curl_cfg user "admin:${ROX_ADMIN_PASSWORD}") https://"${API_ENDPOINT}"/v1/centralhealth/upgradestatus)
-    echo "upgrade status: ${upgradeStatus}"
-    test_equals_non_silent "$(echo "$upgradeStatus" | jq '.upgradeStatus.version' -r)" "${CURRENT_TAG}"
-    test_equals_non_silent "$(echo "$upgradeStatus" | jq '.upgradeStatus.canRollbackAfterUpgrade' -r)" "true"
-
-    kubectl -n stackrox get configmap/central-config -o yaml | yq e '{"data": .data}' - >/tmp/force_rollback_patch
-    local central_config
-    central_config=$(yq e '.data["central-config.yaml"]' /tmp/force_rollback_patch | yq e ".maintenance.forceRollbackVersion = \"$FORCE_ROLLBACK_VERSION\"" -)
-    local config_patch
-    config_patch=$(yq e ".data[\"central-config.yaml\"] |= \"$central_config\"" /tmp/force_rollback_patch)
-    echo "config patch: $config_patch"
-
-    # downgrading to a version that does not understand process listening on ports
-    # so turning that off in sensor and collector to prevent central crashes.
-    # Sensor and Collector will be deleted a few steps after this so no need
-    # to turn these back on.  Going forward unexpected messages will result in
-    # an `UNEXPECTED` log instead of crashing central.  However that change is
-    # not present in the initial 3.74 version.
-    kubectl -n stackrox set env deploy/sensor ROX_PROCESSES_LISTENING_ON_PORT=false
-
-    kubectl -n stackrox patch configmap/central-config -p "$config_patch"
-    kubectl -n stackrox set image deploy/central "central=$REGISTRY/main:$FORCE_ROLLBACK_VERSION"
-
-    # Do not rollback central-db image, since downgrade from PG15 to PG13 is
-    # not possible.
-}
-
-deploy_scaled_workload() {
-    info "Deploying a scaled workload"
-    WAIT_ITERATIONS="${1:-150}"
-
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl version
-
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl helm output secured-cluster-services --image-defaults opensource --output-dir /tmp/early-stackrox-secured-services-chart --remove
-
-    # Make sure no init bundle from previous runs is there
-    rm -f /tmp/cluster-init-bundle.yaml
-    PATH="bin/$TEST_HOST_PLATFORM:$PATH" roxctl -e "$API_ENDPOINT" central init-bundles generate scale-remote --output /tmp/cluster-init-bundle.yaml
-
-    helm install -n stackrox --create-namespace \
-        stackrox-secured-cluster-services /tmp/early-stackrox-secured-services-chart \
-        -f /tmp/cluster-init-bundle.yaml \
-        --set system.enablePodSecurityPolicies=false \
-        --set clusterName=scale-remote \
-        --set image.main.tag="${EARLIER_TAG}" \
-        --set image.collector.tag="${EARLIER_TAG}" \
-        --set centralEndpoint="$API_ENDPOINT"
-
-    sensor_wait
-
-    ./scale/launch_workload.sh scale-test
-    wait_for_api
-
-    info "Sleep for a bit to let the scale build"
-    # shellcheck disable=SC2034
-    for i in $(seq 1 $WAIT_ITERATIONS); do
-        echo -n .
-        sleep 5
-    done
-
-    info "Done with our nap for scaling"
-}
-
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
-    test_upgrade "$*"
+    check_postgres_upgrade
+    if [[ "${1:-}" == "--check" ]]; then
+        # CI checks eligibility before provisioning a cluster or running pre/post-test hooks.
+        if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+            echo "required=$POSTGRES_UPGRADE_REQUIRED" >> "$GITHUB_OUTPUT"
+        fi
+        if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+            echo "$POSTGRES_UPGRADE_REASON" >> "$GITHUB_STEP_SUMMARY"
+        fi
+    elif [[ "$POSTGRES_UPGRADE_REQUIRED" == true ]]; then
+        CURRENT_TAG="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory tag)"}"
+        # Load deployment helpers only when the suite will actually run.
+        # shellcheck source=../../scripts/ci/lib.sh
+        source "$TEST_ROOT/scripts/ci/lib.sh"
+        # shellcheck source=../../scripts/ci/sensor-wait.sh
+        source "$TEST_ROOT/scripts/ci/sensor-wait.sh"
+        # shellcheck source=../../scripts/setup-certs.sh
+        source "$TEST_ROOT/tests/scripts/setup-certs.sh"
+        # shellcheck source=../../tests/e2e/lib.sh
+        source "$TEST_ROOT/tests/e2e/lib.sh"
+        # shellcheck source=../../tests/upgrade/lib.sh
+        source "$TEST_ROOT/tests/upgrade/lib.sh"
+        # shellcheck source=../../tests/upgrade/validation.sh
+        source "$TEST_ROOT/tests/upgrade/validation.sh"
+        test_upgrade "$@"
+    fi
 fi
diff --git a/tests/versions_test.go b/tests/versions_test.go
index 28f99014f663d..29eafba439517 100644
--- a/tests/versions_test.go
+++ b/tests/versions_test.go
@@ -5,6 +5,7 @@ package tests
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/stackrox/rox/pkg/testutils/centralgrpc"
@@ -26,12 +27,16 @@ func TestVersions(t *testing.T) {
 	var versions version.Versions
 	require.NoError(t, json.NewDecoder(resp.Body).Decode(&versions))
 
-	kind := version.GetVersionKind(versions.MainVersion)
-	require.NotEqualf(t, version.InvalidKind, kind, "invalid main version %s", versions.MainVersion)
+	mainVersion := versions.MainVersion
+	if usingKonfluxImages() {
+		mainVersion = strings.TrimSuffix(mainVersion, "-fast")
+	}
+
+	kind := version.GetVersionKind(mainVersion)
+	require.NotEqualf(t, version.InvalidKind, kind, "invalid main version %s", mainVersion)
 	if kind == version.DevelopmentKind || kind == version.NightlyKind {
 		t.Skip("nothing to be checked on development versions")
 	}
 
 	assert.Equal(t, kind, version.GetVersionKind(versions.CollectorVersion), "rc and release builds should reference a corresponding collector version")
-	assert.Equal(t, kind, version.GetVersionKind(versions.ScannerVersion), "rc and release builds should reference a corresponding scanner version")
 }
diff --git a/tests/vm_scanning_suite_test.go b/tests/vm_scanning_suite_test.go
index eab9d63bf3189..f529470ab7e9b 100644
--- a/tests/vm_scanning_suite_test.go
+++ b/tests/vm_scanning_suite_test.go
@@ -90,6 +90,8 @@ type VMHandle struct {
 	ID string
 	// NodeName is the Kubernetes node hosting the VirtualMachineInstance (populated after VMI is Running).
 	NodeName string
+	// SkipReason, when set, skips this VM's subtests so other VMs still run.
+	SkipReason string
 }
 
 // VMScanningSuite exercises OpenShift VM scanning end-to-end (KubeVirt guests, roxagent, Central).
@@ -106,8 +108,12 @@ type VMScanningSuite struct {
 	dynamicClient dynamic.Interface
 	namespace     string
 
-	conn     *grpc.ClientConn
-	vmClient v2.VirtualMachineServiceClient
+	conn       *grpc.ClientConn
+	vmClient   v2.VirtualMachineServiceClient
+	vmV2Client v2.VirtualMachineV2ServiceClient
+	// enhancedVMModel follows Central's ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL.
+	// That flag selects VirtualMachineV2Service vs VirtualMachineService.
+	enhancedVMModel bool
 
 	virtctl vmhelpers.Virtctl
 
@@ -156,10 +162,12 @@ func (s *VMScanningSuite) SetupSuite() {
 	s.logf("VM scanning setup: connect to Central gRPC")
 	s.conn = centralgrpc.GRPCConnectionToCentral(t)
 	s.vmClient = v2.NewVirtualMachineServiceClient(s.conn)
+	s.vmV2Client = v2.NewVirtualMachineV2ServiceClient(s.conn)
 
 	s.logf("VM scanning setup: verify central/sensor connectivity and feature gates")
 	s.mustWaitForHealthyCentralSensorConnection()
 	s.mustVerifyVirtualMachinesFeatureEnabled()
+	s.resolveVMAPI()
 	s.logf("VM scanning setup: verify cluster VSOCK readiness")
 	mustVerifyClusterVSOCKReady(t, s.ctx, s.k8sClient, s.dynamicClient)
 
@@ -192,9 +200,9 @@ func (s *VMScanningSuite) TearDownSuite() {
 		defer s.cancel()
 	}
 
-	// When VM_SCAN_SKIP_CLEANUP is set, leave VMs and the namespace intact so a
-	// developer can SSH into the guests or inspect cluster state after a failure
-	// without having to re-provision from scratch.
+	// When VM_SCAN_SKIP_CLEANUP is set, skip VM/namespace deletion here so CI
+	// post-test can collect guest journals first; local runs use this to debug
+	// without re-provisioning.
 	if s.cfg != nil && s.cfg.SkipCleanup {
 		s.logf("teardown: VM_SCAN_SKIP_CLEANUP is set — skipping VM and namespace deletion (VMs and namespace left intact for debugging)")
 		s.closeConn()
@@ -311,6 +319,57 @@ func (s *VMScanningSuite) mustWaitForHealthyCentralSensorConnection() {
 	waitUntilCentralSensorConnectionIs(s.T(), s.ctx, storage.ClusterHealthStatus_HEALTHY)
 }
 
+// resolveVMAPI reads ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL from Central and
+// checks that the matching gRPC service is registered.
+func (s *VMScanningSuite) resolveVMAPI() {
+	t := s.T()
+	t.Helper()
+
+	flag := features.VirtualMachinesEnhancedDataModel
+	s.enhancedVMModel = s.centralFeatureEnabled(flag)
+	s.logf("VM scanning setup: Central %s=%v", flag.EnvVar(), s.enhancedVMModel)
+
+	if s.enhancedVMModel {
+		_, err := s.vmV2Client.ListVMs(s.ctx, &v2.ListVMsRequest{})
+		require.NoError(t, err, "VirtualMachineV2Service must be registered when %s is enabled", flag.EnvVar())
+		return
+	}
+	_, err := s.vmClient.ListVirtualMachines(s.ctx, &v2.ListVirtualMachinesRequest{})
+	require.NoError(t, err, "VirtualMachineService must be registered when %s is disabled", flag.EnvVar())
+}
+
+// centralFeatureEnabled reports whether flag is on in the Central deployment,
+// matching features.Enabled: explicit true/false, otherwise the flag default.
+func (s *VMScanningSuite) centralFeatureEnabled(flag features.FeatureFlag) bool {
+	t := s.T()
+	t.Helper()
+
+	obj, err := s.k8sClient.AppsV1().Deployments(namespaces.StackRox).Get(s.ctx, "central", metaV1.GetOptions{})
+	require.NoError(t, err, "get Deployment %s/central", namespaces.StackRox)
+	for _, c := range obj.Spec.Template.Spec.Containers {
+		if c.Name != "central" {
+			continue
+		}
+		for _, e := range c.Env {
+			if e.Name != flag.EnvVar() {
+				continue
+			}
+			switch strings.ToLower(strings.TrimSpace(e.Value)) {
+			case "false":
+				return false
+			case "true":
+				return true
+			default:
+				return flag.Default()
+			}
+		}
+		return flag.Default()
+	}
+	require.FailNowf(t, "container central not found in Deployment stackrox/central",
+		"available containers: %s", formatContainerNames(obj.Spec.Template.Spec.Containers))
+	return false
+}
+
 func (s *VMScanningSuite) mustVerifyVirtualMachinesFeatureEnabled() {
 	ctx, cancel := context.WithTimeout(s.ctx, featureGateVerifyTimeout)
 	defer cancel()
@@ -326,7 +385,7 @@ func (s *VMScanningSuite) mustVerifyVirtualMachinesFeatureEnabled() {
 
 // mustVerifySensorVSOCKRBAC asserts Sensor can get KubeVirt VMI vsock subresources.
 // Pull-mode scraping fails without this; the Helm chart creates the binding when
-// spec.virtualMachines.mode is Enabled on the SecuredCluster CR.
+// virtualMachines.enabled follows ROX_VIRTUAL_MACHINES (on by default).
 func (s *VMScanningSuite) mustVerifySensorVSOCKRBAC(ctx context.Context) {
 	t := s.T()
 	t.Helper()
@@ -334,7 +393,7 @@ func (s *VMScanningSuite) mustVerifySensorVSOCKRBAC(ctx context.Context) {
 	binding, err := s.k8sClient.RbacV1().ClusterRoleBindings().Get(ctx, "stackrox:vsock-access-binding", metaV1.GetOptions{})
 	require.NoError(t, err, "get ClusterRoleBinding stackrox:vsock-access-binding; "+
 		"Sensor cannot scrape guest agents over vsock without this RBAC "+
-		"(check that spec.virtualMachines.mode is Enabled on the SecuredCluster CR)")
+		"(check that Helm virtualMachines.enabled / ROX_VIRTUAL_MACHINES is on)")
 	require.Equal(t, "ClusterRole", binding.RoleRef.Kind)
 	require.Equal(t, "stackrox:vsock-access", binding.RoleRef.Name)
 
@@ -592,7 +651,7 @@ func (s *VMScanningSuite) prepareGuests() {
 func (s *VMScanningSuite) prepareGuestWithRecovery(vm *VMHandle) error {
 	const maxRecoveries = 2
 	for recoveryAttempt := 0; recoveryAttempt <= maxRecoveries; recoveryAttempt++ {
-		err := s.prepareGuest(*vm)
+		err := s.prepareGuest(vm)
 		if err == nil {
 			return nil
 		}
@@ -676,6 +735,20 @@ func (s *VMScanningSuite) vmSpecToRequest(sp vmhelpers.VMSpec) vmhelpers.VMReque
 	}
 }
 
+func (s *VMScanningSuite) skipUnlessLegacyVMAPI(t *testing.T) {
+	t.Helper()
+	if s.enhancedVMModel {
+		t.Skip("VirtualMachineService is not used when ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL is enabled")
+	}
+}
+
+func (s *VMScanningSuite) skipUnlessV2VMAPI(t *testing.T) {
+	t.Helper()
+	if !s.enhancedVMModel {
+		t.Skip("VirtualMachineV2Service is not used when ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL is disabled")
+	}
+}
+
 func (s *VMScanningSuite) mustListVMByNamespaceAndName(namespace, name string) *v2.VirtualMachine {
 	t := s.T()
 	t.Helper()
@@ -694,6 +767,24 @@ func (s *VMScanningSuite) mustGetVM(id string) *v2.VirtualMachine {
 	return resp
 }
 
+func (s *VMScanningSuite) mustListV2VMByNamespaceAndName(namespace, name string) *v2.VMListItem {
+	t := s.T()
+	t.Helper()
+	vm, err := vmhelpers.ListV2VMByNamespaceName(s.ctx, s.vmV2Client, namespace, name)
+	require.NoError(t, err)
+	require.NotNil(t, vm, "ListVMs: no VM for namespace=%q name=%q", namespace, name)
+	return vm
+}
+
+func (s *VMScanningSuite) mustGetVMV2(id string) *v2.VMDetail {
+	t := s.T()
+	t.Helper()
+	resp, err := s.vmV2Client.GetVM(s.ctx, &v2.GetVMRequest{Id: id})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	return resp
+}
+
 // waitForScannerV4Initialized blocks until the Scanner V4 matcher deployment
 // is K8s-ready. When SCANNER_V4_MATCHER_READINESS=vulnerability (the default
 // in CI via lib.sh), the K8s readiness probe already gates on the vuln DB
@@ -711,8 +802,8 @@ func (s *VMScanningSuite) waitForScannerV4Initialized() error {
 	return nil
 }
 
-// ensureRoxagentServing starts pull-mode `roxagent serve` on the guest (if needed)
-// and waits until its VSOCK listener is ready. Sensor scrapes the report afterward.
+// ensureRoxagentServing starts Quadlet roxagent.service on the guest if needed
+// and waits until it is active (VSOCK listener ready). Sensor scrapes afterward.
 func (s *VMScanningSuite) ensureRoxagentServing(ctx context.Context, vm *VMHandle) error {
 	if vm == nil {
 		return errors.New("ensureRoxagentServing: nil VM handle")
@@ -722,18 +813,43 @@ func (s *VMScanningSuite) ensureRoxagentServing(ctx context.Context, vm *VMHandl
 		return fmt.Errorf("Scanner V4 matcher did not initialize within timeout: %w", err)
 	}
 	virt := s.virtctlForVM(*vm)
-	return vmhelpers.EnsureRoxagentServing(ctx, virt, vm.Namespace, vm.Name, s.cfg.Repo2CPEURL)
+	return vmhelpers.EnsureRoxagentServing(ctx, virt, vm.Namespace, vm.Name)
+}
+
+// centralScanSnapshot is the scan-ready view from the VM API selected by Central's flag.
+type centralScanSnapshot struct {
+	ID     string
+	Legacy *v2.VirtualMachine
+	Detail *v2.VMDetail
 }
 
-// waitForScan polls Central in order until scan data is visible.
-func (s *VMScanningSuite) waitForScan(ctx context.Context, vm *VMHandle) (*v2.VirtualMachine, error) {
+// waitForScan polls the VM API selected by ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL.
+func (s *VMScanningSuite) waitForScan(ctx context.Context, vm *VMHandle) (*centralScanSnapshot, error) {
 	if vm == nil {
 		return nil, errors.New("waitForScan: nil VM handle")
 	}
-	s.logf("scan wait %s/%s: start (timeout=%v poll=%v)", vm.Namespace, vm.Name, s.cfg.ScanTimeout, s.cfg.ScanPollInterval)
+	s.logf("scan wait %s/%s: start (timeout=%v poll=%v enhancedVMModel=%v)",
+		vm.Namespace, vm.Name, s.cfg.ScanTimeout, s.cfg.ScanPollInterval, s.enhancedVMModel)
 	waitCtx, cancel := context.WithTimeout(ctx, s.cfg.ScanTimeout)
 	defer cancel()
 
+	if s.enhancedVMModel {
+		detail, err := s.waitForV2Scan(waitCtx, vm)
+		if err != nil {
+			return nil, err
+		}
+		vm.ID = detail.GetId()
+		return &centralScanSnapshot{ID: vm.ID, Detail: detail}, nil
+	}
+	legacy, err := s.waitForLegacyScan(waitCtx, vm)
+	if err != nil {
+		return nil, err
+	}
+	vm.ID = legacy.GetId()
+	return &centralScanSnapshot{ID: vm.ID, Legacy: legacy}, nil
+}
+
+func (s *VMScanningSuite) waitForLegacyScan(waitCtx context.Context, vm *VMHandle) (*v2.VirtualMachine, error) {
 	baseOpts := vmhelpers.WaitOptions{
 		Timeout:      s.cfg.ScanTimeout,
 		PollInterval: s.cfg.ScanPollInterval,
@@ -746,7 +862,7 @@ func (s *VMScanningSuite) waitForScan(ctx context.Context, vm *VMHandle) (*v2.Vi
 	}
 	vm.ID = present.GetId()
 
-	s.logf("%s/%s: VM appeared in Central (id=%q), waiting for namespace/name fields to be populated", vm.Namespace, vm.Name, vm.ID)
+	s.logf("%s/%s: VM appeared in Central via VirtualMachineService (id=%q), waiting for namespace/name fields", vm.Namespace, vm.Name, vm.ID)
 	if _, err := vmhelpers.WaitForVMIdentityFields(waitCtx, s.vmClient, baseOpts, present.GetId(), vm.Namespace, vm.Name); err != nil {
 		return nil, err
 	}
@@ -766,6 +882,35 @@ func (s *VMScanningSuite) waitForScan(ctx context.Context, vm *VMHandle) (*v2.Vi
 	return vmhelpers.WaitForScanReady(waitCtx, s.vmClient, baseOpts, present.GetId())
 }
 
+func (s *VMScanningSuite) waitForV2Scan(waitCtx context.Context, vm *VMHandle) (*v2.VMDetail, error) {
+	baseOpts := vmhelpers.WaitOptions{
+		Timeout:      s.cfg.ScanTimeout,
+		PollInterval: s.cfg.ScanPollInterval,
+		Logf:         s.logf,
+	}
+
+	present, err := vmhelpers.WaitForV2VMPresentInCentral(waitCtx, s.vmV2Client, baseOpts, vm.Namespace, vm.Name)
+	if err != nil {
+		return nil, err
+	}
+	vm.ID = present.GetId()
+
+	s.logf("%s/%s: VM appeared in Central via VirtualMachineV2Service (id=%q), waiting for namespace/name fields", vm.Namespace, vm.Name, vm.ID)
+	if _, err := vmhelpers.WaitForV2VMIdentityFields(waitCtx, s.vmV2Client, baseOpts, present.GetId(), vm.Namespace, vm.Name); err != nil {
+		return nil, err
+	}
+	s.logf("%s/%s: waiting for Central to report VM as VM_STATE_RUNNING", vm.Namespace, vm.Name)
+	if _, err := vmhelpers.WaitForV2VMRunningInCentral(waitCtx, s.vmV2Client, baseOpts, present.GetId()); err != nil {
+		return nil, err
+	}
+	s.logf("%s/%s: waiting for latest_scan to arrive in Central", vm.Namespace, vm.Name)
+	if _, err := vmhelpers.WaitForV2VMLatestScan(waitCtx, s.vmV2Client, baseOpts, present.GetId()); err != nil {
+		return nil, err
+	}
+	s.logf("%s/%s: waiting for all v2 components to be vulnerability-matched (no NOT_SCANNED)", vm.Namespace, vm.Name)
+	return vmhelpers.WaitForV2ScanReady(waitCtx, s.vmV2Client, baseOpts, present.GetId())
+}
+
 func (s *VMScanningSuite) resourceDeleteTimeout() time.Duration {
 	if s.cfg != nil && s.cfg.DeleteTimeout > 0 {
 		return s.cfg.DeleteTimeout
@@ -773,8 +918,8 @@ func (s *VMScanningSuite) resourceDeleteTimeout() time.Duration {
 	return defaultVMDeleteTimeout
 }
 
-func (s *VMScanningSuite) prepareGuest(vm VMHandle) error {
-	virt := s.virtctlForVM(vm)
+func (s *VMScanningSuite) prepareGuest(vm *VMHandle) error {
+	virt := s.virtctlForVM(*vm)
 	stepNum := 0
 	runStep := func(stepName, errContext string, timeout time.Duration, fn func(stepCtx context.Context) error) error {
 		stepNum++
@@ -806,15 +951,15 @@ func (s *VMScanningSuite) prepareGuest(vm VMHandle) error {
 	}); err != nil {
 		return err
 	}
-	if err := runStep("Copy roxagent binary", "CopyRoxagentBinary", stepTimeout, func(stepCtx context.Context) error {
-		return vmhelpers.CopyRoxagentBinary(stepCtx, virt, vm.Namespace, vm.Name, s.cfg.RoxagentBinaryPath)
-	}); err != nil {
-		return err
-	}
-	// Runs `roxagent --help` to confirm the binary is present, executable, and in $PATH.
-	if err := runStep("Verify roxagent installed", "VerifyRoxagentInstalled", stepTimeout, func(stepCtx context.Context) error {
-		return vmhelpers.VerifyRoxagentInstalled(stepCtx, virt, vm.Namespace, vm.Name)
+	if err := runStep("Install roxagent Quadlet", "InstallRoxagentQuadlet", max(stepTimeout, 15*time.Minute), func(stepCtx context.Context) error {
+		return vmhelpers.InstallRoxagentQuadlet(stepCtx, virt, vm.Namespace, vm.Name, s.cfg.RoxagentImage, s.cfg.Repo2CPEURL, s.cfg.PodmanAuthFilePath)
 	}); err != nil {
+		if errors.Is(err, vmhelpers.ErrPodmanNotFound) {
+			vm.SkipReason = err.Error()
+			s.logf("[guest prep] Quadlet install skipped on %s/%s; VM subtest will be skipped: %v",
+				vm.Namespace, vm.Name, err)
+			return nil
+		}
 		return err
 	}
 	s.logf("[guest prep] COMPLETED for %s/%s in %d step(s)", vm.Namespace, vm.Name, stepNum)
diff --git a/tests/vm_scanning_test.go b/tests/vm_scanning_test.go
index 5cbb78bfec3b0..d495dc82a373c 100644
--- a/tests/vm_scanning_test.go
+++ b/tests/vm_scanning_test.go
@@ -3,10 +3,17 @@
 package tests
 
 import (
+	"context"
+	"fmt"
+	"regexp"
+	"strings"
 	"testing"
 	"time"
 
 	v2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/pkg/namespaces"
+	pkgVM "github.com/stackrox/rox/pkg/virtualmachine"
+	"github.com/stackrox/rox/tests/logmatchers"
 	"github.com/stackrox/rox/tests/vmhelpers"
 	"github.com/stretchr/testify/require"
 )
@@ -14,6 +21,12 @@ import (
 func (s *VMScanningSuite) TestScanPipeline() {
 	for i := range s.vms {
 		vm := &s.vms[i]
+		if vm.SkipReason != "" {
+			s.T().Run(vm.Name, func(t *testing.T) {
+				t.Skip(vm.SkipReason)
+			})
+			continue
+		}
 		virt := s.virtctlForVM(*vm)
 
 		if err := vmhelpers.EnsureVsockReady(s.ctx, virt, vm.Namespace, vm.Name, "scan pipeline"); err != nil {
@@ -22,12 +35,12 @@ func (s *VMScanningSuite) TestScanPipeline() {
 		}
 
 		s.T().Run(vm.Name, func(t *testing.T) {
-			var first *v2.VirtualMachine
+			var snapshot *centralScanSnapshot
 			roxagentOK := false
 
 			t.Run("EnsureRoxagentServing", func(t *testing.T) {
-				t.Logf("ensuring pull-mode agent: sudo %s serve --port 818 --host-path / --rescan-interval 5m --repo-cpe-url %s",
-					vmhelpers.DefaultRoxagentInstallPath, s.cfg.Repo2CPEURL)
+				t.Logf("ensuring Quadlet roxagent.service is active (image=%s rescan=%s)",
+					s.cfg.RoxagentImage, vmhelpers.E2ERescanInterval)
 				err := s.ensureRoxagentServing(s.ctx, vm)
 				require.NoError(t, err)
 				roxagentOK = true
@@ -37,18 +50,29 @@ func (s *VMScanningSuite) TestScanPipeline() {
 				return
 			}
 
+			t.Run("WaitForSensorPushedMapping", func(t *testing.T) {
+				if strings.TrimSpace(s.cfg.Repo2CPEURL) != "" {
+					t.Skip("ROXAGENT_REPO2CPE_URL set: agent is URL-managed, Sensor will not push mapping")
+				}
+				s.waitForSensorPushedMapping(vm)
+			})
+
 			t.Run("WaitForScan", func(t *testing.T) {
 				var err error
-				first, err = s.waitForScan(s.ctx, vm)
+				snapshot, err = s.waitForScan(s.ctx, vm)
 				require.NoError(t, err)
-				vm.ID = first.GetId()
+				require.NotEmpty(t, snapshot.ID)
+				vm.ID = snapshot.ID
 			})
-			if first == nil {
+			if snapshot == nil {
 				t.Log("skipping remaining subtests: scan did not appear in Central")
 				return
 			}
 
 			t.Run("CentralVMMetadata", func(t *testing.T) {
+				s.skipUnlessLegacyVMAPI(t)
+				first := snapshot.Legacy
+				require.NotNil(t, first, "WaitForScan returned no VirtualMachine")
 				listed := s.mustListVMByNamespaceAndName(vm.Namespace, vm.Name)
 				require.Equal(t, listed.GetId(), first.GetId())
 				require.Equal(t, vm.Name, first.GetName())
@@ -58,9 +82,13 @@ func (s *VMScanningSuite) TestScanPipeline() {
 				require.Equal(t, v2.VirtualMachine_RUNNING, first.GetState())
 				require.NotNil(t, first.GetScan())
 				require.NotNil(t, first.GetScan().GetScanTime())
+				requireForwardedAgentFacts(t, first.GetFacts())
 			})
 
 			t.Run("CentralScanComponents", func(t *testing.T) {
+				s.skipUnlessLegacyVMAPI(t)
+				first := snapshot.Legacy
+				require.NotNil(t, first)
 				for _, component := range first.GetScan().GetComponents() {
 					require.NotContains(t, component.GetNotes(), v2.ScanComponent_UNSCANNED)
 				}
@@ -68,28 +96,133 @@ func (s *VMScanningSuite) TestScanPipeline() {
 			})
 
 			t.Run("CentralScanOperatingSystem", func(t *testing.T) {
-				os := first.GetScan().GetOperatingSystem()
+				s.skipUnlessLegacyVMAPI(t)
+				os := snapshot.Legacy.GetScan().GetOperatingSystem()
 				require.NotEmpty(t, os,
 					"scan.operating_system should be populated via Sensor DiscoveredData")
 			})
 
 			t.Run("ConsistencyCheck", func(t *testing.T) {
-				fetched := s.mustGetVM(first.GetId())
-				require.Equal(t, first.GetId(), fetched.GetId(),
+				s.skipUnlessLegacyVMAPI(t)
+				fetched := s.mustGetVM(snapshot.ID)
+				require.Equal(t, snapshot.ID, fetched.GetId(),
 					"VM ID should remain stable after pull-mode scan")
 			})
 
+			t.Run("VirtualMachineV2GetVM", func(t *testing.T) {
+				s.skipUnlessV2VMAPI(t)
+				detail := s.mustGetVMV2(snapshot.ID)
+				require.Equal(t, snapshot.ID, detail.GetId())
+				require.Equal(t, vm.Name, detail.GetName())
+				require.Equal(t, vm.Namespace, detail.GetNamespace())
+				require.NotEmpty(t, detail.GetClusterId())
+				require.NotEmpty(t, detail.GetClusterName())
+				require.Equal(t, v2.VirtualMachineV2State_VM_STATE_RUNNING, detail.GetState())
+				require.NotNil(t, detail.GetLatestScan())
+				require.NotNil(t, detail.GetLatestScan().GetScanTime())
+				requireForwardedAgentFacts(t, detail.GetFacts())
+				require.Equal(t, detail.GetFacts()[pkgVM.DetectedGuestOSKey], detail.GetGuestOs(),
+					"GetVM.guest_os should prefer facts.detectedGuestOS")
+			})
+
+			t.Run("VirtualMachineV2GuestOSSearch", func(t *testing.T) {
+				s.skipUnlessV2VMAPI(t)
+				detail := s.mustGetVMV2(snapshot.ID)
+				guestOS := detail.GetGuestOs()
+				require.Regexp(t, `^Red Hat Enterprise Linux \d`, guestOS,
+					"guest_os must be versioned so quoted informer search can miss")
+
+				found, err := vmhelpers.ListV2VMByNamespaceNameGuestOS(s.ctx, s.vmV2Client, vm.Namespace, vm.Name, guestOS)
+				require.NoError(t, err)
+				require.NotNil(t, found, "ListVMs Guest OS:%q should find this VM", guestOS)
+				require.Equal(t, snapshot.ID, found.GetId())
+
+				const informerGuestOS = "Red Hat Enterprise Linux"
+				miss, err := vmhelpers.ListV2VMByNamespaceNameGuestOS(s.ctx, s.vmV2Client, vm.Namespace, vm.Name, informerGuestOS)
+				require.NoError(t, err)
+				require.Nil(t, miss,
+					"quoted informer Guest OS must not match a versioned guest_os column")
+			})
+
+			t.Run("VirtualMachineV2ListVMs", func(t *testing.T) {
+				s.skipUnlessV2VMAPI(t)
+				listed := s.mustListV2VMByNamespaceAndName(vm.Namespace, vm.Name)
+				require.Equal(t, snapshot.ID, listed.GetId())
+				require.Equal(t, vm.Name, listed.GetName())
+				require.Equal(t, vm.Namespace, listed.GetNamespace())
+				require.NotEmpty(t, listed.GetClusterId())
+				require.NotEmpty(t, listed.GetClusterName())
+				require.Equal(t, v2.VirtualMachineV2State_VM_STATE_RUNNING, listed.GetState())
+				require.NotNil(t, listed.GetScanTime(),
+					"ListVMs.scan_time should be populated from the latest scan")
+
+				detail := s.mustGetVMV2(snapshot.ID)
+				require.Equal(t, detail.GetGuestOs(), listed.GetGuestOs(),
+					"ListVMs.guest_os should match GetVM.guest_os")
+
+				cves, total, err := vmhelpers.ListAllVMCVEsByVM(s.ctx, s.vmV2Client, snapshot.ID)
+				require.NoError(t, err)
+				require.Greater(t, total, int32(0), "scanned RHEL guest should report CVEs via ListVMCVEsByVM")
+				require.Equal(t, int(total), len(cves), "paginated CVE rows should cover total_count")
+				for _, row := range cves {
+					require.NotEmpty(t, row.GetCve())
+				}
+
+				distinct := distinctCVEIDs(cves)
+				summary, err := s.vmV2Client.GetVMVulnSummary(s.ctx, &v2.GetVMVulnSummaryRequest{Id: snapshot.ID})
+				require.NoError(t, err)
+				requireChipsAgree(t, listed.GetCveSeverityCounts(), summary.GetSeverityCounts())
+				requireChipsCoverTable(t, listed.GetCveSeverityCounts(), cves, len(distinct))
+			})
+
+			t.Run("VirtualMachineV2ListVMCVEsByVM", func(t *testing.T) {
+				s.skipUnlessV2VMAPI(t)
+				cves, total, err := vmhelpers.ListAllVMCVEsByVM(s.ctx, s.vmV2Client, snapshot.ID)
+				require.NoError(t, err)
+				require.Greater(t, total, int32(0))
+				require.NotEmpty(t, cves)
+				for _, row := range cves {
+					require.NotEmpty(t, row.GetCve())
+				}
+				require.Equal(t, len(cves), len(distinctCVEIDs(cves)), "ListVMCVEsByVM CVE IDs must be unique")
+
+				var found bool
+				for _, row := range cves {
+					comps, err := s.vmV2Client.GetVMCVEComponents(s.ctx, &v2.GetVMCVEComponentsRequest{
+						VmId:  snapshot.ID,
+						CveId: row.GetCve(),
+					})
+					require.NoError(t, err)
+					if len(comps.GetComponents()) == 0 {
+						continue
+					}
+					require.GreaterOrEqual(t, row.GetAffectedComponentCount(), int32(1),
+						"CVE %q has %d components from GetVMCVEComponents but affected_component_count=%d",
+						row.GetCve(), len(comps.GetComponents()), row.GetAffectedComponentCount())
+					found = true
+					break
+				}
+				require.True(t, found, "at least one ListVMCVEsByVM row should have components from GetVMCVEComponents")
+			})
+
+			t.Run("VirtualMachineV2ListVMComponents", func(t *testing.T) {
+				s.skipUnlessV2VMAPI(t)
+				comps, total, err := vmhelpers.ListAllVMComponents(s.ctx, s.vmV2Client, snapshot.ID)
+				require.NoError(t, err)
+				require.Greater(t, total, int32(0), "completed scan should list components")
+				require.NotEmpty(t, comps)
+				require.Equal(t, int(total), len(comps), "paginated component rows should cover total_count")
+				for _, c := range comps {
+					require.NotEqual(t, v2.ScanStatus_NOT_SCANNED, c.GetScanStatus())
+					require.NotEqual(t, v2.ScanStatus_SCAN_PENDING, c.GetScanStatus())
+				}
+			})
+
 			// Regression test for ROX-36273: after a change to the RPM database (package removal), the agent should
 			// detect the change on a later periodic rescan without being restarted.
 			t.Run("Changes to RPM DB are detected by periodic rescan", func(t *testing.T) {
-				require.NotNil(t, first.GetScan().GetScanTime())
-				baselineScanTime := first.GetScan().GetScanTime().AsTime()
-				baselineCount := len(first.GetScan().GetComponents())
-				// bc is installed by stackrox/vm-images into every VM
-				// container-disk so this test has a known removable probe package.
 				removed := vmhelpers.VMImageProbePackage
-				require.Contains(t, scanComponentNames(first), removed,
-					"baseline scan must include %q from the VM image build", removed)
+				baselineCount := s.requireProbePackagePresent(t, snapshot, removed)
 
 				beforeInvocationID, err := vmhelpers.RoxagentServeInvocationID(s.ctx, virt, vm.Namespace, vm.Name)
 				require.NoError(t, err)
@@ -101,19 +234,32 @@ func (s *VMScanningSuite) TestScanPipeline() {
 				// Central moves scan_time.
 				const minScanAdvances = 2
 				waitTimeout := max(s.cfg.ScanTimeout, 2*vmhelpers.E2ERescanInterval+2*vmhelpers.E2EScraperPollInterval+3*time.Minute)
-				t.Logf("removed package %q; waiting for %d scan_time advances (rescan=%s scraper=%s timeout=%s; baseline components=%d scan_time=%s)",
+				t.Logf("removed package %q; waiting for %d scan_time advances (rescan=%s scraper=%s timeout=%s; baseline components=%d)",
 					removed, minScanAdvances, vmhelpers.E2ERescanInterval, vmhelpers.E2EScraperPollInterval, waitTimeout,
-					baselineCount, baselineScanTime.UTC().Format(time.RFC3339))
-
-				updated, err := vmhelpers.WaitForScanMissingComponent(
-					s.ctx, s.vmClient, vmhelpers.WaitOptions{
-						Timeout:      waitTimeout,
-						PollInterval: s.cfg.ScanPollInterval,
-						Logf:         s.logf,
-					}, first.GetId(), removed, baselineScanTime, minScanAdvances)
-				require.NoError(t, err)
-				require.Equal(t, baselineCount-1, len(updated.GetScan().GetComponents()),
-					"exactly one component should disappear after removing %q", removed)
+					baselineCount)
+
+				opts := vmhelpers.WaitOptions{
+					Timeout:      waitTimeout,
+					PollInterval: s.cfg.ScanPollInterval,
+					Logf:         s.logf,
+				}
+				if s.enhancedVMModel {
+					require.NotNil(t, snapshot.Detail.GetLatestScan().GetScanTime())
+					baselineScanTime := snapshot.Detail.GetLatestScan().GetScanTime().AsTime()
+					updated, err := vmhelpers.WaitForV2ScanMissingComponent(
+						s.ctx, s.vmV2Client, opts, snapshot.ID, removed, baselineScanTime, minScanAdvances)
+					require.NoError(t, err)
+					require.Equal(t, baselineCount-1, len(updated),
+						"exactly one component should disappear after removing %q", removed)
+				} else {
+					require.NotNil(t, snapshot.Legacy.GetScan().GetScanTime())
+					baselineScanTime := snapshot.Legacy.GetScan().GetScanTime().AsTime()
+					updated, err := vmhelpers.WaitForScanMissingComponent(
+						s.ctx, s.vmClient, opts, snapshot.ID, removed, baselineScanTime, minScanAdvances)
+					require.NoError(t, err)
+					require.Equal(t, baselineCount-1, len(updated.GetScan().GetComponents()),
+						"exactly one component should disappear after removing %q", removed)
+				}
 
 				require.NoError(t, vmhelpers.RoxagentServeDidNotRestart(
 					s.ctx, virt, vm.Namespace, vm.Name, beforeInvocationID),
@@ -123,6 +269,34 @@ func (s *VMScanningSuite) TestScanPipeline() {
 	}
 }
 
+// waitForSensorPushedMapping waits until Sensor logs a successful repo-to-CPE
+// mapping push for vm. Setup installs without --repo-cpe-url, so a scan cannot
+// complete until this push happens.
+func (s *VMScanningSuite) waitForSensorPushedMapping(vm *VMHandle) {
+	waitCtx, cancel := context.WithTimeout(s.ctx, s.cfg.ScanTimeout)
+	defer cancel()
+	re := regexp.MustCompile(regexp.QuoteMeta(
+		fmt.Sprintf(`VMScraper: synced repo-to-CPE mapping to "%s/%s"`, vm.Namespace, vm.Name)))
+	s.waitUntilLog(waitCtx, namespaces.StackRox, sensorPodLabels, sensorContainer,
+		"contain Sensor-pushed repo-to-CPE mapping sync",
+		logmatchers.ContainsLineMatching(re))
+}
+
+func (s *VMScanningSuite) requireProbePackagePresent(t *testing.T, snapshot *centralScanSnapshot, pkg string) int {
+	t.Helper()
+	if s.enhancedVMModel {
+		comps, _, err := vmhelpers.ListAllVMComponents(s.ctx, s.vmV2Client, snapshot.ID)
+		require.NoError(t, err)
+		require.Contains(t, componentRowNames(comps), pkg,
+			"baseline v2 component list must include %q from the VM image build", pkg)
+		return len(comps)
+	}
+	require.NotNil(t, snapshot.Legacy)
+	require.Contains(t, scanComponentNames(snapshot.Legacy), pkg,
+		"baseline scan must include %q from the VM image build", pkg)
+	return len(snapshot.Legacy.GetScan().GetComponents())
+}
+
 func scanComponentNames(vm *v2.VirtualMachine) []string {
 	comps := vm.GetScan().GetComponents()
 	names := make([]string, 0, len(comps))
@@ -133,3 +307,82 @@ func scanComponentNames(vm *v2.VirtualMachine) []string {
 	}
 	return names
 }
+
+func componentRowNames(comps []*v2.VMComponentRow) []string {
+	names := make([]string, 0, len(comps))
+	for _, c := range comps {
+		if name := c.GetName(); name != "" {
+			names = append(names, name)
+		}
+	}
+	return names
+}
+
+func requireForwardedAgentFacts(t *testing.T, facts map[string]string) {
+	t.Helper()
+	require.NotEmpty(t, facts)
+	require.Regexp(t, `^Red Hat Enterprise Linux \d`, facts[pkgVM.DetectedGuestOSKey],
+		"facts.detectedGuestOS should be the versioned guest OS from roxagent")
+	require.NotEmpty(t, facts[pkgVM.AgentVersionKey],
+		"facts.agentVersion should be the roxagent version from ResponseMeta")
+}
+
+// requireChipsAgree checks ListVMs and GetVMVulnSummary use the same chip grain.
+func requireChipsAgree(t *testing.T, listed, summary *v2.VulnCountBySeverity) {
+	t.Helper()
+	require.Equal(t, listed.GetCritical().GetTotal(), summary.GetCritical().GetTotal(), "critical")
+	require.Equal(t, listed.GetImportant().GetTotal(), summary.GetImportant().GetTotal(), "important")
+	require.Equal(t, listed.GetModerate().GetTotal(), summary.GetModerate().GetTotal(), "moderate")
+	require.Equal(t, listed.GetLow().GetTotal(), summary.GetLow().GetTotal(), "low")
+	require.Equal(t, listed.GetUnknown().GetTotal(), summary.GetUnknown().GetTotal(), "unknown")
+	require.Equal(t, listed.GetCritical().GetFixable(), summary.GetCritical().GetFixable(), "critical fixable")
+	require.Equal(t, listed.GetImportant().GetFixable(), summary.GetImportant().GetFixable(), "important fixable")
+	require.Equal(t, listed.GetModerate().GetFixable(), summary.GetModerate().GetFixable(), "moderate fixable")
+	require.Equal(t, listed.GetLow().GetFixable(), summary.GetLow().GetFixable(), "low fixable")
+	require.Equal(t, listed.GetUnknown().GetFixable(), summary.GetUnknown().GetFixable(), "unknown fixable")
+}
+
+// requireChipsCoverTable allows a CVE in more than one severity chip, matching
+// imageCVECountBySeverity. Each chip still covers table rows at that severity
+// and cannot exceed the distinct CVE count.
+func requireChipsCoverTable(t *testing.T, chips *v2.VulnCountBySeverity, tableRows []*v2.VMCVERow, distinct int) {
+	t.Helper()
+	table := vmhelpers.CountVMCVERowsBySeverity(tableRows)
+	require.GreaterOrEqual(t, vmhelpers.VulnCountBySeverityTotal(chips), int32(distinct),
+		"chip total must cover distinct ListVMCVEsByVM CVE IDs")
+	for _, tc := range []struct {
+		name  string
+		chip  *v2.VulnFixableCount
+		table *v2.VulnFixableCount
+	}{
+		{"critical", chips.GetCritical(), table.GetCritical()},
+		{"important", chips.GetImportant(), table.GetImportant()},
+		{"moderate", chips.GetModerate(), table.GetModerate()},
+		{"low", chips.GetLow(), table.GetLow()},
+		{"unknown", chips.GetUnknown(), table.GetUnknown()},
+	} {
+		require.GreaterOrEqual(t, tc.chip.GetTotal(), tc.table.GetTotal(),
+			"%s chip must cover table rows at that severity", tc.name)
+		require.LessOrEqual(t, tc.chip.GetTotal(), int32(distinct),
+			"%s chip cannot exceed distinct CVE IDs", tc.name)
+		require.LessOrEqual(t, tc.chip.GetFixable(), tc.chip.GetTotal(),
+			"%s fixable cannot exceed that chip total", tc.name)
+	}
+}
+
+func distinctCVEIDs(cves []*v2.VMCVERow) []string {
+	seen := make(map[string]struct{}, len(cves))
+	ids := make([]string, 0, len(cves))
+	for _, row := range cves {
+		id := row.GetCve()
+		if id == "" {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		ids = append(ids, id)
+	}
+	return ids
+}
diff --git a/tests/vmhelpers/central.go b/tests/vmhelpers/central.go
index 8b4234ea1af5b..3aa777c7fa5a6 100644
--- a/tests/vmhelpers/central.go
+++ b/tests/vmhelpers/central.go
@@ -40,7 +40,7 @@ func waitForVMCondition(ctx context.Context, client v2.VirtualMachineServiceClie
 	err := pollUntil(ctx, opts, desc, func(ctx context.Context) (bool, string, error) {
 		cur, err := client.GetVirtualMachine(ctx, &v2.GetVirtualMachineRequest{Id: id})
 		if err != nil {
-			return false, "", err
+			return false, "", fmt.Errorf("get virtual machine %s: %w", id, err)
 		}
 		done, detail := check(cur)
 		if done {
@@ -145,6 +145,12 @@ func rawListQueryNamespaceAndName(namespace, name string) string {
 	return fmt.Sprintf("%s:%q+%s:%q", search.Namespace, namespace, search.VirtualMachineName, name)
 }
 
+// rawListQueryNamespaceNameGuestOS adds an exact Guest OS match so search
+// hits the same string List/GetVM return.
+func rawListQueryNamespaceNameGuestOS(namespace, name, guestOS string) string {
+	return fmt.Sprintf("%s+%s:%q", rawListQueryNamespaceAndName(namespace, name), search.GuestOS, guestOS)
+}
+
 // ListVMByNamespaceName returns the first VirtualMachine in Central whose namespace and name
 // match the given values. Returns (nil, nil) when no match is found.
 func ListVMByNamespaceName(ctx context.Context, client v2.VirtualMachineServiceClient, namespace, name string) (*v2.VirtualMachine, error) {
@@ -154,7 +160,7 @@ func ListVMByNamespaceName(ctx context.Context, client v2.VirtualMachineServiceC
 		},
 	})
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("list virtual machines: %w", err)
 	}
 	if vms := resp.GetVirtualMachines(); len(vms) > 0 {
 		return vms[0], nil
diff --git a/tests/vmhelpers/central_test.go b/tests/vmhelpers/central_test.go
index c8c16a8a009f5..d7e34d710043c 100644
--- a/tests/vmhelpers/central_test.go
+++ b/tests/vmhelpers/central_test.go
@@ -24,6 +24,13 @@ func TestRawListQueryNamespaceAndName(t *testing.T) {
 	require.Contains(t, q, `Virtual Machine Name:"vm:special+name"`)
 }
 
+func TestRawListQueryNamespaceNameGuestOS(t *testing.T) {
+	q := rawListQueryNamespaceNameGuestOS("ns", "vm-rhel", "Red Hat Enterprise Linux 8.10")
+	require.Contains(t, q, `Namespace:"ns"`)
+	require.Contains(t, q, `Virtual Machine Name:"vm-rhel"`)
+	require.Contains(t, q, `Guest OS:"Red Hat Enterprise Linux 8.10"`)
+}
+
 type stubVirtualMachineClient struct {
 	listFn func(ctx context.Context, req *v2.ListVirtualMachinesRequest) (*v2.ListVirtualMachinesResponse, error)
 	getFn  func(ctx context.Context, req *v2.GetVirtualMachineRequest) (*v2.VirtualMachine, error)
diff --git a/tests/vmhelpers/central_v2.go b/tests/vmhelpers/central_v2.go
new file mode 100644
index 0000000000000..d74569860e47e
--- /dev/null
+++ b/tests/vmhelpers/central_v2.go
@@ -0,0 +1,351 @@
+package vmhelpers
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	v2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stackrox/rox/pkg/search"
+)
+
+// v2ListPageSize matches VirtualMachineV2Service's server-side defaultPageSize.
+// Requests above that are clamped, so callers must page.
+const (
+	v2ListPageSize = 100
+	v2ListMaxPages = 200
+)
+
+// ListV2VMByNamespaceName returns the first VM matching namespace and name.
+// Returns (nil, nil) when no match is found.
+func ListV2VMByNamespaceName(ctx context.Context, client v2.VirtualMachineV2ServiceClient, namespace, name string) (*v2.VMListItem, error) {
+	return listV2VM(ctx, client, rawListQueryNamespaceAndName(namespace, name))
+}
+
+// ListV2VMByNamespaceNameGuestOS is ListV2VMByNamespaceName plus an exact Guest OS match.
+func ListV2VMByNamespaceNameGuestOS(ctx context.Context, client v2.VirtualMachineV2ServiceClient, namespace, name, guestOS string) (*v2.VMListItem, error) {
+	return listV2VM(ctx, client, rawListQueryNamespaceNameGuestOS(namespace, name, guestOS))
+}
+
+func listV2VM(ctx context.Context, client v2.VirtualMachineV2ServiceClient, query string) (*v2.VMListItem, error) {
+	resp, err := client.ListVMs(ctx, &v2.ListVMsRequest{
+		Query: &v2.RawQuery{Query: query},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("list vms: %w", err)
+	}
+	if vms := resp.GetVms(); len(vms) > 0 {
+		return vms[0], nil
+	}
+	return nil, nil
+}
+
+// WaitForV2VMPresentInCentral polls ListVMs until a VM matches namespace and name.
+func WaitForV2VMPresentInCentral(ctx context.Context, client v2.VirtualMachineV2ServiceClient, opts WaitOptions, namespace, name string) (*v2.VMListItem, error) {
+	var found *v2.VMListItem
+	err := pollUntil(ctx, opts, fmt.Sprintf("V2 VM present in Central (namespace=%q name=%q)", namespace, name), func(ctx context.Context) (bool, string, error) {
+		vm, err := ListV2VMByNamespaceName(ctx, client, namespace, name)
+		if err != nil {
+			return false, "", err
+		}
+		if vm == nil {
+			return false, "list returned no matching virtual machine", nil
+		}
+		found = vm
+		return true, fmt.Sprintf("id=%s", vm.GetId()), nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return found, nil
+}
+
+type vmV2ConditionCheck func(vm *v2.VMDetail) (done bool, detail string)
+
+func waitForV2VMCondition(ctx context.Context, client v2.VirtualMachineV2ServiceClient, opts WaitOptions, id, desc string, check vmV2ConditionCheck) (*v2.VMDetail, error) {
+	var vm *v2.VMDetail
+	err := pollUntil(ctx, opts, desc, func(ctx context.Context) (bool, string, error) {
+		cur, err := client.GetVM(ctx, &v2.GetVMRequest{Id: id})
+		if err != nil {
+			return false, "", fmt.Errorf("get vm %s: %w", id, err)
+		}
+		done, detail := check(cur)
+		if done {
+			vm = cur
+		}
+		return done, detail, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return vm, nil
+}
+
+// WaitForV2VMIdentityFields polls GetVM until id maps to the expected namespace and name.
+func WaitForV2VMIdentityFields(ctx context.Context, client v2.VirtualMachineV2ServiceClient, opts WaitOptions, id, expectedNamespace, expectedName string) (*v2.VMDetail, error) {
+	return waitForV2VMCondition(ctx, client, opts, id, fmt.Sprintf("V2 VM identity fields (id=%q)", id), func(vm *v2.VMDetail) (bool, string) {
+		detail := fmt.Sprintf("namespace=%q name=%q", vm.GetNamespace(), vm.GetName())
+		return vm.GetNamespace() == expectedNamespace && vm.GetName() == expectedName, detail
+	})
+}
+
+// WaitForV2VMRunningInCentral polls until the VM state is VM_STATE_RUNNING.
+func WaitForV2VMRunningInCentral(ctx context.Context, client v2.VirtualMachineV2ServiceClient, opts WaitOptions, id string) (*v2.VMDetail, error) {
+	return waitForV2VMCondition(ctx, client, opts, id, fmt.Sprintf("V2 VM RUNNING (id=%q)", id), func(vm *v2.VMDetail) (bool, string) {
+		st := vm.GetState()
+		return st == v2.VirtualMachineV2State_VM_STATE_RUNNING, fmt.Sprintf("state=%s", st)
+	})
+}
+
+// WaitForV2VMLatestScan polls until latest_scan is present with scan_time set.
+func WaitForV2VMLatestScan(ctx context.Context, client v2.VirtualMachineV2ServiceClient, opts WaitOptions, id string) (*v2.VMDetail, error) {
+	return waitForV2VMCondition(ctx, client, opts, id, fmt.Sprintf("V2 VM latest_scan (id=%q)", id), func(vm *v2.VMDetail) (bool, string) {
+		scan := vm.GetLatestScan()
+		if scan == nil {
+			return false, "latest_scan is nil"
+		}
+		if scan.GetScanTime() == nil {
+			return false, "latest_scan.scan_time is nil"
+		}
+		return true, "latest_scan present"
+	})
+}
+
+// WaitForV2ScanReady polls until the VM has scanned components and none are NOT_SCANNED.
+func WaitForV2ScanReady(ctx context.Context, client v2.VirtualMachineV2ServiceClient, opts WaitOptions, id string) (*v2.VMDetail, error) {
+	var detail *v2.VMDetail
+	err := pollUntil(ctx, opts, fmt.Sprintf("V2 scan ready (id=%q)", id), func(ctx context.Context) (bool, string, error) {
+		vm, err := client.GetVM(ctx, &v2.GetVMRequest{Id: id})
+		if err != nil {
+			return false, "", fmt.Errorf("get vm %s: %w", id, err)
+		}
+		scan := vm.GetLatestScan()
+		if scan == nil {
+			return false, "latest_scan is nil", nil
+		}
+
+		comps, total, err := ListAllVMComponents(ctx, client, id)
+		if err != nil {
+			return false, "", err
+		}
+
+		var ready, pending []string
+		if total > 0 {
+			ready = append(ready, fmt.Sprintf("components=%d", total))
+		} else {
+			pending = append(pending, "components")
+		}
+
+		if total > 0 && !slices.ContainsFunc(comps, func(c *v2.VMComponentRow) bool {
+			return c.GetScanStatus() == v2.ScanStatus_NOT_SCANNED || c.GetScanStatus() == v2.ScanStatus_SCAN_PENDING
+		}) {
+			ready = append(ready, "all-scanned")
+		} else {
+			pending = append(pending, "all-scanned")
+		}
+
+		if os := scan.GetScanOs(); os != "" {
+			ready = append(ready, fmt.Sprintf("os=%q", os))
+		} else if guestOS := vm.GetGuestOs(); guestOS != "" {
+			ready = append(ready, fmt.Sprintf("guest_os=%q", guestOS))
+		} else if len(pending) == 0 {
+			ready = append(ready, "os=<not reported>")
+		} else {
+			pending = append(pending, "os")
+		}
+
+		pollDetail := fmt.Sprintf("ready:[%s] waiting:[%s]", strings.Join(ready, ","), strings.Join(pending, ","))
+		if len(pending) == 0 {
+			detail = vm
+		}
+		return len(pending) == 0, pollDetail, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return detail, nil
+}
+
+// ListAllVMComponents pages through ListVMComponents until every component is collected.
+func ListAllVMComponents(ctx context.Context, client v2.VirtualMachineV2ServiceClient, vmID string) ([]*v2.VMComponentRow, int32, error) {
+	var all []*v2.VMComponentRow
+	var total int32
+	for page := range v2ListMaxPages {
+		offset := int32(page) * v2ListPageSize
+		resp, err := client.ListVMComponents(ctx, &v2.ListVMComponentsRequest{
+			VmId: vmID,
+			Query: &v2.RawQuery{
+				Pagination: &v2.Pagination{
+					Limit:      v2ListPageSize,
+					Offset:     offset,
+					SortOption: &v2.SortOption{Field: search.Component.String()},
+				},
+			},
+		})
+		if err != nil {
+			return nil, 0, fmt.Errorf("list vm components %s: %w", vmID, err)
+		}
+		total = resp.GetTotalCount()
+		all = append(all, resp.GetComponents()...)
+		if v2ListExhausted(len(all), len(resp.GetComponents()), total) {
+			return all, max(total, int32(len(all))), nil
+		}
+	}
+	return nil, 0, fmt.Errorf("ListVMComponents: exceeded %d pages for vm %s (collected %d, total_count=%d)", v2ListMaxPages, vmID, len(all), total)
+}
+
+// ListAllVMCVEsByVM pages through ListVMCVEsByVM until every CVE row is collected.
+func ListAllVMCVEsByVM(ctx context.Context, client v2.VirtualMachineV2ServiceClient, vmID string) ([]*v2.VMCVERow, int32, error) {
+	var all []*v2.VMCVERow
+	var total int32
+	for page := range v2ListMaxPages {
+		offset := int32(page) * v2ListPageSize
+		resp, err := client.ListVMCVEsByVM(ctx, &v2.ListVMCVEsByVMRequest{
+			VmId: vmID,
+			Query: &v2.RawQuery{
+				Pagination: &v2.Pagination{
+					Limit:      v2ListPageSize,
+					Offset:     offset,
+					SortOption: &v2.SortOption{Field: search.CVE.String()},
+				},
+			},
+		})
+		if err != nil {
+			return nil, 0, fmt.Errorf("list vm cves %s: %w", vmID, err)
+		}
+		total = resp.GetTotalCount()
+		all = append(all, resp.GetCves()...)
+		if v2ListExhausted(len(all), len(resp.GetCves()), total) {
+			return all, max(total, int32(len(all))), nil
+		}
+	}
+	return nil, 0, fmt.Errorf("ListVMCVEsByVM: exceeded %d pages for vm %s (collected %d, total_count=%d)", v2ListMaxPages, vmID, len(all), total)
+}
+
+// v2ListExhausted is true on a short page, or when a positive total_count has
+// already been collected. A zero total_count with a full page is not exhausted.
+func v2ListExhausted(collected, pageLen int, total int32) bool {
+	return pageLen < int(v2ListPageSize) || (total > 0 && int32(collected) >= total)
+}
+
+// VulnCountBySeverityTotal sums the per-severity total fields.
+func VulnCountBySeverityTotal(c *v2.VulnCountBySeverity) int32 {
+	if c == nil {
+		return 0
+	}
+	var n int32
+	for _, sev := range []*v2.VulnFixableCount{
+		c.GetCritical(),
+		c.GetImportant(),
+		c.GetModerate(),
+		c.GetLow(),
+		c.GetUnknown(),
+	} {
+		n += sev.GetTotal()
+	}
+	return n
+}
+
+// CountVMCVERowsBySeverity counts ListVMCVEsByVM rows by the severity shown on
+// each row (max severity for that CVE).
+func CountVMCVERowsBySeverity(cves []*v2.VMCVERow) *v2.VulnCountBySeverity {
+	out := &v2.VulnCountBySeverity{}
+	for _, row := range cves {
+		b := severityBucket(out, row.GetSeverity())
+		b.Total++
+		if row.GetIsFixable() {
+			b.Fixable++
+		}
+	}
+	return out
+}
+
+func severityBucket(c *v2.VulnCountBySeverity, sev v2.VulnerabilitySeverity) *v2.VulnFixableCount {
+	ptr := &c.Unknown
+	switch sev {
+	case v2.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY:
+		ptr = &c.Critical
+	case v2.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY:
+		ptr = &c.Important
+	case v2.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY:
+		ptr = &c.Moderate
+	case v2.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY:
+		ptr = &c.Low
+	}
+	if *ptr == nil {
+		*ptr = &v2.VulnFixableCount{}
+	}
+	return *ptr
+}
+
+// WaitForV2ScanMissingComponent polls until packageName is absent from a scan
+// whose latest_scan.scan_time has advanced at least minScanAdvances times past after.
+func WaitForV2ScanMissingComponent(
+	ctx context.Context,
+	client v2.VirtualMachineV2ServiceClient,
+	opts WaitOptions,
+	id, packageName string,
+	after time.Time,
+	minScanAdvances int,
+) ([]*v2.VMComponentRow, error) {
+	if minScanAdvances < 1 {
+		minScanAdvances = 1
+	}
+	advances := 0
+	lastSeen := after
+	var components []*v2.VMComponentRow
+	err := pollUntil(ctx, opts,
+		fmt.Sprintf("V2 scan missing package %q after %d scan_time advance(s) past %s (id=%q)",
+			packageName, minScanAdvances, after.UTC().Format(time.RFC3339), id),
+		func(ctx context.Context) (bool, string, error) {
+			vm, err := client.GetVM(ctx, &v2.GetVMRequest{Id: id})
+			if err != nil {
+				return false, "", fmt.Errorf("get vm %s: %w", id, err)
+			}
+			scan := vm.GetLatestScan()
+			if scan == nil {
+				return false, "latest_scan is nil", nil
+			}
+			st := scan.GetScanTime()
+			if st == nil {
+				return false, "latest_scan.scan_time is nil", nil
+			}
+			scanTime := st.AsTime()
+			if scanTime.After(lastSeen) {
+				advances++
+				lastSeen = scanTime
+			}
+			if advances < minScanAdvances {
+				return false, fmt.Sprintf("scan_time advances=%d/%d last=%s",
+					advances, minScanAdvances, scanTime.UTC().Format(time.RFC3339)), nil
+			}
+
+			filtered, err := client.ListVMComponents(ctx, &v2.ListVMComponentsRequest{
+				VmId: id,
+				Query: &v2.RawQuery{
+					Query: fmt.Sprintf("%s:%q", search.Component, packageName),
+				},
+			})
+			if err != nil {
+				return false, "", err
+			}
+			if n := max(int(filtered.GetTotalCount()), len(filtered.GetComponents())); n > 0 {
+				return false, fmt.Sprintf("scan_time advances=%d but package %q still present (matches=%d)",
+					advances, packageName, n), nil
+			}
+
+			comps, total, err := ListAllVMComponents(ctx, client, id)
+			if err != nil {
+				return false, "", err
+			}
+			components = comps
+			return true, fmt.Sprintf("scan_time advances=%d package %q gone (components=%d)",
+				advances, packageName, total), nil
+		})
+	if err != nil {
+		return nil, err
+	}
+	return components, nil
+}
diff --git a/tests/vmhelpers/central_v2_test.go b/tests/vmhelpers/central_v2_test.go
new file mode 100644
index 0000000000000..bafa2ff5f4bff
--- /dev/null
+++ b/tests/vmhelpers/central_v2_test.go
@@ -0,0 +1,474 @@
+//go:build test && !test_e2e && !test_e2e_vm
+
+package vmhelpers
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	v2 "github.com/stackrox/rox/generated/api/v2"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+type stubV2Client struct {
+	listVMsFn            func(ctx context.Context, req *v2.ListVMsRequest) (*v2.ListVMsResponse, error)
+	getVMFn              func(ctx context.Context, req *v2.GetVMRequest) (*v2.VMDetail, error)
+	listVMComponentsFn   func(ctx context.Context, req *v2.ListVMComponentsRequest) (*v2.ListVMComponentsResponse, error)
+	listVMCVEsByVMFn     func(ctx context.Context, req *v2.ListVMCVEsByVMRequest) (*v2.ListVMCVEsByVMResponse, error)
+	getVMCVEComponentsFn func(ctx context.Context, req *v2.GetVMCVEComponentsRequest) (*v2.GetVMCVEComponentsResponse, error)
+	getVMVulnSummaryFn   func(ctx context.Context, req *v2.GetVMVulnSummaryRequest) (*v2.VMVulnSummary, error)
+}
+
+func (s *stubV2Client) GetVM(ctx context.Context, in *v2.GetVMRequest, _ ...grpc.CallOption) (*v2.VMDetail, error) {
+	if s.getVMFn == nil {
+		return nil, errors.New("GetVM not stubbed")
+	}
+	return s.getVMFn(ctx, in)
+}
+
+func (s *stubV2Client) GetVMVulnSummary(ctx context.Context, in *v2.GetVMVulnSummaryRequest, _ ...grpc.CallOption) (*v2.VMVulnSummary, error) {
+	if s.getVMVulnSummaryFn == nil {
+		return &v2.VMVulnSummary{}, nil
+	}
+	return s.getVMVulnSummaryFn(ctx, in)
+}
+
+func (s *stubV2Client) ListVMCVEsByVM(ctx context.Context, in *v2.ListVMCVEsByVMRequest, _ ...grpc.CallOption) (*v2.ListVMCVEsByVMResponse, error) {
+	if s.listVMCVEsByVMFn == nil {
+		return &v2.ListVMCVEsByVMResponse{}, nil
+	}
+	return s.listVMCVEsByVMFn(ctx, in)
+}
+
+func (s *stubV2Client) GetVMCVEComponents(ctx context.Context, in *v2.GetVMCVEComponentsRequest, _ ...grpc.CallOption) (*v2.GetVMCVEComponentsResponse, error) {
+	if s.getVMCVEComponentsFn == nil {
+		return &v2.GetVMCVEComponentsResponse{}, nil
+	}
+	return s.getVMCVEComponentsFn(ctx, in)
+}
+
+func (s *stubV2Client) ListVMComponents(ctx context.Context, in *v2.ListVMComponentsRequest, _ ...grpc.CallOption) (*v2.ListVMComponentsResponse, error) {
+	if s.listVMComponentsFn == nil {
+		return &v2.ListVMComponentsResponse{}, nil
+	}
+	return s.listVMComponentsFn(ctx, in)
+}
+
+func (s *stubV2Client) ListVMs(ctx context.Context, in *v2.ListVMsRequest, _ ...grpc.CallOption) (*v2.ListVMsResponse, error) {
+	if s.listVMsFn == nil {
+		return &v2.ListVMsResponse{}, nil
+	}
+	return s.listVMsFn(ctx, in)
+}
+
+func (s *stubV2Client) ListVMCVEs(context.Context, *v2.ListVMCVEsRequest, ...grpc.CallOption) (*v2.ListVMCVEsResponse, error) {
+	return &v2.ListVMCVEsResponse{}, nil
+}
+
+func (s *stubV2Client) GetVMDashboardCounts(context.Context, *v2.VMDashboardCountsRequest, ...grpc.CallOption) (*v2.VMDashboardCountsResponse, error) {
+	return &v2.VMDashboardCountsResponse{}, nil
+}
+
+func (s *stubV2Client) GetVMCVEDetail(context.Context, *v2.GetVMCVEDetailRequest, ...grpc.CallOption) (*v2.VMCVEDetail, error) {
+	return &v2.VMCVEDetail{}, nil
+}
+
+func (s *stubV2Client) ListVMCVEAffectedVMs(context.Context, *v2.ListVMCVEAffectedVMsRequest, ...grpc.CallOption) (*v2.ListVMCVEAffectedVMsResponse, error) {
+	return &v2.ListVMCVEAffectedVMsResponse{}, nil
+}
+
+func TestWaitForV2VMPresentInCentral_UsesListVMs(t *testing.T) {
+	ctx := t.Context()
+	opts := WaitOptions{Timeout: 200 * time.Millisecond, PollInterval: 5 * time.Millisecond}
+	var sawQuery string
+	client := &stubV2Client{
+		listVMsFn: func(_ context.Context, req *v2.ListVMsRequest) (*v2.ListVMsResponse, error) {
+			sawQuery = req.GetQuery().GetQuery()
+			return &v2.ListVMsResponse{
+				Vms: []*v2.VMListItem{
+					{Id: "id-1", Namespace: "ns1", Name: "vm1"},
+				},
+			}, nil
+		},
+	}
+	vm, err := WaitForV2VMPresentInCentral(ctx, client, opts, "ns1", "vm1")
+	require.NoError(t, err)
+	require.Equal(t, "id-1", vm.GetId())
+	require.Contains(t, sawQuery, `Namespace:"ns1"`)
+	require.Contains(t, sawQuery, `Virtual Machine Name:"vm1"`)
+}
+
+func TestListV2VMByNamespaceNameGuestOS_Query(t *testing.T) {
+	ctx := t.Context()
+	var sawQuery string
+	client := &stubV2Client{
+		listVMsFn: func(_ context.Context, req *v2.ListVMsRequest) (*v2.ListVMsResponse, error) {
+			sawQuery = req.GetQuery().GetQuery()
+			return &v2.ListVMsResponse{
+				Vms: []*v2.VMListItem{
+					{Id: "id-1", Namespace: "ns1", Name: "vm1", GuestOs: "Red Hat Enterprise Linux 8.10"},
+				},
+			}, nil
+		},
+	}
+	vm, err := ListV2VMByNamespaceNameGuestOS(ctx, client, "ns1", "vm1", "Red Hat Enterprise Linux 8.10")
+	require.NoError(t, err)
+	require.Equal(t, "id-1", vm.GetId())
+	require.Contains(t, sawQuery, `Guest OS:"Red Hat Enterprise Linux 8.10"`)
+	require.Contains(t, sawQuery, `Namespace:"ns1"`)
+	require.Contains(t, sawQuery, `Virtual Machine Name:"vm1"`)
+}
+
+func TestWaitForV2VMLatestScan(t *testing.T) {
+	ctx := t.Context()
+	opts := WaitOptions{Timeout: 150 * time.Millisecond, PollInterval: 5 * time.Millisecond}
+	var calls int
+	client := &stubV2Client{
+		getVMFn: func(_ context.Context, req *v2.GetVMRequest) (*v2.VMDetail, error) {
+			calls++
+			if calls < 3 {
+				return &v2.VMDetail{Id: req.GetId()}, nil
+			}
+			return &v2.VMDetail{
+				Id: req.GetId(),
+				LatestScan: &v2.VMScanInfo{
+					ScanTime: timestamppb.Now(),
+				},
+			}, nil
+		},
+	}
+	vm, err := WaitForV2VMLatestScan(ctx, client, opts, "vid")
+	require.NoError(t, err)
+	require.NotNil(t, vm.GetLatestScan().GetScanTime())
+	require.GreaterOrEqual(t, calls, 3)
+}
+
+func TestWaitForV2VMRunningInCentral(t *testing.T) {
+	ctx := t.Context()
+	opts := WaitOptions{Timeout: 150 * time.Millisecond, PollInterval: 5 * time.Millisecond}
+	var calls int
+	client := &stubV2Client{
+		getVMFn: func(_ context.Context, _ *v2.GetVMRequest) (*v2.VMDetail, error) {
+			calls++
+			if calls < 2 {
+				return &v2.VMDetail{Id: "r1", State: v2.VirtualMachineV2State_VM_STATE_STOPPED}, nil
+			}
+			return &v2.VMDetail{Id: "r1", State: v2.VirtualMachineV2State_VM_STATE_RUNNING}, nil
+		},
+	}
+	vm, err := WaitForV2VMRunningInCentral(ctx, client, opts, "r1")
+	require.NoError(t, err)
+	require.Equal(t, v2.VirtualMachineV2State_VM_STATE_RUNNING, vm.GetState())
+}
+
+func TestListAllVMCVEsByVM_Pages(t *testing.T) {
+	page0 := make([]*v2.VMCVERow, v2ListPageSize)
+	for i := range page0 {
+		page0[i] = &v2.VMCVERow{Cve: "CVE-full"}
+	}
+	tests := map[string]struct {
+		resp      func(offset int32) *v2.ListVMCVEsByVMResponse
+		wantLen   int
+		wantTotal int32
+		wantCalls int
+		wantLast  string
+	}{
+		"short first page": {
+			resp: func(offset int32) *v2.ListVMCVEsByVMResponse {
+				if offset != 0 {
+					return &v2.ListVMCVEsByVMResponse{TotalCount: 2}
+				}
+				return &v2.ListVMCVEsByVMResponse{
+					TotalCount: 2,
+					Cves:       []*v2.VMCVERow{{Cve: "CVE-1"}, {Cve: "CVE-2"}},
+				}
+			},
+			wantLen:   2,
+			wantTotal: 2,
+			wantCalls: 1,
+			wantLast:  "CVE-2",
+		},
+		"zero total_count still pages a full first page": {
+			resp: func(offset int32) *v2.ListVMCVEsByVMResponse {
+				switch offset {
+				case 0:
+					return &v2.ListVMCVEsByVMResponse{TotalCount: 0, Cves: page0}
+				case v2ListPageSize:
+					return &v2.ListVMCVEsByVMResponse{
+						TotalCount: 0,
+						Cves:       []*v2.VMCVERow{{Cve: "CVE-last"}},
+					}
+				default:
+					return &v2.ListVMCVEsByVMResponse{TotalCount: 0}
+				}
+			},
+			wantLen:   v2ListPageSize + 1,
+			wantTotal: int32(v2ListPageSize + 1),
+			wantCalls: 2,
+			wantLast:  "CVE-last",
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			calls := 0
+			client := &stubV2Client{
+				listVMCVEsByVMFn: func(_ context.Context, req *v2.ListVMCVEsByVMRequest) (*v2.ListVMCVEsByVMResponse, error) {
+					calls++
+					return tc.resp(req.GetQuery().GetPagination().GetOffset()), nil
+				},
+			}
+			cves, total, err := ListAllVMCVEsByVM(t.Context(), client, "vid")
+			require.NoError(t, err)
+			require.Equal(t, tc.wantTotal, total)
+			require.Len(t, cves, tc.wantLen)
+			require.Equal(t, tc.wantCalls, calls)
+			require.Equal(t, tc.wantLast, cves[len(cves)-1].GetCve())
+		})
+	}
+}
+
+func TestListAllVMComponents_Pages(t *testing.T) {
+	page0 := make([]*v2.VMComponentRow, v2ListPageSize)
+	for i := range page0 {
+		page0[i] = &v2.VMComponentRow{Name: "pkg"}
+	}
+	tests := map[string]struct {
+		resp      func(offset int32) *v2.ListVMComponentsResponse
+		wantLen   int
+		wantTotal int32
+		wantCalls int
+		wantLast  string
+	}{
+		"accurate total across two pages": {
+			resp: func(offset int32) *v2.ListVMComponentsResponse {
+				switch offset {
+				case 0:
+					return &v2.ListVMComponentsResponse{TotalCount: int32(v2ListPageSize + 1), Components: page0}
+				case v2ListPageSize:
+					return &v2.ListVMComponentsResponse{
+						TotalCount: int32(v2ListPageSize + 1),
+						Components: []*v2.VMComponentRow{{Name: "last"}},
+					}
+				default:
+					return &v2.ListVMComponentsResponse{TotalCount: int32(v2ListPageSize + 1)}
+				}
+			},
+			wantLen:   v2ListPageSize + 1,
+			wantTotal: int32(v2ListPageSize + 1),
+			wantCalls: 2,
+			wantLast:  "last",
+		},
+		"zero total_count still pages a full first page": {
+			resp: func(offset int32) *v2.ListVMComponentsResponse {
+				switch offset {
+				case 0:
+					return &v2.ListVMComponentsResponse{TotalCount: 0, Components: page0}
+				case v2ListPageSize:
+					return &v2.ListVMComponentsResponse{
+						TotalCount: 0,
+						Components: []*v2.VMComponentRow{{Name: "last"}},
+					}
+				default:
+					return &v2.ListVMComponentsResponse{TotalCount: 0}
+				}
+			},
+			wantLen:   v2ListPageSize + 1,
+			wantTotal: int32(v2ListPageSize + 1),
+			wantCalls: 2,
+			wantLast:  "last",
+		},
+		"full page matching total does not fetch next": {
+			resp: func(offset int32) *v2.ListVMComponentsResponse {
+				if offset != 0 {
+					return &v2.ListVMComponentsResponse{
+						TotalCount: int32(v2ListPageSize),
+						Components: page0,
+					}
+				}
+				return &v2.ListVMComponentsResponse{TotalCount: int32(v2ListPageSize), Components: page0}
+			},
+			wantLen:   v2ListPageSize,
+			wantTotal: int32(v2ListPageSize),
+			wantCalls: 1,
+			wantLast:  "pkg",
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			calls := 0
+			client := &stubV2Client{
+				listVMComponentsFn: func(_ context.Context, req *v2.ListVMComponentsRequest) (*v2.ListVMComponentsResponse, error) {
+					calls++
+					return tc.resp(req.GetQuery().GetPagination().GetOffset()), nil
+				},
+			}
+			comps, total, err := ListAllVMComponents(t.Context(), client, "vid")
+			require.NoError(t, err)
+			require.Equal(t, tc.wantTotal, total)
+			require.Len(t, comps, tc.wantLen)
+			require.Equal(t, tc.wantCalls, calls)
+			require.Equal(t, tc.wantLast, comps[len(comps)-1].GetName())
+		})
+	}
+}
+
+func TestVulnCountBySeverityTotal(t *testing.T) {
+	tests := map[string]struct {
+		in   *v2.VulnCountBySeverity
+		want int32
+	}{
+		"nil":   {in: nil, want: 0},
+		"empty": {in: &v2.VulnCountBySeverity{}, want: 0},
+		"sums": {in: &v2.VulnCountBySeverity{
+			Critical:  &v2.VulnFixableCount{Total: 3},
+			Important: &v2.VulnFixableCount{Total: 2},
+			Moderate:  &v2.VulnFixableCount{Total: 1},
+			Low:       &v2.VulnFixableCount{Total: 4},
+			Unknown:   &v2.VulnFixableCount{Total: 0},
+		}, want: 10},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tc.want, VulnCountBySeverityTotal(tc.in))
+		})
+	}
+}
+
+func TestCountVMCVERowsBySeverity(t *testing.T) {
+	tests := map[string]struct {
+		in   []*v2.VMCVERow
+		want *v2.VulnCountBySeverity
+	}{
+		"empty": {in: nil, want: &v2.VulnCountBySeverity{}},
+		"by max severity": {in: []*v2.VMCVERow{
+			{Cve: "CVE-1", Severity: v2.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY, IsFixable: true},
+			{Cve: "CVE-2", Severity: v2.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY},
+			{Cve: "CVE-3", Severity: v2.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY, IsFixable: true},
+		}, want: &v2.VulnCountBySeverity{
+			Critical: &v2.VulnFixableCount{Total: 1, Fixable: 1},
+			Moderate: &v2.VulnFixableCount{Total: 2, Fixable: 1},
+		}},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			got := CountVMCVERowsBySeverity(tc.in)
+			require.Equal(t, tc.want.GetCritical().GetTotal(), got.GetCritical().GetTotal())
+			require.Equal(t, tc.want.GetCritical().GetFixable(), got.GetCritical().GetFixable())
+			require.Equal(t, tc.want.GetImportant().GetTotal(), got.GetImportant().GetTotal())
+			require.Equal(t, tc.want.GetModerate().GetTotal(), got.GetModerate().GetTotal())
+			require.Equal(t, tc.want.GetModerate().GetFixable(), got.GetModerate().GetFixable())
+			require.Equal(t, tc.want.GetLow().GetTotal(), got.GetLow().GetTotal())
+			require.Equal(t, tc.want.GetUnknown().GetTotal(), got.GetUnknown().GetTotal())
+		})
+	}
+}
+
+func TestWaitForV2ScanMissingComponent(t *testing.T) {
+	ctx := t.Context()
+	opts := WaitOptions{Timeout: 400 * time.Millisecond, PollInterval: 5 * time.Millisecond}
+	baseline := time.Now().Add(-time.Minute)
+	var calls int
+	client := &stubV2Client{
+		getVMFn: func(_ context.Context, req *v2.GetVMRequest) (*v2.VMDetail, error) {
+			calls++
+			scanTime := baseline.Add(time.Duration(calls) * time.Second)
+			return &v2.VMDetail{
+				Id: req.GetId(),
+				LatestScan: &v2.VMScanInfo{
+					ScanTime: timestamppb.New(scanTime),
+				},
+			}, nil
+		},
+		listVMComponentsFn: func(_ context.Context, req *v2.ListVMComponentsRequest) (*v2.ListVMComponentsResponse, error) {
+			if req.GetQuery().GetQuery() != "" {
+				if calls < 3 {
+					return &v2.ListVMComponentsResponse{
+						TotalCount: 1,
+						Components: []*v2.VMComponentRow{{Name: "bc"}},
+					}, nil
+				}
+				return &v2.ListVMComponentsResponse{}, nil
+			}
+			return &v2.ListVMComponentsResponse{
+				TotalCount: 2,
+				Components: []*v2.VMComponentRow{{Name: "bash"}, {Name: "coreutils"}},
+			}, nil
+		},
+	}
+	comps, err := WaitForV2ScanMissingComponent(ctx, client, opts, "vid", "bc", baseline, 2)
+	require.NoError(t, err)
+	require.Len(t, comps, 2)
+}
+
+func TestWaitForV2ScanReady(t *testing.T) {
+	ctx := t.Context()
+	opts := WaitOptions{Timeout: 200 * time.Millisecond, PollInterval: 5 * time.Millisecond}
+	var calls int
+	client := &stubV2Client{
+		getVMFn: func(_ context.Context, req *v2.GetVMRequest) (*v2.VMDetail, error) {
+			return &v2.VMDetail{
+				Id:      req.GetId(),
+				GuestOs: "rhel",
+				LatestScan: &v2.VMScanInfo{
+					ScanTime: timestamppb.Now(),
+					ScanOs:   "rhel",
+				},
+			}, nil
+		},
+		listVMComponentsFn: func(context.Context, *v2.ListVMComponentsRequest) (*v2.ListVMComponentsResponse, error) {
+			calls++
+			if calls == 1 {
+				return &v2.ListVMComponentsResponse{
+					TotalCount: 1,
+					Components: []*v2.VMComponentRow{{Name: "bash", ScanStatus: v2.ScanStatus_NOT_SCANNED}},
+				}, nil
+			}
+			return &v2.ListVMComponentsResponse{
+				TotalCount: 1,
+				Components: []*v2.VMComponentRow{{Name: "bash", ScanStatus: v2.ScanStatus_SCANNED}},
+			}, nil
+		},
+	}
+	vm, err := WaitForV2ScanReady(ctx, client, opts, "vid")
+	require.NoError(t, err)
+	require.Equal(t, "vid", vm.GetId())
+	require.GreaterOrEqual(t, calls, 2)
+}
+
+func TestWaitForV2ScanReady_RetriesTransientListError(t *testing.T) {
+	ctx := t.Context()
+	opts := WaitOptions{Timeout: 400 * time.Millisecond, PollInterval: 5 * time.Millisecond}
+	var calls int
+	client := &stubV2Client{
+		getVMFn: func(_ context.Context, req *v2.GetVMRequest) (*v2.VMDetail, error) {
+			return &v2.VMDetail{
+				Id:      req.GetId(),
+				GuestOs: "rhel",
+				LatestScan: &v2.VMScanInfo{
+					ScanTime: timestamppb.Now(),
+					ScanOs:   "rhel",
+				},
+			}, nil
+		},
+		listVMComponentsFn: func(context.Context, *v2.ListVMComponentsRequest) (*v2.ListVMComponentsResponse, error) {
+			calls++
+			if calls == 1 {
+				return nil, status.Error(codes.Unavailable, "central busy")
+			}
+			return &v2.ListVMComponentsResponse{
+				TotalCount: 1,
+				Components: []*v2.VMComponentRow{{Name: "bash", ScanStatus: v2.ScanStatus_SCANNED}},
+			}, nil
+		},
+	}
+	vm, err := WaitForV2ScanReady(ctx, client, opts, "vid")
+	require.NoError(t, err)
+	require.Equal(t, "vid", vm.GetId())
+	require.GreaterOrEqual(t, calls, 2)
+}
diff --git a/tests/vmhelpers/cluster_preflight.go b/tests/vmhelpers/cluster_preflight.go
index 759e569caee95..01b89f959ac4d 100644
--- a/tests/vmhelpers/cluster_preflight.go
+++ b/tests/vmhelpers/cluster_preflight.go
@@ -94,7 +94,7 @@ func nodeKVMCapacityString(node coreV1.Node) string {
 func InspectClusterKVMReadiness(ctx context.Context, k8s kubernetes.Interface) (ClusterKVMPreflightResult, error) {
 	nodeList, err := k8s.CoreV1().Nodes().List(ctx, metaV1.ListOptions{})
 	if err != nil {
-		return ClusterKVMPreflightResult{}, err
+		return ClusterKVMPreflightResult{}, fmt.Errorf("list nodes: %w", err)
 	}
 
 	result := ClusterKVMPreflightResult{
diff --git a/tests/vmhelpers/compliance.go b/tests/vmhelpers/compliance.go
index cc8a0846b85fd..4e4771628b933 100644
--- a/tests/vmhelpers/compliance.go
+++ b/tests/vmhelpers/compliance.go
@@ -67,14 +67,17 @@ func EnsureComplianceMetricsEnv(
 	err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		current, getErr := k8sClient.AppsV1().DaemonSets(ns).Get(ctx, dsName, metaV1.GetOptions{})
 		if getErr != nil {
-			return getErr
+			return fmt.Errorf("get daemonset %s/%s: %w", ns, dsName, getErr)
 		}
 		needsUpdate, setErr := SetContainerEnv(current, containerName, envName, envValue)
 		if setErr != nil || !needsUpdate {
 			return setErr
 		}
 		_, updateErr := k8sClient.AppsV1().DaemonSets(ns).Update(ctx, current, metaV1.UpdateOptions{})
-		return updateErr
+		if updateErr != nil {
+			return fmt.Errorf("update daemonset %s/%s: %w", ns, dsName, updateErr)
+		}
+		return nil
 	})
 	if err != nil {
 		return fmt.Errorf("updating DaemonSet %s/%s: %w", ns, dsName, err)
diff --git a/tests/vmhelpers/roxagent.go b/tests/vmhelpers/roxagent.go
index 48f9e327f0f25..43b011a395885 100644
--- a/tests/vmhelpers/roxagent.go
+++ b/tests/vmhelpers/roxagent.go
@@ -8,12 +8,7 @@ import (
 	"time"
 )
 
-// Guest paths for staging and installing the roxagent binary during VM tests.
 const (
-	// DefaultRoxagentInstallPath is the path used when copying and running roxagent on the guest.
-	DefaultRoxagentInstallPath = "/usr/local/bin/roxagent"
-	roxagentStagingPath        = "/tmp/roxagent"
-	roxagentServePort          = "818"
 	// E2ERescanInterval is passed to serve --rescan-interval. It is the
 	// minimum allowed interval and keeps the package-freshness e2e within a
 	// reasonable wall-clock budget without reactive watching or restarts.
@@ -21,165 +16,105 @@ const (
 	// E2EScraperPollInterval is the Sensor pull-mode scrape cadence used by
 	// the VM e2e suite - floored at 1m.
 	E2EScraperPollInterval = time.Minute
-	// Transient systemd unit started by EnsureRoxagentServing (systemd-run --unit=...).
-	roxagentE2EUnit            = "roxagent-e2e.service"
-	roxagentE2EUnitName        = "roxagent-e2e"
-	roxagentListenReadyMarker  = "Listening on VSOCK port"
+	// roxagentUnit is the Quadlet-generated systemd unit customers run.
+	roxagentUnit               = "roxagent.service"
 	roxagentListenPollInterval = 5 * time.Second
+	guestPodmanAuthPath        = "/etc/containers/auth.json"
+	guestPodmanAuthStagingPath = "/tmp/roxagent-podman-auth.json"
 )
 
+// ErrPodmanNotFound means the guest has no podman binary. SetupSuite records
+// SkipReason and continues; TestScanPipeline skips that VM's subtests.
+var ErrPodmanNotFound = errors.New("podman not found on guest")
+
 // ErrTerminalVSOCKUnavailable is returned when vsock is permanently unavailable on the guest (no retry).
 var ErrTerminalVSOCKUnavailable = errors.New("terminal vsock unavailable")
 
-// isVsockUnavailableOutput detects terminal vsock device errors in roxagent combined output.
+// isVsockUnavailableOutput detects terminal vsock device errors in roxagent or
+// Podman combined output. Both the vsock token and an unavailable-device marker
+// must appear on the same line so an unrelated ENOENT in a journal dump is ignored.
 func isVsockUnavailableOutput(output string) bool {
-	lower := strings.ToLower(strings.TrimSpace(output))
-	if !strings.Contains(lower, "vsock") {
-		return false
-	}
-	return strings.Contains(lower, "no such device") ||
-		strings.Contains(lower, "no such file or directory")
-}
-
-// CopyRoxagentBinary copies a local roxagent binary into the guest install path.
-func CopyRoxagentBinary(ctx context.Context, virt Virtctl, namespace, vm, hostBinaryPath string) error {
-	return retryOnSSHTransport(ctx, virt.Logf, "copy roxagent binary", func(ctx context.Context) error {
-		stderr, err := virt.SCPTo(ctx, namespace, vm, hostBinaryPath, roxagentStagingPath)
-		if err != nil {
-			return fmt.Errorf("virtctl scp roxagent: %w: %s", err, strings.TrimSpace(stderr))
+	for line := range strings.SplitSeq(strings.ToLower(output), "\n") {
+		if !strings.Contains(line, "vsock") {
+			continue
 		}
-		_, stderr, err = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
-			description:            "install roxagent binary",
-			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
-		}, "sudo", "install", "-m", "0755", roxagentStagingPath, DefaultRoxagentInstallPath)
-		if err != nil {
-			return fmt.Errorf("install roxagent binary on guest: %w: %s", err, strings.TrimSpace(stderr))
-		}
-		return nil
-	})
-}
-
-// VerifyRoxagentInstalled runs `roxagent --help` on the guest to confirm the binary is
-// present, executable, and resolvable in $PATH — all in a single SSH round-trip.
-func VerifyRoxagentInstalled(ctx context.Context, virt Virtctl, namespace, vm string) error {
-	return retryOnSSHTransport(ctx, virt.Logf, "verify roxagent installed", func(ctx context.Context) error {
-		_, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
-			description:            "verify roxagent installed",
-			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
-		}, DefaultRoxagentInstallPath, "--help")
-		if err != nil {
-			return fmt.Errorf("roxagent --help: %w: %s", err, strings.TrimSpace(stderr))
+		if strings.Contains(line, "no such device") ||
+			strings.Contains(line, "no such file or directory") ||
+			(strings.Contains(line, "/dev/vsock") && strings.Contains(line, "not found")) {
+			return true
 		}
-		return nil
-	})
+	}
+	return false
 }
 
-// EnsureRoxagentServing starts `roxagent serve` on the guest via a transient systemd
-// unit if it is not already active, then waits until the VSOCK listener is up.
-// Sensor pulls reports from this long-running process; the test does not push
-// index reports.
-//
-// repo2cpeURL is passed as --repo-cpe-url (serve does not read ROXAGENT_REPO2CPE_URL).
-func EnsureRoxagentServing(ctx context.Context, virt Virtctl, namespace, vm, repo2cpeURL string) error {
-	invocationID, err := startRoxagentServeIfNeeded(ctx, virt, namespace, vm, repo2cpeURL)
-	if err != nil {
+// EnsureRoxagentServing starts Quadlet `roxagent.service` if it is not already
+// active, then waits until ActiveState is active (READY=1 after VSOCK listen).
+func EnsureRoxagentServing(ctx context.Context, virt Virtctl, namespace, vm string) error {
+	if err := startRoxagentServeIfNeeded(ctx, virt, namespace, vm); err != nil {
 		return err
 	}
-	return waitRoxagentListening(ctx, virt, namespace, vm, invocationID)
+	return waitRoxagentActive(ctx, virt, namespace, vm)
 }
 
-// startRoxagentServeIfNeeded starts the e2e unit if it isn't already active/activating,
-// and returns its current InvocationID so waitRoxagentListening can scope its journal
-// query to exactly this activation.
-func startRoxagentServeIfNeeded(ctx context.Context, virt Virtctl, namespace, vm, repo2cpeURL string) (string, error) {
-	var invocationID string
-	err := retryOnSSHTransport(ctx, virt.Logf, "start roxagent serve", func(ctx context.Context) error {
+func startRoxagentServeIfNeeded(ctx context.Context, virt Virtctl, namespace, vm string) error {
+	return retryOnSSHTransport(ctx, virt.Logf, "start roxagent serve", func(ctx context.Context) error {
 		state, err := roxagentServeState(ctx, virt, namespace, vm)
 		if err != nil {
 			return err
 		}
 		if state == "active" || state == "activating" {
-			virt.Logf("roxagent serve: %s already %s", roxagentE2EUnit, state)
-			invocationID, err = roxagentInvocationID(ctx, virt, namespace, vm)
-			return err
+			virt.Logf("roxagent serve: %s already %s", roxagentUnit, state)
+			return nil
 		}
 
-		// systemd-run refuses to reuse a unit name that still exists (failed or
-		// stopped). Clear leftovers from a prior attempt, then start fresh.
-		_, _, _ = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
-			description:            "stop leftover roxagent-e2e unit",
-			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
-		}, "sudo", "systemctl", "stop", roxagentE2EUnit)
-		_, _, _ = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
-			description:            "reset-failed roxagent-e2e unit",
-			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
-		}, "sudo", "systemctl", "reset-failed", roxagentE2EUnit)
+		if state == "failed" {
+			_, _, _ = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+				description:            "reset-failed roxagent.service",
+				transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+			}, "sudo", "systemctl", "reset-failed", roxagentUnit)
+		}
 
 		_, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
-			description:            "systemd-run roxagent serve",
+			description:            "systemctl start roxagent.service",
 			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
-		}, "sudo", "systemd-run",
-			"--unit="+roxagentE2EUnitName,
-			"--property=Type=simple",
-			DefaultRoxagentInstallPath, "serve",
-			"--port", roxagentServePort,
-			"--host-path", "/",
-			"--rescan-interval", E2ERescanInterval.String(),
-			"--repo-cpe-url", repo2cpeURL,
-		)
+		}, "sudo", "systemctl", "start", roxagentUnit)
 		if err != nil {
-			logs := fetchRoxagentServeJournal(ctx, virt, namespace, vm)
-			combined := strings.TrimSpace(stderr + "\n" + logs)
-			if isVsockUnavailableOutput(combined) {
-				return fmt.Errorf("%w: systemd-run roxagent serve: %w (output: %s)",
-					ErrTerminalVSOCKUnavailable, err, combined)
-			}
-			return fmt.Errorf("systemd-run roxagent serve: %w (stderr: %s; journal: %s)",
-				err, strings.TrimSpace(stderr), logs)
+			return wrapRoxagentUnitCmdError(ctx, virt, namespace, vm, "systemctl start "+roxagentUnit, err, stderr)
 		}
 
-		virt.Logf("roxagent serve: systemd-run accepted %s", roxagentE2EUnit)
-		invocationID, err = roxagentInvocationID(ctx, virt, namespace, vm)
-		return err
+		virt.Logf("roxagent serve: started %s", roxagentUnit)
+		return nil
 	})
-	return invocationID, err
 }
 
-// waitRoxagentListening polls until the unit identified by invocationID is both active
-// and reports the VSOCK listen marker in its journal.
-func waitRoxagentListening(ctx context.Context, virt Virtctl, namespace, vm, invocationID string) error {
+// waitRoxagentActive polls until the Quadlet unit's ActiveState is active.
+// Type=notify keeps the unit in activating until READY=1 after VSOCK listen.
+func waitRoxagentActive(ctx context.Context, virt Virtctl, namespace, vm string) error {
 	for {
 		state, err := roxagentServeState(ctx, virt, namespace, vm)
 		if err != nil {
 			return err
 		}
 		switch state {
-		case "active", "activating":
-			// keep waiting for the listen log line
+		case "active":
+			virt.Logf("roxagent serve is active (VSOCK listener ready)")
+			return nil
+		case "activating":
+			virt.Logf("roxagent serve still starting (unit=%s, waiting for Type=notify READY)", state)
 		default:
 			logs := fetchRoxagentServeJournal(ctx, virt, namespace, vm)
 			if isVsockUnavailableOutput(logs) {
-				return fmt.Errorf("%w: roxagent serve unit %q (journal: %s)",
-					ErrTerminalVSOCKUnavailable, state, logs)
+				return fmt.Errorf("%w: %s ActiveState=%q (journal: %s)",
+					ErrTerminalVSOCKUnavailable, roxagentUnit, state, logs)
 			}
-			return fmt.Errorf("roxagent serve unit %q (journal: %s)", state, logs)
-		}
-
-		listening, err := roxagentServeListening(ctx, virt, namespace, vm, invocationID)
-		if err != nil {
-			return err
-		}
-		if listening {
-			virt.Logf("roxagent serve is listening on VSOCK")
-			return nil
+			return fmt.Errorf("%s ActiveState=%q (journal: %s)", roxagentUnit, state, logs)
 		}
-		virt.Logf("roxagent serve still starting (unit=%s, waiting for %q)", state, roxagentListenReadyMarker)
 
 		timer := time.NewTimer(roxagentListenPollInterval)
 		select {
 		case <-ctx.Done():
 			timer.Stop()
-			return fmt.Errorf("timed out waiting for roxagent serve to listen: %w", ctx.Err())
+			return fmt.Errorf("timed out waiting for roxagent serve to become active: %w", ctx.Err())
 		case <-timer.C:
 		}
 	}
@@ -190,8 +125,8 @@ func waitRoxagentListening(ctx context.Context, virt Virtctl, namespace, vm, inv
 // for any unit systemd knows about — loaded or not, active or not — so a non-zero exit here
 // reliably means a genuine remote-command problem, not an expected state value. That makes it
 // the preferred way to read any systemd unit property from the guest; add new lookups (like
-// roxagentServeState and roxagentInvocationID below) on top of it rather than parsing the
-// output or exit code of state-specific subcommands such as `is-active`.
+// roxagentServeState below) on top of it rather than parsing the output or exit code of
+// state-specific subcommands such as `is-active`.
 func systemctlShowProperty(ctx context.Context, virt Virtctl, namespace, vm, unit, property string) (string, error) {
 	stdout, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
 		description:            fmt.Sprintf("systemctl show -p %s %s", property, unit),
@@ -204,21 +139,21 @@ func systemctlShowProperty(ctx context.Context, virt Virtctl, namespace, vm, uni
 	return strings.TrimSpace(stdout), nil
 }
 
-// RoxagentServeInvocationID returns the e2e unit's current systemd InvocationID.
+// RoxagentServeInvocationID returns the Quadlet unit's current systemd InvocationID.
 // That UUID is unique per activation, so comparing it before and after a wait
 // detects restarts.
 func RoxagentServeInvocationID(ctx context.Context, virt Virtctl, namespace, vm string) (string, error) {
-	id, err := roxagentInvocationID(ctx, virt, namespace, vm)
+	id, err := systemctlShowProperty(ctx, virt, namespace, vm, roxagentUnit, "InvocationID")
 	if err != nil {
 		return "", err
 	}
 	if id == "" {
-		return "", errors.New("roxagent-e2e InvocationID is empty")
+		return "", errors.New("roxagent.service InvocationID is empty")
 	}
 	return id, nil
 }
 
-// RoxagentServeDidNotRestart returns nil when the e2e unit still has beforeID
+// RoxagentServeDidNotRestart returns nil when the Quadlet unit still has beforeID
 // as its InvocationID. A different ID means systemd started a new activation
 // (stop/start, crash recovery, or an explicit restart).
 func RoxagentServeDidNotRestart(ctx context.Context, virt Virtctl, namespace, vm, beforeID string) error {
@@ -230,15 +165,15 @@ func RoxagentServeDidNotRestart(ctx context.Context, virt Virtctl, namespace, vm
 		return err
 	}
 	if afterID != beforeID {
-		return fmt.Errorf("roxagent-e2e restarted during the wait: InvocationID changed from %s to %s",
+		return fmt.Errorf("roxagent.service restarted during the wait: InvocationID changed from %s to %s",
 			beforeID, afterID)
 	}
 	return nil
 }
 
-// roxagentServeState returns the e2e unit's ActiveState (active/inactive/failed/activating/…).
+// roxagentServeState returns the Quadlet unit's ActiveState (active/inactive/failed/activating/…).
 func roxagentServeState(ctx context.Context, virt Virtctl, namespace, vm string) (string, error) {
-	state, err := systemctlShowProperty(ctx, virt, namespace, vm, roxagentE2EUnit, "ActiveState")
+	state, err := systemctlShowProperty(ctx, virt, namespace, vm, roxagentUnit, "ActiveState")
 	if err != nil {
 		return "", err
 	}
@@ -248,37 +183,22 @@ func roxagentServeState(ctx context.Context, virt Virtctl, namespace, vm string)
 	return state, nil
 }
 
-// roxagentInvocationID returns the e2e unit's current InvocationID, a per-activation UUID.
-// Filtering journalctl on it (instead of `-u <unit> -b`) scopes a query to exactly this run,
-// so a stale marker line from an earlier activation of the same reused transient unit name
-// (stopped/failed, then restarted by startRoxagentServeIfNeeded) can't produce a false positive.
-func roxagentInvocationID(ctx context.Context, virt Virtctl, namespace, vm string) (string, error) {
-	return systemctlShowProperty(ctx, virt, namespace, vm, roxagentE2EUnit, "InvocationID")
-}
-
-// roxagentServeListening reports whether the journal for the activation identified by
-// invocationID contains the VSOCK listen marker. A plain dump exits 0 regardless of whether
-// the marker is present, so a non-zero exit here always means a genuine SSH or remote-command
-// problem rather than "not listening yet". The dump is unbounded (no `-n` tail) so a chatty
-// agent cannot scroll the marker out of a fixed window between polls.
-func roxagentServeListening(ctx context.Context, virt Virtctl, namespace, vm, invocationID string) (bool, error) {
-	stdout, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
-		description:            "journalctl roxagent listening check",
-		transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
-	}, "sudo", "journalctl", "_SYSTEMD_INVOCATION_ID="+invocationID, "--no-pager", "-o", "cat")
-	if err != nil {
-		return false, fmt.Errorf("journalctl _SYSTEMD_INVOCATION_ID=%s: %w (stdout: %s; stderr: %s)",
-			invocationID, err, strings.TrimSpace(stdout), strings.TrimSpace(stderr))
+// wrapRoxagentUnitCmdError appends journal context and maps terminal vsock failures.
+func wrapRoxagentUnitCmdError(ctx context.Context, virt Virtctl, namespace, vm, op string, err error, stderr string) error {
+	logs := fetchRoxagentServeJournal(ctx, virt, namespace, vm)
+	combined := strings.TrimSpace(stderr + "\n" + logs)
+	if isVsockUnavailableOutput(combined) {
+		return fmt.Errorf("%w: %s: %w (output: %s)", ErrTerminalVSOCKUnavailable, op, err, combined)
 	}
-	return strings.Contains(stdout, roxagentListenReadyMarker), nil
+	return fmt.Errorf("%s: %w (stderr: %s; journal: %s)", op, err, strings.TrimSpace(stderr), logs)
 }
 
 // fetchRoxagentServeJournal returns a short recent journal dump for error messages.
 func fetchRoxagentServeJournal(ctx context.Context, virt Virtctl, namespace, vm string) string {
 	stdout, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
-		description:            "journalctl roxagent-e2e",
+		description:            "journalctl roxagent.service",
 		transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
-	}, "sudo", "journalctl", "-u", roxagentE2EUnit, "-b", "--no-pager", "-o", "cat", "-n", "200")
+	}, "sudo", "journalctl", "-u", roxagentUnit, "-b", "--no-pager", "-o", "cat", "-n", "200")
 	if err != nil {
 		return strings.TrimSpace(stdout + "\n" + stderr)
 	}
diff --git a/tests/vmhelpers/roxagent_quadlet.go b/tests/vmhelpers/roxagent_quadlet.go
new file mode 100644
index 0000000000000..80e99db9f001e
--- /dev/null
+++ b/tests/vmhelpers/roxagent_quadlet.go
@@ -0,0 +1,276 @@
+package vmhelpers
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const (
+	quadletInstallScriptName  = "install.sh"
+	quadletContainerFileName  = "roxagent.container"
+	guestQuadletStageTemplate = "/tmp/roxagent-quadlet.XXXXXX"
+)
+
+// InstallRoxagentQuadlet copies the customer installer plus a staged
+// roxagent.container to the guest and runs install.sh --stage-dir so systemd
+// ends up with roxagent.service.
+func InstallRoxagentQuadlet(ctx context.Context, virt Virtctl, namespace, vm, image, repo2cpeURL, podmanAuthPath string) error {
+	if err := requireGuestPodman(ctx, virt, namespace, vm); err != nil {
+		return err
+	}
+	if err := installGuestPodmanAuth(ctx, virt, namespace, vm, podmanAuthPath); err != nil {
+		return err
+	}
+
+	hostStage, err := stageQuadletInstall(image, repo2cpeURL, podmanAuthPath)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = os.RemoveAll(hostStage) }()
+
+	return retryOnSSHTransport(ctx, virt.Logf, "install roxagent quadlet", func(ctx context.Context) error {
+		guestStage, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+			description:            "mktemp quadlet stage dir",
+			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+		}, "mktemp", "-d", guestQuadletStageTemplate)
+		if err != nil {
+			return fmt.Errorf("mktemp quadlet stage dir: %w: %s", err, strings.TrimSpace(stderr))
+		}
+		guestStage = strings.TrimSpace(guestStage)
+		if guestStage == "" {
+			return errors.New("mktemp quadlet stage dir: empty path")
+		}
+
+		for _, name := range []string{quadletInstallScriptName, quadletContainerFileName} {
+			if scpErr := scpToGuest(ctx, virt, namespace, vm, filepath.Join(hostStage, name), guestStage+"/"+name); scpErr != nil {
+				return scpErr
+			}
+		}
+
+		prevState := "inactive"
+		if s, stateErr := roxagentServeState(ctx, virt, namespace, vm); stateErr == nil {
+			prevState = s
+		}
+		if prevState == "failed" {
+			_, _, _ = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+				description:            "reset-failed roxagent.service",
+				transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+			}, "sudo", "systemctl", "reset-failed", roxagentUnit)
+		}
+
+		_, stderr, err = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+			description:            "install.sh --stage-dir",
+			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+		}, "bash", guestStage+"/"+quadletInstallScriptName, "--stage-dir", guestStage)
+		if err != nil {
+			return wrapRoxagentUnitCmdError(ctx, virt, namespace, vm, "install.sh --stage-dir", err, stderr)
+		}
+
+		// install.sh start is a no-op when the unit is already running, so
+		// restart only on re-runs to apply a new Image=/Exec= overlay.
+		if prevState != "active" && prevState != "activating" {
+			return nil
+		}
+		_, stderr, err = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+			description:            "systemctl restart roxagent.service",
+			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+		}, "sudo", "systemctl", "restart", roxagentUnit)
+		if err != nil {
+			return wrapRoxagentUnitCmdError(ctx, virt, namespace, vm, "systemctl restart "+roxagentUnit, err, stderr)
+		}
+		return nil
+	})
+}
+
+func requireGuestPodman(ctx context.Context, virt Virtctl, namespace, vm string) error {
+	return retryOnSSHTransport(ctx, virt.Logf, "check guest podman", func(ctx context.Context) error {
+		_, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+			description:            "podman --version",
+			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+		}, "podman", "--version")
+		if err != nil {
+			return fmt.Errorf("%w on guest %s/%s (VM image must ship it; unactivated guests cannot dnf install): %v: %s",
+				ErrPodmanNotFound, namespace, vm, err, strings.TrimSpace(stderr))
+		}
+		return nil
+	})
+}
+
+func installGuestPodmanAuth(ctx context.Context, virt Virtctl, namespace, vm, podmanAuthPath string) error {
+	if strings.TrimSpace(podmanAuthPath) == "" {
+		return nil
+	}
+	if _, err := os.Stat(podmanAuthPath); err != nil {
+		return fmt.Errorf("podman auth file %q: %w", podmanAuthPath, err)
+	}
+	return retryOnSSHTransport(ctx, virt.Logf, "install guest podman auth", func(ctx context.Context) error {
+		if err := scpToGuest(ctx, virt, namespace, vm, podmanAuthPath, guestPodmanAuthStagingPath); err != nil {
+			return err
+		}
+		defer func() {
+			_, _, _ = runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+				description:            "remove staged podman auth file",
+				transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+			}, "rm", "-f", guestPodmanAuthStagingPath)
+		}()
+		_, stderr, err := runSSHCommandWithFramework(ctx, virt, namespace, vm, sshCommandRunOptions{
+			description:            "install /etc/containers/auth.json",
+			transportRetryAttempts: rhsmPrecheckSSHRetryThreshold,
+		}, "sudo", "install", "-D", "-m", "0600", guestPodmanAuthStagingPath, guestPodmanAuthPath)
+		if err != nil {
+			return fmt.Errorf("install %s: %w: %s", guestPodmanAuthPath, err, strings.TrimSpace(stderr))
+		}
+		return nil
+	})
+}
+
+func scpToGuest(ctx context.Context, virt Virtctl, namespace, vm, src, dst string) error {
+	return retryCopyToGuest(ctx, virt.Logf, src, dst, defaultSSHTransportRetryAttempts, defaultSSHTransportRetryInterval, func() (string, error) {
+		return virt.SCPTo(ctx, namespace, vm, src, dst)
+	})
+}
+
+// wrapSCPError attaches errSSHTransport only for retryable SSH failures so
+// retryOnSSHTransport does not spin on terminal auth errors.
+func wrapSCPError(src, dst, stderr string, err error) error {
+	trimmed := strings.TrimSpace(stderr)
+	isSSH, retryable, category := classifySSHFailure(stderr, err)
+	if !isSSH {
+		return fmt.Errorf("virtctl scp %s -> %s: %w: %s", src, dst, err, trimmed)
+	}
+	wrapped := err
+	if isSSHBannerTimeoutFailure(stderr) {
+		wrapped = errors.Join(err, ErrSSHConnectivityStalled)
+	}
+	if isSSHAuthenticationFailure(stderr) {
+		wrapped = errors.Join(wrapped, ErrSSHAuthenticationFailed)
+	}
+	if retryable {
+		return fmt.Errorf("%w: virtctl scp %s -> %s: retryable SSH %s failure: %w: %s",
+			errSSHTransport, src, dst, category, wrapped, trimmed)
+	}
+	return fmt.Errorf("virtctl scp %s -> %s: terminal SSH %s failure: %w: %s",
+		src, dst, category, wrapped, trimmed)
+}
+
+func retryCopyToGuest(ctx context.Context, logf func(string, ...any), src, dst string, attempts int, interval time.Duration, copyFn func() (string, error)) error {
+	if attempts <= 0 {
+		attempts = defaultSSHTransportRetryAttempts
+	}
+	if interval <= 0 {
+		interval = defaultSSHTransportRetryInterval
+	}
+
+	var lastErr error
+	for attempt := 1; attempt <= attempts; attempt++ {
+		stderr, err := copyFn()
+		if err == nil {
+			return nil
+		}
+		lastErr = wrapSCPError(src, dst, stderr, err)
+		isSSH, retryable, category := classifySSHFailure(stderr, err)
+		if !isSSH || !retryable || attempt >= attempts {
+			return lastErr
+		}
+		if logf != nil {
+			logf("virtctl scp %s -> %s: retryable SSH %s (attempt %d/%d)", src, dst, category, attempt, attempts)
+		}
+		timer := time.NewTimer(interval)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return fmt.Errorf("%w: virtctl scp %s -> %s: context done during retry backoff: %w",
+				errSSHTransport, src, dst, ctx.Err())
+		case <-timer.C:
+		}
+	}
+	return lastErr
+}
+
+func stageQuadletInstall(image, repo2cpeURL, podmanAuthPath string) (string, error) {
+	srcDir := filepath.Join(repoRoot(), "compliance", "virtualmachines", "roxagent", "quadlet")
+	srcContainer, err := os.ReadFile(filepath.Join(srcDir, quadletContainerFileName))
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", quadletContainerFileName, err)
+	}
+	authFile := ""
+	if strings.TrimSpace(podmanAuthPath) != "" {
+		authFile = guestPodmanAuthPath
+	}
+	overlayed, err := overlayQuadletContainer(srcContainer, image, repo2cpeURL, authFile)
+	if err != nil {
+		return "", err
+	}
+	installSrc, err := os.ReadFile(filepath.Join(srcDir, quadletInstallScriptName))
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", quadletInstallScriptName, err)
+	}
+
+	dir, err := os.MkdirTemp("", "roxagent-quadlet-e2e-")
+	if err != nil {
+		return "", fmt.Errorf("mktemp host quadlet stage: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, quadletContainerFileName), overlayed, 0o644); err != nil {
+		_ = os.RemoveAll(dir)
+		return "", fmt.Errorf("write %s: %w", quadletContainerFileName, err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, quadletInstallScriptName), installSrc, 0o755); err != nil {
+		_ = os.RemoveAll(dir)
+		return "", fmt.Errorf("write %s: %w", quadletInstallScriptName, err)
+	}
+	return dir, nil
+}
+
+// overlayQuadletContainer rewrites Image= and Exec= for the cluster image and
+// a 5m rescan. A non-empty authFile sets REGISTRY_AUTH_FILE on [Service]
+// because RHEL 8 Quadlet rejects AuthFile=.
+func overlayQuadletContainer(src []byte, image, repo2cpeURL, authFile string) ([]byte, error) {
+	if strings.TrimSpace(image) == "" {
+		return nil, errors.New("overlayQuadletContainer: image is empty")
+	}
+
+	sawImage, sawExec := false, false
+	srcLines := strings.Split(string(src), "\n")
+	out := make([]string, 0, len(srcLines)+1)
+	for _, line := range srcLines {
+		switch {
+		case strings.HasPrefix(line, "Image="):
+			out = append(out, "Image="+image)
+			sawImage = true
+		case strings.HasPrefix(line, "AuthFile="):
+			continue
+		case line == "[Service]":
+			out = append(out, "[Service]")
+			if authFile != "" {
+				out = append(out, "Environment=REGISTRY_AUTH_FILE="+authFile)
+			}
+		case strings.HasPrefix(line, "Exec="):
+			out = append(out, overlayExecLine(repo2cpeURL))
+			sawExec = true
+		default:
+			out = append(out, line)
+		}
+	}
+	if !sawImage {
+		return nil, errors.New("overlayQuadletContainer: no Image= line")
+	}
+	if !sawExec {
+		return nil, errors.New("overlayQuadletContainer: no Exec= line")
+	}
+	return []byte(strings.Join(out, "\n")), nil
+}
+
+// overlayExecLine is the Quadlet Exec= line. --repo-cpe-url is omitted when
+// empty so systemd cannot pass a blank argument to serve.
+func overlayExecLine(repo2cpeURL string) string {
+	line := "Exec=serve --host-path /host --rescan-interval " + E2ERescanInterval.String()
+	if u := strings.TrimSpace(repo2cpeURL); u != "" {
+		line += " --repo-cpe-url " + u
+	}
+	return line
+}
diff --git a/tests/vmhelpers/roxagent_quadlet_test.go b/tests/vmhelpers/roxagent_quadlet_test.go
new file mode 100644
index 0000000000000..e64262c40afc3
--- /dev/null
+++ b/tests/vmhelpers/roxagent_quadlet_test.go
@@ -0,0 +1,252 @@
+//go:build test && !test_e2e && !test_e2e_vm
+
+package vmhelpers
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestOverlayQuadletContainer(t *testing.T) {
+	t.Parallel()
+
+	src, err := os.ReadFile(filepath.Join(repoRoot(), "compliance", "virtualmachines", "roxagent", "quadlet", "roxagent.container"))
+	require.NoError(t, err)
+
+	const (
+		image = "quay.io/rhacs-eng/main:e2e-test"
+		url   = "https://example.test/repository-to-cpe.json"
+	)
+
+	got, err := overlayQuadletContainer(src, image, url, "")
+	require.NoError(t, err)
+	out := string(got)
+	require.Contains(t, out, "Image="+image)
+	require.NotContains(t, out, "Image=quay.io/stackrox-io/main:latest")
+	require.NotContains(t, out, "AuthFile=")
+	require.NotContains(t, out, "REGISTRY_AUTH_FILE")
+	require.Contains(t, out, overlayExecLine(url))
+	require.Contains(t, out, "Notify=true")
+	require.Contains(t, out, "TimeoutStartSec=600")
+}
+
+func TestOverlayQuadletContainer_OmitsRepoCPEURLWhenEmpty(t *testing.T) {
+	t.Parallel()
+
+	src, err := os.ReadFile(filepath.Join(repoRoot(), "compliance", "virtualmachines", "roxagent", "quadlet", "roxagent.container"))
+	require.NoError(t, err)
+
+	const image = "quay.io/rhacs-eng/main:e2e-test"
+	for name, url := range map[string]string{
+		"empty":      "",
+		"whitespace": "  \t",
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			got, err := overlayQuadletContainer(src, image, url, "")
+			require.NoError(t, err)
+			out := string(got)
+			require.Contains(t, out, overlayExecLine(""))
+			require.NotContains(t, out, "--repo-cpe-url")
+			require.NotContains(t, out, "--repo-cpe-url ")
+		})
+	}
+}
+
+func TestOverlayQuadletContainer_RegistryAuthFile(t *testing.T) {
+	t.Parallel()
+
+	src, err := os.ReadFile(filepath.Join(repoRoot(), "compliance", "virtualmachines", "roxagent", "quadlet", "roxagent.container"))
+	require.NoError(t, err)
+
+	got, err := overlayQuadletContainer(src, "quay.io/rhacs-eng/main:e2e-test", "https://example.test/repository-to-cpe.json", guestPodmanAuthPath)
+	require.NoError(t, err)
+	out := string(got)
+	require.NotContains(t, out, "AuthFile=")
+	container, rest, found := strings.Cut(out, "[Service]")
+	require.True(t, found)
+	require.NotContains(t, container, "REGISTRY_AUTH_FILE")
+	require.Contains(t, rest, "Environment=REGISTRY_AUTH_FILE="+guestPodmanAuthPath)
+}
+
+func TestOverlayQuadletContainer_Errors(t *testing.T) {
+	t.Parallel()
+
+	src := []byte("[Container]\nImage=example:latest\nExec=serve\n")
+	tests := map[string]struct {
+		src          []byte
+		image        string
+		repo2cpeURL  string
+		errSubstring string
+	}{
+		"should reject empty image": {
+			src:          src,
+			repo2cpeURL:  "https://example.test/mapping.json",
+			errSubstring: "image is empty",
+		},
+		"should reject missing Image=": {
+			src:          []byte("[Container]\nExec=serve\n"),
+			image:        "example:latest",
+			repo2cpeURL:  "https://example.test/mapping.json",
+			errSubstring: "no Image= line",
+		},
+		"should reject missing Exec=": {
+			src:          []byte("[Container]\nImage=example:latest\n"),
+			image:        "example:latest",
+			repo2cpeURL:  "https://example.test/mapping.json",
+			errSubstring: "no Exec= line",
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			_, err := overlayQuadletContainer(tc.src, tc.image, tc.repo2cpeURL, "")
+			require.ErrorContains(t, err, tc.errSubstring)
+		})
+	}
+}
+
+func TestIsVsockUnavailableOutput(t *testing.T) {
+	t.Parallel()
+	tests := map[string]struct {
+		output string
+		want   bool
+	}{
+		"vsock no such device": {
+			output: "dial vsock host(2):818: connect: no such device",
+			want:   true,
+		},
+		"dev vsock missing": {
+			output: "open /dev/vsock: no such file or directory",
+			want:   true,
+		},
+		"listen vsock missing": {
+			output: "listening on VSOCK port 818: no such device",
+			want:   true,
+		},
+		"podman device not found": {
+			output: "error adding device /dev/vsock: not found",
+			want:   true,
+		},
+		"non-vsock no such device": {
+			output: "open /dev/does-not-exist: no such device",
+			want:   false,
+		},
+		"other vsock error is retryable": {
+			output: "dial vsock host(2):818: connection refused",
+			want:   false,
+		},
+		"unrelated enoent in journal dump": {
+			output: "listening on VSOCK port 818\nopen /etc/foo: no such file or directory",
+			want:   false,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tc.want, isVsockUnavailableOutput(tc.output))
+		})
+	}
+}
+
+const scpBannerTimeoutStderr = "Connection timed out during banner exchange\nConnection to UNKNOWN port 65535 timed out\nscp: Connection closed\nexit status 255"
+
+func TestWrapSCPError(t *testing.T) {
+	t.Parallel()
+	copyErr := errors.New("exit status 1")
+	tests := map[string]struct {
+		stderr        string
+		wantTransport bool
+		wantStalled   bool
+		wantAuth      bool
+	}{
+		"banner timeout is SSH transport": {
+			stderr:        scpBannerTimeoutStderr,
+			wantTransport: true,
+			wantStalled:   true,
+		},
+		"auth failure is terminal not transport": {
+			stderr:   "Permission denied (publickey).\r\n",
+			wantAuth: true,
+		},
+		"remote command failure is not SSH transport": {
+			stderr: "install.sh: no such file\nexit status 1",
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			err := wrapSCPError("/tmp/install.sh", "/guest/install.sh", tc.stderr, copyErr)
+			require.Error(t, err)
+			require.Equal(t, tc.wantTransport, errors.Is(err, errSSHTransport))
+			require.Equal(t, tc.wantStalled, errors.Is(err, ErrSSHConnectivityStalled))
+			require.Equal(t, tc.wantAuth, errors.Is(err, ErrSSHAuthenticationFailed))
+		})
+	}
+}
+
+func TestRetryCopyToGuest(t *testing.T) {
+	t.Parallel()
+	copyErr := errors.New("exit status 1")
+	tests := map[string]struct {
+		stderr           string
+		succeedOnAttempt int
+		wantAttempts     int
+		wantErr          bool
+		wantTransport    bool
+		wantStalled      bool
+		wantAuth         bool
+	}{
+		"retries banner timeout then succeeds": {
+			stderr:           scpBannerTimeoutStderr,
+			succeedOnAttempt: 3,
+			wantAttempts:     3,
+		},
+		"gives up on persistent banner timeout": {
+			stderr:        scpBannerTimeoutStderr,
+			wantAttempts:  3,
+			wantErr:       true,
+			wantTransport: true,
+			wantStalled:   true,
+		},
+		"does not retry terminal SSH auth": {
+			stderr:       "Permission denied (publickey).\r\n",
+			wantAttempts: 1,
+			wantErr:      true,
+			wantAuth:     true,
+		},
+		"does not retry remote command failure": {
+			stderr:       "install.sh: permission denied",
+			wantAttempts: 1,
+			wantErr:      true,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			attempts := 0
+			err := retryCopyToGuest(t.Context(), nil, "/tmp/install.sh", "/guest/install.sh", 3, time.Millisecond, func() (string, error) {
+				attempts++
+				if tc.succeedOnAttempt > 0 && attempts >= tc.succeedOnAttempt {
+					return "", nil
+				}
+				return tc.stderr, copyErr
+			})
+			require.Equal(t, tc.wantAttempts, attempts)
+			if !tc.wantErr {
+				require.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			require.Equal(t, tc.wantTransport, errors.Is(err, errSSHTransport))
+			require.Equal(t, tc.wantStalled, errors.Is(err, ErrSSHConnectivityStalled))
+			require.Equal(t, tc.wantAuth, errors.Is(err, ErrSSHAuthenticationFailed))
+		})
+	}
+}
diff --git a/tests/vmhelpers/roxagent_test.go b/tests/vmhelpers/roxagent_test.go
deleted file mode 100644
index f981429845384..0000000000000
--- a/tests/vmhelpers/roxagent_test.go
+++ /dev/null
@@ -1,44 +0,0 @@
-//go:build test && !test_e2e && !test_e2e_vm
-
-package vmhelpers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestIsVsockUnavailableOutput(t *testing.T) {
-	t.Parallel()
-	tests := map[string]struct {
-		output string
-		want   bool
-	}{
-		"vsock no such device": {
-			output: "dial vsock host(2):818: connect: no such device",
-			want:   true,
-		},
-		"dev vsock missing": {
-			output: "open /dev/vsock: no such file or directory",
-			want:   true,
-		},
-		"listen vsock missing": {
-			output: "listening on VSOCK port 818: no such device",
-			want:   true,
-		},
-		"non-vsock no such device": {
-			output: "open /dev/does-not-exist: no such device",
-			want:   false,
-		},
-		"other vsock error is retryable": {
-			output: "dial vsock host(2):818: connection refused",
-			want:   false,
-		},
-	}
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			require.Equal(t, tc.want, isVsockUnavailableOutput(tc.output))
-		})
-	}
-}
diff --git a/tests/vmhelpers/virtctl.go b/tests/vmhelpers/virtctl.go
index d4cac7ed1016e..5d0feaa89bbbf 100644
--- a/tests/vmhelpers/virtctl.go
+++ b/tests/vmhelpers/virtctl.go
@@ -96,7 +96,7 @@ func (v Virtctl) run(ctx context.Context, args []string) (stdout string, stderr
 		stdoutStr := outBuf.String()
 		stderrStr := errBuf.String()
 		v.Logf("remote command could not start: %s (result=%v)", summary, err)
-		return stdoutStr, stderrStr, err
+		return stdoutStr, stderrStr, fmt.Errorf("start virtctl: %w", err)
 	}
 	err = waitForCommandWithContext(ctx, cmd)
 
diff --git a/tests/vmhelpers/vm.go b/tests/vmhelpers/vm.go
index 4277f02073bf6..ed233f8b57d81 100644
--- a/tests/vmhelpers/vm.go
+++ b/tests/vmhelpers/vm.go
@@ -384,7 +384,7 @@ func virtualMachineStatusDetail(ctx context.Context, client dynamic.Interface, n
 		if apierrors.IsNotFound(err) {
 			return "virtual machine object not found", false, nil
 		}
-		return "", false, err
+		return "", false, fmt.Errorf("get virtual machine %s/%s: %w", namespace, name, err)
 	}
 	vm, err := vmFromUnstructured(obj)
 	if err != nil {
diff --git a/tests/vmhelpers/vm_scan_config.go b/tests/vmhelpers/vm_scan_config.go
index 82d09d7f9bc6f..1c2b544be6fdd 100644
--- a/tests/vmhelpers/vm_scan_config.go
+++ b/tests/vmhelpers/vm_scan_config.go
@@ -28,15 +28,15 @@ const (
 	defaultScanPollInterval = 10 * time.Second
 	defaultDeleteTimeout    = 5 * time.Minute
 	defaultGuestUser        = "cloud-user"
-
-	defaultRepo2CPEURL = "https://security.access.redhat.com/data/metrics/repository-to-cpe.json"
 )
 
 var (
 	vmScanNamespacePrefix = env.RegisterSetting("VM_SCAN_NAMESPACE_PREFIX", env.WithDefault("vm-scan-e2e"))
 	vmScanSkipCleanup     = env.RegisterBooleanSetting("VM_SCAN_SKIP_CLEANUP", false)
 
-	repo2CPEURL = env.RegisterSetting("ROXAGENT_REPO2CPE_URL", env.WithDefault(defaultRepo2CPEURL))
+	// repo2CPEURL is empty so Quadlet omits --repo-cpe-url and the agent
+	// stays Sensor-managed. Set ROXAGENT_REPO2CPE_URL to force URL-managed.
+	repo2CPEURL = env.RegisterSetting("ROXAGENT_REPO2CPE_URL")
 )
 
 // VMSpec describes a VM to provision: container-disk image and guest SSH user.
@@ -51,7 +51,7 @@ type VMScanConfig struct {
 	Images              []string // container-disk images (from VM_IMAGES, comma-separated)
 	GuestUsers          []string // per-image SSH users (from VM_USERS, comma-separated; shorter lists are padded with defaultGuestUser)
 	VirtctlPath         string
-	RoxagentBinaryPath  string
+	RoxagentImage       string
 	Repo2CPEURL         string
 	SSHPrivateKey       string // PEM-encoded private key content (not a file path)
 	SSHPublicKey        string // OpenSSH authorized_keys line (not a file path)
@@ -60,7 +60,8 @@ type VMScanConfig struct {
 	ScanPollInterval    time.Duration
 	DeleteTimeout       time.Duration
 	SkipCleanup         bool
-	ImagePullSecretPath string // Path to docker config JSON for private registries
+	ImagePullSecretPath string // Path to docker config JSON for the namespace imagePullSecret
+	PodmanAuthFilePath  string // Path to containers-auth JSON for guest Quadlet pulls
 }
 
 // LoadVMScanConfig reads the VM scanning configuration from the environment.
@@ -91,7 +92,7 @@ func LoadVMScanConfig() (*VMScanConfig, error) {
 	if cfg.VirtctlPath, err = DiscoverVirtctlPath(); err != nil {
 		return nil, err
 	}
-	if cfg.RoxagentBinaryPath, err = discoverRoxagentBinaryPath(); err != nil {
+	if cfg.RoxagentImage, err = discoverRoxagentImage(); err != nil {
 		return nil, err
 	}
 
@@ -123,6 +124,7 @@ func LoadVMScanConfig() (*VMScanConfig, error) {
 	cfg.DeleteTimeout = defaultDeleteTimeout
 	cfg.SkipCleanup = vmScanSkipCleanup.BooleanSetting()
 	cfg.ImagePullSecretPath = strings.TrimSpace(os.Getenv("VM_IMAGE_PULL_SECRET_PATH"))
+	cfg.PodmanAuthFilePath = strings.TrimSpace(os.Getenv("VM_PODMAN_AUTH_FILE"))
 
 	return cfg, nil
 }
@@ -164,18 +166,36 @@ func DiscoverVirtctlPath() (string, error) {
 	return p, nil
 }
 
-// discoverRoxagentBinaryPath returns the ROXAGENT_BINARY_PATH env var if set,
-// otherwise probes the standard build output path relative to the repository root.
-func discoverRoxagentBinaryPath() (string, error) {
-	if v := strings.TrimSpace(os.Getenv("ROXAGENT_BINARY_PATH")); v != "" {
+// discoverRoxagentImage returns ROXAGENT_IMAGE, else MAIN_IMAGE, else
+// <repo>:MAIN_IMAGE_TAG. Repo is MAIN_IMAGE_REPO, else DEFAULT_IMAGE_REGISTRY/main,
+// else the branding default, so CI can pass only MAIN_IMAGE_TAG.
+func discoverRoxagentImage() (string, error) {
+	if v := strings.TrimSpace(os.Getenv("ROXAGENT_IMAGE")); v != "" {
+		return v, nil
+	}
+	if v := strings.TrimSpace(os.Getenv("MAIN_IMAGE")); v != "" {
 		return v, nil
 	}
-	root := repoRoot()
-	candidate := filepath.Join(root, "bin", "linux_amd64", "roxagent")
-	if _, err := os.Stat(candidate); err == nil {
-		return candidate, nil
+	tag := strings.TrimSpace(os.Getenv("MAIN_IMAGE_TAG"))
+	if tag == "" {
+		return "", errors.New("ROXAGENT_IMAGE or MAIN_IMAGE is required (or MAIN_IMAGE_TAG)")
+	}
+	return defaultMainImageRepo() + ":" + tag, nil
+}
+
+// defaultMainImageRepo matches make/env.mk: RHACS_BRANDING uses quay.io/rhacs-eng,
+// otherwise quay.io/stackrox-io.
+func defaultMainImageRepo() string {
+	if v := strings.TrimSpace(os.Getenv("MAIN_IMAGE_REPO")); v != "" {
+		return v
+	}
+	if v := strings.TrimSpace(os.Getenv("DEFAULT_IMAGE_REGISTRY")); v != "" {
+		return v + "/main"
+	}
+	if os.Getenv("ROX_PRODUCT_BRANDING") == "RHACS_BRANDING" {
+		return "quay.io/rhacs-eng/main"
 	}
-	return "", fmt.Errorf("ROXAGENT_BINARY_PATH not set and %s does not exist; run 'make roxagent_linux-amd64'", candidate)
+	return "quay.io/stackrox-io/main"
 }
 
 // repoRoot returns the repository root by walking up from this source file.
diff --git a/tests/vmhelpers/vm_scan_config_test.go b/tests/vmhelpers/vm_scan_config_test.go
index 2aac47fc226b6..ede5eebbc8e54 100644
--- a/tests/vmhelpers/vm_scan_config_test.go
+++ b/tests/vmhelpers/vm_scan_config_test.go
@@ -32,16 +32,20 @@ func TestLoadVMScanConfig_Defaults(t *testing.T) {
 	t.Setenv("VM_IMAGES", "registry.example.com/rhel9:latest,registry.example.com/rhel10:latest")
 	t.Setenv("VM_USERS", "")
 	t.Setenv("VIRTCTL_PATH", mustFindExecutable(t, "true"))
-	t.Setenv("ROXAGENT_BINARY_PATH", "/bin/true")
+	t.Setenv("ROXAGENT_IMAGE", "")
+	t.Setenv("MAIN_IMAGE", "quay.io/example/main:test")
 	t.Setenv("VM_SCAN_NAMESPACE_PREFIX", "")
+	t.Setenv("ROXAGENT_REPO2CPE_URL", "")
 	cfg, err := LoadVMScanConfig()
 	require.NoError(t, err)
 	require.Equal(t, []string{"registry.example.com/rhel9:latest", "registry.example.com/rhel10:latest"}, cfg.Images)
 	require.Empty(t, cfg.GuestUsers, "no padding; VMSpecs() defaults per-image")
+	require.Empty(t, cfg.Repo2CPEURL, "empty URL selects Sensor-managed mapping updater")
 	require.Equal(t, "vm-scan-e2e", cfg.NamespacePrefix)
 	require.Equal(t, 20*time.Minute, cfg.ScanTimeout)
 	require.Equal(t, 10*time.Second, cfg.ScanPollInterval)
 	require.Equal(t, 5*time.Minute, cfg.DeleteTimeout)
+	require.Equal(t, "quay.io/example/main:test", cfg.RoxagentImage)
 
 	specs := cfg.VMSpecs()
 	require.Len(t, specs, 2)
@@ -49,11 +53,23 @@ func TestLoadVMScanConfig_Defaults(t *testing.T) {
 	require.Equal(t, "vm-1", specs[1].Name)
 }
 
+func TestLoadVMScanConfig_AuthPaths(t *testing.T) {
+	t.Setenv("VM_IMAGES", "registry.example.com/rhel9:latest")
+	t.Setenv("VIRTCTL_PATH", mustFindExecutable(t, "true"))
+	t.Setenv("MAIN_IMAGE", "quay.io/example/main:test")
+	t.Setenv("VM_IMAGE_PULL_SECRET_PATH", "/tmp/k8s-pull-secret.json")
+	t.Setenv("VM_PODMAN_AUTH_FILE", "/tmp/podman-auth.json")
+	cfg, err := LoadVMScanConfig()
+	require.NoError(t, err)
+	require.Equal(t, "/tmp/k8s-pull-secret.json", cfg.ImagePullSecretPath)
+	require.Equal(t, "/tmp/podman-auth.json", cfg.PodmanAuthFilePath)
+}
+
 func TestLoadVMScanConfig_PartialUsers(t *testing.T) {
 	t.Setenv("VM_IMAGES", "img-a,img-b,img-c")
 	t.Setenv("VM_USERS", "alice")
 	t.Setenv("VIRTCTL_PATH", mustFindExecutable(t, "true"))
-	t.Setenv("ROXAGENT_BINARY_PATH", "/bin/true")
+	t.Setenv("MAIN_IMAGE", "quay.io/example/main:test")
 	cfg, err := LoadVMScanConfig()
 	require.NoError(t, err)
 	require.Equal(t, []string{"alice"}, cfg.GuestUsers, "only explicit users; VMSpecs() pads with default")
@@ -62,7 +78,7 @@ func TestLoadVMScanConfig_PartialUsers(t *testing.T) {
 func TestLoadVMScanConfig_InvalidSSHKeyContent(t *testing.T) {
 	t.Setenv("VM_IMAGES", "registry.example.com/rhel9:latest")
 	t.Setenv("VIRTCTL_PATH", mustFindExecutable(t, "true"))
-	t.Setenv("ROXAGENT_BINARY_PATH", "/bin/true")
+	t.Setenv("MAIN_IMAGE", "quay.io/example/main:test")
 
 	tests := map[string]string{
 		"should reject a file path":         "/home/user/.ssh/id_ed25519",
@@ -116,6 +132,70 @@ func TestGenerateEphemeralSSHKeypair(t *testing.T) {
 	require.Contains(t, pub, "ssh-ed25519 ")                         // notsecret
 }
 
+func TestDiscoverRoxagentImage(t *testing.T) {
+	tests := map[string]struct {
+		roxagentImage string
+		mainImage     string
+		repo          string
+		tag           string
+		branding      string
+		registry      string
+		want          string
+		errSubstring  string
+	}{
+		"should prefer ROXAGENT_IMAGE over MAIN_IMAGE": {
+			roxagentImage: "quay.io/custom/main:dev",
+			mainImage:     "quay.io/example/main:ignored",
+			want:          "quay.io/custom/main:dev",
+		},
+		"should use MAIN_IMAGE": {
+			mainImage: "quay.io/example/main:test",
+			want:      "quay.io/example/main:test",
+		},
+		"should synthesize MAIN_IMAGE_REPO and MAIN_IMAGE_TAG": {
+			repo: "quay.io/rhacs-eng/main",
+			tag:  "4.12.x-123",
+			want: "quay.io/rhacs-eng/main:4.12.x-123",
+		},
+		"should default rhacs repo from MAIN_IMAGE_TAG": {
+			tag:      "4.12.x-784-g58e138e64c",
+			branding: "RHACS_BRANDING",
+			want:     "quay.io/rhacs-eng/main:4.12.x-784-g58e138e64c",
+		},
+		"should default opensource repo from MAIN_IMAGE_TAG": {
+			tag:  "4.12.x-1",
+			want: "quay.io/stackrox-io/main:4.12.x-1",
+		},
+		"should prefer DEFAULT_IMAGE_REGISTRY over branding": {
+			tag:      "4.12.x-1",
+			branding: "RHACS_BRANDING",
+			registry: "quay.io/example",
+			want:     "quay.io/example/main:4.12.x-1",
+		},
+		"should reject missing image configuration": {
+			errSubstring: "ROXAGENT_IMAGE or MAIN_IMAGE",
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv("ROXAGENT_IMAGE", tc.roxagentImage)
+			t.Setenv("MAIN_IMAGE", tc.mainImage)
+			t.Setenv("MAIN_IMAGE_REPO", tc.repo)
+			t.Setenv("MAIN_IMAGE_TAG", tc.tag)
+			t.Setenv("ROX_PRODUCT_BRANDING", tc.branding)
+			t.Setenv("DEFAULT_IMAGE_REGISTRY", tc.registry)
+			got, err := discoverRoxagentImage()
+			if tc.errSubstring != "" {
+				require.ErrorContains(t, err, tc.errSubstring)
+				require.Empty(t, got)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
 func TestRepoRootFrom_VMHelpersFile(t *testing.T) {
 	t.Parallel()
 
diff --git a/tests/vmhelpers/wait.go b/tests/vmhelpers/wait.go
index 820b1fa32f2fe..2d5739418f3cb 100644
--- a/tests/vmhelpers/wait.go
+++ b/tests/vmhelpers/wait.go
@@ -93,10 +93,31 @@ func validateWaitOptions(desc string, opts WaitOptions) error {
 	return nil
 }
 
+// isTransientPollError reports gRPC failures that should not abort a Central wait.
+// Unavailable/DeadlineExceeded/ResourceExhausted/Aborted are typical of a busy
+// Central or a short network blip; Unimplemented and InvalidArgument are not.
+func isTransientPollError(err error) bool {
+	if err == nil || IsAuthenticationExpired(err) {
+		return false
+	}
+	st, ok := status.FromError(err)
+	if !ok {
+		return false
+	}
+	switch st.Code() {
+	case codes.Unavailable, codes.DeadlineExceeded, codes.ResourceExhausted, codes.Aborted:
+		return true
+	default:
+		return false
+	}
+}
+
 // pollUntil is the poll loop for Central gRPC scan-lifecycle waits.
 // Use this instead of k8s wait.PollUntilContextCancel when you need:
 //   - auth-expiry fail-fast: aborts immediately on expired kubeconfig tokens
 //     instead of burning the full timeout,
+//   - retry of transient gRPC codes until Timeout (v2 scan waits issue more
+//     RPCs per poll than the legacy GetVirtualMachine path),
 //   - structured diagnostics: each poll returns a detail string so timeout
 //     errors report exactly which stage was stuck.
 //
@@ -121,15 +142,21 @@ func pollUntil(ctx context.Context, opts WaitOptions, desc string, poll func(ctx
 			if IsAuthenticationExpired(err) {
 				return fmt.Errorf("vmhelpers: %s: %w: %v", desc, ErrAuthenticationExpired, err)
 			}
-			return fmt.Errorf("vmhelpers: %s: %w", desc, err)
-		}
-		if done {
+			if !isTransientPollError(err) {
+				return fmt.Errorf("vmhelpers: %s: %w", desc, err)
+			}
+			if lastDetail == "" {
+				lastDetail = err.Error()
+			}
+			if opts.Logf != nil {
+				opts.Logf("poll %s: waiting (transient: %v)", desc, err)
+			}
+		} else if done {
 			if opts.Logf != nil && detail != "" {
 				opts.Logf("poll %s: done (%s)", desc, detail)
 			}
 			return nil
-		}
-		if opts.Logf != nil && detail != "" {
+		} else if opts.Logf != nil && detail != "" {
 			opts.Logf("poll %s: waiting (%s)", desc, detail)
 		}
 		if time.Now().After(deadline) {
diff --git a/tests/vmhelpers/wait_test.go b/tests/vmhelpers/wait_test.go
index f56dc9ff86a74..eb3f22338914c 100644
--- a/tests/vmhelpers/wait_test.go
+++ b/tests/vmhelpers/wait_test.go
@@ -41,6 +41,38 @@ func TestPollUntil_TimesOutWithDetail(t *testing.T) {
 	require.Contains(t, err.Error(), "still waiting")
 }
 
+func TestPollUntil_RetriesTransientThenSucceeds(t *testing.T) {
+	ctx := t.Context()
+	var polls int
+	err := pollUntil(ctx, WaitOptions{
+		Timeout:      400 * time.Millisecond,
+		PollInterval: 5 * time.Millisecond,
+	}, "transient-test", func(context.Context) (bool, string, error) {
+		polls++
+		if polls == 1 {
+			return false, "", status.Error(codes.Unavailable, "central busy")
+		}
+		return true, "ok", nil
+	})
+	require.NoError(t, err)
+	require.Equal(t, 2, polls)
+}
+
+func TestPollUntil_UnimplementedIsTerminal(t *testing.T) {
+	ctx := t.Context()
+	var polls int
+	err := pollUntil(ctx, WaitOptions{
+		Timeout:      400 * time.Millisecond,
+		PollInterval: 5 * time.Millisecond,
+	}, "unimplemented-test", func(context.Context) (bool, string, error) {
+		polls++
+		return false, "", status.Error(codes.Unimplemented, "not registered")
+	})
+	require.Error(t, err)
+	require.Equal(t, 1, polls)
+	require.Contains(t, err.Error(), "Unimplemented")
+}
+
 func TestPollUntil_RejectsInvalidOptions(t *testing.T) {
 	ctx := context.Background()
 
@@ -66,6 +98,7 @@ func TestIsAuthenticationExpired(t *testing.T) {
 		"wrapped ErrAuthenticationExpired": {err: fmt.Errorf("op: %w", ErrAuthenticationExpired), want: true},
 		"unrelated error":                  {err: errors.New("connection refused"), want: false},
 		"gRPC unavailable (not auth)":      {err: status.Error(codes.Unavailable, "service down"), want: false},
+		"gRPC Unimplemented":               {err: status.Error(codes.Unimplemented, "not registered"), want: false},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
diff --git a/tools/admission-control/README.md b/tools/admission-control/README.md
index 871afa557a611..9ad56a276561e 100644
--- a/tools/admission-control/README.md
+++ b/tools/admission-control/README.md
@@ -7,7 +7,8 @@ Central around image cache and reprocessor ("reassess all") workflows.
 
 - Kubernetes/OpenShift cluster with StackRox deployed
 - `admissionControl.enforcement` enabled in the SecuredCluster CR
-- `spec.monitoring.exposeEndpoint: Enabled` in the SecuredCluster CR
+- `spec.monitoring.exposeEndpoint: Enabled` on **both** the SecuredCluster and Central CRs
+  (AC metrics for all modes; Central metrics required for `prescan-slow-path`)
 
 ## Common Environment Variables
 
@@ -49,6 +50,58 @@ All scripts follow the same pattern:
 3. Run again, save output
 4. `diff` the two outputs (or use `go tool pprof -diff_base` for profiles)
 
+### Example: prescan-slow-path comparison
+
+This workflow proves whether Central skips Scanner `GetScan` for tag-only
+admission after a Central pre-scan (`ScanImageInternalForAdmission`).
+
+**Policy (required):** enable **90-Day Image Age**, Deploy lifecycle, **Fail**
+on admission. Spec-only policies (Privileged Container, Latest tag) will not
+fetch images and the run is invalid.
+
+**Why these flags:** `UNIQUE_PCT=100` and `PARALLEL=1` make every review a
+Central fetch of a distinct pre-scanned tag. Cache hits and coalescing no
+longer move the averages. Failed prescans are dropped from the burst so the
+PR cannot pick up extra Scanner calls for uncached tags.
+
+Scrape happens **after** prescan so `scan_duration_count` from
+`POST /v1/images/scan` is not counted in the burst delta.
+
+```bash
+# 1. Deploy master image. Enforce 90-Day Image Age (Fail on admission).
+ROX_PASSWORD=<pw> ROX_CENTRAL_ADDRESS=<host:port> \
+  BURST_SIZE=20 UNIQUE_PCT=100 PARALLEL=1 \
+  ./tools/admission-control/burst-test.sh prescan-slow-path \
+  | tee /tmp/prescan-master.txt
+
+# 2. Redeploy Central + Sensor with PR branch image
+#    (AC pods will be restarted by the script itself).
+#    Re-export ROX_PASSWORD if the redeploy minted a new one.
+
+# 3. Run again on PR branch
+ROX_PASSWORD=<pw> ROX_CENTRAL_ADDRESS=<host:port> \
+  BURST_SIZE=20 UNIQUE_PCT=100 PARALLEL=1 \
+  ./tools/admission-control/burst-test.sh prescan-slow-path \
+  | tee /tmp/prescan-pr.txt
+
+# 4. Compare
+diff -y /tmp/prescan-master.txt /tmp/prescan-pr.txt
+```
+
+Pass bar (both runs must have `image_fetch_total` ≈ unique images):
+
+| Metric | Master | PR branch |
+|--------|--------|-----------|
+| `scan_duration_count` (Central) | ≈ unique images | **~0** |
+| `image_fetch_duration (avg)` | metadata + GetScan | metadata only (lower) |
+| `image_fetch_total` | ≈ unique | ≈ unique |
+| `review_duration_seconds (avg)` | ignore | ignore (diluted by hits) |
+
+`scan_duration_count` is the Scanner-trip proof. Fetch duration is supporting
+latency. Do not treat `review_duration_seconds` as a Scanner proxy: after
+prescan, Scanner's index is warm so GetScan can be cheap, and review avg mixes
+in cache hits.
+
 ---
 
 ### `burst-test.sh`
@@ -60,6 +113,7 @@ Run with `-h` for all options.
 |------|---------------|-------------------|
 | `fast-path` | Spec-only evaluation (no image fetching) | Privileged Container, Latest tag |
 | `slow-path` | Image coalescing + caching (enrichment) | Any enrichment-required (e.g. Image Age) |
+| `prescan-slow-path` | Scan reuse for pre-scanned tag-only images | Any enrichment-required (e.g. Image Age) |
 
 Slow-path runs two phases automatically: **cold cache** (pods restarted) then
 **warm cache** (immediate re-burst).
@@ -78,6 +132,31 @@ IMAGES_FILE=/tmp/my-images.txt BURST_SIZE=500 UNIQUE_PCT=50 ./burst-test.sh slow
 BURST_SIZE=1000 UNIQUE_PCT=60 ./burst-test.sh slow-path --no-dry-run
 ```
 
+**Prescan-slow-path** pre-scans unique images via Central's `POST /v1/images/scan`
+API (warming the DB), drops failures, restarts AC (not Scanner), then bursts
+**one tag-only deployment per successful prescan**. Central `scan_duration_count`
+during the burst is the Scanner-trip proof; AC `image_fetch_duration_seconds`
+is the latency proof.
+
+```bash
+# Prescan + one-fetch-per-unique-image burst
+ROX_PASSWORD=<pw> ROX_CENTRAL_ADDRESS=<host:port> \
+  BURST_SIZE=20 UNIQUE_PCT=100 PARALLEL=1 PRESCAN_PARALLEL=5 \
+  ./tools/admission-control/burst-test.sh prescan-slow-path
+```
+
+Requires **90-Day Image Age** (or another enrichment-required policy) enabled
+with **Fail on admission**. `UNIQUE_PCT` is forced to 100.
+
+Additional environment variables for `prescan-slow-path`:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ROX_CENTRAL_ADDRESS` | *(required)* | Central host:port |
+| `ROX_PASSWORD` | *(required)* | Central admin password |
+| `ROX_ADMIN_USER` | `admin` | Central admin username |
+| `PRESCAN_PARALLEL` | `5` | Max concurrent prescan API calls |
+
 ---
 
 ### `bench-reassess.sh`
diff --git a/tools/admission-control/bench-reassess.sh b/tools/admission-control/bench-reassess.sh
index 4e7459b310007..ca59edb792147 100755
--- a/tools/admission-control/bench-reassess.sh
+++ b/tools/admission-control/bench-reassess.sh
@@ -79,7 +79,7 @@ read_metric() {
 
 # metric_delta <phase_a> <phase_b> <component-short> <metric> [labels]
 metric_delta() {
-    echo "$(read_metric "$2" "$3" "$4" "${5:-}") - $(read_metric "$1" "$3" "$4" "${5:-}")" | bc
+    delta "$(read_metric "$1" "$3" "$4" "${5:-}")" "$(read_metric "$2" "$3" "$4" "${5:-}")"
 }
 
 # trigger_and_wait_for_reprocessor is now in lib.sh
diff --git a/tools/admission-control/burst-test.sh b/tools/admission-control/burst-test.sh
index 5497f4dd6a175..4fbd75b184754 100755
--- a/tools/admission-control/burst-test.sh
+++ b/tools/admission-control/burst-test.sh
@@ -5,12 +5,18 @@
 # a live cluster, scrapes admission controller Prometheus metrics before and
 # after, and reports deltas.
 #
-# Two modes:
-#   fast-path  - Tests spec-only policy evaluation (no image fetching).
-#                Requires: Privileged Container + Latest tag policies enforced.
-#   slow-path  - Tests image coalescing and caching in the enrichment path.
-#                Runs two phases (cold cache, then warm cache).
-#                Requires: at least one enrichment-required policy (e.g. Image Age).
+# Three modes:
+#   fast-path          - Tests spec-only policy evaluation (no image fetching).
+#                        Requires: Privileged Container + Latest tag policies enforced.
+#   slow-path          - Tests image coalescing and caching in the enrichment path.
+#                        Runs two phases (cold cache, then warm cache).
+#                        Requires: at least one enrichment-required policy (e.g. Image Age).
+#   prescan-slow-path  - Pre-scans unique images via Central API, then bursts
+#                        one tag-only deployment per pre-scanned image.
+#                        Proves Scanner skip via Central scan_duration_count
+#                        and fetch latency via AC image_fetch_duration_seconds.
+#                        Run on master vs PR branch to compare.
+#                        Requires: ROX_CENTRAL_ADDRESS, ROX_PASSWORD, enrichment policy.
 #
 # See README.md for full prerequisites and cross-branch comparison workflow.
 set -euo pipefail
@@ -37,6 +43,8 @@ export DRY_RUN
 : "${METRICS_PORT:=9090}"
 : "${LOCAL_PORT:=9090}"
 : "${PARALLEL:=50}"
+: "${PRESCAN_PARALLEL:=5}"
+: "${ROX_ADMIN_USER:=admin}"
 
 WORK_DIR=$(mktemp -d)
 
@@ -48,11 +56,18 @@ usage() {
 Usage: ./burst-test.sh <mode> [options]
 
 Modes:
-  fast-path    Test spec-only policy evaluation (no image fetching).
-               Requires: Privileged Container + Latest tag policies enforced.
-  slow-path    Test image coalescing and caching in the enrichment path.
-               Runs two phases: cold cache (pods restarted) then warm cache.
-               Requires: at least one enrichment-required policy (e.g. Image Age).
+  fast-path           Test spec-only policy evaluation (no image fetching).
+                      Requires: Privileged Container + Latest tag policies enforced.
+  slow-path           Test image coalescing and caching in the enrichment path.
+                      Runs two phases: cold cache (pods restarted) then warm cache.
+                      Requires: at least one enrichment-required policy (e.g. Image Age).
+  prescan-slow-path   Pre-scan unique images via Central API, restart AC, then
+                      burst one tag-only deployment per pre-scanned image.
+                      PRIMARY: Central scan_duration_count (Scanner GetScan calls).
+                      SECONDARY: AC image_fetch_duration_seconds (per-fetch latency).
+                      Forces UNIQUE_PCT=100. Use PARALLEL=1 for a clean comparison.
+                      Requires: ROX_CENTRAL_ADDRESS, ROX_PASSWORD, enrichment policy
+                      (e.g. 90-Day Image Age with Fail on admission).
 
 Options:
   --no-dry-run Apply deployments for real (replicas=0). Useful for creating
@@ -60,18 +75,23 @@ Options:
   -h, --help   Show this help message.
 
 Environment variables:
-  BURST_SIZE       Number of deployments to create           (default: 500)
-  VIOLATION_PCT    % that violate policy (fast-path only)    (default: 50)
-  UNIQUE_PCT       % of BURST_SIZE used as distinct images   (default: 25)
-                   Unique count = BURST_SIZE * UNIQUE_PCT / 100.
-  IMAGES_FILE      Path to a file with one image per line.
-                   Overrides automatic pool generation.
-  NAMESPACE        Namespace for test deployments            (default: burst-test)
-  IMAGES           Comma-separated images (fast-path only)   (default: quay.io/centos/centos:7,...)
-  ROX_NAMESPACE    StackRox namespace                        (default: stackrox)
-  METRICS_PORT     Admission controller metrics port         (default: 9090)
-  LOCAL_PORT       Local port for kubectl port-forward       (default: 9090)
-  PARALLEL         Max concurrent kubectl creates            (default: 50)
+  BURST_SIZE         Number of deployments to create           (default: 500)
+  VIOLATION_PCT      % that violate policy (fast-path only)    (default: 50)
+  UNIQUE_PCT         % of BURST_SIZE used as distinct images   (default: 25)
+                     Unique count = BURST_SIZE * UNIQUE_PCT / 100.
+  IMAGES_FILE        Path to a file with one image per line.
+                     Overrides automatic pool generation.
+  NAMESPACE          Namespace for test deployments            (default: burst-test)
+  IMAGES             Comma-separated images (fast-path only)   (default: quay.io/centos/centos:7,...)
+  ROX_NAMESPACE      StackRox namespace                        (default: stackrox)
+  METRICS_PORT       Admission controller metrics port         (default: 9090)
+  LOCAL_PORT         Local port for kubectl port-forward       (default: 9090)
+  PARALLEL           Max concurrent kubectl creates            (default: 50;
+                     prescan-slow-path: use 1)
+  PRESCAN_PARALLEL   Max concurrent prescan API calls          (default: 5)
+  ROX_CENTRAL_ADDRESS  Central host:port (prescan-slow-path)
+  ROX_PASSWORD         Central admin password (prescan-slow-path)
+  ROX_ADMIN_USER       Central admin username                  (default: admin)
 
 fast-path mode:
   Violating deployments use privileged: true + :latest tags.
@@ -85,6 +105,17 @@ slow-path mode:
   Phase 2 reuses warm caches from phase 1.
   Reports coalesce ratio, cache hit rate, and fetch counts.
   With --no-dry-run, deployments are created with replicas=0.
+
+prescan-slow-path mode:
+  Forces UNIQUE_PCT=100 (one unique tag-only image per review). Failed
+  prescans are dropped so the burst only uses images stored in Central.
+  Restarts AC (not Scanner), then scrapes Central AND AC metrics AFTER
+  prescan and BEFORE the burst so prescan GetScan calls are excluded.
+  PRIMARY proof: rox_central_scan_duration_count delta (~unique on master,
+  ~0 on PR). SECONDARY: AC image_fetch_duration_seconds avg.
+  Do not use review_duration_seconds — cache hits dilute it.
+  Recommended: BURST_SIZE=20 PARALLEL=1
+  Requires 90-Day Image Age (or similar) with Fail on admission.
 EOF
     exit 0
 }
@@ -93,17 +124,30 @@ if [[ "${MODE}" == "-h" || "${MODE}" == "--help" ]]; then
     usage
 fi
 
-if [[ "${MODE}" != "fast-path" && "${MODE}" != "slow-path" ]]; then
-    echo "ERROR: mode must be 'fast-path' or 'slow-path'" >&2
+if [[ "${MODE}" != "fast-path" && "${MODE}" != "slow-path" && "${MODE}" != "prescan-slow-path" ]]; then
+    echo "ERROR: mode must be 'fast-path', 'slow-path', or 'prescan-slow-path'" >&2
     echo "Run with -h for usage." >&2
     exit 1
 fi
 
+if [[ "${MODE}" == "prescan-slow-path" ]]; then
+    : "${ROX_CENTRAL_ADDRESS:?ROX_CENTRAL_ADDRESS must be set for prescan-slow-path}"
+    : "${ROX_PASSWORD:?ROX_PASSWORD must be set for prescan-slow-path}"
+    if [[ "$UNIQUE_PCT" != "100" ]]; then
+        echo "NOTE: prescan-slow-path forces UNIQUE_PCT=100 (one unique image per review)."
+        UNIQUE_PCT=100
+    fi
+    if [[ "$PARALLEL" -gt 1 ]]; then
+        echo "WARN: PARALLEL=${PARALLEL}. Use PARALLEL=1 so fetch/hit mix does not move averages."
+    fi
+fi
+
 for cmd in kubectl curl bc awk; do
     command -v "$cmd" &>/dev/null || { echo "ERROR: '$cmd' required but not found" >&2; exit 1; }
 done
 
 readonly METRICS_NETPOL="admission-control-metrics-allow"
+readonly CENTRAL_METRICS_NETPOL="central-metrics-allow"
 trap cleanup EXIT
 
 # ---------------------------------------------------------------------------
@@ -114,6 +158,8 @@ cleanup() {
     kill_port_forwards
     kubectl -n "$ROX_NAMESPACE" delete networkpolicy "$METRICS_NETPOL" \
         --ignore-not-found &>/dev/null || true
+    kubectl -n "$ROX_NAMESPACE" delete networkpolicy "$CENTRAL_METRICS_NETPOL" \
+        --ignore-not-found &>/dev/null || true
     kubectl delete namespace "$NAMESPACE" --ignore-not-found &>/dev/null || true
     [[ -n "${WORK_DIR:-}" ]] && rm -rf "$WORK_DIR"
 }
@@ -122,6 +168,10 @@ allow_metrics_ingress() {
     allow_metrics_netpol "$METRICS_NETPOL" "admission-control"
 }
 
+allow_central_metrics_ingress() {
+    allow_metrics_netpol "$CENTRAL_METRICS_NETPOL" "central"
+}
+
 restart_admission_control() {
     echo "Restarting admission-control pods..."
     kubectl -n "$ROX_NAMESPACE" rollout restart deployment/admission-control >/dev/null
@@ -149,6 +199,18 @@ scrape_metrics() {
     scrape_component "admission-control" "$LOCAL_PORT" "$1"
 }
 
+scrape_central_metrics() {
+    scrape_component "central" "$LOCAL_PORT" "$1"
+}
+
+# scrape_prescan_pair <ac-outfile> <central-outfile>
+#   Sequential scrapes (same LOCAL_PORT). Must run AFTER prescan so Central
+#   scan_duration from POST /v1/images/scan is in the baseline.
+scrape_prescan_pair() {
+    scrape_metrics "$1"
+    scrape_central_metrics "$2"
+}
+
 # Backward-compatible wrapper used by reports.
 extract_counter() { extract "$@"; }
 
@@ -344,6 +406,101 @@ EOF
     echo ""
 }
 
+report_prescan_slow_path() {
+    local ac_before="$1" ac_after="$2" central_before="$3" central_after="$4"
+    local prescan_ok="$5" prescan_fail="$6"
+    compute_common_deltas "$ac_before" "$ac_after"
+
+    local review_total
+    review_total=$(echo "${DENIED_D} + ${ALLOWED_D}" | bc)
+
+    local scan_count_d scan_sum_d scan_avg_ms
+    scan_count_d=$(delta \
+        "$(extract "$central_before" "rox_central_scan_duration_count")" \
+        "$(extract "$central_after"  "rox_central_scan_duration_count")")
+    scan_sum_d=$(delta \
+        "$(extract "$central_before" "rox_central_scan_duration_sum")" \
+        "$(extract "$central_after"  "rox_central_scan_duration_sum")")
+    scan_avg_ms=$(avg_or_na "$scan_sum_d" "$scan_count_d")
+
+    local fetch_dur_count_d fetch_dur_sum_d fetch_dur_avg
+    fetch_dur_count_d=$(delta \
+        "$(extract "$ac_before" "rox_admission_control_image_fetch_duration_seconds_count")" \
+        "$(extract "$ac_after"  "rox_admission_control_image_fetch_duration_seconds_count")")
+    fetch_dur_sum_d=$(delta \
+        "$(extract "$ac_before" "rox_admission_control_image_fetch_duration_seconds_sum")" \
+        "$(extract "$ac_after"  "rox_admission_control_image_fetch_duration_seconds_sum")")
+    fetch_dur_avg=$(avg_or_na "$fetch_dur_sum_d" "$fetch_dur_count_d")
+
+    cat <<EOF
+
+================================================
+  PRESCAN SLOW-PATH BURST TEST REPORT
+================================================
+  Burst size:        ${BURST_SIZE}
+  Unique images:     ${UNIQUE_COUNT} (of ${POOL_SIZE} in pool)
+  Pre-scanned OK:    ${prescan_ok}
+  Pre-scanned FAIL:  ${prescan_fail}
+  Total img refs:    ${TOTAL_IMAGE_REFS}
+================================================
+
+EOF
+    printf "  %-42s %s\n" "Metric" "Delta"
+    printf "  %-42s %s\n" "------" "-----"
+    printf "  %-42s %s\n" "scan_duration_count (Central)"    "$scan_count_d"
+    printf "  %-42s %s\n" "scan_duration avg (Central, ms)"  "${scan_avg_ms}"
+    printf "  %-42s %s\n" "image_fetch_total"                "$FETCH_D"
+    printf "  %-42s %s\n" "image_fetch_duration (avg, s)"    "$fetch_dur_avg"
+    printf "  %-42s %s\n" "image_fetches_per_review (avg)"   "$FPR_AVG"
+    printf "  %-42s %s\n" "policyeval_review_total{denied}"  "$DENIED_D"
+    printf "  %-42s %s\n" "policyeval_review_total{allowed}" "$ALLOWED_D"
+    printf "  %-42s %s\n" "image_cache_operations{hit}"      "$HIT_D"
+    printf "  %-42s %s\n" "image_cache_operations{miss}"     "$MISS_D"
+    printf "  %-42s %s\n" "image_cache_operations{skip}"     "$SKIP_D"
+    printf "  %-42s %s\n" "reviews completed"                "$review_total"
+    printf "  %-42s %s\n" "review_duration_seconds (avg)"    "${DUR_AVG}s"
+    echo ""
+
+    cat <<EOF
+  PRIMARY:  scan_duration_count = ${scan_count_d}
+            Master: ~unique images (Scanner GetScan called).
+            PR:     ~0 (existing Central scan reused).
+  SECONDARY: image_fetch_duration avg = ${fetch_dur_avg}s
+            Per GetImage/Central RPC (cache hits excluded).
+            PR should be lower (metadata only vs metadata+GetScan).
+  Do not use review_duration_seconds (${DUR_AVG}s) as proof — it averages
+  in cache hits and is not a Scanner proxy.
+
+EOF
+
+    if awk -v n="$scan_count_d" 'BEGIN{exit !(n+0 > 0)}'; then
+        echo "  Scanner GetScan was invoked ${scan_count_d} times during the burst."
+        echo "  Expected on master; unexpected on PR if prescan succeeded."
+    else
+        echo "  Scanner GetScan was NOT invoked during the burst."
+        echo "  Expected on PR; unexpected on master."
+    fi
+    echo ""
+
+    local pass=true
+    if [[ "$prescan_fail" -gt 0 ]]; then
+        echo "  WARN: ${prescan_fail} images failed to pre-scan and were dropped from the burst."
+    fi
+    if [[ "$FETCH_D" -eq 0 ]]; then
+        echo "  FAIL: image_fetch_total delta is 0. Enforce an enrichment-required policy"
+        echo "        (90-Day Image Age, Fail on admission) and retry."
+        pass=false
+    fi
+    if [[ "$review_total" -ne "$BURST_SIZE" ]]; then
+        echo "  FAIL: expected ${BURST_SIZE} reviews, got ${review_total}"
+        pass=false
+    fi
+    if $pass; then
+        echo "  PASS: ${review_total} reviews, ${FETCH_D} fetches, scan_duration_count=${scan_count_d}"
+    fi
+    echo ""
+}
+
 # ---------------------------------------------------------------------------
 # Main flow
 # ---------------------------------------------------------------------------
@@ -464,4 +621,62 @@ EOF
 
     report_slow_path_phase "PHASE 2: WARM CACHE" \
         "${WORK_DIR}/warm_before.prom" "${WORK_DIR}/warm_after.prom"
+
+elif [[ "$MODE" == "prescan-slow-path" ]]; then
+    allow_central_metrics_ingress
+
+    UNIQUE_COUNT=$BURST_SIZE
+    [[ "$UNIQUE_COUNT" -lt 1 ]] && UNIQUE_COUNT=1
+    load_image_pool "$UNIQUE_COUNT"
+
+    cat <<EOF
+
+==============================================
+  PRESCAN SLOW-PATH BURST TEST
+==============================================
+  Burst size:        ${BURST_SIZE} (1:1 unique after successful prescan)
+  Unique pct:        ${UNIQUE_PCT}% (forced)
+  Unique images:     ${UNIQUE_COUNT} (of ${POOL_SIZE} in pool)
+  Parallel:          ${PARALLEL}
+  Prescan parallel:  ${PRESCAN_PARALLEL}
+  Central:           ${ROX_CENTRAL_ADDRESS}
+==============================================
+EOF
+
+    # --- Phase 1: Pre-scan unique images via Central API ---
+    echo ""
+    echo "=== Phase 1: Pre-scanning ${UNIQUE_COUNT} images via Central API ==="
+    prescan_pool "$PRESCAN_PARALLEL"
+
+    PRESCAN_OK=$(grep -c "^ok " "${WORK_DIR}/prescan.log" 2>/dev/null || true)
+    PRESCAN_FAIL=$(grep -c "^fail " "${WORK_DIR}/prescan.log" 2>/dev/null || true)
+
+    filter_pool_to_prescan_success
+    write_slow_path_manifests
+    TOTAL_IMAGE_REFS=$BURST_SIZE
+
+    # --- Phase 2: Cold-cache burst (Central scrape AFTER prescan) ---
+    echo ""
+    echo "=== Phase 2: Restart AC (cold cache) + burst ==="
+    restart_admission_control
+
+    echo "Scraping baseline AC + Central metrics (post-prescan)..."
+    scrape_prescan_pair \
+        "${WORK_DIR}/prescan_before.prom" \
+        "${WORK_DIR}/prescan_central_before.prom"
+
+    run_burst "Prescan burst (cold cache)"
+
+    echo "Waiting for metrics to settle..."
+    sleep 10
+
+    echo "Scraping post-burst AC + Central metrics..."
+    scrape_prescan_pair \
+        "${WORK_DIR}/prescan_after.prom" \
+        "${WORK_DIR}/prescan_central_after.prom"
+
+    report_prescan_slow_path \
+        "${WORK_DIR}/prescan_before.prom" "${WORK_DIR}/prescan_after.prom" \
+        "${WORK_DIR}/prescan_central_before.prom" "${WORK_DIR}/prescan_central_after.prom" \
+        "$PRESCAN_OK" "$PRESCAN_FAIL"
 fi
diff --git a/tools/admission-control/lib.sh b/tools/admission-control/lib.sh
index d0cdb10e24d7d..5b1d138207489 100644
--- a/tools/admission-control/lib.sh
+++ b/tools/admission-control/lib.sh
@@ -155,6 +155,18 @@ scrape_component() {
 # Metric math
 # ---------------------------------------------------------------------------
 
+# Print n in fixed-point form. awk's default OFMT (%.6g) emits 1.23e+06 for
+# values >= 1e6, and bc cannot parse the '+' ("Parse error: bad character '+'").
+_awk_fmt='
+function fmt(n) {
+    x = sprintf("%.6f", n+0)
+    sub(/0+$/, "", x)
+    sub(/\.$/, "", x)
+    if (x == "" || x == "-" || x == "-0") x = "0"
+    return x
+}
+'
+
 # Sum a Prometheus counter/gauge across all lines matching metric + optional labels.
 extract() {
     local file="$1" metric="$2" labels="${3:-}"
@@ -164,31 +176,29 @@ extract() {
     fi
     if [[ -n "$labels" ]]; then
         { grep "^${metric}[{ ]" "$file" 2>/dev/null | grep "$labels" || true; } \
-            | awk '{s+=$NF} END{print s+0}'
+            | awk "${_awk_fmt}"'{s+=$NF} END{print fmt(s)}'
     else
         { grep "^${metric}[{ ]" "$file" 2>/dev/null || true; } \
-            | awk '{s+=$NF} END{print s+0}'
+            | awk "${_awk_fmt}"'{s+=$NF} END{print fmt(s)}'
     fi
 }
 
-delta() { echo "$2 - $1" | bc; }
+delta() {
+    awk -v a="$1" -v b="$2" "${_awk_fmt}"'BEGIN{print fmt(b-a)}'
+}
 
 avg_or_na() {
-    local sum_d="$1" count_d="$2"
-    if (( $(echo "$count_d > 0" | bc -l) )); then
-        echo "scale=4; $sum_d / $count_d" | bc
-    else
-        echo "N/A"
-    fi
+    awk -v s="$1" -v c="$2" 'BEGIN{
+        if (c+0 > 0) printf "%.4f\n", s/c
+        else print "N/A"
+    }'
 }
 
 pct_or_na() {
-    local numerator="$1" denominator="$2"
-    if (( $(echo "$denominator > 0" | bc -l) )); then
-        echo "scale=1; $numerator * 100 / $denominator" | bc
-    else
-        echo "N/A"
-    fi
+    awk -v n="$1" -v d="$2" 'BEGIN{
+        if (d+0 > 0) printf "%.1f\n", n*100/d
+        else print "N/A"
+    }'
 }
 
 row() { printf "  %-50s %s\n" "$1" "$2"; }
@@ -244,12 +254,9 @@ YAML
     } > "$outfile"
 }
 
-generate_slow_path_manifests() {
-    UNIQUE_COUNT=$(( BURST_SIZE * UNIQUE_PCT / 100 ))
-    [[ "$UNIQUE_COUNT" -lt 1 ]] && UNIQUE_COUNT=1
-
-    load_image_pool "$UNIQUE_COUNT"
-
+# write_slow_path_manifests writes BURST_SIZE deployments from SCANNABLE_POOL.
+# Requires: BURST_SIZE, UNIQUE_COUNT, SCANNABLE_POOL, WORK_DIR, NAMESPACE
+write_slow_path_manifests() {
     for (( i = 0; i < BURST_SIZE; i++ )); do
         generate_slow_path_deployment "burst-${i}" \
             "${WORK_DIR}/deploy-${i}.yaml" \
@@ -258,6 +265,14 @@ generate_slow_path_manifests() {
     echo "  Generated ${BURST_SIZE} manifests (${UNIQUE_COUNT} unique images)."
 }
 
+generate_slow_path_manifests() {
+    UNIQUE_COUNT=$(( BURST_SIZE * UNIQUE_PCT / 100 ))
+    [[ "$UNIQUE_COUNT" -lt 1 ]] && UNIQUE_COUNT=1
+
+    load_image_pool "$UNIQUE_COUNT"
+    write_slow_path_manifests
+}
+
 # ---------------------------------------------------------------------------
 # Reassess trigger + wait
 # ---------------------------------------------------------------------------
@@ -324,6 +339,87 @@ trigger_and_wait_for_reprocessor() {
     wait "$log_pid" 2>/dev/null || true
 }
 
+# ---------------------------------------------------------------------------
+# Pre-scan helpers (warm Central DB via REST API)
+# ---------------------------------------------------------------------------
+
+# prescan_image <image-ref>
+#   Triggers a ScanImage request to Central to populate scan data in the DB.
+#   Requires: ROX_CENTRAL_ADDRESS, ROX_ADMIN_USER, ROX_PASSWORD
+# Prints the HTTP status code on stdout. Returns 0 only for HTTP 200.
+prescan_image() {
+    local image="$1"
+    local http_code
+    http_code=$(curl -sk -o /dev/null -w '%{http_code}' \
+        -u "${ROX_ADMIN_USER}:${ROX_PASSWORD}" \
+        --max-time 120 \
+        -X POST "https://${ROX_CENTRAL_ADDRESS}/v1/images/scan" \
+        -H "Content-Type: application/json" \
+        -d "{\"image_name\": \"${image}\", \"force\": true}")
+    echo "$http_code"
+    [[ "$http_code" == "200" ]]
+}
+
+# prescan_pool <parallel>
+#   Pre-scans SCANNABLE_POOL[0..UNIQUE_COUNT-1] via Central's ScanImage API.
+#   Requires: ROX_CENTRAL_ADDRESS, ROX_ADMIN_USER, ROX_PASSWORD,
+#             SCANNABLE_POOL, UNIQUE_COUNT
+prescan_pool() {
+    local parallel="${1:-5}"
+    local completed=0 failed=0
+    local pids=()
+
+    for (( i = 0; i < UNIQUE_COUNT; i++ )); do
+        local img="${SCANNABLE_POOL[$i]}"
+        (
+            if code=$(prescan_image "$img"); then
+                echo "ok ${img}"
+            else
+                echo "fail ${img} http=${code}"
+            fi
+        ) >> "${WORK_DIR}/prescan.log" &
+        pids+=($!)
+
+        if [[ "${#pids[@]}" -ge "$parallel" ]]; then
+            wait "${pids[@]}" 2>/dev/null || true
+            pids=()
+        fi
+    done
+    if [[ "${#pids[@]}" -gt 0 ]]; then
+        wait "${pids[@]}" 2>/dev/null || true
+    fi
+
+    completed=$(grep -c "^ok " "${WORK_DIR}/prescan.log" 2>/dev/null || true)
+    failed=$(grep -c "^fail " "${WORK_DIR}/prescan.log" 2>/dev/null || true)
+    echo "  Pre-scan complete: ${completed} succeeded, ${failed} failed (of ${UNIQUE_COUNT})."
+
+    if [[ "$failed" -gt 0 ]]; then
+        echo "  Failed images:" >&2
+        grep "^fail " "${WORK_DIR}/prescan.log" | while read -r _ rest; do
+            echo "    ${rest}" >&2
+        done
+    fi
+}
+
+# filter_pool_to_prescan_success keeps only images that returned HTTP 200.
+# Sets SCANNABLE_POOL, UNIQUE_COUNT, BURST_SIZE, and POOL_SIZE to that set so
+# the burst never includes tags that were not stored in Central's DB.
+filter_pool_to_prescan_success() {
+    local ok_file="${WORK_DIR}/prescan.ok"
+    grep "^ok " "${WORK_DIR}/prescan.log" 2>/dev/null | awk '{print $2}' > "$ok_file" || true
+    mapfile -t SCANNABLE_POOL < "$ok_file"
+    UNIQUE_COUNT=${#SCANNABLE_POOL[@]}
+    if [[ "$UNIQUE_COUNT" -eq 0 ]]; then
+        echo "ERROR: every prescan failed. Check ROX_PASSWORD, ROX_CENTRAL_ADDRESS, and Scanner health." >&2
+        echo "  Sample failures:" >&2
+        grep "^fail " "${WORK_DIR}/prescan.log" | head -5 >&2 || true
+        exit 1
+    fi
+    BURST_SIZE=$UNIQUE_COUNT
+    POOL_SIZE=$UNIQUE_COUNT
+    echo "  Bursting ${BURST_SIZE} unique pre-scanned images (failed prescans dropped)."
+}
+
 # ---------------------------------------------------------------------------
 # Burst runner
 # ---------------------------------------------------------------------------
diff --git a/tools/allowed-large-files b/tools/allowed-large-files
index aaef7317597f7..1f2268bb73de2 100644
--- a/tools/allowed-large-files
+++ b/tools/allowed-large-files
@@ -16,6 +16,7 @@ central/image/service/service_impl.go
 central/networkgraph/service/service_impl_test.go
 central/networkpolicies/graph/evaluator_test.go
 central/processlisteningonport/datastore/datastore_impl_test.go
+central/pruning/pruning.go
 central/pruning/pruning_test.go
 central/reports/service/v2/service_impl_test.go
 central/sensor/service/connection/sensor-central-data-flow.excalidraw.svg
@@ -75,6 +76,7 @@ scanner/e2etests/testdata/image_tests.orig.json
 scanner/enricher/csaf/testdata/*
 scanner/enricher/nvd/testdata/feed.json
 scripts/ci/lib.sh
+sensor/common/virtualmachine/vmscraper/scraper_test.go
 sensor/tests/data/policies.json
 sensor/upgrader/preflight/testdata/k8s-1.22.json.gz
 tests/common.go
diff --git a/tools/generate-helpers/config-as-code-helper/main.go b/tools/generate-helpers/config-as-code-helper/main.go
index cba3d849424c0..5b69d7f5b28de 100644
--- a/tools/generate-helpers/config-as-code-helper/main.go
+++ b/tools/generate-helpers/config-as-code-helper/main.go
@@ -83,19 +83,31 @@ func generateTemplateData(t reflect.Type, visited set.StringSet) []ConvertType {
 			continue
 		}
 
+		if _, ok := field.Tag.Lookup("protobuf_oneof"); ok {
+			continue
+		}
+
 		fieldType := field.Type.String()
 		isSlice := strings.HasPrefix(fieldType, "[]")
 		isStringer := strings.Contains(yamlTag, ",stringer")
 		if isStringer {
 			yamlTag = strings.Replace(yamlTag, ",stringer", "", 1)
 			fieldType = utils.IfThenElse(isSlice, "[]string", "string")
+			needUpdate = true
 		}
 		isTimeStamp := strings.Contains(yamlTag, ",timestamp")
 		if isTimeStamp {
 			yamlTag = strings.Replace(yamlTag, ",timestamp", "", 1)
 			fieldType = utils.IfThenElse(isSlice, "[]string", "string")
+			needUpdate = true
 		}
 
+		// A stringer or timestamp field is rewritten as a string. A message that
+		// contains only those fields still needs its own converted type, otherwise
+		// the parent embeds the proto and YAML uses the Go field name and wire value.
+		if isStringer || isTimeStamp {
+			needUpdate = true
+		}
 		needConversion := !isStringer && !isTimeStamp && checkForConversion(field)
 		if needConversion {
 			if !visited.Contains(field.Name) {
@@ -120,6 +132,41 @@ func generateTemplateData(t reflect.Type, visited set.StringSet) []ConvertType {
 			NeedConversion: needConversion,
 		})
 	}
+
+	if typeName == "Exclusion" {
+		// Oneof arms are not exported fields on Exclusion (Matcher is an
+		// interface). Flatten them using the same crYaml tags as the proto.
+		for _, extra := range []struct {
+			name    string
+			yamlTag string
+			typ     reflect.Type
+		}{
+			{"Deployment", ",omitempty", reflect.TypeFor[*storage.Exclusion_Deployment]()},
+			{"ExcludeByKind", "excludeByKind,omitempty", reflect.TypeFor[*storage.Exclusion_ExcludeByKind]()},
+		} {
+			fieldType := extra.typ.String()
+			needConversion := protoreflect.IsProtoMessage(getBaseType(extra.typ))
+			if needConversion {
+				if !visited.Contains(extra.name) {
+					newList := generateTemplateData(getBaseType(extra.typ), visited)
+					conversionList = append(conversionList, newList...)
+					if len(newList) == 0 {
+						needConversion = false
+					}
+				}
+				needUpdate = true
+			}
+			fields = append(fields, Field{
+				Name:           extra.name,
+				Type:           fieldType,
+				TrimmedType:    strings.Replace(fieldType, "storage.", "", 1),
+				BaseType:       getBaseType(extra.typ).Name(),
+				YamlTag:        extra.yamlTag,
+				NeedConversion: needConversion,
+			})
+		}
+	}
+
 	if needUpdate {
 		conversionList = append(conversionList, ConvertType{
 			Fields:   fields,
diff --git a/tools/generate-helpers/config-as-code-helper/policy.go.tpl b/tools/generate-helpers/config-as-code-helper/policy.go.tpl
index 2f012b7c93f76..67f64ad0baeaa 100644
--- a/tools/generate-helpers/config-as-code-helper/policy.go.tpl
+++ b/tools/generate-helpers/config-as-code-helper/policy.go.tpl
@@ -27,9 +27,9 @@ func convert{{.TypeName}}(p *storage.{{.TypeName}}) *{{.TypeName}} {
 
 	return &{{.TypeName}}{
          {{- range .Fields }}
-         {{- $fieldName := printf "p.%s" .Name }}
+         {{- $fieldName := printf "p.Get%s()" .Name }}
          {{- if .IsTimestamp }}
-             {{- $fieldName = printf "timestampToFormatRFC3339(%s)" $fieldName }}
+             {{- $fieldName = printf "timestampToFormatRFC3339(p.Get%s())" .Name }}
          {{- end }}
          {{ .Name }}:
          {{- if .IsStringer -}}
diff --git a/tools/generate-helpers/release-versions/main.go b/tools/generate-helpers/release-versions/main.go
new file mode 100644
index 0000000000000..22fb7efc69d08
--- /dev/null
+++ b/tools/generate-helpers/release-versions/main.go
@@ -0,0 +1,308 @@
+// release-versions generates initial-release database sequences from Git tags.
+package main
+
+import (
+	"bytes"
+	"errors"
+	"flag"
+	"fmt"
+	"go/ast"
+	"go/format"
+	"go/parser"
+	"go/token"
+	"maps"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/stackrox/rox/pkg/version/productstreams"
+)
+
+const sequencePath = "pkg/migrations/internal/seq_num.go"
+
+var initialRelease = regexp.MustCompile(`^[1-9][0-9]*\.(0|[1-9][0-9]*)\.0(-rc\.(0|[1-9][0-9]*))?$`)
+
+func main() {
+	target := flag.String("target", "", "target version (defaults to make tag)")
+	flag.Parse()
+	if err := run(*target); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func command(dir, name string, args ...string) (string, error) {
+	cmd := exec.Command(name, args...)
+	cmd.Dir = dir
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	data, err := cmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("%s %v: %w: %s", name, args, err, stderr.String())
+	}
+	return string(data), nil
+}
+
+func run(target string) error {
+	root, err := command("", "git", "rev-parse", "--show-toplevel")
+	if err != nil {
+		return fmt.Errorf("find repository root: %w", err)
+	}
+	dir := strings.TrimSpace(root)
+	if target == "" {
+		data, err := command(dir, "make", "--quiet", "--no-print-directory", "tag")
+		if err != nil {
+			return fmt.Errorf("determine target version with make tag: %w", err)
+		}
+		target = strings.TrimSpace(data)
+	}
+	data, err := generate(dir, target)
+	if err != nil {
+		return fmt.Errorf("generate release versions: %w", err)
+	}
+	outputPath := filepath.Join(dir, "pkg/migrations/release_versions.go")
+	if err := os.WriteFile(outputPath, data, 0644); err != nil {
+		return fmt.Errorf("write generated release versions to %s: %w", outputPath, err)
+	}
+	return nil
+}
+
+func generate(dir, target string) ([]byte, error) {
+	targetXy, err := parseTargetStream(target)
+	if err != nil {
+		return nil, err
+	}
+	tags, err := listReleaseTags(dir)
+	if err != nil {
+		return nil, err
+	}
+	releaseTags, err := selectReleaseTags(tags, targetXy)
+	if err != nil {
+		return nil, err
+	}
+	sequences, err := readReleaseSequences(dir, releaseTags)
+	if err != nil {
+		return nil, err
+	}
+	if err := ensureTargetSequence(dir, target, targetXy, sequences); err != nil {
+		return nil, err
+	}
+	streams, err := validateReleaseSequences(target, targetXy, sequences)
+	if err != nil {
+		return nil, err
+	}
+	return renderReleaseVersions(streams, sequences)
+}
+
+func parseTargetStream(target string) (productstreams.XYVersion, error) {
+	targetXy, err := productstreams.ParseXYFromVersionString(target)
+	if err != nil {
+		return productstreams.XYVersion{}, fmt.Errorf("parse target stream from %q: %w", target, err)
+	}
+	if err := validateReleaseStream(targetXy); err != nil {
+		return productstreams.XYVersion{}, fmt.Errorf("validate target stream %s: %w", targetXy, err)
+	}
+	return targetXy, nil
+}
+
+func listReleaseTags(dir string) (string, error) {
+	shallow, err := command(dir, "git", "rev-parse", "--is-shallow-repository")
+	if err != nil {
+		return "", fmt.Errorf("check whether checkout is shallow: %w", err)
+	}
+	if strings.TrimSpace(shallow) != "false" {
+		return "", errors.New("release generation requires a full checkout with release tags")
+	}
+	tags, err := command(dir, "git", "tag", "--list",
+		"[0-9]*.[0-9]*.0",
+		"[0-9]*.[0-9]*.0-rc.[0-9]*",
+	)
+	if err != nil {
+		return "", fmt.Errorf("list release tags: %w", err)
+	}
+	return tags, nil
+}
+
+func selectReleaseTags(tags string, targetXy productstreams.XYVersion) (map[productstreams.XYVersion]string, error) {
+	releaseTags := make(map[productstreams.XYVersion]string)
+	for tag := range strings.FieldsSeq(tags) {
+		if !initialRelease.MatchString(tag) {
+			continue
+		}
+		stream, err := productstreams.ParseXYFromVersionString(tag)
+		if err != nil {
+			return nil, fmt.Errorf("parse release stream from tag %q: %w", tag, err)
+		}
+		if stream.Compare(productstreams.XYVersion{X: 4, Y: 4}) < 0 || stream.Compare(targetXy) > 0 {
+			continue
+		}
+		if err := validateReleaseStream(stream); err != nil {
+			return nil, fmt.Errorf("validate historical release stream %s: %w", stream, err)
+		}
+		selected, exists := releaseTags[stream]
+		if !exists {
+			releaseTags[stream] = tag
+			continue
+		}
+		newer, err := newerInitialRelease(tag, selected)
+		if err != nil {
+			return nil, err
+		}
+		if newer {
+			releaseTags[stream] = tag
+		}
+	}
+	return releaseTags, nil
+}
+
+func readReleaseSequences(dir string, releaseTags map[productstreams.XYVersion]string) (map[productstreams.XYVersion]int, error) {
+	sequences := make(map[productstreams.XYVersion]int)
+	for stream, tag := range releaseTags {
+		data, err := command(dir, "git", "show", "refs/tags/"+tag+":"+sequencePath)
+		if err != nil {
+			return nil, fmt.Errorf("read %s from release tag %s: %w", sequencePath, tag, err)
+		}
+		sequence, err := parseSequence(data)
+		if err != nil {
+			return nil, fmt.Errorf("release %s: %w", tag, err)
+		}
+		sequences[stream] = sequence
+	}
+	return sequences, nil
+}
+
+// ensureTargetSequence adds a working-tree baseline only when no tag baseline exists.
+// The target must have been validated by parseTargetStream.
+func ensureTargetSequence(dir, target string, targetXy productstreams.XYVersion, sequences map[productstreams.XYVersion]int) error {
+	if _, exists := sequences[targetXy]; exists {
+		return nil
+	}
+	patch, _, _ := strings.Cut(strings.Split(target, ".")[2], "-")
+	if patch != "0" && patch != "x" {
+		return fmt.Errorf("missing initial release tag %s.0 for patch target %s", targetXy, target)
+	}
+	data, err := os.ReadFile(filepath.Join(dir, sequencePath))
+	if err != nil {
+		return fmt.Errorf("read current database sequence from %s: %w", sequencePath, err)
+	}
+	sequence, err := parseSequence(string(data))
+	if err != nil {
+		return fmt.Errorf("parse current database sequence from %s: %w", sequencePath, err)
+	}
+	sequences[targetXy] = sequence
+	return nil
+}
+
+func validateReleaseSequences(target string, targetXy productstreams.XYVersion, sequences map[productstreams.XYVersion]int) ([]productstreams.XYVersion, error) {
+	stream := targetXy
+	for i := range 4 {
+		if err := validateReleaseStream(stream); err != nil {
+			return nil, fmt.Errorf("validate release stream %s required by %s: %w", stream, target, err)
+		}
+		// Every supported stream needs a baseline; RC-only streams count too.
+		if _, exists := sequences[stream]; !exists {
+			return nil, fmt.Errorf("missing initial release tag %s.0 required by %s; fetch release tags before generation", stream, target)
+		}
+		if i == 3 {
+			break
+		}
+		var err error
+		stream, err = productstreams.GetPreviousYStream(stream)
+		if err != nil {
+			return nil, fmt.Errorf("find minimum supported stream for %s: %w", target, err)
+		}
+	}
+	streams := slices.Collect(maps.Keys(sequences))
+	slices.SortFunc(streams, productstreams.XYVersion.Compare)
+	last := 0
+	for _, stream := range streams {
+		sequence := sequences[stream]
+		if sequence < last {
+			return nil, fmt.Errorf("release %s sequence %d is less than previous sequence %d", stream, sequence, last)
+		}
+		last = sequence
+	}
+	return streams, nil
+}
+
+// renderReleaseVersions expects sorted streams returned by validateReleaseSequences.
+func renderReleaseVersions(streams []productstreams.XYVersion, sequences map[productstreams.XYVersion]int) ([]byte, error) {
+	var output bytes.Buffer
+	fmt.Fprintln(&output, `// Code generated by release-versions. DO NOT EDIT.
+
+package migrations
+
+var releaseVersions = []ReleaseVersion{`)
+	for _, stream := range streams {
+		sequence := sequences[stream]
+		fmt.Fprintf(&output, "{Version: %q, Sequence: %d},\n", stream.String(), sequence)
+	}
+	fmt.Fprintln(&output, "}")
+	formatted, err := format.Source(output.Bytes())
+	if err != nil {
+		return nil, fmt.Errorf("format generated release versions: %w", err)
+	}
+	return formatted, nil
+}
+
+func validateReleaseStream(stream productstreams.XYVersion) error {
+	previous, err := productstreams.GetPreviousYStream(productstreams.GetNextYStream(stream))
+	if err != nil {
+		return err
+	}
+	if previous != stream {
+		return fmt.Errorf("invalid release stream %s", stream)
+	}
+	return nil
+}
+
+// GA supersedes RCs; otherwise select the highest numeric RC ordinal.
+func newerInitialRelease(candidate, selected string) (bool, error) {
+	_, candidateRC, candidateIsRC := strings.Cut(candidate, "-rc.")
+	_, selectedRC, selectedIsRC := strings.Cut(selected, "-rc.")
+	if !candidateIsRC {
+		return true, nil
+	}
+	if !selectedIsRC {
+		return false, nil
+	}
+	candidateOrdinal, err := strconv.Atoi(candidateRC)
+	if err != nil {
+		return false, fmt.Errorf("parse RC ordinal from %q: %w", candidate, err)
+	}
+	selectedOrdinal, err := strconv.Atoi(selectedRC)
+	if err != nil {
+		return false, fmt.Errorf("parse RC ordinal from %q: %w", selected, err)
+	}
+	return candidateOrdinal > selectedOrdinal, nil
+}
+
+func parseSequence(data string) (int, error) {
+	file, err := parser.ParseFile(token.NewFileSet(), "seq_num.go", data, 0)
+	if err != nil {
+		return 0, fmt.Errorf("parse seq_num.go: %w", err)
+	}
+	sequence := 0
+	ast.Inspect(file, func(node ast.Node) bool {
+		decl, ok := node.(*ast.ValueSpec)
+		if !ok {
+			return true
+		}
+		for i, name := range decl.Names {
+			if name.Name == "CurrentDBVersionSeqNum" && i < len(decl.Values) {
+				if literal, ok := decl.Values[i].(*ast.BasicLit); ok && literal.Kind == token.INT {
+					sequence, _ = strconv.Atoi(literal.Value)
+				}
+			}
+		}
+		return true
+	})
+	if sequence <= 0 {
+		return 0, errors.New("missing positive CurrentDBVersionSeqNum in seq_num.go")
+	}
+	return sequence, nil
+}
diff --git a/tools/generate-helpers/release-versions/main_test.go b/tools/generate-helpers/release-versions/main_test.go
new file mode 100644
index 0000000000000..3a8c2794b7844
--- /dev/null
+++ b/tools/generate-helpers/release-versions/main_test.go
@@ -0,0 +1,622 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stackrox/rox/pkg/version/productstreams"
+	"github.com/stretchr/testify/require"
+)
+
+func repository(t *testing.T) (string, func(...string), func(int, string)) {
+	t.Helper()
+	dir := t.TempDir()
+	git := func(args ...string) {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		output, err := cmd.CombinedOutput()
+		require.NoError(t, err, "%s", output)
+	}
+	git("init", "-q", "--initial-branch=master")
+	git("config", "core.hooksPath", "/dev/null")
+	git("config", "user.email", "test@example.com")
+	git("config", "user.name", "Test")
+	git("config", "commit.gpgsign", "false")
+	git("config", "tag.gpgsign", "false")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "pkg/migrations/internal"), 0755))
+	write := func(sequence int, tag string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(dir, sequencePath), []byte(fmt.Sprintf("package internal\nvar CurrentDBVersionSeqNum int = %d\n", sequence)), 0644))
+		git("add", sequencePath)
+		git("commit", "-qm", "sequence", "--allow-empty")
+		if tag != "" {
+			git("tag", tag)
+		}
+	}
+	return dir, git, write
+}
+
+func TestDevelopmentBaseline(t *testing.T) {
+	dir, git, write := repository(t)
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(226, "5.0.0")
+	write(227, "5.1.x")
+	before, err := generate(dir, "5.1.x-105-g66fd4ac964")
+	require.NoError(t, err)
+	require.Contains(t, string(before), `Version: "5.1", Sequence: 227`)
+	write(228, "")
+	before, err = generate(dir, "5.1.x-106-gabcdef-dirty")
+	require.NoError(t, err)
+	require.Contains(t, string(before), `Version: "5.1", Sequence: 228`)
+	git("tag", "5.1.0")
+	after, err := generate(dir, "5.1.0")
+	require.NoError(t, err)
+	require.Equal(t, before, after)
+	write(229, "5.1.1")
+	after, err = generate(dir, "5.1.1")
+	require.NoError(t, err)
+	require.Equal(t, before, after)
+	write(240, "5.2.0")
+	after, err = generate(dir, "5.1.1")
+	require.NoError(t, err)
+	require.Equal(t, before, after)
+}
+
+func TestHistoricalPatchMigration(t *testing.T) {
+	dir, _, write := repository(t)
+	write(205, "4.5.0")
+	write(206, "4.5.1")
+	write(209, "4.6.0")
+	write(209, "4.7.0")
+	write(211, "4.8.x")
+	data, err := generate(dir, "4.8.x")
+	require.NoError(t, err)
+	require.Contains(t, string(data), `Version: "4.5", Sequence: 205`)
+	require.NotContains(t, string(data), "206")
+}
+
+func TestGenerationFailures(t *testing.T) {
+	for name, tc := range map[string]struct {
+		target, tag, source, want string
+		completeHistory           bool
+	}{
+		"missing floor":                  {target: "5.1.x", want: "4.10.0", completeHistory: true},
+		"nightly is not release":         {target: "5.1.x", tag: "4.10.0-nightly-20260930", want: "4.10.0", completeHistory: true},
+		"missing patch baseline":         {target: "5.1.1", tag: "4.10.0", want: "5.1.0", completeHistory: true},
+		"patch RC missing baseline":      {target: "5.1.1-rc.0", tag: "4.10.0", want: "5.1.0", completeHistory: true},
+		"patch nightly missing baseline": {target: "5.1.1-nightly-20260930", tag: "4.10.0", want: "5.1.0", completeHistory: true},
+		"invalid target":                 {target: "garbage", want: "parse target stream"},
+		"phantom target":                 {target: "4.12.x", want: "stream"},
+		"malformed sequence":             {target: "5.1.x", tag: "4.10.0", source: "package internal\nvar CurrentDBVersionSeqNum = 0", want: "positive"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			dir, _, write := repository(t)
+			write(220, tc.tag)
+			if tc.completeHistory {
+				write(225, "4.11.0")
+				write(226, "5.0.0")
+			}
+			if tc.source != "" {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, sequencePath), []byte(tc.source), 0644))
+			}
+			_, err := generate(dir, tc.target)
+			require.ErrorContains(t, err, tc.want)
+		})
+	}
+}
+
+func TestPendingStreams(t *testing.T) {
+	for name, tc := range map[string]struct {
+		floor, latest, pending, target string
+		withRC                         bool
+	}{
+		"major boundary RC-only": {"4.10", "4.11", "5.0", "5.1.x", true},
+		"future development":     {"5.3", "5.4", "5.5", "5.6.x", true},
+		"RC target":              {"5.3", "5.4", "5.5", "5.6.0-rc.1", true},
+		"no RC tags":             {"5.3", "5.4", "5.5", "5.6.x", false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			dir, _, write := repository(t)
+			write(220, tc.floor+".0")
+			write(225, tc.latest+".0")
+			if tc.withRC {
+				write(226, tc.pending+".0-rc.1")
+			}
+			write(227, "")
+			data, err := generate(dir, tc.target)
+			if !tc.withRC {
+				require.ErrorContains(t, err, tc.pending+".0")
+				return
+			}
+			require.NoError(t, err)
+			require.Contains(t, string(data), fmt.Sprintf(`Version: %q, Sequence: 220`, tc.floor))
+			require.Contains(t, string(data), fmt.Sprintf(`Version: %q, Sequence: 225`, tc.latest))
+			require.Contains(t, string(data), fmt.Sprintf(`Version: %q, Sequence: 226`, tc.pending))
+			require.Contains(t, string(data), fmt.Sprintf(`Version: %q, Sequence: 227`, strings.Join(strings.Split(tc.target, ".")[:2], ".")))
+		})
+	}
+}
+
+func TestMissingIntermediateRelease(t *testing.T) {
+	for name, rc := range map[string]bool{"no tags": false, "old RC tags": true} {
+		t.Run(name, func(t *testing.T) {
+			dir, _, write := repository(t)
+			write(220, "5.3.0")
+			if rc {
+				write(221, "5.4.0-rc.1")
+			}
+			write(225, "5.5.0")
+			write(227, "")
+			_, err := generate(dir, "5.6.x")
+			if rc {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, "missing initial release tag 5.4.0")
+			}
+		})
+	}
+}
+
+func TestPendingStreamLifecycle(t *testing.T) {
+	dir, _, write := repository(t)
+	write(220, "5.3.0")
+	write(225, "5.4.0")
+	write(226, "5.5.0-rc.1")
+	write(230, "")
+	before, err := generate(dir, "5.6.x")
+	require.NoError(t, err)
+	require.Contains(t, string(before), `Version: "5.5", Sequence: 226`)
+	write(228, "5.5.0")
+	write(230, "")
+	baseline, err := generate(dir, "5.6.x")
+	require.NoError(t, err)
+	require.Contains(t, string(baseline), `Version: "5.5", Sequence: 228`)
+	require.Contains(t, string(baseline), `Version: "5.6", Sequence: 230`)
+	for _, tag := range []string{"5.5.1-rc.1", "5.5.1"} {
+		write(229, tag)
+		write(230, "")
+		after, err := generate(dir, "5.6.x")
+		require.NoError(t, err)
+		require.Equal(t, baseline, after)
+	}
+}
+
+func TestGenerationCommand(t *testing.T) {
+	dir, git, write := repository(t)
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(226, "5.0.0")
+	write(227, "5.1.x")
+	versionMakefile(t, dir)
+	t.Chdir(dir)
+	t.Setenv("BUILD_TAG", "")
+	require.NoError(t, run(""))
+	output := filepath.Join(dir, "pkg/migrations/release_versions.go")
+	before, err := os.ReadFile(output)
+	require.NoError(t, err)
+	require.Contains(t, string(before), `Version: "5.1", Sequence: 227`)
+	git("tag", "5.1.0")
+	t.Setenv("BUILD_TAG", "5.1.0")
+	require.NoError(t, run(""))
+	after, err := os.ReadFile(output)
+	require.NoError(t, err)
+	require.Equal(t, before, after)
+	t.Setenv("BUILD_TAG", "5.5.x")
+	require.ErrorContains(t, run(""), "5.4.0")
+	after, err = os.ReadFile(output)
+	require.NoError(t, err)
+	require.Equal(t, before, after, "failed generation must not overwrite the output")
+	require.NoError(t, run("5.1.0"), "explicit target takes precedence over BUILD_TAG")
+}
+
+func versionMakefile(t *testing.T, dir string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "make"), 0755))
+	for _, name := range []string{"env.mk", "goproxy.mk"} {
+		data, err := os.ReadFile(filepath.Join("../../../make", name))
+		require.NoError(t, err)
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "make", name), data, 0644))
+	}
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "Makefile"), []byte("include make/env.mk\ntag:\n\t@echo $(TAG)\n"), 0644))
+}
+
+func TestReleaseBranchLifecycle(t *testing.T) {
+	dir, git, write := repository(t)
+	versionMakefile(t, dir)
+	t.Chdir(dir)
+	t.Setenv("BUILD_TAG", "")
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(227, "5.0.0")
+	git("tag", "-a", "5.1.x", "-m", "development")
+	write(228, "")
+	git("checkout", "-qb", "release-5.1")
+	write(228, "")
+	git("tag", "-a", "5.1.0-rc.0", "-m", "release candidate")
+	git("checkout", "master")
+	write(230, "")
+	git("tag", "-a", "5.2.x", "-m", "next development stream")
+	git("checkout", "release-5.1")
+	write(229, "")
+	git("tag", "-a", "5.1.0-rc.1", "-m", "release candidate with migration")
+
+	readOutput := func() []byte {
+		t.Helper()
+		require.NoError(t, run(""))
+		data, err := os.ReadFile("pkg/migrations/release_versions.go")
+		require.NoError(t, err)
+		return data
+	}
+	before := readOutput()
+	require.Contains(t, string(before), `Version: "5.1", Sequence: 229`)
+	require.NotContains(t, string(before), `Version: "5.2"`)
+	git("tag", "-a", "5.1.0", "-m", "GA")
+	git("branch", "5.1.0", "master") // A branch name must not shadow the GA tag.
+	require.Equal(t, before, readOutput())
+	git("checkout", "--detach", "refs/tags/5.1.0")
+	require.Equal(t, before, readOutput(), "detached release CI checkout")
+	git("checkout", "release-5.1")
+	write(231, "")
+	git("tag", "-a", "5.1.1-rc.0", "-m", "patch migration")
+	require.Equal(t, before, readOutput())
+	git("tag", "-a", "5.1.1", "-m", "patch GA")
+	require.Equal(t, before, readOutput())
+
+	git("checkout", "master")
+	write(240, "")
+	git("tag", "-a", "5.2.0", "-m", "newer GA")
+	after := readOutput()
+	require.Contains(t, string(after), `Version: "5.1", Sequence: 229`, "GA on another branch is authoritative")
+	require.Contains(t, string(after), `Version: "5.2", Sequence: 240`)
+	git("checkout", "release-5.1")
+	require.Equal(t, before, readOutput(), "newer release tags must not change old branch output")
+}
+
+func TestMultipleReleaseBranchesWithRCs(t *testing.T) {
+	dir, git, write := repository(t)
+	write(220, "4.10.0")
+	git("checkout", "-qb", "release-4.10")
+	git("checkout", "master")
+	write(225, "4.11.0")
+	git("checkout", "-qb", "release-4.11")
+	git("checkout", "master")
+	write(227, "5.0.0-rc.0")
+	write(228, "5.1.x")
+
+	before, err := generate(dir, "5.1.x")
+	require.NoError(t, err)
+	require.Contains(t, string(before), `Version: "4.10", Sequence: 220`)
+	require.Contains(t, string(before), `Version: "4.11", Sequence: 225`)
+	require.Contains(t, string(before), `Version: "5.1", Sequence: 228`)
+	require.Contains(t, string(before), `Version: "5.0", Sequence: 227`)
+
+	// Each release line can advance independently while RCs are in flight.
+	git("checkout", "release-4.10")
+	write(221, "4.10.10-rc.1")
+	git("checkout", "release-4.11")
+	for sequence, tag := range []string{
+		"4.11.1-rc.0",
+		"4.11.1-rc.1",
+		"4.11.1-rc.2",
+		"4.11.1-rc.3",
+		"4.11.1-rc.4",
+	} {
+		write(226+sequence, tag)
+	}
+	git("checkout", "-qb", "release-5.0", "refs/tags/4.11.0")
+	write(227, "5.0.0-rc.2")
+	git("checkout", "master")
+
+	after, err := generate(dir, "5.1.x")
+	require.NoError(t, err)
+	require.Equal(t, before, after, "patch RCs must not change baselines, and an unchanged initial RC sequence is stable")
+}
+
+func TestNightlyVersionDiscovery(t *testing.T) {
+	dir, git, write := repository(t)
+	versionMakefile(t, dir)
+	t.Chdir(dir)
+	t.Setenv("BUILD_TAG", "")
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(226, "5.0.0")
+	write(227, "")
+	git("tag", "-a", "5.1.x", "-m", "development")
+	write(228, "")
+	git("tag", "-a", "5.1.x-nightly-20260930", "-m", "nightly")
+	tag, err := command(dir, "make", "--quiet", "tag")
+	require.NoError(t, err)
+	require.Contains(t, tag, "5.1.x-1-g")
+	require.NotContains(t, tag, "nightly")
+	require.NoError(t, run(""))
+	before, err := os.ReadFile("pkg/migrations/release_versions.go")
+	require.NoError(t, err)
+	t.Setenv("BUILD_TAG", "5.1.x-nightly-20260930")
+	require.NoError(t, run(""))
+	after, err := os.ReadFile("pkg/migrations/release_versions.go")
+	require.NoError(t, err)
+	require.Equal(t, before, after, "explicit nightly BUILD_TAG must select the same stream")
+	require.NoError(t, os.WriteFile(sequencePath, []byte("package internal\nvar CurrentDBVersionSeqNum = 229\n"), 0644))
+	t.Setenv("BUILD_TAG", "")
+	tag, err = command(dir, "make", "--quiet", "tag")
+	require.NoError(t, err)
+	require.Contains(t, tag, "-dirty")
+	require.NoError(t, run(""))
+	after, err = os.ReadFile("pkg/migrations/release_versions.go")
+	require.NoError(t, err)
+	require.Contains(t, string(after), `Version: "5.1", Sequence: 229`)
+}
+
+func TestPatchVersionSuffixes(t *testing.T) {
+	dir, _, write := repository(t)
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(226, "5.0.0")
+	write(227, "5.1.0")
+	write(228, "5.1.1")
+	baseline, err := generate(dir, "5.1.0")
+	require.NoError(t, err)
+	for name, target := range map[string]string{
+		"patch RC":               "5.1.2-rc.1",
+		"patch nightly":          "5.1.1-nightly-20260930",
+		"RC nightly":             "5.1.2-rc.1-nightly-20260930",
+		"patch git describe":     "5.1.1-12-gabcdef-dirty",
+		"release branch nightly": "5.1.x-nightly-20260930",
+	} {
+		t.Run(name, func(t *testing.T) {
+			data, err := generate(dir, target)
+			require.NoError(t, err)
+			require.Equal(t, baseline, data)
+		})
+	}
+}
+
+func TestInvalidHistoricalSequence(t *testing.T) {
+	for name, sequence := range map[string]int{"invalid": 0, "decreasing": 230} {
+		t.Run(name, func(t *testing.T) {
+			dir, _, write := repository(t)
+			write(sequence, "4.10.0")
+			write(225, "4.11.0")
+			write(226, "5.0.0")
+			write(227, "5.1.x")
+			_, err := generate(dir, "5.1.x")
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestPhantomHistoricalStream(t *testing.T) {
+	dir, _, write := repository(t)
+	write(220, "4.10.0")
+	write(225, "4.12.0")
+	write(227, "5.1.x")
+	_, err := generate(dir, "5.1.x")
+	require.ErrorContains(t, err, "4.12")
+}
+
+func TestCommandIgnoresSuccessfulStderr(t *testing.T) {
+	output, err := command(t.TempDir(), "sh", "-c", "printf '5.1.x'; printf 'warning' >&2")
+	require.NoError(t, err)
+	require.Equal(t, "5.1.x", output)
+}
+
+func TestMajorBoundaryAndReleaseCandidate(t *testing.T) {
+	dir, _, write := repository(t)
+	write(211, "4.8.0")
+	write(213, "4.9.0")
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(227, "5.0.0-rc.1")
+	data, err := generate(dir, "5.0.0-rc.1")
+	require.NoError(t, err)
+	require.Contains(t, string(data), `Version: "5.0", Sequence: 227`)
+	write(228, "5.0.0-rc.2")
+	data, err = generate(dir, "5.0.0-rc.2")
+	require.NoError(t, err)
+	require.Contains(t, string(data), `Version: "5.0", Sequence: 228`)
+}
+
+func TestShallowCheckout(t *testing.T) {
+	dir, _, write := repository(t)
+	write(220, "4.10.0")
+	write(227, "5.1.x")
+	clone := filepath.Join(t.TempDir(), "clone")
+	_, err := command("", "git", "clone", "--depth=1", "file://"+dir, clone)
+	require.NoError(t, err)
+	_, err = generate(clone, "5.1.x")
+	require.ErrorContains(t, err, "full checkout")
+}
+
+func TestParseSequence(t *testing.T) {
+	for name, tc := range map[string]struct {
+		source string
+		want   int
+	}{
+		"typed":      {"package internal\nvar CurrentDBVersionSeqNum int = 205", 205},
+		"untyped":    {"package internal\nvar CurrentDBVersionSeqNum = 227", 227},
+		"missing":    {"package internal", 0},
+		"malformed":  {"not Go", 0},
+		"negative":   {"package internal\nvar CurrentDBVersionSeqNum = -1", 0},
+		"expression": {"package internal\nvar CurrentDBVersionSeqNum = 200 + 1", 0},
+	} {
+		t.Run(name, func(t *testing.T) {
+			got, err := parseSequence(tc.source)
+			if tc.want == 0 {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tc.want, got)
+			}
+		})
+	}
+}
+
+func TestInitialReleaseCandidateSelection(t *testing.T) {
+	dir, _, write := repository(t)
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(226, "5.0.0-rc.2")
+	write(227, "5.0.0-rc.10")
+	write(229, "5.0.1-rc.0")
+	write(0, "5.0.0-rc.11-nightly-20261008")
+	write(230, "")
+	data, err := generate(dir, "5.1.x")
+	require.NoError(t, err)
+	require.Contains(t, string(data), `Version: "5.0", Sequence: 227`)
+	// GA is authoritative even when its sequence differs from the last RC.
+	write(228, "5.0.0")
+	write(230, "")
+	data, err = generate(dir, "5.1.x")
+	require.NoError(t, err)
+	require.Contains(t, string(data), `Version: "5.0", Sequence: 228`)
+}
+
+func TestDecreasingReleaseCandidateSequence(t *testing.T) {
+	dir, _, write := repository(t)
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(229, "5.0.0-rc.0")
+	write(228, "")
+	_, err := generate(dir, "5.1.x")
+	require.ErrorContains(t, err, "less than previous sequence")
+}
+
+func TestPatchTargetWithReleaseCandidateBaseline(t *testing.T) {
+	dir, _, write := repository(t)
+	write(213, "4.9.0")
+	write(220, "4.10.0")
+	write(225, "4.11.0")
+	write(227, "5.0.0-rc.0")
+	write(229, "5.0.1-rc.0")
+	data, err := generate(dir, "5.0.1-rc.0")
+	require.NoError(t, err)
+	require.Contains(t, string(data), `Version: "5.0", Sequence: 227`)
+}
+
+func TestParseTargetStream(t *testing.T) {
+	for name, tc := range map[string]struct {
+		target    string
+		want      productstreams.XYVersion
+		wantError string
+	}{
+		"stream":         {target: "5.1", want: productstreams.XYVersion{X: 5, Y: 1}},
+		"development":    {target: "5.1.x-106-gabcdef-dirty", want: productstreams.XYVersion{X: 5, Y: 1}},
+		"patch RC":       {target: "5.1.2-rc.1", want: productstreams.XYVersion{X: 5, Y: 1}},
+		"nightly":        {target: "5.1.x-nightly-20260930", want: productstreams.XYVersion{X: 5, Y: 1}},
+		"invalid syntax": {target: "garbage", wantError: `parse target stream from "garbage"`},
+		"phantom stream": {target: "4.12.x", wantError: "validate target stream 4.12"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			got, err := parseTargetStream(tc.target)
+			if tc.wantError != "" {
+				require.ErrorContains(t, err, tc.wantError)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestSelectReleaseTags(t *testing.T) {
+	for name, tc := range map[string]struct {
+		tags      string
+		want      map[productstreams.XYVersion]string
+		wantError string
+	}{
+		"numeric RC ordering": {
+			tags: "5.0.0-rc.10 5.0.0-rc.2 5.0.0-rc.9",
+			want: map[productstreams.XYVersion]string{{X: 5, Y: 0}: "5.0.0-rc.10"},
+		},
+		"GA supersedes RC in either order": {
+			tags: "4.11.0-rc.10 4.11.0 5.0.0 5.0.0-rc.10",
+			want: map[productstreams.XYVersion]string{{X: 4, Y: 11}: "4.11.0", {X: 5, Y: 0}: "5.0.0"},
+		},
+		"ignored tags and stream bounds": {
+			tags: "4.3.0 4.4.0 5.1.0 5.2.0 5.0.1 5.0.1-rc.0 5.0.0-nightly-20261008 5.0.0-rc.11-nightly-20261008 5.0.x 5.0.0-rc.01 garbage",
+			want: map[productstreams.XYVersion]string{{X: 4, Y: 4}: "4.4.0", {X: 5, Y: 1}: "5.1.0"},
+		},
+		"no candidates":             {want: map[productstreams.XYVersion]string{}},
+		"phantom historical stream": {tags: "4.12.0", wantError: "validate historical release stream 4.12"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			got, err := selectReleaseTags(tc.tags, productstreams.XYVersion{X: 5, Y: 1})
+			if tc.wantError != "" {
+				require.ErrorContains(t, err, tc.wantError)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestValidateReleaseSequences(t *testing.T) {
+	for name, tc := range map[string]struct {
+		missing   productstreams.XYVersion
+		change    productstreams.XYVersion
+		sequence  int
+		wantError string
+	}{
+		"major boundary and sorted streams":      {},
+		"equal sequences":                        {change: productstreams.XYVersion{X: 5, Y: 0}, sequence: 225},
+		"missing floor":                          {missing: productstreams.XYVersion{X: 4, Y: 10}, wantError: "missing initial release tag 4.10.0 required by 5.1.x"},
+		"missing intermediate":                   {missing: productstreams.XYVersion{X: 5, Y: 0}, wantError: "missing initial release tag 5.0.0 required by 5.1.x"},
+		"missing target":                         {missing: productstreams.XYVersion{X: 5, Y: 1}, wantError: "missing initial release tag 5.1.0 required by 5.1.x"},
+		"decreasing":                             {change: productstreams.XYVersion{X: 5, Y: 0}, sequence: 224, wantError: "release 5.0 sequence 224 is less than previous sequence 225"},
+		"older historical sequence also checked": {change: productstreams.XYVersion{X: 4, Y: 9}, sequence: 221, wantError: "release 4.10 sequence 220 is less than previous sequence 221"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			sequences := map[productstreams.XYVersion]int{
+				{X: 5, Y: 1}:  227,
+				{X: 4, Y: 11}: 225,
+				{X: 4, Y: 9}:  213,
+				{X: 5, Y: 0}:  226,
+				{X: 4, Y: 10}: 220,
+			}
+			delete(sequences, tc.missing)
+			if tc.change.X != 0 {
+				sequences[tc.change] = tc.sequence
+			}
+			got, err := validateReleaseSequences("5.1.x", productstreams.XYVersion{X: 5, Y: 1}, sequences)
+			if tc.wantError != "" {
+				require.ErrorContains(t, err, tc.wantError)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, []productstreams.XYVersion{{X: 4, Y: 9}, {X: 4, Y: 10}, {X: 4, Y: 11}, {X: 5, Y: 0}, {X: 5, Y: 1}}, got)
+		})
+	}
+}
+
+func TestValidateReleaseSequencesRejectsPhantomTarget(t *testing.T) {
+	_, err := validateReleaseSequences("4.12.x", productstreams.XYVersion{X: 4, Y: 12}, nil)
+	require.ErrorContains(t, err, "validate release stream 4.12 required by 4.12.x: invalid release stream 4.12")
+}
+
+func TestRenderReleaseVersions(t *testing.T) {
+	streams := []productstreams.XYVersion{{X: 4, Y: 11}, {X: 5, Y: 0}}
+	sequences := map[productstreams.XYVersion]int{{X: 5, Y: 0}: 226, {X: 4, Y: 11}: 225}
+	got, err := renderReleaseVersions(streams, sequences)
+	require.NoError(t, err)
+	require.Equal(t, `// Code generated by release-versions. DO NOT EDIT.
+
+package migrations
+
+var releaseVersions = []ReleaseVersion{
+	{Version: "4.11", Sequence: 225},
+	{Version: "5.0", Sequence: 226},
+}
+`, string(got))
+}
+
+func TestInitialReleaseOrdinalOverflow(t *testing.T) {
+	_, err := selectReleaseTags("5.1.0-rc.1 5.1.0-rc.999999999999999999999999999999", productstreams.XYVersion{X: 5, Y: 1})
+	require.ErrorContains(t, err, "parse RC ordinal")
+}
diff --git a/tools/linters/go.mod b/tools/linters/go.mod
index ab424a14e39e4..7a7478d0cf497 100644
--- a/tools/linters/go.mod
+++ b/tools/linters/go.mod
@@ -1,38 +1,39 @@
 module github.com/stackrox/stackrox/tools/linters
 
-go 1.26.3
+go 1.26.7
 
 require (
-	github.com/golangci/golangci-lint/v2 v2.12.2
+	actionlint.kjanat.dev v1.17.0
+	github.com/golangci/golangci-lint/v2 v2.14.0
 	github.com/nilslice/protolock v0.17.0
-	github.com/rhysd/actionlint v1.7.12
 	github.com/sethvargo/ratchet v0.12.0
-	golang.org/x/vuln v1.6.0
+	golang.org/x/vuln v1.9.0
 )
 
 require (
-	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
+	4d63.com/gocheckcompilerdirectives v1.4.0 // indirect
 	4d63.com/gochecknoglobals v0.2.2 // indirect
-	charm.land/lipgloss/v2 v2.0.3 // indirect
-	codeberg.org/chavacava/garif v0.2.0 // indirect
+	charm.land/lipgloss/v2 v2.0.6 // indirect
+	codeberg.org/chavacava/garif v0.2.1 // indirect
 	codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect
 	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect
-	dev.gaijin.team/go/golib v0.6.0 // indirect
-	github.com/4meepo/tagalign v1.4.3 // indirect
-	github.com/Abirdcfly/dupword v0.1.7 // indirect
+	dev.gaijin.team/go/exhaustruct/v5 v5.2.0 // indirect
+	dev.gaijin.team/go/golib v0.8.1 // indirect
+	github.com/4meepo/tagalign v1.4.4 // indirect
+	github.com/Abirdcfly/dupword v0.1.8 // indirect
 	github.com/AdminBenni/iota-mixing v1.0.0 // indirect
-	github.com/AlwxSin/noinlineerr v1.0.5 // indirect
-	github.com/Antonboom/errname v1.1.1 // indirect
-	github.com/Antonboom/nilnil v1.1.1 // indirect
+	github.com/AlwxSin/noinlineerr v1.0.6 // indirect
+	github.com/Antonboom/errname v1.1.2 // indirect
+	github.com/Antonboom/nilnil v1.1.2 // indirect
 	github.com/Antonboom/testifylint v1.6.4 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/ClickHouse/clickhouse-go-linter v1.2.0 // indirect
+	github.com/ClickHouse/clickhouse-go-linter v1.2.1 // indirect
 	github.com/Djarvur/go-err113 v0.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/MirrexOne/unqueryvet v1.5.4 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
-	github.com/alecthomas/chroma/v2 v2.24.1 // indirect
-	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
+	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
+	github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
 	github.com/alexkohler/prealloc v1.1.0 // indirect
 	github.com/alfatraining/structtag v1.0.0 // indirect
@@ -45,19 +46,19 @@ require (
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
-	github.com/bombsimon/wsl/v5 v5.8.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.9.0 // indirect
 	github.com/braydonk/yaml v0.9.0 // indirect
 	github.com/breml/bidichk v0.3.3 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
 	github.com/butuzov/ireturn v0.4.1 // indirect
-	github.com/butuzov/mirror v1.3.0 // indirect
+	github.com/butuzov/mirror v1.3.3 // indirect
 	github.com/catenacyber/perfsprint v0.10.1 // indirect
 	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charithe/durationcheck v0.0.11 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318 // indirect
-	github.com/charmbracelet/x/ansi v0.11.7 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/x/ansi v0.11.8 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
@@ -67,20 +68,19 @@ require (
 	github.com/curioswitch/go-reassign v0.3.0 // indirect
 	github.com/daixiang0/gci v0.13.7 // indirect
 	github.com/dave/dst v0.27.3 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
-	github.com/dlclark/regexp2 v1.12.0 // indirect
+	github.com/dlclark/regexp2/v2 v2.2.1 // indirect
 	github.com/docker/cli v29.6.2+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.8 // indirect
 	github.com/emicklei/proto v1.9.1 // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/fatih/structtag v1.2.0 // indirect
-	github.com/firefart/nonamedreturns v1.0.6 // indirect
-	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/firefart/nonamedreturns v1.0.8 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
-	github.com/ghostiam/protogetter v0.3.20 // indirect
-	github.com/go-critic/go-critic v0.14.3 // indirect
+	github.com/ghostiam/protogetter v1.0.1 // indirect
+	github.com/go-critic/go-critic v0.15.0 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
 	github.com/go-toolsmith/astcopy v1.1.0 // indirect
 	github.com/go-toolsmith/astequal v1.2.0 // indirect
@@ -91,13 +91,14 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/godoc-lint/godoc-lint v0.11.2 // indirect
-	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/godoc-lint/godoc-lint v0.11.4 // indirect
+	github.com/gofrs/flock v0.13.1 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golangci/asciicheck v0.5.0 // indirect
+	github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 // indirect
 	github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 // indirect
 	github.com/golangci/go-printf-func-name v0.1.1 // indirect
-	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
+	github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 // indirect
 	github.com/golangci/golines v0.15.0 // indirect
 	github.com/golangci/misspell v0.8.0 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
@@ -120,24 +121,23 @@ require (
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jgautheron/goconst v1.10.0 // indirect
+	github.com/jgautheron/goconst v1.11.0 // indirect
 	github.com/jjti/go-spancheck v0.6.5 // indirect
 	github.com/julz/importas v0.2.0 // indirect
 	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
-	github.com/kisielk/errcheck v1.10.0 // indirect
+	github.com/kisielk/errcheck v1.20.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
 	github.com/klauspost/compress v1.19.0 // indirect
 	github.com/kulti/thelper v0.7.1 // indirect
 	github.com/kunwardeep/paralleltest v1.0.15 // indirect
-	github.com/lasiar/canonicalheader v1.1.2 // indirect
 	github.com/ldez/exptostd v0.4.5 // indirect
-	github.com/ldez/gomoddirectives v0.8.0 // indirect
+	github.com/ldez/gomoddirectives v0.10.0 // indirect
 	github.com/ldez/grignotin v0.10.1 // indirect
 	github.com/ldez/structtags v0.6.1 // indirect
-	github.com/ldez/tagliatelle v0.7.2 // indirect
+	github.com/ldez/tagliatelle v0.8.0 // indirect
 	github.com/ldez/usetesting v0.5.0 // indirect
 	github.com/leonklingele/grouper v1.1.2 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/macabu/inamedparam v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect
@@ -145,25 +145,24 @@ require (
 	github.com/maratori/testableexamples v1.0.1 // indirect
 	github.com/maratori/testpackage v1.1.2 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
-	github.com/mattn/go-shellwords v1.0.12 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/mattn/go-runewidth v0.0.28 // indirect
+	github.com/mattn/go-shellwords v1.0.14 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mgechev/revive v1.15.0 // indirect
+	github.com/mgechev/revive v1.17.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
-	github.com/nishanths/exhaustive v0.12.0 // indirect
+	github.com/nishanths/exhaustive v0.13.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
+	github.com/nunnatsa/ginkgolinter v0.24.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
@@ -173,22 +172,22 @@ require (
 	github.com/quasilyte/gogrep v0.5.0 // indirect
 	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
 	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
-	github.com/raeperd/recvcheck v0.2.0 // indirect
+	github.com/raeperd/recvcheck v0.3.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rogpeppe/go-internal v1.16.0 // indirect
 	github.com/ryancurrah/gomodguard v1.4.1 // indirect
 	github.com/ryancurrah/gomodguard/v2 v2.1.3 // indirect
 	github.com/ryanrolds/sqlclosecheck v0.6.0 // indirect
 	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
-	github.com/securego/gosec/v2 v2.26.1 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/securego/gosec/v2 v2.29.0 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
 	github.com/sonatard/noctx v0.5.1 // indirect
-	github.com/sourcegraph/go-diff v0.8.0 // indirect
+	github.com/sourcegraph/go-diff v0.9.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
@@ -197,20 +196,20 @@ require (
 	github.com/spf13/viper v1.13.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
 	github.com/stbenjam/no-sprintf-host-port v0.3.1 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/stretchr/testify v1.11.1 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/stretchr/testify v1.12.1 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/tetafro/godot v1.5.6 // indirect
-	github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4 // indirect
-	github.com/timonwong/loggercheck v0.11.0 // indirect
+	github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c // indirect
+	github.com/timonwong/loggercheck v0.12.0 // indirect
 	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
 	github.com/ultraware/funlen v0.2.0 // indirect
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/uudashr/gocognit v1.2.1 // indirect
-	github.com/uudashr/iface v1.4.2 // indirect
+	github.com/uudashr/iface v1.5.1 // indirect
 	github.com/xen0n/gosmopolitan v1.3.0 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/xo/terminfo v1.0.0 // indirect
 	github.com/yagipy/maintidx v1.0.0 // indirect
 	github.com/yeya24/promlinter v0.3.0 // indirect
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
@@ -218,24 +217,24 @@ require (
 	go-simpler.org/musttag v0.14.0 // indirect
 	go-simpler.org/sloglint v0.12.0 // indirect
 	go.augendre.info/arangolint v0.4.0 // indirect
-	go.augendre.info/fatcontext v0.9.0 // indirect
+	go.augendre.info/fatcontext v0.10.1 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
-	golang.org/x/mod v0.38.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f // indirect
+	golang.org/x/mod v0.42.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect
-	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/tools v0.48.0 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.52.0 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	honnef.co/go/tools v0.7.0 // indirect
-	mvdan.cc/gofumpt v0.9.2 // indirect
-	mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect
+	honnef.co/go/tools v0.8.1 // indirect
+	mvdan.cc/gofumpt v0.12.0 // indirect
+	mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 // indirect
 )
diff --git a/tools/linters/go.sum b/tools/linters/go.sum
index cee066806ecae..48f60e63ee6e5 100644
--- a/tools/linters/go.sum
+++ b/tools/linters/go.sum
@@ -1,9 +1,11 @@
-4d63.com/gocheckcompilerdirectives v1.3.0 h1:Ew5y5CtcAAQeTVKUVFrE7EwHMrTO6BggtEj8BZSjZ3A=
-4d63.com/gocheckcompilerdirectives v1.3.0/go.mod h1:ofsJ4zx2QAuIP/NO/NAh1ig6R1Fb18/GI7RVMwz7kAY=
+4d63.com/gocheckcompilerdirectives v1.4.0 h1:ZLq62rbGWVmQhiZ8kuNVIT/M09xCSTdJz9K3xOdT/CY=
+4d63.com/gocheckcompilerdirectives v1.4.0/go.mod h1:9ZOAiMOjqC/nRwci2fcUXVHUNLG/cH6r6rhUh+jTFtQ=
 4d63.com/gochecknoglobals v0.2.2 h1:H1vdnwnMaZdQW/N+NrkT1SZMTBmcwHe9Vq8lJcYYTtU=
 4d63.com/gochecknoglobals v0.2.2/go.mod h1:lLxwTQjL5eIesRbvnzIP3jZtG140FnTdz+AlMa+ogt0=
-charm.land/lipgloss/v2 v2.0.3 h1:yM2zJ4Cf5Y51b7RHIwioil4ApI/aypFXXVHSwlM6RzU=
-charm.land/lipgloss/v2 v2.0.3/go.mod h1:7myLU9iG/3xluAWzpY/fSxYYHCgoKTie7laxk6ATwXA=
+actionlint.kjanat.dev v1.17.0 h1:wzkg6amflGqcF4QlkSERw0L1kdGSb/z2KZ7aidlgD74=
+actionlint.kjanat.dev v1.17.0/go.mod h1:9BVNedMJ1sZTdAiszWaOl+H4IiKD9PfKrkwqpxeB+ao=
+charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
+charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -36,35 +38,37 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-codeberg.org/chavacava/garif v0.2.0 h1:F0tVjhYbuOCnvNcU3YSpO6b3Waw6Bimy4K0mM8y6MfY=
-codeberg.org/chavacava/garif v0.2.0/go.mod h1:P2BPbVbT4QcvLZrORc2T29szK3xEOlnl0GiPTJmEqBQ=
+codeberg.org/chavacava/garif v0.2.1 h1:K9oYxSlvlXrHXyW26Z4q61bTpJDo1wbvXcYKar/F/LM=
+codeberg.org/chavacava/garif v0.2.1/go.mod h1:oHnDSmc0f9K1MeE+MQD/yjkiIB5Xsn5y3S9Dg96Xk84=
 codeberg.org/polyfloyd/go-errorlint v1.9.0 h1:VkdEEmA1VBpH6ecQoMR4LdphVI3fA4RrCh2an7YmodI=
 codeberg.org/polyfloyd/go-errorlint v1.9.0/go.mod h1:GPRRu2LzVijNn4YkrZYJfatQIdS+TrcK8rL5Xs24qw8=
 dev.gaijin.team/go/exhaustruct/v4 v4.0.0 h1:873r7aNneqoBB3IaFIzhvt2RFYTuHgmMjoKfwODoI1Y=
 dev.gaijin.team/go/exhaustruct/v4 v4.0.0/go.mod h1:aZ/k2o4Y05aMJtiux15x8iXaumE88YdiB0Ai4fXOzPI=
-dev.gaijin.team/go/golib v0.6.0 h1:v6nnznFTs4bppib/NyU1PQxobwDHwCXXl15P7DV5Zgo=
-dev.gaijin.team/go/golib v0.6.0/go.mod h1:uY1mShx8Z/aNHWDyAkZTkX+uCi5PdX7KsG1eDQa2AVE=
+dev.gaijin.team/go/exhaustruct/v5 v5.2.0 h1:HZB49Fshn8qHJCi9VzYtrcnR1jbLteRHXfnQz8Adams=
+dev.gaijin.team/go/exhaustruct/v5 v5.2.0/go.mod h1:5IshpqhgGdKIrF8lBmi3M6YKmI7T3hMzAL9nrflko88=
+dev.gaijin.team/go/golib v0.8.1 h1:JYju4x9BSo+QD/AYeHULVDcvEhiFg8wOi6pT0IaZF5E=
+dev.gaijin.team/go/golib v0.8.1/go.mod h1:c5fu7t1RSGMxSQgcUYO1sODbzsYnOCXJLmHeNG1Eb+0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/4meepo/tagalign v1.4.3 h1:Bnu7jGWwbfpAie2vyl63Zup5KuRv21olsPIha53BJr8=
-github.com/4meepo/tagalign v1.4.3/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
-github.com/Abirdcfly/dupword v0.1.7 h1:2j8sInznrje4I0CMisSL6ipEBkeJUJAmK1/lfoNGWrQ=
-github.com/Abirdcfly/dupword v0.1.7/go.mod h1:K0DkBeOebJ4VyOICFdppB23Q0YMOgVafM0zYW0n9lF4=
+github.com/4meepo/tagalign v1.4.4 h1:052JDGj2pBORc6NkD30dDXpsUpoYszDeUwr9/5YZuVA=
+github.com/4meepo/tagalign v1.4.4/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
+github.com/Abirdcfly/dupword v0.1.8 h1:SrhcUuGsROBuChFxHALRYzyyPODWn9zwghmzPvD9Cd8=
+github.com/Abirdcfly/dupword v0.1.8/go.mod h1:XZrhVnI7YGpsTiWZANSQaBJ4QpL/Tq5vIEdKJJAs9WI=
 github.com/AdminBenni/iota-mixing v1.0.0 h1:Os6lpjG2dp/AE5fYBPAA1zfa2qMdCAWwPMCgpwKq7wo=
 github.com/AdminBenni/iota-mixing v1.0.0/go.mod h1:i4+tpAaB+qMVIV9OK3m4/DAynOd5bQFaOu+2AhtBCNY=
-github.com/AlwxSin/noinlineerr v1.0.5 h1:RUjt63wk1AYWTXtVXbSqemlbVTb23JOSRiNsshj7TbY=
-github.com/AlwxSin/noinlineerr v1.0.5/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
-github.com/Antonboom/errname v1.1.1 h1:bllB7mlIbTVzO9jmSWVWLjxTEbGBVQ1Ff/ClQgtPw9Q=
-github.com/Antonboom/errname v1.1.1/go.mod h1:gjhe24xoxXp0ScLtHzjiXp0Exi1RFLKJb0bVBtWKCWQ=
-github.com/Antonboom/nilnil v1.1.1 h1:9Mdr6BYd8WHCDngQnNVV0b554xyisFioEKi30sksufQ=
-github.com/Antonboom/nilnil v1.1.1/go.mod h1:yCyAmSw3doopbOWhJlVci+HuyNRuHJKIv6V2oYQa8II=
+github.com/AlwxSin/noinlineerr v1.0.6 h1:KAvuxunTe9QxvqrFB7nZTdb/7Wzas4AvifslTnG0Ld8=
+github.com/AlwxSin/noinlineerr v1.0.6/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
+github.com/Antonboom/errname v1.1.2 h1:dxwONZJua3VB8Xh/VaCjqAcqF645sWWv7xj26zy7tdQ=
+github.com/Antonboom/errname v1.1.2/go.mod h1:YeZIpgLMxT+SNkruGgYkLhzq/9vs3fsolTZegKaKDZI=
+github.com/Antonboom/nilnil v1.1.2 h1:aNlFuJhaEseXe4fHO3xbjXlSeEiQVYa2lEkWD2s2hAY=
+github.com/Antonboom/nilnil v1.1.2/go.mod h1:0ynwvphOLmAuMwTNDyBnDZmSwZoDpcFXmUHmzoHH2WA=
 github.com/Antonboom/testifylint v1.6.4 h1:gs9fUEy+egzxkEbq9P4cpcMB6/G0DYdMeiFS87UiqmQ=
 github.com/Antonboom/testifylint v1.6.4/go.mod h1:YO33FROXX2OoUfwjz8g+gUxQXio5i9qpVy7nXGbxDD4=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/ClickHouse/clickhouse-go-linter v1.2.0 h1:zbm174up3hTKjp0wKZVnTzRiG7tSF5XZF0FJG/MuCBI=
-github.com/ClickHouse/clickhouse-go-linter v1.2.0/go.mod h1:pLorS7ffPTfuUV9M0SJgfHA/h/WQPQUk2FWG9x74cQ4=
+github.com/ClickHouse/clickhouse-go-linter v1.2.1 h1:zGEKIyd5YL08ieWG/LOUmlau2DxbxPVOfAeo+4Jz3ck=
+github.com/ClickHouse/clickhouse-go-linter v1.2.1/go.mod h1:pLorS7ffPTfuUV9M0SJgfHA/h/WQPQUk2FWG9x74cQ4=
 github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
 github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
 github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
@@ -75,10 +79,10 @@ github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsu
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.24.1 h1:m5ffpfZbIb++k8AqFEKy9uVgY12xIQtBsQlc6DfZJQM=
-github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
-github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
-github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
+github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
+github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 h1:dXPJ+uOJLWb8rjlAuLX7JPiRJtZKw/53Ol+WxdDJ1Eo=
+github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606/go.mod h1:ZH31IJyNpxpStxP2ayCcPQz+3T2G/OnxIQqe4LWvSDw=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -112,8 +116,8 @@ github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6
 github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
 github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
-github.com/bombsimon/wsl/v5 v5.8.0 h1:JTkyfs4yl8SPejrCF2GdABXE+mO1WvM7iUYzRWlsxDs=
-github.com/bombsimon/wsl/v5 v5.8.0/go.mod h1:AbOLsulgkqP4ZnitHf9gwPtCOGlrzkk0jb0uNxRSY0o=
+github.com/bombsimon/wsl/v5 v5.9.0 h1:WCrgZ7RQnZO5oEwbVTlYgBdU3wL294kR1BSWV8vTfsU=
+github.com/bombsimon/wsl/v5 v5.9.0/go.mod h1:kjo4HiAV5FDkHC8/uzJq9mBffEEd6WT/nvN7DoMovDM=
 github.com/braydonk/yaml v0.9.0 h1:ewGMrVmEVpsm3VwXQDR388sLg5+aQ8Yihp6/hc4m+h4=
 github.com/braydonk/yaml v0.9.0/go.mod h1:hcm3h581tudlirk8XEUPDBAimBPbmnL0Y45hCRl47N4=
 github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
@@ -122,8 +126,8 @@ github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDw
 github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s=
 github.com/butuzov/ireturn v0.4.1 h1:vWb3NO4t77iku/sjCQ/2pHTQeOmxEhjIriJqRLg1Y+I=
 github.com/butuzov/ireturn v0.4.1/go.mod h1:q+DXKzTDV5guNuXLnIab9fKXizTn2miZHLhxH7V/GB4=
-github.com/butuzov/mirror v1.3.0 h1:HdWCXzmwlQHdVhwvsfBb2Au0r3HyINry3bDWLYXiKoc=
-github.com/butuzov/mirror v1.3.0/go.mod h1:AEij0Z8YMALaq4yQj9CPPVYOyJQyiexpQEQgihajRfI=
+github.com/butuzov/mirror v1.3.3 h1:v0RsWBhfFc1RQqE/f3sHpSttKDtodFn0gFmtYyD4/hA=
+github.com/butuzov/mirror v1.3.3/go.mod h1:h9BzzwYnTiHO0GzgvaTqIg7VSsOUhdIv51cHFFBmX1w=
 github.com/catenacyber/perfsprint v0.10.1 h1:u7Riei30bk46XsG8nknMhKLXG9BcXz3+3tl/WpKm0PQ=
 github.com/catenacyber/perfsprint v0.10.1/go.mod h1:DJTGsi/Zufpuus6XPGJyKOTMELe347o6akPvWG9Zcsc=
 github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
@@ -137,10 +141,10 @@ github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1Di
 github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318 h1:OqDqxQZliC7C8adA7KjelW3OjtAxREfeHkNcd66wpeI=
-github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318/go.mod h1:Y6kE2GzHfkyQQVCSL9r2hwokSrIlHGzZG+71+wDYSZI=
-github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
-github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
@@ -174,6 +178,8 @@ github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42
 github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2/v2 v2.2.1 h1:mf4KkFUj0gJuarK8P+LgiS+Lit7m9N1yAwEfPbee7R0=
+github.com/dlclark/regexp2/v2 v2.2.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw=
 github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
@@ -190,18 +196,18 @@ github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
-github.com/firefart/nonamedreturns v1.0.6 h1:vmiBcKV/3EqKY3ZiPxCINmpS431OcE1S47AQUwhrg8E=
-github.com/firefart/nonamedreturns v1.0.6/go.mod h1:R8NisJnSIpvPWheCq0mNRXJok6D8h7fagJTF8EMEwCo=
+github.com/firefart/nonamedreturns v1.0.8 h1:iB32Dl17zJl1zlVEj/WlUWgx0HiRyQ85OUw1WHa4/II=
+github.com/firefart/nonamedreturns v1.0.8/go.mod h1:vxFNvm5AfP/8rgAKFzYmnqx0yp1HjrYsErZ9pHPTznA=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
 github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
-github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
-github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
-github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
-github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
-github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog=
-github.com/go-critic/go-critic v0.14.3/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
+github.com/ghostiam/protogetter v1.0.1 h1:q4LLTx2KJHJpxrfO3BniUDWoFkoqWD/UlHhClBlUlLM=
+github.com/ghostiam/protogetter v1.0.1/go.mod h1:50Fh5yZfs6SFGrd1FlmT04NcguyEOxyjNK5zGD6/EvM=
+github.com/go-critic/go-critic v0.15.0 h1:MDUZIQKytIl+vPEc0Igw51m4uLTdi1ZGz2jatEqNs1g=
+github.com/go-critic/go-critic v0.15.0/go.mod h1:3BPrw8nHATGm3o2n37cssOmJzpySGKCdY8JWkCzxgKQ=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -211,10 +217,10 @@ github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vb
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
@@ -243,10 +249,10 @@ github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUW
 github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/godoc-lint/godoc-lint v0.11.2 h1:Bp0FkJWoSdNsBikdNgIcgtaoo+xz6I/Y9s5WSBQUeeM=
-github.com/godoc-lint/godoc-lint v0.11.2/go.mod h1:iVpGdL1JCikNH2gGeAn3Hh+AgN5Gx/I/cxV+91L41jo=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/godoc-lint/godoc-lint v0.11.4 h1:N9zUYVJ/OkznBbrBsU/zODvua64EUplMBLQWStO3+1M=
+github.com/godoc-lint/godoc-lint v0.11.4/go.mod h1:7usTXoxS0QYIi5usTSCPwR0w/6xLjcz450shXjLn3t4=
+github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
+github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -279,14 +285,16 @@ github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0=
 github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ=
+github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 h1:fVLolA3dG6s0brGetsiDAtcnpMSwVa2LqXJEw/9RJG4=
+github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6/go.mod h1:1xo+NFW5S+bEf2DKXhaxuzvcDN5AR6o/KMwvqC5Mkpo=
 github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 h1:CbTB8KpqnViI6lIXxp03Oclc4VFHi3K4BWC1TacsZ+A=
 github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
 github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U=
 github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
-github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
-github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d/go.mod h1:ivJ9QDg0XucIkmwhzCDsqcnxxlDStoTl89jDMIoNxKY=
-github.com/golangci/golangci-lint/v2 v2.12.2 h1:7+d1uY0bq1MU2UV3R5pW5Q7QWdcoq4naMRXM+gsJKrs=
-github.com/golangci/golangci-lint/v2 v2.12.2/go.mod h1:opqHHuIcTG2R+4akzWMd4o1BnD9/1LcjICWOujr91U8=
+github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 h1:WL8YKrt3UbOBqSRU7GpP5BTtQTMWtVtj+mfPijgZeIg=
+github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792/go.mod h1:te5hX0dW4C5r6YbXs+6ysNr8Q5UTmdIqGbb+mlFiYmA=
+github.com/golangci/golangci-lint/v2 v2.14.0 h1:ot8QffRa4LzAAEgtvNYrVs9esxQ7xoTwoAv6uhp4ngA=
+github.com/golangci/golangci-lint/v2 v2.14.0/go.mod h1:amHimCzNDP1GfVno3hIiNssjvqXmuW+CPZAHOdR4cIc=
 github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
 github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
 github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
@@ -335,8 +343,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
@@ -373,8 +381,8 @@ github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSo
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jgautheron/goconst v1.10.0 h1:Ptt+OoE4NaEWKhLrWrrN3IpZdGLiqaf7WLnEX/iv4Jw=
-github.com/jgautheron/goconst v1.10.0/go.mod h1:0p+wv1lFOiUr0IlNNT1nrm6+8DB8u2sU6KHGzFRXHDc=
+github.com/jgautheron/goconst v1.11.0 h1:KgN90z5qXt5f0Uzf3cWXev3hfMMFUyNeKdpkSBRvLDk=
+github.com/jgautheron/goconst v1.11.0/go.mod h1:0p+wv1lFOiUr0IlNNT1nrm6+8DB8u2sU6KHGzFRXHDc=
 github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8=
 github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@@ -390,8 +398,8 @@ github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
 github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
 github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
-github.com/kisielk/errcheck v1.10.0 h1:Lvs/YAHP24YKg08LA8oDw2z9fJVme090RAXd90S+rrw=
-github.com/kisielk/errcheck v1.10.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
+github.com/kisielk/errcheck v1.20.0 h1:9rwHBNKzd4wkDWcROy3DvFGNqEPlkxBg305rvk7HabI=
+github.com/kisielk/errcheck v1.20.0/go.mod h1:O+f80MKNwX8Oor2jwgpeQ9An7uJm+hRSgT+h22knRJU=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
 github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
@@ -411,24 +419,22 @@ github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98=
 github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs=
 github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w=
 github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
-github.com/lasiar/canonicalheader v1.1.2 h1:vZ5uqwvDbyJCnMhmFYimgMZnJMjwljN5VGY0VKbMXb4=
-github.com/lasiar/canonicalheader v1.1.2/go.mod h1:qJCeLFS0G/QlLQ506T+Fk/fWMa2VmBUiEI2cuMK4djI=
 github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ=
 github.com/ldez/exptostd v0.4.5/go.mod h1:QRjHRMXJrCTIm9WxVNH6VW7oN7KrGSht69bIRwvdFsM=
-github.com/ldez/gomoddirectives v0.8.0 h1:JqIuTtgvFC2RdH1s357vrE23WJF2cpDCPFgA/TWDGpk=
-github.com/ldez/gomoddirectives v0.8.0/go.mod h1:jutzamvZR4XYJLr0d5Honycp4Gy6GEg2mS9+2YX3F1Q=
+github.com/ldez/gomoddirectives v0.10.0 h1:Zb23rfMMkG21B6pZ9OfESzemByP5Qr7YvWcXQZE/S3Q=
+github.com/ldez/gomoddirectives v0.10.0/go.mod h1:W9uh0721Vc7aaVoiMXTpKIveLmtHC9uaOSiHM4OK5a8=
 github.com/ldez/grignotin v0.10.1 h1:keYi9rYsgbvqAZGI1liek5c+jv9UUjbvdj3Tbn5fn4o=
 github.com/ldez/grignotin v0.10.1/go.mod h1:UlDbXFCARrXbWGNGP3S5vsysNXAPhnSuBufpTEbwOas=
 github.com/ldez/structtags v0.6.1 h1:bUooFLbXx41tW8SvkfwfFkkjPYvFFs59AAMgVg6DUBk=
 github.com/ldez/structtags v0.6.1/go.mod h1:YDxVSgDy/MON6ariaxLF2X09bh19qL7MtGBN5MrvbdY=
-github.com/ldez/tagliatelle v0.7.2 h1:KuOlL70/fu9paxuxbeqlicJnCspCRjH0x8FW+NfgYUk=
-github.com/ldez/tagliatelle v0.7.2/go.mod h1:PtGgm163ZplJfZMZ2sf5nhUT170rSuPgBimoyYtdaSI=
+github.com/ldez/tagliatelle v0.8.0 h1:QczqVPa22JdT40p3m5JTTVmPMv5wDORqdomJn6/Pnn0=
+github.com/ldez/tagliatelle v0.8.0/go.mod h1:K9n83Wv0wyVq3JYF9WI28BX8xXhDBVP3thHJ0ENuiEs=
 github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc=
 github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ=
 github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
 github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
-github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
-github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
+github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE=
 github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
@@ -445,18 +451,18 @@ github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4=
 github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs=
 github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
-github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
-github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=
+github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-shellwords v1.0.14 h1:yUKzIgsCnosndOASY6/enly1EAuaXeFSQ7cdyA3OuYg=
+github.com/mattn/go-shellwords v1.0.14/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mgechev/revive v1.15.0 h1:vJ0HzSBzfNyPbHKolgiFjHxLek9KUijhqh42yGoqZ8Q=
-github.com/mgechev/revive v1.15.0/go.mod h1:LlAKO3QQe9OJ0pVZzI2GPa8CbXGZ/9lNpCGvK4T/a8A=
+github.com/mgechev/revive v1.17.0 h1:hwTTVC3svSv9X2FA2hiYT17Uws+lfxDWhPxzBZZCREg=
+github.com/mgechev/revive v1.17.0/go.mod h1:uiVNUF8ruVh4WHm/aPs7kKEeuo+m6oO3tuOfniyzP/g=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
@@ -476,16 +482,16 @@ github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81
 github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE=
 github.com/nilslice/protolock v0.17.0 h1:sYvcukABl62tZX77H6NuV+jtlwTIfQbn0ln0ixTqr4A=
 github.com/nilslice/protolock v0.17.0/go.mod h1:DYFqop7QlHjmBCaJKfcVO1Mw5b8JejJZgMvmFng/N9Y=
-github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhKRf3Swg=
-github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
+github.com/nishanths/exhaustive v0.13.0 h1:Rof0axOSNQaaPaPmLK5RxcRrJV2Vcv+vfUmuRy+2EAM=
+github.com/nishanths/exhaustive v0.13.0/go.mod h1:3/adQjJgvD/UFHHSYBjpK9Wbz8DOvf0FBtzx+zI0Rlo=
 github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
-github.com/nunnatsa/ginkgolinter v0.23.0 h1:x3o4DGYOWbBMP/VdNQKgSj+25aJKx2Pe6lHr8gBcgf8=
-github.com/nunnatsa/ginkgolinter v0.23.0/go.mod h1:9qN1+0akwXEccwV1CAcCDfcoBlWXHB+ML9884pL4SZ4=
-github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps=
-github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/nunnatsa/ginkgolinter v0.24.0 h1:Mp0EagluLFP98JatP6nqp/gGEoljNG97uf9AcxcBVy8=
+github.com/nunnatsa/ginkgolinter v0.24.0/go.mod h1:2ZMRuzX6+3XXyY6UZOwb6n+MCocVGbkIsDBC4vuWz5c=
+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -499,12 +505,11 @@ github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT9
 github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
@@ -538,17 +543,15 @@ github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl
 github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0=
 github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4lu7Gd+PU1fV2/qnDNfzT635KRSObncs=
 github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
-github.com/raeperd/recvcheck v0.2.0 h1:GnU+NsbiCqdC2XX5+vMZzP+jAJC5fht7rcVTAhX74UI=
-github.com/raeperd/recvcheck v0.2.0/go.mod h1:n04eYkwIR0JbgD73wT8wL4JjPC3wm0nFtzBnWNocnYU=
-github.com/rhysd/actionlint v1.7.12 h1:vQ4GeJN86C0QH+gTUQcs8McmK62OLT3kmakPMtEWYnY=
-github.com/rhysd/actionlint v1.7.12/go.mod h1:krOUhujIsJusovkaYzQ/VNH8PFexjNKqU0q5XI/4w+g=
+github.com/raeperd/recvcheck v0.3.1 h1:p7nZMxiCWkdUtY2i3o+pv1h4fJCR5gpvqAXr9326hEY=
+github.com/raeperd/recvcheck v0.3.1/go.mod h1:CbE7iRocQ4uc71JwpW/CPSh4BShnkre4A9Gb508RypU=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
+github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g=
 github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I=
@@ -558,14 +561,14 @@ github.com/ryanrolds/sqlclosecheck v0.6.0 h1:pEyL9okISdg1F1SEpJNlrEotkTGerv5BMk7
 github.com/ryanrolds/sqlclosecheck v0.6.0/go.mod h1:xyX16hsDaCMXHrMJ3JMzGf5OpDfHTOTTQrT7HOFUmeU=
 github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
 github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw=
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
-github.com/securego/gosec/v2 v2.26.1 h1:gdkttGhQFVehqRJ8grKH4DrpqM/QlPKNHBnl8QgcEC4=
-github.com/securego/gosec/v2 v2.26.1/go.mod h1:57UW4p0uoP3kxoTkhoo3axLdVAi+OWrLg/Ax/kdqtPE=
+github.com/securego/gosec/v2 v2.29.0 h1:pF2HSLcnY5voqpxQumEe0O5YAAbvF4Syu4qeIewpLyc=
+github.com/securego/gosec/v2 v2.29.0/go.mod h1:47C7ej+L2bC1NOxteU2aCGnCi4cZaoKzRt5y9plIvuY=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sethvargo/ratchet v0.12.0 h1:UY1sEevYHi28ryw9c8eHOLonc6oePZDUXHbzx0ESQqw=
@@ -573,14 +576,14 @@ github.com/sethvargo/ratchet v0.12.0/go.mod h1:Unu+6zOcsnJj5x/hKgiaRKbGKPZkysoYk
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
 github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
 github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
 github.com/sonatard/noctx v0.5.1 h1:wklWg9c9ZYugOAk7qG4yP4PBrlQsmSLPTvW1K4PRQMs=
 github.com/sonatard/noctx v0.5.1/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
-github.com/sourcegraph/go-diff v0.8.0 h1:ipIyu4cTsLbIrln4l0qtHA3r0a7gyK4ntKjtQytHhvY=
-github.com/sourcegraph/go-diff v0.8.0/go.mod h1:hWlcO7Al+UZStZAP8rBumHpCK5ZHQ5BXsMls8p4+F5E=
+github.com/sourcegraph/go-diff v0.9.0 h1:7xcVsayWHhvxZGrqt1o89vvBApCa4nyCgO7tNxDHJ+Q=
+github.com/sourcegraph/go-diff v0.9.0/go.mod h1:hWlcO7Al+UZStZAP8rBumHpCK5ZHQ5BXsMls8p4+F5E=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
@@ -601,13 +604,13 @@ github.com/stbenjam/no-sprintf-host-port v0.3.1 h1:AyX7+dxI4IdLBPtDbsGAyqiTSLpCP
 github.com/stbenjam/no-sprintf-host-port v0.3.1/go.mod h1:ODbZesTCHMVKthBHskvUUexdcNHAQRXk9NpSsL8p/HQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
@@ -616,10 +619,10 @@ github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpR
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
 github.com/tetafro/godot v1.5.6 h1:IEkrFCwXaYHlOn4mGzGS3F3dkP6m9t0jpwqBFPIkKiA=
 github.com/tetafro/godot v1.5.6/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
-github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4 h1:SiHe5XLTn9sFWJ5pBwJ5FN/4j34q9ZlOAD//kMoMYp0=
-github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4/go.mod h1:sDHLK7rb/59v/ZxZ7KtymgcoxuUMxjXq8gtu9VMOK8M=
-github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
-github.com/timonwong/loggercheck v0.11.0/go.mod h1:HEAWU8djynujaAVX7QI65Myb8qgfcZ1uKbdpg3ZzKl8=
+github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c h1:d/FUP8GD4QiY/rdFzZmBu3KqL9eBNVzMu7W/5pGkaMM=
+github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c/go.mod h1:sDHLK7rb/59v/ZxZ7KtymgcoxuUMxjXq8gtu9VMOK8M=
+github.com/timonwong/loggercheck v0.12.0 h1:7Cb9XGLJZSWYNjgL459DIhpSiEHupD+MLQ6vaN2Pl3g=
+github.com/timonwong/loggercheck v0.12.0/go.mod h1:Wa6Y+SJHQR01mViZlLLY5GAZVOWOLNMbkXddMjFWQCs=
 github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=
 github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
@@ -630,12 +633,12 @@ github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSW
 github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8=
 github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
 github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
-github.com/uudashr/iface v1.4.2 h1:06Vq5RKVYThBsj0Bnw4oasMjD1r+7CE/bcKOA8dVSvg=
-github.com/uudashr/iface v1.4.2/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
+github.com/uudashr/iface v1.5.1 h1:BS3yrgaT55s3dAtJoxuTnsZNbsejq/mVuzp49YDyfBA=
+github.com/uudashr/iface v1.5.1/go.mod h1:5UWoT6SvTdTww/KToRj6clO+n4Kg3/NrAQvgOB+5Ggw=
 github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
 github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
+github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM=
 github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk=
 github.com/yeya24/promlinter v0.3.0 h1:JVDbMp08lVCP7Y6NP3qHroGAO6z2yGKQtS5JsjqtoFs=
@@ -658,8 +661,8 @@ go-simpler.org/sloglint v0.12.0 h1:UzWDlLWNE5FLqsvyq3tWYHuQMbqrervOhT8qPl4Mmw4=
 go-simpler.org/sloglint v0.12.0/go.mod h1:jBjjC2bm8rYrs88oTRlFX497kWjJsyZWYoNaXkGRI6I=
 go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50=
 go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA=
-go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDojE=
-go.augendre.info/fatcontext v0.9.0/go.mod h1:L94brOAT1OOUNue6ph/2HnwxoNlds9aXDF2FcUntbNw=
+go.augendre.info/fatcontext v0.10.1 h1:HCS/+eob32cM0mEtmZM6NiXdqvS5KiZmsR+fCubTpbc=
+go.augendre.info/fatcontext v0.10.1/go.mod h1:pqpGvA9GlrXy+aXkp8L2dKz12Zp4g2FhzcAtwToU+2w=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -671,10 +674,11 @@ go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
-go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -696,8 +700,8 @@ golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/y
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 h1:qWFG1Dj7TBjOjOvhEOkmyGPVoquqUKnIU0lEVLp8xyk=
-golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
+golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f h1:+lI8cDJ4uceLipg2f1ODay7fEuLkk0BIHXd6PB8icxo=
+golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f/go.mod h1:PqrXSW65cXDZH0k4IeUbhmg/bcAZDbzNz3byBpKCsXo=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -722,8 +726,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -758,8 +762,8 @@ golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -781,8 +785,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -823,15 +827,13 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxDllNhhf/fAx8qIm4t6A7vpm2A=
-golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e h1:P6NGsugec4oASJ+yKMNgTndeo0h2CbixZLvQIe9h5R4=
+golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e/go.mod h1:GNu+nb+E5axfGmP+Uu3ZVQu5lE/Xk42MjZOHWUD94/o=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -843,8 +845,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -895,14 +897,14 @@ golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0t
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
-golang.org/x/vuln v1.6.0 h1:FeMO9Rm/HwyduOztbvKcOw+zvDEPr4I4aQNSfevFcKY=
-golang.org/x/vuln v1.6.0/go.mod h1:bWlG2493/sjR7ksvicBgMrznH3eYQEyK8ifUYBrqUbg=
+golang.org/x/vuln v1.9.0 h1:12VaqnI9kJfqwRoPptxoqsUhQtdfrSbdksT7X/KY/sc=
+golang.org/x/vuln v1.9.0/go.mod h1:E/Frwm0xp49fTyBW+6CQHdkvobknbwUM49yEpMGUauw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -982,14 +984,13 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
@@ -1011,12 +1012,12 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
-honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
-mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4=
-mvdan.cc/gofumpt v0.9.2/go.mod h1:iB7Hn+ai8lPvofHd9ZFGVg2GOr8sBUw1QUWjNbmIL/s=
-mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 h1:ssMzja7PDPJV8FStj7hq9IKiuiKhgz9ErWw+m68e7DI=
-mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15/go.mod h1:4M5MMXl2kW6fivUT6yRGpLLPNfuGtU2Z0cPvFquGDYU=
+honnef.co/go/tools v0.8.1 h1:+JKf3xJ1ni4CwrhVg4/pqsfPGP6vNAXcKbMXJodYx3w=
+honnef.co/go/tools v0.8.1/go.mod h1:XA+OnlRA9EDh/ukGvXMNSZNKGwFQJ+5dER0ioUkOxks=
+mvdan.cc/gofumpt v0.12.0 h1:1Lbudkz2kpM9Cjz2pL4M19u7q+GaEhCTNf7N9mfpcho=
+mvdan.cc/gofumpt v0.12.0/go.mod h1:SmBHHrljiZu/uoypeKup3rFzP6eoC9UwCp2iH5E3jZA=
+mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 h1:Re1NRyLpiAt9kB+ImaaoapwWiQXrKwER4tY8fLOkDew=
+mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8/go.mod h1:MrS/+zJ1M2xvGXhKktiHbNQeQPyg3Qel+KkzT+f7/i4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/tools/linters/tools-import.go b/tools/linters/tools-import.go
index c25dd3d3ed84e..ba96ee84647f5 100644
--- a/tools/linters/tools-import.go
+++ b/tools/linters/tools-import.go
@@ -8,9 +8,9 @@ package tools
 
 import (
 	// Tool dependencies, not used anywhere in the code.
+	_ "actionlint.kjanat.dev/cmd/actionlint"
 	_ "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
 	_ "github.com/nilslice/protolock"
-	_ "github.com/rhysd/actionlint/cmd/actionlint"
 	_ "github.com/sethvargo/ratchet"
 	_ "golang.org/x/vuln/cmd/govulncheck"
 )
diff --git a/tools/local-sensor/main.go b/tools/local-sensor/main.go
index a4a2996402042..2684583170dc6 100644
--- a/tools/local-sensor/main.go
+++ b/tools/local-sensor/main.go
@@ -487,8 +487,8 @@ func main() {
 		}()
 	}
 
-	// CreateSensor will set up the workload manager handlers (SetSignalHandlers, SetVMIndexReportHandler, SetVMStore)
-	// if workloadManager is not nil and VirtualMachines feature is enabled
+	// CreateSensor will set up the workload manager handlers (SetSignalHandlers)
+	// if workloadManager is not nil.
 	s, err := sensor.CreateSensor(sensorConfig)
 	if err != nil {
 		panic(err)
diff --git a/tools/proto/go.mod b/tools/proto/go.mod
index b86088a333a04..cf4a606c9fb9a 100644
--- a/tools/proto/go.mod
+++ b/tools/proto/go.mod
@@ -1,35 +1,36 @@
 module github.com/stackrox/stackrox/tools/proto
 
-go 1.26.3
+go 1.26.7
 
 require (
-	github.com/bufbuild/buf v1.72.0
+	github.com/bufbuild/buf v1.73.0
 	github.com/favadi/protoc-go-inject-tag v1.4.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/protobuf v1.36.12
 )
 
 require (
-	buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.11-20260626152828-968bf0468096.1 // indirect
-	buf.build/gen/go/bufbuild/protodescriptor/protocolbuffers/go v1.36.11-20250109164928-1da0de137947.1 // indirect
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260709200747-435963d16310.1 // indirect
-	buf.build/gen/go/bufbuild/registry/connectrpc/go v1.20.0-20260713175918-10d915f5b43b.1 // indirect
-	buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.36.11-20260713175918-10d915f5b43b.1 // indirect
-	buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.11-20241007202033-cf42259fcbfc.1 // indirect
-	buf.build/go/app v0.2.1-0.20260626143626-be153867abea // indirect
+	buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.12-20260722160903-4d94f3df3a7b.2 // indirect
+	buf.build/gen/go/bufbuild/protodescriptor/protocolbuffers/go v1.36.12-20250109164928-1da0de137947.2 // indirect
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 // indirect
+	buf.build/gen/go/bufbuild/registry/connectrpc/go v1.20.0-20260831211851-b4432e12a6e7.1 // indirect
+	buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.36.12-20260831211851-b4432e12a6e7.2 // indirect
+	buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.12-20241007202033-cf42259fcbfc.2 // indirect
+	buf.build/go/app v0.2.1-0.20260824172350-b0e76892c61a // indirect
 	buf.build/go/bufplugin v0.10.0 // indirect
 	buf.build/go/bufprivateusage v0.1.0 // indirect
 	buf.build/go/interrupt v1.1.0 // indirect
-	buf.build/go/protovalidate v1.2.0 // indirect
+	buf.build/go/protovalidate v1.4.0 // indirect
 	buf.build/go/protoyaml v0.7.0 // indirect
 	buf.build/go/spdx v0.2.0 // indirect
 	buf.build/go/standard v0.1.1-0.20260325175353-2b287e071df5 // indirect
-	cel.dev/expr v0.25.2 // indirect
+	cel.dev/cel-go v0.32.0 // indirect
+	cel.dev/expr v0.25.3 // indirect
 	connectrpc.com/connect v1.20.0 // indirect
 	connectrpc.com/otelconnect v0.9.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
-	github.com/bufbuild/protocompile v0.14.2-0.20260716165721-bb5762d29672 // indirect
+	github.com/bufbuild/protocompile v0.14.2-0.20260910151042-7436f7c76201 // indirect
 	github.com/bufbuild/protoplugin v0.0.0-20260414125817-25d1d281b46b // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cli/browser v1.3.0 // indirect
@@ -37,37 +38,36 @@ require (
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v29.6.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.8 // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/cli v29.8.0+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.9 // indirect
+	github.com/docker/go-connections v0.8.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/gofrs/flock v0.13.0 // indirect
-	github.com/google/cel-go v0.29.2 // indirect
-	github.com/google/go-containerregistry v0.21.7 // indirect
+	github.com/gofrs/flock v0.13.1 // indirect
+	github.com/google/go-containerregistry v0.22.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jdx/go-netrc v1.0.0 // indirect
-	github.com/klauspost/compress v1.19.0 // indirect
+	github.com/klauspost/compress v1.20.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.23 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/moby/api v1.55.0 // indirect
-	github.com/moby/moby/client v0.5.0 // indirect
+	github.com/moby/moby/api v1.56.0 // indirect
+	github.com/moby/moby/client v0.6.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/petermattis/goid v0.0.0-20260716134002-a9b348f0a2b9 // indirect
+	github.com/petermattis/goid v0.0.0-20260820044319-269ab09b5261 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.60.0 // indirect
+	github.com/quic-go/quic-go v0.62.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/cors v1.11.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
 	github.com/segmentio/encoding v0.5.4 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/tetratelabs/wazero v1.12.0 // indirect
@@ -77,24 +77,24 @@ require (
 	go.lsp.dev/protocol v0.12.0 // indirect
 	go.lsp.dev/uri v0.3.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
+	go.opentelemetry.io/otel v1.46.0 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/trace v1.46.0 // indirect
 	go.uber.org/mock v0.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.28.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
-	golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 // indirect
-	golang.org/x/mod v0.38.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
+	golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa // indirect
+	golang.org/x/mod v0.40.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	mvdan.cc/xurls/v2 v2.6.0 // indirect
 	pluginrpc.com/pluginrpc v0.5.0 // indirect
diff --git a/tools/proto/go.sum b/tools/proto/go.sum
index d51ed71ab7c1d..ab10596db0edb 100644
--- a/tools/proto/go.sum
+++ b/tools/proto/go.sum
@@ -1,33 +1,35 @@
-buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.11-20260626152828-968bf0468096.1 h1:bHi5/cwz7IPRhFcrRA4iytTjDI3WwFkv1m5K7y+YOTc=
-buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.11-20260626152828-968bf0468096.1/go.mod h1:1Znr6gmYBhbxWUPRrrVnSLXQsz8bvFVw1HHJq2bI3VQ=
-buf.build/gen/go/bufbuild/protodescriptor/protocolbuffers/go v1.36.11-20250109164928-1da0de137947.1 h1:HwzzCRS4ZrEm1++rzSDxHnO0DOjiT1b8I/24e8a4exY=
-buf.build/gen/go/bufbuild/protodescriptor/protocolbuffers/go v1.36.11-20250109164928-1da0de137947.1/go.mod h1:8PRKXhgNes29Tjrnv8KdZzg3I1QceOkzibW1QK7EXv0=
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260709200747-435963d16310.1 h1:fXh8CsdNpjRr8R5vFdqtIxPt/Lno2IIJlYOdZBIZn0w=
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260709200747-435963d16310.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM=
-buf.build/gen/go/bufbuild/registry/connectrpc/go v1.20.0-20260713175918-10d915f5b43b.1 h1:c4w6fQ6wAhZLgVI+HZozlWX9I2aVPN34vrl/8cuovVc=
-buf.build/gen/go/bufbuild/registry/connectrpc/go v1.20.0-20260713175918-10d915f5b43b.1/go.mod h1:mbcuFKpnCQsF8H2fBs1lN1dQVAiASPQKwFgTkXqYscI=
-buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.36.11-20260713175918-10d915f5b43b.1 h1:qJUlFKLFdb3OFCpmA+r5AQbysgBD7WLRapE9lOs08r8=
-buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.36.11-20260713175918-10d915f5b43b.1/go.mod h1:1JJi9jvOqRxSMa+JxiZSm57doB+db/1WYCIa2lHfc40=
-buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.11-20241007202033-cf42259fcbfc.1 h1:iGPvEJltOXUMANWf0zajcRcbiOXLD90ZwPUFvbcuv6Q=
-buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.11-20241007202033-cf42259fcbfc.1/go.mod h1:nWVKKRA29zdt4uvkjka3i/y4mkrswyWwiu0TbdX0zts=
-buf.build/go/app v0.2.1-0.20260626143626-be153867abea h1:krHaIyUJSTnurb0fbYQtsXkZWiWQ/ydOgfm61TPSODc=
-buf.build/go/app v0.2.1-0.20260626143626-be153867abea/go.mod h1:V32mBaPWsfq6REAeZvvs/rQl7ZCl9Dn7eW1BBrmH0GQ=
+buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.12-20260722160903-4d94f3df3a7b.2 h1:z5+rVknD0AvorY/QV9cb3ohUXw4E7HvxU4+2JUH6EHU=
+buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.12-20260722160903-4d94f3df3a7b.2/go.mod h1:Owcuj2phVyvThVYCD74iSV8ki0dAXw/uxkdcdZScdCc=
+buf.build/gen/go/bufbuild/protodescriptor/protocolbuffers/go v1.36.12-20250109164928-1da0de137947.2 h1:tE4A2RVukQOSd4K+6ndK+8s65FbjiBt2k5CiddXxCCo=
+buf.build/gen/go/bufbuild/protodescriptor/protocolbuffers/go v1.36.12-20250109164928-1da0de137947.2/go.mod h1:Gjxz0o7qPHokNsmlX8D+/aKd29NRLRr9CCUkPeMAzJ0=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 h1:NbnlmV26O7oZ1iM5tsCI+GEx+3ZSdrhvnKQ/eWSrLiY=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2/go.mod h1:TCt1lluMFnctISJXvkIQ4x3ABrPuUKCWKyjKdkJNBpw=
+buf.build/gen/go/bufbuild/registry/connectrpc/go v1.20.0-20260831211851-b4432e12a6e7.1 h1:BpToyjv+oz0qldatN/ZFTL+vVtPVavFCY+g4rRu03bs=
+buf.build/gen/go/bufbuild/registry/connectrpc/go v1.20.0-20260831211851-b4432e12a6e7.1/go.mod h1:hMqlU8iWXqCU7UOBs8PTDG/z7BFnhIknJZ4XMWcBx3E=
+buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.36.12-20260831211851-b4432e12a6e7.2 h1:cik2XvKM1UV8HgLWD2vnBvV4GgT5NfpLJBb9UgLKzzg=
+buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.36.12-20260831211851-b4432e12a6e7.2/go.mod h1:91H8i3iR9GoomNkM9X13RTFL8cVNAHnS44BdgAnbqz4=
+buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.12-20241007202033-cf42259fcbfc.2 h1:9xw8g8Q6zHLC7CO/jtpl2UK0kQticxIG+mI6N86f2/M=
+buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.12-20241007202033-cf42259fcbfc.2/go.mod h1:+0bw+k8FY5MU3tojFh33HeA5xMfGWjAUQpr+maW5Z3o=
+buf.build/go/app v0.2.1-0.20260824172350-b0e76892c61a h1:m3hkeJOeLSq/1yTSMLyV5ipY6u3XrfS3gV8ZIqkUJJA=
+buf.build/go/app v0.2.1-0.20260824172350-b0e76892c61a/go.mod h1:w19H+Lh2cAV/uL1FhcdDlyoxLTm8SkQAHW3CfmXZbFU=
 buf.build/go/bufplugin v0.10.0 h1:vZBX0mq9as5UIBug8U+/DkGRaHNlM/HVOw59O8fvOIU=
 buf.build/go/bufplugin v0.10.0/go.mod h1:ax7obVurKDH1I2nR4pFTS+TE6K3kZhTmwDCN2YgdV8I=
 buf.build/go/bufprivateusage v0.1.0 h1:SzCoCcmzS3zyXHEXHeSQhGI7OTkgtljoknLzsUz9Gg4=
 buf.build/go/bufprivateusage v0.1.0/go.mod h1:GlCCJ3VVF7EqqU0CoRmo1FzAwwaKymEWSr+ty69xU5w=
 buf.build/go/interrupt v1.1.0 h1:olBuhgv9Sav4/9pkSLoxgiOsZDgM5VhRhvRpn3DL0lE=
 buf.build/go/interrupt v1.1.0/go.mod h1:ql56nXPG1oHlvZa6efNC7SKAQ/tUjS6z0mhJl0gyeRM=
-buf.build/go/protovalidate v1.2.0 h1:DQVrUWkmGTBij+kOYv/x2LLxwcLaGKMdzShj1/6/3H0=
-buf.build/go/protovalidate v1.2.0/go.mod h1:7rYiQEhqvAipoazpVNBBH2S2f8bjG4huMVy1V2Yofn4=
+buf.build/go/protovalidate v1.4.0 h1:UjLrYbt5VX7+TMOs2+pG5FhZhIG1mSfK4EIopbb4LcM=
+buf.build/go/protovalidate v1.4.0/go.mod h1:8vJfzNT6NIG2qm3uFsJDXMlRmG+bQJzbcIn1Aa0vPGs=
 buf.build/go/protoyaml v0.7.0 h1:z4oVoFicbpPefhT7WAykxUdfp0yEQlhMQ2mCZOY5V38=
 buf.build/go/protoyaml v0.7.0/go.mod h1:+a0cavd0uMvirb87xdu2ZMMmjlIQoiH/N2Ich5MGSQ0=
 buf.build/go/spdx v0.2.0 h1:IItqM0/cMxvFJJumcBuP8NrsIzMs/UYjp/6WSpq8LTw=
 buf.build/go/spdx v0.2.0/go.mod h1:bXdwQFem9Si3nsbNy8aJKGPoaPi5DKwdeEp5/ArZ6w8=
 buf.build/go/standard v0.1.1-0.20260325175353-2b287e071df5 h1:njYKSWoLiq2i5O7y2bPPU2Yzp7iAU0Wk9KJ2OoAhNiU=
 buf.build/go/standard v0.1.1-0.20260325175353-2b287e071df5/go.mod h1:DQmodNT9EHX94WzUaWiZK+/4EaFa/xZTc1gzfCxZVXU=
-cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
-cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/cel-go v0.32.0 h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
+cel.dev/cel-go v0.32.0/go.mod h1:DnVip7tpJSsgZymwfT+m1tnEVy3ivAjSMXPx12YrMkU=
+cel.dev/expr v0.25.3 h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
+cel.dev/expr v0.25.3/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 connectrpc.com/connect v1.20.0 h1:6TNDAB+WeNd2uolWNlYczB5E0KNNaVMNUEx8JEUsPmQ=
 connectrpc.com/connect v1.20.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
 connectrpc.com/grpcreflect v1.3.0 h1:Y4V+ACf8/vOb1XOc251Qun7jMB75gCUNw6llvB9csXc=
@@ -42,10 +44,10 @@ github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6
 github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/brianvoe/gofakeit/v6 v6.28.0 h1:Xib46XXuQfmlLS2EXRuJpqcw8St6qSZz75OUo0tgAW4=
 github.com/brianvoe/gofakeit/v6 v6.28.0/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs=
-github.com/bufbuild/buf v1.72.0 h1:VMmGFtCLrxyS2wkpghExmhhiqJDdmc8DcwAvsGJGJ94=
-github.com/bufbuild/buf v1.72.0/go.mod h1:bhtIlPDo3q/PDw4yaTdx2+jxkc33Aq+ygFIi6Diz2yU=
-github.com/bufbuild/protocompile v0.14.2-0.20260716165721-bb5762d29672 h1:6xykiXQPoF/hhOjAhwiHQ0kgcAvrDZw0Tjl1VQkpu5c=
-github.com/bufbuild/protocompile v0.14.2-0.20260716165721-bb5762d29672/go.mod h1:jPUiZUFWc8E3Kc2Y4SRlGAdjde4amGkHY0BUACNS43E=
+github.com/bufbuild/buf v1.73.0 h1:fDNKlxaf+PYi20dmVM7Yt3kOfXEhwrgKDLMNZFjztDs=
+github.com/bufbuild/buf v1.73.0/go.mod h1:rfWpi8FmfTPW4CbLFIXZYAux2FWBiCMY6BUOlGqnR84=
+github.com/bufbuild/protocompile v0.14.2-0.20260910151042-7436f7c76201 h1:jBaIQ1eixwqtjBKJk8gw+dKtmbkp3w8sLJtJ7kav1EE=
+github.com/bufbuild/protocompile v0.14.2-0.20260910151042-7436f7c76201/go.mod h1:bX3ObJfML+aki7PJevkWLSlOfEZ8EnNsfCz0hiYkhiI=
 github.com/bufbuild/protoplugin v0.0.0-20260414125817-25d1d281b46b h1:b7wvo9ZhjLzCp7tGbOUMvgtYTnd33zGSAmMxcdxMnhQ=
 github.com/bufbuild/protoplugin v0.0.0-20260414125817-25d1d281b46b/go.mod h1:c5D8gWRIZ2HLWO3gXYTtUfw/hbJyD8xikv2ooPxnklQ=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -59,16 +61,14 @@ github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmC
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v29.6.1+incompatible h1:oO7F4nn3Ovr/5TlfTUWFbMwBSS/B7Xs6Epv26gBrUP8=
-github.com/docker/cli v29.6.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
-github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/cli v29.8.0+incompatible h1:ih0c2jq/nN7QfES8zIfwSzIhRScjs4ehER+kZ60aeSk=
+github.com/docker/cli v29.8.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker-credential-helpers v0.9.9 h1:BkydjIgZ46JnDbqyM2p2fc63KMw6y+KHL3Em/2AGJ7w=
+github.com/docker/docker-credential-helpers v0.9.9/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
+github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
+github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/favadi/protoc-go-inject-tag v1.4.0 h1:K3KXxbgRw5WT4f43LbglARGz/8jVsDOS7uMjG4oNvXY=
@@ -76,19 +76,17 @@ github.com/favadi/protoc-go-inject-tag v1.4.0/go.mod h1:AZ+PK+QDKUOLlBRG0rYiKkUX
 github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
-github.com/google/cel-go v0.29.2 h1:ZtDxkeiMmz0mxbKDYiNkE5Lk7V5edMRcaaDf2jX002k=
-github.com/google/cel-go v0.29.2/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
+github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
+github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU=
-github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE=
+github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84=
+github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -97,8 +95,8 @@ github.com/jdx/go-netrc v1.0.0 h1:QbLMLyCZGj0NA8glAhxUpf1zDg6cxnWgMBbjq40W0gQ=
 github.com/jdx/go-netrc v1.0.0/go.mod h1:Gh9eFQJnoTNIRHXl2j5bJXA1u84hQWJWgGh569zF3v8=
 github.com/jhump/protoreflect/v2 v2.0.0-beta.2 h1:qZU+rEZUOYTz1Bnhi3xbwn+VxdXkLVeEpAeZzVXLY88=
 github.com/jhump/protoreflect/v2 v2.0.0-beta.2/go.mod h1:4tnOYkB/mq7QTyS3YKtVtNrJv4Psqout8HA1U+hZtgM=
-github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
-github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -107,20 +105,20 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.23 h1:cYwCQTQf3HB6xUC+BtyCLZNr7IzbOmoZbmssVNzSyiQ=
-github.com/mattn/go-isatty v0.0.23/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
-github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.5.0 h1:5XhyPk2fuOWf6RlSFa3MkIIgDZkF25xToXW8Q/BH7cc=
-github.com/moby/moby/client v0.5.0/go.mod h1:rcVpF8ncl9vo5gaIBdol6CnbEtSj1uxMvEV/UrykF/s=
+github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ=
+github.com/moby/moby/api v1.56.0/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
+github.com/moby/moby/client v0.6.0 h1:AJjEB21QPbXSXjDsZorFBoDZPhMrfbpaPLgSMAW9Bgs=
+github.com/moby/moby/client v0.6.0/go.mod h1:OCo00wNRyA3m4lmJ228W3JbyCN4ZNNYjpOXiJydBdcQ=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/petermattis/goid v0.0.0-20260716134002-a9b348f0a2b9 h1:UyKlK0Ke63afxhHrgJAk8KlCt+kP9KYBRUsWG6lK2WM=
-github.com/petermattis/goid v0.0.0-20260716134002-a9b348f0a2b9/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/petermattis/goid v0.0.0-20260820044319-269ab09b5261 h1:lcWAnrqr2nNfDiArwFNHCE4787Mw2tCdVSOXCru0/0E=
+github.com/petermattis/goid v0.0.0-20260820044319-269ab09b5261/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/protocolbuffers/protoscope v0.0.0-20221109213918-8e7a6aafa2c9 h1:arwj11zP0yJIxIRiDn22E0H8PxfF7TsTrc2wIPFIsf4=
@@ -129,8 +127,8 @@ github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.60.0 h1:xcQioE8OM66UQLeUMHltK1CCcOu3JbVB4JAQdDQSB+0=
-github.com/quic-go/quic-go v0.60.0/go.mod h1:wpKpjmPpftl30sL6pFh7REVpjbcCVy4zt2vDyK1TuJk=
+github.com/quic-go/quic-go v0.62.0 h1:ZHDjCk5OacATwGvs8PWE97CTvX7AqZiVoW7++ZOXTf8=
+github.com/quic-go/quic-go v0.62.0/go.mod h1:RAro2j2yN9a9EiPACLHT9IB2NXCvGQmmo/alT0yYI0w=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rodaine/protogofakeit v0.1.1 h1:ZKouljuRM3A+TArppfBqnH8tGZHOwM/pjvtXe9DaXH8=
@@ -145,15 +143,15 @@ github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
 github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/segmentio/encoding v0.5.4 h1:OW1VRern8Nw6ITAtwSZ7Idrl3MXCFwXHPgqESYfvNt0=
 github.com/segmentio/encoding v0.5.4/go.mod h1:HS1ZKa3kSN32ZHVZ7ZLPLXWvOVIiZtyJnO1gPH1sKt0=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
 github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
 github.com/tidwall/btree v1.8.1 h1:27ehoXvm5AG/g+1VxLS1SD3vRhp/H7LuEfwNvddEdmA=
@@ -168,18 +166,18 @@ go.lsp.dev/uri v0.3.0 h1:KcZJmh6nFIBeJzTugn5JTU6OOyG0lDOo3R9KwTxTYbo=
 go.lsp.dev/uri v0.3.0/go.mod h1:P5sbO1IQR+qySTWOCnhnK7phBx+W3zbLqSMDJNTw88I=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
+go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
+go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
+go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
@@ -188,37 +186,38 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
 go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 h1:qLvzZeaANDgyVOA8pyHCOStGlXn0rseXma+GQjeuv2g=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa h1:QSyA8ishJCyT21kER9KwNt0b7BM3iRK4x9QXhjN5Fdk=
+golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa/go.mod h1:zeBbvyFKDaLwa7CH/zI8KXt7gTl14SF7sO08Pl5jBCM=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d h1:QwnJwPte4XXAkhPu26LTDIahnsMSUV0kK8HkxbC+Pc4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d/go.mod h1:WRrQ7/7N19PypuT0fxLOL5Lq0waoiRri4FbtHDEKrGE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d h1:Jkpk39hlTZOIp3RbfvNX9R8Hv+Sw0X89nlU/xFOErsc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.0 h1:W3G9N3KQf3BU+YuCtGKJk0CmxQNbAISICD/9AORxLIw=
-google.golang.org/grpc v1.81.0/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4 h1:NCe/UiklGd/9xjT+ROBVhJ1kf6TRQaFedsR+z7u1gvo=
+google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4/go.mod h1:fJ2lYaWjqNknJyQBOCd0fA3HnEElJqGplH71a2txi+g=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 h1:5t+ZydAFj5kGVLrgCvLmpmCf9ylGRd64hpEronfRaws=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/tools/retest/github.go b/tools/retest/github.go
index 776ea0fc13e98..8c838a1a5018d 100644
--- a/tools/retest/github.go
+++ b/tools/retest/github.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/google/go-github/v60/github"
+	"github.com/google/go-github/v91/github"
 )
 
 func createComment(ctx context.Context, client *github.Client, prNumber int, comment string) {
@@ -17,8 +17,8 @@ func createComment(ctx context.Context, client *github.Client, prNumber int, com
 		return
 	}
 	log.Printf("#%d will be commented with: %s", prNumber, comment)
-	issueComment := &github.IssueComment{
-		Body: &comment,
+	issueComment := github.IssueCommentRequest{
+		Body: comment,
 	}
 	c, _, err := client.Issues.CreateComment(ctx, s, s, prNumber, issueComment)
 	if err != nil {
@@ -135,7 +135,7 @@ func statusesForPR(ctx context.Context, client *github.Client, url string) (map[
 	if err != nil {
 		return nil, err
 	}
-	_, err = client.Do(ctx, statusRequest, &statuses)
+	_, err = client.Do(statusRequest.WithContext(ctx), &statuses)
 	if err != nil {
 		return nil, err
 	}
diff --git a/tools/retest/github_test.go b/tools/retest/github_test.go
index fabff57738d4e..0eb035553ceae 100644
--- a/tools/retest/github_test.go
+++ b/tools/retest/github_test.go
@@ -3,7 +3,7 @@ package main
 import (
 	"testing"
 
-	"github.com/google/go-github/v60/github"
+	"github.com/google/go-github/v91/github"
 	"github.com/stretchr/testify/assert"
 )
 
diff --git a/tools/retest/main.go b/tools/retest/main.go
index 982da62a7407a..9c493bc0152d2 100644
--- a/tools/retest/main.go
+++ b/tools/retest/main.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/google/go-github/v60/github"
+	"github.com/google/go-github/v91/github"
 )
 
 var allowedCheckFailurePrefixes = []string{
@@ -52,7 +52,10 @@ const s = "stackrox"
 func main() {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
-	client := github.NewClient(nil).WithAuthToken(os.Getenv("GITHUB_TOKEN"))
+	client, err := github.NewClient(github.WithAuthToken(os.Getenv("GITHUB_TOKEN")))
+	if err != nil {
+		log.Fatal(err.Error())
+	}
 	if err := run(ctx, client); err != nil {
 		log.Fatal(err.Error())
 	}
diff --git a/tools/retest/main_integration_test.go b/tools/retest/main_integration_test.go
index 185430b8db45e..cb3c591564272 100644
--- a/tools/retest/main_integration_test.go
+++ b/tools/retest/main_integration_test.go
@@ -6,11 +6,11 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"testing"
 
-	"github.com/google/go-github/v60/github"
+	"github.com/google/go-github/v91/github"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestIntegration(t *testing.T) {
@@ -198,10 +198,9 @@ func TestIntegration(t *testing.T) {
 	server = httptest.NewServer(http.HandlerFunc(handler))
 	t.Cleanup(server.Close)
 
-	client := github.NewClient(server.Client())
-	parse, err := url.Parse(server.URL + "/")
-	assert.NoError(t, err)
-	client.BaseURL = parse
+	baseURL := server.URL + "/"
+	client, err := github.NewClient(github.WithHTTPClient(server.Client()), github.WithURLs(&baseURL, nil))
+	require.NoError(t, err)
 
 	err = run(context.Background(), client)
 	assert.NoError(t, err)
@@ -221,12 +220,11 @@ func TestGetStatuses(t *testing.T) {
 	server = httptest.NewServer(http.HandlerFunc(handler))
 	t.Cleanup(server.Close)
 
-	client := github.NewClient(server.Client())
-	baseUrl, err := url.Parse(server.URL + "/")
-	assert.NoError(t, err)
-	client.BaseURL = baseUrl
+	baseURL2 := server.URL + "/"
+	client, err := github.NewClient(github.WithHTTPClient(server.Client()), github.WithURLs(&baseURL2, nil))
+	require.NoError(t, err)
 
-	statuses, err := statusesForPR(context.Background(), client, baseUrl.String())
+	statuses, err := statusesForPR(context.Background(), client, baseURL2)
 	assert.NoError(t, err)
 	assert.Equal(t, map[string]jobState{"gke-upgrade-tests": jobOK}, statuses)
 }
diff --git a/tools/roxvet/common/traverse.go b/tools/roxvet/common/traverse.go
index 5a4d2ce5fd22c..358a16d3498a9 100644
--- a/tools/roxvet/common/traverse.go
+++ b/tools/roxvet/common/traverse.go
@@ -2,6 +2,7 @@ package common
 
 import (
 	"go/ast"
+	"slices"
 
 	"golang.org/x/tools/go/ast/inspector"
 )
@@ -11,7 +12,7 @@ import (
 func FilteredPreorder(inspector *inspector.Inspector, fileFilter FileFilter, nodeTypes []ast.Node, fn func(n ast.Node)) {
 	// Limit the nodeTypes slice's capacity to its length. This ensures that any call to `append` will not write into
 	// the backing storage, but allocate a new slice.
-	effectiveTypes := nodeTypes[:len(nodeTypes):len(nodeTypes)]
+	effectiveTypes := slices.Clip(nodeTypes)
 	hadFile := hasFile(nodeTypes)
 	if !hadFile {
 		effectiveTypes = append(effectiveTypes, (*ast.File)(nil))
@@ -33,7 +34,7 @@ func FilteredPreorder(inspector *inspector.Inspector, fileFilter FileFilter, nod
 // FilteredNodes calls `inspector.Nodes(nodeTypes, fn)`, but filters out all files that do not pass the given
 // fileFilter.
 func FilteredNodes(inspector *inspector.Inspector, fileFilter FileFilter, nodeTypes []ast.Node, fn func(n ast.Node, push bool) bool) {
-	effTypes := nodeTypes[:len(nodeTypes):len(nodeTypes)]
+	effTypes := slices.Clip(nodeTypes)
 	hadFile := hasFile(nodeTypes)
 	if !hadFile {
 		effTypes = append(effTypes, (*ast.File)(nil))
diff --git a/tools/test/go.mod b/tools/test/go.mod
index 0250c0b26ad96..a3abe16a62fec 100644
--- a/tools/test/go.mod
+++ b/tools/test/go.mod
@@ -4,24 +4,24 @@ go 1.26.3
 
 require (
 	github.com/jstemmer/go-junit-report/v2 v2.1.0
-	github.com/stackrox/image-prefetcher/deploy v0.5.1
+	github.com/stackrox/image-prefetcher/deploy v0.6.0
 	github.com/stackrox/prometheus-metric-parser v0.0.0-20240718111853-be492d554cd5
 )
 
 require (
-	cloud.google.com/go/auth v0.5.1 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/monitoring v1.19.0 // indirect
+	cloud.google.com/go/monitoring v1.24.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/s2a-go v0.1.7 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.4 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
+	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -31,24 +31,24 @@ require (
 	github.com/prometheus/prom2json v1.3.3 // indirect
 	github.com/spf13/cobra v1.10.1 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/api v0.183.0 // indirect
-	google.golang.org/genproto v0.0.0-20240610135401-a8a62080eff3 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
-	google.golang.org/grpc v1.82.1 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/api v0.264.0 // indirect
+	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )
diff --git a/tools/test/go.sum b/tools/test/go.sum
index e42424d0c4d2d..9e50e8218aac6 100644
--- a/tools/test/go.sum
+++ b/tools/test/go.sum
@@ -1,73 +1,44 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/auth v0.5.1 h1:0QNO7VThG54LUzKiQxv8C6x1YX7lUrzlAa1nVLF8CIw=
-cloud.google.com/go/auth v0.5.1/go.mod h1:vbZT8GjzDf3AVqCcQmqeeM32U9HBFc32vVVAbwDsa6s=
-cloud.google.com/go/auth/oauth2adapt v0.2.2 h1:+TTV8aXpjeChS9M+aTtN/TjdQnzJvmzKFt//oWu7HX4=
-cloud.google.com/go/auth/oauth2adapt v0.2.2/go.mod h1:wcYjgpZI9+Yu7LyYBg4pqSiaRkfEK3GQcpb7C/uyF1Q=
+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-cloud.google.com/go/monitoring v1.19.0 h1:NCXf8hfQi+Kmr56QJezXRZ6GPb80ZI7El1XztyUuLQI=
-cloud.google.com/go/monitoring v1.19.0/go.mod h1:25IeMR5cQ5BoZ8j1eogHE5VPJLlReQ7zFp5OiLgiGZw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
+cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
 github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
-github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
-github.com/googleapis/gax-go/v2 v2.12.4 h1:9gWcmF85Wvq4ryPFvGFaOgPIs1AQX0d0bcbGw4Z96qg=
-github.com/googleapis/gax-go/v2 v2.12.4/go.mod h1:KYEYLorsnIGDi/rPC8b5TdlB9kbKoFubselGIoBMCwI=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
+github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
+github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jstemmer/go-junit-report/v2 v2.1.0 h1:X3+hPYlSczH9IMIpSC9CQSZA0L+BipYafciZUWHEmsc=
@@ -78,10 +49,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
 github.com/prometheus/common v0.54.0 h1:ZlZy0BgJhTwVZUn7dLOkwCZHUkrAqd3WYtcFCWnM1D8=
@@ -94,115 +63,59 @@ github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stackrox/image-prefetcher/deploy v0.5.1 h1:M0XBgUbmTgR4y3lTXxfL0Drd0tncHSZHWtsQqnXmCEA=
-github.com/stackrox/image-prefetcher/deploy v0.5.1/go.mod h1:bAhl/GuKJnAchWpAYkEaoqfaJHqCkbBKhLDWHm1GXLs=
+github.com/stackrox/image-prefetcher/deploy v0.6.0 h1:KLH2unXZSFEbPOakWliu9XXRmzInytkGiNk3zQtuWxs=
+github.com/stackrox/image-prefetcher/deploy v0.6.0/go.mod h1:rz+MNwLZL+Ur3rNABFPggUIfW/z/BOdfKfmCS/3L83g=
 github.com/stackrox/prometheus-metric-parser v0.0.0-20240718111853-be492d554cd5 h1:gAg8XyBlWRq8Ia4uTPmhNUnVYtiDN4eiqviJ+tD87xw=
 github.com/stackrox/prometheus-metric-parser v0.0.0-20240718111853-be492d554cd5/go.mod h1:y4d4bwvOygvByIxM/g0XCzBKMryqXilCk4Lj+mMBsVM=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
-go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 h1:vS1Ao/R55RNV4O7TA2Qopok8yN+X0LIP6RVWLFkprck=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0/go.mod h1:BMsdeOxN04K0L5FNUBfjFdvwWGNe/rkmSwH4Aelu/X0=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 h1:LoYXNGAShUG3m/ehNk4iFctuhGX/+R1ZpfJ4/ia80JM=
 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.183.0 h1:PNMeRDwo1pJdgNcFQ9GstuLe/noWKIc89pRWRLMvLwE=
-google.golang.org/api v0.183.0/go.mod h1:q43adC5/pHoSZTx5h2mSmdF7NcyfW9JuDyIOJAgS9ZQ=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240610135401-a8a62080eff3 h1:8RTI1cmuvdY9J7q/jpJWEj5UfgWjhV5MCoXaYmwLBYQ=
-google.golang.org/genproto v0.0.0-20240610135401-a8a62080eff3/go.mod h1:qb66gsewNb7Ghv1enkhJiRfYGWUklv3n6G8UvprOhzA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
-google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/api v0.264.0 h1:+Fo3DQXBK8gLdf8rFZ3uLu39JpOnhvzJrLMQSoSYZJM=
+google.golang.org/api v0.264.0/go.mod h1:fAU1xtNNisHgOF5JooAs8rRaTkl2rT3uaoNGo9NS3R8=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/ui/apps/platform/README.md b/ui/apps/platform/README.md
index 456c6968fbfaf..9ef4fa12b792f 100644
--- a/ui/apps/platform/README.md
+++ b/ui/apps/platform/README.md
@@ -452,6 +452,12 @@ Given a feature flag environment variable `"ROX_WHATEVER"` in pkg/features/list.
         customize_envVars+=$'\n        value: "true"'
         ```
 
+    * Add `env_with_default ROX_WHATEVER "true"` to `collect_feature_flags` function in tests/e2e/lib-compat.sh
+
+        roxie-based e2e deployments read feature flag overrides from this separate list, not from
+        `export_test_environment`. Skipping this step makes `TestFeatureFlagSettings` fail in
+        roxie-based jobs because the Go test process and the deployed Central disagree on the flag's value.
+
     The value of feature flags for **demo** and **release** builds is in pkg/features/list.go
 
 5. To turn on a feature flag for **local deployment**, do either or both of the following:
@@ -523,6 +529,8 @@ Given a feature flag environment variable `"ROX_WHATEVER"` in pkg/features/list.
         customize_envVars+=$'\n        value: "true"'
         ```
 
+    * Delete `env_with_default ROX_WHATEVER "true"` from `collect_feature_flags` function in tests/e2e/lib-compat.sh
+
 ### Routes
 
 #### Add a route
diff --git a/ui/apps/platform/TESTING_E2E.md b/ui/apps/platform/TESTING_E2E.md
index 8f8756a146f28..bc4d28eddacba 100644
--- a/ui/apps/platform/TESTING_E2E.md
+++ b/ui/apps/platform/TESTING_E2E.md
@@ -116,7 +116,7 @@ This sets `localStorage.access_token` from the `ROX_AUTH_TOKEN` env var in `befo
 
 ## Feature Flag Gating
 
-Tests that depend on a feature flag should skip when the flag is not enabled. The test runner scripts (`scripts/cypress.sh`) fetch flags from the deployment API and export them as `CYPRESS_ROX_*` env vars.
+Tests that depend on a feature flag should skip when the flag is not enabled. The test runner scripts (`scripts/cypress.sh`) fetch flags from the deployment API and export them as `CYPRESS_ROX_*` env vars, which `cypress.config.js` copies to `Cypress.expose()` for synchronous access in tests.
 
 For individual tests, skip inside the `it` block:
 
@@ -263,7 +263,7 @@ Globally applicable helper functions (`cypress/helpers/*`). Use these frequently
 | `helpers/request.js` | API interception and waiting | `interceptRequests`, `waitForResponses`, `interactAndWaitForResponses`, `interceptAndWatchRequests`, `interceptAndOverridePermissions`, `interceptAndOverrideFeatureFlags` |
 | `helpers/visit.js` | Page navigation with auto auth handling and request awaiting | `visit`, `visitWithStaticResponseForPermissions`, `visitWithStaticResponseForAuthStatus` |
 | `helpers/basicAuth.js` | Test authentication setup | `withAuth` (default export) |
-| `helpers/features.js` | Feature flag and orchestrator checks | `hasFeatureFlag`, `hasOrchestratorFlavor` |
+| `helpers/features.js` | Feature flag and orchestrator checks via `Cypress.expose()` | `hasFeatureFlag`, `hasOrchestratorFlavor` |
 | `helpers/nav.ts` | Left navigation interactions | `visitFromLeftNav`, `visitFromLeftNavExpandable` |
 | `helpers/formHelpers.js` | Form element interactions | `getInputByLabel`, `getSelectButtonByLabel`, `getSelectOption`, `generateNameWithDate` |
 | `helpers/tableHelpers.ts` | Table row/column interactions | `getTableRowLinkByName`, `openTableRowActionMenu`, `sortByTableHeader`, `assertOnEachRowForColumn` |
diff --git a/ui/apps/platform/cypress.config.js b/ui/apps/platform/cypress.config.js
index d41c983d4040a..d0b0de761e573 100644
--- a/ui/apps/platform/cypress.config.js
+++ b/ui/apps/platform/cypress.config.js
@@ -7,6 +7,24 @@ const cypressVite = require('cypress-vite');
 // and make the path available at test runtime when injecting the axe core.
 const axeCorePath = require.resolve('axe-core/axe.min.js');
 
+const PUBLIC_ENV_KEYS = ['ORCHESTRATOR_FLAVOR'];
+
+/*
+ * Cypress only fills expose from the config file or the --expose CLI flag, so copy the public
+ * CYPRESS_* values exported by scripts/cypress.sh. Feature flag names come from /v1/featureflags
+ * at runtime, so match them by prefix and boolean value. Secrets such as ROX_AUTH_TOKEN,
+ * DEMO_PASSWORD, and the OCP console credentials stay readable only through cy.env().
+ */
+function getPublicEnv(env = {}) {
+    return Object.fromEntries(
+        Object.entries(env).filter(
+            ([key, value]) =>
+                PUBLIC_ENV_KEYS.includes(key) ||
+                (key.startsWith('ROX_') && typeof value === 'boolean')
+        )
+    );
+}
+
 /*
  * The helper function intended to provide automatic code completion for configuration in many popular code editors
  * had subtle side-effect to cause some typescript-eslint/no-unsafe-return errors in unit test files.
@@ -16,6 +34,7 @@ const axeCorePath = require.resolve('axe-core/axe.min.js');
  */
 
 module.exports = {
+    allowCypressEnv: false,
     chromeWebSecurity: false, // Browser options
     defaultCommandTimeout: 8000, // Timeouts options
     numTestsKeptInMemory: 0, // Global options
@@ -37,7 +56,11 @@ module.exports = {
         viewportWidth: 1440, // Viewport options
         setupNodeEvents: (on, config) => {
             // eslint-disable-next-line no-param-reassign
-            config.env.AXE_CORE_PATH = axeCorePath;
+            config.expose = {
+                ...config.expose,
+                ...getPublicEnv(config.env),
+                AXE_CORE_PATH: axeCorePath,
+            };
             on('task', {
                 beforeSuite(spec) {
                     // eslint-disable-next-line no-console
diff --git a/ui/apps/platform/cypress/constants/apiEndpoints.js b/ui/apps/platform/cypress/constants/apiEndpoints.js
index c3a11d7477f82..784fc317db1ac 100644
--- a/ui/apps/platform/cypress/constants/apiEndpoints.js
+++ b/ui/apps/platform/cypress/constants/apiEndpoints.js
@@ -74,7 +74,7 @@ export const integrationHealth = {
 export const credentialHealth = {
     central: '/v1/credentialexpiry?component=CENTRAL',
     centralDb: '/v1/credentialexpiry?component=CENTRAL_DB',
-    scanner: '/v1/credentialexpiry?component=SCANNER',
+    scannerV4: '/v1/credentialexpiry?component=SCANNER_V4',
 };
 
 export const integrations = {
diff --git a/ui/apps/platform/cypress/fixtures/clusters/health.json b/ui/apps/platform/cypress/fixtures/clusters/health.json
index 6d6538a318fd2..d35b1d8953e7f 100644
--- a/ui/apps/platform/cypress/fixtures/clusters/health.json
+++ b/ui/apps/platform/cypress/fixtures/clusters/health.json
@@ -150,7 +150,8 @@
                 },
                 "certExpiryStatus": {
                     "sensorCertExpiry": "2020-09-07T13:00:00Z"
-                }
+                },
+                "sensorVersionCompatibility": "SENSOR_VERSION_COMPATIBILITY_INCOMPATIBLE_BEHIND"
             },
             "dynamicConfig": {
                 "admissionControllerConfig": {
@@ -219,7 +220,8 @@
                 },
                 "certExpiryStatus": {
                     "sensorCertExpiry": "2020-09-29T13:01:00Z"
-                }
+                },
+                "sensorVersionCompatibility": "SENSOR_VERSION_COMPATIBILITY_MATCHED"
             },
             "dynamicConfig": {
                 "admissionControllerConfig": {
@@ -358,7 +360,8 @@
                 },
                 "certExpiryStatus": {
                     "sensorCertExpiry": "2020-09-30T13:01:00Z"
-                }
+                },
+                "sensorVersionCompatibility": "SENSOR_VERSION_COMPATIBILITY_COMPATIBLE_BEHIND"
             },
             "dynamicConfig": {
                 "admissionControllerConfig": {
@@ -505,7 +508,8 @@
                 },
                 "certExpiryStatus": {
                     "sensorCertExpiry": "2020-10-31T13:01:00Z"
-                }
+                },
+                "sensorVersionCompatibility": "SENSOR_VERSION_COMPATIBILITY_MATCHED"
             },
             "dynamicConfig": {
                 "admissionControllerConfig": {
@@ -573,7 +577,8 @@
                 },
                 "certExpiryStatus": {
                     "sensorCertExpiry": "2021-08-26T13:01:00Z"
-                }
+                },
+                "sensorVersionCompatibility": "SENSOR_VERSION_COMPATIBILITY_INCOMPATIBLE_AHEAD"
             },
             "dynamicConfig": {
                 "admissionControllerConfig": {
@@ -641,7 +646,8 @@
                 },
                 "certExpiryStatus": {
                     "sensorCertExpiry": "2021-08-31T13:01:00Z"
-                }
+                },
+                "sensorVersionCompatibility": "SENSOR_VERSION_COMPATIBILITY_MATCHED"
             },
             "dynamicConfig": {
                 "admissionControllerConfig": {
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVM.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVM.json
new file mode 100644
index 0000000000000..cdfe8aeab670f
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVM.json
@@ -0,0 +1,30 @@
+{
+    "id": "vm-001",
+    "name": "cypress-vm-1",
+    "namespace": "default",
+    "clusterId": "cluster-001",
+    "clusterName": "production-cluster",
+    "guestOs": "Red Hat Enterprise Linux 9.2",
+    "state": "VM_STATE_RUNNING",
+    "lastUpdated": "2025-04-15T10:30:00.000Z",
+    "facts": {
+        "guestOS": "Red Hat Enterprise Linux 9.2",
+        "ipAddresses": "10.0.1.50",
+        "nodeName": "worker-node-1",
+        "activePodCount": "3",
+        "activePods": "3",
+        "bootOrder": "disk,network"
+    },
+    "annotations": {},
+    "labels": {},
+    "vsockCid": 3,
+    "notes": [],
+    "latestScan": {
+        "scanId": "scan-001",
+        "scanOs": "rhel:9",
+        "scanTime": "2025-04-15T10:30:00.000Z",
+        "topCvss": 9.8,
+        "scanNotes": []
+    },
+    "agentStatus": "AGENT_STATUS_ACTIVE"
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVMCVEComponents.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVMCVEComponents.json
new file mode 100644
index 0000000000000..f17271202a3b0
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVMCVEComponents.json
@@ -0,0 +1,14 @@
+{
+    "components": [
+        {
+            "componentName": "openssl",
+            "componentVersion": "3.0.7-20.el9",
+            "source": "OS",
+            "fixedBy": "3.0.7-21.el9",
+            "advisory": {
+                "name": "RHSA-2024:1234",
+                "link": "https://access.redhat.com/errata/RHSA-2024:1234"
+            }
+        }
+    ]
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVMVulnSummary.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVMVulnSummary.json
new file mode 100644
index 0000000000000..fc763174c4c29
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVMVulnSummary.json
@@ -0,0 +1,11 @@
+{
+    "severityCounts": {
+        "critical": { "total": 1, "fixable": 1 },
+        "important": { "total": 1, "fixable": 1 },
+        "moderate": { "total": 1, "fixable": 1 },
+        "low": { "total": 0, "fixable": 0 },
+        "unknown": { "total": 0, "fixable": 0 }
+    },
+    "fixableCount": 3,
+    "notFixableCount": 0
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVirtualMachine.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVirtualMachine.json
deleted file mode 100644
index d70646ab6c984..0000000000000
--- a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/getVirtualMachine.json
+++ /dev/null
@@ -1,116 +0,0 @@
-{
-    "id": "vm-001",
-    "namespace": "default",
-    "name": "cypress-vm-1",
-    "clusterId": "cluster-001",
-    "clusterName": "production-cluster",
-    "facts": {
-        "guestOS": "Red Hat Enterprise Linux 9.2",
-        "ipAddresses": "10.0.1.50",
-        "nodeName": "worker-node-1",
-        "activePodCount": "3",
-        "bootOrder": "disk,network"
-    },
-    "scan": {
-        "scanTime": "2025-04-15T10:30:00.000Z",
-        "operatingSystem": "rhel:9",
-        "components": [
-            {
-                "name": "openssl",
-                "version": "3.0.7-20.el9",
-                "vulns": [
-                    {
-                        "cve": "CVE-2024-0001",
-                        "advisory": {
-                            "name": "RHSA-2024:0001",
-                            "link": "https://access.redhat.com/errata/RHSA-2024:0001"
-                        },
-                        "cvss": 9.8,
-                        "summary": "Critical vulnerability in openssl",
-                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0001",
-                        "fixedBy": "3.0.7-25.el9",
-                        "publishedOn": "2024-01-15T00:00:00.000Z",
-                        "lastModified": "2024-02-01T00:00:00.000Z",
-                        "firstSystemOccurrence": "2024-01-20T00:00:00.000Z",
-                        "severity": "CRITICAL_VULNERABILITY_SEVERITY",
-                        "cvssMetrics": [],
-                        "epss": {
-                            "epssProbability": 0.85,
-                            "epssPercentile": 0.97
-                        }
-                    },
-                    {
-                        "cve": "CVE-2024-0002",
-                        "advisory": {
-                            "name": "RHSA-2024:0002",
-                            "link": "https://access.redhat.com/errata/RHSA-2024:0002"
-                        },
-                        "cvss": 5.3,
-                        "summary": "Moderate vulnerability in openssl",
-                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0002",
-                        "fixedBy": "3.0.7-25.el9",
-                        "publishedOn": "2024-02-10T00:00:00.000Z",
-                        "lastModified": "2024-03-01T00:00:00.000Z",
-                        "firstSystemOccurrence": "2024-02-15T00:00:00.000Z",
-                        "severity": "MODERATE_VULNERABILITY_SEVERITY",
-                        "cvssMetrics": [],
-                        "epss": {
-                            "epssProbability": 0.12,
-                            "epssPercentile": 0.45
-                        }
-                    }
-                ],
-                "source": "OS",
-                "topCvss": 9.8,
-                "riskScore": 9.8,
-                "architecture": "x86_64",
-                "notes": []
-            },
-            {
-                "name": "curl",
-                "version": "7.76.1-26.el9",
-                "vulns": [
-                    {
-                        "cve": "CVE-2024-0003",
-                        "advisory": {
-                            "name": "RHSA-2024:0003",
-                            "link": "https://access.redhat.com/errata/RHSA-2024:0003"
-                        },
-                        "cvss": 7.5,
-                        "summary": "Important vulnerability in curl",
-                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0003",
-                        "fixedBy": "7.76.1-29.el9",
-                        "publishedOn": "2024-03-01T00:00:00.000Z",
-                        "lastModified": "2024-03-15T00:00:00.000Z",
-                        "firstSystemOccurrence": "2024-03-05T00:00:00.000Z",
-                        "severity": "IMPORTANT_VULNERABILITY_SEVERITY",
-                        "cvssMetrics": [],
-                        "epss": {
-                            "epssProbability": 0.45,
-                            "epssPercentile": 0.82
-                        }
-                    }
-                ],
-                "source": "OS",
-                "topCvss": 7.5,
-                "riskScore": 7.5,
-                "architecture": "x86_64",
-                "notes": []
-            },
-            {
-                "name": "systemd",
-                "version": "252-18.el9",
-                "vulns": [],
-                "source": "OS",
-                "topCvss": 0,
-                "riskScore": 0,
-                "architecture": "x86_64",
-                "notes": ["UNSCANNED"]
-            }
-        ],
-        "notes": []
-    },
-    "lastUpdated": "2025-04-15T10:30:00.000Z",
-    "vsockCid": 3,
-    "state": "RUNNING"
-}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVMs.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVMs.json
new file mode 100644
index 0000000000000..7eb933653a824
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVMs.json
@@ -0,0 +1,84 @@
+{
+    "vms": [
+        {
+            "id": "vm-001",
+            "name": "cypress-vm-1",
+            "namespace": "default",
+            "clusterId": "cluster-001",
+            "clusterName": "production-cluster",
+            "guestOs": "Red Hat Enterprise Linux 9.2",
+            "state": "VM_STATE_RUNNING",
+            "scanTime": "2025-04-15T10:30:00.000Z",
+            "scanOs": "rhel:9",
+            "lastUpdated": "2025-04-15T10:30:00.000Z",
+            "vsockCid": 3,
+            "facts": {
+                "guestOS": "Red Hat Enterprise Linux 9.2",
+                "ipAddresses": "10.0.1.50",
+                "nodeName": "worker-node-1",
+                "activePodCount": "3",
+                "activePods": "3",
+                "bootOrder": "disk,network"
+            },
+            "cveSeverityCounts": {
+                "critical": { "total": 1, "fixable": 1 },
+                "important": { "total": 1, "fixable": 1 },
+                "moderate": { "total": 1, "fixable": 1 },
+                "low": { "total": 0, "fixable": 0 },
+                "unknown": { "total": 0, "fixable": 0 }
+            },
+            "componentScanCount": { "scanned": 2, "total": 3 }
+        },
+        {
+            "id": "vm-002",
+            "name": "cypress-vm-2",
+            "namespace": "monitoring",
+            "clusterId": "cluster-001",
+            "clusterName": "production-cluster",
+            "guestOs": "Red Hat Enterprise Linux 8.8",
+            "state": "VM_STATE_RUNNING",
+            "scanTime": "2025-04-14T08:15:00.000Z",
+            "scanOs": "rhel:8",
+            "lastUpdated": "2025-04-14T08:15:00.000Z",
+            "vsockCid": 4,
+            "facts": {
+                "guestOS": "Red Hat Enterprise Linux 8.8",
+                "ipAddresses": "10.0.1.51",
+                "nodeName": "worker-node-2",
+                "activePodCount": "1",
+                "bootOrder": "disk"
+            },
+            "cveSeverityCounts": {
+                "critical": { "total": 0, "fixable": 0 },
+                "important": { "total": 0, "fixable": 0 },
+                "moderate": { "total": 0, "fixable": 0 },
+                "low": { "total": 1, "fixable": 0 },
+                "unknown": { "total": 0, "fixable": 0 }
+            },
+            "componentScanCount": { "scanned": 1, "total": 1 }
+        },
+        {
+            "id": "vm-003",
+            "name": "cypress-vm-3",
+            "namespace": "default",
+            "clusterId": "cluster-002",
+            "clusterName": "staging-cluster",
+            "guestOs": "Red Hat Enterprise Linux 9.3",
+            "state": "VM_STATE_STOPPED",
+            "lastUpdated": "2025-04-13T12:00:00.000Z",
+            "vsockCid": 5,
+            "facts": {
+                "guestOS": "Red Hat Enterprise Linux 9.3"
+            },
+            "cveSeverityCounts": {
+                "critical": { "total": 0, "fixable": 0 },
+                "important": { "total": 0, "fixable": 0 },
+                "moderate": { "total": 0, "fixable": 0 },
+                "low": { "total": 0, "fixable": 0 },
+                "unknown": { "total": 0, "fixable": 0 }
+            },
+            "componentScanCount": { "scanned": 0, "total": 0 }
+        }
+    ],
+    "totalCount": 3
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineComponents-vm-002.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineComponents-vm-002.json
new file mode 100644
index 0000000000000..a4307f6c80230
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineComponents-vm-002.json
@@ -0,0 +1,18 @@
+{
+    "components": [
+        {
+            "id": "kernel-4.18.0-477.el8",
+            "name": "kernel",
+            "version": "4.18.0-477.el8",
+            "source": "OS",
+            "scanStatus": "SCANNED",
+            "lastScanned": "2025-04-14T08:15:00.000Z",
+            "cveCount": 1,
+            "architecture": "x86_64",
+            "topCvss": 4.0,
+            "riskScore": 4.0,
+            "notes": []
+        }
+    ],
+    "totalCount": 1
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineComponents.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineComponents.json
new file mode 100644
index 0000000000000..d9f23a0ea51da
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineComponents.json
@@ -0,0 +1,44 @@
+{
+    "components": [
+        {
+            "id": "openssl-3.0.7-20.el9",
+            "name": "openssl",
+            "version": "3.0.7-20.el9",
+            "source": "OS",
+            "scanStatus": "SCANNED",
+            "lastScanned": "2025-04-15T10:30:00.000Z",
+            "cveCount": 2,
+            "architecture": "x86_64",
+            "topCvss": 9.8,
+            "riskScore": 9.8,
+            "notes": []
+        },
+        {
+            "id": "curl-7.76.1-26.el9",
+            "name": "curl",
+            "version": "7.76.1-26.el9",
+            "source": "OS",
+            "scanStatus": "SCANNED",
+            "lastScanned": "2025-04-15T10:30:00.000Z",
+            "cveCount": 1,
+            "architecture": "x86_64",
+            "topCvss": 7.5,
+            "riskScore": 7.5,
+            "notes": []
+        },
+        {
+            "id": "systemd-252-18.el9",
+            "name": "systemd",
+            "version": "252-18.el9",
+            "source": "OS",
+            "scanStatus": "NOT_SCANNED",
+            "lastScanned": "2025-04-15T10:30:00.000Z",
+            "cveCount": 0,
+            "architecture": "x86_64",
+            "topCvss": 0,
+            "riskScore": 0,
+            "notes": ["UNSCANNED"]
+        }
+    ],
+    "totalCount": 3
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineCves-vm-002.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineCves-vm-002.json
new file mode 100644
index 0000000000000..400f23f6ee45a
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineCves-vm-002.json
@@ -0,0 +1,29 @@
+{
+    "cves": [
+        {
+            "cve": "CVE-2024-0004",
+            "severity": "LOW_VULNERABILITY_SEVERITY",
+            "isFixable": false,
+            "cvss": 4.0,
+            "nvdCvss": 4.0,
+            "epssProbability": 0.02,
+            "epssPercentile": 0.15,
+            "epss": {
+                "epssProbability": 0.02,
+                "epssPercentile": 0.15
+            },
+            "affectedComponentCount": 1,
+            "publishedOn": "2024-04-01T00:00:00.000Z",
+            "lastModified": "2024-04-15T00:00:00.000Z",
+            "firstSystemOccurrence": "2024-04-05T00:00:00.000Z",
+            "summary": "Low severity kernel vulnerability",
+            "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0004",
+            "cvssMetrics": [],
+            "advisory": {
+                "name": "",
+                "link": ""
+            }
+        }
+    ],
+    "totalCount": 1
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineCves.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineCves.json
new file mode 100644
index 0000000000000..8e818e2e54e9b
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachineCves.json
@@ -0,0 +1,80 @@
+{
+    "cves": [
+        {
+            "cve": "CVE-2024-0001",
+            "severity": "CRITICAL_VULNERABILITY_SEVERITY",
+            "isFixable": true,
+            "cvss": 9.8,
+            "nvdCvss": 9.8,
+            "epssProbability": 0.85,
+            "epssPercentile": 0.97,
+            "epss": {
+                "epssProbability": 0.85,
+                "epssPercentile": 0.97
+            },
+            "affectedComponentCount": 1,
+            "publishedOn": "2024-01-15T00:00:00.000Z",
+            "lastModified": "2024-02-01T00:00:00.000Z",
+            "firstSystemOccurrence": "2024-01-20T00:00:00.000Z",
+            "summary": "Critical vulnerability in openssl",
+            "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0001",
+            "fixedBy": "3.0.7-25.el9",
+            "cvssMetrics": [],
+            "advisory": {
+                "name": "RHSA-2024:0001",
+                "link": "https://access.redhat.com/errata/RHSA-2024:0001"
+            }
+        },
+        {
+            "cve": "CVE-2024-0002",
+            "severity": "MODERATE_VULNERABILITY_SEVERITY",
+            "isFixable": true,
+            "cvss": 5.3,
+            "nvdCvss": 5.3,
+            "epssProbability": 0.12,
+            "epssPercentile": 0.45,
+            "epss": {
+                "epssProbability": 0.12,
+                "epssPercentile": 0.45
+            },
+            "affectedComponentCount": 1,
+            "publishedOn": "2024-02-10T00:00:00.000Z",
+            "lastModified": "2024-03-01T00:00:00.000Z",
+            "firstSystemOccurrence": "2024-02-15T00:00:00.000Z",
+            "summary": "Moderate vulnerability in openssl",
+            "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0002",
+            "fixedBy": "3.0.7-25.el9",
+            "cvssMetrics": [],
+            "advisory": {
+                "name": "RHSA-2024:0002",
+                "link": "https://access.redhat.com/errata/RHSA-2024:0002"
+            }
+        },
+        {
+            "cve": "CVE-2024-0003",
+            "severity": "IMPORTANT_VULNERABILITY_SEVERITY",
+            "isFixable": true,
+            "cvss": 7.5,
+            "nvdCvss": 7.5,
+            "epssProbability": 0.45,
+            "epssPercentile": 0.82,
+            "epss": {
+                "epssProbability": 0.45,
+                "epssPercentile": 0.82
+            },
+            "affectedComponentCount": 1,
+            "publishedOn": "2024-03-01T00:00:00.000Z",
+            "lastModified": "2024-03-15T00:00:00.000Z",
+            "firstSystemOccurrence": "2024-03-05T00:00:00.000Z",
+            "summary": "Important vulnerability in curl",
+            "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0003",
+            "fixedBy": "7.76.1-29.el9",
+            "cvssMetrics": [],
+            "advisory": {
+                "name": "RHSA-2024:0003",
+                "link": "https://access.redhat.com/errata/RHSA-2024:0003"
+            }
+        }
+    ],
+    "totalCount": 3
+}
diff --git a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachines.json b/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachines.json
deleted file mode 100644
index 2acd246a61dd8..0000000000000
--- a/ui/apps/platform/cypress/fixtures/vulnerabilities/virtualMachineCves/listVirtualMachines.json
+++ /dev/null
@@ -1,188 +0,0 @@
-{
-    "virtualMachines": [
-        {
-            "id": "vm-001",
-            "namespace": "default",
-            "name": "cypress-vm-1",
-            "clusterId": "cluster-001",
-            "clusterName": "production-cluster",
-            "facts": {
-                "guestOS": "Red Hat Enterprise Linux 9.2",
-                "ipAddresses": "10.0.1.50",
-                "nodeName": "worker-node-1",
-                "activePodCount": "3",
-                "bootOrder": "disk,network"
-            },
-            "scan": {
-                "scanTime": "2025-04-15T10:30:00.000Z",
-                "operatingSystem": "rhel:9",
-                "components": [
-                    {
-                        "name": "openssl",
-                        "version": "3.0.7-20.el9",
-                        "vulns": [
-                            {
-                                "cve": "CVE-2024-0001",
-                                "advisory": {
-                                    "name": "RHSA-2024:0001",
-                                    "link": "https://access.redhat.com/errata/RHSA-2024:0001"
-                                },
-                                "cvss": 9.8,
-                                "summary": "Critical vulnerability in openssl",
-                                "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0001",
-                                "fixedBy": "3.0.7-25.el9",
-                                "publishedOn": "2024-01-15T00:00:00.000Z",
-                                "lastModified": "2024-02-01T00:00:00.000Z",
-                                "firstSystemOccurrence": "2024-01-20T00:00:00.000Z",
-                                "severity": "CRITICAL_VULNERABILITY_SEVERITY",
-                                "cvssMetrics": [],
-                                "epss": {
-                                    "epssProbability": 0.85,
-                                    "epssPercentile": 0.97
-                                }
-                            },
-                            {
-                                "cve": "CVE-2024-0002",
-                                "advisory": {
-                                    "name": "RHSA-2024:0002",
-                                    "link": "https://access.redhat.com/errata/RHSA-2024:0002"
-                                },
-                                "cvss": 5.3,
-                                "summary": "Moderate vulnerability in openssl",
-                                "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0002",
-                                "fixedBy": "3.0.7-25.el9",
-                                "publishedOn": "2024-02-10T00:00:00.000Z",
-                                "lastModified": "2024-03-01T00:00:00.000Z",
-                                "firstSystemOccurrence": "2024-02-15T00:00:00.000Z",
-                                "severity": "MODERATE_VULNERABILITY_SEVERITY",
-                                "cvssMetrics": [],
-                                "epss": {
-                                    "epssProbability": 0.12,
-                                    "epssPercentile": 0.45
-                                }
-                            }
-                        ],
-                        "source": "OS",
-                        "topCvss": 9.8,
-                        "riskScore": 9.8,
-                        "architecture": "x86_64",
-                        "notes": []
-                    },
-                    {
-                        "name": "curl",
-                        "version": "7.76.1-26.el9",
-                        "vulns": [
-                            {
-                                "cve": "CVE-2024-0003",
-                                "advisory": {
-                                    "name": "RHSA-2024:0003",
-                                    "link": "https://access.redhat.com/errata/RHSA-2024:0003"
-                                },
-                                "cvss": 7.5,
-                                "summary": "Important vulnerability in curl",
-                                "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0003",
-                                "fixedBy": "7.76.1-29.el9",
-                                "publishedOn": "2024-03-01T00:00:00.000Z",
-                                "lastModified": "2024-03-15T00:00:00.000Z",
-                                "firstSystemOccurrence": "2024-03-05T00:00:00.000Z",
-                                "severity": "IMPORTANT_VULNERABILITY_SEVERITY",
-                                "cvssMetrics": [],
-                                "epss": {
-                                    "epssProbability": 0.45,
-                                    "epssPercentile": 0.82
-                                }
-                            }
-                        ],
-                        "source": "OS",
-                        "topCvss": 7.5,
-                        "riskScore": 7.5,
-                        "architecture": "x86_64",
-                        "notes": []
-                    },
-                    {
-                        "name": "systemd",
-                        "version": "252-18.el9",
-                        "vulns": [],
-                        "source": "OS",
-                        "topCvss": 0,
-                        "riskScore": 0,
-                        "architecture": "x86_64",
-                        "notes": ["UNSCANNED"]
-                    }
-                ],
-                "notes": []
-            },
-            "lastUpdated": "2025-04-15T10:30:00.000Z",
-            "vsockCid": 3,
-            "state": "RUNNING"
-        },
-        {
-            "id": "vm-002",
-            "namespace": "monitoring",
-            "name": "cypress-vm-2",
-            "clusterId": "cluster-001",
-            "clusterName": "production-cluster",
-            "facts": {
-                "guestOS": "Red Hat Enterprise Linux 8.8",
-                "ipAddresses": "10.0.1.51",
-                "nodeName": "worker-node-2",
-                "activePodCount": "1",
-                "bootOrder": "disk"
-            },
-            "scan": {
-                "scanTime": "2025-04-14T08:15:00.000Z",
-                "operatingSystem": "rhel:8",
-                "components": [
-                    {
-                        "name": "kernel",
-                        "version": "4.18.0-477.el8",
-                        "vulns": [
-                            {
-                                "cve": "CVE-2024-0004",
-                                "advisory": {
-                                    "name": "",
-                                    "link": ""
-                                },
-                                "cvss": 4.0,
-                                "summary": "Low severity kernel vulnerability",
-                                "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0004",
-                                "publishedOn": "2024-04-01T00:00:00.000Z",
-                                "lastModified": "2024-04-15T00:00:00.000Z",
-                                "firstSystemOccurrence": "2024-04-05T00:00:00.000Z",
-                                "severity": "LOW_VULNERABILITY_SEVERITY",
-                                "cvssMetrics": [],
-                                "epss": {
-                                    "epssProbability": 0.02,
-                                    "epssPercentile": 0.15
-                                }
-                            }
-                        ],
-                        "source": "OS",
-                        "topCvss": 4.0,
-                        "riskScore": 4.0,
-                        "architecture": "x86_64",
-                        "notes": []
-                    }
-                ],
-                "notes": []
-            },
-            "lastUpdated": "2025-04-14T08:15:00.000Z",
-            "vsockCid": 4,
-            "state": "RUNNING"
-        },
-        {
-            "id": "vm-003",
-            "namespace": "default",
-            "name": "cypress-vm-3",
-            "clusterId": "cluster-002",
-            "clusterName": "staging-cluster",
-            "facts": {
-                "guestOS": "Red Hat Enterprise Linux 9.3"
-            },
-            "lastUpdated": "2025-04-13T12:00:00.000Z",
-            "vsockCid": 5,
-            "state": "STOPPED"
-        }
-    ],
-    "totalCount": 3
-}
diff --git a/ui/apps/platform/cypress/fixtures/vulnmanagement/nodeCves.json b/ui/apps/platform/cypress/fixtures/vulnmanagement/nodeCves.json
new file mode 100644
index 0000000000000..9139582d1798c
--- /dev/null
+++ b/ui/apps/platform/cypress/fixtures/vulnmanagement/nodeCves.json
@@ -0,0 +1,55 @@
+{
+    "data": {
+        "results": [
+            {
+                "createdAt": "2024-07-15T12:21:46Z",
+                "cve": "CVE-2024-36886",
+                "cvss": 9.8,
+                "envImpact": 0.5,
+                "fixedByVersion": "4.18.0-305.el8",
+                "id": "cve-2024-36886-rhcos:4.14",
+                "impactScore": 6.0,
+                "isFixable": true,
+                "lastModified": "2024-07-15T12:21:46Z",
+                "lastScanned": "2024-07-15T12:21:46Z",
+                "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-36886",
+                "publishedOn": "2024-06-01T00:00:00Z",
+                "scoreVersion": "V3",
+                "severity": "CRITICAL_VULNERABILITY_SEVERITY",
+                "summary": "TIPC message reassembly use-after-free remote code execution vulnerability",
+                "suppressActivation": null,
+                "suppressExpiry": null,
+                "suppressed": false,
+                "componentCount": 1,
+                "nodeCount": 3,
+                "operatingSystem": "rhcos:4.14",
+                "__typename": "NodeVulnerability"
+            },
+            {
+                "createdAt": "2024-07-10T08:00:00Z",
+                "cve": "CVE-2024-32487",
+                "cvss": 8.6,
+                "envImpact": 0.35,
+                "fixedByVersion": "5.0.0-1.el8",
+                "id": "cve-2024-32487-rhcos:4.14",
+                "impactScore": 5.2,
+                "isFixable": true,
+                "lastModified": "2024-07-10T08:00:00Z",
+                "lastScanned": "2024-07-10T08:00:00Z",
+                "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-32487",
+                "publishedOn": "2024-05-15T00:00:00Z",
+                "scoreVersion": "V3",
+                "severity": "IMPORTANT_VULNERABILITY_SEVERITY",
+                "summary": "OS command injection via less utility",
+                "suppressActivation": null,
+                "suppressExpiry": null,
+                "suppressed": false,
+                "componentCount": 1,
+                "nodeCount": 3,
+                "operatingSystem": "rhcos:4.14",
+                "__typename": "NodeVulnerability"
+            }
+        ],
+        "count": 2
+    }
+}
diff --git a/ui/apps/platform/cypress/helpers/features.js b/ui/apps/platform/cypress/helpers/features.js
index fabd7989c2447..4102f03468a91 100644
--- a/ui/apps/platform/cypress/helpers/features.js
+++ b/ui/apps/platform/cypress/helpers/features.js
@@ -2,9 +2,9 @@
  * Return whether or not the testing environment has a feature flag.
  */
 export function hasFeatureFlag(flag) {
-    return Cypress.env(flag) || false;
+    return Cypress.expose(flag) || false;
 }
 
 export function hasOrchestratorFlavor(value) {
-    return Cypress.env('ORCHESTRATOR_FLAVOR') === value;
+    return Cypress.expose('ORCHESTRATOR_FLAVOR') === value;
 }
diff --git a/ui/apps/platform/cypress/helpers/main.js b/ui/apps/platform/cypress/helpers/main.js
index 0b0cbab3fdd42..bc5dc00a201d2 100644
--- a/ui/apps/platform/cypress/helpers/main.js
+++ b/ui/apps/platform/cypress/helpers/main.js
@@ -1,6 +1,5 @@
 import pf6 from '../selectors/pf6';
 
-import { hasFeatureFlag } from './features';
 import { getRouteMatcherMapForGraphQL } from './request';
 import { visit, visitConsole, visitWithStaticResponseForPermissions } from './visit';
 
@@ -42,9 +41,6 @@ const routeMatcherMapForViolationsByPolicyCategory = {
         url: '/v1/alerts/summary/counts?request.query=&group_by=CATEGORY',
     },
 };
-const routeMatcherMapForComplianceLevelsByStandard = getRouteMatcherMapForGraphQL([
-    getAggregatedResultsOpname,
-]);
 
 function getRouteMatcherMap() {
     return {
@@ -55,9 +51,6 @@ function getRouteMatcherMap() {
         ...routeMatcherMapForDeploymentsAtMostRisk,
         ...routeMatcherMapForAgingImages,
         ...routeMatcherMapForViolationsByPolicyCategory,
-        ...(hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')
-            ? routeMatcherMapForComplianceLevelsByStandard
-            : {}),
     };
 }
 
@@ -106,6 +99,17 @@ export function visitConsoleMainDashboard(staticResponseMap) {
     cy.get(`h1:contains("Overview")`);
 }
 
+/**
+ * @param {Record<string, { body: unknown } | { fixture: string }>} [staticResponseMap]
+ */
+export function visitConsoleDynamicPluginsStatusPage(staticResponseMap) {
+    visitConsole(
+        '/k8s/cluster/operator.openshift.io~v1~Console/cluster/console-plugins',
+        routeMatcherMapForConsole,
+        staticResponseMap
+    );
+}
+
 /**
  * Visit main dashboard to test conditional rendering for user role permissions specified as response or fixture.
  * Conditional rendering for permissions might make a subset of requests.
diff --git a/ui/apps/platform/cypress/helpers/request.js b/ui/apps/platform/cypress/helpers/request.js
index 81e895d88fbc6..e39b5d643dabc 100644
--- a/ui/apps/platform/cypress/helpers/request.js
+++ b/ui/apps/platform/cypress/helpers/request.js
@@ -218,6 +218,20 @@ export function expectRequestedQuery(expectedQuery) {
     };
 }
 
+// Asserts one or more items to be independent
+// of order in concatenated query string
+// of absence, presence, or value of items outside scope of test (for example, CVE Snoozed)
+export function expectRequestedQueryToIncludeSubstrings(expectedQuerySubstrings) {
+    return ({ query }) => {
+        expectedQuerySubstrings.forEach((expectedQuery) => {
+            expect(query).to.include(
+                expectedQuery,
+                `Expected query to include ${expectedQuery} but received ${query}`
+            );
+        });
+    };
+}
+
 export function expectRequestedPagination(expectedPagination) {
     return (variables) => {
         const { pagination } = variables;
diff --git a/ui/apps/platform/cypress/helpers/systemHealth.js b/ui/apps/platform/cypress/helpers/systemHealth.js
index 205da53a8ace5..7a529192d09f9 100644
--- a/ui/apps/platform/cypress/helpers/systemHealth.js
+++ b/ui/apps/platform/cypress/helpers/systemHealth.js
@@ -18,8 +18,7 @@ export const integrationHealthVulnDefinitionsAlias =
 export const integrationHealthDeclarativeConfigsAlias = 'declarative-config/health';
 export const credentialForCentralExpiryAlias = 'credentialexpiry?component=CENTRAL';
 export const credentialForCentralDbExpiryAlias = 'credentialexpiry?component=CENTRAL_DB';
-export const credentialForScannerExpiryAlias = 'credentialexpiry?component=SCANNER';
-
+export const credentialForScannerV4ExpiryAlias = 'credentialexpiry?component=SCANNER_V4';
 const SystemHealthHeadingSelector = 'h1:contains("System Health")';
 const routeMatcherMap = {
     'integrationhealth/imageintegrations': {
@@ -50,9 +49,9 @@ const routeMatcherMap = {
         method: 'GET',
         url: api.credentialHealth.centralDb,
     },
-    [credentialForScannerExpiryAlias]: {
+    [credentialForScannerV4ExpiryAlias]: {
         method: 'GET',
-        url: api.credentialHealth.scanner,
+        url: api.credentialHealth.scannerV4,
     },
     externalbackups: {
         method: 'GET',
diff --git a/ui/apps/platform/cypress/integration-ocp/smoke.test.ts b/ui/apps/platform/cypress/integration-ocp/smoke.test.ts
index 8b2fb4f8e2647..ff6b5fa915c08 100644
--- a/ui/apps/platform/cypress/integration-ocp/smoke.test.ts
+++ b/ui/apps/platform/cypress/integration-ocp/smoke.test.ts
@@ -1,4 +1,4 @@
-import { visitFromConsoleLeftNavExpandable } from '../helpers/nav';
+import { visitConsoleDynamicPluginsStatusPage } from '../helpers/main';
 import { withOcpAuth } from '../helpers/ocpAuth';
 
 describe('Basic tests of the OCP plugin', () => {
@@ -30,14 +30,12 @@ describe('Basic tests of the OCP plugin', () => {
         });
 
         it('should display plugin information in cluster settings', () => {
-            visitFromConsoleLeftNavExpandable('Administration', 'Dynamic Plugins');
+            visitConsoleDynamicPluginsStatusPage();
 
-            cy.get('td[data-label="name"]:contains("advanced-cluster-security")')
+            cy.get('td:has(a:contains("advanced-cluster-security"))')
                 .parent()
                 .within(() => {
-                    cy.get('td[data-label="version"]')
-                        .invoke('text')
-                        .should('match', /^[1-9]\d*\.\d+\.\d+/);
+                    cy.contains('td', /^[1-9]\d*\.\d+\.\d+/);
                 });
         });
     });
diff --git a/ui/apps/platform/cypress/integration/baseImages/baseImages.test.ts b/ui/apps/platform/cypress/integration/baseImages/baseImages.test.ts
index fd4cf8da93a38..ac126cc95443a 100644
--- a/ui/apps/platform/cypress/integration/baseImages/baseImages.test.ts
+++ b/ui/apps/platform/cypress/integration/baseImages/baseImages.test.ts
@@ -1,5 +1,4 @@
 import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag } from '../../helpers/features';
 import { interactAndWaitForResponses } from '../../helpers/request';
 import { getRegExpForTitleWithBranding } from '../../helpers/title';
 
@@ -8,12 +7,6 @@ import { addBaseImage, visitBaseImages, visitBaseImagesFromLeftNav } from './bas
 describe('Base Images', () => {
     withAuth();
 
-    before(function () {
-        if (!hasFeatureFlag('ROX_BASE_IMAGE_DETECTION')) {
-            this.skip();
-        }
-    });
-
     it('should navigate to Base Images page from left nav', () => {
         visitBaseImagesFromLeftNav();
 
diff --git a/ui/apps/platform/cypress/integration/clusters/Clusters.helpers.js b/ui/apps/platform/cypress/integration/clusters/Clusters.helpers.js
index c754e1bf77aba..a6899db765458 100644
--- a/ui/apps/platform/cypress/integration/clusters/Clusters.helpers.js
+++ b/ui/apps/platform/cypress/integration/clusters/Clusters.helpers.js
@@ -6,7 +6,6 @@ import {
 } from '../../helpers/request';
 import { visit } from '../../helpers/visit';
 
-export const sensorUpgradesConfigAlias = 'sensorupgrades/config';
 export const clustersAlias = 'clusters';
 export const clusterDefaultsAlias = 'cluster-defaults';
 export const delegatedRegistryConfigAlias = 'delegatedregistryconfig';
@@ -20,15 +19,7 @@ const routeMatcherMapForClusterDefaults = {
     },
 };
 
-// With conditional rendering of side panel,
-// commented requests only when it opens.
 const routeMatcherMapForClusters = {
-    /*
-    [sensorUpgradesConfigAlias]: {
-        method: 'GET',
-        url: '/v1/sensorupgrades/config',
-    },
-    */
     [clustersAlias]: {
         method: 'GET',
         url: 'v1/clusters',
diff --git a/ui/apps/platform/cypress/integration/clusters/Clusters.selectors.js b/ui/apps/platform/cypress/integration/clusters/Clusters.selectors.js
index dea869193505f..3a8b4820742fd 100644
--- a/ui/apps/platform/cypress/integration/clusters/Clusters.selectors.js
+++ b/ui/apps/platform/cypress/integration/clusters/Clusters.selectors.js
@@ -26,7 +26,6 @@ export const selectors = {
             totalRegisteredNodes: '[data-testid="totalRegisteredNodes"]',
         }),
         collectorInfoComplete: '[data-testid="collectorInfoComplete"]',
-        sensorUpgrade: '[data-testid="sensorUpgrade"]',
         sensorVersion: '[data-testid="sensorVersion"]',
         centralVersion: '[data-testid="centralVersion"]',
         credentialExpiration: '[data-testid="credentialExpiration"]',
diff --git a/ui/apps/platform/cypress/integration/clusters/clustersSensorCompatibility.test.js b/ui/apps/platform/cypress/integration/clusters/clustersSensorCompatibility.test.js
index 9a8786a33bfdd..0c9618d77f571 100644
--- a/ui/apps/platform/cypress/integration/clusters/clustersSensorCompatibility.test.js
+++ b/ui/apps/platform/cypress/integration/clusters/clustersSensorCompatibility.test.js
@@ -1,6 +1,4 @@
 import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag } from '../../helpers/features';
-import { interceptAndOverrideFeatureFlags } from '../../helpers/request';
 
 import { clustersAlias, visitClusters } from './Clusters.helpers';
 
@@ -103,14 +101,7 @@ const clustersResponse = {
 describe('Clusters Sensor Compatibility Status', () => {
     withAuth();
 
-    before(function () {
-        if (!hasFeatureFlag('ROX_SENSOR_COMPATIBILITY_STATUS')) {
-            this.skip();
-        }
-    });
-
     beforeEach(() => {
-        interceptAndOverrideFeatureFlags({ ROX_SENSOR_COMPATIBILITY_STATUS: true });
         cy.intercept('GET', 'v1/metadata', { body: metadata }).as('metadata');
     });
 
diff --git a/ui/apps/platform/cypress/integration/collections/deploymentMatching.test.js b/ui/apps/platform/cypress/integration/collections/deploymentMatching.test.js
index 305eb54a8e33f..1b66a91de835d 100644
--- a/ui/apps/platform/cypress/integration/collections/deploymentMatching.test.js
+++ b/ui/apps/platform/cypress/integration/collections/deploymentMatching.test.js
@@ -36,7 +36,15 @@ describe('Collection deployment matching', () => {
         cy.get('input[aria-label="Select value 1 of 1 for the namespace name"]').type('stackrox');
 
         // Test that Stackrox deployments are matched
-        assertDeploymentsAreMatched(['central', 'central-db', 'collector', 'scanner', 'sensor']);
+        assertDeploymentsAreMatched([
+            'central',
+            'central-db',
+            'collector',
+            'scanner-v4-indexer',
+            'scanner-v4-matcher',
+            'scanner-v4-db',
+            'sensor',
+        ]);
 
         // Restrict collection to two specific deployments
         cy.get('button:contains("No deployments specified")').click();
diff --git a/ui/apps/platform/cypress/integration/compliance/Compliance.helpers.js b/ui/apps/platform/cypress/integration/compliance/Compliance.helpers.js
deleted file mode 100644
index f2afd1c987a40..0000000000000
--- a/ui/apps/platform/cypress/integration/compliance/Compliance.helpers.js
+++ /dev/null
@@ -1,211 +0,0 @@
-import { getRouteMatcherMapForGraphQL, interactAndWaitForResponses } from '../../helpers/request';
-import { visit } from '../../helpers/visit';
-
-// path
-
-export const basePath = '/main/compliance';
-
-function getEntitiesPath(entitiesKey) {
-    return `${basePath}/${entitiesKey}`;
-}
-
-const segmentForEntity = {
-    clusters: 'cluster',
-    controls: 'control',
-    deployments: 'deployment',
-    namespaces: 'namespace',
-    nodes: 'node',
-};
-
-function getEntityPagePath(entitiesKey) {
-    return `${basePath}/${segmentForEntity[entitiesKey]}`;
-}
-
-// opname
-
-const opnamesWithoutStandards = [
-    'clustersCount',
-    'namespacesCount',
-    'nodesCount',
-    'deploymentsCount',
-    'runStatuses',
-    'getAggregatedResultsAcrossEntity_CLUSTER',
-    'getAggregatedResultsByEntity_CLUSTER',
-    'getAggregatedResultsAcrossEntity_NAMESPACE',
-    'getAggregatedResultsAcrossEntity_NODE',
-];
-
-export const routeMatcherMapWithoutStandards =
-    getRouteMatcherMapForGraphQL(opnamesWithoutStandards);
-
-// TODO are these reliable after hideScanResults feature?
-/*
-const opnamesOfStandards = [
-    'complianceStandards_CIS_Kubernetes_v1_5',
-    'complianceStandards_HIPAA_164',
-    'complianceStandards_NIST_800_190',
-    'complianceStandards_NIST_SP_800_53_Rev_4',
-    'complianceStandards_PCI_DSS_3_2',
-];
-*/
-
-const routeMatcherMapForComplianceDashboard = getRouteMatcherMapForGraphQL(opnamesWithoutStandards);
-
-const opnameForEntities = {
-    clusters: 'clustersList', // just clusters would be even better, and so on
-    controls: 'controls',
-    deployments: 'deploymentsList',
-    namespaces: 'namespaceList', // singular: too bad, so sad
-    nodes: 'nodesList',
-};
-
-const opnameForEntity = {
-    clusters: 'getClusterName',
-    deployments: 'getDeployment',
-    namespaces: 'getNamespace',
-    nodes: 'getNode',
-};
-
-// heading
-
-export const headingPlural = {
-    clusters: 'Clusters',
-    deployments: 'Deployments',
-    namespaces: 'Namespaces',
-    nodes: 'Nodes',
-};
-
-export const headingSingular = {
-    clusters: 'Cluster',
-    deployments: 'Deployment',
-    namespaces: 'Namespace',
-    nodes: 'Node',
-};
-
-// assert
-
-// assert instead of interact because query might be cached.
-export function assertComplianceEntityPage(entitiesKey) {
-    cy.location('pathname').should('contain', getEntityPagePath(entitiesKey)); // contain because pathname has id
-    cy.get(`h1 + div:contains("${headingSingular[entitiesKey]}")`);
-}
-
-// visit
-
-export function visitComplianceDashboard() {
-    visit(basePath, routeMatcherMapForComplianceDashboard);
-
-    cy.get(`h1:contains("Compliance")`);
-}
-
-/*
- * Assume location is compliance dashboard.
- */
-function scanCompliance() {
-    const routeMatcherMapForTriggerScan = getRouteMatcherMapForGraphQL(['triggerScan']);
-    const routeMatcherMap = {
-        ...routeMatcherMapForTriggerScan,
-        ...routeMatcherMapForComplianceDashboard,
-    };
-
-    const scanButton = '[data-testid="scan-button"]';
-
-    interactAndWaitForResponses(
-        () => {
-            cy.get(scanButton).click();
-        },
-        routeMatcherMap,
-        undefined,
-        { timeout: 20000 }
-    );
-
-    // Note: scan results are polled for every 10 seconds, this should give us plenty of time
-    // to await completion of the scan.
-    cy.get('div:contains("Compliance scanning complete")', {
-        timeout: 60000,
-    });
-}
-
-/*
- * Call directly in first test (of a test file for another container) which assumes that scan results are available.
- * Although compliance test file bends the guideline that tests should not depend on side effects within the same test file,
- * configmanagement test files break the guideline if they assume that compliance test file has already run.
- * Cypress 10 apparently no longer runs tests files in a determinate order.
- */
-export function triggerScan() {
-    visitComplianceDashboard();
-    scanCompliance();
-}
-
-/*
- * For example, visitComplianceEntities('clusters')
- */
-export function visitComplianceEntities(entitiesKey) {
-    const routeMatcherMap = getRouteMatcherMapForGraphQL([
-        'searchOptions',
-        opnameForEntities[entitiesKey],
-    ]);
-
-    visit(getEntitiesPath(entitiesKey), routeMatcherMap);
-
-    cy.get(`h1:contains("${headingPlural[entitiesKey]}")`);
-}
-
-/*
- * For example, visitComplianceStandard('CIS Docker v1.2.0')
- */
-export function visitComplianceStandard(standardName) {
-    const routeMatcherMap = getRouteMatcherMapForGraphQL([
-        'searchOptions',
-        'getComplianceStandards',
-        'controls',
-    ]);
-
-    visit(`${getEntitiesPath('controls')}?s[standard]=${standardName}`, routeMatcherMap);
-
-    cy.get(`h1:contains("${standardName}")`);
-}
-
-export function interactAndWaitForComplianceEntities(interactionCallback, entitiesKey) {
-    const opname = opnameForEntities[entitiesKey];
-    const routeMatcherMap = getRouteMatcherMapForGraphQL([opname]);
-    interactAndWaitForResponses(interactionCallback, routeMatcherMap);
-
-    cy.location('pathname').should('eq', getEntitiesPath(entitiesKey));
-    cy.get(`h1:contains("${headingPlural[entitiesKey]}")`);
-}
-
-export function interactAndWaitForComplianceEntityInSidePanel(interactionCallback, entitiesKey) {
-    const opname = opnameForEntity[entitiesKey];
-    const routeMatcherMap = getRouteMatcherMapForGraphQL([opname]);
-    interactAndWaitForResponses(interactionCallback, routeMatcherMap);
-
-    cy.location('pathname').should('contain', getEntitiesPath(entitiesKey)); // contain because pathname has id
-}
-
-export function interactAndWaitForComplianceStandard(interactionCallback) {
-    const entitiesKey = 'controls';
-    const opname = opnameForEntities[entitiesKey];
-    const routeMatcherMap = getRouteMatcherMapForGraphQL([opname]);
-    interactAndWaitForResponses(interactionCallback, routeMatcherMap);
-
-    cy.location('pathname').should('eq', getEntitiesPath(entitiesKey));
-    cy.get('h1 + div:contains("Standard")');
-}
-
-// verify
-
-/*
- * For example, verifyDashboardEntityLink('clusters', /^\d+ clusters?/))
- */
-export function verifyDashboardEntityLink(entitiesKey, entityRegExp) {
-    cy.get('[data-testid="page-header"]')
-        .contains('a', entityRegExp)
-        .then(($a) => {
-            const [, count] = /^(\d+) /.exec($a.text());
-            interactAndWaitForComplianceEntities(() => {
-                cy.wrap($a).click();
-            }, entitiesKey);
-            cy.get(`[data-testid="panel-header"]:contains("${count}")`);
-        });
-}
diff --git a/ui/apps/platform/cypress/integration/compliance/Compliance.selectors.js b/ui/apps/platform/cypress/integration/compliance/Compliance.selectors.js
deleted file mode 100644
index 9d761aa263966..0000000000000
--- a/ui/apps/platform/cypress/integration/compliance/Compliance.selectors.js
+++ /dev/null
@@ -1,13 +0,0 @@
-export const selectors = {
-    list: {
-        table: {
-            firstGroup: '.table-group-active:first',
-            firstTableGroup: '.rt-table:first',
-            firstRow: 'div.rt-tr-group > .rt-tr.-odd:first',
-            firstRowName: 'div.rt-tr-group > .rt-tr.-odd:first .rt-td a',
-            secondRowName: 'div.rt-tr-group > .rt-tr.-even:first .rt-td a',
-            firstStandard: 'div.rt-table .rt-thead .rt-th:nth-child(3)',
-            firstPercentage: 'div.rt-tr-group > .rt-tr.-odd > .rt-td:nth-child(3)',
-        },
-    },
-};
diff --git a/ui/apps/platform/cypress/integration/compliance/complianceDashboard.test.js b/ui/apps/platform/cypress/integration/compliance/complianceDashboard.test.js
deleted file mode 100644
index 51b372c1ae4b7..0000000000000
--- a/ui/apps/platform/cypress/integration/compliance/complianceDashboard.test.js
+++ /dev/null
@@ -1,96 +0,0 @@
-import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag } from '../../helpers/features';
-import { getRegExpForTitleWithBranding } from '../../helpers/title';
-
-import {
-    interactAndWaitForComplianceStandard,
-    triggerScan,
-    verifyDashboardEntityLink,
-    visitComplianceDashboard,
-} from './Compliance.helpers';
-import { selectors } from './Compliance.selectors';
-
-function getWidgetSelector(headerText) {
-    return `.widget:has([data-testid="widget-header"]:contains("${headerText}"))`;
-}
-
-function getStandardAcrossEntitiesLink(entityNameOrdinaryCasePlural) {
-    return `${getWidgetSelector(`Passing standards across ${entityNameOrdinaryCasePlural}`)} a`;
-}
-
-describe('Compliance Dashboard', () => {
-    withAuth();
-
-    before(function () {
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-    });
-
-    it('should scan for compliance data', () => {
-        triggerScan(); // prerequisite for the following tests
-    });
-
-    it('should have title', () => {
-        visitComplianceDashboard();
-
-        cy.title().should('match', getRegExpForTitleWithBranding('Compliance'));
-    });
-
-    it('should show the same amount of clusters as list', () => {
-        visitComplianceDashboard();
-
-        verifyDashboardEntityLink('clusters', /^\d+ clusters?/); // include ^ but omit $
-    });
-
-    it('should show the same amount of namespaces as list', () => {
-        visitComplianceDashboard();
-
-        verifyDashboardEntityLink('namespaces', /^\d+ namespaces?/); // include ^ but omit $
-    });
-
-    it('should show the same amount of nodes as list', () => {
-        visitComplianceDashboard();
-
-        verifyDashboardEntityLink('nodes', /^\d+ nodes?/); // include ^ but omit $
-    });
-
-    it('should show the same amount of deployments as list', () => {
-        visitComplianceDashboard();
-
-        verifyDashboardEntityLink('deployments', /^\d+ deployments?/); // include ^ but omit $
-    });
-
-    it('should link from Passing Standards Across Clusters widget to standards grouped by clusters list', () => {
-        visitComplianceDashboard();
-
-        interactAndWaitForComplianceStandard(() => {
-            cy.get(getStandardAcrossEntitiesLink('clusters')).first().click();
-        });
-        cy.location('search').should('contain', '?s[groupBy]=CLUSTER'); // followed by a standard
-        cy.get('[data-testid="panel-header"]').contains('cluster');
-        cy.get(selectors.list.table.firstGroup).should('be.visible');
-    });
-
-    it('should link from Passing Standards Across Namespaces widget to standards grouped by namespaces list', () => {
-        visitComplianceDashboard();
-
-        interactAndWaitForComplianceStandard(() => {
-            cy.get(getStandardAcrossEntitiesLink('namespaces')).first().click();
-        });
-        cy.location('search').should('contain', '?s[groupBy]=NAMESPACE'); // followed by a standard
-        cy.get('[data-testid="panel-header"]').contains('namespace');
-        cy.get(selectors.list.table.firstGroup).should('be.visible');
-    });
-
-    it('should link from Passing Standards Across Nodes widget to standards grouped by nodes list', () => {
-        visitComplianceDashboard();
-
-        interactAndWaitForComplianceStandard(() => {
-            cy.get(getStandardAcrossEntitiesLink('nodes')).first().click();
-        });
-        cy.location('search').should('contain', '?s[groupBy]=NODE'); // followed by a standard
-        cy.get('[data-testid="panel-header"]').contains('node');
-        cy.get(selectors.list.table.firstGroup).should('be.visible');
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/compliance/complianceList.test.js b/ui/apps/platform/cypress/integration/compliance/complianceList.test.js
deleted file mode 100644
index 32a6ca5097d6c..0000000000000
--- a/ui/apps/platform/cypress/integration/compliance/complianceList.test.js
+++ /dev/null
@@ -1,134 +0,0 @@
-import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag } from '../../helpers/features';
-import searchSelectors from '../../selectors/search';
-
-import {
-    assertComplianceEntityPage,
-    interactAndWaitForComplianceEntities,
-    interactAndWaitForComplianceEntityInSidePanel,
-    triggerScan,
-    visitComplianceEntities,
-    visitComplianceStandard,
-} from './Compliance.helpers';
-import { selectors } from './Compliance.selectors';
-
-describe('Compliance entities list', () => {
-    withAuth();
-
-    before(function () {
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-    });
-
-    // TODO: ROX-30939: fix test for OCP4.20 "1 namespace" (openshift-cloud-credential-operator)
-    it.skip('should filter namespaces table with passing controls', () => {
-        triggerScan(); // in case complianceDashboard.test.js is skipped
-        visitComplianceEntities('namespaces');
-
-        interactAndWaitForComplianceEntities(() => {
-            cy.get(searchSelectors.input).type('Compliance State:');
-            cy.get(searchSelectors.input).type('{enter}');
-            cy.get(searchSelectors.input).type('Pass');
-            cy.get(searchSelectors.input).type('{enter}');
-        }, 'namespaces');
-        cy.get('.rt-tbody .rt-tr').should('not.exist');
-        cy.get('[data-testid="panel-header"]').should('contain', '0 namespaces');
-    });
-
-    it('should filter namespaces table with failing controls', () => {
-        visitComplianceEntities('namespaces');
-
-        interactAndWaitForComplianceEntities(() => {
-            cy.get(searchSelectors.input).type('Compliance State:');
-            cy.get(searchSelectors.input).type('{enter}');
-            cy.get(searchSelectors.input).type('Fail');
-            cy.get(searchSelectors.input).type('{enter}');
-        }, 'namespaces');
-        cy.get('.rt-tbody .rt-tr');
-        cy.get('[data-testid="panel-header"]').should('contain', 'namespace');
-    });
-
-    it('should open/close side panel when clicking on a table row', () => {
-        visitComplianceEntities('clusters');
-
-        cy.get(selectors.list.table.firstRowName)
-            .invoke('text')
-            .then((name) => {
-                cy.get('[data-testid="panel-header"]').should('contain', 'cluster');
-                cy.get(selectors.list.table.firstRow).click();
-                cy.get('[data-testid="side-panel"]').should('exist');
-                cy.get('[data-testid="side-panel-header"]').contains(name);
-                cy.get('[data-testid="side-panel"] [aria-label="Close"]').click();
-                cy.get('[data-testid="side-panel"]').should('not.exist');
-                cy.get('[data-testid="panel-header"]').should('contain', 'cluster');
-            });
-    });
-
-    it('should have the same percentage from list to entity widget', () => {
-        visitComplianceEntities('clusters');
-
-        cy.get(selectors.list.table.firstRow).click();
-        cy.get(selectors.list.table.firstStandard)
-            .invoke('text')
-            .then((firstStandard) => {
-                cy.get(selectors.list.table.firstPercentage)
-                    .invoke('text')
-                    .then((firstTablePercentage) => {
-                        cy.get(`[data-testid="${firstStandard}-compliance"] div.rv-sunburst text`)
-                            .invoke('text')
-                            .then((firstWidgetPercentage) =>
-                                expect(firstTablePercentage).to.equal(firstWidgetPercentage)
-                            );
-                    });
-            });
-    });
-
-    it('should link to entity page when clicking on side panel header', () => {
-        visitComplianceEntities('clusters');
-
-        cy.get(selectors.list.table.firstRowName)
-            .invoke('text')
-            .then((name) => {
-                interactAndWaitForComplianceEntityInSidePanel(() => {
-                    cy.get(selectors.list.table.firstRow).click();
-                }, 'clusters');
-                cy.get('[data-testid="side-panel-header"]').contains(name);
-                cy.get('[data-testid="side-panel-header"]').click();
-                assertComplianceEntityPage('clusters');
-            });
-    });
-
-    it('should be sorted by version in standards list', () => {
-        visitComplianceStandard('CIS Kubernetes v1.5');
-
-        cy.get(selectors.list.table.firstRowName)
-            .invoke('text')
-            .then((text1) => {
-                cy.get(selectors.list.table.secondRowName)
-                    .invoke('text')
-                    .then((text2) => {
-                        const arr1 = text1.split(' ')[0];
-                        const controlArr1 = arr1.split('.');
-                        const arr2 = text2.split(' ')[0];
-                        const controlArr2 = arr2.split('.');
-                        expect(parseInt(controlArr1[0], 10)).to.be.at.most(
-                            parseInt(controlArr2[0], 10)
-                        );
-                        if (controlArr1[1] && controlArr2[1]) {
-                            expect(parseInt(controlArr1[1], 10)).to.be.at.most(
-                                parseInt(controlArr2[1], 10)
-                            );
-                        }
-                    });
-            });
-    });
-
-    it('should collapse/open table grouping', () => {
-        visitComplianceStandard('PCI DSS 3.2.1');
-
-        cy.get(selectors.list.table.firstTableGroup).should('be.visible');
-        cy.get(selectors.list.table.firstGroup).click();
-        cy.get(selectors.list.table.firstTableGroup).should('not.be.visible');
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/compliance/hideScanResults.helpers.js b/ui/apps/platform/cypress/integration/compliance/hideScanResults.helpers.js
deleted file mode 100644
index ff12927049367..0000000000000
--- a/ui/apps/platform/cypress/integration/compliance/hideScanResults.helpers.js
+++ /dev/null
@@ -1,52 +0,0 @@
-import { interactAndWaitForResponses } from '../../helpers/request';
-
-import { routeMatcherMapWithoutStandards } from './Compliance.helpers';
-
-// selectors
-
-export const selectorForModal = `[role="dialog"]:has('h1:contains("Manage standards")')`;
-
-export function selectorInModal(selector) {
-    return `${selectorForModal} ${selector}`;
-}
-export function selectorForWidget(title) {
-    return `.widget:has('[data-testid="widget-header"]:contains("${title}")')`;
-}
-
-export function selectorInWidget(title, selector) {
-    return `${selectorForWidget(title)} ${selector}`;
-}
-
-// interactions
-
-export function openModal() {
-    const routeMatcherMap = {
-        'compliance/standards': {
-            method: 'GET',
-            url: '/v1/compliance/standards',
-        },
-    };
-
-    interactAndWaitForResponses(() => {
-        cy.get('button:contains("Manage standards")').click();
-    }, routeMatcherMap);
-
-    cy.get(selectorForModal);
-}
-
-export function clickSaveAndWaitForPatchComplianceStandards(standardIds) {
-    const routeMatcherMapForPatch = Object.fromEntries(
-        standardIds.map((standardId) => [
-            `PATCH_${standardId}`,
-            { method: 'PATCH', url: `/v1/compliance/standards/${standardId}` },
-        ])
-    );
-    const routeMatcherMap = {
-        ...routeMatcherMapForPatch,
-        ...routeMatcherMapWithoutStandards,
-    };
-
-    return interactAndWaitForResponses(() => {
-        cy.get(selectorInModal('button:contains("Save")')).click();
-    }, routeMatcherMap); // TODO GraphQL requests?
-}
diff --git a/ui/apps/platform/cypress/integration/compliance/hideScanResults.test.js b/ui/apps/platform/cypress/integration/compliance/hideScanResults.test.js
deleted file mode 100644
index ddb88bd6ded79..0000000000000
--- a/ui/apps/platform/cypress/integration/compliance/hideScanResults.test.js
+++ /dev/null
@@ -1,128 +0,0 @@
-import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag } from '../../helpers/features';
-import { getInputByLabel } from '../../helpers/formHelpers';
-
-import { triggerScan, visitComplianceDashboard } from './Compliance.helpers';
-import {
-    clickSaveAndWaitForPatchComplianceStandards,
-    openModal,
-    selectorForModal,
-    selectorInModal,
-    selectorInWidget,
-} from './hideScanResults.helpers';
-
-const titleAcrossClusters = 'Passing standards across clusters';
-const titleAcrossNamespaces = 'Passing standards across namespaces';
-
-const forHIPAA = {
-    standardId: 'HIPAA_164',
-    barLink: 'a:contains("HIPAA")',
-    checkboxLabel: 'HIPAA 164',
-};
-
-const forNIST190 = {
-    standardId: 'NIST_800_190',
-    barLink: 'a:contains("NIST SP 800-190")',
-    checkboxLabel: 'NIST SP 800-190',
-};
-
-const forNIST53 = {
-    standardId: 'NIST_SP_800_53_Rev_4',
-    barLink: 'a:contains("NIST SP 800-53")',
-    checkboxLabel: 'NIST SP 800-53',
-};
-
-function assertExistenceOfStandard(forStandard, existence) {
-    const { barLink } = forStandard;
-    const existOrNot = existence ? 'exist' : 'not.exist';
-
-    cy.get(selectorInWidget(titleAcrossClusters, barLink)).should(existOrNot);
-    cy.get(selectorInWidget(titleAcrossNamespaces, barLink)).should(existOrNot);
-
-    // TODO columns in entity tables
-}
-
-function assertCheckedAndClickStandard(forStandard, checked) {
-    const { checkboxLabel } = forStandard;
-    const haveAttrOrNot = checked ? 'have.attr' : 'not.have.attr';
-
-    getInputByLabel(checkboxLabel).should(haveAttrOrNot, 'checked');
-    getInputByLabel(checkboxLabel).click();
-}
-
-describe('Compliance hideScanResults', () => {
-    withAuth();
-
-    before(function () {
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-    });
-
-    it('should open modal and then cancel', () => {
-        triggerScan(); // in case complianceDashboard.test.js is skipped
-        openModal();
-
-        cy.get(selectorInModal('button:contains("Save")')).should('be.disabled');
-        cy.get(selectorInModal('button:contains("Cancel")')).click();
-        cy.get(selectorForModal).should('not.exist');
-    });
-
-    it('should hide HIPAA standard', () => {
-        visitComplianceDashboard();
-
-        assertExistenceOfStandard(forHIPAA, true);
-
-        openModal();
-
-        assertCheckedAndClickStandard(forHIPAA, true);
-        clickSaveAndWaitForPatchComplianceStandards([forHIPAA.standardId]);
-
-        assertExistenceOfStandard(forHIPAA, false);
-    });
-
-    // The following test depends on the preceding test.
-
-    it('should show HIPAA standard and hide NIST standards', () => {
-        visitComplianceDashboard();
-
-        assertExistenceOfStandard(forHIPAA, false);
-        assertExistenceOfStandard(forNIST190, true);
-        assertExistenceOfStandard(forNIST53, true);
-
-        openModal();
-        assertCheckedAndClickStandard(forHIPAA, false);
-        assertCheckedAndClickStandard(forNIST190, true);
-        assertCheckedAndClickStandard(forNIST53, true);
-
-        clickSaveAndWaitForPatchComplianceStandards([
-            forHIPAA.standardId,
-            forNIST190.standardId,
-            forNIST53.standardId,
-        ]);
-
-        assertExistenceOfStandard(forHIPAA, true);
-        assertExistenceOfStandard(forNIST190, false);
-        assertExistenceOfStandard(forNIST53, false);
-    });
-
-    // The following test depends on the preceding test.
-
-    it('should show NIST standards', () => {
-        visitComplianceDashboard();
-
-        assertExistenceOfStandard(forNIST190, false);
-        assertExistenceOfStandard(forNIST53, false);
-
-        openModal();
-        assertCheckedAndClickStandard(forNIST190, false);
-        assertCheckedAndClickStandard(forNIST53, false);
-
-        clickSaveAndWaitForPatchComplianceStandards([forNIST190.standardId, forNIST53.standardId]);
-
-        assertExistenceOfStandard(forNIST190, true);
-        assertExistenceOfStandard(forNIST53, true);
-    });
-
-    // hideScanResults is same at the end as it was at the beginning
-});
diff --git a/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.helpers.js b/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.helpers.js
index 3e45540f1e401..a9b78b2fcc5e6 100644
--- a/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.helpers.js
+++ b/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.helpers.js
@@ -15,7 +15,6 @@ function getEntitiesPath(entitiesKey) {
 
 const segmentForEntity = {
     clusters: 'cluster',
-    controls: 'control',
     deployments: 'deployment',
     images: 'image',
     namespaces: 'namespace',
@@ -34,7 +33,6 @@ function getEntityPagePath(entitiesKey, id = '') {
 // Heading on entities page has sentence case for entity type.
 const headingForEntities = {
     clusters: 'Clusters',
-    controls: 'Controls',
     deployments: 'Deployments',
     images: 'Images',
     namespaces: 'Namespaces',
@@ -49,7 +47,6 @@ const headingForEntities = {
 // Heading on entity page or side panel has sentence case for entity type.
 const headingForEntity = {
     clusters: 'Cluster',
-    controls: 'Control',
     deployments: 'Deployment',
     images: 'Image',
     namespaces: 'Namespace',
@@ -62,10 +59,8 @@ const headingForEntity = {
 };
 
 function tableHeaderRegExp(entitiesKey) {
-    const singular =
-        entitiesKey === 'controls' ? 'CIS Control' : headingForEntity[entitiesKey].toLowerCase();
-    const plural =
-        entitiesKey === 'controls' ? 'CIS Controls' : headingForEntities[entitiesKey].toLowerCase();
+    const singular = headingForEntity[entitiesKey].toLowerCase();
+    const plural = headingForEntities[entitiesKey].toLowerCase();
 
     // Complexity to exclude 1 for plural.
     // Double backslash \\d needed for RegExp constructor unlike RegExp literal.
@@ -74,7 +69,6 @@ function tableHeaderRegExp(entitiesKey) {
 
 const countNounRegExp = {
     // clusters has singular link by name
-    controls: /\d+ Controls?$/,
     deployments: /^\d+ deployments?$/,
     images: /\d+ images?$/,
     // namespaces
@@ -89,7 +83,6 @@ const countNounRegExp = {
 // Title of widget is title case but has uppercase style.
 const widgetTitleForEntities = {
     clusters: 'Clusters',
-    controls: 'CIS Controls',
     deployments: 'Deployments',
     images: 'Images',
     namespaces: 'Namespaces',
@@ -117,7 +110,6 @@ function getRouteMatcherMapForEntities(entitiesKey) {
 
 const opnameForEntity = {
     clusters: 'getCluster',
-    controls: 'getControl',
     deployments: 'getDeployment',
     images: 'getImage',
     namespaces: 'getNamespace',
@@ -136,7 +128,6 @@ function getRouteMatcherMapForEntity(entitiesKey) {
 
 const typeOfEntity = {
     clusters: 'CLUSTER',
-    controls: 'CONTROL',
     deployments: 'DEPLOYMENT',
     images: 'IMAGE',
     namespaces: 'NAMESPACE',
@@ -152,12 +143,8 @@ function opnameForPrimaryAndSecondaryEntities(entitiesKey1, entitiesKey2) {
     return `${opnameForEntity[entitiesKey1]}_${typeOfEntity[entitiesKey2]}`;
 }
 
-const routeMatcherMapForConfigurationManagementDashboard = getRouteMatcherMapForGraphQL([
-    'complianceByControls',
-]);
-
 export function visitConfigurationManagementDashboard() {
-    visit(basePath, routeMatcherMapForConfigurationManagementDashboard);
+    visit(basePath);
 
     cy.get('h1:contains("Configuration Management")');
 }
@@ -245,22 +232,6 @@ export function interactAndWaitForConfigurationManagementSecondaryEntities(
     interactAndWaitForResponses(interactionCallback, routeMatcherMap);
 }
 
-export function interactAndWaitForConfigurationManagementScan(interactionCallback) {
-    interactAndWaitForResponses(
-        interactionCallback,
-        routeMatcherMapForConfigurationManagementDashboard
-    );
-
-    // ROX-24912
-    // Comment out for now and assume that scan results are available from compliance tests.
-    // Maybe interactAndWaitForResponses waits only for the first pair of responses from page visit.
-    // Apparently the negative assertion sometimes passes before ComplianceScanProgress renders.
-    // But auto-disappears prevents positive assertion as in scanCompliance helper function.
-    cy.get('div:contains("Compliance scanning in progress")', {
-        timeout: 60000,
-    }).should('not.exist');
-}
-
 export function navigateToSingleEntityPage(entitiesKey) {
     // interactAndWaitForConfigurationManagementEntityPage(() => {
     //     cy.get('[data-testid="side-panel"] [aria-label="link"]').click();
@@ -370,18 +341,11 @@ function verifyWidgetLinkToTable(entitiesKey1, entitiesKey2, contextSelector) {
                 cy.get(`${selectors.countWidgets}:contains('${listEntity}') button`).click();
             }
 
-            if (
-                (entitiesKey1 === 'controls' && entitiesKey2 === 'nodes') ||
-                (entitiesKey1 === 'nodes' && entitiesKey2 === 'controls')
-            ) {
-                clickCountWidget(); // no request
-            } else {
-                interactAndWaitForConfigurationManagementSecondaryEntities(
-                    clickCountWidget,
-                    entitiesKey1,
-                    entitiesKey2
-                );
-            }
+            interactAndWaitForConfigurationManagementSecondaryEntities(
+                clickCountWidget,
+                entitiesKey1,
+                entitiesKey2
+            );
 
             cy.get(`${contextSelector} .rt-tr-group`);
             cy.get(`${contextSelector} [data-testid="panel-header"]`).contains(
diff --git a/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.selectors.js b/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.selectors.js
index 58dd303d26071..2600eb55be4dc 100644
--- a/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.selectors.js
+++ b/ui/apps/platform/cypress/integration/configmanagement/ConfigurationManagement.selectors.js
@@ -9,16 +9,6 @@ export const dashboardSelectors = {
     getWidget: (title) => {
         return `[data-testid="widget"]:contains('${title}')`;
     },
-    cisStandardsAcrossClusters: {
-        widget: '[data-testid="compliance-by-controls"]',
-        select: {
-            input: '[data-testid="compliance-by-controls"] .react-select__control',
-            value: '[data-testid="compliance-by-controls"] .react-select__single-value',
-            options: '[data-testid="compliance-by-controls"] .react-select__option',
-        },
-        passingControlsLink: 'a:contains("Controls Passing")',
-        failingControlsLinks: 'a:contains("Controls Failing")',
-    },
     horizontalBars: '.rv-xy-plot__series.rv-xy-plot__series--bar > rect',
 };
 
diff --git a/ui/apps/platform/cypress/integration/configmanagement/ciscontrols.test.js b/ui/apps/platform/cypress/integration/configmanagement/ciscontrols.test.js
deleted file mode 100644
index 51a1e8374087b..0000000000000
--- a/ui/apps/platform/cypress/integration/configmanagement/ciscontrols.test.js
+++ /dev/null
@@ -1,103 +0,0 @@
-import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag, hasOrchestratorFlavor } from '../../helpers/features';
-import { triggerScan } from '../compliance/Compliance.helpers';
-
-import {
-    clickOnCountWidget,
-    hasCountWidgetsFor,
-    hasTabsFor,
-    interactAndWaitForConfigurationManagementScan,
-    navigateToSingleEntityPage,
-    verifyWidgetLinkToTableFromSidePanel,
-    verifyWidgetLinkToTableFromSinglePage,
-    visitConfigurationManagementDashboard,
-    visitConfigurationManagementEntitiesWithSearch,
-    visitConfigurationManagementEntityInSidePanel,
-} from './ConfigurationManagement.helpers';
-
-const entitiesKey = 'controls';
-
-describe('Configuration Management Controls', () => {
-    withAuth();
-
-    // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-    before(function () {
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-    });
-
-    before(function beforeHook() {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-    });
-
-    it('should render the controls list and open the side panel when a row is clicked', () => {
-        // ROX-13537: See if compliance scan prevents failure of last tests because no Pass or no Fail status.
-        triggerScan();
-
-        visitConfigurationManagementDashboard();
-
-        // This and the following tests assumes that scan results are available
-        interactAndWaitForConfigurationManagementScan(() => {
-            cy.get('[data-testid="scan-button"]').click();
-        });
-
-        visitConfigurationManagementEntityInSidePanel(entitiesKey);
-    });
-
-    it('should take you to a control single when the "navigate away" button is clicked', () => {
-        visitConfigurationManagementEntityInSidePanel(entitiesKey);
-        navigateToSingleEntityPage(entitiesKey);
-    });
-
-    it('should have the correct count widgets for a single entity view', () => {
-        visitConfigurationManagementEntityInSidePanel(entitiesKey);
-        navigateToSingleEntityPage(entitiesKey);
-        hasCountWidgetsFor(['Nodes']);
-    });
-
-    // ROX-13028: skip pending investigation why sometimes 0 nodes for control, therefore widget is disabled.
-    it.skip('should click on the nodes count widget in the entity page and show the nodes tab', () => {
-        visitConfigurationManagementEntityInSidePanel(entitiesKey);
-        navigateToSingleEntityPage(entitiesKey);
-        clickOnCountWidget('nodes', 'entityList');
-    });
-
-    it('should have the correct tabs for a single entity view', () => {
-        visitConfigurationManagementEntityInSidePanel(entitiesKey);
-        navigateToSingleEntityPage(entitiesKey);
-        hasTabsFor(['nodes']);
-    });
-
-    describe('should go to nodes table from widget link', () => {
-        const entitiesKey2 = 'nodes';
-
-        it('in single page', () => {
-            verifyWidgetLinkToTableFromSinglePage(entitiesKey, entitiesKey2);
-        });
-
-        it('in side panel', () => {
-            verifyWidgetLinkToTableFromSidePanel(entitiesKey, entitiesKey2);
-        });
-    });
-
-    it('should show no failing nodes in the control findings section of a passing control', () => {
-        visitConfigurationManagementEntitiesWithSearch(entitiesKey, '?s[Compliance%20State]=Pass');
-
-        // Click first row which has pass in Control Status column to open control in side panel.
-        cy.get(`.rt-td:nth-child(4):contains("Pass"):nth(0)`).click();
-        // Control Findings
-        cy.get('[data-testid="widget"] .rt-tbody .rt-tr').should('have.length', 0);
-    });
-
-    it('should show failing nodes in the control findings section of a failing control', () => {
-        visitConfigurationManagementEntitiesWithSearch(entitiesKey, '?s[Compliance%20State]=Fail');
-
-        // Click first row which has fail in Control Status column to open control in side panel.
-        cy.get(`.rt-td:nth-child(4):contains("Fail"):nth(0)`).click();
-        // Control Findings
-        cy.get('[data-testid="widget"] .rt-tbody .rt-tr').should('not.have.length', 0);
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/configmanagement/clusters.test.js b/ui/apps/platform/cypress/integration/configmanagement/clusters.test.js
index d0cd978d94576..e115a0ac38910 100644
--- a/ui/apps/platform/cypress/integration/configmanagement/clusters.test.js
+++ b/ui/apps/platform/cypress/integration/configmanagement/clusters.test.js
@@ -3,12 +3,10 @@ import withAuth from '../../helpers/basicAuth';
 import {
     hasCountWidgetsFor,
     hasTabsFor,
-    interactAndWaitForConfigurationManagementScan,
     navigateToSingleEntityPage,
     verifyTableLinkToSidePanelTable,
     verifyWidgetLinkToTableFromSidePanel,
     verifyWidgetLinkToTableFromSinglePage,
-    visitConfigurationManagementDashboard,
     visitConfigurationManagementEntities,
     visitConfigurationManagementEntityInSidePanel,
 } from './ConfigurationManagement.helpers';
@@ -40,7 +38,6 @@ describe('Configuration Management Clusters', () => {
             'Users & Groups',
             'Service Accounts',
             'Roles',
-            'Controls',
         ]);
     });
 
@@ -56,7 +53,6 @@ describe('Configuration Management Clusters', () => {
             'subjects',
             'serviceaccounts',
             'roles',
-            'controls',
         ]);
     });
 
@@ -154,30 +150,6 @@ describe('Configuration Management Clusters', () => {
         });
     });
 
-    describe('should go to controls table from widget link', () => {
-        const entitiesKey2 = 'controls';
-
-        it('in single page', () => {
-            verifyWidgetLinkToTableFromSinglePage(entitiesKey, entitiesKey2);
-        });
-
-        it('in side panel', () => {
-            verifyWidgetLinkToTableFromSidePanel(entitiesKey, entitiesKey2);
-        });
-    });
-
-    // ROX-13011: Prevent failures, pending investigation into reason why No Controls instead of link sometimes.
-    it.skip('should go from table link to controls table in side panel', () => {
-        visitConfigurationManagementDashboard();
-
-        // This test assumes that scan results are available
-        interactAndWaitForConfigurationManagementScan(() => {
-            cy.get('[data-testid="scan-button"]').click();
-        });
-
-        verifyTableLinkToSidePanelTable(entitiesKey, 'controls');
-    });
-
     it('should go from table link to subjects table in side panel', () => {
         verifyTableLinkToSidePanelTable(entitiesKey, 'subjects');
     });
diff --git a/ui/apps/platform/cypress/integration/configmanagement/dashboard.test.js b/ui/apps/platform/cypress/integration/configmanagement/dashboard.test.js
index 9c7d7f84d46f6..aba8af05eee90 100644
--- a/ui/apps/platform/cypress/integration/configmanagement/dashboard.test.js
+++ b/ui/apps/platform/cypress/integration/configmanagement/dashboard.test.js
@@ -1,11 +1,9 @@
 import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag, hasOrchestratorFlavor } from '../../helpers/features';
 import { getRegExpForTitleWithBranding } from '../../helpers/title';
 
 import {
     interactAndWaitForConfigurationManagementEntities,
     interactAndWaitForConfigurationManagementEntityInSidePanel,
-    // interactAndWaitForConfigurationManagementScan,
     visitConfigurationManagementDashboard,
 } from './ConfigurationManagement.helpers';
 import { selectors } from './ConfigurationManagement.selectors';
@@ -56,33 +54,6 @@ describe('Configuration Management Dashboard', () => {
             });
     });
 
-    it('should show same number of controls between the tile and the controls list', function () {
-        // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-
-        const entitiesKey = 'controls';
-
-        visitConfigurationManagementDashboard();
-
-        cy.get(`${selectors.tileLinks}:eq(1) ${selectors.tileLinkValue}`)
-            .invoke('text')
-            .then((value) => {
-                const numControls = value;
-
-                interactAndWaitForConfigurationManagementEntities(() => {
-                    cy.get(`${selectors.tileLinks}:eq(1)`).click();
-                }, entitiesKey);
-
-                cy.get(`[data-testid="panel"] [data-testid="panel-header"]`)
-                    .invoke('text')
-                    .then((panelHeaderText) => {
-                        expect(parseInt(panelHeaderText, 10)).to.equal(parseInt(numControls, 10));
-                    });
-            });
-    });
-
     it('should properly navigate to the policies list', () => {
         const entitiesKey = 'policies';
 
@@ -93,21 +64,6 @@ describe('Configuration Management Dashboard', () => {
         }, entitiesKey);
     });
 
-    it('should properly navigate to the cis controls list', function () {
-        // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-
-        const entitiesKey = 'controls';
-
-        visitConfigurationManagementDashboard();
-
-        interactAndWaitForConfigurationManagementEntities(() => {
-            cy.get(`${selectors.tileLinks}:eq(1)`).click();
-        }, entitiesKey);
-    });
-
     it('should properly navigate to the clusters list', () => {
         const entitiesKey = 'clusters';
 
@@ -219,23 +175,6 @@ describe('Configuration Management Dashboard', () => {
         }, entitiesKey);
     });
 
-    it('go to controls list from View link in CIS widget', function () {
-        // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-
-        const entitiesKey = 'controls';
-
-        visitConfigurationManagementDashboard();
-
-        interactAndWaitForConfigurationManagementEntities(() => {
-            cy.get(selectors.cisStandardsAcrossClusters.widget)
-                .find('a:contains("View standard")')
-                .click();
-        }, entitiesKey);
-    });
-
     it('should go to subjects (users and groups) list from View link in Users widget', () => {
         const entitiesKey = 'subjects';
 
@@ -289,62 +228,6 @@ describe('Configuration Management Dashboard', () => {
         cy.location('search').should('contain', '[Policy%20Status]='); // either Fail (for rated as Whatever) or Pass (for policies without violations)
     });
 
-    it('clicking the "CIS Standard Across Clusters" widget\'s "passing controls" link should take you to the controls list and filter by passing controls', function () {
-        // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        const entitiesKey = 'controls';
-
-        visitConfigurationManagementDashboard();
-
-        // This and the following test assumes that scan results are available
-        // ROX-24912
-        // Comment out for now and assume that scan results are available from compliance tests.
-        // See function for more details.
-        /*
-        interactAndWaitForConfigurationManagementScan(() => {
-            cy.get('[data-testid="scan-button"]').click();
-        });
-        */
-
-        interactAndWaitForConfigurationManagementEntities(() => {
-            cy.get(selectors.cisStandardsAcrossClusters.widget)
-                .find(selectors.cisStandardsAcrossClusters.passingControlsLink)
-                .click();
-        }, entitiesKey);
-
-        cy.location('search').should('contain', '[Compliance%20State]=Pass');
-    });
-
-    it('clicking the "CIS Standard Across Clusters" widget\'s "failing controls" link should take you to the controls list and filter by failing controls', function () {
-        // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        const entitiesKey = 'controls';
-
-        visitConfigurationManagementDashboard();
-
-        interactAndWaitForConfigurationManagementEntities(() => {
-            cy.get(selectors.cisStandardsAcrossClusters.widget)
-                .find(selectors.cisStandardsAcrossClusters.failingControlsLinks)
-                .click();
-        }, entitiesKey);
-
-        cy.location('search').should('contain', '[Compliance%20State]=Fail');
-    });
-
     it('should open side panel from link in Secrets widget', () => {
         const entitiesKey = 'secrets';
 
diff --git a/ui/apps/platform/cypress/integration/configmanagement/nodes.test.js b/ui/apps/platform/cypress/integration/configmanagement/nodes.test.js
index 0a67650f72de9..87551bbab72f2 100644
--- a/ui/apps/platform/cypress/integration/configmanagement/nodes.test.js
+++ b/ui/apps/platform/cypress/integration/configmanagement/nodes.test.js
@@ -1,18 +1,10 @@
 import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag, hasOrchestratorFlavor } from '../../helpers/features';
-import { triggerScan } from '../compliance/Compliance.helpers';
 
 import {
-    clickEntityTableRowThatHasLinkInColumn,
-    clickOnCountWidget,
     clickOnSingleEntityInTable,
     clickOnSingularEntityWidgetInSidePanel,
-    hasCountWidgetsFor,
     hasRelatedEntityFor,
-    hasTabsFor,
     navigateToSingleEntityPage,
-    verifyWidgetLinkToTableFromSidePanel,
-    verifyWidgetLinkToTableFromSinglePage,
     visitConfigurationManagementEntityInSidePanel,
 } from './ConfigurationManagement.helpers';
 
@@ -44,53 +36,4 @@ describe('Configuration Management Nodes', () => {
         navigateToSingleEntityPage(entitiesKey);
         hasRelatedEntityFor('Cluster');
     });
-
-    it('should have the correct count widgets for a single entity view', () => {
-        visitConfigurationManagementEntityInSidePanel(entitiesKey);
-        navigateToSingleEntityPage(entitiesKey);
-        hasCountWidgetsFor(['Controls']);
-    });
-
-    it('should have the correct tabs for a single entity view', () => {
-        visitConfigurationManagementEntityInSidePanel(entitiesKey);
-        navigateToSingleEntityPage(entitiesKey);
-        hasTabsFor(['controls']);
-    });
-
-    it('should click on the controls count widget in the entity page and show the controls tab', function () {
-        // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-        if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-            this.skip();
-        }
-
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        triggerScan(); // because test assumes that scan results are available
-
-        const columnIndexForControls = 7;
-        clickEntityTableRowThatHasLinkInColumn(entitiesKey, columnIndexForControls);
-        navigateToSingleEntityPage(entitiesKey);
-        clickOnCountWidget('controls', 'entityList');
-    });
-
-    describe('should go to controls table from widget link', () => {
-        // Skip although Controls and CIS Kubernetes v1.5 are visible, because these tests assume compliance tests ran and triggered a scan (pardon rhyme).
-        before(function () {
-            if (!hasFeatureFlag('ROX_DEPRECATED_COMPLIANCE_DASHBOARD')) {
-                this.skip();
-            }
-        });
-
-        const entitiesKey2 = 'controls';
-
-        it('in single page', () => {
-            verifyWidgetLinkToTableFromSinglePage(entitiesKey, entitiesKey2);
-        });
-
-        it('in side panel', () => {
-            verifyWidgetLinkToTableFromSidePanel(entitiesKey, entitiesKey2);
-        });
-    });
 });
diff --git a/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.helpers.js b/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.helpers.js
index 1d8f11767f48d..e3bc6efbb1d59 100644
--- a/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.helpers.js
+++ b/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.helpers.js
@@ -53,12 +53,12 @@ export function visitSystemConfigurationWithCentralCredentialExpiryBanner(
     );
 }
 
-export function visitSystemConfigurationWithScannerCredentialExpiryBanner(
+export function visitSystemConfigurationWithScannerV4CredentialExpiryBanner(
     expiry,
     staticResponseForPermissions
 ) {
     visitSystemConfigurationWithCredentialExpiryBanner(
-        'SCANNER',
+        'SCANNER_V4',
         expiry,
         staticResponseForPermissions
     );
@@ -83,6 +83,6 @@ export function interactAndWaitForCentralCertificateDownload(interactionCallback
     interactAndWaitForCertificateDownload('central', interactionCallback);
 }
 
-export function interactAndWaitForScannerCertificateDownload(interactionCallback) {
-    interactAndWaitForCertificateDownload('scanner', interactionCallback);
+export function interactAndWaitForScannerV4CertificateDownload(interactionCallback) {
+    interactAndWaitForCertificateDownload('scanner?v=4', interactionCallback);
 }
diff --git a/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.test.js b/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.test.js
index 2b63b528077bc..8f227ea4f423f 100644
--- a/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.test.js
+++ b/ui/apps/platform/cypress/integration/credentialExpiry/credentialExpiry.test.js
@@ -4,13 +4,13 @@ import withAuth from '../../helpers/basicAuth';
 
 import {
     interactAndWaitForCentralCertificateDownload,
-    interactAndWaitForScannerCertificateDownload,
+    interactAndWaitForScannerV4CertificateDownload,
     visitSystemConfigurationWithCentralCredentialExpiryBanner,
-    visitSystemConfigurationWithScannerCredentialExpiryBanner,
+    visitSystemConfigurationWithScannerV4CredentialExpiryBanner,
 } from './credentialExpiry.helpers';
 
 const centralCredentialExpiryBanner = '.pf-v6-c-banner:contains("Central certificate")';
-const scannerCredentialExpiryBanner = '.pf-v6-c-banner:contains("Scanner certificate")';
+const scannerV4CredentialExpiryBanner = '.pf-v6-c-banner:contains("Scanner V4 certificate")';
 
 describe('Credential expiry', () => {
     withAuth();
@@ -76,16 +76,16 @@ describe('Credential expiry', () => {
         });
     });
 
-    describe('for scanner', () => {
-        it('should not display banner if scanner cert is expiring more than 14 days later', () => {
+    describe('for scanner v4', () => {
+        it('should not display banner if scanner v4 cert is expiring more than 14 days later', () => {
             const expiry = dateFns.addHours(dateFns.addDays(new Date(), 15), 1);
 
-            visitSystemConfigurationWithScannerCredentialExpiryBanner(expiry);
+            visitSystemConfigurationWithScannerV4CredentialExpiryBanner(expiry);
 
-            cy.get(centralCredentialExpiryBanner).should('not.exist');
+            cy.get(scannerV4CredentialExpiryBanner).should('not.exist');
         });
 
-        it("should display banner without download button if user doesn't have the required permission", () => {
+        it('should display banner without download button if user does not have the required permission', () => {
             const expiry = dateFns.addMinutes(dateFns.addHours(new Date(), 23), 30);
 
             cy.fixture('auth/mypermissionsMinimalAccess.json').then(({ resourceToAccess }) => {
@@ -95,44 +95,44 @@ describe('Credential expiry', () => {
                     },
                 };
 
-                visitSystemConfigurationWithScannerCredentialExpiryBanner(
+                visitSystemConfigurationWithScannerV4CredentialExpiryBanner(
                     expiry,
                     staticResponseForPermissions
                 );
 
-                cy.get(scannerCredentialExpiryBanner)
+                cy.get(scannerV4CredentialExpiryBanner)
                     .invoke('text')
                     .then((text) => {
-                        expect(text).to.include('Scanner certificate expires in 23 hours');
+                        expect(text).to.include('Scanner V4 certificate expires in 23 hours');
                         expect(text).to.include('Contact your administrator');
                     });
-                cy.get(scannerCredentialExpiryBanner).find('button').should('not.exist');
+                cy.get(scannerV4CredentialExpiryBanner).find('button').should('not.exist');
             });
         });
 
         it('should show a warning banner if the expiry date is within 4-14 days', () => {
             const expiry = dateFns.addDays(new Date(), 10);
 
-            visitSystemConfigurationWithScannerCredentialExpiryBanner(expiry);
+            visitSystemConfigurationWithScannerV4CredentialExpiryBanner(expiry);
 
-            cy.get(scannerCredentialExpiryBanner).should('have.class', 'pf-m-yellow');
+            cy.get(scannerV4CredentialExpiryBanner).should('have.class', 'pf-m-yellow');
         });
 
-        it('should show a danger banner if the expiry date is greater than 14 days', () => {
+        it('should show a danger banner if the expiry date is less than or equal to 3 days', () => {
             const expiry = dateFns.addDays(new Date(), 2);
 
-            visitSystemConfigurationWithScannerCredentialExpiryBanner(expiry);
+            visitSystemConfigurationWithScannerV4CredentialExpiryBanner(expiry);
 
-            cy.get(scannerCredentialExpiryBanner).should('have.class', 'pf-m-red');
+            cy.get(scannerV4CredentialExpiryBanner).should('have.class', 'pf-m-red');
         });
 
         it('should download the YAML', () => {
             const expiry = dateFns.addDays(new Date(), 1);
 
-            visitSystemConfigurationWithScannerCredentialExpiryBanner(expiry);
+            visitSystemConfigurationWithScannerV4CredentialExpiryBanner(expiry);
 
-            interactAndWaitForScannerCertificateDownload(() => {
-                cy.get(scannerCredentialExpiryBanner).find('button').click();
+            interactAndWaitForScannerV4CertificateDownload(() => {
+                cy.get(scannerV4CredentialExpiryBanner).find('button').click();
             });
         });
     });
diff --git a/ui/apps/platform/cypress/integration/cypressExpose.test.js b/ui/apps/platform/cypress/integration/cypressExpose.test.js
new file mode 100644
index 0000000000000..b8bd7a530c1da
--- /dev/null
+++ b/ui/apps/platform/cypress/integration/cypressExpose.test.js
@@ -0,0 +1,62 @@
+import { hasFeatureFlag, hasOrchestratorFlavor } from '../helpers/features';
+
+// Assertions report key names only, so a failure never prints a secret value into the CI log.
+const SECRET_KEYS = [
+    'ROX_AUTH_TOKEN',
+    'OPENSHIFT_CONSOLE_USERNAME',
+    'OPENSHIFT_CONSOLE_PASSWORD',
+    'DEMO_PASSWORD',
+];
+
+describe('Cypress.expose public config', () => {
+    it('does not expose secrets to the browser', () => {
+        const exposed = Cypress.expose();
+        const leakedKeys = SECRET_KEYS.filter((key) => key in exposed);
+        // Feature flags are always booleans, so any other ROX_* value is an unexpected leak.
+        const nonBooleanRoxKeys = Object.keys(exposed).filter(
+            (key) => key.startsWith('ROX_') && typeof exposed[key] !== 'boolean'
+        );
+
+        expect(leakedKeys, 'secrets in Cypress.expose()').to.be.empty;
+        expect(nonBooleanRoxKeys, 'non-boolean ROX_* values in Cypress.expose()').to.be.empty;
+    });
+
+    it('copies feature flags exported by scripts/cypress.sh as booleans', function () {
+        // scripts/cypress.sh always exports ROX_AUTH_TOKEN alongside the feature flags, so use it to
+        // detect a runner launch. If the copy breaks, flag-gated tests skip silently, so fail here.
+        cy.env(['ROX_AUTH_TOKEN']).then(({ ROX_AUTH_TOKEN }) => {
+            if (!ROX_AUTH_TOKEN) {
+                this.skip();
+            }
+
+            const flagKeys = Object.keys(Cypress.expose()).filter((key) => key.startsWith('ROX_'));
+
+            expect(flagKeys, 'ROX_* feature flags in Cypress.expose()').to.not.be.empty;
+        });
+    });
+
+    it('rejects the deprecated Cypress.env() because allowCypressEnv is false', () => {
+        expect(() => Cypress.env('AXE_CORE_PATH')).to.throw();
+    });
+
+    it('feature helpers read from Cypress.expose', () => {
+        Cypress.expose({
+            ROX_FAKE_FLAG: true,
+            ROX_OTHER_FLAG: false,
+            ORCHESTRATOR_FLAVOR: 'openshift',
+        });
+
+        expect(hasFeatureFlag('ROX_FAKE_FLAG')).to.equal(true);
+        expect(hasFeatureFlag('ROX_OTHER_FLAG')).to.equal(false);
+        expect(hasFeatureFlag('ROX_MISSING_FLAG')).to.equal(false);
+        expect(hasOrchestratorFlavor('openshift')).to.equal(true);
+        expect(hasOrchestratorFlavor('k8s')).to.equal(false);
+    });
+
+    it('injects axe-core from the exposed AXE_CORE_PATH', () => {
+        // Inject directly rather than through checkAccessibility so the assertion covers the
+        // exposed path itself and does not depend on the accessibility of the current page.
+        cy.injectAxe({ axeCorePath: Cypress.expose('AXE_CORE_PATH') });
+        cy.window().its('axe').should('exist');
+    });
+});
diff --git a/ui/apps/platform/cypress/integration/legacyScannerFeatureFlag.test.ts b/ui/apps/platform/cypress/integration/legacyScannerFeatureFlag.test.ts
deleted file mode 100644
index 54c06f39e768e..0000000000000
--- a/ui/apps/platform/cypress/integration/legacyScannerFeatureFlag.test.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import dateFns from 'date-fns';
-
-import withAuth from '../helpers/basicAuth';
-import { interceptAndOverrideFeatureFlags } from '../helpers/request';
-import { visit } from '../helpers/visit';
-import {
-    credentialForScannerExpiryAlias,
-    integrationHealthVulnDefinitionsAlias,
-    setClock,
-    visitSystemHealth,
-    visitSystemHealthWithKeysRemoved,
-} from '../helpers/systemHealth';
-import { visitIntegrationsDashboard } from './integrations/integrations.helpers';
-import { visitSystemConfigurationWithScannerCredentialExpiryBanner } from './credentialExpiry/credentialExpiry.helpers';
-import { visitSystemConfiguration } from './systemConfig/systemConfig.helpers';
-import { visitNodeCveOverviewPage } from './vulnerabilities/nodeCves/NodeCve.helpers';
-
-const vulnDefinitionsCardSelector =
-    '.pf-v6-c-card:contains("StackRox Scanner Vulnerability Definitions")';
-const scannerCertificateCardSelector = '.pf-v6-c-card:contains("Scanner certificate")';
-const scannerCredentialExpiryBanner = '.pf-v6-c-banner:contains("Scanner certificate")';
-const stackRoxScannerTileSelector = '[data-testid="integration-tile"]:contains("StackRox Scanner")';
-const nodeCveScannerInfoBoxSelector = '.pf-v6-c-alert:contains("StackRox Scanner")';
-
-const disabledMessage = 'disabled by your administrator';
-
-describe('Legacy Scanner feature flag (ROX_LEGACY_SCANNER)', () => {
-    withAuth();
-
-    describe('when disabled', () => {
-        beforeEach(() => {
-            interceptAndOverrideFeatureFlags({ ROX_LEGACY_SCANNER: false });
-        });
-
-        it('should hide StackRox Scanner tile on Integrations page', () => {
-            visitIntegrationsDashboard();
-
-            cy.get(stackRoxScannerTileSelector).should('not.exist');
-        });
-
-        it('should hide scanner comparison info box on Node CVEs page', () => {
-            interceptAndOverrideFeatureFlags({
-                ROX_LEGACY_SCANNER: false,
-                ROX_SCANNER_V4: true,
-                ROX_NODE_INDEX_ENABLED: true,
-            });
-
-            visitNodeCveOverviewPage();
-
-            cy.get(nodeCveScannerInfoBoxSelector).should('not.exist');
-        });
-
-        it('should hide scanner credential expiry banner', () => {
-            visitSystemConfiguration();
-
-            cy.get(scannerCredentialExpiryBanner).should('not.exist');
-        });
-
-        it('should show disabled vuln definitions card with message on System Health page', () => {
-            visitSystemHealthWithKeysRemoved([
-                credentialForScannerExpiryAlias,
-                integrationHealthVulnDefinitionsAlias,
-            ]);
-
-            cy.get(vulnDefinitionsCardSelector).should('contain', disabledMessage);
-        });
-
-        it('should show disabled scanner certificate card with message on System Health page', () => {
-            visitSystemHealthWithKeysRemoved([
-                credentialForScannerExpiryAlias,
-                integrationHealthVulnDefinitionsAlias,
-            ]);
-
-            cy.get(scannerCertificateCardSelector).should('contain', disabledMessage);
-        });
-
-        it('should show disabled feature page for Platform CVEs', () => {
-            visit('/main/vulnerabilities/platform-cves');
-
-            cy.get('h1').should('contain', 'Kubernetes components');
-            cy.get('body').should('contain', disabledMessage);
-            cy.get('a:contains("Go to Vulnerability Management")').should('exist');
-        });
-    });
-
-    describe('when enabled', () => {
-        beforeEach(() => {
-            interceptAndOverrideFeatureFlags({ ROX_LEGACY_SCANNER: true });
-        });
-
-        it('should show active vuln definitions card on System Health page', () => {
-            const currentDatetime = new Date('2020-12-10T02:04:59.377369440Z');
-            const lastUpdatedTimestamp = '2020-12-09T03:04:59.377369440Z';
-
-            const staticResponseMap = {
-                [integrationHealthVulnDefinitionsAlias]: {
-                    body: { lastUpdatedTimestamp },
-                },
-            };
-
-            setClock(currentDatetime);
-            visitSystemHealth(staticResponseMap);
-
-            cy.get(vulnDefinitionsCardSelector).should('exist');
-            cy.get(vulnDefinitionsCardSelector).should('not.have.css', 'opacity', '0.5');
-            cy.get(vulnDefinitionsCardSelector).should('contain', 'up to date');
-        });
-
-        it('should show active scanner certificate card on System Health page', () => {
-            visitSystemHealth();
-
-            cy.get(scannerCertificateCardSelector).should('exist');
-            cy.get(scannerCertificateCardSelector).should('not.have.css', 'opacity', '0.5');
-        });
-
-        it('should show StackRox Scanner tile on Integrations page', () => {
-            visitIntegrationsDashboard();
-
-            cy.get(stackRoxScannerTileSelector).should('exist');
-        });
-
-        it('should show scanner credential expiry banner', () => {
-            const expiry = dateFns.addDays(new Date(), 2);
-
-            visitSystemConfigurationWithScannerCredentialExpiryBanner(expiry);
-
-            cy.get(scannerCredentialExpiryBanner).should('exist');
-        });
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/networkGraph/networkDeploymentSidebar.test.js b/ui/apps/platform/cypress/integration/networkGraph/networkDeploymentSidebar.test.js
index c33dbf2c1082e..55d2a9d346116 100644
--- a/ui/apps/platform/cypress/integration/networkGraph/networkDeploymentSidebar.test.js
+++ b/ui/apps/platform/cypress/integration/networkGraph/networkDeploymentSidebar.test.js
@@ -33,7 +33,7 @@ describe('Network Graph deployment sidebar', () => {
         //  `${networkGraphSelectors.nodes} > [data-type="node"] .pf-topology__node__label:contains("central")`
         // ).should('not.exist');
         cy.get(
-            `${networkGraphSelectors.nodes} > [data-type="node"] .pf-topology__node__label:contains("scanner")`
+            `${networkGraphSelectors.nodes} > [data-type="node"] .pf-topology__node__label:contains("scanner-v4-indexer")`
         ).should('not.exist');
         cy.get(
             `${networkGraphSelectors.nodes} > [data-type="node"] .pf-topology__node__label:contains("admission-controller")`
diff --git a/ui/apps/platform/cypress/integration/networkGraph/networkGraph.test.js b/ui/apps/platform/cypress/integration/networkGraph/networkGraph.test.js
index 58cec4d0ac364..1796e9c8218ec 100644
--- a/ui/apps/platform/cypress/integration/networkGraph/networkGraph.test.js
+++ b/ui/apps/platform/cypress/integration/networkGraph/networkGraph.test.js
@@ -105,28 +105,37 @@ describe('Network Graph smoke tests', () => {
         // Verify that 'stackrox' namespace is present
         cy.get(networkGraphSelectors.filteredNamespaceGroupNode('stackrox'));
 
-        // Verify that central, central-db, scanner, scanner-db, sensor are present
-        ['central', 'central-db', 'scanner', 'scanner-db', 'sensor'].forEach((deployment) => {
+        // Verify that central, central-db, scanner-v4-indexer, scanner-v4-matcher, scanner-v4-db, sensor are present
+        [
+            'central',
+            'central-db',
+            'scanner-v4-indexer',
+            'scanner-v4-matcher',
+            'scanner-v4-db',
+            'sensor',
+        ].forEach((deployment) => {
             cy.get(networkGraphSelectors.deploymentNode(deployment));
         });
 
         // Apply a deployment filter for 'central-db'
         selectDeployment('central-db');
 
-        // Verify that central, central-db are present and that scanner, scanner-db, sensor are not present
+        // Verify that central, central-db are present and that scanner-v4-indexer, scanner-v4-matcher, scanner-v4-db, sensor are not present
         ['central', 'central-db'].forEach((deployment) => {
             cy.get(networkGraphSelectors.deploymentNode(deployment));
         });
-        ['scanner', 'scanner-db', 'sensor'].forEach((deployment) => {
-            cy.get(networkGraphSelectors.deploymentNode(deployment)).should('not.exist');
-        });
+        ['scanner-v4-indexer', 'scanner-v4-matcher', 'scanner-v4-db', 'sensor'].forEach(
+            (deployment) => {
+                cy.get(networkGraphSelectors.deploymentNode(deployment)).should('not.exist');
+            }
+        );
 
         // Remove the central-db selection from the scope filter
         selectDeployment('central-db');
-        // Apply a general filter of "Deployment Label" for 'app=scanner-db'
-        selectFilter('Deployment Label', 'app=scanner-db');
+        // Apply a general filter of "Deployment Label" for 'app=scanner-v4-db'
+        selectFilter('Deployment Label', 'app=scanner-v4-db');
 
-        ['scanner', 'scanner-db'].forEach((deployment) => {
+        ['scanner-v4-indexer', 'scanner-v4-matcher', 'scanner-v4-db'].forEach((deployment) => {
             cy.get(networkGraphSelectors.deploymentNode(deployment));
         });
         ['central', 'central-db', 'sensor'].forEach((deployment) => {
diff --git a/ui/apps/platform/cypress/integration/policies/policiesTable.test.js b/ui/apps/platform/cypress/integration/policies/policiesTable.test.js
index 2f40501a7a041..11f86e0c3e53c 100644
--- a/ui/apps/platform/cypress/integration/policies/policiesTable.test.js
+++ b/ui/apps/platform/cypress/integration/policies/policiesTable.test.js
@@ -1,6 +1,10 @@
 import * as api from '../../constants/apiEndpoints';
 import withAuth from '../../helpers/basicAuth';
-import { addCheckboxSelectFilter } from '../../helpers/compoundFilters';
+import {
+    addCheckboxSelectFilter,
+    selectAttribute,
+    selectEntity,
+} from '../../helpers/compoundFilters';
 import { generateNameWithDate } from '../../helpers/formHelpers';
 import {
     changePolicyStatusInTable,
@@ -172,6 +176,22 @@ describe('Policies table', () => {
         cy.get(`${selectors.table.severityCell}:contains("Critical")`).should('not.exist');
     });
 
+    it('should show autocomplete options when filtering by category', () => {
+        visitPolicies();
+
+        selectEntity('Policy');
+        selectAttribute('Category');
+
+        // open the autocomplete dropdown
+        cy.get('button[aria-label="Menu toggle"]').click();
+
+        // the dropdown must not be empty — this was fixed by ROX-36393
+        cy.get('ul[aria-label="Filter results select menu"] li').should(
+            'have.length.greaterThan',
+            0
+        );
+    });
+
     it('should have expected lifecycle values', () => {
         visitPolicies();
 
diff --git a/ui/apps/platform/cypress/integration/policies/policyWizardStep3-dnd.test.js b/ui/apps/platform/cypress/integration/policies/policyWizardStep3-dnd.test.js
index 5302dbe7d207a..7f878f08194cb 100644
--- a/ui/apps/platform/cypress/integration/policies/policyWizardStep3-dnd.test.js
+++ b/ui/apps/platform/cypress/integration/policies/policyWizardStep3-dnd.test.js
@@ -1,6 +1,5 @@
 import * as api from '../../constants/apiEndpoints';
 import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag } from '../../helpers/features';
 import {
     cloneFirstPolicyFromTable,
     doPolicyRowAction,
@@ -33,12 +32,6 @@ function clearPolicyCriteriaCards() {
 describe('Policy wizard, Step 3 Policy Criteria', () => {
     withAuth();
 
-    before(function () {
-        if (hasFeatureFlag('ROX_POLICY_CRITERIA_MODAL')) {
-            this.skip();
-        }
-    });
-
     it('should not allow user to edit policy criteria for default policies', () => {
         visitPolicies();
         editFirstPolicyFromTable();
diff --git a/ui/apps/platform/cypress/integration/policies/policyWizardStep3.test.js b/ui/apps/platform/cypress/integration/policies/policyWizardStep3.test.js
deleted file mode 100644
index c5a01305dbcfe..0000000000000
--- a/ui/apps/platform/cypress/integration/policies/policyWizardStep3.test.js
+++ /dev/null
@@ -1,480 +0,0 @@
-import * as api from '../../constants/apiEndpoints';
-import withAuth from '../../helpers/basicAuth';
-import { hasFeatureFlag } from '../../helpers/features';
-import { closeModalByButton } from '../../helpers/modal';
-import {
-    cloneFirstPolicyFromTable,
-    doPolicyRowAction,
-    editFirstPolicyFromTable,
-    goToStep3,
-    visitPolicies,
-} from './Policies.helpers';
-import { selectors } from './Policies.selectors';
-
-const TREE_VIEW_SEARCH_INPUT = '.pf-v6-c-tree-view__search input[name="search-input"]';
-const TREE_VIEW_FIRST_LEVEL_CHILD = '.pf-v6-c-tree-view__list-item .pf-v6-c-tree-view__list-item';
-
-// open Policy Fields modal, select given field, and add it to the section card
-function addPolicyField(fieldName) {
-    cy.get('.policy-section-card button:contains("Add policy field")').click();
-
-    // Note: we only use the first word of the field name to filter, because the PatternFly 4
-    // TreeView search field has a bug where it doesn't accept spaces
-    const firstWordOfFieldName = fieldName.split(' ')[0];
-    // cy.log(firstWordOfFieldName);
-    cy.get(TREE_VIEW_SEARCH_INPUT).type(firstWordOfFieldName);
-
-    // Match entire title to distinguish CVSS From NVD CVSS.
-    cy.get(`${TREE_VIEW_FIRST_LEVEL_CHILD} .pf-v6-c-tree-view__node-title`)
-        .contains(new RegExp(`^${fieldName}$`))
-        .click();
-
-    cy.get(`${TREE_VIEW_FIRST_LEVEL_CHILD} .pf-v6-c-tree-view__node`).should(
-        'have.class',
-        'pf-m-current'
-    );
-
-    closeModalByButton('Add policy field');
-}
-
-// open Policy Fields modal and ensure a given field is not available
-function assertPolicyFieldNotAvailable(fieldName) {
-    cy.get('.policy-section-card button:contains("Add policy field")').click();
-
-    // Note: we only use the first word of the field name to filter, because the PatternFly 4
-    // TreeView search field has a bug where it doesn't accept spaces
-    const firstWordOfFieldName = fieldName.split(' ')[0];
-    // cy.log(firstWordOfFieldName);
-    cy.get(TREE_VIEW_SEARCH_INPUT).type(firstWordOfFieldName);
-
-    cy.get(
-        `${TREE_VIEW_FIRST_LEVEL_CHILD} .pf-v6-c-tree-view__node-title:contains(${fieldName})`
-    ).should('not.exist');
-
-    closeModalByButton('Cancel');
-}
-
-function goToPoliciesAndCloneToStep3() {
-    visitPolicies();
-    cloneFirstPolicyFromTable();
-    goToStep3();
-}
-
-function clearPolicyCriteriaCards() {
-    // starting from clean slate
-    cy.get(selectors.step3.policyCriteria.groupCards).then((cards) => {
-        if (cards.length > 0) {
-            cy.get(selectors.step3.policyCriteria.deleteBtn).eq(0).click();
-        }
-    });
-}
-
-describe.skip('Policy wizard, Step 3 Policy Criteria', () => {
-    withAuth();
-
-    before(function () {
-        if (!hasFeatureFlag('ROX_POLICY_CRITERIA_MODAL')) {
-            this.skip();
-        }
-    });
-
-    it('should not allow user to edit policy criteria for default policies', () => {
-        visitPolicies();
-        editFirstPolicyFromTable();
-        goToStep3();
-
-        cy.get(selectors.step3.defaultPolicyAlert).should('exist');
-        cy.get(selectors.step3.policyCriteria.value.numberInput).should('be.disabled');
-        cy.get(selectors.step3.policySection.addBtn).should('not.exist');
-    });
-
-    it('should have a modal with nested policy field keys', () => {
-        goToPoliciesAndCloneToStep3();
-
-        // open policy fields modal
-        cy.get('.policy-section-card button:contains("Add policy field")').click();
-        cy.get('.pf-v6-c-modal-box__title-text:contains("Add policy criteria field")');
-
-        // check that all Deploy-time categories are available
-        // after filtering for Lifecycle was added, the number of groups for a Deploy-only policy is 7
-        const GROUPS_AVAILABLE_FOR_DEPLOY_POLICY = [
-            'Image registry',
-            'Image contents',
-            'Image scanning',
-            'Container configuration',
-            'Deployment metadata',
-            'Storage',
-            'Networking',
-            'Service account',
-        ];
-        cy.get('.pf-v6-c-tree-view__list-item').each((element, index) => {
-            element.get(
-                `.pf-v6-c-tree-view__node-title:contains(${GROUPS_AVAILABLE_FOR_DEPLOY_POLICY[index]})`
-            );
-        });
-
-        // now, check the criteria in a category
-        const FIELDS_AVAILABLE_FOR_DEPLOY_POLICY = [
-            'Image registry',
-            'Image name',
-            'Image tag',
-            'Require image signature',
-        ];
-        cy.get('.pf-v6-c-tree-view__list-item:first').click();
-        cy.get(TREE_VIEW_FIRST_LEVEL_CHILD).each((element, index) => {
-            element.get(
-                `.pf-v6-c-tree-view__node-title:contains(${FIELDS_AVAILABLE_FOR_DEPLOY_POLICY[index]})`
-            );
-        });
-
-        closeModalByButton('Cancel');
-    });
-
-    describe('Policy section', () => {
-        it('should allow the user to add and delete a policy section card', () => {
-            goToPoliciesAndCloneToStep3();
-
-            // add policy section card
-            cy.get(selectors.step3.policySection.cards).then((sections) => {
-                cy.get(selectors.step3.policySection.addBtn).click();
-                cy.get(selectors.step3.policySection.cards).then((newSections) => {
-                    expect(newSections).to.have.length(sections.length + 1);
-                });
-            });
-            cy.get(selectors.step3.policySection.orDivider).should('exist');
-
-            // delete policy section card
-            cy.get(selectors.step3.policySection.cards).then((sections) => {
-                cy.get(selectors.step3.policySection.deleteBtn).first().click();
-                cy.get(selectors.step3.policySection.cards).then((newSections) => {
-                    expect(newSections).to.have.length(sections.length - 1);
-                });
-            });
-        });
-
-        it('should allow editing a policy section name and retain new name value', () => {
-            goToPoliciesAndCloneToStep3();
-
-            cy.get(selectors.step3.policySection.nameEditBtn).click();
-            cy.get(selectors.step3.policySection.nameInput).clear();
-            cy.get(selectors.step3.policySection.nameInput).type('New Section');
-            cy.get(selectors.step3.policySection.nameSaveBtn).click();
-            cy.get(selectors.step3.policySection.name).contains('New Section');
-        });
-
-        it('should allow the user to add/delete a policy field card in the same policy section', () => {
-            goToPoliciesAndCloneToStep3();
-
-            // add policy field card
-            cy.get(selectors.step3.policyCriteria.groupCards).then((cards) => {
-                addPolicyField('Image registry', 0);
-                cy.get(selectors.step3.policyCriteria.groupCards).then((newCards) => {
-                    expect(newCards).to.have.length(cards.length + 1);
-                });
-            });
-
-            // delete policy field card
-            cy.get(selectors.step3.policyCriteria.groupCards).then((cards) => {
-                cy.get(selectors.step3.policyCriteria.deleteBtn).eq(0).click();
-                cy.get(selectors.step3.policyCriteria.groupCards).then((newCards) => {
-                    expect(newCards).to.have.length(cards.length - 1);
-                });
-            });
-        });
-
-        it('should allow the user to add multiple non-duplicate policy field cards in the same policy section', () => {
-            goToPoliciesAndCloneToStep3();
-
-            cy.get(selectors.step3.policyCriteria.groupCards).then((cards) => {
-                addPolicyField('Image registry');
-                addPolicyField('Image name');
-                addPolicyField('Image tag');
-                cy.get(selectors.step3.policyCriteria.groupCards).then((newCards) => {
-                    expect(newCards).to.have.length(cards.length + 3);
-                });
-            });
-        });
-
-        it('should not be able to add duplicate policy field cards in the same policy section', () => {
-            goToPoliciesAndCloneToStep3();
-
-            cy.get(selectors.step3.policyCriteria.groupCards).then((cards) => {
-                addPolicyField('Image name');
-                assertPolicyFieldNotAvailable('Image name');
-                cy.get(selectors.step3.policyCriteria.groupCards).then((newCards) => {
-                    expect(newCards).to.have.length(cards.length + 1);
-                });
-            });
-        });
-    });
-
-    describe('Policy field card', () => {
-        describe('values', () => {
-            it('should add/delete multiple field values for the same field if applicable', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                // add field values for Image Registry
-                addPolicyField('Image name');
-                cy.get(selectors.step3.policyCriteria.value.deleteBtn).should('not.exist');
-                cy.get(selectors.step3.policyCriteria.value.addBtn).first().click();
-                cy.get(selectors.step3.policyCriteria.value.textInput).then((inputs) => {
-                    expect(inputs).to.have.length(2);
-                    cy.get(selectors.step3.policyCriteria.value.deleteBtn).should('have.length', 2);
-                });
-                cy.get(selectors.step3.policyCriteria.booleanOperator).should('have.length', 1);
-                cy.get(selectors.step3.policyCriteria.booleanOperator).should('not.be.disabled');
-
-                // delete field value
-                cy.get(selectors.step3.policyCriteria.value.deleteBtn).first().click();
-                cy.get(selectors.step3.policyCriteria.value.textInput).then((inputs) => {
-                    expect(inputs).to.have.length(1);
-                    cy.get(selectors.step3.policyCriteria.value.deleteBtn).should('not.exist');
-                    cy.get(selectors.step3.policyCriteria.booleanOperator).should('not.exist');
-                });
-            });
-
-            it('should not add multiple field values for the same field if not applicable', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Mounted volume writability');
-                cy.get(selectors.step3.policyCriteria.value.radioGroup).should('exist');
-                cy.get(selectors.step3.policyCriteria.value.addBtn).should('not.exist');
-            });
-        });
-
-        describe('negation', () => {
-            it('should negate field if applicable and change wording', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Image registry');
-                cy.get(selectors.step3.policyCriteria.value.negateCheckbox).should(
-                    'not.be.checked'
-                );
-                cy.get(selectors.step3.policyCriteria.value.negateCheckbox).click();
-                cy.get(selectors.step3.policyCriteria.value.negateCheckbox).should('be.checked');
-                cy.get(selectors.step3.policyCriteria.groupCardTitle).first().contains('not');
-            });
-
-            it('should not show negate field if not applicable', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Mounted volume writability');
-                cy.get(selectors.step3.policyCriteria.value.negateCheckbox).should('not.exist');
-            });
-        });
-
-        describe('boolean operator', () => {
-            it('should toggle AND/OR if applicable', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Image registry');
-                cy.get(selectors.step3.policyCriteria.value.addBtn).first().click();
-                cy.get(selectors.step3.policyCriteria.booleanOperator).should('not.be.disabled');
-                cy.get(selectors.step3.policyCriteria.booleanOperator).contains('or');
-                cy.get(selectors.step3.policyCriteria.booleanOperator).click();
-                cy.get(selectors.step3.policyCriteria.booleanOperator).contains('and');
-            });
-
-            it('should have AND/OR toggle disabled if not applicable', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Image age');
-                cy.get(selectors.step3.policyCriteria.value.addBtn).first().click();
-                cy.get(selectors.step3.policyCriteria.booleanOperator).should('be.disabled');
-                cy.get(selectors.step3.policyCriteria.booleanOperator).contains('or');
-            });
-        });
-
-        describe('input', () => {
-            it('should populate boolean radio buttons w default value and respect changed values', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Image scan status');
-                cy.get(selectors.step3.policyCriteria.value.radioGroup).should('exist');
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupItem}:contains('Scanned') button`
-                ).should('not.have.class', 'pf-m-selected');
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupItem}:contains('Not scanned') button`
-                ).should('have.class', 'pf-m-selected');
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupItem}:contains('Scanned') button`
-                ).click();
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupItem}:contains('Scanned') button`
-                ).should('have.class', 'pf-m-selected');
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupItem}:contains('Not scanned') button`
-                ).should('not.have.class', 'pf-m-selected');
-            });
-
-            it('should populate string radio buttons w default value and respect changed values', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Seccomp profile type');
-                cy.get(selectors.step3.policyCriteria.value.radioGroupString).should('exist');
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupStringItem} button.pf-m-selected`
-                ).should('have.length', 0);
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupStringItem}:contains('Unconfined') button`
-                ).click();
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupStringItem}:contains('Unconfined') button`
-                ).should('have.class', 'pf-m-selected');
-                cy.get(
-                    `${selectors.step3.policyCriteria.value.radioGroupStringItem} button.pf-m-selected`
-                ).should('have.length', 1);
-            });
-
-            it('should populate text input and respect changed values', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Image registry');
-                cy.get(selectors.step3.policyCriteria.value.textInput).should('have.value', '');
-                cy.get(selectors.step3.policyCriteria.value.textInput).type('test');
-                cy.get(selectors.step3.policyCriteria.value.textInput).should('have.value', 'test');
-            });
-
-            it('should populate select dropdown and respect changed values', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('Drop capabilities');
-                cy.get(selectors.step3.policyCriteria.value.select).should('have.value', '');
-                cy.get(selectors.step3.policyCriteria.value.select).click();
-                cy.get(selectors.step3.policyCriteria.value.selectOption)
-                    .first()
-                    .then((option) => {
-                        cy.wrap(option).click();
-                        cy.get(selectors.step3.policyCriteria.value.select).contains(option.text());
-                    });
-            });
-
-            it('should populate policy field input nested group and parse value string to object and respect changed values', () => {
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-
-                addPolicyField('CVSS');
-                cy.get(selectors.step3.policyCriteria.value.select).should('have.value', '');
-                cy.get(selectors.step3.policyCriteria.value.numberInput).should('have.value', '');
-                cy.get(selectors.step3.policyCriteria.value.select).click();
-                cy.get(selectors.step3.policyCriteria.value.selectOption)
-                    .first()
-                    .then((option) => {
-                        cy.wrap(option).click();
-                        cy.get(selectors.step3.policyCriteria.value.select).contains(option.text());
-                    });
-                cy.get(selectors.step3.policyCriteria.value.numberInput).type('10');
-                cy.get(selectors.step3.policyCriteria.value.numberInput).should('have.value', '10');
-            });
-        });
-
-        describe('table modal', () => {
-            beforeEach(() => {
-                cy.intercept('GET', api.integrations.signatureIntegrations, {
-                    fixture: 'integrations/signatureIntegrations.json',
-                }).as('getSignatureIntegrations');
-
-                goToPoliciesAndCloneToStep3();
-                clearPolicyCriteriaCards();
-                addPolicyField('Require image signature');
-                cy.wait('@getSignatureIntegrations');
-            });
-
-            it('should populate table modal select and respect changed values on save', () => {
-                cy.get(selectors.step3.policyCriteria.value.tableModal.textInput).should(
-                    'have.value',
-                    'Add trusted image signers'
-                );
-                cy.get(selectors.step3.policyCriteria.value.tableModal.openButton).click();
-                cy.get(selectors.step3.policyCriteria.value.tableModal.firstRowCheckbox).click();
-                cy.get(selectors.step3.policyCriteria.value.tableModal.saveBtn).click();
-                cy.get(selectors.step3.policyCriteria.value.tableModal.textInput).should(
-                    'have.value',
-                    'Selected 1 trusted image signer'
-                );
-            });
-
-            it('should populate table modal select and not change values on cancel', () => {
-                cy.get(selectors.step3.policyCriteria.value.tableModal.openButton).click();
-                cy.get(selectors.step3.policyCriteria.value.tableModal.firstRowCheckbox).click();
-                cy.get(selectors.step3.policyCriteria.value.tableModal.cancelBtn).click();
-                cy.get(selectors.step3.policyCriteria.value.tableModal.textInput).should(
-                    'have.value',
-                    'Add trusted image signers'
-                );
-            });
-
-            it('should go to link when table row is clicked', () => {
-                cy.get(selectors.step3.policyCriteria.value.tableModal.openButton).click();
-                cy.get(selectors.step3.policyCriteria.value.tableModal.firstRowName).click();
-                cy.location('pathname').should('contain', 'signatureIntegrations');
-            });
-        });
-    });
-
-    describe('Existing values', () => {
-        it('should populate boolean radio buttons', () => {
-            visitPolicies();
-            doPolicyRowAction(`${selectors.table.rows}:contains('root filesystem')`, 'Clone');
-            goToStep3();
-            cy.get(selectors.step3.policyCriteria.value.radioGroup).should('exist');
-            cy.get(
-                `${selectors.step3.policyCriteria.value.radioGroupItem}:contains('Writable') button`
-            ).should('have.class', 'pf-m-selected');
-            cy.get(
-                `${selectors.step3.policyCriteria.value.radioGroupItem} button.pf-m-selected`
-            ).should('have.length', 1);
-        });
-
-        it('should populate string radio buttons', () => {
-            visitPolicies();
-            doPolicyRowAction(`${selectors.table.rows}:contains('seccomp profile')`, 'Clone');
-            goToStep3();
-            cy.get(selectors.step3.policyCriteria.value.radioGroupString).should('exist');
-            cy.get(
-                `${selectors.step3.policyCriteria.value.radioGroupStringItem}:contains('Unconfined') button`
-            ).should('have.class', 'pf-m-selected');
-            cy.get(
-                `${selectors.step3.policyCriteria.value.radioGroupStringItem} button.pf-m-selected`
-            ).should('have.length', 1);
-        });
-
-        it('should populate text input', () => {
-            visitPolicies();
-            doPolicyRowAction(`${selectors.table.rows}:contains('Latest tag')`, 'Clone');
-            goToStep3();
-            cy.get(selectors.step3.policyCriteria.value.textInput).should('have.value', 'latest');
-        });
-
-        it('should populate select dropdown', () => {
-            visitPolicies();
-            doPolicyRowAction(`${selectors.table.rows}:contains('capability')`, 'Clone');
-            goToStep3();
-            cy.get(selectors.step3.policyCriteria.value.select).contains('SYS_ADMIN');
-        });
-
-        it('should populate policy field input nested group', () => {
-            visitPolicies();
-            doPolicyRowAction(`${selectors.table.rows}:contains('CVSS >= 6')`, 'Clone');
-            goToStep3();
-            cy.get(selectors.step3.policyCriteria.value.select).contains(
-                'Is greater than or equal to'
-            );
-            cy.get(selectors.step3.policyCriteria.value.numberInput).should(
-                'have.value',
-                '6.000000'
-            );
-        });
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/risk/risk.test.js b/ui/apps/platform/cypress/integration/risk/risk.test.js
index cd2b730c7a13d..a39e345fe897f 100644
--- a/ui/apps/platform/cypress/integration/risk/risk.test.js
+++ b/ui/apps/platform/cypress/integration/risk/risk.test.js
@@ -126,7 +126,7 @@ describe('Risk', () => {
             const nsOption = 'Namespace';
             const nsValue = 'stackrox';
             const deployOption = 'Deployment';
-            const deployValue = 'scanner';
+            const deployValue = 'scanner-v4-indexer';
 
             visitRiskDeploymentsWithSearchQuery(
                 'Platform view',
diff --git a/ui/apps/platform/cypress/integration/systemHealth/certificateHealthCards.test.js b/ui/apps/platform/cypress/integration/systemHealth/certificateHealthCards.test.js
index e43c7dfb2a702..08754d9e20687 100644
--- a/ui/apps/platform/cypress/integration/systemHealth/certificateHealthCards.test.js
+++ b/ui/apps/platform/cypress/integration/systemHealth/certificateHealthCards.test.js
@@ -2,7 +2,7 @@ import withAuth from '../../helpers/basicAuth';
 import {
     credentialForCentralDbExpiryAlias,
     credentialForCentralExpiryAlias,
-    credentialForScannerExpiryAlias,
+    credentialForScannerV4ExpiryAlias,
     setClock,
     visitSystemHealth,
 } from '../../helpers/systemHealth';
@@ -10,8 +10,7 @@ import {
 const statusSelectorCentral = 'div:has(.pf-v6-c-card__header:contains("Central certificate"))';
 const statusSelectorCentralDb =
     'div:has(.pf-v6-c-card__header:contains("Central Database certificate"))';
-const statusSelectorScanner =
-    'div:has(.pf-v6-c-card__header:contains("StackRox Scanner certificate"))';
+const statusSelectorScannerV4 = 'div:has(.pf-v6-c-card__header:contains("Scanner V4 certificate"))';
 
 describe('System Health Certificate Health Cards', () => {
     withAuth();
@@ -104,19 +103,19 @@ describe('System Health Certificate Health Cards', () => {
         });
     });
 
-    describe('StackRox Scanner certificate', () => {
+    describe('Scanner V4 certificate', () => {
         it('should have widget and up to date text', () => {
             const currentDatetime = new Date('2025-05-21T02:04:59.377369440Z'); // about 355 days until expiry
             const expiry = '2026-05-20T03:04:59.377369440Z';
 
             const staticResponseMap = {
-                [credentialForScannerExpiryAlias]: { body: { expiry } },
+                [credentialForScannerV4ExpiryAlias]: { body: { expiry } },
             };
 
             setClock(currentDatetime); // call before visit
             visitSystemHealth(staticResponseMap);
 
-            cy.get(`${statusSelectorScanner}:contains("expires in 12 months")`);
+            cy.get(`${statusSelectorScannerV4}:contains("expires in 12 months")`);
         });
 
         it('should have widget with warning text for less than 2 weeks', () => {
@@ -124,13 +123,13 @@ describe('System Health Certificate Health Cards', () => {
             const expiry = '2026-05-20T03:04:59.377369440Z';
 
             const staticResponseMap = {
-                [credentialForScannerExpiryAlias]: { body: { expiry } },
+                [credentialForScannerV4ExpiryAlias]: { body: { expiry } },
             };
 
             setClock(currentDatetime); // call before visit
             visitSystemHealth(staticResponseMap);
 
-            cy.get(`${statusSelectorScanner}:contains("expires in 13 days")`);
+            cy.get(`${statusSelectorScannerV4}:contains("expires in 13 days")`);
         });
 
         it('should have widget with error text for less than 24 hours', () => {
@@ -138,13 +137,13 @@ describe('System Health Certificate Health Cards', () => {
             const expiry = '2026-05-20T03:04:59.377369440Z';
 
             const staticResponseMap = {
-                [credentialForScannerExpiryAlias]: { body: { expiry } },
+                [credentialForScannerV4ExpiryAlias]: { body: { expiry } },
             };
 
             setClock(currentDatetime); // call before visit
             visitSystemHealth(staticResponseMap);
 
-            cy.get(`${statusSelectorScanner}:contains("expires in 1 day")`);
+            cy.get(`${statusSelectorScannerV4}:contains("expires in 1 day")`);
         });
     });
 });
diff --git a/ui/apps/platform/cypress/integration/systemHealth/clusters.test.js b/ui/apps/platform/cypress/integration/systemHealth/clusters.test.js
index 7c93e6fcb0783..a81e81f3d1713 100644
--- a/ui/apps/platform/cypress/integration/systemHealth/clusters.test.js
+++ b/ui/apps/platform/cypress/integration/systemHealth/clusters.test.js
@@ -29,11 +29,13 @@ describe('System Health Clusters without fixture', () => {
         });
     });
 
-    it('should go to Clusters via click link in Sensor upgrade card', () => {
+    it('should go to Clusters via click link in Sensor compatibility status card', () => {
         visitSystemHealth();
 
         interactAndVisitClusters(() => {
-            cy.get(getCardHeaderDescendantSelector('Sensor upgrade', clustersLink)).click();
+            cy.get(
+                getCardHeaderDescendantSelector('Sensor compatibility status', clustersLink)
+            ).click();
         });
     });
 
@@ -148,31 +150,32 @@ describe('System Health Clusters with fixture', () => {
         cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Total', 7));
     });
 
-    it('should have phrase in Sensor upgrade card header', () => {
+    it('should have phrase in Sensor compatibility status card header', () => {
         setClock(currentDatetime); // call before visit
         visitSystemHealth({
             clusters: { fixture: clustersFixturePath },
         });
 
-        const cardTitle = 'Sensor upgrade';
+        const cardTitle = 'Sensor compatibility status';
 
-        cy.get(getCardHeaderDescendantSelector(cardTitle, 'div:contains("2 degraded")'));
+        cy.get(
+            getCardHeaderDescendantSelector(cardTitle, 'div:contains("2 incompatible sensors")')
+        );
     });
 
-    it('should have counts in Sensor upgrade card', () => {
+    it('should have counts in Sensor compatibility status card', () => {
         setClock(currentDatetime); // call before visit
         visitSystemHealth({
             clusters: { fixture: clustersFixturePath },
         });
 
-        const cardTitle = 'Sensor upgrade';
+        const cardTitle = 'Sensor compatibility status';
         const nthRow = 1; // Clusters
 
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Up to date', 4));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Failed', 0));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Out of date', 2));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Unavailable', 0));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Uninitialized', 1));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Matched', 3));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Incompatible', 2));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Compatible', 1));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Unknown', 1));
         cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Total', 7));
     });
 
@@ -279,14 +282,21 @@ describe('System Health Clusters subset 3', () => {
         cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Total', 3));
     });
 
-    it('should have not have counts in Sensor upgrade card', () => {
+    it('should have counts in Sensor compatibility status card', () => {
         setClock(currentDatetime); // call before visit
         visitSystemHealthWithClustersFixtureFilteredByNames(clustersFixturePath, clusterNames);
 
-        const cardTitle = 'Sensor upgrade';
+        const cardTitle = 'Sensor compatibility status';
+        const nthRow = 1; // Clusters
 
-        cy.get(getCardHeaderDescendantSelector(cardTitle, 'div:contains("3 healthy")'));
-        cy.get(getCardBodyDescendantSelector(cardTitle, 'table')).should('not.exist');
+        cy.get(
+            getCardHeaderDescendantSelector(cardTitle, 'div:contains("No incompatible sensors")')
+        );
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Matched', 2));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Incompatible', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Compatible', 1));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Unknown', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Total', 3));
     });
 
     it('should have phrase in Credential expiration card header', () => {
@@ -377,18 +387,17 @@ describe('System Health Clusters subset 1 Uninitialized', () => {
         cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Total', 1));
     });
 
-    it('should have counts in Sensor upgrade card', () => {
+    it('should have counts in Sensor compatibility status card', () => {
         setClock(currentDatetime); // call before visit
         visitSystemHealthWithClustersFixtureFilteredByNames(clustersFixturePath, clusterNames);
 
-        const cardTitle = 'Sensor upgrade';
+        const cardTitle = 'Sensor compatibility status';
         const nthRow = 1; // Clusters
 
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Up to date', 0));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Failed', 0));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Out of date', 0));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Unavailable', 0));
-        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Uninitialized', 1));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Matched', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Incompatible', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Compatible', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Unknown', 1));
         cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Total', 1));
     });
 
@@ -423,14 +432,21 @@ describe('System Health Clusters subset 1 Healthy', () => {
         cy.get(getCardBodyDescendantSelector(cardTitle, 'table')).should('not.exist');
     });
 
-    it('should have not have counts in Sensor upgrade card', () => {
+    it('should have counts in Sensor compatibility status card', () => {
         setClock(currentDatetime); // call before visit
         visitSystemHealthWithClustersFixtureFilteredByNames(clustersFixturePath, clusterNames);
 
-        const cardTitle = 'Sensor upgrade';
+        const cardTitle = 'Sensor compatibility status';
+        const nthRow = 1; // Clusters
 
-        cy.get(getCardHeaderDescendantSelector(cardTitle, 'div:contains("1 healthy")'));
-        cy.get(getCardBodyDescendantSelector(cardTitle, 'table')).should('not.exist');
+        cy.get(
+            getCardHeaderDescendantSelector(cardTitle, 'div:contains("No incompatible sensors")')
+        );
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Matched', 1));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Incompatible', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Compatible', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Unknown', 0));
+        cy.get(getTableCellContainsSelector(cardTitle, nthRow, 'Total', 1));
     });
 
     it('should have not have counts in Credential expiration card', () => {
diff --git a/ui/apps/platform/cypress/integration/systemHealth/vulnDefinitions.test.js b/ui/apps/platform/cypress/integration/systemHealth/vulnDefinitions.test.js
index a885f8f521dc5..13e9556fa46cf 100644
--- a/ui/apps/platform/cypress/integration/systemHealth/vulnDefinitions.test.js
+++ b/ui/apps/platform/cypress/integration/systemHealth/vulnDefinitions.test.js
@@ -5,8 +5,7 @@ import {
     visitSystemHealth,
 } from '../../helpers/systemHealth';
 
-const statusSelector =
-    'div:has(.pf-v6-c-card__header:contains("StackRox Scanner Vulnerability Definitions"))';
+const statusSelector = 'div:has(.pf-v6-c-card__header:contains("Scanner V4 Vulnerabilities"))';
 
 describe('System Health Vulnerability Definitions', () => {
     withAuth();
diff --git a/ui/apps/platform/cypress/integration/violations/violations.test.js b/ui/apps/platform/cypress/integration/violations/violations.test.js
index 45ca139da3491..7b0e0457ba0fa 100644
--- a/ui/apps/platform/cypress/integration/violations/violations.test.js
+++ b/ui/apps/platform/cypress/integration/violations/violations.test.js
@@ -212,6 +212,10 @@ describe('Violations', () => {
     });
 
     it('should sort the Severity column', () => {
+        // Freeze clock so the 5s poll in ViolationsTablePage doesn't race
+        // with waiting for violations responses.
+        cy.clock(Date.now(), ['setInterval']);
+
         interactAndWaitForViolationsResponses(() => {
             visitViolations();
         });
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/VulnerabilityReporting.helpers.js b/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/VulnerabilityReporting.helpers.js
index ca8680f75f925..24a0ad1bc620e 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/VulnerabilityReporting.helpers.js
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/VulnerabilityReporting.helpers.js
@@ -45,9 +45,9 @@ const routeMatcherMapForWizardStep2 = {
     },
 };
 
-export const vulnerabilityReportsBasePath = '/main/vulnerabilities/reports';
-export const vulnerabilityReportsConfigurationPath = `${vulnerabilityReportsBasePath}/configuration`;
-export const vulnerabilityReportsViewBasedPath = `${vulnerabilityReportsBasePath}/view-based`;
+export const vulnerabilityReportsBasePath = '/main/vulnerabilities/reports/images';
+export const vulnerabilityReportsConfigurationPath = `${vulnerabilityReportsBasePath}/configurations`;
+export const vulnerabilityReportsViewBasedPath = `${vulnerabilityReportsBasePath}/view-based-jobs`;
 
 // visit
 
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/vulnerabilityReportingNav.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/vulnerabilityReportingNav.test.ts
index 4b7d66b4c0b33..e3319e9304caa 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/vulnerabilityReportingNav.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/VulnerabilityReporting/vulnerabilityReportingNav.test.ts
@@ -23,8 +23,7 @@ describe('Vulnerability Reporting Navigation', () => {
     it('navigates to the index page', () => {
         visitVulnerabilityReports(staticResponseMap);
         cy.location('pathname').should('eq', vulnerabilityReportsConfigurationPath);
-        // Because of mixed headings, comment out until we delete ROX_VULNERABILITY_REPORTS_ENHANCED_FILTERING
-        // cy.get('h1').should('contain', 'Image vulnerability reports');
+        cy.get('h1').should('contain', 'Image vulnerability reports');
     });
 
     it('navigates to the create page', () => {
@@ -67,9 +66,11 @@ describe('Vulnerability Reporting Navigation', () => {
                 );
                 expect(location.search).to.include('action=edit');
             });
-            // cy.get('h1').should('contain', 'Edit report');
+            cy.get('h1').should('contain', firstReport.name);
 
-            cy.get('nav[aria-label="Breadcrumb"] a').click();
+            cy.get(
+                'nav[aria-label="Breadcrumb"] a:contains("Image vulnerability reports")'
+            ).click();
             cy.get('td').contains('a', firstReport.name).click();
 
             cy.contains('button', 'Actions').click();
@@ -81,7 +82,7 @@ describe('Vulnerability Reporting Navigation', () => {
                 );
                 expect(location.search).to.include('action=edit');
             });
-            // cy.get('h1').should('contain', 'Edit report');
+            cy.get('h1').should('contain', firstReport.name);
         });
     });
 
@@ -99,9 +100,11 @@ describe('Vulnerability Reporting Navigation', () => {
                 );
                 expect(location.search).to.include('action=clone');
             });
-            // cy.get('h1').should('contain', 'Clone report');
+            cy.get('h1').should('contain', `${firstReport.name} (COPY)`);
 
-            cy.get('nav[aria-label="Breadcrumb"] a').click();
+            cy.get(
+                'nav[aria-label="Breadcrumb"] a:contains("Image vulnerability reports")'
+            ).click();
             cy.get('td').contains('a', firstReport.name).click();
 
             cy.contains('button', 'Actions').click();
@@ -113,7 +116,7 @@ describe('Vulnerability Reporting Navigation', () => {
                 );
                 expect(location.search).to.include('action=clone');
             });
-            // cy.get('h1').should('contain', 'Clone report');
+            cy.get('h1').should('contain', `${firstReport.name} (COPY)`);
         });
     });
 });
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/NodeCve.helpers.ts b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/NodeCve.helpers.ts
index 504e89dcb5d15..341dcc9fa1840 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/NodeCve.helpers.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/NodeCve.helpers.ts
@@ -1,14 +1,10 @@
 import type { RouteHandler, RouteMatcherOptions } from 'cypress/types/net-stubbing';
 
 import { graphql } from '../../../constants/apiEndpoints';
-import {
-    getRouteMatcherMapForGraphQL,
-    interactAndWaitForResponses,
-} from '../../../helpers/request';
 import { visit, visitWithStaticResponseForPermissions } from '../../../helpers/visit';
-import { selectors as vulnSelectors } from '../vulnerabilities.selectors';
 
 export const nodeCveBaseUrl = '/main/vulnerabilities/node-cves/cves';
+export const nodePageBaseUrl = '/main/vulnerabilities/node-cves/nodes';
 
 // Source of truth for keys in routeMatcherMap and staticResponseMap objects.
 // Overview page
@@ -100,6 +96,16 @@ export function visitNodeCvePage(
     return visit(mockNodeCvePageUrl, routeMatcherMap, staticResponseMap);
 }
 
+export function visitNodePage(
+    nodeId: string,
+    routeMatcherMap?: Record<string, RouteMatcherOptions>,
+    staticResponseMap?: Record<string, RouteHandler>,
+    params?: Record<string, string>
+) {
+    const paramString = params ? `?${new URLSearchParams(params).toString()}` : '';
+    return visit(`${nodePageBaseUrl}/${nodeId}${paramString}`, routeMatcherMap, staticResponseMap);
+}
+
 export function visitNodeCvePageWithStaticPermissions(
     mockCveName: string,
     resourceToAccess: Record<string, string>,
@@ -130,22 +136,8 @@ export const staticResponseMapForNodePage = {
     },
 };
 
-export function visitFirstNodeLinkFromTable(): Cypress.Chainable<string> {
-    // Get the name of the first node in the table and pass it to the caller
-    return cy
-        .get('tbody tr td[data-label="Node"] a')
-        .first()
-        .then(($link) => {
-            interactAndWaitForResponses(
-                () => cy.wrap($link).click(),
-                getRouteMatcherMapForGraphQL(['getNodeMetadata'])
-            );
-            return cy.wrap($link.text());
-        });
-}
-
-export function visitFirstNodeFromOverviewPage() {
-    visitNodeCveOverviewPage();
-    cy.get(vulnSelectors.entityTypeToggleItem('Node')).click();
-    visitFirstNodeLinkFromTable();
-}
+export const staticResponseMapForNodes = {
+    [getNodesOpname]: {
+        fixture: `vulnerabilities/nodeCves/${getNodesOpname}`,
+    },
+};
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/cveDetailPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/cveDetailPage.test.ts
index 0122708d27e83..5eddf49637827 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/cveDetailPage.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/cveDetailPage.test.ts
@@ -144,11 +144,11 @@ describe('Node CVEs - CVE Detail Page', () => {
             );
 
             // check sorting of CVE Severity column
-            sortByTableHeader('CVE severity');
+            sortByTableHeader('Top CVE severity');
             waitAndYieldRequestBodyVariables().then(
                 expectRequestedSort({ field: 'Severity', reversed: true })
             );
-            sortByTableHeader('CVE severity');
+            sortByTableHeader('Top CVE severity');
             waitAndYieldRequestBodyVariables().then(
                 expectRequestedSort({ field: 'Severity', reversed: false })
             );
@@ -164,11 +164,11 @@ describe('Node CVEs - CVE Detail Page', () => {
             );
 
             // check sorting of CVSS column
-            sortByTableHeader('CVSS');
+            sortByTableHeader('Top CVSS');
             waitAndYieldRequestBodyVariables().then(
                 expectRequestedSort({ field: 'CVSS', reversed: true })
             );
-            sortByTableHeader('CVSS');
+            sortByTableHeader('Top CVSS');
             waitAndYieldRequestBodyVariables().then(
                 expectRequestedSort({ field: 'CVSS', reversed: false })
             );
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeCvesOverviewPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeCvesOverviewPage.test.ts
index 498f1cfd5a3ba..ab89add17082e 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeCvesOverviewPage.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeCvesOverviewPage.test.ts
@@ -12,7 +12,7 @@ import {
     routeMatcherMapForEntityCounts,
     routeMatcherMapForNodeCves,
     routeMatcherMapForNodes,
-    visitFirstNodeLinkFromTable,
+    staticResponseMapForNodes,
     visitNodeCveOverviewPage,
 } from './NodeCve.helpers';
 import {
@@ -25,7 +25,7 @@ import {
 } from '../../../helpers/tableHelpers';
 import {
     expectRequestedPagination,
-    expectRequestedQuery,
+    expectRequestedQueryToIncludeSubstrings,
     expectRequestedSort,
     interceptAndWatchRequests,
 } from '../../../helpers/request';
@@ -111,12 +111,19 @@ describe('Node CVEs - Overview Page', () => {
     });
 
     it('should link a Node table row to the correct Node detail page', () => {
-        visitNodeCveOverviewPage();
-        visitEntityTab('Node');
-
-        visitFirstNodeLinkFromTable().then((name) => {
-            cy.get('h1').contains(name);
+        // This table lists nodes that have unsnoozed CVEs. A scan with none leaves
+        // it empty, so CI cannot rely on live rows. Mock the list and assert hrefs.
+        visitNodeCveOverviewPage(routeMatcherMapForNodes, staticResponseMapForNodes, {
+            entityTab: 'Node',
         });
+
+        cy.get('tbody tr td[data-label="Node"] a')
+            .first()
+            .then(($link) => {
+                const linkHref = $link.attr('href');
+                expect(linkHref).to.match(/\/node-cves\/nodes\/1$/);
+                expect($link.text()).to.include('cypress-node-1');
+            });
     });
 
     it('should sort CVE table columns', () => {
@@ -187,6 +194,8 @@ describe('Node CVEs - Overview Page', () => {
     });
 
     it('should sort Node table columns', () => {
+        // Sorting asserts request payloads. The table may have zero rows when
+        // no unsnoozed Node CVEs exist; headers still trigger those requests.
         interceptAndWatchRequests(routeMatcherMapForNodes).then(
             ({
                 waitForRequests,
@@ -249,16 +258,20 @@ describe('Node CVEs - Overview Page', () => {
     });
 
     it('should filter the CVE table', () => {
+        // expectRequestedQueryToIncludeSubstrings asserts items to be independent
+        // of order in concatenated query string
+        // of CVE Snoozed that is outside scope of test
         interceptAndWatchRequests(routeMatcherMapForNodeCves).then(
             ({ waitForRequests, waitAndYieldRequestBodyVariables }) => {
                 // Visit Node tab and wait for initial load
                 visitNodeCveOverviewPage();
                 waitForRequests();
 
+                // Observed tab
                 // filtering by CVE name should only display rows with a matching name
                 filterHelpers.addAutocompleteFilter('CVE', 'Name', 'CVE-2021-1234');
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery('CVE:r/CVE-2021-1234')
+                    expectRequestedQueryToIncludeSubstrings(['CVE:r/CVE-2021-1234'])
                 );
                 // Do not assert on cell contents as the filter value is mocked
                 filterHelpers.clearFilters();
@@ -268,7 +281,7 @@ describe('Node CVEs - Overview Page', () => {
                 // filtering by Severity should not report counts for hidden severities
                 applyLocalSeverityFilters('Low');
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery('Severity:LOW_VULNERABILITY_SEVERITY')
+                    expectRequestedQueryToIncludeSubstrings(['Severity:LOW_VULNERABILITY_SEVERITY'])
                 );
                 assertOnEachRowForColumn('Nodes by severity', (_, cell) => {
                     const { critical, important, moderate, low } = getSeverityLabelCounts(cell);
@@ -282,7 +295,9 @@ describe('Node CVEs - Overview Page', () => {
 
                 // filtering by CVSS should only display rows with a CVSS in range
                 filterHelpers.addNumericFilter('CVE', 'CVSS', 'Is less than', 8);
-                waitAndYieldRequestBodyVariables().then(expectRequestedQuery('CVSS:<8'));
+                waitAndYieldRequestBodyVariables().then(
+                    expectRequestedQueryToIncludeSubstrings(['CVSS:<8'])
+                );
                 assertOnEachRowForColumn('Top CVSS', (_, cell) => {
                     const cvss = parseFloat(cell.innerText.replace(/[^0-9.]/g, ''));
                     expect(cvss).to.be.lessThan(8);
@@ -298,13 +313,17 @@ describe('Node CVEs - Overview Page', () => {
                 waitForRequests();
                 filterHelpers.addNumericFilter('CVE', 'CVSS', 'Is less than', 8);
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery('CVE:r/CVE-2021-1234+CVSS:<8')
+                    expectRequestedQueryToIncludeSubstrings(['CVE:r/CVE-2021-1234', 'CVSS:<8'])
                 );
             }
         );
     });
 
     it('should filter the Node table', () => {
+        // expectRequestedQueryToIncludeSubstrings asserts items to be independent
+        // of order in concatenated query string
+        // of CVE Snoozed that is outside scope of test
+        // Row-content checks no-op when the table is empty (no unsnoozed Node CVEs).
         interceptAndWatchRequests(routeMatcherMapForNodes).then(
             ({ waitForRequests, waitAndYieldRequestBodyVariables }) => {
                 // Visit Node tab and wait for initial load
@@ -312,11 +331,12 @@ describe('Node CVEs - Overview Page', () => {
                 visitEntityTab('Node');
                 waitForRequests();
 
+                // Observed tab
                 // filtering by Node name should only display rows with a matching name
                 const nodeNameFilter = 'a';
                 filterHelpers.addAutocompleteFilter('Node', 'Name', nodeNameFilter);
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery(`Node:r/${nodeNameFilter}`)
+                    expectRequestedQueryToIncludeSubstrings([`Node:r/${nodeNameFilter}`])
                 );
                 assertOnEachRowForColumn('Node', (_, cell) => {
                     expect(cell.innerText).to.match(new RegExp(nodeNameFilter, 'i'));
@@ -328,7 +348,7 @@ describe('Node CVEs - Overview Page', () => {
                 // filtering by Severity should not report counts for hidden severities
                 applyLocalSeverityFilters('Low');
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery('Severity:LOW_VULNERABILITY_SEVERITY')
+                    expectRequestedQueryToIncludeSubstrings(['Severity:LOW_VULNERABILITY_SEVERITY'])
                 );
                 assertOnEachRowForColumn('CVEs by severity', (_, cell) => {
                     const { critical, important, moderate, low } = getSeverityLabelCounts(cell);
@@ -344,7 +364,7 @@ describe('Node CVEs - Overview Page', () => {
                 const clusterNameFilter = 'a';
                 filterHelpers.addAutocompleteFilter('Cluster', 'Name', clusterNameFilter);
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery(`Cluster:r/${clusterNameFilter}`)
+                    expectRequestedQueryToIncludeSubstrings([`Cluster:r/${clusterNameFilter}`])
                 );
                 assertOnEachRowForColumn('Cluster', (_, cell) => {
                     expect(cell.innerText).to.match(new RegExp(clusterNameFilter, 'i'));
@@ -356,7 +376,7 @@ describe('Node CVEs - Overview Page', () => {
                 const osFilter = 'red hat';
                 filterHelpers.addPlainTextFilter('Node', 'Operating System', osFilter);
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery(`Operating System:r/${osFilter}`)
+                    expectRequestedQueryToIncludeSubstrings([`Operating System:r/${osFilter}`])
                 );
                 assertOnEachRowForColumn('Operating system', (_, cell) => {
                     expect(cell.innerText).to.match(new RegExp(osFilter, 'i'));
@@ -372,7 +392,10 @@ describe('Node CVEs - Overview Page', () => {
                 waitForRequests();
                 filterHelpers.addAutocompleteFilter('Cluster', 'Name', clusterNameFilter);
                 waitAndYieldRequestBodyVariables().then(
-                    expectRequestedQuery(`Node:r/${nodeNameFilter}+Cluster:r/${clusterNameFilter}`)
+                    expectRequestedQueryToIncludeSubstrings([
+                        `Node:r/${nodeNameFilter}`,
+                        `Cluster:r/${clusterNameFilter}`,
+                    ])
                 );
             }
         );
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeDetailPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeDetailPage.test.ts
index 9a818546db0d9..d2a20f7019c73 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeDetailPage.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/nodeCves/nodeDetailPage.test.ts
@@ -8,7 +8,6 @@ import {
     interceptAndWatchRequests,
 } from '../../../helpers/request';
 import {
-    assertOnEachRowForColumn,
     paginateNext,
     paginatePrevious,
     queryTableHeader,
@@ -26,19 +25,19 @@ import {
 } from '../workloadCves/WorkloadCves.helpers';
 import {
     getNodeVulnerabilitiesOpname,
+    nodePageBaseUrl,
     routeMatcherMapForNodePage,
     routeMatcherMapForNodes,
     staticResponseMapForNodePage,
-    visitFirstNodeFromOverviewPage,
+    visitNodePage,
 } from './NodeCve.helpers';
 
 const { assertAvailableFilters } = filterHelpers;
 
-const nodeBaseUrl = '/main/vulnerabilities/node-cves/nodes';
 const mockNodeId = '1';
 const mockNodeName = 'cypress-node-1';
 
-const mockNodePageUrl = `${nodeBaseUrl}/${mockNodeId}`;
+const mockNodePageUrl = `${nodePageBaseUrl}/${mockNodeId}`;
 
 describe('Node CVEs - Node Detail Page', () => {
     withAuth();
@@ -70,7 +69,7 @@ describe('Node CVEs - Node Detail Page', () => {
     });
 
     it('should only show relevant filters for the Node Detail page', () => {
-        visitFirstNodeFromOverviewPage();
+        visitNodePage(mockNodeId, routeMatcherMapForNodePage, staticResponseMapForNodePage);
 
         assertAvailableFilters({
             CVE: ['Name', 'CVSS', 'Discovered Time'],
@@ -79,7 +78,7 @@ describe('Node CVEs - Node Detail Page', () => {
     });
 
     it('should follow the breadcrumb link to the Node list tab', () => {
-        visitFirstNodeFromOverviewPage();
+        visitNodePage(mockNodeId, routeMatcherMapForNodePage, staticResponseMapForNodePage);
 
         // clicking the Nodes breadcrumb should navigate to the overview page with the Node tab selected
         interactAndWaitForResponses(() => {
@@ -90,13 +89,7 @@ describe('Node CVEs - Node Detail Page', () => {
     });
 
     it('should link from a CVE in the table to the CVE detail page', () => {
-        interactAndWaitForResponses(
-            () => {
-                visitFirstNodeFromOverviewPage();
-            },
-            routeMatcherMapForNodePage,
-            staticResponseMapForNodePage
-        );
+        visitNodePage(mockNodeId, routeMatcherMapForNodePage, staticResponseMapForNodePage);
 
         // clicking a CVE name in the list should navigate to a Node CVE details page
         cy.get(`table td[data-label="CVE"]`).first().click();
@@ -104,132 +97,94 @@ describe('Node CVEs - Node Detail Page', () => {
     });
 
     it('should sort CVE table columns', () => {
-        interceptAndWatchRequests({
-            [getNodeVulnerabilitiesOpname]:
-                routeMatcherMapForNodePage[getNodeVulnerabilitiesOpname],
-        }).then(({ waitForRequests, waitAndYieldRequestBodyVariables }) => {
-            visitFirstNodeFromOverviewPage();
-            waitForRequests();
-
-            // check sorting of CVE column
-            sortByTableHeader('CVE');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'CVE', reversed: true })
-            );
-            sortByTableHeader('CVE');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'CVE', reversed: false })
-            );
-
-            // check sorting of Top Severity column
-            sortByTableHeader('Top severity');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'Severity', reversed: true })
-            );
-            sortByTableHeader('Top severity');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'Severity', reversed: false })
-            );
-
-            // check sorting of CVE status column
-            sortByTableHeader('CVE status');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'Fixable', reversed: true })
-            );
-            sortByTableHeader('CVE status');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'Fixable', reversed: false })
-            );
-
-            // check sorting of CVSS column
-            sortByTableHeader('CVSS');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'CVSS', reversed: true })
-            );
-            sortByTableHeader('CVSS');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedSort({ field: 'CVSS', reversed: false })
-            );
-
-            // check that the Affected components column is not sortable
-            queryTableHeader('Affected components');
-            queryTableSortHeader('Affected components').should('not.exist');
-        });
+        interceptAndWatchRequests(routeMatcherMapForNodePage, staticResponseMapForNodePage).then(
+            ({ waitForRequests, waitAndYieldRequestBodyVariables }) => {
+                visitNodePage(mockNodeId);
+                waitForRequests();
+
+                const waitForVulnQuery = () =>
+                    waitAndYieldRequestBodyVariables([getNodeVulnerabilitiesOpname]).then((vars) =>
+                        cy.wrap(Array.isArray(vars) ? vars[0] : vars)
+                    );
+
+                // check sorting of CVE column
+                sortByTableHeader('CVE');
+                waitForVulnQuery().then(expectRequestedSort({ field: 'CVE', reversed: true }));
+                sortByTableHeader('CVE');
+                waitForVulnQuery().then(expectRequestedSort({ field: 'CVE', reversed: false }));
+
+                // check sorting of Top Severity column
+                sortByTableHeader('Top CVE severity');
+                waitForVulnQuery().then(expectRequestedSort({ field: 'Severity', reversed: true }));
+                sortByTableHeader('Top CVE severity');
+                waitForVulnQuery().then(
+                    expectRequestedSort({ field: 'Severity', reversed: false })
+                );
+
+                // check sorting of CVE status column
+                sortByTableHeader('CVE status');
+                waitForVulnQuery().then(expectRequestedSort({ field: 'Fixable', reversed: true }));
+                sortByTableHeader('CVE status');
+                waitForVulnQuery().then(expectRequestedSort({ field: 'Fixable', reversed: false }));
+
+                // check sorting of CVSS column
+                sortByTableHeader('Top CVSS');
+                waitForVulnQuery().then(expectRequestedSort({ field: 'CVSS', reversed: true }));
+                sortByTableHeader('Top CVSS');
+                waitForVulnQuery().then(expectRequestedSort({ field: 'CVSS', reversed: false }));
+
+                // check that the Affected components column is not sortable
+                queryTableHeader('Affected components');
+                queryTableSortHeader('Affected components').should('not.exist');
+            }
+        );
     });
 
     it('should filter the CVE table', () => {
-        interceptAndWatchRequests({
-            [getNodeVulnerabilitiesOpname]:
-                routeMatcherMapForNodePage[getNodeVulnerabilitiesOpname],
-        }).then(({ waitForRequests, waitAndYieldRequestBodyVariables }) => {
-            visitFirstNodeFromOverviewPage();
-            waitForRequests();
-
-            // filtering by CVE name should only display rows with a matching name
-            filterHelpers.addAutocompleteFilter('CVE', 'Name', 'CVE-2021-1234');
-            waitAndYieldRequestBodyVariables().then(expectRequestedQuery('CVE:r/CVE-2021-1234'));
-            // Do not assert on cell contents as the filter value is mocked
-            filterHelpers.clearFilters();
-            waitForRequests();
-
-            // filtering by Severity should only display rows with a matching top severity
-            applyLocalSeverityFilters('Low');
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedQuery('Severity:LOW_VULNERABILITY_SEVERITY')
-            );
-            assertOnEachRowForColumn('Top severity', (_, cell) => {
-                expect(cell.innerText).to.contain('Low');
-            });
-            filterHelpers.clearFilters();
-            waitForRequests();
-
-            // filtering by CVE Status should only display rows with a matching status
-            applyLocalStatusFilters('Fixable');
-            waitAndYieldRequestBodyVariables().then(expectRequestedQuery('Fixable:true'));
-            assertOnEachRowForColumn('CVE status', (_, cell) => {
-                expect(cell.innerText).to.contain('Fixable');
-            });
-            filterHelpers.clearFilters();
-            waitForRequests();
-
-            // filtering by CVSS should only display rows with a CVSS in range
-            filterHelpers.addNumericFilter('CVE', 'CVSS', 'Is less than', 8);
-            waitAndYieldRequestBodyVariables().then(expectRequestedQuery('CVSS:<8'));
-            assertOnEachRowForColumn('CVSS', (_, cell) => {
-                const cvss = parseFloat(cell.innerText.replace(/[^0-9.]/g, ''));
-                expect(cvss).to.be.lessThan(8);
-            });
-            filterHelpers.clearFilters();
-            waitForRequests();
-
-            // filtering by Component should only display rows with a nested table containing a matching component
-            //   - expand each row
-            //   - check that the component name exists in the table
-            const componentFilter = 'a';
-            filterHelpers.addAutocompleteFilter('Node component', 'Name', componentFilter);
-            waitAndYieldRequestBodyVariables().then(
-                expectRequestedQuery(`Component:r/${componentFilter}`)
-            );
-            // scope these assertions to the first parent table so that assertions run in the child tables
-            const columnDataLabel = 'Component';
-            cy.get(`table`)
-                .then(($el) =>
-                    $el.find(
-                        `table:has(th:contains("${columnDataLabel}")) td[data-label="${columnDataLabel}"]`
-                    )
-                )
-                .then(($cells) => {
-                    $cells.each((_, cell) => {
-                        expect(cell.innerText).to.contain(componentFilter);
-                    });
-                });
-        });
+        interceptAndWatchRequests(routeMatcherMapForNodePage, staticResponseMapForNodePage).then(
+            ({ waitForRequests, waitAndYieldRequestBodyVariables }) => {
+                visitNodePage(mockNodeId);
+                waitForRequests();
+
+                const waitForVulnQuery = () =>
+                    waitAndYieldRequestBodyVariables([getNodeVulnerabilitiesOpname]).then((vars) =>
+                        cy.wrap(Array.isArray(vars) ? vars[0] : vars)
+                    );
+
+                // Assert GraphQL query strings. Stubbed rows are not a live filter result.
+                filterHelpers.addAutocompleteFilter('CVE', 'Name', 'CVE-2021-1234');
+                waitForVulnQuery().then(expectRequestedQuery('CVE:r/CVE-2021-1234'));
+                filterHelpers.clearFilters();
+                waitForRequests([getNodeVulnerabilitiesOpname]);
+
+                applyLocalSeverityFilters('Low');
+                waitForVulnQuery().then(
+                    expectRequestedQuery('Severity:LOW_VULNERABILITY_SEVERITY')
+                );
+                filterHelpers.clearFilters();
+                waitForRequests([getNodeVulnerabilitiesOpname]);
+
+                applyLocalStatusFilters('Fixable');
+                waitForVulnQuery().then(expectRequestedQuery('Fixable:true'));
+                filterHelpers.clearFilters();
+                waitForRequests([getNodeVulnerabilitiesOpname]);
+
+                filterHelpers.addNumericFilter('CVE', 'CVSS', 'Is less than', 8);
+                waitForVulnQuery().then(expectRequestedQuery('CVSS:<8'));
+                filterHelpers.clearFilters();
+                waitForRequests([getNodeVulnerabilitiesOpname]);
+
+                const componentFilter = 'a';
+                filterHelpers.addAutocompleteFilter('Node component', 'Name', componentFilter);
+                waitForVulnQuery().then(expectRequestedQuery(`Component:r/${componentFilter}`));
+            }
+        );
     });
 
     it('should correctly paginate the CVE table', () => {
         interceptAndWatchRequests(routeMatcherMapForNodePage, staticResponseMapForNodePage).then(
             ({ waitForRequests, waitAndYieldRequestBodyVariables }) => {
-                visitFirstNodeFromOverviewPage();
+                visitNodePage(mockNodeId);
                 waitForRequests();
 
                 paginateNext();
@@ -274,7 +229,7 @@ describe('Node CVEs - Node Detail Page', () => {
     it('should update summary cards when a filter is applied', () => {
         interceptAndWatchRequests(routeMatcherMapForNodePage, staticResponseMapForNodePage).then(
             ({ waitForRequests }) => {
-                visitFirstNodeFromOverviewPage();
+                visitNodePage(mockNodeId);
                 waitForRequests();
 
                 applyLocalSeverityFilters('Low');
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/clusterDetailPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/clusterDetailPage.test.ts
deleted file mode 100644
index 180dddf4c33d1..0000000000000
--- a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/clusterDetailPage.test.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-import withAuth from '../../../helpers/basicAuth';
-
-describe('Platform CVEs - Cluster Detail Page', () => {
-    withAuth();
-
-    it('should restrict access to users with insufficient permissions', () => {
-        // check that users without Cluster access cannot access the Cluster Detail page directly
-    });
-
-    it('should only show relevant filters for the Cluster Detail page', () => {
-        // check the advanced filters and ensure only the relevant filters are displayed
-    });
-
-    it('should link to the correct pages', () => {
-        // clicking the Cluster breadcrumb should navigate to the overview page with the Cluster tab selected
-        // clicking a CVE name in the list should navigate to the correct Platform CVE details page
-    });
-
-    it('should sort CVE table columns', () => {
-        // check sorting of CVE column
-        // check sorting of CVE status column
-        // check sorting of CVE type column
-        // check sorting of CVSS column
-    });
-
-    it('should filter the CVE table', () => {
-        // filtering by CVE name should only display rows with a matching name
-        // filtering by CVE Status should only display rows with a matching status
-        // filtering by CVE Type should only display rows with a matching type
-        // filtering by CVSS should only display rows with a CVSS in range
-        // clearing filters should remove all filter chips and filter from the URL
-    });
-
-    it('should correctly paginate the CVE table', () => {
-        // visit the location and save the list of CVE names with a default perPage
-        //   visit the location with perPage=2 in the URL
-        //     should only display the first 2 rows of the previous list
-        //     paginating to the next page should display the following two rows
-        // go to page 1, then page 2
-        //   applying a filter should reset the page to 1
-        // go to page 1, then page 2
-        //   go to next page, applying a sort should reset the page to 1
-    });
-
-    it('should correctly update summary cards when a filter is applied', () => {
-        // apply a Fixable status filter and ensure that Not Fixable displays "Results hidden"
-        // clear filters
-        // apply a CVE Type filter and ensure that all other types read "Results hidden" in the card
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/cveDetailPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/cveDetailPage.test.ts
deleted file mode 100644
index cb91ef240b999..0000000000000
--- a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/cveDetailPage.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import withAuth from '../../../helpers/basicAuth';
-
-// TODO - classic tests conditionally skip many of these checks when running on OpenShift, we
-//        need to verify if this is still necessary and if so, how to handle it in the new tests
-describe('Platform CVEs - CVE Detail Page', () => {
-    withAuth();
-
-    it('should restrict access to users with insufficient permissions', () => {
-        // check that users without Cluster access cannot access the Platform CVE Detail page directly
-    });
-
-    it('should only show relevant filters for the page', () => {
-        // check the advanced filters and ensure only the relevant filters are displayed
-    });
-
-    it('should link to the overview page from the breadcrumbs', () => {
-        // clicking the Platform CVEs breadcrumb should navigate to the overview page with the CVE tab selected
-    });
-
-    it('should link to the cluster page from the name links in the table', () => {
-        // clicking a Cluster name in the list should navigate to the correct Cluster details page
-    });
-
-    it('should display the expected Cluster table columns', () => {
-        // check presence of Cluster column
-        // check presence of Cluster type column
-        // check presence of K8s version column
-    });
-
-    it('should sort Cluster table columns', () => {
-        // check sorting of Cluster column
-        // check sorting of Cluster type column
-        // check sorting of K8s version column
-    });
-
-    it('should filter the Cluster table', () => {
-        // filtering by Cluster name should only display rows with a matching name
-        // filtering by Cluster type should only display rows with a matching cluster type
-        // filtering by K8s version should only display rows matching the version
-        // clearing filters should remove all filter chips and filter from the URL
-    });
-
-    // Note: This might not be reliable in CI due to the low number of Clusters. We may need to mock and/or
-    // just test the logic of the pagination in the URL.
-    it('should paginate the Cluster table', () => {
-        // visit the location and save the list of Cluster names with a default perPage
-        //   visit the location with perPage=2 in the URL
-        //     should only display the first 2 rows of the previous list
-        //     paginating to the next page should display the following two rows
-        // go to page 1, then page 2
-        //   applying a filter should reset the page to 1
-        // go to page 1, then page 2
-        //   go to next page, applying a sort should reset the page to 1
-    });
-
-    it('should update summary cards when a filter is applied', () => {
-        // apply a filter for a Cluster name and ensure that "affected clusters" contains the text: 1/n affected clusters
-        // clear filters
-        // apply a CVE status filter and ensure that the opposite status reads "Results hidden" in the card
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/platformCvesFeatureFlag.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/platformCvesFeatureFlag.test.ts
deleted file mode 100644
index 46208a73156d3..0000000000000
--- a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/platformCvesFeatureFlag.test.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-import type { RouteHandler, RouteMatcherOptions } from 'cypress/types/net-stubbing';
-
-import withAuth from '../../../helpers/basicAuth';
-import { interceptAndOverrideFeatureFlags } from '../../../helpers/request';
-import { visit } from '../../../helpers/visit';
-import pf6 from '../../../selectors/pf6';
-
-export function visitPlatformCvesOverviewPage(
-    routeMatcherMap?: Record<string, RouteMatcherOptions>,
-    staticResponseMap?: Record<string, RouteHandler>
-) {
-    visit('/main/vulnerabilities/platform-cves', routeMatcherMap, staticResponseMap);
-}
-
-describe('Platform CVEs - Feature Flag Gating', () => {
-    withAuth();
-
-    describe('when ROX_LEGACY_SCANNER is enabled', () => {
-        beforeEach(() => {
-            interceptAndOverrideFeatureFlags({ ROX_LEGACY_SCANNER: true });
-        });
-
-        it('should show the "Kubernetes components" item in the More Views dropdown', () => {
-            visit('/main/vulnerabilities/user-workloads');
-            cy.get(`${pf6.menuToggle}:contains("More Views")`).click();
-            cy.get(`${pf6.dropdownItem}:contains("Kubernetes components")`).should('exist');
-        });
-
-        it('should render the Kubernetes components page when navigated to directly', () => {
-            visitPlatformCvesOverviewPage();
-
-            cy.get('h1').should('contain', 'Kubernetes components');
-        });
-    });
-
-    describe('when ROX_LEGACY_SCANNER is disabled', () => {
-        beforeEach(() => {
-            interceptAndOverrideFeatureFlags({ ROX_LEGACY_SCANNER: false });
-        });
-
-        it('should not show the "Kubernetes components" item in the More Views dropdown', () => {
-            visit('/main/vulnerabilities/user-workloads');
-            cy.get(`${pf6.menuToggle}:contains("More Views")`).click();
-            cy.get(`${pf6.dropdownItem}:contains("Kubernetes components")`).should('not.exist');
-        });
-
-        it('should show a disabled feature page when navigated to directly', () => {
-            visitPlatformCvesOverviewPage();
-
-            cy.get('h1').should('contain', 'Kubernetes components');
-            cy.get('body').should('contain', 'disabled by your administrator');
-            cy.get('a:contains("Go to Vulnerability Management")').should('exist');
-        });
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/platformCvesOverviewPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/platformCvesOverviewPage.test.ts
deleted file mode 100644
index e6582841ff4a3..0000000000000
--- a/ui/apps/platform/cypress/integration/vulnerabilities/platformCves/platformCvesOverviewPage.test.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-import withAuth from '../../../helpers/basicAuth';
-
-describe('Platform CVEs - Overview Page', () => {
-    withAuth();
-
-    it('should restrict access to users with insufficient permissions', () => {
-        // check that users without Cluster access do not see Platform CVEs in the navigation
-        // check that users without Cluster access cannot access the Platform CVEs page directly
-    });
-
-    it('should only show relevant filters for the Platform CVEs page', () => {
-        // check the advanced filters and ensure only the relevant filters are displayed for CVEs
-        // check the advanced filters and ensure only the relevant filters are displayed for Clusters
-    });
-
-    it('should link to the correct details pages', () => {
-        // clicking a CVE in the list should navigate to the correct CVE details page
-        // clicking a Cluster in the list should navigate to the correct Cluster details page
-    });
-
-    it('should sort CVE table columns', () => {
-        // check sorting of CVE column
-        // check sorting of CVE status column
-        // check sorting of CVE type column
-        // check sorting of CVSS column
-        // check sorting of Affected Clusters column
-    });
-
-    it('should sort Cluster table columns', () => {
-        // check sorting of Cluster column
-        // check sorting of CVE count column
-        // check sorting of Cluster type column
-        // check sorting of K8s version column
-    });
-
-    it('should filter the CVE table', () => {
-        // filtering by CVE name should only display rows with a matching name
-        // filtering by Status should only display rows with a matching status
-        // filtering by Type should only display rows with a matching type
-        // filtering by CVSS should only display rows with a CVSS in range
-        // clearing filters should remove all filter chips and filter from the URL
-    });
-
-    it('should filter the Cluster table', () => {
-        // filtering by Cluster name should only display rows with a matching name
-        // filtering by Cluster type should only display rows with a matching cluster type
-        // filtering by K8s version should only display rows matching the version
-        // clearing filters should remove all filter chips and filter from the URL
-    });
-
-    it('should correctly paginate the CVE table', () => {
-        // visit the location and save the list of CVE names with a default perPage
-        //   visit the location with perPage=2 in the URL
-        //     should only display the first 2 rows of the previous list
-        //     paginating to the next page should display the following two rows
-        // go to page 1, then page 2
-        //   applying a filter should reset the page to 1
-        // go to page 1, then page 2
-        //   go to next page, applying a sort should reset the page to 1
-        // go to page 1, then page 2
-        //   click the "clusters" tab, then click back to the "cves" tab should reset the page to 1
-    });
-
-    it('should correctly paginate the Cluster table', () => {
-        // visit the location and save the list of Cluster names with a default perPage
-        //   visit the location with perPage=2 in the URL
-        //     should only display the first 2 rows of the previous list
-        //     paginating to the next page should display the following two rows
-        // go to page 1, then page 2
-        //   applying a filter should reset the page to 1
-        // go to page 1, then page 2
-        //   go to next page, applying a sort should reset the page to 1
-        // go to page 1, then page 2
-        //   click the "cves" tab, then click back to the "clusters" tab should reset the page to 1
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/reports/reportsOverviewNav.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/reports/reportsOverviewNav.test.ts
new file mode 100644
index 0000000000000..49ef7cc346922
--- /dev/null
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/reports/reportsOverviewNav.test.ts
@@ -0,0 +1,30 @@
+import withAuth from '../../../helpers/basicAuth';
+import { interceptAndOverridePermissions } from '../../../helpers/request';
+import { visit } from '../../../helpers/visit';
+import pf6 from '../../../selectors/pf6';
+
+const vulnerabilityReportsOverviewPath = '/main/vulnerabilities/reports';
+const vulnerabilityImageReportsPath = '/main/vulnerabilities/reports/images';
+const vulnerabilityNodeReportsPath = '/main/vulnerabilities/reports/nodes';
+
+describe('Vulnerability Reports Overview Navigation', () => {
+    withAuth();
+
+    it('navigates to the image vulnerability reports page', () => {
+        interceptAndOverridePermissions({ Deployment: 'READ_ACCESS', Image: 'READ_ACCESS' });
+
+        visit(vulnerabilityReportsOverviewPath);
+
+        cy.get(`${pf6.card}:contains("Image vulnerability reports") button`).click();
+        cy.location('pathname').should('include', vulnerabilityImageReportsPath);
+    });
+
+    it('navigates to the node vulnerability reports page', () => {
+        interceptAndOverridePermissions({ Cluster: 'READ_ACCESS', Node: 'READ_ACCESS' });
+
+        visit(vulnerabilityReportsOverviewPath);
+
+        cy.get(`${pf6.card}:contains("Node vulnerability reports") button`).click();
+        cy.location('pathname').should('include', vulnerabilityNodeReportsPath);
+    });
+});
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/VirtualMachineCve.helpers.ts b/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/VirtualMachineCve.helpers.ts
index e334b79b09101..ba4cb9b5ef70b 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/VirtualMachineCve.helpers.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/VirtualMachineCve.helpers.ts
@@ -4,11 +4,15 @@ import { visit, visitWithStaticResponseForPermissions } from '../../../helpers/v
 
 export const listVirtualMachinesAlias = 'listVirtualMachines';
 export const getVirtualMachineAlias = 'getVirtualMachine';
+export const getVirtualMachineCveComponentsAlias = 'getVirtualMachineCveComponents';
+export const listVirtualMachineCvesAlias = 'listVirtualMachineCves';
+export const listVirtualMachineComponentsAlias = 'listVirtualMachineComponents';
+export const getVirtualMachineVulnSummaryAlias = 'getVirtualMachineVulnSummary';
 
 export const routeMatcherMapForVirtualMachines = {
     [listVirtualMachinesAlias]: {
         method: 'GET',
-        url: '/v2/virtualmachines?*',
+        url: '/v2/virtualmachines/vms?*',
     },
 };
 
@@ -19,20 +23,53 @@ export const routeMatcherMapForVirtualMachine = {
     },
 };
 
+export const routeMatcherMapForVirtualMachineVulnerabilities = {
+    ...routeMatcherMapForVirtualMachine,
+    [listVirtualMachineCvesAlias]: {
+        method: 'GET',
+        url: '/v2/virtualmachines/*/cves?*',
+    },
+    [getVirtualMachineVulnSummaryAlias]: {
+        method: 'GET',
+        url: '/v2/virtualmachines/*/vuln-summary?*',
+    },
+};
+
+export const routeMatcherMapForVirtualMachineComponents = {
+    [listVirtualMachineComponentsAlias]: {
+        method: 'GET',
+        url: '/v2/virtualmachines/*/components?*',
+    },
+};
+
+export const routeMatcherMapForVirtualMachineCveComponents = {
+    [getVirtualMachineCveComponentsAlias]: {
+        method: 'GET',
+        url: '/v2/virtualmachines/*/cves/*/components',
+    },
+};
+
+function virtualMachineCvesOverviewPath(params?: Record<string, string>): string {
+    const query = params ? `?${new URLSearchParams(params).toString()}` : '';
+    return `/main/vulnerabilities/virtual-machine-cves${query}`;
+}
+
 export function visitVirtualMachineCvesOverviewPage(
     routeMatcherMap?: Record<string, RouteMatcherOptions>,
-    staticResponseMap?: Record<string, RouteHandler>
+    staticResponseMap?: Record<string, RouteHandler>,
+    params?: Record<string, string>
 ) {
-    visit('/main/vulnerabilities/virtual-machine-cves', routeMatcherMap, staticResponseMap);
+    visit(virtualMachineCvesOverviewPath(params), routeMatcherMap, staticResponseMap);
 }
 
 export function visitVirtualMachineCvesOverviewPageWithStaticPermissions(
     resourceToAccess: Record<string, string>,
     routeMatcherMap?: Record<string, RouteMatcherOptions>,
-    staticResponseMap?: Record<string, RouteHandler>
+    staticResponseMap?: Record<string, RouteHandler>,
+    params?: Record<string, string>
 ) {
     visitWithStaticResponseForPermissions(
-        '/main/vulnerabilities/virtual-machine-cves',
+        virtualMachineCvesOverviewPath(params),
         { body: { resourceToAccess } },
         routeMatcherMap,
         staticResponseMap
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachineCvesOverviewPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachineCvesOverviewPage.test.ts
index 5f0ef0043ec8b..5aa785365c842 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachineCvesOverviewPage.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachineCvesOverviewPage.test.ts
@@ -11,7 +11,8 @@ import {
     visitVirtualMachineCvesOverviewPageWithStaticPermissions,
 } from './VirtualMachineCve.helpers';
 
-const fixturePathListVMs = 'vulnerabilities/virtualMachineCves/listVirtualMachines';
+const fixturePathListVMs = 'vulnerabilities/virtualMachineCves/listVMs';
+const virtualMachineTabParams = { entityTab: 'VirtualMachine' };
 
 describe('Virtual Machine CVEs - Overview Page', () => {
     withAuth();
@@ -35,28 +36,38 @@ describe('Virtual Machine CVEs - Overview Page', () => {
                 [listVirtualMachinesAlias]: {
                     fixture: fixturePathListVMs,
                 },
-            }
+            },
+            virtualMachineTabParams
         );
         cy.get('h1').contains('Virtual machine vulnerabilities');
     });
 
     it('should render the overview page heading and description', () => {
-        visitVirtualMachineCvesOverviewPage(routeMatcherMapForVirtualMachines, {
-            [listVirtualMachinesAlias]: {
-                fixture: fixturePathListVMs,
+        visitVirtualMachineCvesOverviewPage(
+            routeMatcherMapForVirtualMachines,
+            {
+                [listVirtualMachinesAlias]: {
+                    fixture: fixturePathListVMs,
+                },
             },
-        });
+            virtualMachineTabParams
+        );
 
         cy.get('h1').contains('Virtual machine vulnerabilities');
+        cy.contains('Technology preview').should('not.exist');
         cy.get('body').contains('Prioritize and remediate observed CVEs across virtual machines');
     });
 
     it('should render VM rows from fixture data', () => {
-        visitVirtualMachineCvesOverviewPage(routeMatcherMapForVirtualMachines, {
-            [listVirtualMachinesAlias]: {
-                fixture: fixturePathListVMs,
+        visitVirtualMachineCvesOverviewPage(
+            routeMatcherMapForVirtualMachines,
+            {
+                [listVirtualMachinesAlias]: {
+                    fixture: fixturePathListVMs,
+                },
             },
-        });
+            virtualMachineTabParams
+        );
 
         cy.get('tbody tr').should('have.length', 3);
 
@@ -84,11 +95,15 @@ describe('Virtual Machine CVEs - Overview Page', () => {
     });
 
     it('should link VM names to the correct detail page', () => {
-        visitVirtualMachineCvesOverviewPage(routeMatcherMapForVirtualMachines, {
-            [listVirtualMachinesAlias]: {
-                fixture: fixturePathListVMs,
+        visitVirtualMachineCvesOverviewPage(
+            routeMatcherMapForVirtualMachines,
+            {
+                [listVirtualMachinesAlias]: {
+                    fixture: fixturePathListVMs,
+                },
             },
-        });
+            virtualMachineTabParams
+        );
 
         cy.get('tbody tr td[data-label="Virtual machine"] a')
             .first()
@@ -101,11 +116,15 @@ describe('Virtual Machine CVEs - Overview Page', () => {
     });
 
     it('should display an empty state when no VMs are returned', () => {
-        visitVirtualMachineCvesOverviewPage(routeMatcherMapForVirtualMachines, {
-            [listVirtualMachinesAlias]: {
-                body: { virtualMachines: [], totalCount: 0 },
+        visitVirtualMachineCvesOverviewPage(
+            routeMatcherMapForVirtualMachines,
+            {
+                [listVirtualMachinesAlias]: {
+                    body: { vms: [], totalCount: 0 },
+                },
             },
-        });
+            virtualMachineTabParams
+        );
 
         cy.get('body').contains('No CVEs have been detected');
     });
@@ -116,13 +135,13 @@ describe('Virtual Machine CVEs - Overview Page', () => {
                 fixture: fixturePathListVMs,
             },
         }).then(({ waitForRequests }) => {
-            visitVirtualMachineCvesOverviewPage();
+            visitVirtualMachineCvesOverviewPage(undefined, undefined, virtualMachineTabParams);
             waitForRequests();
 
             sortByTableHeader('Virtual machine');
             cy.wait(`@${listVirtualMachinesAlias}`).then((interception) => {
                 const { url } = interception.request;
-                expect(url).to.include('Virtual Machine Name');
+                expect(decodeURIComponent(url)).to.include('Virtual Machine Name');
             });
         });
     });
@@ -130,15 +149,25 @@ describe('Virtual Machine CVEs - Overview Page', () => {
     it('should paginate through results', () => {
         const paginatedFixture = {
             body: {
-                virtualMachines: Array.from({ length: 20 }, (_, i) => ({
+                vms: Array.from({ length: 20 }, (_, i) => ({
                     id: `vm-${String(i + 1).padStart(3, '0')}`,
                     namespace: 'default',
                     name: `cypress-vm-${i + 1}`,
                     clusterId: 'cluster-001',
                     clusterName: 'production-cluster',
+                    guestOs: 'Red Hat Enterprise Linux 9.2',
                     lastUpdated: '2025-04-15T10:30:00.000Z',
+                    scanTime: '2025-04-15T10:30:00.000Z',
                     vsockCid: i + 3,
-                    state: 'RUNNING',
+                    state: 'VM_STATE_RUNNING',
+                    cveSeverityCounts: {
+                        critical: { total: 0, fixable: 0 },
+                        important: { total: 0, fixable: 0 },
+                        moderate: { total: 0, fixable: 0 },
+                        low: { total: 0, fixable: 0 },
+                        unknown: { total: 0, fixable: 0 },
+                    },
+                    componentScanCount: { scanned: 0, total: 0 },
                 })),
                 totalCount: 50,
             },
@@ -147,7 +176,7 @@ describe('Virtual Machine CVEs - Overview Page', () => {
         interceptAndWatchRequests(routeMatcherMapForVirtualMachines, {
             [listVirtualMachinesAlias]: paginatedFixture,
         }).then(({ waitForRequests }) => {
-            visitVirtualMachineCvesOverviewPage();
+            visitVirtualMachineCvesOverviewPage(undefined, undefined, virtualMachineTabParams);
             waitForRequests();
 
             paginateNext();
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachinePage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachinePage.test.ts
index 37c1c3c0689d0..88417e6d3ceb6 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachinePage.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/virtualMachineCves/virtualMachinePage.test.ts
@@ -1,21 +1,49 @@
+import { interceptRequests } from '../../../helpers/request';
 import withAuth from '../../../helpers/basicAuth';
 import { hasFeatureFlag } from '../../../helpers/features';
 import { assertCannotFindThePage } from '../../../helpers/visit';
 
 import {
     getVirtualMachineAlias,
-    routeMatcherMapForVirtualMachine,
+    getVirtualMachineCveComponentsAlias,
+    getVirtualMachineVulnSummaryAlias,
+    listVirtualMachineComponentsAlias,
+    listVirtualMachineCvesAlias,
+    routeMatcherMapForVirtualMachineComponents,
+    routeMatcherMapForVirtualMachineCveComponents,
+    routeMatcherMapForVirtualMachineVulnerabilities,
     visitVirtualMachinePage,
     visitVirtualMachinePageWithStaticPermissions,
 } from './VirtualMachineCve.helpers';
 
 const vmId = 'vm-001';
-const fixturePathGetVM = 'vulnerabilities/virtualMachineCves/getVirtualMachine';
+const fixturePathGetVM = 'vulnerabilities/virtualMachineCves/getVM';
+const fixturePathListCves = 'vulnerabilities/virtualMachineCves/listVirtualMachineCves';
+const fixturePathListComponents = 'vulnerabilities/virtualMachineCves/listVirtualMachineComponents';
+const fixturePathCveComponents = 'vulnerabilities/virtualMachineCves/getVMCVEComponents';
+const fixturePathVulnSummary = 'vulnerabilities/virtualMachineCves/getVMVulnSummary';
+
+const staticResponseMapForVirtualMachineVulnerabilities = {
+    [getVirtualMachineAlias]: { fixture: fixturePathGetVM },
+    [listVirtualMachineCvesAlias]: { fixture: fixturePathListCves },
+    [getVirtualMachineVulnSummaryAlias]: { fixture: fixturePathVulnSummary },
+};
+
+function visitWithVulnFixtures() {
+    visitVirtualMachinePage(
+        vmId,
+        routeMatcherMapForVirtualMachineVulnerabilities,
+        staticResponseMapForVirtualMachineVulnerabilities
+    );
+}
 
-function visitWithFixture() {
-    visitVirtualMachinePage(vmId, routeMatcherMapForVirtualMachine, {
-        [getVirtualMachineAlias]: { fixture: fixturePathGetVM },
+function visitComponentsTab() {
+    visitWithVulnFixtures();
+    interceptRequests(routeMatcherMapForVirtualMachineComponents, {
+        [listVirtualMachineComponentsAlias]: { fixture: fixturePathListComponents },
     });
+    cy.get('button').contains('Components').click();
+    cy.wait(`@${listVirtualMachineComponentsAlias}`);
 }
 
 describe('Virtual Machine CVEs - Virtual Machine Page', () => {
@@ -36,17 +64,15 @@ describe('Virtual Machine CVEs - Virtual Machine Page', () => {
         visitVirtualMachinePageWithStaticPermissions(
             vmId,
             { Cluster: 'READ_ACCESS' },
-            routeMatcherMapForVirtualMachine,
-            {
-                [getVirtualMachineAlias]: { fixture: fixturePathGetVM },
-            }
+            routeMatcherMapForVirtualMachineVulnerabilities,
+            staticResponseMapForVirtualMachineVulnerabilities
         );
         cy.get('h1').contains('cypress-vm-1');
     });
 
     describe('Vulnerabilities tab', () => {
         it('should render CVE rows from fixture data', () => {
-            visitWithFixture();
+            visitWithVulnFixtures();
 
             cy.get('tbody tr:not([class*="expandable"])').should('have.length', 3);
 
@@ -54,47 +80,54 @@ describe('Virtual Machine CVEs - Virtual Machine Page', () => {
                 .eq(0)
                 .within(() => {
                     cy.get('td[data-label="CVE"]').contains('CVE-2024-0001');
-                    cy.get('td[data-label="CVE severity"]').should('exist');
-                    cy.get('td[data-label="CVE status"]').should('exist');
-                    cy.get('td[data-label="CVSS"]').should('exist');
-                    cy.get('td[data-label="EPSS probability"]').should('exist');
-                    cy.get('td[data-label="Affected components"]').contains('openssl');
+                    cy.get('td[data-label="Top CVE severity"]').contains('Critical');
+                    cy.get('td[data-label="CVE status"]').contains('Fixable');
+                    cy.get('td[data-label="Top CVSS"]').contains('9.8');
+                    cy.get('td[data-label="EPSS probability"]').contains('85.000%');
+                    cy.get('td[data-label="Affected components"]').contains('1 component');
                 });
         });
 
         it('should display the correct number of affected components', () => {
-            visitWithFixture();
+            visitWithVulnFixtures();
 
             cy.get('tbody tr:not([class*="expandable"])')
                 .eq(0)
                 .within(() => {
-                    cy.get('td[data-label="Affected components"]').contains('openssl');
+                    cy.get('td[data-label="CVE"]').contains('CVE-2024-0001');
+                    cy.get('td[data-label="Affected components"]').contains('1 component');
                 });
 
             cy.get('tbody tr:not([class*="expandable"])')
                 .eq(2)
                 .within(() => {
-                    cy.get('td[data-label="Affected components"]').contains('curl');
+                    cy.get('td[data-label="CVE"]').contains('CVE-2024-0003');
+                    cy.get('td[data-label="Affected components"]').contains('1 component');
                 });
         });
 
-        it('should expand a row to show the components sub-table', () => {
-            visitWithFixture();
+        it('should expand a row to show affected component details', () => {
+            visitWithVulnFixtures();
+
+            // Components for a single CVE are fetched lazily on row expand, so stub that
+            // endpoint after the initial page load rather than in the visit route map.
+            interceptRequests(routeMatcherMapForVirtualMachineCveComponents, {
+                [getVirtualMachineCveComponentsAlias]: { fixture: fixturePathCveComponents },
+            });
 
             cy.get('tbody tr:not([class*="expandable"])').eq(0).find('td button').first().click();
+            cy.wait(`@${getVirtualMachineCveComponentsAlias}`);
 
             cy.get('tbody tr[class*="expandable"]')
                 .eq(0)
                 .within(() => {
                     cy.get('td[data-label="Component"]').contains('openssl');
                     cy.get('td[data-label="Version"]').contains('3.0.7-20.el9');
-                    cy.get('td[data-label="CVE fixed in"]').contains('3.0.7-25.el9');
-                    cy.get('td[data-label="Advisory"]').contains('RHSA-2024:0001');
                 });
         });
 
         it('should display an empty state when the VM has no vulnerabilities', () => {
-            visitVirtualMachinePage(vmId, routeMatcherMapForVirtualMachine, {
+            visitVirtualMachinePage(vmId, routeMatcherMapForVirtualMachineVulnerabilities, {
                 [getVirtualMachineAlias]: {
                     body: {
                         id: vmId,
@@ -102,15 +135,31 @@ describe('Virtual Machine CVEs - Virtual Machine Page', () => {
                         name: 'empty-vm',
                         clusterId: 'cluster-001',
                         clusterName: 'production-cluster',
-                        scan: {
-                            scanTime: '2025-04-15T10:30:00.000Z',
-                            operatingSystem: 'rhel:9',
-                            components: [],
-                            notes: [],
-                        },
+                        guestOs: 'Red Hat Enterprise Linux 9.2',
                         lastUpdated: '2025-04-15T10:30:00.000Z',
+                        facts: {},
+                        annotations: {},
+                        labels: {},
                         vsockCid: 3,
-                        state: 'RUNNING',
+                        notes: [],
+                        state: 'VM_STATE_RUNNING',
+                        agentStatus: 'AGENT_STATUS_ACTIVE',
+                    },
+                },
+                [listVirtualMachineCvesAlias]: {
+                    body: { cves: [], totalCount: 0 },
+                },
+                [getVirtualMachineVulnSummaryAlias]: {
+                    body: {
+                        severityCounts: {
+                            critical: { total: 0, fixable: 0 },
+                            important: { total: 0, fixable: 0 },
+                            moderate: { total: 0, fixable: 0 },
+                            low: { total: 0, fixable: 0 },
+                            unknown: { total: 0, fixable: 0 },
+                        },
+                        fixableCount: 0,
+                        notFixableCount: 0,
                     },
                 },
             });
@@ -121,25 +170,37 @@ describe('Virtual Machine CVEs - Virtual Machine Page', () => {
 
     describe('Components tab', () => {
         it('should render component rows from fixture data', () => {
-            visitWithFixture();
-
-            cy.get('button').contains('Components').click();
+            visitComponentsTab();
 
             cy.get('tbody tr').should('have.length', 3);
 
             cy.get('tbody tr')
                 .eq(0)
                 .within(() => {
-                    cy.get('td[data-label="Name"]').should('exist');
-                    cy.get('td[data-label="Version"]').should('exist');
-                    cy.get('td[data-label="Status"]').should('exist');
+                    cy.get('td[data-label="Name"]').contains('openssl');
+                    cy.get('td[data-label="Version"]').contains('3.0.7-20.el9');
+                    cy.get('td[data-label="Status"]').contains('Scanned');
+                    cy.get('td[data-label="Source"]').contains('OS');
+                });
+
+            cy.get('tbody tr')
+                .eq(1)
+                .within(() => {
+                    cy.get('td[data-label="Name"]').contains('curl');
+                    cy.get('td[data-label="Version"]').contains('7.76.1-26.el9');
+                });
+
+            cy.get('tbody tr')
+                .eq(2)
+                .within(() => {
+                    cy.get('td[data-label="Name"]').contains('systemd');
+                    cy.get('td[data-label="Version"]').contains('252-18.el9');
+                    cy.get('td[data-label="Status"]').contains('Not scanned');
                 });
         });
 
         it('should show scanned and unscanned statuses', () => {
-            visitWithFixture();
-
-            cy.get('button').contains('Components').click();
+            visitComponentsTab();
 
             cy.get('td[data-label="Status"]').then(($cells) => {
                 const statuses = $cells.map((_, el) => el.innerText.trim()).get();
@@ -151,14 +212,14 @@ describe('Virtual Machine CVEs - Virtual Machine Page', () => {
 
     describe('Breadcrumb navigation', () => {
         it('should display VM name in breadcrumb', () => {
-            visitWithFixture();
+            visitWithVulnFixtures();
 
             cy.get('.pf-v6-c-breadcrumb__item').should('contain.text', 'Virtual Machines');
             cy.get('.pf-v6-c-breadcrumb__item').should('contain.text', 'cypress-vm-1');
         });
 
         it('should link back to the overview page', () => {
-            visitWithFixture();
+            visitWithVulnFixtures();
 
             cy.get('.pf-v6-c-breadcrumb__item a')
                 .contains('Virtual Machines')
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/deploymentSingle.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/deploymentSingle.test.ts
index 778cc8a43e973..28ee7a461ba97 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/deploymentSingle.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/deploymentSingle.test.ts
@@ -73,7 +73,7 @@ describe('Workload CVE Deployment Single page', () => {
         cy.get(vulnSelectors.summaryCard('CVEs by status'));
         // Check table exists with the correct headers
         cy.get('table thead tr th').contains('CVE');
-        cy.get('table thead tr th').contains('CVE severity');
+        cy.get('table thead tr th').contains('Top CVE severity');
         cy.get('table thead tr th').contains('CVE status');
         cy.get('table thead tr th').contains('Affected components');
         cy.get('table thead tr th').contains('First discovered');
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/imageSingle.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/imageSingle.test.ts
index 8ce81d5520e73..c784b117e70ed 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/imageSingle.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/imageSingle.test.ts
@@ -49,20 +49,11 @@ describe('Workload CVE Image Single page', () => {
     // see: https://issues.redhat.com/browse/ROX-24254
     //      https://github.com/stackrox/stackrox/pull/6156
     it('should display nested component data correctly when processed via apollo client', () => {
-        const isFlattenImageData = hasFeatureFlag('ROX_FLATTEN_IMAGE_DATA');
-        const imageRootKey = isFlattenImageData ? 'imageV2' : 'image';
-
         const opname = 'getCVEsForImage';
 
         const imageData = {
-            id: isFlattenImageData
-                ? '4c657931-d333-5cb8-8f0d-7e3836525ec7'
-                : 'sha256:010fec71f42f4b5e65f3f56f10af94a7c05c9c271a9bbc3026684ba170698cb5',
-            ...(isFlattenImageData
-                ? {
-                      digest: 'sha256:010fec71f42f4b5e65f3f56f10af94a7c05c9c271a9bbc3026684ba170698cb5',
-                  }
-                : {}),
+            id: '4c657931-d333-5cb8-8f0d-7e3836525ec7',
+            digest: 'sha256:010fec71f42f4b5e65f3f56f10af94a7c05c9c271a9bbc3026684ba170698cb5',
             name: {
                 registry: 'quay.io',
                 remote: 'openshift-release-dev/ocp-v4.0-art-dev',
@@ -82,7 +73,7 @@ describe('Workload CVE Image Single page', () => {
                 },
                 __typename: 'ImageMetadata',
             },
-            __typename: isFlattenImageData ? 'ImageV2' : 'Image',
+            __typename: 'ImageV2',
             imageCVECountBySeverity: {
                 unknown: {
                     total: 0,
@@ -182,7 +173,7 @@ describe('Workload CVE Image Single page', () => {
 
         const body = {
             data: {
-                [imageRootKey]: imageData,
+                imageV2: imageData,
             },
         };
 
diff --git a/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/workloadCveOverviewPage.test.ts b/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/workloadCveOverviewPage.test.ts
index 5b685bca9a27e..12bb73e18817b 100644
--- a/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/workloadCveOverviewPage.test.ts
+++ b/ui/apps/platform/cypress/integration/vulnerabilities/workloadCves/workloadCveOverviewPage.test.ts
@@ -363,8 +363,6 @@ describe('Workload CVE overview page tests', () => {
 
     describe('Layer type filter tests', () => {
         it('should apply Layer type filter correctly', () => {
-            interceptAndOverrideFeatureFlags({ ROX_BASE_IMAGE_DETECTION: true });
-
             visitWorkloadCveOverview();
 
             addCheckboxSelectFilter('Image component', 'Layer type', 'Base image');
diff --git a/ui/apps/platform/cypress/integration/vulnmanagement/VulnerabilityManagement.helpers.js b/ui/apps/platform/cypress/integration/vulnmanagement/VulnerabilityManagement.helpers.js
index 4ee5ab5f4fc3a..a9a14f7428e40 100644
--- a/ui/apps/platform/cypress/integration/vulnmanagement/VulnerabilityManagement.helpers.js
+++ b/ui/apps/platform/cypress/integration/vulnmanagement/VulnerabilityManagement.helpers.js
@@ -10,7 +10,6 @@ const opnamesForDashboard = [
     'topRiskiestImageVulns',
     'recentlyDetectedImageVulnerabilities',
     'mostCommonImageVulnerabilities',
-    'clustersWithMostClusterVulnerabilities',
 ];
 
 const routeMatcherMapForVulnerabilityManagementDashboard =
diff --git a/ui/apps/platform/cypress/integration/vulnmanagement/clusterCves.test.js b/ui/apps/platform/cypress/integration/vulnmanagement/clusterCves.test.js
deleted file mode 100644
index 26f80dd53bdff..0000000000000
--- a/ui/apps/platform/cypress/integration/vulnmanagement/clusterCves.test.js
+++ /dev/null
@@ -1,100 +0,0 @@
-import withAuth from '../../helpers/basicAuth';
-import { hasOrchestratorFlavor } from '../../helpers/features';
-import {
-    assertSortedItems,
-    callbackForPairOfAscendingNumberValuesFromElements,
-    callbackForPairOfDescendingNumberValuesFromElements,
-} from '../../helpers/sort';
-import {
-    hasTableColumnHeadings,
-    interactAndWaitForVulnerabilityManagementEntities,
-    verifySecondaryEntities,
-    visitVulnerabilityManagementEntities,
-} from './VulnerabilityManagement.helpers';
-import { selectors } from './VulnerabilityManagement.selectors';
-
-const entitiesKey = 'cluster-cves';
-
-describe('Vulnerability Management Cluster (Platform) CVEs', () => {
-    withAuth();
-
-    it('should display table columns', () => {
-        visitVulnerabilityManagementEntities(entitiesKey);
-
-        hasTableColumnHeadings([
-            '', // checkbox
-            '', // hidden
-            'CVE',
-            'Type',
-            'Fixable',
-            'CVSS Score',
-            'Env. Impact',
-            'Impact Score',
-            'Entities',
-            'Published',
-            '', // hidden
-        ]);
-    });
-
-    it('should sort the CVSS Score column', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        visitVulnerabilityManagementEntities(entitiesKey);
-
-        const thSelector = '.rt-th:contains("CVSS Score")';
-        const tdSelector = '.rt-td:nth-child(6) [data-testid="label-chip"]';
-
-        // 0. Initial table state indicates that the column is sorted descending.
-        cy.get(thSelector).should('have.class', '-sort-desc');
-        cy.get(tdSelector).then((items) => {
-            assertSortedItems(items, callbackForPairOfDescendingNumberValuesFromElements);
-        });
-
-        // 1. Sort ascending by the column.
-        interactAndWaitForVulnerabilityManagementEntities(() => {
-            cy.get(thSelector).click();
-        }, entitiesKey);
-        cy.location('search').should('eq', '?sort[0][id]=CVSS&sort[0][desc]=false');
-
-        cy.get(thSelector).should('have.class', '-sort-asc');
-        cy.get(tdSelector).then((items) => {
-            assertSortedItems(items, callbackForPairOfAscendingNumberValuesFromElements);
-        });
-
-        // 2. Sort descending by the column.
-        cy.get(thSelector).click(); // no request because initial response has been cached
-        cy.location('search').should('eq', '?sort[0][id]=CVSS&sort[0][desc]=true');
-
-        cy.get(thSelector).should('have.class', '-sort-desc');
-        // Do not assert because of potential timing problem: get td elements before table re-renders.
-    });
-
-    // Cluster (Platform) CVEs does not yet have Severity column.
-
-    it('should display vulnerability descriptions', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        visitVulnerabilityManagementEntities(entitiesKey);
-
-        // Balance positive and negative assertions.
-        cy.get(selectors.cveDescription).should('exist');
-        cy.get(`${selectors.cveDescription}:contains("No description available")`).should(
-            'not.exist'
-        );
-    });
-
-    // Argument 3 in verify functions is index of column which has the links.
-    // The one-based index includes checkbox, hidden, invisible.
-
-    it('should display links for clusters', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        verifySecondaryEntities(entitiesKey, 'clusters', 9);
-    });
-});
diff --git a/ui/apps/platform/cypress/integration/vulnmanagement/clusters.test.js b/ui/apps/platform/cypress/integration/vulnmanagement/clusters.test.js
index 42f2532f321f0..940951578ef06 100644
--- a/ui/apps/platform/cypress/integration/vulnmanagement/clusters.test.js
+++ b/ui/apps/platform/cypress/integration/vulnmanagement/clusters.test.js
@@ -1,4 +1,5 @@
 import withAuth from '../../helpers/basicAuth';
+import { hasFeatureFlag } from '../../helpers/features';
 import {
     assertSortedItems,
     callbackForPairOfAscendingNumberValuesFromElements,
@@ -25,7 +26,6 @@ describe('Vulnerability Management Clusters', () => {
             'Cluster',
             'Image CVEs',
             'Node CVEs',
-            'Platform CVEs',
             'K8S Version',
             'Entities',
             'Latest Violation',
@@ -37,7 +37,8 @@ describe('Vulnerability Management Clusters', () => {
         visitVulnerabilityManagementEntities(entitiesKey);
 
         const thSelector = '.rt-th:contains("Risk Priority")';
-        const tdSelector = '.rt-td:nth-child(9)';
+        const columnIndex = hasFeatureFlag('ROX_LEGACY_SCANNER') ? 9 : 8;
+        const tdSelector = `.rt-td:nth-child(${columnIndex})`;
 
         // 0. Initial table state indicates that the column is sorted ascending.
         cy.get(thSelector).should('have.class', '-sort-asc');
@@ -81,19 +82,18 @@ describe('Vulnerability Management Clusters', () => {
         verifyConditionalCVEs(entitiesKey, 'node-cves', 4, 'nodeVulnerabilityCounter');
     });
 
-    it('should display either links for cluster CVEs or text for No CVEs', () => {
-        verifyConditionalCVEs(entitiesKey, 'cluster-cves', 5, 'clusterVulnerabilityCounter');
-    });
-
     it('should display links for namespaces', () => {
-        verifySecondaryEntities(entitiesKey, 'namespaces', 7);
+        const columnIndex = hasFeatureFlag('ROX_LEGACY_SCANNER') ? 7 : 6;
+        verifySecondaryEntities(entitiesKey, 'namespaces', columnIndex);
     });
 
     it('should display links for deployments', () => {
-        verifySecondaryEntities(entitiesKey, 'deployments', 7);
+        const columnIndex = hasFeatureFlag('ROX_LEGACY_SCANNER') ? 7 : 6;
+        verifySecondaryEntities(entitiesKey, 'deployments', columnIndex);
     });
 
     it('should display links for nodes', () => {
-        verifySecondaryEntities(entitiesKey, 'nodes', 7);
+        const columnIndex = hasFeatureFlag('ROX_LEGACY_SCANNER') ? 7 : 6;
+        verifySecondaryEntities(entitiesKey, 'nodes', columnIndex);
     });
 });
diff --git a/ui/apps/platform/cypress/integration/vulnmanagement/dashboard.test.js b/ui/apps/platform/cypress/integration/vulnmanagement/dashboard.test.js
index 25ba8dde138df..bbd5ffe090629 100644
--- a/ui/apps/platform/cypress/integration/vulnmanagement/dashboard.test.js
+++ b/ui/apps/platform/cypress/integration/vulnmanagement/dashboard.test.js
@@ -56,10 +56,6 @@ describe('Vulnerability Management Dashboard', () => {
         verifyVulnerabilityManagementDashboardCVEs('node-cves', /^\d+ Node CVEs?$/);
     });
 
-    it('should navigate from menu item Cluster (Platform) CVEs to entities list', () => {
-        verifyVulnerabilityManagementDashboardCVEs('cluster-cves', /^\d+ Platform CVEs?$/);
-    });
-
     it('should navigate from images link to images list', () => {
         visitVulnerabilityManagementDashboard();
 
@@ -178,19 +174,6 @@ describe('Vulnerability Management Dashboard', () => {
         );
     });
 
-    it('should go to clusters list from View all link of Clusters with most orchestrator and Istio vulnerabilities', () => {
-        visitVulnerabilityManagementDashboard();
-
-        const entitiesKey = 'clusters';
-        const widgetHeading = 'Clusters with most orchestrator and Istio vulnerabilities';
-
-        interactAndWaitForVulnerabilityManagementEntities(() => {
-            cy.get(getViewAllSelectorForWidget(widgetHeading)).click();
-        }, entitiesKey);
-
-        cy.location('search').should('eq', '');
-    });
-
     it('should to to deployments list from View all link of Top risky deployments by CVE count and CVSS score', () => {
         visitVulnerabilityManagementDashboard();
 
diff --git a/ui/apps/platform/cypress/integration/vulnmanagement/dashboardToEntityPage.test.js b/ui/apps/platform/cypress/integration/vulnmanagement/dashboardToEntityPage.test.js
index 62f63dd834d57..f393560c3fef1 100644
--- a/ui/apps/platform/cypress/integration/vulnmanagement/dashboardToEntityPage.test.js
+++ b/ui/apps/platform/cypress/integration/vulnmanagement/dashboardToEntityPage.test.js
@@ -25,7 +25,6 @@ function getItemTextSelectorForWidget(widgetHeading, itemTextSelector) {
 
 const itemTextSelectorForNumberedList = '[data-testid="numbered-list-item-name"]';
 const itemTextSelectorForLabelText = '.rv-xy-plot__series--label text';
-const itemTextSelectorForClusters = 'li > div > div > a';
 
 function getHeaderTextFromItemTextWithColonSeparators(itemText) {
     const [, itemTextAfterNumberBeforeSlash] = /^\d+\.([^:]+):.*$/.exec(itemText);
@@ -136,17 +135,4 @@ describe('Vulnerability Management Dashboard', () => {
             getHeaderTextFromItemTextWithSlashSeparators
         );
     });
-
-    it('has item link to cluster single page from Clusters with most orchestrator and Istio vulnerabilities', () => {
-        visitVulnerabilityManagementDashboard();
-
-        const entitiesKey = 'clusters';
-        const widgetHeading = 'Clusters with most orchestrator and Istio vulnerabilities';
-
-        verifyItemLinkToEntityPage(
-            entitiesKey,
-            getItemTextSelectorForWidget(widgetHeading, itemTextSelectorForClusters),
-            (itemText) => itemText
-        );
-    });
 });
diff --git a/ui/apps/platform/cypress/integration/vulnmanagement/nodeCves.test.js b/ui/apps/platform/cypress/integration/vulnmanagement/nodeCves.test.js
index fe373a67fcfc9..3ceba3c6c9890 100644
--- a/ui/apps/platform/cypress/integration/vulnmanagement/nodeCves.test.js
+++ b/ui/apps/platform/cypress/integration/vulnmanagement/nodeCves.test.js
@@ -1,27 +1,29 @@
 import { selectors } from './VulnerabilityManagement.selectors';
 import withAuth from '../../helpers/basicAuth';
-import { hasOrchestratorFlavor } from '../../helpers/features';
 import {
-    assertSortedItems,
-    callbackForPairOfAscendingNumberValuesFromElements,
-    callbackForPairOfAscendingVulnerabilitySeverityValuesFromElements,
-    callbackForPairOfDescendingNumberValuesFromElements,
-    callbackForPairOfDescendingVulnerabilitySeverityValuesFromElements,
-} from '../../helpers/sort';
-import {
-    hasTableColumnHeadings,
-    interactAndWaitForVulnerabilityManagementEntities,
-    verifySecondaryEntities,
-    visitVulnerabilityManagementEntities,
-} from './VulnerabilityManagement.helpers';
-
-const entitiesKey = 'node-cves';
+    expectRequestedSort,
+    getRouteMatcherMapForGraphQL,
+    interceptAndWatchRequests,
+} from '../../helpers/request';
+import { visit } from '../../helpers/visit';
+import { hasTableColumnHeadings } from './VulnerabilityManagement.helpers';
+
+const nodeCvesFixturePath = 'vulnmanagement/nodeCves.json';
+
+function visitNodeCvesWithMockedData() {
+    const routeMatcherMap = getRouteMatcherMapForGraphQL(['searchOptions', 'getNodeCves']);
+    const staticResponseMap = {
+        getNodeCves: { fixture: nodeCvesFixturePath },
+    };
+    visit('/main/vulnerability-management/node-cves', routeMatcherMap, staticResponseMap);
+    cy.get('h1:contains("Node CVEs")');
+}
 
 describe('Vulnerability Management Node CVEs', () => {
     withAuth();
 
     it('should display table columns', () => {
-        visitVulnerabilityManagementEntities(entitiesKey);
+        visitNodeCvesWithMockedData();
 
         hasTableColumnHeadings([
             '', // checkbox
@@ -40,118 +42,56 @@ describe('Vulnerability Management Node CVEs', () => {
         ]);
     });
 
-    it('should sort the CVSS Score column', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        visitVulnerabilityManagementEntities(entitiesKey);
+    it('should sort the CVSS Score column', () => {
+        visitNodeCvesWithMockedData();
 
         const thSelector = '.rt-th:contains("CVSS Score")';
-        const tdSelector = '.rt-td:nth-child(7) [data-testid="label-chip"]';
-
-        // 0. Initial table state indicates that the column is sorted descending.
-        cy.get(thSelector).should('have.class', '-sort-desc');
-        cy.get(tdSelector).then((items) => {
-            assertSortedItems(items, callbackForPairOfDescendingNumberValuesFromElements);
-        });
-
-        // 1. Sort ascending by the column.
-        interactAndWaitForVulnerabilityManagementEntities(() => {
-            cy.get(thSelector).click();
-        }, entitiesKey);
-        cy.location('search').should('eq', '?sort[0][id]=CVSS&sort[0][desc]=false');
-
-        cy.get(thSelector).should('have.class', '-sort-asc');
-        cy.get(tdSelector).then((items) => {
-            assertSortedItems(items, callbackForPairOfAscendingNumberValuesFromElements);
-        });
-
-        // 2. Sort descending by the column.
-        cy.get(thSelector).click(); // no request because initial response has been cached
-        cy.location('search').should('eq', '?sort[0][id]=CVSS&sort[0][desc]=true');
 
         cy.get(thSelector).should('have.class', '-sort-desc');
-        // Do not assert because of potential timing problem: get td elements before table re-renders.
-    });
 
-    // TODO Investigate whether not yet supported or incorrect field in payload.
-    it.skip('should sort the Severity column', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
-
-        visitVulnerabilityManagementEntities(entitiesKey);
-
-        const thSelector = '.rt-th:contains("Severity")';
-        const tdSelector = '.rt-td:nth-child(6)';
-
-        // 0. Initial table state indicates that the column is not sorted.
-        cy.get(thSelector)
-            .should('not.have.class', '-sort-asc')
-            .should('not.have.class', '-sort-desc');
-
-        // 1. Sort ascending by the column.
-        interactAndWaitForVulnerabilityManagementEntities(() => {
-            cy.get(thSelector).click();
-        }, entitiesKey);
-        cy.location('search').should('eq', '?sort[0][id]=Severity&sort[0][desc]=false');
-
-        cy.get(thSelector).should('have.class', '-sort-asc');
-        cy.get(tdSelector).then((items) => {
-            assertSortedItems(
-                items,
-                callbackForPairOfAscendingVulnerabilitySeverityValuesFromElements
-            );
-        });
-
-        // 2. Sort descending by the column.
-        interactAndWaitForVulnerabilityManagementEntities(() => {
-            cy.get(thSelector).click();
-        }, entitiesKey);
-        cy.location('search').should('eq', '?sort[0][id]=Severity&sort[0][desc]=true');
+        const routeMatcherMap = getRouteMatcherMapForGraphQL(['getNodeCves']);
+        const staticResponseMap = {
+            getNodeCves: { fixture: nodeCvesFixturePath },
+        };
+        interceptAndWatchRequests(routeMatcherMap, staticResponseMap).then(
+            ({ waitAndYieldRequestBodyVariables }) => {
+                cy.get(thSelector).click();
+                cy.location('search').should('eq', '?sort[0][id]=CVSS&sort[0][desc]=false');
+                cy.get(thSelector).should('have.class', '-sort-asc');
+
+                waitAndYieldRequestBodyVariables().then(
+                    expectRequestedSort({ field: 'CVSS', reversed: false })
+                );
+            }
+        );
 
+        cy.get(thSelector).click();
+        cy.location('search').should('eq', '?sort[0][id]=CVSS&sort[0][desc]=true');
         cy.get(thSelector).should('have.class', '-sort-desc');
-        cy.get(tdSelector).then((items) => {
-            assertSortedItems(
-                items,
-                callbackForPairOfDescendingVulnerabilitySeverityValuesFromElements
-            );
-        });
     });
 
-    it('should display vulnerability descriptions', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
+    it('should display vulnerability descriptions', () => {
+        visitNodeCvesWithMockedData();
 
-        visitVulnerabilityManagementEntities(entitiesKey);
-
-        // Balance positive and negative assertions.
         cy.get(selectors.cveDescription).should('exist');
         cy.get(`${selectors.cveDescription}:contains("No description available")`).should(
             'not.exist'
         );
     });
 
-    // Argument 3 in verify functions is index of column which has the links.
-    // The one-based index includes checkbox, hidden, invisible.
-
-    // Some tests might fail in local deployment.
-
-    it('should display links for nodes', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
+    it('should display links for nodes', () => {
+        visitNodeCvesWithMockedData();
 
-        verifySecondaryEntities(entitiesKey, 'nodes', 10);
+        cy.get('.rt-tbody .rt-td')
+            .contains('a', /^\d+ nodes?$/)
+            .should('exist');
     });
 
-    it('should display links for node-components', function () {
-        if (hasOrchestratorFlavor('openshift')) {
-            this.skip();
-        }
+    it('should display links for node-components', () => {
+        visitNodeCvesWithMockedData();
 
-        verifySecondaryEntities(entitiesKey, 'node-components', 10);
+        cy.get('.rt-tbody .rt-td')
+            .contains('a', /^\d+ node components?$/)
+            .should('exist');
     });
 });
diff --git a/ui/apps/platform/cypress/support/commands.js b/ui/apps/platform/cypress/support/commands.js
index 7a744a01b2f2c..59ebccb397525 100644
--- a/ui/apps/platform/cypress/support/commands.js
+++ b/ui/apps/platform/cypress/support/commands.js
@@ -16,7 +16,7 @@ Cypress.Commands.add('checkAccessibility', (context = null) => {
     // inject axe only if it hasn't been injected yet
     cy.window().then((win) => {
         if (!win.axe) {
-            cy.injectAxe({ axeCorePath: Cypress.env('AXE_CORE_PATH') });
+            cy.injectAxe({ axeCorePath: Cypress.expose('AXE_CORE_PATH') });
         }
     });
 
diff --git a/ui/apps/platform/eslint-plugins/pluginLimited.js b/ui/apps/platform/eslint-plugins/pluginLimited.js
index f5697047dcc81..031212372b678 100644
--- a/ui/apps/platform/eslint-plugins/pluginLimited.js
+++ b/ui/apps/platform/eslint-plugins/pluginLimited.js
@@ -379,6 +379,38 @@ const rules = {
             };
         },
     },
+    'no-import-from-Containers-in-Components': {
+        // Prevent soft circular dependency:
+        // * A generic file in Components has import from a specific file in Containers.
+        // * Another specific file in Containers might have import of that generic file from Components.
+        //   Although the rule cannot know for sure, Components exists for import into Containers.
+        meta: {
+            type: 'problem',
+            docs: {
+                description:
+                    'Fix soft circular dependency between specific Containers and generic Components',
+            },
+            schema: [],
+        },
+        create(context) {
+            return {
+                ImportDeclaration(node) {
+                    const { filename } = context;
+                    if (
+                        filename.includes('ui/apps/platform/src/Components/') &&
+                        typeof node.source?.value === 'string' &&
+                        node.source.value.startsWith('Containers/')
+                    ) {
+                        context.report({
+                            node,
+                            message:
+                                'Fix soft circular dependency between specific Containers and generic Components',
+                        });
+                    }
+                },
+            };
+        },
+    },
     'no-logical-or-preceding-array-or-object': {
         // Consistently write more precise nullish coalescing operator.
         meta: {
diff --git a/ui/apps/platform/eslint-plugins/pluginPatternFly.js b/ui/apps/platform/eslint-plugins/pluginPatternFly.js
index 38edad0b83686..90a28cf80bb67 100644
--- a/ui/apps/platform/eslint-plugins/pluginPatternFly.js
+++ b/ui/apps/platform/eslint-plugins/pluginPatternFly.js
@@ -46,6 +46,145 @@ const rules = {
             };
         },
     },
+    'PageSection-type-breadcrumb': {
+        // Require that PageSection element has type="breadcrumb" prop if Breadcrumb is a child.
+        meta: {
+            type: 'problem',
+            docs: {
+                description:
+                    'Require that PageSection element has type="breadcrumb" prop if Breadcrumb is a child.',
+            },
+            schema: [],
+        },
+        create(context) {
+            return {
+                JSXOpeningElement(node) {
+                    if (
+                        node.name?.name === 'PageSection' &&
+                        !node.attributes.some(
+                            (attribute) =>
+                                attribute.name?.name === 'type' &&
+                                attribute.value?.value === 'breadcrumb'
+                        )
+                    ) {
+                        const ancestors = context.sourceCode.getAncestors(node);
+                        if (
+                            ancestors.length > 0 &&
+                            Array.isArray(ancestors[ancestors.length - 1].children) &&
+                            ancestors[ancestors.length - 1].children.some(
+                                (child) => child.openingElement?.name?.name === 'Breadcrumb'
+                            )
+                        ) {
+                            context.report({
+                                node,
+                                message:
+                                    'PageSection element needs type="breadcrumb" prop if Breadcrumb is a child',
+                            });
+                        }
+                    }
+                },
+            };
+        },
+    },
+    'PageSection-type-tabs': {
+        // Require that PageSection element has type="tabs" prop if Tabs is a child.
+        meta: {
+            type: 'problem',
+            docs: {
+                description:
+                    'Require that PageSection element has type="tabs" prop if Tabs is a child.',
+            },
+            schema: [],
+        },
+        create(context) {
+            return {
+                JSXOpeningElement(node) {
+                    if (
+                        node.name?.name === 'PageSection' &&
+                        !node.attributes.some(
+                            (attribute) =>
+                                attribute.name?.name === 'type' && attribute.value?.value === 'tabs'
+                        )
+                    ) {
+                        const ancestors = context.sourceCode.getAncestors(node);
+                        if (
+                            ancestors.length > 0 &&
+                            Array.isArray(ancestors[ancestors.length - 1].children) &&
+                            ancestors[ancestors.length - 1].children.some(
+                                (child) => child.openingElement?.name?.name === 'Tabs'
+                            )
+                        ) {
+                            context.report({
+                                node,
+                                message:
+                                    'PageSection element needs type="tabs" prop if Tabs is a child',
+                            });
+                        }
+                    }
+                },
+            };
+        },
+    },
+    'PageSection-type-wizard': {
+        // Require that PageSection element has type="wizard" prop if Wizard is a child.
+        meta: {
+            type: 'problem',
+            docs: {
+                description:
+                    'Require that PageSection element has type="wizard" prop if Wizard is a child.',
+            },
+            schema: [],
+        },
+        create(context) {
+            return {
+                JSXOpeningElement(node) {
+                    if (
+                        node.name?.name === 'PageSection' &&
+                        !node.attributes.some(
+                            (attribute) =>
+                                attribute.name?.name === 'type' &&
+                                attribute.value?.value === 'wizard'
+                        )
+                    ) {
+                        const ancestors = context.sourceCode.getAncestors(node);
+                        if (
+                            ancestors.length > 0 &&
+                            Array.isArray(ancestors[ancestors.length - 1].children) &&
+                            ancestors[ancestors.length - 1].children.some(
+                                (child) => child.openingElement?.name?.name === 'Wizard'
+                            )
+                        ) {
+                            context.report({
+                                node,
+                                message:
+                                    'PageSection element needs type="wizard" prop if Wizard is a child',
+                            });
+                        } else if (
+                            ancestors.length > 1 &&
+                            Array.isArray(ancestors[ancestors.length - 1].children)
+                        ) {
+                            const childFound = ancestors[ancestors.length - 1].children.find(
+                                (child) => child.openingElement?.name?.name === 'FormikProvider'
+                            );
+                            if (
+                                childFound &&
+                                Array.isArray(childFound.children) &&
+                                childFound.children.some(
+                                    (child) => child.openingElement?.name?.name === 'Wizard'
+                                )
+                            ) {
+                                context.report({
+                                    node,
+                                    message:
+                                        'PageSection element needs type="wizard" prop if Wizard is a descendant',
+                                });
+                            }
+                        }
+                    }
+                },
+            };
+        },
+    },
     'Td-dataLabel-Th-text': {
         // Require that if Td element has dataLabel prop with string value,
         // then Th element with same index has corresponding text (or screenReaderText).
diff --git a/ui/apps/platform/eslint.config.js b/ui/apps/platform/eslint.config.js
index a93beaaf797a9..1f61d3908f56e 100644
--- a/ui/apps/platform/eslint.config.js
+++ b/ui/apps/platform/eslint.config.js
@@ -788,7 +788,6 @@ module.exports = [
     },
     {
         files: ['src/*/**/*.{jsx,ts,tsx}'], // product files, except for unit tests (including test-utils folder)
-        ignores: ['src/Containers/Compliance/**'],
 
         // languageOptions from previous configuration object
 
@@ -797,14 +796,13 @@ module.exports = [
             limited: pluginLimited,
         },
         rules: {
-            'import/no-cycle': ['error', { maxDepth: '∞' }], // classic compliance has 7 errors
+            'import/no-cycle': ['error', { maxDepth: '∞' }],
             'limited/react-export-default': 'error',
         },
     },
     {
         files: ['**/*.{js,jsx,ts,tsx}'], // generic configuration includes cypress and src folders
         ignores: [
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/VulnMgmt/**', // deprecated
         ],
 
@@ -823,7 +821,6 @@ module.exports = [
     {
         files: ['src/*/**/*.{js,jsx,ts,tsx}'],
         ignores: [
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/VulnMgmt/**', // deprecated
             'src/Containers/Workflow/**', // deprecated
         ],
@@ -839,13 +836,36 @@ module.exports = [
             'limited/no-relative-path-to-src-in-import': 'error',
         },
     },
+    {
+        files: ['src/*/**/*.{js,jsx,ts,tsx}'],
+        ignores: [
+            'src/Components/CompoundSearchFilter/attributes/imageCVE.ts', // refactor: originDisplayNames
+            'src/Components/CompoundSearchFilter/attributes/imageComponent.ts', // refactor: sourceTypeLabels, sourceTypes
+            'src/Components/CompoundSearchFilter/attributes/virtualMachine.ts', // refactor: sourceTypeLabels, sourceTypes
+            'src/Components/EmailNotifier/EmailNotifierForm.tsx', // refactor
+            'src/Components/EmailNotifier/EmailNotifierModal.tsx', // refactor
+            'src/Components/RelatedEntity.jsx', // deprecated
+            'src/Components/RelatedEntityListCount.jsx', // deprecated
+            'src/Components/URLSearchInputWithAutocomplete.jsx', // deprecated
+            'src/Components/workflow/EntitiesMenu/EntitiesMenu.jsx', // deprecated
+        ],
+
+        // languageOptions from previous configuration object
+
+        // Key of plugin is namespace of its rules.
+        plugins: {
+            limited: pluginLimited,
+        },
+        rules: {
+            'limited/no-import-from-Containers-in-Components': 'error',
+        },
+    },
     {
         files: ['src/*/**/*.{js,jsx,ts,tsx}'],
         ignores: [
             'src/Components/GroupedTabs.jsx', // deprecated
             'src/Components/ReactSelect/ReactSelect.jsx', // deprecated
             'src/Components/URLSearchInputWithAutocomplete.jsx', // deprecated
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/VulnMgmt/**', // deprecated
             'src/sagas/authSagas.js', // deprecated
             'src/sagas/groupSagas.js', // deprecated
@@ -913,8 +933,6 @@ module.exports = [
             'src/Components/visuals/**', // deprecated
             'src/Components/workflow/**', // deprecated
 
-            'src/Containers/Clusters/**', // fix errors, and then delete; also in tailwind.config.js file
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/ConfigManagement/**',
             'src/Containers/Images/**', // deprecated
             'src/Containers/Login/**', // rewrite in PatternFly, and then delete; also in tailwind.config.js file
@@ -940,7 +958,6 @@ module.exports = [
         ignores: [
             'cypress/constants/**',
             'cypress/integration/clusters/**', // delete obsolete tests
-            'cypress/integration/compliance/**', // deprecated
             'cypress/integration/configmanagement/**', // deprecated/modernized
             'cypress/integration/integrations/**', // replace
             'cypress/integration/networkGraph/**', // replace
@@ -951,7 +968,6 @@ module.exports = [
             'src/Components/**', // replace non-deprecated
             'src/Containers/AccessControl/**', // replace
             'src/Containers/Clusters/**', // delete obsolete tests
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/ConfigManagement/**', // deprecated/modernized
             'src/Containers/Integrations/**', // replace
             'src/Containers/Login/**', // replace
@@ -991,7 +1007,6 @@ module.exports = [
             'src/Components/Tabs.jsx', // deprecated
             'src/Components/visuals/Sunburst.jsx', // deprecated
             'src/Components/visuals/SunburstDetailSection.jsx', // deprecated
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/Login/LoginPage.jsx', // rewrite
             'src/Containers/MainPage/asyncComponent.tsx', // replace
             'src/Containers/Risk/KeyValuePairs.jsx', // rewrite?
@@ -1014,7 +1029,6 @@ module.exports = [
             'src/**/*.test.jsx', // unit test
             'src/**/*.cy.jsx', // component test
             'src/Components/**', // research
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/ConfigManagement/**', // deferred
             'src/Containers/Images/**', // deprecated
             'src/Containers/Login/LoginPage.jsx', // rewrite pending PatternFly 6
@@ -1103,7 +1117,6 @@ module.exports = [
             'src/Components/**', // most or all deprecated
             'src/constants/entityPageProps.js', // deprecated
             'src/constants/reduxFormPropTypes.js', // deprecated
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/ConfigManagement/**', // deprecated
             'src/Containers/Images/**', // deprecated
             'src/Containers/Login/LoginPage.jsx', // rewrite in TypeScript
@@ -1137,7 +1150,6 @@ module.exports = [
             'src/Containers/AccessControl/AuthProviders/AuthProviders.tsx', // replace
             'src/Containers/AccessControl/AuthProviders/AuthProvidersList.tsx', // replace
             'src/Containers/Clusters/DownloadHelmValues.tsx', // replace
-            'src/Containers/Compliance/**', // deprecated
             'src/Containers/Login/LoginPage.jsx', // replace
             'src/Containers/Login/TestLoginResultsPage.jsx', // replace
             'src/Containers/MainPage/AcsFeedbackModal.tsx', // replace
diff --git a/ui/apps/platform/package-lock.json b/ui/apps/platform/package-lock.json
index caf91135eb628..b46d16429e0c9 100644
--- a/ui/apps/platform/package-lock.json
+++ b/ui/apps/platform/package-lock.json
@@ -21,7 +21,6 @@
                 "@patternfly/react-styles": "^6.4.0",
                 "@patternfly/react-table": "^6.4.1",
                 "@patternfly/react-topology": "^6.4.0",
-                "@patternfly/react-user-feedback": "^6.2.0",
                 "@segment/analytics-next": "^1.81.1",
                 "axios": "^1.18.0",
                 "connected-react-router": "^6.9.3",
@@ -47,7 +46,7 @@
                 "object-resolve-path": "^1.1.1",
                 "pluralize": "^8.0.0",
                 "prop-types": "^15.7.2",
-                "qs": "^6.15.2",
+                "qs": "^6.16.0",
                 "raven-for-redux": "^1.3.1",
                 "raven-js": "^3.27.0",
                 "react": "^18.2.0",
@@ -1550,13 +1549,6 @@
                 "url": "https://opencollective.com/eslint"
             }
         },
-        "node_modules/@eslint/eslintrc/node_modules/argparse": {
-            "version": "2.0.1",
-            "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-            "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-            "dev": true,
-            "license": "Python-2.0"
-        },
         "node_modules/@eslint/eslintrc/node_modules/globals": {
             "version": "14.0.0",
             "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
@@ -1570,19 +1562,6 @@
                 "url": "https://github.com/sponsors/sindresorhus"
             }
         },
-        "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
-            "version": "4.1.0",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-            "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "argparse": "^2.0.1"
-            },
-            "bin": {
-                "js-yaml": "bin/js-yaml.js"
-            }
-        },
         "node_modules/@eslint/js": {
             "version": "9.39.3",
             "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.3.tgz",
@@ -2170,9 +2149,9 @@
             }
         },
         "node_modules/@openshift-console/dynamic-plugin-sdk/node_modules/immutable": {
-            "version": "3.8.3",
-            "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.3.tgz",
-            "integrity": "sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==",
+            "version": "3.8.4",
+            "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.4.tgz",
+            "integrity": "sha512-ZQv17KolYrYmsDoDB8N67zhIKsNi9mGYlk96y/yuxyAqJB2hLzSGSM7k/sB0/ZvO4kx27U9+fBeD/XlLGh/uXQ==",
             "license": "MIT",
             "engines": {
                 "node": ">=0.10.0"
@@ -2474,20 +2453,6 @@
                 "react-dom": "^17 || ^18 || ^19"
             }
         },
-        "node_modules/@patternfly/react-user-feedback": {
-            "version": "6.2.0",
-            "resolved": "https://registry.npmjs.org/@patternfly/react-user-feedback/-/react-user-feedback-6.2.0.tgz",
-            "integrity": "sha512-grhaZQwcESNZD2ifpbPoodCJ/NRTt4B24jVNYgDi23EVvQ0oGpyIXAvbUhX3siSkLjdqdYLsY9o5wNRJM78VkA==",
-            "license": "MIT",
-            "dependencies": {
-                "@patternfly/react-core": "^6.0.0",
-                "@patternfly/react-icons": "^6.0.0"
-            },
-            "peerDependencies": {
-                "react": "^17 || ^18 || ^19",
-                "react-dom": "^17 || ^18 || ^19"
-            }
-        },
         "node_modules/@peculiar/asn1-cms": {
             "version": "2.7.0",
             "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.7.0.tgz",
@@ -2737,12 +2702,6 @@
                 "node": ">= 14"
             }
         },
-        "node_modules/@redocly/openapi-core/node_modules/argparse": {
-            "version": "2.0.1",
-            "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-            "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-            "license": "Python-2.0"
-        },
         "node_modules/@redocly/openapi-core/node_modules/brace-expansion": {
             "version": "2.1.4",
             "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
@@ -2765,18 +2724,6 @@
                 "node": ">= 14"
             }
         },
-        "node_modules/@redocly/openapi-core/node_modules/js-yaml": {
-            "version": "4.1.0",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-            "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
-            "license": "MIT",
-            "dependencies": {
-                "argparse": "^2.0.1"
-            },
-            "bin": {
-                "js-yaml": "bin/js-yaml.js"
-            }
-        },
         "node_modules/@redocly/openapi-core/node_modules/minimatch": {
             "version": "5.1.8",
             "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.8.tgz",
@@ -5330,6 +5277,12 @@
                 }
             ]
         },
+        "node_modules/argparse": {
+            "version": "2.0.1",
+            "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+            "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+            "license": "Python-2.0"
+        },
         "node_modules/aria-query": {
             "version": "5.3.0",
             "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
@@ -8121,9 +8074,9 @@
             }
         },
         "node_modules/dompurify": {
-            "version": "3.4.8",
-            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.8.tgz",
-            "integrity": "sha512-yb1cEmaOum7wFvOCSQxyfgVlv5D47Rc30iZWoMpbDIWTnJ6grDDQyu2KFJzB2k7u0pMuJcQ1zphH//fFnw2tjQ==",
+            "version": "3.4.13",
+            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz",
+            "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
             "license": "(MPL-2.0 OR Apache-2.0)",
             "optionalDependencies": {
                 "@types/trusted-types": "^2.0.7"
@@ -10636,9 +10589,9 @@
             }
         },
         "node_modules/immutable": {
-            "version": "4.3.8",
-            "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.8.tgz",
-            "integrity": "sha512-d/Ld9aLbKpNwyl0KiM2CT1WYvkitQ1TSvmRtkcV8FKStiDoA7Slzgjmb/1G2yhKM1p0XeNOieaTbFZmU1d3Xuw==",
+            "version": "4.3.9",
+            "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.9.tgz",
+            "integrity": "sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==",
             "license": "MIT",
             "optional": true
         },
@@ -11609,6 +11562,28 @@
             "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
             "integrity": "sha1-GSA/tZmR35jjoocFDUZHzerzJJk= sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="
         },
+        "node_modules/js-yaml": {
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+            "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/puzrin"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodeca"
+                }
+            ],
+            "license": "MIT",
+            "dependencies": {
+                "argparse": "^2.0.1"
+            },
+            "bin": {
+                "js-yaml": "bin/js-yaml.js"
+            }
+        },
         "node_modules/jsbn": {
             "version": "0.1.1",
             "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz",
@@ -13683,13 +13658,6 @@
                 "mocha": ">=3.1.2"
             }
         },
-        "node_modules/mocha/node_modules/argparse": {
-            "version": "2.0.1",
-            "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-            "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-            "dev": true,
-            "peer": true
-        },
         "node_modules/mocha/node_modules/brace-expansion": {
             "version": "2.1.4",
             "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
@@ -13747,19 +13715,6 @@
                 "url": "https://github.com/sponsors/isaacs"
             }
         },
-        "node_modules/mocha/node_modules/js-yaml": {
-            "version": "4.1.0",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-            "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
-            "dev": true,
-            "peer": true,
-            "dependencies": {
-                "argparse": "^2.0.1"
-            },
-            "bin": {
-                "js-yaml": "bin/js-yaml.js"
-            }
-        },
         "node_modules/mocha/node_modules/minimatch": {
             "version": "5.1.8",
             "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.8.tgz",
@@ -15418,12 +15373,13 @@
             }
         },
         "node_modules/qs": {
-            "version": "6.15.2",
-            "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-            "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+            "version": "6.16.0",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+            "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
             "license": "BSD-3-Clause",
             "dependencies": {
-                "side-channel": "^1.1.0"
+                "es-define-property": "^1.0.1",
+                "side-channel": "^1.1.1"
             },
             "engines": {
                 "node": ">=0.6"
@@ -17290,14 +17246,14 @@
             "integrity": "sha1-+w1xM49TKjoUkhNjni0yy+qLyyg= sha512-oXF8tfxx5cDk8r2kYqlkUJzZpDBqVY/II2WhvU0n9Y3XYvAYRmeaf1PvvIvTgPnv4KJ+ES5M0PyDq5Jp+Ygy2g=="
         },
         "node_modules/side-channel": {
-            "version": "1.1.0",
-            "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-            "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+            "version": "1.1.1",
+            "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+            "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
             "license": "MIT",
             "dependencies": {
                 "es-errors": "^1.3.0",
-                "object-inspect": "^1.13.3",
-                "side-channel-list": "^1.0.0",
+                "object-inspect": "^1.13.4",
+                "side-channel-list": "^1.0.1",
                 "side-channel-map": "^1.0.1",
                 "side-channel-weakmap": "^1.0.2"
             },
@@ -17309,13 +17265,13 @@
             }
         },
         "node_modules/side-channel-list": {
-            "version": "1.0.0",
-            "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-            "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+            "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
             "license": "MIT",
             "dependencies": {
                 "es-errors": "^1.3.0",
-                "object-inspect": "^1.13.3"
+                "object-inspect": "^1.13.4"
             },
             "engines": {
                 "node": ">= 0.4"
@@ -19930,13 +19886,6 @@
                 "@svgr/core": "*"
             }
         },
-        "node_modules/vite-plugin-svgr/node_modules/argparse": {
-            "version": "2.0.1",
-            "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-            "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-            "dev": true,
-            "license": "Python-2.0"
-        },
         "node_modules/vite-plugin-svgr/node_modules/cosmiconfig": {
             "version": "8.3.6",
             "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-8.3.6.tgz",
@@ -19984,19 +19933,6 @@
             "dev": true,
             "license": "MIT"
         },
-        "node_modules/vite-plugin-svgr/node_modules/js-yaml": {
-            "version": "4.1.0",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-            "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "argparse": "^2.0.1"
-            },
-            "bin": {
-                "js-yaml": "bin/js-yaml.js"
-            }
-        },
         "node_modules/vite-plugin-svgr/node_modules/picomatch": {
             "version": "4.0.2",
             "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
diff --git a/ui/apps/platform/package.json b/ui/apps/platform/package.json
index 744d0c0545f98..00001ee218471 100644
--- a/ui/apps/platform/package.json
+++ b/ui/apps/platform/package.json
@@ -24,7 +24,6 @@
         "@patternfly/react-styles": "^6.4.0",
         "@patternfly/react-table": "^6.4.1",
         "@patternfly/react-topology": "^6.4.0",
-        "@patternfly/react-user-feedback": "^6.2.0",
         "@segment/analytics-next": "^1.81.1",
         "axios": "^1.18.0",
         "connected-react-router": "^6.9.3",
@@ -50,7 +49,7 @@
         "object-resolve-path": "^1.1.1",
         "pluralize": "^8.0.0",
         "prop-types": "^15.7.2",
-        "qs": "^6.15.2",
+        "qs": "^6.16.0",
         "raven-for-redux": "^1.3.1",
         "raven-js": "^3.27.0",
         "react": "^18.2.0",
@@ -200,7 +199,8 @@
         "connected-react-router": {
             "react": "^18.0.0"
         },
-        "react-dropzone": "14.3.2"
+        "react-dropzone": "14.3.2",
+        "js-yaml": "^4.3.2"
     },
     "browserslist": [
         "Chrome >= 80"
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageCVE.ts b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageCVE.ts
index e3c9a1a967df8..b37c0e88a79ce 100644
--- a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageCVE.ts
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageCVE.ts
@@ -1,5 +1,7 @@
 // If you're adding a new attribute, make sure to add it to "imageCVEAttributes" as well
 
+import { originDisplayNames } from 'Containers/Vulnerabilities/utils/vulnerabilityUtils';
+
 import type { CompoundSearchFilterAttribute } from '../types';
 import { EPSSProbability } from './epssProbability';
 
@@ -27,29 +29,50 @@ export const CVSS: CompoundSearchFilterAttribute = {
 export const KnownExploit: CompoundSearchFilterAttribute = {
     displayName: 'Known exploit',
     filterChipLabel: 'Known exploit',
-    searchTerm: 'Known Exploit', // and 'Known Ransonware Campaign' as category2
+    searchTerm: 'CISA KEV', // and 'Known Ransomware Campaign' as category2
     inputType: 'select-exclusive-double',
     inputProps: {
-        category2: 'Known Ransonware Campaign',
+        category2: 'Known Ransomware Campaign',
         options: [
             {
                 label: 'Has a known exploit',
-                category: 'Known Exploit',
+                category: 'CISA KEV',
                 value: 'true',
             },
             {
                 label: 'Used in ransomware campaigns',
-                category: 'Known Ransonware Campaign',
+                category: 'Known Ransomware Campaign',
                 value: 'true',
             },
             {
                 label: 'No known exploit',
-                category: 'Known Exploit',
+                category: 'CISA KEV',
                 value: 'false',
             },
         ],
     },
-    featureFlagDependency: ['ROX_SCANNER_V4', 'ROX_CISA_KEV'],
+    featureFlagDependency: ['ROX_SCANNER_V4'],
+};
+
+// The filter value is the VulnOrigin enum name (e.g. VULN_ORIGIN_RED_HAT), which the
+// backend enum search matches by case-insensitive prefix. The human-readable label
+// would not match, so value must be the enum key, not the display name.
+//
+// Intentionally NOT part of imageCVEAttributes: the CVE origin filter is only shown on
+// the single image page, single deployment page, and image vulnerability reports, which
+// append it to their own configs.
+export const Origin: CompoundSearchFilterAttribute = {
+    displayName: 'Origin',
+    filterChipLabel: 'CVE origin',
+    searchTerm: 'CVE Origin',
+    inputType: 'select',
+    inputProps: {
+        options: Object.entries(originDisplayNames).map(([value, label]) => ({
+            value,
+            label: label ?? value,
+        })),
+    },
+    featureFlagDependency: ['ROX_SCANNER_V4'],
 };
 
 export const imageCVEAttributes = [CVSS, DiscoveredTime, EPSSProbability, KnownExploit, Name];
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageComponent.ts b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageComponent.ts
index e4556f1ca8ea4..72e9c5fbeb2a2 100644
--- a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageComponent.ts
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/imageComponent.ts
@@ -35,7 +35,6 @@ export const LayerType: CompoundSearchFilterAttribute = {
     filterChipLabel: 'Image component layer type',
     searchTerm: 'Component Layer Type',
     inputType: 'select',
-    featureFlagDependency: ['ROX_BASE_IMAGE_DETECTION'],
     inputProps: {
         options: [
             { label: 'Application', value: 'APPLICATION' },
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/nodeCVE.ts b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/nodeCVE.ts
index 4c01db84b81f6..089c86950eefb 100644
--- a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/nodeCVE.ts
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/nodeCVE.ts
@@ -18,7 +18,7 @@ export const DiscoveredTime: CompoundSearchFilterAttribute = {
 
 export const CVSS: CompoundSearchFilterAttribute = {
     displayName: 'CVSS',
-    filterChipLabel: 'CVE CVSS',
+    filterChipLabel: 'CVSS',
     searchTerm: 'CVSS',
     inputType: 'condition-number',
 };
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/platformCVE.ts b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/platformCVE.ts
index 3fe885ed1e870..e71333f8dba9e 100644
--- a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/platformCVE.ts
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/platformCVE.ts
@@ -18,7 +18,7 @@ export const DiscoveredTime: CompoundSearchFilterAttribute = {
 
 export const CVSS: CompoundSearchFilterAttribute = {
     displayName: 'CVSS',
-    filterChipLabel: 'CVE CVSS',
+    filterChipLabel: 'CVSS',
     searchTerm: 'CVSS',
     inputType: 'condition-number',
 };
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/virtualMachine.ts b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/virtualMachine.ts
index fb9fb5d41c24b..92d5f5023642c 100644
--- a/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/virtualMachine.ts
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/attributes/virtualMachine.ts
@@ -42,9 +42,49 @@ export const VirtualMachineID: CompoundSearchFilterAttribute = {
     inputType: 'text',
 };
 
+export const VirtualMachineGuestOs: CompoundSearchFilterAttribute = {
+    displayName: 'Guest OS',
+    filterChipLabel: 'Virtual machine guest OS',
+    searchTerm: 'Guest OS',
+    inputType: 'text',
+};
+
 export const VirtualMachineName: CompoundSearchFilterAttribute = {
     displayName: 'Name',
     filterChipLabel: 'Virtual machine name',
     searchTerm: 'Virtual Machine Name',
     inputType: 'text',
 };
+
+export const VirtualMachineScanTime: CompoundSearchFilterAttribute = {
+    displayName: 'Scan time',
+    filterChipLabel: 'Virtual machine scan time',
+    searchTerm: 'Virtual Machine Scan Time',
+    inputType: 'date-picker',
+};
+
+export const VirtualMachineCVECvss: CompoundSearchFilterAttribute = {
+    displayName: 'CVSS',
+    filterChipLabel: 'CVE CVSS',
+    searchTerm: 'CVSS',
+    inputType: 'condition-number',
+};
+
+export const VirtualMachineCVEDiscoveredTime: CompoundSearchFilterAttribute = {
+    displayName: 'Discovered time',
+    filterChipLabel: 'CVE discovered time',
+    searchTerm: 'CVE Created Time',
+    inputType: 'date-picker',
+};
+
+export const virtualMachineAttributes = [
+    VirtualMachineCVECvss,
+    VirtualMachineCVEDiscoveredTime,
+    VirtualMachineCVEName,
+    VirtualMachineComponentName,
+    VirtualMachineComponentVersion,
+    VirtualMachineGuestOs,
+    VirtualMachineID,
+    VirtualMachineName,
+    VirtualMachineScanTime,
+];
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/components/CompoundSearchFilterInputField.tsx b/ui/apps/platform/src/Components/CompoundSearchFilter/components/CompoundSearchFilterInputField.tsx
index a803b5e75a710..919f4922859e0 100644
--- a/ui/apps/platform/src/Components/CompoundSearchFilter/components/CompoundSearchFilterInputField.tsx
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/components/CompoundSearchFilterInputField.tsx
@@ -6,13 +6,11 @@ import type {
     CompoundSearchFilterEntity,
     OnSearchCallback,
 } from '../types';
+import CompoundSearchFilterSelectInputField from './CompoundSearchFilterSelectInputField';
 import SearchFilterConditionDate from './SearchFilterConditionDate';
 import SearchFilterConditionNumber from './SearchFilterConditionNumber';
 import SearchFilterConditionText from './SearchFilterConditionText';
 import SearchFilterAutocompleteSelect from './SearchFilterAutocompleteSelect';
-import SearchFilterSelectExclusiveDouble from './SearchFilterSelectExclusiveDouble';
-import SearchFilterSelectExclusiveSingle from './SearchFilterSelectExclusiveSingle';
-import SearchFilterSelectInclusive from './SearchFilterSelectInclusive';
 import SearchFilterText from './SearchFilterText';
 
 export type CompoundSearchFilterInputFieldProps = {
@@ -78,26 +76,10 @@ function CompoundSearchFilterInputField({
                 />
             );
         case 'select-exclusive-double':
-            return (
-                <SearchFilterSelectExclusiveDouble
-                    attribute={attribute}
-                    isDisabled={isDisabled}
-                    onSearch={onSearch}
-                    searchFilter={searchFilter}
-                />
-            );
         case 'select-exclusive-single':
-            return (
-                <SearchFilterSelectExclusiveSingle
-                    attribute={attribute}
-                    isDisabled={isDisabled}
-                    onSearch={onSearch}
-                    searchFilter={searchFilter}
-                />
-            );
         case 'select':
             return (
-                <SearchFilterSelectInclusive
+                <CompoundSearchFilterSelectInputField
                     attribute={attribute}
                     isDisabled={isDisabled}
                     onSearch={onSearch}
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/components/CompoundSearchFilterSelectInputField.tsx b/ui/apps/platform/src/Components/CompoundSearchFilter/components/CompoundSearchFilterSelectInputField.tsx
new file mode 100644
index 0000000000000..69cacc2c08d11
--- /dev/null
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/components/CompoundSearchFilterSelectInputField.tsx
@@ -0,0 +1,56 @@
+import type { SearchFilter } from 'types/search';
+import { ensureExhaustive } from 'utils/type.utils';
+
+import type { GenericSelectSearchFilterAttribute, OnSearchCallback } from '../types';
+import SearchFilterSelectExclusiveDouble from './SearchFilterSelectExclusiveDouble';
+import SearchFilterSelectExclusiveSingle from './SearchFilterSelectExclusiveSingle';
+import SearchFilterSelectInclusive from './SearchFilterSelectInclusive';
+
+export type CompoundSearchFilterSelectInputFieldProps = {
+    attribute: GenericSelectSearchFilterAttribute;
+    isDisabled?: boolean;
+    onSearch: OnSearchCallback;
+    searchFilter: SearchFilter;
+};
+
+function CompoundSearchFilterSelectInputField({
+    attribute,
+    isDisabled = false,
+    onSearch,
+    searchFilter,
+}: CompoundSearchFilterSelectInputFieldProps) {
+    const { inputType } = attribute;
+    switch (inputType) {
+        case 'select-exclusive-double':
+            return (
+                <SearchFilterSelectExclusiveDouble
+                    attribute={attribute}
+                    isDisabled={isDisabled}
+                    onSearch={onSearch}
+                    searchFilter={searchFilter}
+                />
+            );
+        case 'select-exclusive-single':
+            return (
+                <SearchFilterSelectExclusiveSingle
+                    attribute={attribute}
+                    isDisabled={isDisabled}
+                    onSearch={onSearch}
+                    searchFilter={searchFilter}
+                />
+            );
+        case 'select':
+            return (
+                <SearchFilterSelectInclusive
+                    attribute={attribute}
+                    isDisabled={isDisabled}
+                    onSearch={onSearch}
+                    searchFilter={searchFilter}
+                />
+            );
+        default:
+            return ensureExhaustive(inputType);
+    }
+}
+
+export default CompoundSearchFilterSelectInputField;
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/components/SelectExclusiveSingleTabs.tsx b/ui/apps/platform/src/Components/CompoundSearchFilter/components/SelectExclusiveSingleTabs.tsx
new file mode 100644
index 0000000000000..98946d153b16d
--- /dev/null
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/components/SelectExclusiveSingleTabs.tsx
@@ -0,0 +1,50 @@
+import type { ReactElement } from 'react';
+import { Tab, TabTitleText, Tabs } from '@patternfly/react-core';
+
+import type { SearchFilter } from 'types/search';
+import { searchValueAsArray } from 'utils/searchUtils';
+
+import type { OnSearchPayload, SelectExclusiveSingleSearchFilterAttribute } from '../types';
+
+export type SelectExclusiveSingleTabsProps = {
+    attribute: SelectExclusiveSingleSearchFilterAttribute;
+    onSelectTab: (payload: OnSearchPayload) => void;
+    searchFilter: SearchFilter;
+    tabContentId: string;
+    usePageInsets?: boolean;
+};
+
+// Generic presentation of search filter attribute as tabs.
+// For example, CVE Snoozed for Nodes Results pages.
+// Callback function might need to reset pagination in addition to update search filter.
+function SelectExclusiveSingleTabs({
+    attribute,
+    onSelectTab,
+    searchFilter,
+    tabContentId,
+    usePageInsets = true,
+}: SelectExclusiveSingleTabsProps): ReactElement {
+    const { inputProps, searchTerm } = attribute;
+    const { options } = inputProps;
+
+    const activeKey = searchValueAsArray(searchFilter[searchTerm])[0] ?? options[0].value;
+
+    function onSelect(_, eventKey) {
+        onSelectTab([{ action: 'SELECT_EXCLUSIVE', category: searchTerm, value: eventKey }]);
+    }
+
+    return (
+        <Tabs activeKey={activeKey} onSelect={onSelect} usePageInsets={usePageInsets}>
+            {options.map(({ label, value }) => (
+                <Tab
+                    key={value}
+                    eventKey={value}
+                    tabContentId={tabContentId}
+                    title={<TabTitleText>{label}</TabTitleText>}
+                />
+            ))}
+        </Tabs>
+    );
+}
+
+export default SelectExclusiveSingleTabs;
diff --git a/ui/apps/platform/src/Components/CompoundSearchFilter/types.ts b/ui/apps/platform/src/Components/CompoundSearchFilter/types.ts
index c7ab7ad243ca9..389c00724e63e 100644
--- a/ui/apps/platform/src/Components/CompoundSearchFilter/types.ts
+++ b/ui/apps/platform/src/Components/CompoundSearchFilter/types.ts
@@ -56,23 +56,30 @@ export type SelectExclusiveSingleSearchFilterAttribute = {
     inputProps: SelectSearchFilterOptions;
 } & BaseSearchFilterAttribute;
 
+export type SelectSingleSearchFilterAttribute =
+    | SelectSearchFilterAttribute
+    | SelectExclusiveSingleSearchFilterAttribute;
+
 export type SelectExclusiveDoubleSearchFilterAttribute = {
     inputType: 'select-exclusive-double';
     inputProps: SelectExclusiveDoubleSearchFilterInputProps;
 } & BaseSearchFilterAttribute;
 
 export type SelectExclusiveDoubleSearchFilterInputProps = {
-    category2: string;
+    category2: SearchFieldLabel;
     options: NonEmptyArray<SelectExclusiveDoubleSearchFilterOption>;
 };
 
 export type SelectExclusiveDoubleSearchFilterOption = {
-    category: string;
+    category: SearchFieldLabel;
 } & SelectSearchFilterOption;
 
 export type CompoundSearchFilterAttribute =
     | ConditionTextFilterAttribute
     | GenericSearchFilterAttribute
+    | GenericSelectSearchFilterAttribute;
+
+export type GenericSelectSearchFilterAttribute =
     | SelectSearchFilterAttribute
     | SelectExclusiveDoubleSearchFilterAttribute
     | SelectExclusiveSingleSearchFilterAttribute;
diff --git a/ui/apps/platform/src/Components/ConditionalTooltip.tsx b/ui/apps/platform/src/Components/ConditionalTooltip.tsx
new file mode 100644
index 0000000000000..df1519188e076
--- /dev/null
+++ b/ui/apps/platform/src/Components/ConditionalTooltip.tsx
@@ -0,0 +1,15 @@
+import { Tooltip } from '@patternfly/react-core';
+import type { TooltipProps } from '@patternfly/react-core';
+
+export type ConditionalTooltipProps = TooltipProps & {
+    renderTooltip: boolean;
+};
+
+function ConditionalTooltip({ renderTooltip, children, ...props }: ConditionalTooltipProps) {
+    if (renderTooltip) {
+        return <Tooltip {...props}>{children}</Tooltip>;
+    }
+    return children;
+}
+
+export default ConditionalTooltip;
diff --git a/ui/apps/platform/src/Components/ControlDetails.jsx b/ui/apps/platform/src/Components/ControlDetails.jsx
deleted file mode 100644
index 347017c03c5c6..0000000000000
--- a/ui/apps/platform/src/Components/ControlDetails.jsx
+++ /dev/null
@@ -1,43 +0,0 @@
-import PropTypes from 'prop-types';
-
-import { standardLabels } from 'messages/standards';
-
-import Widget from 'Components/Widget';
-
-const ControlDetails = ({ standardId, standardName, control, description, className }) => (
-    <Widget
-        header="Control details"
-        bodyClassName="flex-col"
-        className={className}
-        id="control-details"
-    >
-        <div className="flex flex-col justify-center p-4">
-            <div className="pb-2">
-                <span className="font-700 pr-1">Standard:</span>
-                <span data-testid="standard-name">
-                    {standardLabels[standardId] || standardName}
-                </span>
-            </div>
-            <div>
-                <span className="font-700 pr-1">Control:</span>
-                <span data-testid="control-name">{control}</span>
-            </div>
-        </div>
-        <div className="px-4 pb-4 leading-loose whitespace-pre-wrap">{description}</div>
-    </Widget>
-);
-
-ControlDetails.propTypes = {
-    standardId: PropTypes.string.isRequired,
-    control: PropTypes.string.isRequired,
-    description: PropTypes.string.isRequired,
-    className: PropTypes.string,
-    standardName: PropTypes.string,
-};
-
-ControlDetails.defaultProps = {
-    className: '',
-    standardName: '',
-};
-
-export default ControlDetails;
diff --git a/ui/apps/platform/src/Components/CountWidget.jsx b/ui/apps/platform/src/Components/CountWidget.jsx
deleted file mode 100644
index 606f477897b01..0000000000000
--- a/ui/apps/platform/src/Components/CountWidget.jsx
+++ /dev/null
@@ -1,54 +0,0 @@
-import { connect } from 'react-redux';
-import PropTypes from 'prop-types';
-import { Link } from 'react-router-dom-v5-compat';
-import Widget from 'Components/Widget';
-
-const CountWidget = ({ title, count, description, linkUrl }) => {
-    const countNode = (
-        <div
-            className={`${
-                count > 0 ? `hover:bg-tertiary-200` : ``
-            } text-6xl px-5 py-8 h-full flex items-center justify-center`}
-        >
-            {count}
-        </div>
-    );
-    const descNode = description && <div className="pt-1">{description}</div>;
-    return (
-        <Widget
-            header={title}
-            className="bg-base-100"
-            bodyClassName="flex-col h-full justify-center text-center"
-        >
-            {linkUrl ? (
-                <Link
-                    to={linkUrl}
-                    className="no-underline w-full h-full flex flex-col justify-center text-primary-700"
-                >
-                    {countNode}
-                    {descNode}
-                </Link>
-            ) : (
-                <>
-                    {countNode}
-                    {descNode}
-                </>
-            )}
-        </Widget>
-    );
-};
-
-CountWidget.propTypes = {
-    title: PropTypes.string.isRequired,
-    count: PropTypes.number,
-    description: PropTypes.string,
-    linkUrl: PropTypes.string,
-};
-
-CountWidget.defaultProps = {
-    description: null,
-    linkUrl: null,
-    count: 0,
-};
-
-export default connect()(CountWidget);
diff --git a/ui/apps/platform/src/Components/EntityIcon.jsx b/ui/apps/platform/src/Components/EntityIcon.jsx
index 545764667c7c7..11503a90aba0e 100644
--- a/ui/apps/platform/src/Components/EntityIcon.jsx
+++ b/ui/apps/platform/src/Components/EntityIcon.jsx
@@ -12,7 +12,6 @@ import policy from 'images/side-panel-icons/policy.svg';
 import role from 'images/side-panel-icons/role.svg';
 import secrets from 'images/side-panel-icons/secrets.svg';
 import serviceAccount from 'images/side-panel-icons/service-account.svg';
-import control from 'images/side-panel-icons/control.svg';
 
 const imageMap = {
     [entityTypes.CLUSTER]: cluster,
@@ -32,7 +31,6 @@ const imageMap = {
     [entityTypes.ROLE]: role,
     [entityTypes.SECRET]: secrets,
     [entityTypes.SERVICE_ACCOUNT]: serviceAccount,
-    [entityTypes.CONTROL]: control,
 };
 
 const EntityIcon = ({ className, entityType }) => (
diff --git a/ui/apps/platform/src/Components/ExportButton.jsx b/ui/apps/platform/src/Components/ExportButton.jsx
deleted file mode 100644
index 7988a13464865..0000000000000
--- a/ui/apps/platform/src/Components/ExportButton.jsx
+++ /dev/null
@@ -1,116 +0,0 @@
-import { Component } from 'react';
-import PropTypes from 'prop-types';
-import { FileText } from 'react-feather';
-import onClickOutside from 'react-onclickoutside';
-import { Button } from '@patternfly/react-core';
-
-import downloadCSV from 'services/CSVDownloadService';
-import ButtonClassic from 'Components/Button';
-import entityTypes from 'constants/entityTypes';
-import useCaseTypes from 'constants/useCaseTypes';
-import { addBrandedTimestampToString } from 'utils/dateUtils';
-
-const queryParamMap = {
-    [entityTypes.CLUSTER]: 'clusterId',
-    [entityTypes.STANDARD]: 'standardId',
-    ALL: '',
-};
-
-class ExportButton extends Component {
-    static propTypes = {
-        className: PropTypes.string,
-        textClass: PropTypes.string,
-        fileName: PropTypes.string,
-        type: PropTypes.string,
-        id: PropTypes.string,
-        page: PropTypes.string,
-        disabled: PropTypes.bool,
-    };
-
-    static defaultProps = {
-        className: 'btn btn-base h-10',
-        textClass: null,
-        fileName: 'compliance',
-        type: null,
-        id: '',
-        page: '',
-        disabled: false,
-    };
-
-    constructor(props) {
-        super(props);
-
-        this.state = {
-            toggleWidget: false,
-        };
-    }
-
-    handleClickOutside = () => this.setState({ toggleWidget: false });
-
-    downloadCSVFile = () => {
-        const { id, fileName, type } = this.props;
-        const csvName = addBrandedTimestampToString(fileName);
-
-        let queryStr = '';
-        if (queryParamMap[type] && id) {
-            queryStr = `${queryParamMap[type]}=${id}`;
-        }
-
-        downloadCSV(csvName, '/api/compliance/export/csv', queryStr);
-    };
-
-    isSupported = () => {
-        const { page, type } = this.props;
-        return page === useCaseTypes.COMPLIANCE && Object.keys(queryParamMap).includes(type);
-    };
-
-    renderContent = () => {
-        if (!this.state.toggleWidget) {
-            return null;
-        }
-
-        return this.isSupported() ? (
-            <div className="absolute right-0 z-20 flex flex-col text-base-600">
-                <div className="arrow-up self-end mr-5" />
-                <ul
-                    className="bg-base-100 rounded"
-                    style={{
-                        borderColor: 'var(--pf-t--global--border--color--brand--default)',
-                        borderWidth: 2,
-                    }}
-                >
-                    <li className="p-4 border-b">
-                        <div className="flex">
-                            <Button variant="primary" onClick={this.downloadCSVFile}>
-                                Download Evidence as CSV
-                            </Button>
-                        </div>
-                    </li>
-                </ul>
-            </div>
-        ) : null;
-    };
-
-    toggleWidget = () => {
-        this.setState(({ toggleWidget }) => ({ toggleWidget: !toggleWidget }));
-    };
-
-    render() {
-        return (
-            <div className="relative pl-2">
-                <ButtonClassic
-                    className={this.props.className}
-                    disabled={this.props.disabled}
-                    text="Export"
-                    textCondensed="Export"
-                    textClass={this.props.textClass}
-                    icon={<FileText size="14" className="mx-1 lg:ml-1 lg:mr-3" />}
-                    onClick={this.toggleWidget}
-                />
-                {this.renderContent()}
-            </div>
-        );
-    }
-}
-
-export default onClickOutside(ExportButton);
diff --git a/ui/apps/platform/src/Components/IconWidget.jsx b/ui/apps/platform/src/Components/IconWidget.jsx
deleted file mode 100644
index c81b78d283ad5..0000000000000
--- a/ui/apps/platform/src/Components/IconWidget.jsx
+++ /dev/null
@@ -1,59 +0,0 @@
-import { connect } from 'react-redux';
-import PropTypes from 'prop-types';
-import { Link } from 'react-router-dom-v5-compat';
-import Widget from 'Components/Widget';
-import Loader from 'Components/Loader';
-
-const IconWidget = ({ title, icon, description, linkUrl, loading, textSizeClass }) => {
-    const contents = loading ? (
-        <Loader />
-    ) : (
-        <>
-            <div className="flex h-full items-end justify-center">
-                <img src={icon} alt={title} />
-            </div>
-            <div
-                className={`h-full flex items-start justify-center pt-3 leading-normal ${textSizeClass}`}
-            >
-                <span>{description}</span>
-            </div>
-        </>
-    );
-
-    return (
-        <Widget
-            header={title}
-            className="bg-base-100"
-            bodyClassName="flex-col h-full justify-center text-center text-base-600 px-3 pt-8 pb-3"
-        >
-            {linkUrl && !loading ? (
-                <Link
-                    to={linkUrl}
-                    className="w-full h-full flex flex-col justify-center text-base-600 break-all"
-                >
-                    {contents}
-                </Link>
-            ) : (
-                <div className="break-all">{contents}</div>
-            )}
-        </Widget>
-    );
-};
-
-IconWidget.propTypes = {
-    title: PropTypes.string.isRequired,
-    icon: PropTypes.node.isRequired,
-    description: PropTypes.string,
-    textSizeClass: PropTypes.string,
-    linkUrl: PropTypes.string,
-    loading: PropTypes.bool,
-};
-
-IconWidget.defaultProps = {
-    description: null,
-    linkUrl: null,
-    textSizeClass: 'text-2xl',
-    loading: false,
-};
-
-export default connect()(IconWidget);
diff --git a/ui/apps/platform/src/Components/InfoWidget.jsx b/ui/apps/platform/src/Components/InfoWidget.jsx
deleted file mode 100644
index b14be1fbe5976..0000000000000
--- a/ui/apps/platform/src/Components/InfoWidget.jsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import { connect } from 'react-redux';
-import PropTypes from 'prop-types';
-import { Link } from 'react-router-dom-v5-compat';
-import Widget from 'Components/Widget';
-import Loader from 'Components/Loader';
-
-const InfoWidget = ({ title, headline, description, linkUrl, loading }) => {
-    const contents = loading ? (
-        <Loader />
-    ) : (
-        <div className="p-6">
-            <div className="border-b border-base-400 pb-3 text-2xl text-base-600">{headline}</div>
-            <div className="pt-3">{description}</div>
-        </div>
-    );
-    return (
-        <Widget
-            header={title}
-            className="bg-base-100"
-            bodyClassName="flex-col h-full justify-center text-center text-base-600 p-3"
-        >
-            {linkUrl && !loading ? (
-                <Link
-                    to={linkUrl}
-                    className="w-full h-full flex flex-col justify-center text-base-600"
-                >
-                    {contents}
-                </Link>
-            ) : (
-                contents
-            )}
-        </Widget>
-    );
-};
-
-InfoWidget.propTypes = {
-    title: PropTypes.string.isRequired,
-    headline: PropTypes.string,
-    description: PropTypes.string,
-    linkUrl: PropTypes.string,
-    loading: PropTypes.bool,
-};
-
-InfoWidget.defaultProps = {
-    description: null,
-    headline: null,
-    linkUrl: null,
-    loading: false,
-};
-
-export default connect()(InfoWidget);
diff --git a/ui/apps/platform/src/Components/NotifierConfiguration/NotifierConfigurationView.tsx b/ui/apps/platform/src/Components/NotifierConfiguration/NotifierConfigurationView.tsx
deleted file mode 100644
index 9459a9416d830..0000000000000
--- a/ui/apps/platform/src/Components/NotifierConfiguration/NotifierConfigurationView.tsx
+++ /dev/null
@@ -1,111 +0,0 @@
-import { useState } from 'react';
-import type { ReactElement } from 'react';
-import { Button, Flex, FlexItem, Title } from '@patternfly/react-core';
-import { Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
-
-import { isDefaultEmailTemplate } from 'Components/EmailTemplate/EmailTemplate.utils';
-import EmailTemplateModal from 'Components/EmailTemplate/EmailTemplateModal';
-import type { TemplatePreviewArgs } from 'Components/EmailTemplate/EmailTemplateModal';
-import useIndexKey from 'hooks/useIndexKey';
-import type { NotifierConfiguration } from 'services/ReportsService.types';
-
-export type NotifierConfigurationViewProps = {
-    headingLevel: 'h2' | 'h3';
-    customBodyDefault: string;
-    customSubjectDefault: string;
-    notifierConfigurations: NotifierConfiguration[];
-    renderTemplatePreview?: (args: TemplatePreviewArgs) => ReactElement;
-};
-
-function NotifierConfigurationView({
-    headingLevel,
-    customBodyDefault,
-    customSubjectDefault,
-    notifierConfigurations,
-    renderTemplatePreview,
-}: NotifierConfigurationViewProps): ReactElement {
-    const { keyFor } = useIndexKey();
-    const [notifierConfigurationSelected, setNotifierConfigurationSelected] =
-        useState<NotifierConfiguration | null>(null);
-
-    return (
-        <>
-            <Flex direction={{ default: 'column' }}>
-                <FlexItem>
-                    <Title headingLevel={headingLevel}>Delivery destinations</Title>
-                </FlexItem>
-                <FlexItem flex={{ default: 'flexNone' }}>
-                    {notifierConfigurations.length === 0 ? (
-                        'No delivery destinations'
-                    ) : (
-                        <Table variant="compact">
-                            <Thead>
-                                <Tr>
-                                    <Th>Email notifier</Th>
-                                    <Th>Distribution list</Th>
-                                    <Th>Email template</Th>
-                                </Tr>
-                            </Thead>
-                            <Tbody>
-                                {notifierConfigurations.map((notifierConfiguration, index) => {
-                                    const { emailConfig, notifierName } = notifierConfiguration;
-                                    const { customBody, customSubject, mailingLists } = emailConfig;
-                                    const isDefaultEmailTemplateApplied = isDefaultEmailTemplate({
-                                        customBody,
-                                        customSubject,
-                                    });
-                                    return (
-                                        <Tr key={keyFor(index)}>
-                                            <Td dataLabel="Email notifier">{notifierName}</Td>
-                                            <Td dataLabel="Distribution list">
-                                                {mailingLists.join(', ')}
-                                            </Td>
-                                            <Td dataLabel="Email template">
-                                                <Button
-                                                    variant="link"
-                                                    isInline
-                                                    onClick={() => {
-                                                        setNotifierConfigurationSelected(
-                                                            notifierConfiguration
-                                                        );
-                                                    }}
-                                                >
-                                                    {isDefaultEmailTemplateApplied
-                                                        ? 'Default template applied'
-                                                        : 'Custom template applied'}
-                                                </Button>
-                                            </Td>
-                                        </Tr>
-                                    );
-                                })}
-                            </Tbody>
-                        </Table>
-                    )}
-                </FlexItem>
-            </Flex>
-            {notifierConfigurationSelected && (
-                <EmailTemplateModal
-                    customBodyDefault={customBodyDefault}
-                    customBodyInitial={notifierConfigurationSelected.emailConfig.customBody}
-                    customSubjectDefault={customSubjectDefault}
-                    customSubjectInitial={notifierConfigurationSelected.emailConfig.customSubject}
-                    onChange={null}
-                    onClose={() => {
-                        setNotifierConfigurationSelected(null);
-                    }}
-                    renderTemplatePreview={renderTemplatePreview}
-                    title={
-                        isDefaultEmailTemplate({
-                            customBody: notifierConfigurationSelected.emailConfig.customBody,
-                            customSubject: notifierConfigurationSelected.emailConfig.customSubject,
-                        })
-                            ? 'Default template applied'
-                            : 'Custom template applied'
-                    }
-                />
-            )}
-        </>
-    );
-}
-
-export default NotifierConfigurationView;
diff --git a/ui/apps/platform/src/Components/ReportJob/MyLastJobStatus.test.tsx b/ui/apps/platform/src/Components/ReportJob/MyLastJobStatus.test.tsx
index 13f6b1498b0d6..dd6da5d74df0a 100644
--- a/ui/apps/platform/src/Components/ReportJob/MyLastJobStatus.test.tsx
+++ b/ui/apps/platform/src/Components/ReportJob/MyLastJobStatus.test.tsx
@@ -8,6 +8,7 @@ import type { ReportStatus } from 'types/reportJob';
 import MyLastJobStatus from './MyLastJobStatus';
 
 const baseReportSnapshot: Omit<ConfiguredReportSnapshot, 'reportStatus' | 'isDownloadAvailable'> = {
+    type: 'VULNERABILITY',
     reportConfigId: 'report-config-id-1',
     reportJobId: 'report-job-id-1',
     name: 'test-name-1',
diff --git a/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.test.tsx b/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.test.tsx
index 19f638afd45ae..575c38f7b72e1 100644
--- a/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.test.tsx
+++ b/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.test.tsx
@@ -71,7 +71,7 @@ describe('ReportJobStatus', () => {
                     reportRequestType: 'ON_DEMAND',
                     reportNotificationMethod: 'DOWNLOAD',
                     completedAt: '',
-                    errorMsg: 'This is an error message',
+                    errorMsg: 'scan failed on Cluster "Prod-East"',
                 }}
                 isDownloadAvailable={false}
                 areDownloadActionsDisabled={false}
@@ -88,7 +88,7 @@ describe('ReportJobStatus', () => {
         // trigger the hover action
         fireEvent.mouseEnter(statusIconElement);
 
-        const tooltipElement = await screen.findByText('This is an error message');
+        const tooltipElement = await screen.findByText('scan failed on Cluster "Prod-East"');
 
         expect(tooltipElement).toBeInTheDocument();
 
diff --git a/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.tsx b/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.tsx
index e9f204ef47638..67c8854ae405f 100644
--- a/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.tsx
+++ b/ui/apps/platform/src/Components/ReportJob/ReportJobStatus.tsx
@@ -9,7 +9,6 @@ import {
     PendingIcon,
 } from '@patternfly/react-icons';
 import { Button, Flex, FlexItem, Tooltip } from '@patternfly/react-core';
-import capitalize from 'lodash/capitalize';
 
 import type { ReportStatus } from 'types/reportJob';
 import PartialReportModal from './PartialReportModal';
@@ -47,9 +46,7 @@ function ReportJobStatus({
         statusIconColorClass = 'pf-v6-u-icon-color-status-danger';
         statusTextColorClass = 'pf-v6-u-text-color-status-danger';
         statusIcon = (
-            <Tooltip
-                content={reportStatus?.errorMsg ? capitalize(reportStatus.errorMsg) : genericMsg}
-            >
+            <Tooltip content={reportStatus?.errorMsg || genericMsg}>
                 <ExclamationCircleIcon title="Report run was unsuccessful" />
             </Tooltip>
         );
diff --git a/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.test.tsx b/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.test.tsx
index 63f5271412e03..04f8a07da48c8 100644
--- a/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.test.tsx
+++ b/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.test.tsx
@@ -3,7 +3,7 @@ import { render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import '@testing-library/jest-dom';
 
-import ReportJobStatusFilter, { ensureReportJobStatuses } from './ReportJobStatusFilter';
+import ReportJobStatusFilter, { isReportJobStatus } from './ReportJobStatusFilter';
 import type { ReportJobStatus } from './types';
 
 const getCheckboxOption = (name: string) => {
@@ -93,22 +93,17 @@ describe('ReportJobStatusFilter', () => {
         expect(checkboxOptionForError).toBeChecked();
     });
 
-    // Tests for the "ensureReportJobStatuses" helper function
-    describe('ensureReportJobStatuses', () => {
+    // Tests for the "isReportJobStatus" helper function
+    describe('isReportJobStatus', () => {
         test('should filter out all incorrect values', async () => {
-            expect(ensureReportJobStatuses('')).toEqual([]);
-            expect(ensureReportJobStatuses(['TEST', 'BLAH', 'LOADING'])).toEqual([]);
+            expect(['TEST', 'BLAH', 'LOADING'].filter(isReportJobStatus)).toEqual([]);
         });
 
         test('should filter to show all correct values', async () => {
             expect(
-                ensureReportJobStatuses([
-                    'PREPARING',
-                    'WAITING',
-                    'DOWNLOAD_GENERATED',
-                    'EMAIL_DELIVERED',
-                    'ERROR',
-                ])
+                ['PREPARING', 'WAITING', 'DOWNLOAD_GENERATED', 'EMAIL_DELIVERED', 'ERROR'].filter(
+                    isReportJobStatus
+                )
             ).toEqual(['PREPARING', 'WAITING', 'DOWNLOAD_GENERATED', 'EMAIL_DELIVERED', 'ERROR']);
         });
     });
diff --git a/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.tsx b/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.tsx
index 07a9a1cdf3237..5d1f4764e6280 100644
--- a/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.tsx
+++ b/ui/apps/platform/src/Components/ReportJob/ReportJobStatusFilter.tsx
@@ -5,32 +5,10 @@ import CheckboxSelect from 'Components/CheckboxSelect';
 import { reportJobStatusLabels, reportJobStatuses } from './types';
 import type { ReportJobStatus } from './types';
 
-function isReportJobStatus(value: string): value is ReportJobStatus {
+export function isReportJobStatus(value: string): value is ReportJobStatus {
     return value in reportJobStatuses;
 }
 
-/**
- * Ensures that the given search filter value is converted to an array of valid report job status values.
- *
- * Example:
- * ensureReportJobStatuses(["WAITING", "PREPARING"]);  // returns ["WAITING", "PREPARING"]
- * ensureReportJobStatuses("WAITING");                 // returns [] (since input is not an array)
- * ensureReportJobStatuses(undefined);                 // returns []
- *
- * @param searchFilterValue - The input value, which can be a string, an array of strings, or undefined.
- * @returns {ReportJobStatus[]} - If the input is an array of strings, it filters the values that match valid "ReportJobStatus"s
- *                         and returns them as an array.
- *                         If the input is not an array or undefined, it returns an empty array.
- */
-export function ensureReportJobStatuses(
-    searchFilterValue: string | string[] | undefined
-): ReportJobStatus[] {
-    if (Array.isArray(searchFilterValue)) {
-        return searchFilterValue.filter((value) => isReportJobStatus(value));
-    }
-    return [];
-}
-
 export type ReportJobStatusFilterProps = {
     availableStatuses: ReportJobStatus[];
     selectedStatuses: ReportJobStatus[];
diff --git a/ui/apps/platform/src/Components/Reports/Step/FiltersQuery.tsx b/ui/apps/platform/src/Components/Reports/Step/FiltersQuery.tsx
index d3923721d07c5..9c0dda60515e5 100644
--- a/ui/apps/platform/src/Components/Reports/Step/FiltersQuery.tsx
+++ b/ui/apps/platform/src/Components/Reports/Step/FiltersQuery.tsx
@@ -6,16 +6,14 @@ import {
     HelperText,
     HelperTextItem,
 } from '@patternfly/react-core';
-import { getIn } from 'formik';
-import type { FormikProps } from 'formik';
 
 import CompoundSearchFilter from 'Components/CompoundSearchFilter/components/CompoundSearchFilter';
 import CompoundSearchFilterLabels from 'Components/CompoundSearchFilter/components/CompoundSearchFilterLabels';
-import SearchFilterSelectInclusive from 'Components/CompoundSearchFilter/components/SearchFilterSelectInclusive';
+import CompoundSearchFilterSelectInputField from 'Components/CompoundSearchFilter/components/CompoundSearchFilterSelectInputField';
 import type {
     CompoundSearchFilterConfig,
+    GenericSelectSearchFilterAttribute,
     OnSearchPayload,
-    SelectSearchFilterAttribute,
 } from 'Components/CompoundSearchFilter/types';
 import { updateSearchFilter } from 'Components/CompoundSearchFilter/utils/utils';
 import type { SearchFilter } from 'types/search';
@@ -25,28 +23,29 @@ import {
     getSearchFilterFromSearchString,
 } from 'utils/searchUtils';
 
-export type FiltersQueryConfiguration = {
-    vulnReportFilters: {
-        query: string;
-    };
-};
-
-export type FiltersQueryProps<T extends FiltersQueryConfiguration = FiltersQueryConfiguration> = {
-    attributesSeparateFromConfig: SelectSearchFilterAttribute[];
-    formik: FormikProps<T>;
+// Because filter property name differs for different report types,
+// renderer is responsible to provide values from formik object.
+export type FiltersQueryProps = {
+    attributesSeparateFromConfig: GenericSelectSearchFilterAttribute[];
+    error: string | undefined;
+    query: string;
     searchFilterConfig: CompoundSearchFilterConfig;
+    setQueryValue: (value: string, shouldValidate?: boolean) => void;
+    touched: boolean | undefined;
 };
 
-function FiltersQuery<T extends FiltersQueryConfiguration = FiltersQueryConfiguration>({
+function FiltersQuery({
     attributesSeparateFromConfig,
-    formik,
+    error,
+    query,
     searchFilterConfig,
-}: FiltersQueryProps<T>): ReactElement {
-    const searchFilter = getSearchFilterFromSearchString(formik.values.vulnReportFilters.query);
+    setQueryValue,
+    touched,
+}: FiltersQueryProps): ReactElement {
+    const searchFilter = getSearchFilterFromSearchString(query);
 
     function onFilterChange(searchFilterChanged: SearchFilter) {
-        formik.setFieldValue(
-            'vulnReportFilters.query',
+        setQueryValue(
             getRequestQueryStringForSearchFilter(applyRegexSearchModifiers(searchFilterChanged))
         );
     }
@@ -59,7 +58,7 @@ function FiltersQuery<T extends FiltersQueryConfiguration = FiltersQueryConfigur
         <>
             {attributesSeparateFromConfig.map((attribute) => (
                 <FormGroup key={attribute.searchTerm} label={attribute.displayName} fieldId="TODO">
-                    <SearchFilterSelectInclusive
+                    <CompoundSearchFilterSelectInputField
                         attribute={attribute}
                         onSearch={onSearch}
                         searchFilter={searchFilter}
@@ -81,13 +80,11 @@ function FiltersQuery<T extends FiltersQueryConfiguration = FiltersQueryConfigur
                         searchFilter={searchFilter}
                     />
                 ) : (
-                    getIn(formik.touched, 'vulnReportFilters.query') &&
-                    getIn(formik.errors, 'vulnReportFilters.query') && (
+                    touched &&
+                    error && (
                         <FormHelperText>
                             <HelperText>
-                                <HelperTextItem variant="error">
-                                    {getIn(formik.errors, 'vulnReportFilters.query')}
-                                </HelperTextItem>
+                                <HelperTextItem variant="error">{error}</HelperTextItem>
                             </HelperText>
                         </FormHelperText>
                     )
diff --git a/ui/apps/platform/src/Components/Reports/Step/validationSchemaDelivery.ts b/ui/apps/platform/src/Components/Reports/Step/validationSchemaDelivery.ts
new file mode 100644
index 0000000000000..e5b46817efd9b
--- /dev/null
+++ b/ui/apps/platform/src/Components/Reports/Step/validationSchemaDelivery.ts
@@ -0,0 +1,54 @@
+import * as yup from 'yup';
+
+import type { Schedule } from 'types/schedule.proto';
+
+import type { DeliveryType } from '../reports.types';
+
+export const validationSchemaDelivery: yup.ObjectSchema<DeliveryType> = yup.object().shape({
+    notifiers: yup
+        .array()
+        .of(
+            yup.object().shape({
+                emailConfig: yup.object().shape({
+                    notifierId: yup.string().required('Email notifier is required'),
+                    mailingLists: yup
+                        .array()
+                        .of(yup.string().required())
+                        .min(1, 'At least one distribution list email is required')
+                        .required(),
+                    customSubject: yup.string().defined(),
+                    customBody: yup.string().defined(),
+                }),
+                notifierName: yup.string().defined(),
+            })
+        )
+        .defined(),
+    schedule: yup
+        .object()
+        .nullable()
+        .defined()
+        .test('schedule-days-required', 'At least one day must be selected', function test(value) {
+            if (value == null) {
+                return true;
+            }
+            // Schedule is a union type that .shape() can't express.
+            // Cast so property access is type-checked.
+            const schedule = value as Schedule;
+            if (schedule.intervalType === 'UNSET' || schedule.intervalType === 'DAILY') {
+                return true;
+            }
+            if ('daysOfWeek' in schedule && schedule.daysOfWeek.days.length === 0) {
+                return this.createError({
+                    path: 'schedule.daysOfWeek.days',
+                    message: 'At least one day must be selected',
+                });
+            }
+            if ('daysOfMonth' in schedule && schedule.daysOfMonth.days.length === 0) {
+                return this.createError({
+                    path: 'schedule.daysOfMonth.days',
+                    message: 'At least one day must be selected',
+                });
+            }
+            return true;
+        }) as unknown as yup.Schema<Schedule | null>,
+});
diff --git a/ui/apps/platform/src/Components/Reports/Step/validationSchemaDetails.ts b/ui/apps/platform/src/Components/Reports/Step/validationSchemaDetails.ts
new file mode 100644
index 0000000000000..d2581af95678e
--- /dev/null
+++ b/ui/apps/platform/src/Components/Reports/Step/validationSchemaDetails.ts
@@ -0,0 +1,8 @@
+import * as yup from 'yup';
+
+import type { DetailsType } from '../reports.types';
+
+export const validationSchemaDetails: yup.ObjectSchema<DetailsType> = yup.object().shape({
+    name: yup.string().trim().required('Report name is required'),
+    description: yup.string().ensure(),
+});
diff --git a/ui/apps/platform/src/Components/Reports/View/DeliveryView.tsx b/ui/apps/platform/src/Components/Reports/View/DeliveryView.tsx
index ea4548cf21741..3f88899f15278 100644
--- a/ui/apps/platform/src/Components/Reports/View/DeliveryView.tsx
+++ b/ui/apps/platform/src/Components/Reports/View/DeliveryView.tsx
@@ -1,20 +1,11 @@
 import type { ReactElement } from 'react';
-import {
-    DescriptionList,
-    DescriptionListDescription,
-    DescriptionListGroup,
-    DescriptionListTerm,
-    Flex,
-    FlexItem,
-    Title,
-} from '@patternfly/react-core';
+import { DescriptionList, Flex, FlexItem, Title } from '@patternfly/react-core';
 import type { BreakpointModifiers } from '@patternfly/react-core';
 
-import { formatRecurringSchedule } from 'utils/dateUtils';
-
 import type { DeliveryType } from '../reports.types';
 
-import NotifierConfigurationDescriptionList from './NotifierConfigurationDescriptionList';
+import NotifierConfigurationsDescriptionListGroup from './NotifierConfigurationsDescriptionListGroup';
+import ScheduleDescriptionListGroup from './ScheduleDescriptionListGroup';
 
 export type DeliveryViewProps = {
     headingLevel: 'h2' | 'h3';
@@ -27,7 +18,6 @@ function DeliveryView({
     horizontalTermWidthModifier,
     values,
 }: DeliveryViewProps): ReactElement {
-    /* eslint-disable react/no-array-index-key */
     return (
         <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
             <FlexItem>
@@ -39,37 +29,12 @@ function DeliveryView({
                     isHorizontal
                     horizontalTermWidthModifier={horizontalTermWidthModifier}
                 >
-                    <DescriptionListGroup>
-                        <DescriptionListTerm>Destinations</DescriptionListTerm>
-                        <DescriptionListDescription>
-                            {values.notifiers.length === 0 ? (
-                                '-'
-                            ) : (
-                                <Flex
-                                    direction={{ default: 'column' }}
-                                    spaceItems={{ default: 'spaceItemsLg' }}
-                                >
-                                    {values.notifiers.map((notifier, index) => (
-                                        <NotifierConfigurationDescriptionList
-                                            key={index}
-                                            notifier={notifier}
-                                        />
-                                    ))}
-                                </Flex>
-                            )}
-                        </DescriptionListDescription>
-                    </DescriptionListGroup>
-                    <DescriptionListGroup>
-                        <DescriptionListTerm>Schedule</DescriptionListTerm>
-                        <DescriptionListDescription>
-                            {values.schedule ? formatRecurringSchedule(values.schedule) : '-'}
-                        </DescriptionListDescription>
-                    </DescriptionListGroup>
+                    <NotifierConfigurationsDescriptionListGroup notifiers={values.notifiers} />
+                    <ScheduleDescriptionListGroup schedule={values.schedule} />
                 </DescriptionList>
             </FlexItem>
         </Flex>
     );
-    /* eslint-enable react/no-array-index-key */
 }
 
 export default DeliveryView;
diff --git a/ui/apps/platform/src/Components/Reports/View/DetailsDescriptionListGroups.tsx b/ui/apps/platform/src/Components/Reports/View/DetailsDescriptionListGroups.tsx
new file mode 100644
index 0000000000000..0d7e409dc218e
--- /dev/null
+++ b/ui/apps/platform/src/Components/Reports/View/DetailsDescriptionListGroups.tsx
@@ -0,0 +1,35 @@
+import type { ReactElement } from 'react';
+import {
+    DescriptionListDescription,
+    DescriptionListGroup,
+    DescriptionListTerm,
+} from '@patternfly/react-core';
+
+// Generic component for use cases:
+// Parameters of compliance scan schedule configuration
+// Details of vulnerability report configuration
+
+export type DetailsDescriptionListGroupsProps = {
+    description: string;
+    name: string;
+};
+
+function DetailsDescriptionListGroups({
+    description,
+    name,
+}: DetailsDescriptionListGroupsProps): ReactElement {
+    return (
+        <>
+            <DescriptionListGroup>
+                <DescriptionListTerm>Name</DescriptionListTerm>
+                <DescriptionListDescription>{name || '-'}</DescriptionListDescription>
+            </DescriptionListGroup>
+            <DescriptionListGroup>
+                <DescriptionListTerm>Description</DescriptionListTerm>
+                <DescriptionListDescription>{description || '-'}</DescriptionListDescription>
+            </DescriptionListGroup>
+        </>
+    );
+}
+
+export default DetailsDescriptionListGroups;
diff --git a/ui/apps/platform/src/Components/Reports/View/DetailsView.tsx b/ui/apps/platform/src/Components/Reports/View/DetailsView.tsx
index 92d9f6b8e7b0a..5cde41afc9feb 100644
--- a/ui/apps/platform/src/Components/Reports/View/DetailsView.tsx
+++ b/ui/apps/platform/src/Components/Reports/View/DetailsView.tsx
@@ -1,17 +1,11 @@
 import type { ReactElement } from 'react';
-import {
-    DescriptionList,
-    DescriptionListDescription,
-    DescriptionListGroup,
-    DescriptionListTerm,
-    Flex,
-    FlexItem,
-    Title,
-} from '@patternfly/react-core';
+import { DescriptionList, Flex, FlexItem, Title } from '@patternfly/react-core';
 import type { BreakpointModifiers } from '@patternfly/react-core';
 
 import type { DetailsType } from '../reports.types';
 
+import DetailsDescriptionListGroups from './DetailsDescriptionListGroups';
+
 export type DetailsViewProps = {
     headingLevel: 'h2' | 'h3';
     horizontalTermWidthModifier: BreakpointModifiers;
@@ -34,18 +28,10 @@ function DetailsView({
                     isHorizontal
                     horizontalTermWidthModifier={horizontalTermWidthModifier}
                 >
-                    <DescriptionListGroup>
-                        <DescriptionListTerm>Name</DescriptionListTerm>
-                        <DescriptionListDescription>
-                            {values.name || '-'}
-                        </DescriptionListDescription>
-                    </DescriptionListGroup>
-                    <DescriptionListGroup>
-                        <DescriptionListTerm>Description</DescriptionListTerm>
-                        <DescriptionListDescription>
-                            {values.description || '-'}
-                        </DescriptionListDescription>
-                    </DescriptionListGroup>
+                    <DetailsDescriptionListGroups
+                        description={values.description}
+                        name={values.name}
+                    />
                 </DescriptionList>
             </FlexItem>
         </Flex>
diff --git a/ui/apps/platform/src/Components/Reports/View/NotifierConfigurationsDescriptionListGroup.tsx b/ui/apps/platform/src/Components/Reports/View/NotifierConfigurationsDescriptionListGroup.tsx
new file mode 100644
index 0000000000000..978195737cbb9
--- /dev/null
+++ b/ui/apps/platform/src/Components/Reports/View/NotifierConfigurationsDescriptionListGroup.tsx
@@ -0,0 +1,47 @@
+import type { ReactElement } from 'react';
+import {
+    DescriptionListDescription,
+    DescriptionListGroup,
+    DescriptionListTerm,
+    Flex,
+} from '@patternfly/react-core';
+
+import type { NotifierConfiguration } from 'services/ReportsService.types';
+
+import NotifierConfigurationDescriptionList from './NotifierConfigurationDescriptionList';
+
+// Generic component for use cases:
+// Delivery of compliance scan schedule configuration does not have schedules
+// Delivery of vulnerability report configuration does have schedules
+
+export type NotifierConfigurationsDescriptionListGroupProps = {
+    notifiers: NotifierConfiguration[];
+};
+
+function NotifierConfigurationsDescriptionListGroup({
+    notifiers,
+}: NotifierConfigurationsDescriptionListGroupProps): ReactElement {
+    /* eslint-disable react/no-array-index-key */
+    return (
+        <DescriptionListGroup>
+            <DescriptionListTerm>Destinations</DescriptionListTerm>
+            <DescriptionListDescription>
+                {notifiers.length === 0 ? (
+                    '-'
+                ) : (
+                    <Flex
+                        direction={{ default: 'column' }}
+                        spaceItems={{ default: 'spaceItemsLg' }}
+                    >
+                        {notifiers.map((notifier, index) => (
+                            <NotifierConfigurationDescriptionList key={index} notifier={notifier} />
+                        ))}
+                    </Flex>
+                )}
+            </DescriptionListDescription>
+        </DescriptionListGroup>
+    );
+    /* eslint-enable react/no-array-index-key */
+}
+
+export default NotifierConfigurationsDescriptionListGroup;
diff --git a/ui/apps/platform/src/Components/Reports/View/ScheduleDescriptionListGroup.tsx b/ui/apps/platform/src/Components/Reports/View/ScheduleDescriptionListGroup.tsx
new file mode 100644
index 0000000000000..cc74e0ae9930d
--- /dev/null
+++ b/ui/apps/platform/src/Components/Reports/View/ScheduleDescriptionListGroup.tsx
@@ -0,0 +1,32 @@
+import type { ReactElement } from 'react';
+import {
+    DescriptionListDescription,
+    DescriptionListGroup,
+    DescriptionListTerm,
+} from '@patternfly/react-core';
+
+import type { Schedule } from 'types/schedule.proto';
+import { formatRecurringSchedule } from 'utils/dateUtils';
+
+// Generic component for use cases:
+// Parameters of compliance scan schedule configuration
+// Delivery of vulnerability report configuration
+
+export type ScheduleDescriptionListGroupProps = {
+    schedule: Schedule | null;
+};
+
+function ScheduleDescriptionListGroup({
+    schedule,
+}: ScheduleDescriptionListGroupProps): ReactElement {
+    return (
+        <DescriptionListGroup>
+            <DescriptionListTerm>Schedule</DescriptionListTerm>
+            <DescriptionListDescription>
+                {schedule ? formatRecurringSchedule(schedule) : '-'}
+            </DescriptionListDescription>
+        </DescriptionListGroup>
+    );
+}
+
+export default ScheduleDescriptionListGroup;
diff --git a/ui/apps/platform/src/Components/SearchInput/SearchInput.jsx b/ui/apps/platform/src/Components/SearchInput/SearchInput.jsx
index fc8373d45b82d..99fc6726f6590 100644
--- a/ui/apps/platform/src/Components/SearchInput/SearchInput.jsx
+++ b/ui/apps/platform/src/Components/SearchInput/SearchInput.jsx
@@ -32,7 +32,6 @@ export const searchInputPropTypes = {
     sendAutoCompleteRequest: PropTypes.func,
     clearAutoComplete: PropTypes.func,
     autoCompleteCategories: PropTypes.arrayOf(PropTypes.string),
-    setAllSearchOptions: PropTypes.func,
     isDisabled: PropTypes.bool,
     prependAutocompleteQuery: PropTypes.arrayOf(
         PropTypes.shape({
@@ -53,7 +52,6 @@ export const searchInputDefaultProps = {
     sendAutoCompleteRequest: null,
     clearAutoComplete: null,
     autoCompleteCategories: [],
-    setAllSearchOptions: () => {},
     isDisabled: false,
     prependAutocompleteQuery: [],
 };
@@ -108,8 +106,6 @@ class SearchInput extends Component {
     }
 
     sendAutoCompleteRequest = (searchOptions, input) => {
-        this.props.setAllSearchOptions(searchOptions);
-
         // Don't populate autocomplete if the text box is totally empty,
         // since we want people to see just the chips in that case.
         if (!searchOptions.length && !input.length) {
diff --git a/ui/apps/platform/src/Components/URLSearchInputWithAutocomplete.jsx b/ui/apps/platform/src/Components/URLSearchInputWithAutocomplete.jsx
index 642611d65ef5f..575335cd00c91 100644
--- a/ui/apps/platform/src/Components/URLSearchInputWithAutocomplete.jsx
+++ b/ui/apps/platform/src/Components/URLSearchInputWithAutocomplete.jsx
@@ -3,10 +3,8 @@ import { useLocation, useNavigate } from 'react-router-dom-v5-compat';
 import PropTypes from 'prop-types';
 import { components } from 'react-select';
 import queryString from 'qs';
-import { connect } from 'react-redux';
 import { Filter } from 'react-feather';
 
-import { actions as searchAutoCompleteActions } from 'reducers/searchAutocomplete';
 import { Creatable } from 'Components/ReactSelect';
 import searchOptionsToQuery from 'services/searchOptionsToQuery';
 import searchContext from 'Containers/searchContext';
@@ -99,7 +97,6 @@ export const removeValuesForKey = (oldOptions, newOptions) => {
 const URLSearchInputWithAutocomplete = ({
     autoCompleteResults,
     categoryOptions,
-    setAllSearchOptions,
     clearAutocomplete,
     fetchAutocomplete,
     placeholder,
@@ -235,7 +232,6 @@ const URLSearchInputWithAutocomplete = ({
 
     function updateAutocompleteState(searchOptions) {
         return (input) => {
-            setAllSearchOptions(searchOptions);
             if (searchOptions.length === 0) {
                 if (clearAutocomplete) {
                     clearAutocomplete();
@@ -311,7 +307,6 @@ URLSearchInputWithAutocomplete.propTypes = {
     autoCompleteResults: PropTypes.arrayOf(PropTypes.string),
     fetchAutocomplete: PropTypes.func,
     clearAutocomplete: PropTypes.func,
-    setAllSearchOptions: PropTypes.func.isRequired,
     prependAutocompleteQuery: PropTypes.arrayOf(
         PropTypes.shape({
             value: PropTypes.string,
@@ -328,8 +323,4 @@ URLSearchInputWithAutocomplete.defaultProps = {
     prependAutocompleteQuery: [],
 };
 
-const mapDispatchToProps = {
-    setAllSearchOptions: searchAutoCompleteActions.setAllSearchOptions,
-};
-
-export default connect(null, mapDispatchToProps)(URLSearchInputWithAutocomplete);
+export default URLSearchInputWithAutocomplete;
diff --git a/ui/apps/platform/src/Components/visuals/ArcSingle.jsx b/ui/apps/platform/src/Components/visuals/ArcSingle.jsx
deleted file mode 100644
index 52571ec45bcf9..0000000000000
--- a/ui/apps/platform/src/Components/visuals/ArcSingle.jsx
+++ /dev/null
@@ -1,58 +0,0 @@
-import { ArcSeries, LabelSeries, XYPlot } from 'react-vis';
-import PropTypes from 'prop-types';
-
-const RADIUS = 3;
-const VALUE_THICKNESS = 0.2;
-const FULL_ANGLE = 2 * Math.PI;
-
-function getDataFromValue(value) {
-    return [
-        {
-            angle0: 0,
-            angle: (FULL_ANGLE * value) / 100,
-            radius0: RADIUS - VALUE_THICKNESS,
-            radius: RADIUS,
-            color: 'var(--success-500)',
-        },
-        {
-            angle0: (FULL_ANGLE * value) / 100,
-            angle: FULL_ANGLE,
-            radius0: RADIUS - VALUE_THICKNESS * 0.8,
-            radius: RADIUS - VALUE_THICKNESS * 0.2,
-            color: 'var(--base-400)',
-        },
-    ];
-}
-const LABEL_STYLE = {
-    fontSize: '36px',
-    fill: 'var(--primary-800)',
-    fontWeight: 500,
-};
-
-const ArcSingle = ({ value }) => {
-    const data = getDataFromValue(value);
-
-    return (
-        <XYPlot xDomain={[-5, 5]} yDomain={[-5, 5]} width={135} height={121}>
-            <LabelSeries
-                labelAnchorX="middle"
-                labelAnchorY="middle"
-                data={[{ x: -1.8, y: -2.4, label: `${value}%`, style: LABEL_STYLE }]}
-            />
-
-            <ArcSeries
-                animate
-                center={{ x: -2, y: -2 }}
-                data={data}
-                colorType="literal"
-                radiusDomain={[0, 1.8]}
-            />
-        </XYPlot>
-    );
-};
-
-ArcSingle.propTypes = {
-    value: PropTypes.number.isRequired,
-};
-
-export default ArcSingle;
diff --git a/ui/apps/platform/src/Components/visuals/Sunburst.jsx b/ui/apps/platform/src/Components/visuals/Sunburst.jsx
index ee43137269dc6..eb5e3735e0416 100644
--- a/ui/apps/platform/src/Components/visuals/Sunburst.jsx
+++ b/ui/apps/platform/src/Components/visuals/Sunburst.jsx
@@ -149,7 +149,7 @@ class Sunburst extends Component {
             // TODO: factor out into dimension mapping
             width: this.props.small ? 200 : 265,
             height: this.props.small ? 200 : 271,
-            className: 'cursor-pointer pointer-events-none my-auto',
+            className: 'cursor-pointer pointer-events-none',
             onValueMouseOver: this.onValueMouseOverHandler,
             onValueMouseOut: this.onValueMouseOutHandler,
             onValueClick: this.onValueClickHandler,
diff --git a/ui/apps/platform/src/ConsolePlugin/PluginProvider.tsx b/ui/apps/platform/src/ConsolePlugin/PluginProvider.tsx
index 1e5a77209c5c6..daa73f3a77ffe 100644
--- a/ui/apps/platform/src/ConsolePlugin/PluginProvider.tsx
+++ b/ui/apps/platform/src/ConsolePlugin/PluginProvider.tsx
@@ -7,6 +7,7 @@ import configureApolloClient from 'init/configureApolloClient';
 import { setAnalyticsSource } from 'init/initializeAnalytics';
 import { UserPermissionProvider } from 'providers/UserPermissionProvider';
 import { FeatureFlagsProvider } from 'providers/FeatureFlagProvider';
+import { LightspeedStatusProvider } from 'providers/LightspeedStatusProvider';
 import { MetadataProvider } from 'providers/MetadataProvider';
 import { PublicConfigProvider } from 'providers/PublicConfigProvider';
 import { TelemetryConfigProvider } from 'providers/TelemetryConfigProvider';
@@ -46,7 +47,9 @@ function PluginProviderContent({ children }: { children: ReactNode }) {
                     <MetadataProvider>
                         <PublicConfigProvider>
                             <TelemetryConfigProvider>
-                                <PluginContent>{children}</PluginContent>
+                                <LightspeedStatusProvider>
+                                    <PluginContent>{children}</PluginContent>
+                                </LightspeedStatusProvider>
                             </TelemetryConfigProvider>
                         </PublicConfigProvider>
                     </MetadataProvider>
diff --git a/ui/apps/platform/src/ConsolePlugin/hooks/useDefaultWorkloadCveViewContext.ts b/ui/apps/platform/src/ConsolePlugin/hooks/useDefaultWorkloadCveViewContext.ts
index fdedeab2e5d30..10cb06cacf8ab 100644
--- a/ui/apps/platform/src/ConsolePlugin/hooks/useDefaultWorkloadCveViewContext.ts
+++ b/ui/apps/platform/src/ConsolePlugin/hooks/useDefaultWorkloadCveViewContext.ts
@@ -21,7 +21,7 @@ export function useDefaultWorkloadCveViewContext(): WorkloadCveView {
         const querySearchFilter = parseQuerySearchFilter(searchFilter);
         return {
             baseSearchFilter: {
-                'Image CVE Count': ['>0'],
+                'Vulnerability State': ['OBSERVED'],
                 Namespace:
                     activeNamespace === ALL_NAMESPACES_KEY
                         ? querySearchFilter.Namespace
diff --git a/ui/apps/platform/src/Containers/AccessControl/AuthProviders/AuthProviderForm.tsx b/ui/apps/platform/src/Containers/AccessControl/AuthProviders/AuthProviderForm.tsx
index 0a8f6e1c46578..620d4ca201152 100644
--- a/ui/apps/platform/src/Containers/AccessControl/AuthProviders/AuthProviderForm.tsx
+++ b/ui/apps/platform/src/Containers/AccessControl/AuthProviders/AuthProviderForm.tsx
@@ -93,7 +93,8 @@ function testModeSupported(provider) {
         provider.type === 'auth0' ||
         provider.type === 'oidc' ||
         provider.type === 'saml' ||
-        provider.type === 'openshift'
+        provider.type === 'openshift' ||
+        provider.type === 'openshift-with-acm-roles'
     );
 }
 
@@ -166,7 +167,7 @@ function AuthProviderForm({
             // eslint-disable-next-line @typescript-eslint/ban-ts-comment
             // @ts-ignore
             .when('type', {
-                is: 'oidc',
+                is: (type) => type === 'oidc',
                 then: (configSchema) =>
                     configSchema.shape({
                         client_id: yup.string().required('A client ID is required.'),
@@ -235,6 +236,14 @@ function AuthProviderForm({
                     configSchema.shape({
                         audience: yup.string().required('An audience is required.'),
                     }),
+            })
+            .when('type', {
+                is: 'openshift-with-acm-roles',
+                then: (configSchema) =>
+                    configSchema.shape({
+                        client_name: yup.string().required('A client name is required.'),
+                        client_secret: yup.string().required('A client secret is required.'),
+                    }),
             }),
     });
 
@@ -745,18 +754,56 @@ function AuthProviderForm({
                             />
                         </FormSection>
                     )}
-                    <FormSection title="Rules" titleElement="h2" className="pf-v6-u-mt-0">
-                        <RuleGroups
-                            authProviderId={selectedAuthProvider.id}
-                            groups={values.groups}
-                            roles={roles}
-                            onChange={onChange}
-                            setFieldValue={setFieldValue}
-                            disabled={isViewing}
-                            errors={errors?.groups as RuleGroupErrors[]}
-                            ruleAttributes={ruleAttributes}
-                        />
-                    </FormSection>
+                    {selectedAuthProvider.type !== 'openshift-with-acm-roles' && (
+                        <FormSection title="Rules" titleElement="h2" className="pf-v6-u-mt-0">
+                            <RuleGroups
+                                authProviderId={selectedAuthProvider.id}
+                                groups={values.groups}
+                                roles={roles}
+                                onChange={onChange}
+                                setFieldValue={setFieldValue}
+                                disabled={isViewing}
+                                errors={errors?.groups as RuleGroupErrors[]}
+                                ruleAttributes={ruleAttributes}
+                            />
+                        </FormSection>
+                    )}
+                    {selectedAuthProvider.type === 'openshift-with-acm-roles' && (
+                        <div id="acm-access-control-documentation">
+                            <Alert
+                                isInline
+                                variant="info"
+                                title="Note: this authentication provider only supports role configuration in Red Hat Advanced Cluster Management."
+                                component="p"
+                            >
+                                <p>
+                                    This requires Red Hat Advanced Cluster Management deployed on
+                                    the cluster where the central entity of Red Hat Advanced Cluster
+                                    Security is deployed.
+                                </p>
+                                <p>
+                                    Additionally, Red Hat Advanced Cluster Management must have
+                                    &apos;fine-grained role-based access control&apos; activated.
+                                </p>
+                                <p>
+                                    For further information on the role configuration, please refer
+                                    to the Red Hat Advanced Cluster Management documentation
+                                    (version &gt;= 2.16), area &apos;Secure clusters&apos;, section
+                                    &apos;Securing clusters&apos;, subsections &apos;Fine-grained
+                                    role-based access control for virtual machines&apos;,
+                                    &apos;Enabling fine-grained role-based access control for
+                                    virtualization&apos;, and the subsections related to
+                                    &apos;MulticlusterRoleAssignment&apos;.
+                                </p>
+                                <p>
+                                    The OpenShift ClusterRoles created to configure the Red Hat
+                                    Advanced Cluster Security access control need to have the label
+                                    &apos;clusterview.open-cluster-management.io/discoverable&apos;
+                                    present and set to &apos;true&apos;.
+                                </p>
+                            </Alert>
+                        </div>
+                    )}
                 </FormSection>
             </FormikProvider>
         </Form>
diff --git a/ui/apps/platform/src/Containers/AccessControl/AuthProviders/ConfigurationFormFields.tsx b/ui/apps/platform/src/Containers/AccessControl/AuthProviders/ConfigurationFormFields.tsx
index 7bb46917bd468..80a06cec29395 100644
--- a/ui/apps/platform/src/Containers/AccessControl/AuthProviders/ConfigurationFormFields.tsx
+++ b/ui/apps/platform/src/Containers/AccessControl/AuthProviders/ConfigurationFormFields.tsx
@@ -738,6 +738,56 @@ function ConfigurationFormFields({
                     </FormGroup>
                 </GridItem>
             )}
+            {type === 'openshift-with-acm-roles' && (
+                <>
+                    <GridItem span={12} lg={6}>
+                        <FormGroup label="Client Name" fieldId="config.client_name" isRequired>
+                            <TextInput
+                                type="text"
+                                id="config.client_name"
+                                value={(config.client_name as string) || ''}
+                                onChange={onChange}
+                                isDisabled={isViewing || isActiveModificationsDisabled}
+                                isRequired
+                                onBlur={onBlur}
+                            />
+                            <FormHelperText>
+                                <HelperText>
+                                    <HelperTextItem>
+                                        <span className="pf-v6-u-font-size-sm">
+                                            The name of the client registered in ACM for role
+                                            resolution
+                                        </span>
+                                    </HelperTextItem>
+                                </HelperText>
+                            </FormHelperText>
+                        </FormGroup>
+                    </GridItem>
+                    <GridItem span={12} lg={6}>
+                        <FormGroup label="Client Secret" fieldId="config.client_secret" isRequired>
+                            <TextInput
+                                type="password"
+                                id="config.client_secret"
+                                value={(config.client_secret as string) || ''}
+                                onChange={onChange}
+                                isDisabled={isViewing || isActiveModificationsDisabled}
+                                isRequired
+                                onBlur={onBlur}
+                                placeholder={isViewing ? '*****' : ''}
+                            />
+                            <FormHelperText>
+                                <HelperText>
+                                    <HelperTextItem>
+                                        <span className="pf-v6-u-font-size-sm">
+                                            The client secret for authenticating with ACM
+                                        </span>
+                                    </HelperTextItem>
+                                </HelperText>
+                            </FormHelperText>
+                        </FormGroup>
+                    </GridItem>
+                </>
+            )}
         </>
     );
 }
diff --git a/ui/apps/platform/src/Containers/AccessControl/AuthProviders/authProviders.utils.ts b/ui/apps/platform/src/Containers/AccessControl/AuthProviders/authProviders.utils.ts
index 603dd7cae4583..d0112a639b1f9 100644
--- a/ui/apps/platform/src/Containers/AccessControl/AuthProviders/authProviders.utils.ts
+++ b/ui/apps/platform/src/Containers/AccessControl/AuthProviders/authProviders.utils.ts
@@ -45,6 +45,18 @@ export function transformInitialValues(
             config: alteredConfig,
         };
     }
+    if (initialValues.type === 'openshift-with-acm-roles') {
+        const alteredConfig = { ...initialValues.config };
+
+        // backend doesn't return the exact value for the client secret for security reasons
+        // clean-up obfuscated value if any as we don't need to show it
+        alteredConfig.client_secret = '';
+
+        return {
+            ...initialValues,
+            config: alteredConfig,
+        };
+    }
     if (initialValues.type === 'saml') {
         const alteredConfig = { ...initialValues.config };
         // unless static config values are present, assume dynamic configuration is selected
diff --git a/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.cy.jsx b/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.cy.jsx
index 524b31099b97d..f8dfb7e4f543c 100644
--- a/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.cy.jsx
+++ b/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.cy.jsx
@@ -49,9 +49,59 @@ describe('BaseImagesModal', () => {
 
             cy.get('input#baseImagePath').type('ubuntu');
             cy.get('input#baseImagePath').blur();
-            cy.contains(
-                'Base image path must include both repository and tag separated by ":"'
-            ).should('be.visible');
+            cy.contains('Base image path must include a tag pattern after ":"').should(
+                'be.visible'
+            );
+            cy.contains('example-registry.io/path/to/image:tag').should('be.visible');
+            cy.contains('For registries with a port, use registry:port/repo:tag').should(
+                'be.visible'
+            );
+        });
+
+        it('should show error when the pattern is placed on the path of a registry with a port', () => {
+            const onClose = cy.stub();
+            const onSuccess = cy.stub();
+
+            cy.mount(
+                <TestWrapper>
+                    <BaseImagesModal isOpen onClose={onClose} onSuccess={onSuccess} />
+                </TestWrapper>
+            );
+
+            // Registry port colon must not be mistaken for the tag separator.
+            cy.get('input#baseImagePath').type('registry:5000/repo*');
+            cy.get('input#baseImagePath').blur();
+            cy.contains('Base image path must include a tag pattern after ":"').should(
+                'be.visible'
+            );
+        });
+
+        it('should reject invalid tag pattern characters', () => {
+            cy.mount(
+                <TestWrapper>
+                    <BaseImagesModal isOpen onClose={cy.stub()} onSuccess={cy.stub()} />
+                </TestWrapper>
+            );
+
+            cy.get('input#baseImagePath').type('registry:5000/repo:1.@bad');
+            cy.get('input#baseImagePath').blur();
+            cy.contains('Tag pattern must not contain "/", ":", "@", or whitespace').should(
+                'be.visible'
+            );
+            cy.findByRole('button', { name: 'Save' }).should('be.disabled');
+        });
+
+        it('should reject tag patterns longer than 128 bytes', () => {
+            cy.mount(
+                <TestWrapper>
+                    <BaseImagesModal isOpen onClose={cy.stub()} onSuccess={cy.stub()} />
+                </TestWrapper>
+            );
+
+            cy.get('input#baseImagePath').type(`ubuntu:${'a'.repeat(129)}`);
+            cy.get('input#baseImagePath').blur();
+            cy.contains('Tag pattern must be at most 128 bytes').should('be.visible');
+            cy.findByRole('button', { name: 'Save' }).should('be.disabled');
         });
 
         it('should enable save button when form is valid', () => {
diff --git a/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.tsx b/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.tsx
index b6c16d64d39e1..626eec8fa38f6 100644
--- a/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.tsx
+++ b/ui/apps/platform/src/Containers/BaseImages/BaseImagesModal.tsx
@@ -60,35 +60,63 @@ const addValidationSchema = yup.object({
     baseImagePath: yup
         .string()
         .required('Base image path is required')
-        .test(
-            'has-colon',
-            'Base image path must include both repository and tag separated by ":"',
-            (value) => {
-                if (!value?.includes(':')) {
-                    return false;
-                }
-                const lastColonIndex = value.lastIndexOf(':');
-                const tagPattern = value.substring(lastColonIndex + 1);
-                return tagPattern.length > 0;
+        .test('has-tag', 'Base image path must include a tag pattern after ":"', (value) => {
+            if (!value) {
+                return false;
+            }
+            const { tagPattern } = parseBaseImagePath(value);
+            return tagPattern.length > 0;
+        })
+        .test('valid-tag-pattern', function (value) {
+            if (!value) {
+                return true;
             }
-        ),
+            const { tagPattern } = parseBaseImagePath(value);
+            const error = tagPattern && getTagPatternError(tagPattern);
+            return error ? this.createError({ message: error }) : true;
+        }),
 });
 
 const editValidationSchema = yup.object({
-    baseImageTagPattern: yup.string().required('Tag pattern is required'),
+    baseImageTagPattern: yup
+        .string()
+        .required('Tag pattern is required')
+        .test('valid-tag-pattern', function (value) {
+            const error = value && getTagPatternError(value);
+            return error ? this.createError({ message: error }) : true;
+        }),
 });
 
 type AddFormData = yup.InferType<typeof addValidationSchema>;
 type EditFormData = yup.InferType<typeof editValidationSchema>;
 
+export function getTagPatternError(tagPattern: string): string | undefined {
+    if (new TextEncoder().encode(tagPattern).length > 128) {
+        return 'Tag pattern must be at most 128 bytes';
+    }
+    if (/[/:@\p{White_Space}]/u.test(tagPattern)) {
+        return 'Tag pattern must not contain "/", ":", "@", or whitespace';
+    }
+    return undefined;
+}
+
 /**
  * Parses a base image path into repository path and tag pattern.
- * Format: "docker.io/library/ubuntu:22.04" -> { repoPath: "docker.io/library/ubuntu", tagPattern: "22.04" }
+ * Only a colon in the final path segment separates the tag; a colon before the last
+ * "/" belongs to a registry port. Returns an empty tagPattern when no tag is present.
+ * Examples:
+ *   "docker.io/library/ubuntu:22.04"      -> { repoPath: "docker.io/library/ubuntu", tagPattern: "22.04" }
+ *   "registry:5000/library/ubuntu:1.*"    -> { repoPath: "registry:5000/library/ubuntu", tagPattern: "1.*" }
+ *   "registry:5000/library/ubuntu"        -> { repoPath: "registry:5000/library/ubuntu", tagPattern: "" }
  */
 export function parseBaseImagePath(path: string): { repoPath: string; tagPattern: string } {
-    const lastColonIndex = path.lastIndexOf(':');
-    const repoPath = path.substring(0, lastColonIndex);
-    const tagPattern = path.substring(lastColonIndex + 1);
+    const lastSlashIndex = path.lastIndexOf('/');
+    const tagColonIndex = path.indexOf(':', lastSlashIndex + 1);
+    if (tagColonIndex === -1) {
+        return { repoPath: path, tagPattern: '' };
+    }
+    const repoPath = path.substring(0, tagColonIndex);
+    const tagPattern = path.substring(tagColonIndex + 1);
     return { repoPath, tagPattern };
 }
 
@@ -298,8 +326,9 @@ function BaseImagesModal({
                                             )}
                                         <HelperTextItem>
                                             Include repository path and tag (e.g.,
-                                            example-registry.io/path/to/image:tag). Tag can be a
-                                            pattern (e.g., 1.*)
+                                            example-registry.io/path/to/image:tag). The tag can be a
+                                            pattern such as 1.*. For registries with a port, use
+                                            registry:port/repo:tag (e.g., registry:5000/repo:1.*).
                                         </HelperTextItem>
                                     </HelperText>
                                 </FormHelperText>
diff --git a/ui/apps/platform/src/Containers/BaseImages/parseBaseImagePath.test.ts b/ui/apps/platform/src/Containers/BaseImages/parseBaseImagePath.test.ts
index fa9243515bb4b..19845e80c91c9 100644
--- a/ui/apps/platform/src/Containers/BaseImages/parseBaseImagePath.test.ts
+++ b/ui/apps/platform/src/Containers/BaseImages/parseBaseImagePath.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
-import { parseBaseImagePath } from './BaseImagesModal';
+import { getTagPatternError, parseBaseImagePath } from './BaseImagesModal';
 
 describe('parseBaseImagePath', () => {
     it('should parse simple image path with single colon', () => {
@@ -29,4 +29,49 @@ describe('parseBaseImagePath', () => {
             tagPattern: '1.*',
         });
     });
+
+    it('should keep the tag pattern separate for a registry with a port', () => {
+        const result = parseBaseImagePath('registry:5000/library/ubuntu:1.*');
+
+        expect(result).toEqual({
+            repoPath: 'registry:5000/library/ubuntu',
+            tagPattern: '1.*',
+        });
+    });
+
+    it('should return an empty tag when a registry with a port has no tag', () => {
+        const result = parseBaseImagePath('registry:5000/library/ubuntu');
+
+        expect(result).toEqual({
+            repoPath: 'registry:5000/library/ubuntu',
+            tagPattern: '',
+        });
+    });
+
+    it('should return an empty tag when the pattern is placed on the path instead of the tag', () => {
+        const result = parseBaseImagePath('registry:5000/library/ubuntu*');
+
+        expect(result).toEqual({
+            repoPath: 'registry:5000/library/ubuntu*',
+            tagPattern: '',
+        });
+    });
+});
+
+describe('getTagPatternError', () => {
+    it('accepts a tag pattern at the length limit', () => {
+        expect(getTagPatternError('a'.repeat(128))).toBeUndefined();
+    });
+
+    it('rejects tag patterns longer than 128 bytes', () => {
+        expect(getTagPatternError('a'.repeat(129))).toBe('Tag pattern must be at most 128 bytes');
+    });
+
+    it('rejects repository separators and whitespace', () => {
+        ['repo/tag', 'port:tag', 'sha256@digest', '1. *', '1.\u00a0*'].forEach((pattern) => {
+            expect(getTagPatternError(pattern)).toBe(
+                'Tag pattern must not contain "/", ":", "@", or whitespace'
+            );
+        });
+    });
 });
diff --git a/ui/apps/platform/src/Containers/Clusters/ClusterDeployment.tsx b/ui/apps/platform/src/Containers/Clusters/ClusterDeployment.tsx
index 09ced24eb9003..7b1901b3c4ad2 100644
--- a/ui/apps/platform/src/Containers/Clusters/ClusterDeployment.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/ClusterDeployment.tsx
@@ -1,8 +1,15 @@
 import type { ReactElement } from 'react';
-import { Alert, Button, Content, Flex, FlexItem, Switch, Title } from '@patternfly/react-core';
+import {
+    Alert,
+    Button,
+    Content,
+    Flex,
+    FlexItem,
+    Spinner,
+    Switch,
+    Title,
+} from '@patternfly/react-core';
 import { DownloadIcon } from '@patternfly/react-icons';
-import { CheckCircle } from 'react-feather';
-import { ClipLoader } from 'react-spinners';
 
 import type { ClusterManagerType } from 'types/cluster.proto';
 import useAnalytics, { LEGACY_CLUSTER_DOWNLOAD_YAML } from 'hooks/useAnalytics';
@@ -110,29 +117,23 @@ function ClusterDeployment({
                     </Flex>
                 </Flex>
             )}
-            {(!editing || !clusterCheckedIn) && (
-                <div className="flex flex-col text-primary-500 p-4">
-                    {clusterCheckedIn ? (
-                        <div className="flex text-success-600 bg-success-200 border border-solid border-success-400 p-4 items-center">
-                            <div className="flex-1 text-center">
-                                <CheckCircle />
-                            </div>
-                            <div className="flex-3 pl-2">
-                                Success! The cluster has been recognized.
-                            </div>
-                        </div>
-                    ) : (
-                        <div className="flex text-primary-600 bg-primary-200 border border-solid border-primary-400 p-4 items-center">
-                            <div className="text-center px-4">
-                                <ClipLoader color="currentColor" loading size={20} />
-                            </div>
-                            <div className="flex-3 pl-2">
-                                Waiting for the cluster to check in successfully...
-                            </div>
-                        </div>
-                    )}
-                </div>
-            )}
+            {(!editing || !clusterCheckedIn) &&
+                (clusterCheckedIn ? (
+                    <Alert
+                        variant="success"
+                        isInline
+                        title="Success! The cluster has been recognized."
+                        component="p"
+                    />
+                ) : (
+                    <Alert
+                        variant="info"
+                        isInline
+                        title="Waiting for the cluster to check in successfully..."
+                        component="p"
+                        customIcon={<Spinner size="md" />}
+                    />
+                ))}
         </Flex>
     );
 }
diff --git a/ui/apps/platform/src/Containers/Clusters/ClusterLabelsConfigurationStatusSummary.tsx b/ui/apps/platform/src/Containers/Clusters/ClusterLabelsConfigurationStatusSummary.tsx
index 3426000b9f742..81b2b9b1be894 100644
--- a/ui/apps/platform/src/Containers/Clusters/ClusterLabelsConfigurationStatusSummary.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/ClusterLabelsConfigurationStatusSummary.tsx
@@ -3,7 +3,6 @@ import { Alert, Content, Flex, FlexItem, Title } from '@patternfly/react-core';
 import { Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
 
 import ExternalLink from 'Components/PatternFly/IconText/ExternalLink';
-import useFeatureFlags from 'hooks/useFeatureFlags';
 import useMetadata from 'hooks/useMetadata';
 import type { Cluster, ClusterManagerType, CompleteClusterConfig } from 'types/cluster.proto';
 import type { DecommissionedClusterRetentionInfo } from 'types/clusterService.proto';
@@ -41,8 +40,6 @@ function ClusterLabelsConfigurationStatusSummary({
     handleChange,
     handleChangeAdmissionControllerEnforcementBehavior,
 }: ClusterLabelsConfigurationStatusSummaryProps): ReactElement {
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isSensorCompatStatusEnabled = isFeatureFlagEnabled('ROX_SENSOR_COMPATIBILITY_STATUS');
     const metadata = useMetadata();
     const compatibleVersions = metadata?.compatibleSensorVersions ?? [];
 
@@ -165,14 +162,13 @@ function ClusterLabelsConfigurationStatusSummary({
                     >
                         <ClusterStatusGrid healthStatus={selectedCluster.healthStatus} />
                         <ClusterSummaryGrid
-                            centralVersion={centralVersion}
                             clusterInfo={selectedCluster}
                             clusterRetentionInfo={clusterRetentionInfo}
                         />
                     </Flex>
                 </Flex>
             )}
-            {selectedCluster.id && selectedCluster.status && isSensorCompatStatusEnabled && (
+            {selectedCluster.id && selectedCluster.status && (
                 <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsSm' }}>
                     <Title headingLevel="h2">Compatibility status</Title>
                     <SensorCompatibilityPanel
diff --git a/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterModal.tsx b/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterModal.tsx
index 8cde6f59163ed..8617becaec418 100644
--- a/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterModal.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterModal.tsx
@@ -1,44 +1,21 @@
-import { useState } from 'react';
 import type { ReactElement } from 'react';
-import {
-    Alert,
-    Button,
-    Divider,
-    Flex,
-    FlexItem,
-    Tab,
-    TabContent,
-    TabTitleText,
-    Tabs,
-} from '@patternfly/react-core';
+import { Alert, Button, Flex } from '@patternfly/react-core';
 import { Modal } from '@patternfly/react-core/deprecated';
 
-import SecureClusterUsingHelmChart from './SecureClusterUsingHelmChart';
 import SecureClusterUsingOperator from './SecureClusterUsingOperator';
 
-type TabKey = 'Operator' | 'Helm';
-
 const headingLevel = 'h2';
 
-const idHelm = 'SecureClusterUsingHelm';
-const idOperator = 'SecureClusterUsingOperator';
-
 export type SecureClusterModalProps = {
     isModalOpen: boolean;
     setIsModalOpen: (isOpen: boolean) => void;
 };
 
 function SecureClusterModal({ isModalOpen, setIsModalOpen }): ReactElement {
-    const [activeKey, setActiveKey] = useState<TabKey>('Operator');
-
     function onClose() {
         setIsModalOpen(false);
     }
 
-    function onSelect(_event, tabKey) {
-        setActiveKey(tabKey);
-    }
-
     return (
         <Modal
             variant="medium"
@@ -52,31 +29,7 @@ function SecureClusterModal({ isModalOpen, setIsModalOpen }): ReactElement {
             ]}
         >
             <Flex direction={{ default: 'column' }}>
-                <FlexItem>
-                    <Tabs activeKey={activeKey} onSelect={onSelect}>
-                        <Tab
-                            eventKey="Operator"
-                            tabContentId={idOperator}
-                            title={<TabTitleText>Operator</TabTitleText>}
-                        />
-                        <Tab
-                            eventKey="Helm"
-                            tabContentId={idHelm}
-                            title={<TabTitleText>Helm chart (deprecated)</TabTitleText>}
-                        />
-                    </Tabs>
-                    <Divider component="div" />
-                </FlexItem>
-                {activeKey === 'Operator' && (
-                    <TabContent id={idOperator}>
-                        <SecureClusterUsingOperator headingLevel={headingLevel} />
-                    </TabContent>
-                )}
-                {activeKey === 'Helm' && (
-                    <TabContent id={idHelm}>
-                        <SecureClusterUsingHelmChart headingLevel={headingLevel} />
-                    </TabContent>
-                )}
+                <SecureClusterUsingOperator headingLevel={headingLevel} />
                 <Alert
                     variant="info"
                     isInline
diff --git a/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterPage.tsx b/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterPage.tsx
index f22a1191cddef..0510e42f4ddef 100644
--- a/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterPage.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterPage.tsx
@@ -1,32 +1,16 @@
 import type { ReactElement } from 'react';
-import {
-    Alert,
-    Breadcrumb,
-    BreadcrumbItem,
-    PageSection,
-    Tab,
-    TabTitleText,
-    Tabs,
-    Title,
-} from '@patternfly/react-core';
+import { Alert, Breadcrumb, BreadcrumbItem, PageSection, Title } from '@patternfly/react-core';
 
 import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
 import PageTitle from 'Components/PageTitle';
-import useURLStringUnion from 'hooks/useURLStringUnion';
 import { clustersBasePath, clustersClusterRegistrationSecretsPath } from 'routePaths';
 
-import SecureClusterUsingHelmChart from './SecureClusterUsingHelmChart';
 import SecureClusterUsingOperator from './SecureClusterUsingOperator';
 
 const title = 'Secure a cluster with a cluster registration secret';
 const headingLevel = 'h2';
 
-const operatorTab = 'Operator';
-const helmChartTab = 'Helm chart';
-
 function SecureClusterPage(): ReactElement {
-    const [activeTabKey, setActiveTabKey] = useURLStringUnion('tab', [operatorTab, helmChartTab]);
-
     return (
         <>
             <PageTitle title="Secure a cluster" />
@@ -42,28 +26,8 @@ function SecureClusterPage(): ReactElement {
             <PageSection>
                 <Title headingLevel="h1">Secure a cluster with a cluster registration secret</Title>
             </PageSection>
-            <PageSection type="tabs">
-                <Tabs
-                    activeKey={activeTabKey}
-                    onSelect={(_event, tabKey) => setActiveTabKey(tabKey)}
-                    usePageInsets
-                    mountOnEnter
-                    unmountOnExit
-                >
-                    <Tab eventKey={operatorTab} title={<TabTitleText>{operatorTab}</TabTitleText>}>
-                        <PageSection>
-                            <SecureClusterUsingOperator headingLevel={headingLevel} />
-                        </PageSection>
-                    </Tab>
-                    <Tab
-                        eventKey={helmChartTab}
-                        title={<TabTitleText>Helm chart (deprecated)</TabTitleText>}
-                    >
-                        <PageSection>
-                            <SecureClusterUsingHelmChart headingLevel={headingLevel} />
-                        </PageSection>
-                    </Tab>
-                </Tabs>
+            <PageSection>
+                <SecureClusterUsingOperator headingLevel={headingLevel} />
             </PageSection>
             <PageSection>
                 <Alert
diff --git a/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterUsingHelmChart.tsx b/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterUsingHelmChart.tsx
deleted file mode 100644
index 0605bb6dcde15..0000000000000
--- a/ui/apps/platform/src/Containers/Clusters/ClusterRegistrationSecrets/SecureClusterUsingHelmChart.tsx
+++ /dev/null
@@ -1,105 +0,0 @@
-import type { ReactElement } from 'react';
-import {
-    ClipboardCopy,
-    ClipboardCopyButton,
-    CodeBlock,
-    CodeBlockAction,
-    CodeBlockCode,
-    Flex,
-    FlexItem,
-    List,
-    ListItem,
-    Title,
-} from '@patternfly/react-core';
-import useClipboardCopy from 'hooks/useClipboardCopy';
-
-import InstallMethodDeprecationAlert from '../Components/InstallMethodDeprecationAlert';
-
-const codeBlock = [
-    'helm install -n stackrox --create-namespace \\',
-    'stackrox-secured-cluster-services rhacs/secured-cluster-services \\',
-    '--set-file crs.file=<path/to/cluster-registration-secret.yaml> \\',
-    '--set clusterName=<name_of_the_secured_cluster> \\',
-    '--set centralEndpoint=<endpoint_of_central_service> \\',
-    '--set imagePullSecrets.username=<your redhat.com developer account username> \\',
-    '--set imagePullSecrets.password=<your redhat.com developer account password>',
-].join('\n');
-
-export type SecureClusterUsingHelmChartProps = {
-    headingLevel: 'h2' | 'h3';
-};
-
-function SecureClusterUsingHelmChart({
-    headingLevel,
-}: SecureClusterUsingHelmChartProps): ReactElement {
-    const subHeadingLevel = headingLevel === 'h2' ? 'h3' : 'h4';
-    const { wasCopied, copyToClipboard } = useClipboardCopy();
-
-    const actions = (
-        <CodeBlockAction>
-            <ClipboardCopyButton
-                aria-label="Copy command to clipboard"
-                id="ClipboardCopyButton"
-                onClick={() => copyToClipboard(codeBlock)}
-                variant="plain"
-            >
-                {wasCopied ? 'Copied to clipboard' : 'Copy to clipboard'}
-            </ClipboardCopyButton>
-        </CodeBlockAction>
-    );
-
-    return (
-        <Flex direction={{ default: 'column' }}>
-            <FlexItem spacer={{ default: 'spacerLg' }}>
-                <InstallMethodDeprecationAlert
-                    deprecationMessage={
-                        <>
-                            The <strong>rhacs/secured-cluster-services</strong> Helm chart is
-                            deprecated since version 4.11 and will be removed in 5.1.
-                        </>
-                    }
-                />
-            </FlexItem>
-            <Title headingLevel={subHeadingLevel}>Prerequisites</Title>
-            <List component="ul">
-                <ListItem>
-                    <p>
-                        You must have previously added the Helm chart repository, or add it using
-                        the following command:
-                    </p>
-                    <ClipboardCopy>
-                        helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
-                    </ClipboardCopy>
-                </ListItem>
-                <ListItem>
-                    <p>You must download the YAML file for a cluster registration secret.</p>
-                </ListItem>
-                <ListItem>
-                    <p>
-                        You must have access to the Red Hat Container Registry and a pull secret for
-                        authentication.
-                    </p>
-                </ListItem>
-                <ListItem>
-                    <p>
-                        You must have the address and the port number that you are exposing the
-                        Central service on.
-                    </p>
-                </ListItem>
-                <ListItem>
-                    <Flex
-                        direction={{ default: 'column' }}
-                        spaceItems={{ default: 'spaceItemsSm' }}
-                    >
-                        <p>Run a command similar to the following:</p>
-                        <CodeBlock actions={actions}>
-                            <CodeBlockCode>{codeBlock}</CodeBlockCode>
-                        </CodeBlock>
-                    </Flex>
-                </ListItem>
-            </List>
-        </Flex>
-    );
-}
-
-export default SecureClusterUsingHelmChart;
diff --git a/ui/apps/platform/src/Containers/Clusters/ClusterSummaryGrid.tsx b/ui/apps/platform/src/Containers/Clusters/ClusterSummaryGrid.tsx
index 4be2261ffa0d0..c76040587c4f9 100644
--- a/ui/apps/platform/src/Containers/Clusters/ClusterSummaryGrid.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/ClusterSummaryGrid.tsx
@@ -1,6 +1,5 @@
 import { Grid, GridItem } from '@patternfly/react-core';
 
-import useFeatureFlags from 'hooks/useFeatureFlags';
 import type { Cluster } from 'types/cluster.proto';
 import type { DecommissionedClusterRetentionInfo } from 'types/clusterService.proto';
 
@@ -8,24 +7,14 @@ import ClusterDeletion from './Components/ClusterDeletion';
 import ClusterHealthPanel from './Components/ClusterHealthPanel';
 import ClusterMetadata from './Components/ClusterMetadata';
 import CredentialExpiration from './Components/CredentialExpiration';
-import SensorCompatibilitySummary from './Components/SensorCompatibilitySummary';
-import SensorUpgradePanel from './Components/SensorUpgradePanel';
 import type { CertExpiryStatus } from './clusterTypes';
 
 type ClusterSummaryGridProps = {
-    centralVersion: string;
     clusterRetentionInfo: DecommissionedClusterRetentionInfo;
     clusterInfo: Cluster;
 };
 
-export function ClusterSummaryGrid({
-    centralVersion,
-    clusterRetentionInfo,
-    clusterInfo,
-}: ClusterSummaryGridProps) {
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isSensorCompatStatusEnabled = isFeatureFlagEnabled('ROX_SENSOR_COMPATIBILITY_STATUS');
-
+export function ClusterSummaryGrid({ clusterRetentionInfo, clusterInfo }: ClusterSummaryGridProps) {
     return (
         <Grid hasGutter>
             {clusterInfo.status && (
@@ -35,25 +24,6 @@ export function ClusterSummaryGrid({
                     </ClusterHealthPanel>
                 </GridItem>
             )}
-            {clusterInfo.status && !isSensorCompatStatusEnabled && (
-                <GridItem span={12} lg={6} xl={3} className="cluster-status-panel">
-                    {isSensorCompatStatusEnabled ? (
-                        <ClusterHealthPanel header="Sensor version">
-                            <SensorCompatibilitySummary
-                                compatibility={clusterInfo.status.sensorVersionCompatibility}
-                                sensorVersion={clusterInfo.status.sensorVersion}
-                                centralVersion={centralVersion}
-                            />
-                        </ClusterHealthPanel>
-                    ) : (
-                        <SensorUpgradePanel
-                            centralVersion={centralVersion}
-                            sensorVersion={clusterInfo.status?.sensorVersion}
-                            upgradeStatus={clusterInfo.status?.upgradeStatus}
-                        />
-                    )}
-                </GridItem>
-            )}
             {clusterInfo.status && (
                 <GridItem span={12} lg={6} xl={3} className="cluster-status-panel">
                     <ClusterHealthPanel header="Credential expiration">
diff --git a/ui/apps/platform/src/Containers/Clusters/ClustersTable.tsx b/ui/apps/platform/src/Containers/Clusters/ClustersTable.tsx
index 1498ace9eae49..e3b7079c0ec3f 100644
--- a/ui/apps/platform/src/Containers/Clusters/ClustersTable.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/ClustersTable.tsx
@@ -13,7 +13,6 @@ import {
 } from '@patternfly/react-table';
 
 import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
-import useFeatureFlags from 'hooks/useFeatureFlags';
 import useMetadata from 'hooks/useMetadata';
 import type { Cluster } from 'types/cluster.proto';
 import type { ClusterIdToRetentionInfo } from 'types/clusterService.proto';
@@ -28,8 +27,6 @@ import ClusterStatus from './Components/ClusterStatus';
 import CredentialExpiration from './Components/CredentialExpiration';
 import SensorCompatibility from './Components/SensorCompatibility';
 import SensorCompatibilityPanel from './Components/SensorCompatibilityPanel';
-import SensorUpgrade from './Components/SensorUpgrade';
-import SensorUpgradePanel from './Components/SensorUpgradePanel';
 
 export type ClustersTableProps = {
     centralVersion: string;
@@ -40,7 +37,6 @@ export type ClustersTableProps = {
     onDeleteCluster: (cluster: Cluster) => (event: MouseEvent) => void;
     toggleAllClusters: () => void;
     toggleCluster: (clusterId) => void;
-    upgradeSingleCluster: (clusterId: string) => void;
 };
 
 export const EXPANDABLE_COLUMN = {
@@ -60,16 +56,11 @@ function ClustersTable({
     onDeleteCluster,
     toggleAllClusters,
     toggleCluster,
-    upgradeSingleCluster,
 }: ClustersTableProps): ReactElement {
     const [expanded, setExpanded] = useState<ExpansionMap>({});
-    const { isFeatureFlagEnabled } = useFeatureFlags();
     const metadata = useMetadata();
     const compatibleVersions = metadata?.compatibleSensorVersions ?? [];
-    const isSensorCompatStatusEnabled = isFeatureFlagEnabled('ROX_SENSOR_COMPATIBILITY_STATUS');
-    const sensorColumnLabel = isSensorCompatStatusEnabled
-        ? 'Sensor compatibility status'
-        : 'Sensor upgrade status';
+    const sensorColumnLabel = 'Sensor compatibility status';
 
     function toggle(clusterId: string, col: ExpandableColumnId) {
         setExpanded((prev) => ({
@@ -176,38 +167,23 @@ function ClustersTable({
                                             </Td>
                                             <Td
                                                 dataLabel={sensorColumnLabel}
-                                                compoundExpand={
-                                                    clusterInfo?.status?.upgradeStatus
-                                                        ? {
-                                                              isExpanded: isCellExpanded(
-                                                                  clusterId,
-                                                                  EXPANDABLE_COLUMN.SENSOR
-                                                              ),
-                                                              onToggle: () =>
-                                                                  toggle(
-                                                                      clusterId,
-                                                                      EXPANDABLE_COLUMN.SENSOR
-                                                                  ),
-                                                              rowIndex,
-                                                              columnIndex: 4,
-                                                          }
-                                                        : undefined
-                                                }
+                                                compoundExpand={{
+                                                    isExpanded: isCellExpanded(
+                                                        clusterId,
+                                                        EXPANDABLE_COLUMN.SENSOR
+                                                    ),
+                                                    onToggle: () =>
+                                                        toggle(clusterId, EXPANDABLE_COLUMN.SENSOR),
+                                                    rowIndex,
+                                                    columnIndex: 4,
+                                                }}
                                             >
-                                                {isSensorCompatStatusEnabled ? (
-                                                    <SensorCompatibility
-                                                        compatibility={
-                                                            clusterInfo.status
-                                                                ?.sensorVersionCompatibility
-                                                        }
-                                                    />
-                                                ) : (
-                                                    <SensorUpgrade
-                                                        upgradeStatus={
-                                                            clusterInfo.status?.upgradeStatus
-                                                        }
-                                                    />
-                                                )}
+                                                <SensorCompatibility
+                                                    compatibility={
+                                                        clusterInfo.status
+                                                            ?.sensorVersionCompatibility
+                                                    }
+                                                />
                                             </Td>
                                             <Td dataLabel="Credential expiration">
                                                 {/* TODO: needs update for upgrade */}
@@ -260,38 +236,17 @@ function ClustersTable({
                                             <Tr isExpanded>
                                                 <Td colSpan={colSpan}>
                                                     <ExpandableRowContent>
-                                                        {isSensorCompatStatusEnabled ? (
-                                                            <SensorCompatibilityPanel
-                                                                compatibility={
-                                                                    clusterInfo.status
-                                                                        ?.sensorVersionCompatibility
-                                                                }
-                                                                compatibleVersions={
-                                                                    compatibleVersions
-                                                                }
-                                                                sensorVersion={
-                                                                    clusterInfo.status
-                                                                        ?.sensorVersion
-                                                                }
-                                                                centralVersion={centralVersion}
-                                                            />
-                                                        ) : (
-                                                            <SensorUpgradePanel
-                                                                centralVersion={centralVersion}
-                                                                sensorVersion={
-                                                                    clusterInfo.status
-                                                                        ?.sensorVersion ?? ''
-                                                                }
-                                                                upgradeStatus={
-                                                                    clusterInfo.status
-                                                                        ?.upgradeStatus
-                                                                }
-                                                                actionProps={{
-                                                                    clusterId: clusterInfo.id,
-                                                                    upgradeSingleCluster,
-                                                                }}
-                                                            />
-                                                        )}
+                                                        <SensorCompatibilityPanel
+                                                            compatibility={
+                                                                clusterInfo.status
+                                                                    ?.sensorVersionCompatibility
+                                                            }
+                                                            compatibleVersions={compatibleVersions}
+                                                            sensorVersion={
+                                                                clusterInfo.status?.sensorVersion
+                                                            }
+                                                            centralVersion={centralVersion}
+                                                        />
                                                     </ExpandableRowContent>
                                                 </Td>
                                             </Tr>
diff --git a/ui/apps/platform/src/Containers/Clusters/ClustersTablePanel.tsx b/ui/apps/platform/src/Containers/Clusters/ClustersTablePanel.tsx
index 60d9c982ac820..c8d61e46f520d 100644
--- a/ui/apps/platform/src/Containers/Clusters/ClustersTablePanel.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/ClustersTablePanel.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useReducer, useState } from 'react';
+import { useCallback, useEffect, useMemo, useState } from 'react';
 import { Link, useNavigate } from 'react-router-dom-v5-compat';
 import {
     Button,
@@ -15,7 +15,6 @@ import {
 } from '@patternfly/react-core';
 
 import MenuDropdown from 'Components/PatternFly/MenuDropdown';
-import CloseButton from 'Components/CloseButton';
 import CompoundSearchFilter from 'Components/CompoundSearchFilter/components/CompoundSearchFilter';
 import CompoundSearchFilterLabels from 'Components/CompoundSearchFilter/components/CompoundSearchFilterLabels';
 import {
@@ -34,16 +33,10 @@ import useInterval from 'hooks/useInterval';
 import useMetadata from 'hooks/useMetadata';
 import usePermissions from 'hooks/usePermissions';
 import useURLSearch from 'hooks/useURLSearch';
-import {
-    deleteClusters,
-    fetchClustersWithRetentionInfo,
-    upgradeCluster,
-    upgradeClusters,
-} from 'services/ClustersService';
+import { deleteClusters, fetchClustersWithRetentionInfo } from 'services/ClustersService';
 import type { Cluster } from 'types/cluster.proto';
 import type { ClusterIdToRetentionInfo } from 'types/clusterService.proto';
 import { getTableUIState } from 'utils/getTableUIState';
-import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
 import {
     applyRegexSearchModifiers,
     convertToRestSearch,
@@ -60,9 +53,8 @@ import {
 } from 'routePaths';
 
 import ClustersTable from './ClustersTable';
-import AutoUpgradeToggle from './Components/AutoUpgradeToggle';
 import SecureClusterModal from './ClusterRegistrationSecrets/SecureClusterModal';
-import { clusterTablePollingInterval, getUpgradeableClusters } from './cluster.helpers';
+import { clusterTablePollingInterval } from './cluster.helpers';
 import NoClustersPage from './NoClustersPage';
 import { searchFilterConfig } from './searchFilterConfig';
 
@@ -77,7 +69,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
 
     const { hasReadAccess, hasReadWriteAccess } = usePermissions();
     const hasReadAccessForAdministration = hasReadAccess('Administration');
-    const hasWriteAccessForAdministration = hasReadWriteAccess('Administration');
     const hasWriteAccessForCluster = hasReadWriteAccess('Cluster');
 
     const { currentUser } = useAuthStatus();
@@ -85,10 +76,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
 
     const [isModalOpen, setIsModalOpen] = useState(false);
 
-    const isSensorCompatibilityStatusEnabled = isFeatureFlagEnabled(
-        'ROX_SENSOR_COMPATIBILITY_STATUS'
-    );
-
     function onFocusInstallMenu() {
         const element = document.getElementById('toggle-descriptions');
         if (element !== null) {
@@ -115,7 +102,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
     );
 
     const [checkedClusterIds, setCheckedClusterIds] = useState<string[]>([]);
-    const [upgradableClusters, setUpgradableClusters] = useState<Cluster[]>([]);
     const [showDialog, setShowDialog] = useState(false);
     const [errorForClustersWithRetentionInfo, setErrorForClustersWithRetentionInfo] = useState<
         Error | undefined
@@ -132,41 +118,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
     const [clusterIdToRetentionInfo, setClusterIdToRetentionInfo] =
         useState<ClusterIdToRetentionInfo>({});
 
-    type NotificationAction = {
-        type: 'ADD_NOTIFICATION' | 'REMOVE_NOTIFICATION';
-        payload: string;
-    };
-
-    function notificationsReducer(state: string[], action: NotificationAction) {
-        switch (action.type) {
-            case 'ADD_NOTIFICATION': {
-                return [...state, action.payload];
-            }
-            case 'REMOVE_NOTIFICATION': {
-                return state.filter((note) => note !== action.payload);
-            }
-            default: {
-                return state;
-            }
-        }
-    }
-    const [notifications, dispatch] = useReducer(notificationsReducer, []);
-
-    const messages = notifications.map((note) => (
-        <div
-            key={note}
-            className="flex flex-1 border-b border-base-400 items-center justify-end relative py-0 pl-3 w-full"
-        >
-            <span className="w-full">{note}</span>
-            <CloseButton
-                onClose={() => {
-                    dispatch({ type: 'REMOVE_NOTIFICATION', payload: note });
-                }}
-                className="border-base-400 border-l"
-            />
-        </div>
-    ));
-
     const fetchClustersList = useCallback(
         (showLoadingSpinner: boolean) => {
             if (showLoadingSpinner) {
@@ -209,31 +160,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
         return <NoClustersPage isModalOpen={isModalOpen} setIsModalOpen={setIsModalOpen} />;
     }
 
-    function upgradeSingleCluster(id) {
-        upgradeCluster(id)
-            .then(() => {
-                fetchClustersList(true);
-            })
-            .catch((error) => {
-                const serverError = getAxiosErrorMessage(error);
-                const givenCluster = currentClusters.find((cluster) => cluster.id === id);
-                const clusterName = givenCluster ? givenCluster.name : '-';
-                const payload = `Failed to trigger upgrade for cluster ${clusterName}. Error: ${serverError}`;
-
-                dispatch({ type: 'ADD_NOTIFICATION', payload });
-            });
-    }
-
-    function upgradeSelectedClusters() {
-        // Although return works around typescript-eslint/no-floating-promises error,
-        // catch block would be better.
-        return upgradeClusters(checkedClusterIds).then(() => {
-            setCheckedClusterIds([]);
-
-            fetchClustersList(true);
-        });
-    }
-
     function deleteSelectedClusters() {
         setShowDialog(true);
     }
@@ -260,16 +186,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
             });
     }
 
-    function calculateUpgradeableClusters(selection) {
-        const currentlySelectedClusters = currentClusters.filter((cluster) =>
-            selection.includes(cluster.id)
-        );
-
-        const upgradeableList = getUpgradeableClusters(currentlySelectedClusters);
-
-        setUpgradableClusters(upgradeableList);
-    }
-
     const onDeleteHandler = (cluster: Cluster) => (e) => {
         e.stopPropagation();
         setCheckedClusterIds([cluster.id]);
@@ -282,7 +198,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
             : [...checkedClusterIds, id];
 
         setCheckedClusterIds(selection);
-        calculateUpgradeableClusters(selection);
     }
 
     function toggleAllClusters() {
@@ -293,7 +208,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
                 ? []
                 : currentClusters.map(({ id }) => id);
         setCheckedClusterIds(selection);
-        calculateUpgradeableClusters(selection);
     }
 
     // After there is a response, if there are clusters or search filter.
@@ -405,27 +319,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
                             }
                         />
                         <ToolbarGroup variant="action-group" align={{ default: 'alignEnd' }}>
-                            {!isSensorCompatibilityStatusEnabled &&
-                                hasWriteAccessForAdministration && (
-                                    <ToolbarItem className="pf-v6-u-align-self-center">
-                                        <AutoUpgradeToggle />
-                                    </ToolbarItem>
-                                )}
-                            {!isSensorCompatibilityStatusEnabled &&
-                                hasWriteAccessForAdministration && (
-                                    <ToolbarItem>
-                                        <Button
-                                            variant="secondary"
-                                            onClick={upgradeSelectedClusters}
-                                            isDisabled={
-                                                upgradableClusters.length === 0 ||
-                                                !!selectedClusterId
-                                            }
-                                        >
-                                            {`Upgrade (${upgradableClusters.length})`}
-                                        </Button>
-                                    </ToolbarItem>
-                                )}
                             {hasWriteAccessForCluster && (
                                 <ToolbarItem>
                                     <Button
@@ -450,11 +343,6 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
                         </ToolbarGroup>
                     </ToolbarContent>
                 </Toolbar>
-                {messages.length > 0 && (
-                    <div className="flex flex-col w-full items-center bg-warning-200 text-warning-8000 justify-center font-700 text-center">
-                        {messages}
-                    </div>
-                )}
                 <ClustersTable
                     centralVersion={metadata.version}
                     clusterIdToRetentionInfo={clusterIdToRetentionInfo}
@@ -464,11 +352,10 @@ function ClustersTablePanel({ selectedClusterId }: ClustersTablePanelProps) {
                     onDeleteCluster={onDeleteHandler}
                     toggleAllClusters={toggleAllClusters}
                     toggleCluster={toggleCluster}
-                    upgradeSingleCluster={upgradeSingleCluster}
                 />
             </PageSection>
             <Dialog
-                className="w-1/3"
+                className="pf-v6-u-w-50"
                 isOpen={showDialog}
                 text={`Deleting a cluster configuration doesn't remove security services running in the cluster. To remove them, run the "delete-sensor.sh" script from the sensor installation bundle. Are you sure you want to delete ${checkedClusterIds.length} cluster(s)?`}
                 onConfirm={makeDeleteRequest}
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/AdmissionControl/AdmissionControlStatus.tsx b/ui/apps/platform/src/Containers/Clusters/Components/AdmissionControl/AdmissionControlStatus.tsx
index 6f53ea6b91749..11d6143b63d20 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/AdmissionControl/AdmissionControlStatus.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/AdmissionControl/AdmissionControlStatus.tsx
@@ -25,7 +25,7 @@ function AdmissionControlStatus({ healthStatus }: AdmissionControlStatusProps):
     const { Icon, fgColor } = isDelayed
         ? delayedAdmissionControlStatusStyle
         : healthStatusStyles[admissionControlHealthStatus];
-    const icon = <Icon className="inline h-4 w-4" />;
+    const icon = <Icon />;
 
     const healthLabelElement = (
         <HealthLabelWithDelayed
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/AutoUpgradeToggle.tsx b/ui/apps/platform/src/Containers/Clusters/Components/AutoUpgradeToggle.tsx
deleted file mode 100644
index 2df692192a737..0000000000000
--- a/ui/apps/platform/src/Containers/Clusters/Components/AutoUpgradeToggle.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-import { useEffect, useState } from 'react';
-import type { ReactElement } from 'react';
-
-import { Switch } from '@patternfly/react-core';
-import {
-    getAutoUpgradeConfig,
-    isAutoUpgradeSupported,
-    saveAutoUpgradeConfig,
-} from 'services/ClustersService';
-import type { AutoUpgradeConfig } from 'services/ClustersService';
-
-function AutoUpgradeToggle(): ReactElement {
-    const [autoUpgradeConfig, setAutoUpgradeConfig] = useState<AutoUpgradeConfig | null>(null);
-
-    function fetchConfig(): void {
-        getAutoUpgradeConfig()
-            .then((config) => {
-                setAutoUpgradeConfig(config);
-            })
-            .catch(() => {
-                // TODO display message when there is a place for minor errors
-            });
-    }
-
-    useEffect(() => {
-        fetchConfig();
-    }, []);
-
-    if (!autoUpgradeConfig) {
-        return <></>;
-    }
-
-    if (!isAutoUpgradeSupported(autoUpgradeConfig)) {
-        return <>Automatic upgrades are disabled</>;
-    }
-
-    const toggleAutoUpgrade = (isChecked: boolean) => {
-        const previousValue = autoUpgradeConfig.enableAutoUpgrade;
-
-        const newConfig = {
-            ...autoUpgradeConfig,
-            enableAutoUpgrade: isChecked,
-        };
-
-        // optimistic UI update
-        setAutoUpgradeConfig(newConfig);
-
-        saveAutoUpgradeConfig(newConfig).catch(() => {
-            // rollback on failure
-            setAutoUpgradeConfig({
-                ...autoUpgradeConfig,
-                enableAutoUpgrade: previousValue,
-            });
-            fetchConfig();
-        });
-    };
-
-    return (
-        <Switch
-            id="enableAutoUpgrade"
-            label="Automatically upgrade secured clusters"
-            isChecked={autoUpgradeConfig.enableAutoUpgrade}
-            onChange={(_e, isChecked) => toggleAutoUpgrade(isChecked)}
-        />
-    );
-}
-
-export default AutoUpgradeToggle;
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/ClusterStatus.tsx b/ui/apps/platform/src/Containers/Clusters/Components/ClusterStatus.tsx
index 163406eceb2ee..821d000f85e02 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/ClusterStatus.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/ClusterStatus.tsx
@@ -14,7 +14,7 @@ function ClusterStatus({ healthStatus }: ClusterStatusProps): ReactElement {
     const { overallHealthStatus = 'UNAVAILABLE' } = healthStatus ?? {};
 
     const { Icon, fgColor } = healthStatusStyles[overallHealthStatus];
-    const icon = <Icon className="h-4 w-4" />;
+    const icon = <Icon />;
 
     return (
         <HealthStatus icon={icon} iconColor={fgColor}>
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatus.tsx b/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatus.tsx
index 168de2999f802..e849efff40397 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatus.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatus.tsx
@@ -26,7 +26,7 @@ function CollectorStatus({ healthStatus }: CollectorStatusProps): ReactElement {
     const { Icon, fgColor } = isDelayed
         ? delayedCollectorStatusStyle
         : healthStatusStyles[collectorHealthStatus];
-    const icon = <Icon className="inline h-4 w-4" />;
+    const icon = <Icon />;
 
     const statusElement = (
         <HealthLabelWithDelayed
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatusTotals.tsx b/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatusTotals.tsx
index 61ae5a36eb0ff..953c7a42d6aea 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatusTotals.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorStatusTotals.tsx
@@ -28,7 +28,7 @@ function CollectorStatusTotals({ collectorHealthInfo }: CollectorStatusTotalsPro
                     <th className={thClassName} scope="row">
                         Collector version:
                     </th>
-                    <td className={`${tdClassName} break-all`} data-testid="version">
+                    <td className={`${tdClassName} pf-v6-u-text-break-word`} data-testid="version">
                         {version || notAvailable}
                     </td>
                 </tr>
@@ -63,7 +63,7 @@ function CollectorStatusTotals({ collectorHealthInfo }: CollectorStatusTotalsPro
                                 {statusErrors.map((err) => (
                                     <li key={err}>
                                         <span
-                                            className={`${healthStatusStylesLegacy.UNHEALTHY.fgColor} break-all`}
+                                            className={`${healthStatusStylesLegacy.UNHEALTHY.fgColor} pf-v6-u-text-break-word`}
                                         >
                                             {err}
                                         </span>
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorUnavailableStatus.tsx b/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorUnavailableStatus.tsx
index 6b9d815bbcb79..7562a3b939037 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorUnavailableStatus.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/Collector/CollectorUnavailableStatus.tsx
@@ -24,7 +24,7 @@ function CollectorUnavailableStatus({
 
     return isList ? (
         <Tooltip content={reasonUnavailable}>
-            <div className="inline">
+            <div className="pf-v6-u-display-inline">
                 <HealthStatus icon={icon} iconColor={fgColor} isList={isList}>
                     {statusElement}
                 </HealthStatus>
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/CredentialExpiration.tsx b/ui/apps/platform/src/Containers/Clusters/Components/CredentialExpiration.tsx
index e43105b688cbe..c2e2821073e4e 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/CredentialExpiration.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/CredentialExpiration.tsx
@@ -36,13 +36,13 @@ function CredentialExpiration({
     // Adapt health status categories to certificate expiration.
     const healthStatus = getCredentialExpirationStatus(certExpiryStatus, currentDatetime);
     const { Icon, fgColor } = healthStatusStylesLegacy[healthStatus];
-    const icon = <Icon className="h-4 w-4" />;
+    const icon = <Icon />;
 
     // Order arguments according to date-fns@2 convention:
     // If sensorCertExpiry > currentDateTime: in X units
     // If sensorCertExpiry <= currentDateTime: X units ago
     const distanceElement = (
-        <span className="whitespace-nowrap">
+        <span className="pf-v6-u-text-nowrap">
             {getDistanceStrictAsPhrase(sensorCertExpiry, currentDatetime)}
         </span>
     );
@@ -68,7 +68,7 @@ function CredentialExpiration({
         expirationElement = (
             <div data-testid={testId}>
                 {distanceElement}{' '}
-                <span className="whitespace-nowrap">{`on ${
+                <span className="pf-v6-u-text-nowrap">{`on ${
                     diffInDays > 0 && diffInDays < 7
                         ? getDayOfWeek(sensorCertExpiry)
                         : getDate(sensorCertExpiry)
@@ -88,7 +88,7 @@ function CredentialExpiration({
                 <div>
                     {expirationElement}
                     {version && (
-                        <div className="flex flex-row items-end leading-tight">
+                        <div>
                             <ExternalLink>
                                 <a
                                     href={getVersionedDocs(
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/HealthLabelWithDelayed.tsx b/ui/apps/platform/src/Containers/Clusters/Components/HealthLabelWithDelayed.tsx
index ce9bd9c445beb..639fe7c2cc2e5 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/HealthLabelWithDelayed.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/HealthLabelWithDelayed.tsx
@@ -1,4 +1,5 @@
 import type { ReactElement } from 'react';
+import capitalize from 'lodash/capitalize';
 
 import { healthStatusLabels } from '../cluster.constants';
 import type { ClusterHealthItem, ClusterHealthItemStatus } from '../clusterTypes';
@@ -26,12 +27,12 @@ function HealthLabelWithDelayed({
     const healthLabelText = isList
         ? clusterHealthItem
         : healthStatusLabels[clusterHealthItemStatus];
-    const healthLabelElement = <span className="capitalize">{healthLabelText}</span>;
+    const healthLabelElement = <span>{capitalize(healthLabelText)}</span>;
     if (isDelayed) {
         return (
             <div data-testid={testId} className={`${isList ? 'inline' : ''}`}>
                 {healthLabelElement}
-                <span className="whitespace-nowrap">{` ${delayedText}`}</span>
+                <span className="pf-v6-u-text-nowrap">{` ${delayedText}`}</span>
             </div>
         );
     }
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/HealthStatus.tsx b/ui/apps/platform/src/Containers/Clusters/Components/HealthStatus.tsx
index f6170bde73d5e..9696c16472412 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/HealthStatus.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/HealthStatus.tsx
@@ -25,8 +25,14 @@ function HealthStatus({
 }: HealthStatusProps): ReactElement {
     return (
         // flex-row assumes a child element wraps multiple grandchildren
-        <div className={`leading-normal ${isList ? 'inline' : 'flex flex-row items-start'}`}>
-            <span className={`align-middle flex-shrink-0 mr-2 ${iconColor}`}>{icon}</span>
+        <div
+            className={
+                isList
+                    ? 'pf-v6-u-display-inline'
+                    : 'pf-v6-u-display-flex pf-v6-u-align-items-flex-start'
+            }
+        >
+            <span className={`pf-v6-u-flex-shrink-0 pf-v6-u-mr-sm ${iconColor}`}>{icon}</span>
             {children}
         </div>
     );
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/HealthStatusNotApplicable.tsx b/ui/apps/platform/src/Containers/Clusters/Components/HealthStatusNotApplicable.tsx
index 56ef23748f367..8459a896e6736 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/HealthStatusNotApplicable.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/HealthStatusNotApplicable.tsx
@@ -7,7 +7,7 @@ function HealthStatusNotApplicable({
     isList = false,
 }: HealthStatusNotApplicableProps): ReactElement {
     return (
-        <div className={`${isList ? 'inline' : ''} leading-normal`} data-testid={testId}>
+        <div className={isList ? 'pf-v6-u-display-inline' : ''} data-testid={testId}>
             <span className="pf-v6-u-text-nowrap">Not applicable</span>
         </div>
     );
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/HelmIndicator.tsx b/ui/apps/platform/src/Containers/Clusters/Components/HelmIndicator.tsx
index a893e8ad2d588..1b7c017aa060c 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/HelmIndicator.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/HelmIndicator.tsx
@@ -6,8 +6,8 @@ import HelmLogo from 'images/helm.svg?react';
 function HelmIndicator(): ReactElement {
     return (
         <Tooltip content="This cluster is managed by Helm.">
-            <span className="w-5 h-5 inline-block pf-v6-u-flex-shrink-0">
-                <HelmLogo className="w-5 h-5" />
+            <span className="pf-v6-u-display-inline-block pf-v6-u-flex-shrink-0">
+                <HelmLogo />
             </span>
         </Tooltip>
     );
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/OperatorIndicator.tsx b/ui/apps/platform/src/Containers/Clusters/Components/OperatorIndicator.tsx
index e8bff9412465f..4c058253db91a 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/OperatorIndicator.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/OperatorIndicator.tsx
@@ -6,9 +6,9 @@ import operatorLogo from 'images/operator-logo.png';
 function OperatorIndicator(): ReactElement {
     return (
         <Tooltip content="This cluster is managed by a Kubernetes Operator.">
-            <span className="w-5 h-5 inline-block pf-v6-u-flex-shrink-0">
+            <span className="pf-v6-u-display-inline-block pf-v6-u-flex-shrink-0">
                 <img
-                    className="w-5 h-5"
+                    style={{ width: '20px', height: '20px' }}
                     src={operatorLogo}
                     alt="Managed by a Kubernetes Operator"
                 />
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/Scanner/ScannerStatus.tsx b/ui/apps/platform/src/Containers/Clusters/Components/Scanner/ScannerStatus.tsx
index 61042f763b8d9..f51397e2fbafb 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/Scanner/ScannerStatus.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/Scanner/ScannerStatus.tsx
@@ -22,7 +22,7 @@ const ScannerStatus = ({ healthStatus }: ScannerStatusProps) => {
     const { Icon, fgColor } = isDelayed
         ? delayedScannerStatusStyle
         : healthStatusStyles[scannerHealthStatus];
-    const icon = <Icon className="inline h-4 w-4" />;
+    const icon = <Icon />;
 
     const healthLabelElement = (
         <HealthLabelWithDelayed
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/SensorCompatibilityPanel.tsx b/ui/apps/platform/src/Containers/Clusters/Components/SensorCompatibilityPanel.tsx
index fc728c67308f9..b456feb356741 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/SensorCompatibilityPanel.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/SensorCompatibilityPanel.tsx
@@ -135,7 +135,7 @@ function SensorCompatibilityPanel({
             <SensorCompatibilitySubPanel
                 header="Sensor version"
                 bodyItems={{
-                    version: ['Version', sensorVersion],
+                    version: ['Version', sensorVersion ?? 'Unknown'],
                     range: [
                         'Version range',
                         shouldShowSensorVersionRangeChart(compatibility, compatibleVersions) ? (
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/SensorCompatibilitySummary.tsx b/ui/apps/platform/src/Containers/Clusters/Components/SensorCompatibilitySummary.tsx
deleted file mode 100644
index f800891d95672..0000000000000
--- a/ui/apps/platform/src/Containers/Clusters/Components/SensorCompatibilitySummary.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-import {
-    DescriptionList,
-    DescriptionListDescription,
-    DescriptionListGroup,
-    DescriptionListTerm,
-} from '@patternfly/react-core';
-
-import useMetadata from 'hooks/useMetadata';
-import type { SensorVersionCompatibility } from 'types/cluster.proto';
-
-import { shouldShowSensorVersionRangeChart } from '../cluster.helpers';
-import SensorVersionRangeChart from './SensorVersionRangeChart';
-
-type SensorCompatibilitySummaryProps = {
-    compatibility?: SensorVersionCompatibility;
-    sensorVersion: string;
-    centralVersion: string;
-};
-
-function SensorCompatibilitySummary({
-    compatibility,
-    sensorVersion,
-    centralVersion,
-}: SensorCompatibilitySummaryProps) {
-    const { compatibleSensorVersions = [] } = useMetadata();
-
-    const showChart = shouldShowSensorVersionRangeChart(compatibility, compatibleSensorVersions);
-
-    return (
-        <DescriptionList>
-            <DescriptionListGroup>
-                <DescriptionListTerm>Version</DescriptionListTerm>
-                <DescriptionListDescription>
-                    {sensorVersion || 'Unknown'}
-                </DescriptionListDescription>
-            </DescriptionListGroup>
-            {showChart && (
-                <DescriptionListGroup>
-                    <DescriptionListTerm>Version range</DescriptionListTerm>
-                    <DescriptionListDescription>
-                        <SensorVersionRangeChart
-                            compatibleVersions={compatibleSensorVersions}
-                            sensorVersion={sensorVersion}
-                            centralVersion={centralVersion}
-                            compatibility={compatibility}
-                        />
-                    </DescriptionListDescription>
-                </DescriptionListGroup>
-            )}
-        </DescriptionList>
-    );
-}
-
-export default SensorCompatibilitySummary;
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/SensorStatus.tsx b/ui/apps/platform/src/Containers/Clusters/Components/SensorStatus.tsx
index 7b3ce9492a4c0..9bb13bd9e81e2 100644
--- a/ui/apps/platform/src/Containers/Clusters/Components/SensorStatus.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/Components/SensorStatus.tsx
@@ -21,7 +21,7 @@ function SensorStatus({ healthStatus }: SensorStatusProps): ReactElement {
 
     const isDelayed = !!(lastContact && isDelayedSensorHealthStatus(sensorHealthStatus));
     const { Icon, fgColor } = healthStatusStyles[sensorHealthStatus];
-    const icon = <Icon className="inline h-4 w-4" />;
+    const icon = <Icon />;
 
     const statusElement = (
         <HealthLabelWithDelayed
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/SensorUpgrade.tsx b/ui/apps/platform/src/Containers/Clusters/Components/SensorUpgrade.tsx
deleted file mode 100644
index a5f6f9b7bcf68..0000000000000
--- a/ui/apps/platform/src/Containers/Clusters/Components/SensorUpgrade.tsx
+++ /dev/null
@@ -1,34 +0,0 @@
-import type { ReactElement } from 'react';
-
-import HealthStatus from './HealthStatus';
-import HealthStatusNotApplicable from './HealthStatusNotApplicable';
-import { findUpgradeState, sensorUpgradeStyles } from '../cluster.helpers';
-import type { SensorUpgradeStatus } from '../clusterTypes';
-
-const testId = 'sensorUpgrade';
-
-type SensorUpgradeProps = {
-    upgradeStatus?: SensorUpgradeStatus;
-};
-
-function SensorUpgrade({ upgradeStatus }: SensorUpgradeProps): ReactElement {
-    if (upgradeStatus) {
-        const upgradeStateObject = findUpgradeState(upgradeStatus);
-        if (upgradeStateObject) {
-            const { displayValue, type } = upgradeStateObject;
-
-            const { Icon, fgColor } = sensorUpgradeStyles[type];
-            const icon = <Icon className="h-4 w-4" />;
-
-            return (
-                <HealthStatus icon={icon} iconColor={fgColor}>
-                    <div data-testid={testId}>{displayValue}</div>
-                </HealthStatus>
-            );
-        }
-    }
-
-    return <HealthStatusNotApplicable testId={testId} />;
-}
-
-export default SensorUpgrade;
diff --git a/ui/apps/platform/src/Containers/Clusters/Components/SensorUpgradePanel.tsx b/ui/apps/platform/src/Containers/Clusters/Components/SensorUpgradePanel.tsx
deleted file mode 100644
index 3c0dfb1505009..0000000000000
--- a/ui/apps/platform/src/Containers/Clusters/Components/SensorUpgradePanel.tsx
+++ /dev/null
@@ -1,107 +0,0 @@
-import {
-    Button,
-    DescriptionList,
-    DescriptionListDescription,
-    DescriptionListGroup,
-    DescriptionListTerm,
-    Divider,
-    Panel,
-    PanelHeader,
-    PanelMain,
-    PanelMainBody,
-} from '@patternfly/react-core';
-import upperFirst from 'lodash/upperFirst';
-
-import { findUpgradeState } from '../cluster.helpers';
-import SensorUpgrade from './SensorUpgrade';
-import type { SensorUpgradeStatus } from '../clusterTypes';
-
-export type SensorUpgradePanelProps = {
-    actionProps?: {
-        clusterId: string;
-        upgradeSingleCluster: (clusterId: string) => void;
-    };
-    centralVersion: string;
-    sensorVersion: string;
-    upgradeStatus?: SensorUpgradeStatus;
-};
-
-function SensorUpgradePanel({
-    centralVersion,
-    sensorVersion,
-    upgradeStatus,
-    actionProps,
-}: SensorUpgradePanelProps) {
-    const { upgradabilityStatusReason, mostRecentProcess } = upgradeStatus ?? {
-        upgradabilityStatusReason: '',
-        mostRecentProcess: undefined,
-    };
-
-    const upgradeState = findUpgradeState(upgradeStatus);
-
-    const statusReason =
-        upgradeState?.type === 'failure'
-            ? (mostRecentProcess?.progress?.upgradeStatusDetail ?? '')
-            : upperFirst(upgradabilityStatusReason);
-
-    return (
-        <Panel variant="bordered">
-            <PanelHeader>Sensor upgrade status</PanelHeader>
-            <Divider />
-            <PanelMain>
-                <PanelMainBody>
-                    <DescriptionList>
-                        <DescriptionListGroup>
-                            <DescriptionListTerm>Status</DescriptionListTerm>
-                            <DescriptionListDescription>
-                                <SensorUpgrade upgradeStatus={upgradeStatus} />
-                            </DescriptionListDescription>
-                        </DescriptionListGroup>
-                        {statusReason && (
-                            <DescriptionListGroup>
-                                <DescriptionListTerm>Sensor information</DescriptionListTerm>
-                                <DescriptionListDescription>
-                                    {statusReason}
-                                </DescriptionListDescription>
-                            </DescriptionListGroup>
-                        )}
-                        {actionProps && (
-                            <DescriptionListGroup>
-                                <DescriptionListTerm>Available action</DescriptionListTerm>
-                                <DescriptionListDescription>
-                                    {upgradeState?.actionText ? (
-                                        <Button
-                                            isInline
-                                            onClick={() => {
-                                                actionProps.upgradeSingleCluster(
-                                                    actionProps.clusterId
-                                                );
-                                            }}
-                                            variant="secondary"
-                                        >
-                                            {upgradeState.actionText}
-                                        </Button>
-                                    ) : (
-                                        'None'
-                                    )}
-                                </DescriptionListDescription>
-                            </DescriptionListGroup>
-                        )}
-                        <DescriptionListGroup>
-                            <DescriptionListTerm>Sensor version</DescriptionListTerm>
-                            <DescriptionListDescription>{sensorVersion}</DescriptionListDescription>
-                        </DescriptionListGroup>
-                        <DescriptionListGroup>
-                            <DescriptionListTerm>Central version</DescriptionListTerm>
-                            <DescriptionListDescription>
-                                {centralVersion}
-                            </DescriptionListDescription>
-                        </DescriptionListGroup>
-                    </DescriptionList>
-                </PanelMainBody>
-            </PanelMain>
-        </Panel>
-    );
-}
-
-export default SensorUpgradePanel;
diff --git a/ui/apps/platform/src/Containers/Clusters/cluster.helpers.test.js b/ui/apps/platform/src/Containers/Clusters/cluster.helpers.test.js
index ddcfd9b3d60d0..3ae22d3035da6 100644
--- a/ui/apps/platform/src/Containers/Clusters/cluster.helpers.test.js
+++ b/ui/apps/platform/src/Containers/Clusters/cluster.helpers.test.js
@@ -1,10 +1,8 @@
 import {
-    findUpgradeState,
     formatBuildDate,
     formatCloudProvider,
     formatKubernetesVersion,
     getCredentialExpirationStatus,
-    getUpgradeableClusters,
 } from './cluster.helpers';
 
 describe('cluster helpers', () => {
@@ -200,423 +198,6 @@ describe('cluster helpers', () => {
         });
     });
 
-    describe('getUpgradeableClusters', () => {
-        it('should return 0 when no clusters are unpgradeable', () => {
-            const clusters = [
-                {
-                    id: 'f7ae6b5f-6329-4ed9-a439-83181991a526',
-                    name: 'K8S',
-                    status: {
-                        upgradeStatus: {
-                            upgradability: 'UP_TO_DATE',
-                            mostRecentProcess: {
-                                active: false,
-                                progress: {
-                                    upgradeState: 'UPGRADE_COMPLETE',
-                                },
-                            },
-                        },
-                    },
-                },
-                {
-                    id: '26eac883-1f09-4123-971b-8b00ee63f5fd',
-                    name: 'remote1',
-                    status: {
-                        upgradeStatus: {
-                            upgradability: 'UP_TO_DATE',
-                            mostRecentProcess: {
-                                active: false,
-                                progress: {
-                                    upgradeState: 'UPGRADE_COMPLETE',
-                                },
-                            },
-                        },
-                    },
-                },
-            ];
-
-            const upgradeableClusters = getUpgradeableClusters(clusters);
-
-            expect(upgradeableClusters.length).toEqual(0);
-        });
-
-        it('should the number of ugradeable clusters', () => {
-            const clusters = [
-                {
-                    id: 'f7ae6b5f-6329-4ed9-a439-83181991a526',
-                    name: 'K8S',
-                    status: {
-                        upgradeStatus: {
-                            upgradability: 'UP_TO_DATE',
-                            mostRecentProcess: {
-                                active: false,
-                                progress: {
-                                    upgradeState: 'UPGRADE_COMPLETE',
-                                },
-                            },
-                        },
-                    },
-                },
-                {
-                    id: '26eac883-1f09-4123-971b-8b00ee63f5fd',
-                    name: 'remote1',
-                    status: {
-                        upgradeStatus: {
-                            upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                            mostRecentProcess: {
-                                active: false,
-                                progress: {
-                                    upgradeState: 'UPGRADE_COMPLETE',
-                                },
-                            },
-                        },
-                    },
-                },
-            ];
-
-            const upgradeableClusters = getUpgradeableClusters(clusters);
-
-            expect(upgradeableClusters.length).toEqual(1);
-        });
-    });
-
-    describe('findUpgradeState', () => {
-        it('should return null if upgradeStatus is null', () => {
-            const testUpgradeStatus = null;
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            expect(received).toEqual(null);
-        });
-
-        it('should return "Up to date with Central" if upgradeStatus -> upgradability is UP_TO_DATE', () => {
-            const testUpgradeStatus = {
-                upgradability: 'UP_TO_DATE',
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = { displayValue: 'Up to date with Central', type: 'current' };
-            expect(received).toEqual(expected);
-        });
-
-        it(`should return "Sensor is not running the same version as Central" if upgradeStatus -> upgradability is MANUAL_UPGRADE_REQUIRED`, () => {
-            const testUpgradeStatus = {
-                upgradability: 'MANUAL_UPGRADE_REQUIRED',
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Sensor is not running the same version as Central',
-                type: 'intervention',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Downgrade possible" if there is no mostRecentProcess', () => {
-            const testUpgradeStatus = {
-                upgradability: 'SENSOR_VERSION_HIGHER',
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Downgrade possible',
-                type: 'download',
-                actionText: 'Downgrade sensor',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade available" if there is no mostRecentProcess', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Upgrade available',
-                type: 'download',
-                actionText: 'Upgrade sensor',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade available" if upgradeStatus -> upgradability is AUTO_UPGRADE_POSSIBLE but mostRecentProgress is not active and is COMPLETE', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: false,
-                    progress: {
-                        upgradeState: 'UPGRADE_COMPLETE',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Upgrade available',
-                type: 'download',
-                actionText: 'Upgrade sensor',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should print the error (and "Retry Upgrade") if upgradeStatus -> upgradability is AUTO_UPGRADE_POSSIBLE but mostRecentProgress is not active and failed', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: false,
-                    progress: {
-                        upgradeState: 'PRE_FLIGHT_CHECKS_FAILED',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Pre-flight checks failed',
-                type: 'failure',
-                actionText: 'Retry upgrade',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade initializing" if upgradeStatus -> upgradability is AUTO_UPGRADE_POSSIBLE and upgradeState is UPGRADE_INITIALIZING', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADE_INITIALIZING',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Upgrade initializing',
-                type: 'progress',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrader launching" if upgradeState is UPGRADER_LAUNCHING', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADER_LAUNCHING',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = { displayValue: 'Upgrader launching', type: 'progress' };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrader launched" if upgradeState is UPGRADER_LAUNCHED', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADER_LAUNCHED',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = { displayValue: 'Upgrader launched', type: 'progress' };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Pre-flight checks complete" if upgradeState is PRE_FLIGHT_CHECKS_COMPLETE', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'PRE_FLIGHT_CHECKS_COMPLETE',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = { displayValue: 'Pre-flight checks complete', type: 'progress' };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Pre-flight checks failed." if upgradeState is PRE_FLIGHT_CHECKS_FAILED', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'PRE_FLIGHT_CHECKS_FAILED',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Pre-flight checks failed',
-                type: 'failure',
-                actionText: 'Retry upgrade',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade Operations Done" if upgradeState is UPGRADE_OPERATIONS_DONE', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADE_OPERATIONS_DONE',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = { displayValue: 'Upgrade operations done', type: 'progress' };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade Operations Complete" if upgradeState is UPGRADE_COMPLETE', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADE_COMPLETE',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = { displayValue: 'Upgrade complete', type: 'current' };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade failed. Rolled back." if upgradeState is UPGRADE_ERROR_ROLLED_BACK', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADE_ERROR_ROLLED_BACK',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Upgrade failed. Rolled back.',
-                type: 'failure',
-                actionText: 'Retry upgrade',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade failed. Rollback failed." if upgradeState is UPGRADE_ERROR_ROLLBACK_FAILED', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADE_ERROR_ROLLBACK_FAILED',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Upgrade failed. Rollback failed.',
-                type: 'failure',
-                actionText: 'Retry upgrade',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade timed out." if upgradeState is UPGRADE_TIMED_OUT', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADE_TIMED_OUT',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Upgrade timed out.',
-                type: 'failure',
-                actionText: 'Retry upgrade',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Upgrade error unknown." if upgradeState is UPGRADE_ERROR_UNKNOWN', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'UPGRADE_ERROR_UNKNOWN',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Upgrade error unknown',
-                type: 'failure',
-                actionText: 'Retry upgrade',
-            };
-            expect(received).toEqual(expected);
-        });
-
-        it('should return "Unknown upgrade state. Contact Support." if upgradeState does not match known progress', () => {
-            const testUpgradeStatus = {
-                upgradability: 'AUTO_UPGRADE_POSSIBLE',
-                mostRecentProcess: {
-                    active: true,
-                    progress: {
-                        upgradeState: 'SNAFU',
-                    },
-                },
-            };
-
-            const received = findUpgradeState(testUpgradeStatus);
-
-            const expected = {
-                displayValue: 'Unknown upgrade state. Contact Support.',
-                type: 'intervention',
-            };
-            expect(received).toEqual(expected);
-        });
-    });
-
     describe('get credential expiration status', () => {
         it('should return HEALTHY when more than a month before expiration', () => {
             const status = getCredentialExpirationStatus(
diff --git a/ui/apps/platform/src/Containers/Clusters/cluster.helpers.tsx b/ui/apps/platform/src/Containers/Clusters/cluster.helpers.tsx
index 351aa82177115..50034af032aba 100644
--- a/ui/apps/platform/src/Containers/Clusters/cluster.helpers.tsx
+++ b/ui/apps/platform/src/Containers/Clusters/cluster.helpers.tsx
@@ -1,12 +1,9 @@
 import { differenceInDays, differenceInMinutes } from 'date-fns';
-import get from 'lodash/get';
-import { DownloadCloud } from 'react-feather';
 import {
     BanIcon,
     CheckCircleIcon,
     ExclamationCircleIcon,
     ExclamationTriangleIcon,
-    InProgressIcon,
     InfoCircleIcon,
     MinusCircleIcon,
     ResourcesEmptyIcon,
@@ -14,7 +11,6 @@ import {
 } from '@patternfly/react-icons';
 
 import type {
-    Cluster,
     ClusterHealthStatusLabel,
     ClusterProviderMetadata,
     SensorVersionCompatibility,
@@ -110,16 +106,8 @@ export const centralEnvDefault = {
     kernelSupportAvailable: false,
 };
 
-type MinusCircleRotate45Props = {
-    className: string;
-};
-
-const MinusCircleRotate45 = ({ className }: MinusCircleRotate45Props) => (
-    <MinusCircleIcon className={`${className} transform rotate-45`} />
-);
-
 const styleUninitializedLegacy = {
-    Icon: MinusCircleRotate45,
+    Icon: MinusCircleIcon,
     fgColor: '',
 };
 
@@ -187,20 +175,6 @@ export const delayedScannerStatusStyle = {
     fgColor: '',
 };
 
-export const sensorUpgradeStyles = {
-    current: styleHealthy,
-    progress: {
-        Icon: InProgressIcon,
-        fgColor: 'pf-v6-u-icon-color-primary',
-    },
-    download: {
-        Icon: DownloadCloud,
-        fgColor: 'pf-v6-u-text-color-link',
-    },
-    intervention: styleDegraded,
-    failure: styleUnhealthy,
-};
-
 export const sensorCompatibilityMap = {
     SENSOR_VERSION_COMPATIBILITY_MATCHED: {
         displayValue: 'Matched',
@@ -243,97 +217,6 @@ export const sensorCompatibilityMap = {
 export type SensorCompatibilityInfo =
     (typeof sensorCompatibilityMap)[keyof typeof sensorCompatibilityMap];
 
-type UpgradeState = {
-    displayValue: string;
-    type: string;
-    actionText?: string;
-};
-type UpgradeStates = Record<string, UpgradeState>;
-
-// @TODO: add optional button text and func
-const upgradeStates: UpgradeStates = {
-    UP_TO_DATE: {
-        displayValue: 'Up to date with Central',
-        type: 'current',
-    },
-    MANUAL_UPGRADE_REQUIRED: {
-        displayValue: 'Sensor is not running the same version as Central',
-        type: 'intervention',
-    },
-    UPGRADE_AVAILABLE: {
-        displayValue: 'Upgrade available',
-        type: 'download',
-        actionText: 'Upgrade sensor',
-    },
-    DOWNGRADE_POSSIBLE: {
-        displayValue: 'Downgrade possible',
-        type: 'download',
-        actionText: 'Downgrade sensor',
-    },
-    UPGRADE_INITIALIZING: {
-        displayValue: 'Upgrade initializing',
-        type: 'progress',
-    },
-    UPGRADER_LAUNCHING: {
-        displayValue: 'Upgrader launching',
-        type: 'progress',
-    },
-    UPGRADER_LAUNCHED: {
-        displayValue: 'Upgrader launched',
-        type: 'progress',
-    },
-    PRE_FLIGHT_CHECKS_COMPLETE: {
-        displayValue: 'Pre-flight checks complete',
-        type: 'progress',
-    },
-    UPGRADE_OPERATIONS_DONE: {
-        displayValue: 'Upgrade operations done',
-        type: 'progress',
-    },
-    UPGRADE_COMPLETE: {
-        displayValue: 'Upgrade complete',
-        type: 'current',
-    },
-    UPGRADE_INITIALIZATION_ERROR: {
-        displayValue: 'Upgrade initialization error',
-        type: 'failure',
-        actionText: 'Retry upgrade',
-    },
-    PRE_FLIGHT_CHECKS_FAILED: {
-        displayValue: 'Pre-flight checks failed',
-        type: 'failure',
-        actionText: 'Retry upgrade',
-    },
-    UPGRADE_ERROR_ROLLING_BACK: {
-        displayValue: 'Upgrade failed. Rolling back…',
-        type: 'failure',
-    },
-    UPGRADE_ERROR_ROLLED_BACK: {
-        displayValue: 'Upgrade failed. Rolled back.',
-        type: 'failure',
-        actionText: 'Retry upgrade',
-    },
-    UPGRADE_ERROR_ROLLBACK_FAILED: {
-        displayValue: 'Upgrade failed. Rollback failed.',
-        type: 'failure',
-        actionText: 'Retry upgrade',
-    },
-    UPGRADE_TIMED_OUT: {
-        displayValue: 'Upgrade timed out.',
-        type: 'failure',
-        actionText: 'Retry upgrade',
-    },
-    UPGRADE_ERROR_UNKNOWN: {
-        displayValue: 'Upgrade error unknown',
-        type: 'failure',
-        actionText: 'Retry upgrade',
-    },
-    unknown: {
-        displayValue: 'Unknown upgrade state. Contact Support.',
-        type: 'intervention',
-    },
-};
-
 export function formatKubernetesVersion(orchestratorMetadata: { version: string }) {
     return orchestratorMetadata?.version || 'Not available';
 }
@@ -430,160 +313,6 @@ export const isCertificateExpiringSoon = (
 export const isDelayedSensorHealthStatus = (sensorHealthStatus) =>
     sensorHealthStatus === 'UNHEALTHY' || sensorHealthStatus === 'DEGRADED';
 
-export function formatUpgradeMessage(upgradeStateObject, detail) {
-    if (upgradeStateObject.type === 'current') {
-        return null;
-    }
-    const message = {
-        message:
-            upgradeStateObject.displayValue || upgradeStateObject.actionText || 'Unknown status',
-        type: '',
-        detail,
-    };
-    switch (upgradeStateObject.type) {
-        case 'failure': {
-            message.type = 'error';
-            break;
-        }
-        case 'intervention': {
-            message.type = 'warn';
-            break;
-        }
-        default: {
-            message.type = 'info';
-        }
-    }
-    return message;
-}
-
-// This function looks at a cluster upgrade status, and figures out whether the most recent
-// upgrade has any information that is of relevance to the user.
-function hasRelevantInformationFromMostRecentUpgrade(upgradeStatus) {
-    // No information from the most recent upgrade -- probably means no upgrade has been done before.
-    // Not interesting.
-    if (get(upgradeStatus, 'mostRecentProcess', null) === null) {
-        return false;
-    }
-    const isActive = get(upgradeStatus, 'mostRecentProcess.active', false);
-    // The upgrade is currently active. Definitely show the user information about it.
-    if (isActive) {
-        return true;
-    }
-
-    // The upgrade is not active. This means that this is the most recently completed upgrade.
-    // If it was COMPLETE, the information is not interesting to the user.
-    // Else, we show the user the information.
-    return (
-        get(upgradeStatus, 'mostRecentProcess.progress.upgradeState', undefined) !==
-        'UPGRADE_COMPLETE'
-    );
-}
-
-export function getUpgradeStatusDetail(upgradeStatus: string): string {
-    return get(upgradeStatus, 'mostRecentProcess.progress.upgradeStatusDetail', '') as string;
-}
-
-export type UpgradeStatus = {
-    mostRecentProcess: {
-        type: string;
-        progress?: {
-            upgradeState: string;
-        };
-        initiatedAt?: string;
-        active?: boolean;
-        upgradability?: string;
-    };
-};
-
-/**
- * If the most recent upgrade was a cert rotation, return the initiation time.
- * Else, return null.
- */
-export function initiationOfCertRotationIfApplicable(upgradeStatus: UpgradeStatus) {
-    const mostRecentProcess = upgradeStatus?.mostRecentProcess;
-    if (mostRecentProcess?.type !== 'CERT_ROTATION') {
-        return null;
-    }
-    if (mostRecentProcess?.progress?.upgradeState !== 'UPGRADE_COMPLETE') {
-        return null;
-    }
-    return mostRecentProcess.initiatedAt;
-}
-
-export function findUpgradeState(
-    upgradeStatus: UpgradeStatus | null | undefined
-): UpgradeState | null {
-    const upgradability = get(upgradeStatus, 'upgradability', null);
-    if (!upgradability || upgradability === 'UNSET') {
-        return null;
-    }
-
-    switch (upgradability) {
-        case 'UP_TO_DATE': {
-            if (!upgradeStatus?.mostRecentProcess?.active) {
-                return upgradeStates.UP_TO_DATE;
-            }
-
-            // Display active progress while using automatic upgrade to re-issue certificates.
-            const upgradeState: string = get(
-                upgradeStatus,
-                'mostRecentProcess.progress.upgradeState',
-                'unknown'
-            );
-
-            return upgradeStates[upgradeState] || upgradeStates.unknown;
-        }
-        case 'MANUAL_UPGRADE_REQUIRED': {
-            return upgradeStates[upgradability];
-        }
-        // Auto upgrades are possible even in the case of SENSOR_VERSION_HIGHER (it's not technically an upgrade,
-        // and not really something we ever expect, but eh.) If the backend detects this to be the case, it will not
-        // trigger an upgrade unless asked to by the user.
-        case 'SENSOR_VERSION_HIGHER': {
-            if (!hasRelevantInformationFromMostRecentUpgrade(upgradeStatus)) {
-                return upgradeStates.DOWNGRADE_POSSIBLE;
-            }
-
-            const upgradeState = get(
-                upgradeStatus,
-                'mostRecentProcess.progress.upgradeState',
-                'unknown'
-            );
-
-            return upgradeStates[upgradeState] || upgradeStates.unknown;
-        }
-        case 'AUTO_UPGRADE_POSSIBLE': {
-            if (!hasRelevantInformationFromMostRecentUpgrade(upgradeStatus)) {
-                return upgradeStates.UPGRADE_AVAILABLE;
-            }
-
-            const upgradeState = get(
-                upgradeStatus,
-                'mostRecentProcess.progress.upgradeState',
-                'unknown'
-            );
-
-            return upgradeStates[upgradeState] || upgradeStates.unknown;
-        }
-        default: {
-            return upgradeStates.unknown;
-        }
-    }
-}
-
-export function isUpToDateStateObject(upgradeStateObject) {
-    return upgradeStateObject?.type === 'current';
-}
-
-export function getUpgradeableClusters(clusters: Cluster[] = []): Cluster[] {
-    return clusters.filter((cluster) => {
-        const upgradeStatus: UpgradeStatus | null = get(cluster, 'status.upgradeStatus', null);
-        const upgradeStateObject = findUpgradeState(upgradeStatus);
-
-        return upgradeStateObject?.actionText; // if property exists, you can try or retry an upgrade
-    });
-}
-
 export function buildStatusMessage(
     healthStatus: ClusterHealthStatusLabel,
     lastContact: string | null | undefined,
@@ -628,6 +357,4 @@ export default {
     clusterTablePollingInterval,
     clusterDetailPollingInterval,
     newClusterDefault,
-    findUpgradeState,
-    isUpToDateStateObject,
 };
diff --git a/ui/apps/platform/src/Containers/Clusters/searchFilterConfig.ts b/ui/apps/platform/src/Containers/Clusters/searchFilterConfig.ts
index 8ade59f3a9b36..707c2549ee461 100644
--- a/ui/apps/platform/src/Containers/Clusters/searchFilterConfig.ts
+++ b/ui/apps/platform/src/Containers/Clusters/searchFilterConfig.ts
@@ -79,7 +79,6 @@ const sensorCompatibilityStatusAttribute: CompoundSearchFilterAttribute = {
     searchTerm: 'Sensor Version Compatibility',
     inputType: 'select',
     inputProps: { options: sensorCompatibilityStatusOptions },
-    featureFlagDependency: ['ROX_SENSOR_COMPATIBILITY_STATUS'],
 };
 
 const lastContactAttributes: CompoundSearchFilterAttribute = {
diff --git a/ui/apps/platform/src/Containers/Collections/CollectionsTablePage.tsx b/ui/apps/platform/src/Containers/Collections/CollectionsTablePage.tsx
index ebc8a4e53437d..2bb533d8852f5 100644
--- a/ui/apps/platform/src/Containers/Collections/CollectionsTablePage.tsx
+++ b/ui/apps/platform/src/Containers/Collections/CollectionsTablePage.tsx
@@ -81,6 +81,16 @@ function CollectionsTablePage({ hasWriteAccessForCollections }: CollectionsTable
     return (
         <>
             <PageTitle title="Collections" />
+            <Alert
+                title="Collections are deprecated and will be removed in a future release"
+                component="p"
+                variant="info"
+                isInline
+            >
+                Collection scope is deprecated for scheduled image vulnerability reports. To prepare
+                for future updates, we recommend updating each scheduled report in Vulnerability
+                reporting to use Custom scope.
+            </Alert>
             <PageSection>
                 <Flex alignItems={{ default: 'alignItemsCenter' }}>
                     <Flex direction={{ default: 'column' }}>
diff --git a/ui/apps/platform/src/Containers/Collections/errorUtils.test.ts b/ui/apps/platform/src/Containers/Collections/errorUtils.test.ts
new file mode 100644
index 0000000000000..ad1a9737cf215
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Collections/errorUtils.test.ts
@@ -0,0 +1,32 @@
+import { parseConfigError } from './errorUtils';
+
+describe('parseConfigError', () => {
+    it('classifies a collection loop and extracts the loopId from a lower-case-leading message', () => {
+        const err = new Error(
+            "edge between 'aaaaaaaa-1111' and 'bbbbbbbb-2222' would create a loop"
+        );
+
+        const result = parseConfigError(err);
+
+        expect(result.type).toBe('CollectionLoop');
+        expect(result).toHaveProperty('loopId', 'bbbbbbbb-2222');
+    });
+
+    it('classifies an invalid rule and preserves the backend message in details', () => {
+        const err = new Error('failed to compile regex "["');
+
+        const result = parseConfigError(err);
+
+        expect(result.type).toBe('InvalidRule');
+        expect(result.details).toBe('failed to compile regex "["');
+    });
+
+    it('falls back to UnknownError for an unrecognized message', () => {
+        const err = new Error('something entirely unexpected happened');
+
+        const result = parseConfigError(err);
+
+        expect(result.type).toBe('UnknownError');
+        expect(result.details).toBe('something entirely unexpected happened');
+    });
+});
diff --git a/ui/apps/platform/src/Containers/Compliance/ComplianceSearchInput.jsx b/ui/apps/platform/src/Containers/Compliance/ComplianceSearchInput.jsx
deleted file mode 100644
index 259c6fb7f0ede..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/ComplianceSearchInput.jsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import PropTypes from 'prop-types';
-import { CLIENT_SIDE_SEARCH_OPTIONS as SEARCH_OPTIONS } from 'constants/searchOptions';
-
-import Query from 'Components/CacheFirstQuery';
-import URLSearchInput from 'Components/URLSearchInput';
-
-import { SEARCH_OPTIONS_QUERY } from 'queries/search';
-
-const addComplianceStateOption = (searchOptions) => {
-    let modifiedSearchOptions = [];
-    if (searchOptions) {
-        modifiedSearchOptions = [...searchOptions];
-        modifiedSearchOptions.push(SEARCH_OPTIONS.COMPLIANCE.STATE);
-    }
-    return modifiedSearchOptions;
-};
-
-const ComplianceSearchInput = ({ placeholder, categories, shouldAddComplianceState }) => (
-    <Query query={SEARCH_OPTIONS_QUERY} action="list" variables={{ categories }}>
-        {({ data }) => {
-            if (!data) {
-                return null;
-            }
-            let { searchOptions } = data;
-            if (shouldAddComplianceState) {
-                searchOptions = addComplianceStateOption(searchOptions);
-            }
-            return (
-                <URLSearchInput
-                    placeholder={placeholder}
-                    className="w-full"
-                    categoryOptions={searchOptions}
-                    categories={categories}
-                />
-            );
-        }}
-    </Query>
-);
-
-ComplianceSearchInput.propTypes = {
-    placeholder: PropTypes.string.isRequired,
-    categories: PropTypes.arrayOf(PropTypes.string),
-    shouldAddComplianceState: PropTypes.bool,
-};
-
-ComplianceSearchInput.defaultProps = {
-    categories: [],
-    shouldAddComplianceState: false,
-};
-
-export default ComplianceSearchInput;
diff --git a/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceDashboardPage.tsx b/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceDashboardPage.tsx
deleted file mode 100644
index 7fa1e8d75fcc6..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceDashboardPage.tsx
+++ /dev/null
@@ -1,240 +0,0 @@
-import { useState } from 'react';
-import type { ReactElement } from 'react';
-import { useApolloClient } from '@apollo/client';
-import { Alert } from '@patternfly/react-core';
-
-import Button from 'Components/Button';
-import ComplianceUsageDisclaimer, {
-    COMPLIANCE_DISCLAIMER_KEY,
-} from 'Components/ComplianceUsageDisclaimer';
-import ExportButton from 'Components/ExportButton';
-import PageHeader from 'Components/PageHeader';
-import { resourceTypes } from 'constants/entityTypes';
-import useCaseTypes from 'constants/useCaseTypes';
-import { useBooleanLocalStorage } from 'hooks/useLocalStorage';
-import usePermissions from 'hooks/usePermissions';
-import { fetchComplianceStandardsSortedByName } from 'services/ComplianceService';
-import type { ComplianceStandardMetadata } from 'services/ComplianceService';
-import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
-
-import {
-    AGGREGATED_RESULTS_ACROSS_ENTITY,
-    AGGREGATED_RESULTS_STANDARDS_BY_ENTITY,
-} from 'queries/controls';
-import ScanButton from '../ScanButton';
-import StandardsByEntity from '../widgets/StandardsByEntity';
-import StandardsAcrossEntity from '../widgets/StandardsAcrossEntity';
-
-import ManageStandardsError from './ManageStandardsError';
-import ManageStandardsModal from './ManageStandardsModal';
-import ComplianceDashboardTile, {
-    CLUSTERS_COUNT,
-    DEPLOYMENTS_COUNT,
-    NAMESPACES_COUNT,
-    NODES_COUNT,
-} from './ComplianceDashboardTile';
-import ComplianceScanProgress from './ComplianceScanProgress';
-import { useComplianceRunStatuses } from './useComplianceRunStatuses';
-import { isComplianceRouteEnabled } from '../complianceRBAC';
-
-const queriesToRefetchOnPollingComplete = [
-    CLUSTERS_COUNT,
-    NODES_COUNT,
-    NAMESPACES_COUNT,
-    DEPLOYMENTS_COUNT,
-    AGGREGATED_RESULTS_STANDARDS_BY_ENTITY(resourceTypes.CLUSTER),
-    AGGREGATED_RESULTS_ACROSS_ENTITY(resourceTypes.CLUSTER),
-    AGGREGATED_RESULTS_ACROSS_ENTITY(resourceTypes.NAMESPACE),
-    AGGREGATED_RESULTS_ACROSS_ENTITY(resourceTypes.NODE),
-];
-
-function ComplianceDashboardPage(): ReactElement {
-    const [isDisclaimerAccepted, setIsDisclaimerAccepted] = useBooleanLocalStorage(
-        COMPLIANCE_DISCLAIMER_KEY,
-        false
-    );
-    const { hasReadAccess, hasReadWriteAccess } = usePermissions();
-
-    // Counts and widgets (with one exception) have same conditional rendering as routes.
-    // Do not require for StandardsAcrossEntity cluster, so page has at least one widget.
-    // Do require for StandardsByEntity cluster, because it has links to clusters.
-    const isComplianceRouteEnabledForClusters = isComplianceRouteEnabled(
-        hasReadAccess,
-        'compliance/clusters'
-    );
-    const isComplianceRouteEnabledForDeployments = isComplianceRouteEnabled(
-        hasReadAccess,
-        'compliance/deployments'
-    );
-    const isComplianceRouteEnabledForNamespaces = isComplianceRouteEnabled(
-        hasReadAccess,
-        'compliance/namespaces'
-    );
-    const isComplianceRouteEnabledForNodes = isComplianceRouteEnabled(
-        hasReadAccess,
-        'compliance/nodes'
-    );
-
-    const hasWriteAccessForCompliance = hasReadWriteAccess('Compliance');
-
-    const [isFetchingStandards, setIsFetchingStandards] = useState(false);
-    const [errorMessageFetching, setErrorMessageFetching] = useState('');
-    const [standards, setStandards] = useState<ComplianceStandardMetadata[]>([]);
-    const [isManageStandardsModalOpen, setIsManageStandardsModalOpen] = useState(false);
-
-    const client = useApolloClient();
-
-    const { runs, error, restartPolling, inProgressScanDetected, isCurrentScanIncomplete } =
-        useComplianceRunStatuses(queriesToRefetchOnPollingComplete);
-
-    function clickManageStandardsButton() {
-        setIsFetchingStandards(true);
-        fetchComplianceStandardsSortedByName()
-            .then((standardsFetched) => {
-                setErrorMessageFetching('');
-                setStandards(standardsFetched);
-                setIsManageStandardsModalOpen(true);
-            })
-            .catch((error) => {
-                setErrorMessageFetching(getAxiosErrorMessage(error));
-                setStandards([]);
-            })
-            .finally(() => {
-                setIsFetchingStandards(false);
-            });
-    }
-
-    function onCloseManageStandardsError() {
-        setErrorMessageFetching('');
-    }
-
-    function onChangeManageStandardsModal() {
-        setIsManageStandardsModalOpen(false);
-
-        /*
-         * Same method as for Scan button to clear store of any cached query data,
-         * so backend filters out standards in query data according to saved update
-         * to hideScanResults properties.
-         */
-        return client.resetStore();
-    }
-
-    function onCancelManageStandardsModal() {
-        setIsManageStandardsModalOpen(false);
-    }
-
-    return (
-        <>
-            <PageHeader header="Compliance" subHeader="Dashboard">
-                <div className="flex w-full justify-end">
-                    <div className="flex">
-                        {isComplianceRouteEnabledForClusters && (
-                            <ComplianceDashboardTile entityType="CLUSTER" />
-                        )}
-                        {isComplianceRouteEnabledForNamespaces && (
-                            <ComplianceDashboardTile entityType="NAMESPACE" />
-                        )}
-                        {isComplianceRouteEnabledForNodes && (
-                            <ComplianceDashboardTile entityType="NODE" />
-                        )}
-                        {isComplianceRouteEnabledForDeployments && (
-                            <ComplianceDashboardTile entityType="DEPLOYMENT" />
-                        )}
-                        {hasWriteAccessForCompliance && (
-                            <ScanButton
-                                className={`flex items-center justify-center border-2 btn btn-base h-10 lg:min-w-32 xl:min-w-43`}
-                                text="Scan environment"
-                                textClass="hidden lg:block"
-                                textCondensed="Scan all"
-                                clusterId="*"
-                                standardId="*"
-                                onScanTriggered={restartPolling}
-                                scanInProgress={isCurrentScanIncomplete}
-                            />
-                        )}
-                        {hasWriteAccessForCompliance && (
-                            <div className="flex items-center">
-                                <Button
-                                    text="Manage standards"
-                                    className="btn btn-base h-10 ml-2"
-                                    onClick={() => {
-                                        clickManageStandardsButton();
-                                    }}
-                                    disabled={isFetchingStandards}
-                                    isLoading={isFetchingStandards}
-                                />
-                            </div>
-                        )}
-                        <ExportButton
-                            fileName="Compliance Dashboard Report"
-                            textClass="hidden lg:block"
-                            type="ALL"
-                            page={useCaseTypes.COMPLIANCE}
-                        />
-                    </div>
-                </div>
-            </PageHeader>
-            <div className="flex-1 relative p-6 xxxl:p-8 bg-base-200">
-                {!isDisclaimerAccepted && (
-                    <ComplianceUsageDisclaimer
-                        onAccept={() => setIsDisclaimerAccepted(true)}
-                        className="pf-v6-u-mb-lg"
-                    />
-                )}
-                {(inProgressScanDetected || !!error) && (
-                    <div className="pf-v6-u-pb-lg">
-                        {error ? (
-                            <Alert
-                                variant="danger"
-                                title="There was an error fetching compliance scan status, data below may be out of date"
-                                component="p"
-                            >
-                                {getAxiosErrorMessage(error)}
-                            </Alert>
-                        ) : (
-                            <ComplianceScanProgress runs={runs} />
-                        )}
-                    </div>
-                )}
-                <div
-                    className="grid grid-gap-6 xxxl:grid-gap-8 md:grid-auto-fit xxl:grid-auto-fit-wide md:grid-dense pf-v6-u-pb-lg"
-                    // style={{ '--min-tile-height': '160px' }}
-                >
-                    <StandardsAcrossEntity
-                        entityType={resourceTypes.CLUSTER}
-                        bodyClassName="pr-4 py-1"
-                    />
-                    {isComplianceRouteEnabledForClusters && (
-                        <StandardsByEntity entityType={resourceTypes.CLUSTER} bodyClassName="p-4" />
-                    )}
-                    {isComplianceRouteEnabledForNamespaces && (
-                        <StandardsAcrossEntity
-                            entityType={resourceTypes.NAMESPACE}
-                            bodyClassName="px-4 pt-1"
-                        />
-                    )}
-                    {isComplianceRouteEnabledForNodes && (
-                        <StandardsAcrossEntity
-                            entityType={resourceTypes.NODE}
-                            bodyClassName="pr-4 py-1"
-                        />
-                    )}
-                </div>
-            </div>
-            {errorMessageFetching ? (
-                <ManageStandardsError
-                    onClose={onCloseManageStandardsError}
-                    errorMessage={errorMessageFetching}
-                />
-            ) : isManageStandardsModalOpen ? (
-                <ManageStandardsModal
-                    onCancel={onCancelManageStandardsModal}
-                    onChange={onChangeManageStandardsModal}
-                    standards={standards}
-                />
-            ) : null}
-        </>
-    );
-}
-
-export default ComplianceDashboardPage;
diff --git a/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceDashboardTile.tsx b/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceDashboardTile.tsx
deleted file mode 100644
index c112b4ab707f0..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceDashboardTile.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-import { Link } from 'react-router-dom-v5-compat';
-import { gql, useQuery } from '@apollo/client';
-import type { DocumentNode } from '@apollo/client';
-
-import { complianceBasePath } from 'routePaths';
-
-import {
-    entityCountNounOrdinaryCase,
-    entityNounOrdinaryCasePlural,
-} from '../entitiesForCompliance';
-
-export const CLUSTERS_COUNT = gql`
-    query clustersCount {
-        results: complianceClusterCount
-    }
-`;
-
-export const NODES_COUNT = gql`
-    query nodesCount {
-        results: complianceNodeCount
-    }
-`;
-
-export const NAMESPACES_COUNT = gql`
-    query namespacesCount {
-        results: complianceNamespaceCount
-    }
-`;
-
-export const DEPLOYMENTS_COUNT = gql`
-    query deploymentsCount {
-        results: complianceDeploymentCount
-    }
-`;
-
-// Subset of ComplianceEntityType
-type DashboardTileEntityType = 'CLUSTER' | 'DEPLOYMENT' | 'NAMESPACE' | 'NODE';
-
-const queryMap: Record<DashboardTileEntityType, DocumentNode> = {
-    CLUSTER: CLUSTERS_COUNT,
-    DEPLOYMENT: DEPLOYMENTS_COUNT,
-    NAMESPACE: NAMESPACES_COUNT,
-    NODE: NODES_COUNT,
-};
-
-const entityPathSegmentMap: Record<DashboardTileEntityType, string> = {
-    CLUSTER: 'clusters',
-    DEPLOYMENT: 'deployments',
-    NAMESPACE: 'namespaces',
-    NODE: 'nodes',
-};
-
-export type ComplianceDashboardTileProps = {
-    entityType: DashboardTileEntityType;
-};
-
-function ComplianceDashboardTile({ entityType }: ComplianceDashboardTileProps) {
-    const QUERY = queryMap[entityType];
-    const url = `${complianceBasePath}/${entityPathSegmentMap[entityType]}`;
-
-    const { loading, data, error } = useQuery(QUERY);
-
-    if (loading || error || !data) {
-        return (
-            <div className="btn btn-base h-10 mr-2">
-                <div className="flex flex-col text-center">
-                    <div>{entityNounOrdinaryCasePlural[entityType]}</div>
-                    <div className="text-sm">{error ? '(not scanned)' : 'scanned'}</div>
-                </div>
-            </div>
-        );
-    }
-
-    const count: number = typeof data?.results === 'number' ? data.results : 0;
-    return (
-        <Link to={url} className="btn btn-base h-10 mr-2 no-underline">
-            <div className="flex flex-col text-center whitespace-nowrap">
-                <div>{entityCountNounOrdinaryCase(count, entityType)}</div>
-                <div className="text-sm">(scanned)</div>
-            </div>
-        </Link>
-    );
-}
-
-export default ComplianceDashboardTile;
diff --git a/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceScanProgress.tsx b/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceScanProgress.tsx
deleted file mode 100644
index 5847135dc0929..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Dashboard/ComplianceScanProgress.tsx
+++ /dev/null
@@ -1,39 +0,0 @@
-import { Card, CardBody, CardTitle, Progress } from '@patternfly/react-core';
-import type { CardProps } from '@patternfly/react-core';
-
-import type { ComplianceRunStatusResponse } from './useComplianceRunStatuses';
-
-export type ComplianceScanProgressProps = {
-    runs: ComplianceRunStatusResponse['complianceRunStatuses']['runs'];
-} & CardProps;
-
-function ComplianceScanProgress({ runs, ...props }: ComplianceScanProgressProps) {
-    const unfinishedRunCount = runs.filter((run) => run.state !== 'FINISHED').length;
-    const finishedRunCount = runs.length - unfinishedRunCount;
-
-    const title =
-        unfinishedRunCount === 0
-            ? 'Compliance scanning complete'
-            : 'Compliance scanning in progress';
-
-    return (
-        <Card {...props}>
-            <CardTitle id="compliance-scan-progress-title">{title}</CardTitle>
-            <CardBody>
-                <Progress
-                    aria-labelledby="compliance-scan-progress-title"
-                    size="sm"
-                    variant={unfinishedRunCount === 0 ? 'success' : undefined}
-                    value={finishedRunCount}
-                    min={0}
-                    max={runs.length}
-                    measureLocation={'outside'}
-                    label={`${finishedRunCount} of ${runs.length} runs`}
-                    valueText={`${finishedRunCount} of ${runs.length} runs`}
-                />
-            </CardBody>
-        </Card>
-    );
-}
-
-export default ComplianceScanProgress;
diff --git a/ui/apps/platform/src/Containers/Compliance/Dashboard/ManageStandardsError.tsx b/ui/apps/platform/src/Containers/Compliance/Dashboard/ManageStandardsError.tsx
deleted file mode 100644
index 305eb50003f9a..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Dashboard/ManageStandardsError.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import type { ReactElement } from 'react';
-import { Alert } from '@patternfly/react-core';
-import { Modal } from '@patternfly/react-core/deprecated';
-
-export type ManageStandardsErrorProps = {
-    onClose: () => void;
-    errorMessage: string;
-};
-
-function ManageStandardsError({ onClose, errorMessage }: ManageStandardsErrorProps): ReactElement {
-    return (
-        <Modal title="Manage standards" variant="small" isOpen onClose={onClose} showClose>
-            <Alert title="Unable to fetch standards" component="p" variant="warning" isInline>
-                {errorMessage}
-            </Alert>
-        </Modal>
-    );
-}
-
-export default ManageStandardsError;
diff --git a/ui/apps/platform/src/Containers/Compliance/Dashboard/ManageStandardsModal.tsx b/ui/apps/platform/src/Containers/Compliance/Dashboard/ManageStandardsModal.tsx
deleted file mode 100644
index 789620a0ea71b..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Dashboard/ManageStandardsModal.tsx
+++ /dev/null
@@ -1,144 +0,0 @@
-import { useState } from 'react';
-import type { ReactElement } from 'react';
-import { Alert, Button, Checkbox, Form } from '@patternfly/react-core';
-import { Modal } from '@patternfly/react-core/deprecated';
-import { useFormik } from 'formik';
-
-import { patchComplianceStandard } from 'services/ComplianceService';
-import type { ComplianceStandardMetadata } from 'services/ComplianceService';
-import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
-
-export type ManageStandardsModalProps = {
-    onCancel: () => void;
-    onChange: () => void;
-    standards: ComplianceStandardMetadata[];
-};
-
-/*
- * Formik values have standard id as key and showScanResults as value.
- * Therefore, negate hideScanResults value here and
- * showComplianceScanMap[id] value in onSubmit function below.
- */
-function getShowScanResultsMap(standards: ComplianceStandardMetadata[]): Record<string, boolean> {
-    return Object.fromEntries(standards.map(({ id, hideScanResults }) => [id, !hideScanResults]));
-}
-
-function ManageStandardsModal({
-    onCancel,
-    onChange,
-    standards,
-}: ManageStandardsModalProps): ReactElement {
-    const [errorMessage, setErrorMessage] = useState('');
-    const [countFulfilledWhenRejected, setCountFulfilledWhenRejected] = useState(0);
-    const { dirty, handleSubmit, isSubmitting, setFieldValue, setSubmitting, values } = useFormik<
-        Record<string, boolean>
-    >({
-        initialValues: getShowScanResultsMap(standards),
-        onSubmit: (showScanResultsMap) => {
-            setErrorMessage('');
-            // Filter standards for which hideScanResults property has changed,
-            // and them map to promises for patch requests.
-            // Negate hideScanResults is correct even if property is absent.
-            const patchRequestPromises = standards
-                .filter(({ hideScanResults, id }) => !hideScanResults !== showScanResultsMap[id])
-                .map(({ id }) => patchComplianceStandard(id, !showScanResultsMap[id]));
-
-            Promise.allSettled(patchRequestPromises)
-                .then((results) => {
-                    let numberOfRejectedPromises = 0;
-                    let reasonMessage = '';
-                    results.forEach((result) => {
-                        if (result.status === 'rejected') {
-                            if (numberOfRejectedPromises === 0) {
-                                reasonMessage = getAxiosErrorMessage(result.reason);
-                            }
-                            numberOfRejectedPromises += 1;
-                        }
-                    });
-                    setSubmitting(false);
-
-                    if (numberOfRejectedPromises === 0) {
-                        onChange();
-                    } else {
-                        setErrorMessage(reasonMessage);
-                        setCountFulfilledWhenRejected(results.length - numberOfRejectedPromises);
-                    }
-                })
-                .catch((error) => {
-                    setErrorMessage(getAxiosErrorMessage(error));
-                    setSubmitting(false);
-                });
-        },
-    });
-
-    return (
-        <Modal
-            title="Manage standards"
-            variant="small"
-            isOpen
-            showClose={false}
-            actions={[
-                <Button
-                    key="Save"
-                    variant="primary"
-                    onClick={() => {
-                        handleSubmit();
-                    }}
-                    isDisabled={!dirty || isSubmitting}
-                    isLoading={isSubmitting}
-                >
-                    Save
-                </Button>,
-                countFulfilledWhenRejected === 0 ? (
-                    <Button
-                        key="Cancel"
-                        variant="secondary"
-                        onClick={onCancel}
-                        isDisabled={isSubmitting}
-                    >
-                        Cancel
-                    </Button>
-                ) : (
-                    <Button
-                        key="Close"
-                        variant="secondary"
-                        onClick={onChange}
-                        isDisabled={isSubmitting}
-                    >
-                        Close
-                    </Button>
-                ),
-            ]}
-        >
-            <Form>
-                {standards.map(({ id, name }) => {
-                    return (
-                        <Checkbox
-                            key={id}
-                            id={id}
-                            name={id}
-                            label={name}
-                            isChecked={values[id]}
-                            onChange={(_event, value) => {
-                                return setFieldValue(id, value);
-                            }}
-                        />
-                    );
-                })}
-            </Form>
-            {errorMessage && (
-                <Alert
-                    title="Unable to save changes"
-                    component="p"
-                    variant="danger"
-                    isInline
-                    className="pf-v6-u-mt-lg"
-                >
-                    {errorMessage}
-                </Alert>
-            )}
-        </Modal>
-    );
-}
-
-export default ManageStandardsModal;
diff --git a/ui/apps/platform/src/Containers/Compliance/Dashboard/useComplianceRunStatuses.ts b/ui/apps/platform/src/Containers/Compliance/Dashboard/useComplianceRunStatuses.ts
deleted file mode 100644
index 9957b4538d728..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Dashboard/useComplianceRunStatuses.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-import { useState } from 'react';
-import { gql, useApolloClient, useQuery } from '@apollo/client';
-import type { DocumentNode } from '@apollo/client';
-
-export type ComplianceRunStatusResponse = {
-    complianceRunStatuses: {
-        runs: { state: string }[];
-    };
-};
-
-function isCurrentScanIncomplete(
-    runs: ComplianceRunStatusResponse['complianceRunStatuses']['runs']
-) {
-    return runs.some((run) => run.state !== 'FINISHED');
-}
-
-const complianceRunStatusesQuery = gql`
-    query runStatuses($latest: Boolean) {
-        complianceRunStatuses(latest: $latest) {
-            runs {
-                state
-            }
-        }
-    }
-`;
-
-const pollInterval = 10000;
-const variables = {
-    latest: true,
-};
-
-export type UseComplianceRunStatusesResponse = {
-    /* The latest compliance scan runs */
-    runs: ComplianceRunStatusResponse['complianceRunStatuses']['runs'];
-    error: unknown;
-    /* Fetches the latest compliance scan runs, and restarts polling, if necessary */
-    restartPolling: () => void;
-    /* Whether or not an in progress scan was detected during the lifetime of this hook */
-    inProgressScanDetected: boolean;
-    /* Whether or not the latest scan is incomplete */
-    isCurrentScanIncomplete: boolean;
-};
-
-export function useComplianceRunStatuses(
-    queriesToRefetchOnPollingComplete: DocumentNode[]
-): UseComplianceRunStatusesResponse {
-    const [inProgressScanDetected, setInProgressScanDetected] = useState(false);
-
-    const client = useApolloClient();
-
-    const { startPolling, stopPolling, error, data, refetch } = useQuery<
-        ComplianceRunStatusResponse,
-        typeof variables
-    >(complianceRunStatusesQuery, {
-        variables,
-        pollInterval,
-        onCompleted,
-        onError,
-        errorPolicy: 'all',
-        notifyOnNetworkStatusChange: true,
-    });
-
-    function onCompleted(data: ComplianceRunStatusResponse) {
-        if (isCurrentScanIncomplete(data.complianceRunStatuses.runs)) {
-            setInProgressScanDetected(true);
-        } else {
-            stopPolling();
-        }
-
-        return client.refetchQueries({ include: queriesToRefetchOnPollingComplete });
-    }
-
-    function onError() {
-        stopPolling();
-    }
-
-    return {
-        error,
-        runs: data?.complianceRunStatuses.runs ?? [],
-        restartPolling: () =>
-            refetch().then(({ data }) => {
-                if (isCurrentScanIncomplete(data.complianceRunStatuses.runs)) {
-                    setInProgressScanDetected(true);
-                    startPolling(pollInterval);
-                }
-            }),
-        inProgressScanDetected,
-        isCurrentScanIncomplete: isCurrentScanIncomplete(data?.complianceRunStatuses.runs ?? []),
-    };
-}
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Cluster.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Cluster.jsx
deleted file mode 100644
index 00386c8b4cac7..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Cluster.jsx
+++ /dev/null
@@ -1,215 +0,0 @@
-import { useContext } from 'react';
-
-import entityTypes from 'constants/entityTypes';
-import EntityCompliance from 'Containers/Compliance/widgets/EntityCompliance';
-import ResourceCount from 'Containers/Compliance/widgets/ResourceCount';
-import ClusterVersion from 'Containers/Compliance/widgets/ClusterVersion';
-import Query from 'Components/CacheFirstQuery';
-import usePermissions from 'hooks/usePermissions';
-import { CLUSTER_NAME as QUERY } from 'queries/cluster';
-import ComplianceList from 'Containers/Compliance/List/List';
-import ComplianceByStandards from 'Containers/Compliance/widgets/ComplianceByStandards';
-import Loader from 'Components/Loader';
-import { entityPagePropTypes, entityPageDefaultProps } from 'constants/entityPageProps';
-import searchContext from 'Containers/searchContext';
-import isGQLLoading from 'utils/gqlLoading';
-
-import Header from './Header';
-import ResourceTabs from './ResourceTabs';
-import { isComplianceRouteEnabled } from '../complianceRBAC';
-
-function getResourceTabs({
-    isComplianceRouteEnabledForDeployments,
-    isComplianceRouteEnabledForNamespaces,
-    isComplianceRouteEnabledForNodes,
-}) {
-    const resourceTabs = [entityTypes.CONTROL];
-    if (isComplianceRouteEnabledForNamespaces) {
-        resourceTabs.push(entityTypes.NAMESPACE);
-    }
-    if (isComplianceRouteEnabledForNodes) {
-        resourceTabs.push(entityTypes.NODE);
-    }
-    if (isComplianceRouteEnabledForDeployments) {
-        resourceTabs.push(entityTypes.DEPLOYMENT);
-    }
-    return resourceTabs;
-}
-
-function processData(data) {
-    if (!data || !data.cluster) {
-        return {};
-    }
-    return data.cluster;
-}
-
-const ClusterPage = ({
-    entityId,
-    listEntityType1,
-    entityId1,
-    entityType2,
-    entityListType2,
-    entityId2,
-    query,
-    sidePanelMode,
-}) => {
-    const searchParam = useContext(searchContext);
-
-    const { hasReadAccess } = usePermissions();
-    const isComplianceRouteEnabledForDeployments = isComplianceRouteEnabled(
-        hasReadAccess,
-        'compliance/deployments'
-    );
-    const isComplianceRouteEnabledForNamespaces = isComplianceRouteEnabled(
-        hasReadAccess,
-        'compliance/namespaces'
-    );
-    const isComplianceRouteEnabledForNodes = isComplianceRouteEnabled(
-        hasReadAccess,
-        'compliance/nodes'
-    );
-    const isComplianceRouteEnabledForEntities =
-        isComplianceRouteEnabledForDeployments ||
-        isComplianceRouteEnabledForNamespaces ||
-        isComplianceRouteEnabledForNodes;
-
-    const resourceTabs = getResourceTabs({
-        isComplianceRouteEnabledForDeployments,
-        isComplianceRouteEnabledForNamespaces,
-        isComplianceRouteEnabledForNodes,
-    });
-
-    return (
-        <Query query={QUERY} variables={{ id: entityId }}>
-            {({ loading, data }) => {
-                if (isGQLLoading(loading, data)) {
-                    return <Loader />;
-                }
-                const cluster = processData(data);
-                const { name, id } = cluster;
-                let contents;
-
-                if (listEntityType1 && !sidePanelMode) {
-                    const listQuery = {
-                        groupBy:
-                            listEntityType1 === entityTypes.CONTROL ? entityTypes.STANDARD : '',
-                        'Cluster Id': entityId,
-                        ...query[searchParam],
-                    };
-                    contents = (
-                        <section className="flex flex-col flex-1 overflow-y-auto h-full">
-                            <ComplianceList
-                                entityType={listEntityType1}
-                                query={listQuery}
-                                selectedRowId={entityId1}
-                                entityType2={entityType2}
-                                entityListType2={entityListType2}
-                                entityId2={entityId2}
-                            />
-                        </section>
-                    );
-                } else {
-                    contents = (
-                        <div
-                            className={`flex-1 relative bg-base-200 overflow-auto ${
-                                !sidePanelMode ? `p-6` : `p-4`
-                            } `}
-                        >
-                            <div
-                                className={`grid ${
-                                    !sidePanelMode
-                                        ? `grid grid-gap-6 xxxl:grid-gap-8 md:grid-auto-fit xxl:grid-auto-fit-wide md:grid-dense`
-                                        : ``
-                                } sm:grid-columns-1 grid-gap-5`}
-                            >
-                                <div
-                                    className="grid s-2 md:grid-auto-fit md:grid-dense"
-                                    style={{ '--min-tile-width': '50%' }}
-                                >
-                                    <div className="s-full pb-5">
-                                        <EntityCompliance
-                                            entityType={entityTypes.CLUSTER}
-                                            entityId={id}
-                                            entityName={name}
-                                            clusterName={name}
-                                        />
-                                    </div>
-                                    <div className="s-full">
-                                        <ClusterVersion clusterId={id} />
-                                    </div>
-                                </div>
-                                <ComplianceByStandards
-                                    entityId={id}
-                                    entityName={name}
-                                    entityType={entityTypes.CLUSTER}
-                                />
-
-                                {sidePanelMode && isComplianceRouteEnabledForEntities && (
-                                    <div
-                                        className="grid s-2 md:grid-auto-fit md:grid-dense"
-                                        style={{ '--min-tile-width': '50%' }}
-                                    >
-                                        {isComplianceRouteEnabledForNamespaces && (
-                                            <div className="md:pr-3 pb-3">
-                                                <ResourceCount
-                                                    entityType={entityTypes.NAMESPACE}
-                                                    relatedToResourceType={entityTypes.CLUSTER}
-                                                    relatedToResource={cluster}
-                                                />
-                                            </div>
-                                        )}
-                                        {isComplianceRouteEnabledForNodes && (
-                                            <div className="md:pl-3 pb-3">
-                                                <ResourceCount
-                                                    entityType={entityTypes.NODE}
-                                                    relatedToResourceType={entityTypes.CLUSTER}
-                                                    relatedToResource={cluster}
-                                                />
-                                            </div>
-                                        )}
-                                        {isComplianceRouteEnabledForDeployments && (
-                                            <div className="md:pr-3 pt-2">
-                                                <ResourceCount
-                                                    entityType={entityTypes.DEPLOYMENT}
-                                                    relatedToResourceType={entityTypes.CLUSTER}
-                                                    relatedToResource={cluster}
-                                                />
-                                            </div>
-                                        )}
-                                    </div>
-                                )}
-                            </div>
-                        </div>
-                    );
-                }
-
-                return (
-                    <section className="flex flex-col h-full w-full">
-                        {!sidePanelMode && (
-                            <>
-                                <Header
-                                    entityType={entityTypes.CLUSTER}
-                                    listEntityType={listEntityType1}
-                                    entityName={name}
-                                    entityId={id}
-                                />
-                                <ResourceTabs
-                                    entityId={entityId}
-                                    entityType={entityTypes.CLUSTER}
-                                    selectedType={listEntityType1}
-                                    resourceTabs={resourceTabs}
-                                />
-                            </>
-                        )}
-                        {contents}
-                    </section>
-                );
-            }}
-        </Query>
-    );
-};
-
-ClusterPage.propTypes = entityPagePropTypes;
-ClusterPage.defaultProps = entityPageDefaultProps;
-
-export default ClusterPage;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Control.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Control.jsx
deleted file mode 100644
index a1e8119ba59e0..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Control.jsx
+++ /dev/null
@@ -1,166 +0,0 @@
-import { useContext } from 'react';
-
-import entityTypes from 'constants/entityTypes';
-import Widget from 'Components/Widget';
-import Query from 'Components/CacheFirstQuery';
-import { CONTROL_QUERY as QUERY } from 'queries/controls';
-import ControlDetails from 'Components/ControlDetails';
-import ControlRelatedResourceList from 'Containers/Compliance/widgets/ControlRelatedResourceList';
-import { entityPagePropTypes, entityPageDefaultProps } from 'constants/entityPageProps';
-import useCases from 'constants/useCaseTypes';
-import ComplianceList from 'Containers/Compliance/List/List';
-import Loader from 'Components/Loader';
-import PageNotFound from 'Components/PageNotFound';
-import searchContext from 'Containers/searchContext';
-import isGQLLoading from 'utils/gqlLoading';
-
-import Header from './Header';
-import ResourceTabs from './ResourceTabs';
-
-const ControlPage = ({
-    entityId,
-    listEntityType1,
-    entityId1,
-    entityType2,
-    entityListType2,
-    entityId2,
-    query,
-    sidePanelMode,
-}) => {
-    const searchParam = useContext(searchContext);
-
-    return (
-        <Query query={QUERY} variables={{ id: entityId }}>
-            {({ data, loading }) => {
-                if (isGQLLoading(loading, data)) {
-                    return <Loader />;
-                }
-
-                if (!data || !data.results) {
-                    return (
-                        <PageNotFound
-                            resourceType={entityTypes.CONTROL}
-                            useCase={useCases.COMPLIANCE}
-                        />
-                    );
-                }
-
-                const { results: control, complianceStandards: standards } = data;
-                const standard = standards.find((item) => item.id === control.standardId);
-                const { name, standardId, interpretationText, description } = control;
-                const standardName = standard ? standard.name : '';
-                let contents;
-
-                if (listEntityType1 && !sidePanelMode) {
-                    const listQuery = {
-                        control: name,
-                        ...query[searchParam],
-                    };
-
-                    contents = (
-                        <section className="flex flex-col flex-1 overflow-y-auto h-full">
-                            <ComplianceList
-                                entityType={listEntityType1}
-                                query={listQuery}
-                                selectedRowId={entityId1}
-                                entityType2={entityType2}
-                                entityListType2={entityListType2}
-                                entityId2={entityId2}
-                            />
-                        </section>
-                    );
-                } else {
-                    contents = (
-                        <div
-                            className={`flex-1 relative bg-base-200 overflow-auto ${
-                                !sidePanelMode ? `p-6` : `p-4`
-                            } `}
-                        >
-                            <div
-                                className={`grid ${
-                                    !sidePanelMode
-                                        ? `grid grid-gap-6 xxxl:grid-gap-8 md:grid-auto-fit xxl:grid-auto-fit-wide md:grid-dense`
-                                        : ``
-                                }sm:grid-columns-1 grid-gap-5`}
-                            >
-                                <ControlDetails
-                                    standardId={standardId}
-                                    standardName={standardName}
-                                    control={name}
-                                    description={description}
-                                    className="sx-2"
-                                />
-                                {!!interpretationText.length && (
-                                    <Widget className="sx-2" header="Control guidance">
-                                        <div className="p-4 leading-loose whitespace-pre-wrap">
-                                            {interpretationText}
-                                        </div>
-                                    </Widget>
-                                )}
-                                {sidePanelMode && (
-                                    <>
-                                        <ControlRelatedResourceList
-                                            listEntityType={entityTypes.CLUSTER}
-                                            pageEntityType={entityTypes.CONTROL}
-                                            pageEntity={control}
-                                            standard={standardName}
-                                        />
-                                        <ControlRelatedResourceList
-                                            listEntityType={entityTypes.NAMESPACE}
-                                            pageEntityType={entityTypes.CONTROL}
-                                            pageEntity={control}
-                                            standard={standardName}
-                                        />
-                                        <ControlRelatedResourceList
-                                            listEntityType={entityTypes.NODE}
-                                            pageEntityType={entityTypes.CONTROL}
-                                            pageEntity={control}
-                                            standard={standardName}
-                                        />
-                                        <ControlRelatedResourceList
-                                            listEntityType={entityTypes.DEPLOYMENT}
-                                            pageEntityType={entityTypes.CONTROL}
-                                            pageEntity={control}
-                                            standard={standardName}
-                                        />
-                                    </>
-                                )}
-                            </div>
-                        </div>
-                    );
-                }
-
-                return (
-                    <section className="flex flex-col h-full w-full">
-                        {!sidePanelMode && (
-                            <>
-                                <Header
-                                    entityType={entityTypes.CONTROL}
-                                    listEntityType={listEntityType1}
-                                    entity={control}
-                                    entityName={`${standardName} ${name}`}
-                                />
-                                <ResourceTabs
-                                    entityId={entityId}
-                                    entityType={entityTypes.CONTROL}
-                                    selectedType={listEntityType1}
-                                    standardId={standardId}
-                                    resourceTabs={[
-                                        entityTypes.NODE,
-                                        entityTypes.DEPLOYMENT,
-                                        entityTypes.CLUSTER,
-                                    ]}
-                                />
-                            </>
-                        )}
-                        {contents}
-                    </section>
-                );
-            }}
-        </Query>
-    );
-};
-ControlPage.propTypes = entityPagePropTypes;
-ControlPage.defaultProps = entityPageDefaultProps;
-
-export default ControlPage;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Deployment.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Deployment.jsx
deleted file mode 100644
index 7cfd73c681c39..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Deployment.jsx
+++ /dev/null
@@ -1,194 +0,0 @@
-import { useContext } from 'react';
-import { useLocation } from 'react-router-dom-v5-compat';
-import { gql } from '@apollo/client';
-import pluralize from 'pluralize';
-
-import entityTypes from 'constants/entityTypes';
-import Widget from 'Components/Widget';
-import Query from 'Components/CacheFirstQuery';
-import Loader from 'Components/Loader';
-import { entityPagePropTypes, entityPageDefaultProps } from 'constants/entityPageProps';
-import URLService from 'utils/URLService';
-import ComplianceList from 'Containers/Compliance/List/List';
-import EntityCompliance from 'Containers/Compliance/widgets/EntityCompliance';
-import Cluster from 'images/cluster.svg';
-import Namespace from 'images/ns-icon.svg';
-import IconWidget from 'Components/IconWidget';
-import Labels from 'Containers/Compliance/widgets/Labels';
-import ComplianceByStandards from 'Containers/Compliance/widgets/ComplianceByStandards';
-import isGQLLoading from 'utils/gqlLoading';
-import searchContext from 'Containers/searchContext';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-
-import Header from './Header';
-import ResourceTabs from './ResourceTabs';
-
-export const DEPLOYMENT_QUERY = gql`
-    query getDeployment($id: ID!) {
-        deployment(id: $id) {
-            id
-            clusterId
-            clusterName
-            labels {
-                key
-                value
-            }
-            name
-            namespace
-            namespaceId
-        }
-    }
-`;
-
-function processData(data) {
-    if (!data || !data.deployment) {
-        return {};
-    }
-
-    const result = { ...data.deployment };
-    return result;
-}
-
-const DeploymentPage = ({
-    entityId,
-    listEntityType1,
-    entityId1,
-    entityType2,
-    entityListType2,
-    entityId2,
-    query,
-    sidePanelMode,
-}) => {
-    const searchParam = useContext(searchContext);
-    const match = useWorkflowMatch();
-    const location = useLocation();
-
-    return (
-        <Query query={DEPLOYMENT_QUERY} variables={{ id: entityId }}>
-            {({ loading, data }) => {
-                if (isGQLLoading(loading, data)) {
-                    return <Loader />;
-                }
-                const deployment = processData(data);
-                const { name, id, labels, clusterName, namespace, clusterId, namespaceId } =
-                    deployment;
-                let contents;
-
-                if (listEntityType1 && !sidePanelMode) {
-                    const listQuery = {
-                        groupBy:
-                            listEntityType1 === entityTypes.CONTROL ? entityTypes.STANDARD : '',
-                        deployment: name,
-                        ...query[searchParam],
-                    };
-                    contents = (
-                        <section className="flex flex-col flex-1 overflow-y-auto h-full">
-                            <ComplianceList
-                                entityType={listEntityType1}
-                                query={listQuery}
-                                selectedRowId={entityId1}
-                                entityType2={entityType2}
-                                entityListType2={entityListType2}
-                                entityId2={entityId2}
-                            />
-                        </section>
-                    );
-                } else {
-                    const clusterUrl = URLService.getURL(match, location)
-                        .base(entityTypes.CLUSTER, clusterId)
-                        .url();
-
-                    const namespaceUrl = URLService.getURL(match, location)
-                        .base(entityTypes.NAMESPACE, namespaceId)
-                        .url();
-
-                    contents = (
-                        <div
-                            className={`flex-1 relative bg-base-200 overflow-auto ${
-                                !sidePanelMode ? `p-6` : `p-4`
-                            } `}
-                        >
-                            <div
-                                className={`grid ${
-                                    !sidePanelMode
-                                        ? `grid grid-gap-6 xxxl:grid-gap-8 md:grid-auto-fit xxl:grid-auto-fit-wide md:grid-dense`
-                                        : ``
-                                } sm:grid-columns-1 grid-gap-5`}
-                            >
-                                <div
-                                    className="grid s-2 md:grid-auto-fit md:grid-dense"
-                                    style={{ '--min-tile-width': '50%' }}
-                                >
-                                    <div className="s-full pb-3">
-                                        <EntityCompliance
-                                            entityType={entityTypes.DEPLOYMENT}
-                                            entityId={id}
-                                            entityName={name}
-                                            clusterName={clusterName}
-                                        />
-                                    </div>
-                                    <div className="md:pr-3 pt-3">
-                                        <IconWidget
-                                            title="Parent Cluster"
-                                            icon={Cluster}
-                                            description={clusterName}
-                                            loading={loading}
-                                            linkUrl={clusterUrl}
-                                        />
-                                    </div>
-                                    <div className="md:pl-3 pt-3">
-                                        <IconWidget
-                                            title="Parent Namespace"
-                                            icon={Namespace}
-                                            description={namespace}
-                                            loading={loading}
-                                            linkUrl={namespaceUrl}
-                                        />
-                                    </div>
-                                </div>
-
-                                <Widget
-                                    className="sx-2"
-                                    header={`${labels.length} ${pluralize('Label', labels.length)}`}
-                                >
-                                    <Labels labels={labels} />
-                                </Widget>
-                                <ComplianceByStandards
-                                    entityId={id}
-                                    entityName={name}
-                                    entityType={entityTypes.DEPLOYMENT}
-                                />
-                            </div>
-                        </div>
-                    );
-                }
-
-                return (
-                    <section className="flex flex-col h-full w-full">
-                        {!sidePanelMode && (
-                            <>
-                                <Header
-                                    entityType={entityTypes.DEPLOYMENT}
-                                    listEntityType={listEntityType1}
-                                    entityName={name}
-                                    entityId={id}
-                                />
-                                <ResourceTabs
-                                    entityId={id}
-                                    entityType={entityTypes.DEPLOYMENT}
-                                    selectedType={listEntityType1}
-                                    resourceTabs={[entityTypes.CONTROL]}
-                                />
-                            </>
-                        )}
-                        {contents}
-                    </section>
-                );
-            }}
-        </Query>
-    );
-};
-DeploymentPage.propTypes = entityPagePropTypes;
-DeploymentPage.defaultProps = entityPageDefaultProps;
-
-export default DeploymentPage;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Header.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Header.jsx
deleted file mode 100644
index 0b26de161dbf9..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Header.jsx
+++ /dev/null
@@ -1,63 +0,0 @@
-import PropTypes from 'prop-types';
-import pluralize from 'pluralize';
-
-import PageHeader from 'Components/PageHeader';
-import ScanButton from 'Containers/Compliance/ScanButton';
-import ExportButton from 'Components/ExportButton';
-import useCaseTypes from 'constants/useCaseTypes';
-import entityTypes from 'constants/entityTypes';
-import usePermissions from 'hooks/usePermissions';
-
-import { entityNounSentenceCaseSingular } from '../entitiesForCompliance';
-
-const EntityHeader = ({ entityType, listEntityType, entityName, entityId, searchComponent }) => {
-    const { hasReadWriteAccess } = usePermissions();
-    const hasWriteAccessForCompliance = hasReadWriteAccess('Compliance');
-
-    const header = entityName || 'Loading...';
-    const subHeader = entityNounSentenceCaseSingular[entityType];
-    // Leave raw entity types in case customer depends on this convention for export file name.
-    let exportFilename = listEntityType
-        ? `${pluralize(listEntityType)} ACROSS ${entityType} "${entityName.toUpperCase()}"`
-        : `${entityType} "${entityName}"`;
-    exportFilename = `${exportFilename} Report`;
-    const scanCluster = entityType === entityTypes.CLUSTER ? entityId : '*';
-    const scanStandard = entityType === entityTypes.STANDARD ? entityId : '*';
-
-    return (
-        <PageHeader classes="bg-base-100" header={header} subHeader={subHeader}>
-            {searchComponent}
-            <div className="flex flex-1 items-center justify-end pl-4">
-                {hasWriteAccessForCompliance && scanCluster && (
-                    <ScanButton text="Scan" clusterId={scanCluster} standardId={scanStandard} />
-                )}
-                {(entityType === entityTypes.CLUSTER || entityType === entityTypes.STANDARD) && (
-                    <ExportButton
-                        fileName={exportFilename}
-                        type={entityType}
-                        page={useCaseTypes.COMPLIANCE}
-                        id={entityId}
-                    />
-                )}
-            </div>
-        </PageHeader>
-    );
-};
-
-EntityHeader.propTypes = {
-    entityType: PropTypes.string,
-    listEntityType: PropTypes.string,
-    entityName: PropTypes.string,
-    entityId: PropTypes.string,
-    searchComponent: PropTypes.node,
-};
-
-EntityHeader.defaultProps = {
-    entityType: '',
-    listEntityType: '',
-    entityName: '',
-    entityId: '',
-    searchComponent: null,
-};
-
-export default EntityHeader;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Namespace.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Namespace.jsx
deleted file mode 100644
index dd1f037fd3766..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Namespace.jsx
+++ /dev/null
@@ -1,205 +0,0 @@
-import { useContext } from 'react';
-import pluralize from 'pluralize';
-import { gql } from '@apollo/client';
-
-import ComplianceByStandards from 'Containers/Compliance/widgets/ComplianceByStandards';
-import Query from 'Components/CacheFirstQuery';
-import IconWidget from 'Components/IconWidget';
-import Cluster from 'images/cluster.svg';
-import Widget from 'Components/Widget';
-import ComplianceList from 'Containers/Compliance/List/List';
-import ResourceCount from 'Containers/Compliance/widgets/ResourceCount';
-import PageNotFound from 'Components/PageNotFound';
-import isGQLLoading from 'utils/gqlLoading';
-import Loader from 'Components/Loader';
-import Labels from 'Containers/Compliance/widgets/Labels';
-import EntityCompliance from 'Containers/Compliance/widgets/EntityCompliance';
-import entityTypes from 'constants/entityTypes';
-import useCases from 'constants/useCaseTypes';
-import { entityPagePropTypes, entityPageDefaultProps } from 'constants/entityPageProps';
-import searchContext from 'Containers/searchContext';
-
-import Header from './Header';
-import ResourceTabs from './ResourceTabs';
-
-export const QUERY = gql`
-    query getNamespace($id: ID!) {
-        results: namespace(id: $id) {
-            metadata {
-                clusterName
-                name
-                id
-                labels {
-                    key
-                    value
-                }
-            }
-        }
-    }
-`;
-
-function processData(data, entityId) {
-    const defaultValue = {
-        labels: [],
-        name: '',
-        clusterName: '',
-        id: entityId,
-    };
-
-    if (!data || !data.results || !data.results.metadata) {
-        return defaultValue;
-    }
-
-    const { metadata, ...rest } = data.results;
-
-    return {
-        ...rest,
-        ...metadata,
-    };
-}
-
-const NamespacePage = ({
-    entityId,
-    listEntityType1,
-    entityId1,
-    entityType2,
-    entityListType2,
-    entityId2,
-    query,
-    sidePanelMode,
-}) => {
-    const searchParam = useContext(searchContext);
-    return (
-        <Query query={QUERY} variables={{ id: entityId }}>
-            {({ loading, data }) => {
-                if (isGQLLoading(loading, data)) {
-                    return <Loader />;
-                }
-                if (!data.results) {
-                    return (
-                        <PageNotFound
-                            resourceType={entityTypes.NAMESPACE}
-                            useCase={useCases.COMPLIANCE}
-                        />
-                    );
-                }
-                const namespace = processData(data);
-                const { name, id, clusterName, labels } = namespace;
-                let contents;
-
-                if (listEntityType1 && !sidePanelMode) {
-                    const listQuery = {
-                        groupBy:
-                            listEntityType1 === entityTypes.CONTROL ? entityTypes.STANDARD : '',
-                        Namespace: namespace?.name,
-                        ...query[searchParam],
-                    };
-                    contents = (
-                        <section className="flex flex-col flex-1 overflow-y-auto h-full">
-                            <ComplianceList
-                                entityType={listEntityType1}
-                                query={listQuery}
-                                selectedRowId={entityId1}
-                                entityType2={entityType2}
-                                entityListType2={entityListType2}
-                                entityId2={entityId2}
-                            />
-                        </section>
-                    );
-                } else {
-                    contents = (
-                        <div
-                            className={`flex-1 relative bg-base-200 overflow-auto ${
-                                !sidePanelMode ? `p-6` : `p-4`
-                            } `}
-                        >
-                            <div
-                                className={`grid ${
-                                    !sidePanelMode
-                                        ? `grid grid-gap-6 xxxl:grid-gap-8 md:grid-auto-fit xxl:grid-auto-fit-wide md:grid-dense`
-                                        : ``
-                                } sm:grid-columns-1 grid-gap-5`}
-                            >
-                                <div
-                                    className="grid s-2 md:grid-auto-fit md:grid-dense"
-                                    style={{ '--min-tile-width': '50%' }}
-                                >
-                                    <div className="s-full pb-3">
-                                        <EntityCompliance
-                                            entityType={entityTypes.NAMESPACE}
-                                            entityId={id}
-                                            entityName={name}
-                                            clusterName={clusterName}
-                                        />
-                                    </div>
-                                    <div className="md:pr-3 pt-3">
-                                        <IconWidget
-                                            title="Parent Cluster"
-                                            icon={Cluster}
-                                            description={clusterName}
-                                            loading={loading}
-                                        />
-                                    </div>
-                                </div>
-
-                                <Widget
-                                    className="sx-2"
-                                    header={`${labels.length} ${pluralize('Label', labels.length)}`}
-                                >
-                                    <Labels labels={labels} />
-                                </Widget>
-                                <ComplianceByStandards
-                                    entityId={id}
-                                    entityName={name}
-                                    entityType={entityTypes.NAMESPACE}
-                                />
-                                {sidePanelMode && (
-                                    <>
-                                        <div
-                                            className="grid sx-2 sy-1 md:grid-auto-fit md:grid-dense"
-                                            style={{ '--min-tile-width': '50%' }}
-                                        >
-                                            <div className="md:pr-3 pt-3">
-                                                <ResourceCount
-                                                    entityType={entityTypes.DEPLOYMENT}
-                                                    relatedToResourceType={entityTypes.NAMESPACE}
-                                                    relatedToResource={namespace}
-                                                />
-                                            </div>
-                                        </div>
-                                    </>
-                                )}
-                            </div>
-                        </div>
-                    );
-                }
-
-                return (
-                    <section className="flex flex-col h-full w-full">
-                        {!sidePanelMode && (
-                            <>
-                                <Header
-                                    entityType={entityTypes.NAMESPACE}
-                                    listEntityType={listEntityType1}
-                                    entityName={name}
-                                    entityId={id}
-                                />
-                                <ResourceTabs
-                                    entityId={id}
-                                    entityType={entityTypes.NAMESPACE}
-                                    selectedType={listEntityType1}
-                                    resourceTabs={[entityTypes.CONTROL, entityTypes.DEPLOYMENT]}
-                                />
-                            </>
-                        )}
-                        {contents}
-                    </section>
-                );
-            }}
-        </Query>
-    );
-};
-NamespacePage.propTypes = entityPagePropTypes;
-NamespacePage.defaultProps = entityPageDefaultProps;
-
-export default NamespacePage;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Node.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Node.jsx
deleted file mode 100644
index 8d033be499762..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Node.jsx
+++ /dev/null
@@ -1,238 +0,0 @@
-import { useContext } from 'react';
-import pluralize from 'pluralize';
-
-import entityTypes from 'constants/entityTypes';
-import { NODE_QUERY } from 'queries/node';
-import Cluster from 'images/cluster.svg';
-import IpAddress from 'images/ip-address.svg';
-import Hostname from 'images/hostname.svg';
-import ContainerRuntime from 'images/container-runtime.svg';
-import ComplianceByStandards from 'Containers/Compliance/widgets/ComplianceByStandards';
-import Widget from 'Components/Widget';
-import Query from 'Components/CacheFirstQuery';
-import IconWidget from 'Components/IconWidget';
-import InfoWidget from 'Components/InfoWidget';
-import Labels from 'Containers/Compliance/widgets/Labels';
-import EntityCompliance from 'Containers/Compliance/widgets/EntityCompliance';
-import Loader from 'Components/Loader';
-import ComplianceList from 'Containers/Compliance/List/List';
-import PageNotFound from 'Components/PageNotFound';
-import { entityPagePropTypes, entityPageDefaultProps } from 'constants/entityPageProps';
-import useCases from 'constants/useCaseTypes';
-import isGQLLoading from 'utils/gqlLoading';
-import { getDateTime, getDistanceStrictAsPhrase } from 'utils/dateUtils';
-import searchContext from 'Containers/searchContext';
-
-import Header from './Header';
-import ResourceTabs from './ResourceTabs';
-
-function processData(data) {
-    if (!data || !data.node) {
-        return {
-            name: '',
-        };
-    }
-
-    const result = { ...data.node };
-    const [ipAddress] = result.internalIpAddresses;
-    result.ipAddress = ipAddress;
-
-    return result;
-}
-
-const NodePage = ({
-    entityId,
-    listEntityType1,
-    entityId1,
-    entityType2,
-    entityListType2,
-    entityId2,
-    query,
-    sidePanelMode,
-}) => {
-    const searchParam = useContext(searchContext);
-    return (
-        <Query query={NODE_QUERY} variables={{ id: entityId }}>
-            {({ loading, data }) => {
-                if (isGQLLoading(loading, data)) {
-                    return <Loader />;
-                }
-
-                if (!data.node) {
-                    return (
-                        <PageNotFound
-                            resourceType={entityTypes.NODE}
-                            useCase={useCases.COMPLIANCE}
-                        />
-                    );
-                }
-                const node = processData(data);
-                const {
-                    name,
-                    id,
-                    containerRuntimeVersion,
-                    clusterName,
-                    osImage,
-                    ipAddress,
-                    joinedAt,
-                    kernelVersion,
-                    labels,
-                } = node;
-                let contents;
-
-                if (listEntityType1 && !sidePanelMode) {
-                    const listQuery = {
-                        groupBy:
-                            listEntityType1 === entityTypes.CONTROL ? entityTypes.STANDARD : '',
-                        node: name,
-                        ...query[searchParam],
-                    };
-                    contents = (
-                        <section className="flex flex-col flex-1 overflow-y-auto h-full">
-                            <ComplianceList
-                                entityType={listEntityType1}
-                                query={listQuery}
-                                selectedRowId={entityId1}
-                                entityType2={entityType2}
-                                entityListType2={entityListType2}
-                                entityId2={entityId2}
-                            />
-                        </section>
-                    );
-                } else {
-                    contents = (
-                        <div
-                            className={`flex-1 relative bg-base-200 overflow-auto ${
-                                !sidePanelMode ? `p-6` : `p-4`
-                            } `}
-                        >
-                            <div
-                                style={{ '--min-tile-height': '190px' }}
-                                className={`grid ${
-                                    !sidePanelMode
-                                        ? `grid grid-gap-6 xxxl:grid-gap-8 md:grid-auto-fit xxl:grid-auto-fit-wide md:grid-dense`
-                                        : ``
-                                } sm:grid-columns-1 grid-gap-5`}
-                            >
-                                <div
-                                    className="grid s-2 md:grid-auto-fit md:grid-dense"
-                                    style={{ '--min-tile-width': '50%' }}
-                                >
-                                    <div className="s-full pb-3">
-                                        <EntityCompliance
-                                            entityType={entityTypes.NODE}
-                                            entityId={id}
-                                            entityName={name}
-                                            clusterName={clusterName}
-                                        />
-                                    </div>
-                                    <div className="md:pr-3 pt-3">
-                                        <IconWidget
-                                            title="Parent Cluster"
-                                            icon={Cluster}
-                                            description={clusterName}
-                                            loading={loading}
-                                        />
-                                    </div>
-                                    <div className="md:pl-3 pt-3">
-                                        <IconWidget
-                                            title="Container Runtime"
-                                            icon={ContainerRuntime}
-                                            description={containerRuntimeVersion}
-                                            loading={loading}
-                                        />
-                                    </div>
-                                </div>
-
-                                <div
-                                    className="grid s-2 md:grid-auto-fit md:grid-dense"
-                                    style={{ '--min-tile-width': '50%' }}
-                                >
-                                    <div className="md:pr-3 pb-3">
-                                        <InfoWidget
-                                            title="Operating System"
-                                            headline={osImage}
-                                            description={kernelVersion}
-                                            loading={loading}
-                                        />
-                                    </div>
-                                    <div className="md:pl-3 pb-3">
-                                        <InfoWidget
-                                            title="Node Join Time"
-                                            headline={getDistanceStrictAsPhrase(
-                                                joinedAt,
-                                                new Date()
-                                            )}
-                                            description={getDateTime(joinedAt)}
-                                            textSizeClass="text-base"
-                                            loading={loading}
-                                        />
-                                    </div>
-                                    <div className="md:pr-3 pt-3">
-                                        <IconWidget
-                                            title="IP Address"
-                                            icon={IpAddress}
-                                            description={ipAddress}
-                                            loading={loading}
-                                        />
-                                    </div>
-                                    <div className="md:pl-3 pt-3">
-                                        <IconWidget
-                                            title="Hostname"
-                                            icon={Hostname}
-                                            textSizeClass="text-base"
-                                            description={name}
-                                            loading={loading}
-                                        />
-                                    </div>
-                                </div>
-
-                                <Widget
-                                    className="sx-2"
-                                    header={`${labels.length} ${pluralize('Label', labels.length)}`}
-                                >
-                                    <Labels labels={labels} />
-                                </Widget>
-                                <ComplianceByStandards
-                                    entityId={id}
-                                    entityName={name}
-                                    entityType={entityTypes.NODE}
-                                />
-                            </div>
-                        </div>
-                    );
-                }
-
-                return (
-                    <section className="flex flex-col h-full w-full">
-                        {!sidePanelMode && (
-                            <>
-                                <Header
-                                    entityType={entityTypes.NODE}
-                                    listEntityType={listEntityType1}
-                                    entityName={name}
-                                    entityId={id}
-                                />
-                                <ResourceTabs
-                                    entityId={id}
-                                    entityType={entityTypes.NODE}
-                                    selectedType={listEntityType1}
-                                    resourceTabs={[
-                                        entityTypes.CONTROL,
-                                        entityTypes.CLUSTER,
-                                        entityTypes.NAMESPACE,
-                                    ]}
-                                />
-                            </>
-                        )}
-                        {contents}
-                    </section>
-                );
-            }}
-        </Query>
-    );
-};
-NodePage.propTypes = entityPagePropTypes;
-NodePage.defaultProps = entityPageDefaultProps;
-
-export default NodePage;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Page.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Page.jsx
deleted file mode 100644
index 385d0511f176a..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Page.jsx
+++ /dev/null
@@ -1,56 +0,0 @@
-import PropTypes from 'prop-types';
-import { useLocation } from 'react-router-dom-v5-compat';
-import URLService from 'utils/URLService';
-import entityTypes from 'constants/entityTypes';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-
-import NodePage from './Node';
-import NamespacePage from './Namespace';
-import ClusterPage from './Cluster';
-import ControlPage from './Control';
-import DeploymentPage from './Deployment';
-import StandardPage from './Standard';
-
-const ComplianceEntityPage = () => {
-    const location = useLocation();
-    const match = useWorkflowMatch();
-
-    const params = URLService.getParams(match, location);
-
-    const pageProps = {
-        entityId: params.pageEntityId,
-        listEntityType1: params.entityListType1,
-        entityType1: params.entityType1,
-        entityId1: params.entityId1,
-        entityType2: params.entityType2,
-        entityListType2: params.entityListType2,
-        entityId2: params.entityId2,
-        query: params.query,
-    };
-
-    const pageTypeMap = {
-        [entityTypes.CLUSTER]: <ClusterPage {...pageProps} />,
-        [entityTypes.NODE]: <NodePage {...pageProps} />,
-        [entityTypes.NAMESPACE]: <NamespacePage {...pageProps} />,
-        [entityTypes.CONTROL]: <ControlPage {...pageProps} />,
-        [entityTypes.DEPLOYMENT]: <DeploymentPage {...pageProps} />,
-        [entityTypes.STANDARD]: <StandardPage {...pageProps} />,
-    };
-
-    return pageTypeMap[params.pageEntityType];
-};
-
-ComplianceEntityPage.propTypes = {
-    params: PropTypes.shape({
-        entityId: PropTypes.string,
-        entityType: PropTypes.string,
-    }),
-    sidePanelMode: PropTypes.bool,
-};
-
-ComplianceEntityPage.defaultProps = {
-    params: null,
-    sidePanelMode: false,
-};
-
-export default ComplianceEntityPage;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/ResourceTabs.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/ResourceTabs.jsx
deleted file mode 100644
index 0fdf5148715b0..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/ResourceTabs.jsx
+++ /dev/null
@@ -1,103 +0,0 @@
-import PropTypes from 'prop-types';
-import { Link, useLocation } from 'react-router-dom-v5-compat';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { resourceLabels } from 'messages/common';
-import URLService from 'utils/URLService';
-import pluralize from 'pluralize';
-import Query from 'Components/ThrowingQuery';
-import { SEARCH_WITH_CONTROLS as QUERY } from 'queries/search';
-import queryService from 'utils/queryService';
-import { getResourceCountFromAggregatedResults } from '../complianceUtils';
-
-const ResourceTabs = ({ entityType, entityId, resourceTabs, selectedType }) => {
-    const match = useWorkflowMatch();
-    const location = useLocation();
-
-    function getLinkToListType(listEntityType) {
-        return URLService.getURL(match, location)
-            .base(entityType, entityId)
-            .push(listEntityType)
-            .query()
-            .url();
-    }
-
-    function processData(data) {
-        const tabData = [
-            {
-                title: 'Overview',
-                link: getLinkToListType(),
-                type: null,
-            },
-        ];
-
-        if (resourceTabs.length && data) {
-            resourceTabs.forEach((type) => {
-                const count = getResourceCountFromAggregatedResults(type, data);
-                if (count > 0) {
-                    tabData.push({
-                        title: `${count} ${pluralize(resourceLabels[type], count)}`,
-                        link: getLinkToListType(type),
-                        type,
-                    });
-                }
-            });
-        }
-
-        return tabData;
-    }
-
-    function getVariables() {
-        // entitytype.NODE and namespace don't play well in groupBy
-        return {
-            query: queryService.objectToWhereClause({ [`${entityType} ID`]: entityId }),
-        };
-    }
-
-    return (
-        <Query query={QUERY} variables={getVariables()}>
-            {({ loading, data }) => {
-                if (loading) {
-                    return null;
-                }
-                const tabData = processData(data);
-                return (
-                    <ul className="border-b border-base-400 bg-base-100 pl-3">
-                        {tabData.map((datum, i) => {
-                            const borderLeft = !i ? 'border-l' : '';
-                            const bgColor =
-                                datum.type === selectedType || (!selectedType && !datum.type)
-                                    ? 'bg-primary-200'
-                                    : 'bg-base-100';
-                            const textColor = 'text-base-600';
-
-                            return (
-                                <li key={datum.title} className="inline-block">
-                                    <Link
-                                        className={`no-underline ${textColor} ${borderLeft} ${bgColor} border-r border-base-400 min-w-32 px-3 text-center pt-3 pb-3 font-700 inline-block`}
-                                        to={datum.link}
-                                    >
-                                        {datum.title}
-                                    </Link>
-                                </li>
-                            );
-                        })}
-                    </ul>
-                );
-            }}
-        </Query>
-    );
-};
-
-ResourceTabs.propTypes = {
-    entityType: PropTypes.string.isRequired,
-    entityId: PropTypes.string.isRequired,
-    selectedType: PropTypes.string,
-    resourceTabs: PropTypes.arrayOf(PropTypes.string),
-};
-
-ResourceTabs.defaultProps = {
-    resourceTabs: PropTypes.arrayOf(PropTypes.string),
-    selectedType: null,
-};
-
-export default ResourceTabs;
diff --git a/ui/apps/platform/src/Containers/Compliance/Entity/Standard.jsx b/ui/apps/platform/src/Containers/Compliance/Entity/Standard.jsx
deleted file mode 100644
index 44c20dc5d966b..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Entity/Standard.jsx
+++ /dev/null
@@ -1,45 +0,0 @@
-import entityTypes from 'constants/entityTypes';
-import ComplianceList from 'Containers/Compliance/List/List';
-import { entityPagePropTypes, entityPageDefaultProps } from 'constants/entityPageProps';
-import ComplianceSearchInput from '../ComplianceSearchInput';
-import Header from '../List/Header';
-
-const StandardPage = ({
-    entityId,
-    listEntityType1,
-    entityId1,
-    entityType2,
-    entityListType2,
-    entityId2,
-}) => {
-    const listQuery = {
-        'Standard Id': entityId,
-    };
-    return (
-        <section className="flex flex-col h-full relative">
-            <Header
-                entityType={entityTypes.CONTROL}
-                searchComponent={
-                    <ComplianceSearchInput
-                        placeholder="Filter standards"
-                        categories={['COMPLIANCE']}
-                        shouldAddComplianceState
-                    />
-                }
-            />
-            <ComplianceList
-                entityType={listEntityType1}
-                query={listQuery}
-                selectedRowId={entityId1}
-                entityType2={entityType2}
-                entityListType2={entityListType2}
-                entityId2={entityId2}
-            />
-        </section>
-    );
-};
-
-StandardPage.propTypes = entityPagePropTypes;
-StandardPage.defaultProps = entityPageDefaultProps;
-
-export default StandardPage;
diff --git a/ui/apps/platform/src/Containers/Compliance/List/Header.jsx b/ui/apps/platform/src/Containers/Compliance/List/Header.jsx
deleted file mode 100644
index 44f7ca980ce1b..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/Header.jsx
+++ /dev/null
@@ -1,61 +0,0 @@
-import PropTypes from 'prop-types';
-import lowerCase from 'lodash/lowerCase';
-import startCase from 'lodash/startCase';
-import findKey from 'lodash/findKey';
-
-import PageHeader from 'Components/PageHeader';
-import ExportButton from 'Components/ExportButton';
-import ScanButton from 'Containers/Compliance/ScanButton';
-import { standardLabels } from 'messages/standards';
-import useCaseTypes from 'constants/useCaseTypes';
-import usePermissions from 'hooks/usePermissions';
-
-// Disable to prevent merge conflict below if we need to cherry pick fix to previous release.
-/* eslint-disable prettier/prettier */
-const ListHeader = ({ entityType, searchComponent, standard }) => {
-    const { hasReadWriteAccess } = usePermissions();
-    const hasWriteAccessForCompliance = hasReadWriteAccess('Compliance');
-
-    const standardId = findKey(standardLabels, (key) => key === standard) || standard;
-
-    // ROX-25189: Add nullish coalescing to include compliance operator standard id:
-    // in page header
-    // in file name
-    const headerText = standardId
-        ? standardLabels[standardId] ?? standardId
-        : `${startCase(lowerCase(entityType))}s`;
-
-    // If standardId is truthy, then standard page entity is CONTROL for address controls?s[standard]=WHAT_EVER&s[groupBy]=CATEGORY
-    const subHeaderText = standardId ? 'Standard' : 'Resource list';
-    return (
-        <PageHeader header={headerText} subHeader={subHeaderText}>
-            <div className="w-full">{searchComponent}</div>
-            <div className="flex flex-1 items-center justify-end pl-4">
-                {hasWriteAccessForCompliance && standardId && (
-                    <ScanButton text="Scan" standardId={standardId} />
-                )}
-                {standardId && (
-                    <ExportButton
-                        fileName={`${headerText} Compliance Report`}
-                        id={standardId}
-                        type="STANDARD"
-                        page={useCaseTypes.COMPLIANCE}
-                    />
-                )}
-            </div>
-        </PageHeader>
-    );
-};
-/* eslint-enable prettier/prettier */
-ListHeader.propTypes = {
-    searchComponent: PropTypes.element,
-    entityType: PropTypes.string.isRequired,
-    standard: PropTypes.string,
-};
-
-ListHeader.defaultProps = {
-    searchComponent: null,
-    standard: null,
-};
-
-export default ListHeader;
diff --git a/ui/apps/platform/src/Containers/Compliance/List/List.jsx b/ui/apps/platform/src/Containers/Compliance/List/List.jsx
deleted file mode 100644
index 586ef75dcdd82..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/List.jsx
+++ /dev/null
@@ -1,78 +0,0 @@
-import PropTypes from 'prop-types';
-import { useLocation, useNavigate } from 'react-router-dom-v5-compat';
-import lowerCase from 'lodash/lowerCase';
-import pluralize from 'pluralize';
-
-import URLService from 'utils/URLService';
-import { PageBody } from 'Components/Panel';
-import { searchCategories as searchCategoryTypes } from 'constants/entityTypes';
-import searchContext from 'Containers/searchContext';
-import { searchParams } from 'constants/searchParams';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import ListTable from './Table';
-import SidePanel from './SidePanel';
-import SidePanelAdjacentArea from './SidePanelAdjacentArea';
-import ComplianceSearchInput from '../ComplianceSearchInput';
-
-const ComplianceList = ({ entityType, query, selectedRowId, noSearch }) => {
-    const navigate = useNavigate();
-    const location = useLocation();
-    const match = useWorkflowMatch();
-    function setSelectedRowId(row) {
-        const { id } = row;
-        const url = URLService.getURL(match, location)
-            .set('entityListType1', entityType)
-            .set('entityId1', id)
-            .url();
-        navigate(url);
-    }
-
-    const placeholder = `Filter ${pluralize(lowerCase(entityType))}`;
-
-    const searchComponent = noSearch ? null : (
-        <ComplianceSearchInput
-            placeholder={placeholder}
-            categories={[searchCategoryTypes[entityType]]}
-        />
-    );
-
-    return (
-        <PageBody>
-            <div className="flex-shrink-1 overflow-hidden w-full">
-                <ListTable
-                    searchComponent={searchComponent}
-                    selectedRowId={selectedRowId}
-                    entityType={entityType}
-                    query={query}
-                    updateSelectedRow={setSelectedRowId}
-                />
-            </div>
-            {selectedRowId && (
-                <SidePanelAdjacentArea width="1/3">
-                    <searchContext.Provider value={searchParams.sidePanel}>
-                        <SidePanel entityType={entityType} entityId={selectedRowId} />
-                    </searchContext.Provider>
-                </SidePanelAdjacentArea>
-            )}
-        </PageBody>
-    );
-};
-
-export default ComplianceList;
-
-ComplianceList.propTypes = {
-    entityType: PropTypes.string.isRequired,
-    query: PropTypes.shape({}),
-    selectedRowId: PropTypes.string,
-    // entityType2: PropTypes.string,
-    // entityId2: PropTypes.string,
-    noSearch: PropTypes.bool,
-};
-
-ComplianceList.defaultProps = {
-    query: null,
-    selectedRowId: null,
-    noSearch: false,
-    // entityType2: null,
-    // entityId2: null
-};
diff --git a/ui/apps/platform/src/Containers/Compliance/List/Page.jsx b/ui/apps/platform/src/Containers/Compliance/List/Page.jsx
deleted file mode 100644
index 6c3d6ba9f21a2..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/Page.jsx
+++ /dev/null
@@ -1,58 +0,0 @@
-import { useContext } from 'react';
-import PropTypes from 'prop-types';
-import { useLocation } from 'react-router-dom-v5-compat';
-import lowerCase from 'lodash/lowerCase';
-import pluralize from 'pluralize';
-
-import URLService from 'utils/URLService';
-import ComplianceList from 'Containers/Compliance/List/List';
-import searchContext from 'Containers/searchContext';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import ComplianceSearchInput from '../ComplianceSearchInput';
-import Header from './Header';
-
-const ComplianceListPage = () => {
-    const location = useLocation();
-    const match = useWorkflowMatch();
-    const params = URLService.getParams(match, location);
-    const searchParam = useContext(searchContext);
-    const query = { ...params.query[searchParam] };
-    const { pageEntityListType, entityId1, entityType2, entityListType2, entityId2 } = params;
-    const placeholder = `Filter ${pluralize(lowerCase(pageEntityListType))}`;
-    return (
-        <section className="flex flex-col h-full relative">
-            <Header
-                entityType={pageEntityListType}
-                searchComponent={
-                    <ComplianceSearchInput
-                        placeholder={placeholder}
-                        categories={['COMPLIANCE']}
-                        shouldAddComplianceState
-                    />
-                }
-                standard={query.Standard || query.standard}
-            />
-            <ComplianceList
-                entityType={pageEntityListType}
-                query={query}
-                selectedRowId={entityId1}
-                entityType2={entityType2}
-                entityListType2={entityListType2}
-                entityId2={entityId2}
-                noSearch
-            />
-        </section>
-    );
-};
-
-ComplianceListPage.propTypes = {
-    params: PropTypes.shape({
-        entityType: PropTypes.string.isRequired,
-    }),
-};
-
-ComplianceListPage.defaultProps = {
-    params: null,
-};
-
-export default ComplianceListPage;
diff --git a/ui/apps/platform/src/Containers/Compliance/List/SidePanel.jsx b/ui/apps/platform/src/Containers/Compliance/List/SidePanel.jsx
deleted file mode 100644
index 79d7566d93c3b..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/SidePanel.jsx
+++ /dev/null
@@ -1,102 +0,0 @@
-import PropTypes from 'prop-types';
-import { ExternalLinkAltIcon } from '@patternfly/react-icons';
-import { Link, useLocation, useNavigate } from 'react-router-dom-v5-compat';
-
-import Query from 'Components/CacheFirstQuery';
-import CloseButton from 'Components/CloseButton';
-import { PanelNew, PanelBody, PanelHead, PanelHeadEnd } from 'Components/Panel';
-import { resourceTypes, standardEntityTypes } from 'constants/entityTypes';
-import ControlPage from 'Containers/Compliance/Entity/Control';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import URLService from 'utils/URLService';
-import getEntityName from 'utils/getEntityName';
-import { entityNameQueryMap } from 'utils/queryMap';
-import { truncate } from 'utils/textUtils';
-import NamespacePage from '../Entity/Namespace';
-import ClusterPage from '../Entity/Cluster';
-import NodePage from '../Entity/Node';
-import DeploymentPage from '../Entity/Deployment';
-
-const MAX_CONTROL_TITLE = 120;
-
-const ComplianceListSidePanel = ({ entityType, entityId }) => {
-    const navigate = useNavigate();
-    const location = useLocation();
-    const match = useWorkflowMatch();
-
-    function getEntityPage() {
-        switch (entityType) {
-            case resourceTypes.NODE:
-                return <NodePage entityId={entityId} sidePanelMode />;
-            case resourceTypes.NAMESPACE:
-                return <NamespacePage entityId={entityId} sidePanelMode />;
-            case resourceTypes.CLUSTER:
-                return <ClusterPage entityId={entityId} sidePanelMode />;
-            case resourceTypes.DEPLOYMENT:
-                return <DeploymentPage entityId={entityId} sidePanelMode />;
-            case standardEntityTypes.CONTROL:
-                return <ControlPage entityId={entityId} sidePanelMode />;
-            default:
-                return null;
-        }
-    }
-
-    function closeSidePanel() {
-        const baseURL = URLService.getURL(match, location).clearSidePanelParams().url();
-        navigate(baseURL);
-    }
-    const headerUrl = URLService.getURL(match, location).base(entityType, entityId).url();
-
-    return (
-        <Query query={entityNameQueryMap[entityType]} variables={{ id: entityId }}>
-            {({ loading, data }) => {
-                let linkText = 'loading...';
-                if (!loading && data) {
-                    linkText = truncate(getEntityName(entityType, data), MAX_CONTROL_TITLE);
-                }
-                const headerTextComponent = (
-                    <div className="w-full flex items-center">
-                        <div className="flex items-center" data-testid="side-panel-header">
-                            <Link to={headerUrl} className="w-full flex ml-4">
-                                <div className="flex flex-1 items-center leading-normal">
-                                    {linkText}
-                                </div>
-                            </Link>
-                            <Link
-                                className="mx-4 p-1 rounded flex"
-                                to={headerUrl}
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                aria-label="External link"
-                            >
-                                <ExternalLinkAltIcon />
-                            </Link>
-                        </div>
-                    </div>
-                );
-                const entityPage = getEntityPage();
-                return (
-                    <PanelNew testid="side-panel">
-                        <PanelHead>
-                            {headerTextComponent}
-                            <PanelHeadEnd>
-                                <CloseButton
-                                    onClose={closeSidePanel}
-                                    className="border-base-400 border-l"
-                                />
-                            </PanelHeadEnd>
-                        </PanelHead>
-                        <PanelBody>{entityPage}</PanelBody>
-                    </PanelNew>
-                );
-            }}
-        </Query>
-    );
-};
-
-ComplianceListSidePanel.propTypes = {
-    entityType: PropTypes.string.isRequired,
-    entityId: PropTypes.string.isRequired,
-};
-
-export default ComplianceListSidePanel;
diff --git a/ui/apps/platform/src/Containers/Compliance/List/SidePanelAdjacentArea.tsx b/ui/apps/platform/src/Containers/Compliance/List/SidePanelAdjacentArea.tsx
deleted file mode 100644
index 9c00dbdcc6977..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/SidePanelAdjacentArea.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import type { ReactElement, ReactNode } from 'react';
-
-type Width = '1/3' | '2/5' | '1/2' | '3/5';
-
-export type SidePanelAdjacentAreaProps = {
-    children: ReactNode;
-    width?: Width;
-};
-
-const widthClassNames: Record<Width, string> = {
-    '1/3': 'md:w-1/3', // Compliance
-    '2/5': 'md:w-2/5 xl:w-1/3 xxl:w-1/4', // Violations
-    '1/2': 'md:w-1/2', // Integrations
-    '3/5': 'md:w-3/5 lg:w-1/2 xl:w-2/5 xxl:w-1/3', // Risk
-};
-
-/*
- * Render an area (without animation nor overlay) that contains the content of a side panel.
- * Assume its parent has position relative.
- * Assume it follows its main panel sibling.
- *
- * If page width is less than medium, the side panel completely covers the main panel.
- * If page width is at least medium, the side panel has a fraction of page width (not including side nav).
- */
-function SidePanelAdjacentArea({
-    children,
-    width = '1/2',
-}: SidePanelAdjacentAreaProps): ReactElement {
-    return (
-        <div
-            className={`bg-base-100 border-base-400 border-l flex-shrink-0 h-full absolute left-0 top-0 w-full z-10 md:relative ${widthClassNames[width]}`}
-        >
-            {children}
-        </div>
-    );
-}
-
-export default SidePanelAdjacentArea;
diff --git a/ui/apps/platform/src/Containers/Compliance/List/Table.jsx b/ui/apps/platform/src/Containers/Compliance/List/Table.jsx
deleted file mode 100644
index a4fb72bdc44a6..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/Table.jsx
+++ /dev/null
@@ -1,388 +0,0 @@
-import { useState } from 'react';
-import PropTypes from 'prop-types';
-import pluralize from 'pluralize';
-import orderBy from 'lodash/orderBy';
-import { useQuery } from '@apollo/client';
-import { Alert } from '@patternfly/react-core';
-
-import entityTypes, { standardTypes } from 'constants/entityTypes';
-import { standardLabels } from 'messages/standards';
-import { CLIENT_SIDE_SEARCH_OPTIONS as SEARCH_OPTIONS } from 'constants/searchOptions';
-import Table from 'Components/Table';
-import { PanelNew, PanelBody, PanelHead, PanelHeadEnd, PanelTitle } from 'Components/Panel';
-import Loader from 'Components/Loader';
-import TablePagination from 'Components/TablePagination';
-import Query from 'Components/CacheFirstQuery';
-import NoResultsMessage from 'Components/NoResultsMessage';
-
-import { CLUSTERS_QUERY, NAMESPACES_QUERY, NODES_QUERY, DEPLOYMENTS_QUERY } from 'queries/table';
-import { LIST_STANDARD, STANDARDS_QUERY } from 'queries/standard';
-import queryService from 'utils/queryService';
-
-import { complianceEntityTypes, entityCountNounOrdinaryCase } from '../entitiesForCompliance';
-import TableGroup from './TableGroup';
-import { getColumnsByEntity, getColumnsByStandard, getColumnsForControl } from './tableColumns';
-
-function getQuery(entityType) {
-    switch (entityType) {
-        case entityTypes.CLUSTER:
-            return CLUSTERS_QUERY;
-        case entityTypes.NAMESPACE:
-            return NAMESPACES_QUERY;
-        case entityTypes.NODE:
-            return NODES_QUERY;
-        case entityTypes.DEPLOYMENT:
-            return DEPLOYMENTS_QUERY;
-        case entityTypes.CONTROL:
-            return LIST_STANDARD;
-        default:
-            return null;
-    }
-}
-
-function getVariables(entityType, query) {
-    const groupBy =
-        entityType === entityTypes.CONTROL
-            ? ['CONTROL', 'CATEGORY', ...(query.groupBy ? [query.groupBy] : [])]
-            : null;
-    return {
-        where: queryService.objectToWhereClause(query),
-        groupBy,
-    };
-}
-
-function complianceRate(numPassing, numFailing) {
-    return numPassing + numFailing > 0
-        ? `${Math.round((numPassing / (numPassing + numFailing)) * 100)}%`
-        : 'N/A';
-}
-
-function formatResourceData(data, resourceType) {
-    if (!data || !data.results || data.results.results.length === 0) {
-        return null;
-    }
-    const formattedData = { results: [] };
-    const entityMap = {};
-    let standardKeyIndex = 0;
-    let entityKeyIndex = 0;
-    data.results.results[0].aggregationKeys.forEach(({ scope }, idx) => {
-        if (scope === 'STANDARD') {
-            standardKeyIndex = idx;
-        }
-        if (scope === resourceType) {
-            entityKeyIndex = idx;
-        }
-    });
-    data.results.results.forEach(({ aggregationKeys, keys, numPassing, numFailing }) => {
-        const curEntity = aggregationKeys[entityKeyIndex].id;
-        const curStandard = aggregationKeys[standardKeyIndex].id;
-        const entity = keys[entityKeyIndex];
-        if (entity.__typename === '') {
-            return;
-        }
-        const entityMetaData = entity.metadata || {};
-
-        entityMap[curEntity] = entityMap[curEntity] || {
-            name: entity?.name || entity?.metadata?.name,
-            cluster: entity?.clusterName || entityMetaData?.clusterName || entity?.name,
-            namespace: entity?.namespace,
-            id: curEntity,
-            overall: {
-                numPassing: 0,
-                numFailing: 0,
-                average: 0,
-            },
-        };
-
-        if (numPassing + numFailing > 0) {
-            entityMap[curEntity][curStandard] = complianceRate(numPassing, numFailing);
-        }
-        entityMap[curEntity].overall.numPassing += numPassing;
-        entityMap[curEntity].overall.numFailing += numFailing;
-    });
-
-    Object.keys(entityMap).forEach((cluster) => {
-        const overallCluster = { ...entityMap[cluster] };
-        const { numPassing, numFailing } = overallCluster.overall;
-        overallCluster.overall.average = complianceRate(numPassing, numFailing);
-        formattedData.results.push(overallCluster);
-    });
-
-    return formattedData;
-}
-
-function formatStandardData(data) {
-    if (!data.results || !data.results.results || data.results.results.length === 0) {
-        return null;
-    }
-    const formattedData = { results: [], totalRows: 0 };
-    const groups = {};
-    let controlKeyIndex = null;
-    let categoryKeyIndex = null;
-    let groupByKeyIndex = null;
-    data.results.results[0].aggregationKeys.forEach(({ scope }, idx) => {
-        if (scope === 'CONTROL') {
-            controlKeyIndex = idx;
-        }
-        if (scope === 'CATEGORY') {
-            categoryKeyIndex = idx;
-        }
-        if (scope !== 'CATEGORY' && scope !== 'CONTROL') {
-            groupByKeyIndex = idx;
-        }
-    });
-    data.results.results.forEach(({ keys, numPassing, numFailing }) => {
-        const groupKey = groupByKeyIndex === null ? categoryKeyIndex : groupByKeyIndex;
-        const {
-            id: standard,
-            name,
-            clusterName,
-            description: groupDescription,
-            metadata,
-            __typename,
-        } = keys[groupKey];
-        // the check below is to address ROX-1420
-        if (__typename !== '') {
-            let groupName = name || standardLabels[standard] || standard;
-            if (__typename === 'Node') {
-                groupName = `${clusterName}/${name}`;
-            } else if (__typename === 'Namespace') {
-                groupName = `${metadata?.clusterName}/${metadata?.name}`;
-            }
-            if (!groups[groupName]) {
-                const groupId = parseInt(groupName, 10) || groupName;
-                groups[groupName] = {
-                    groupId,
-                    name: `${groupName} ${groupDescription ? `- ${groupDescription}` : ''}`,
-                    rows: [],
-                };
-            }
-            if (controlKeyIndex) {
-                const { id, name: controlName, description, standardId } = keys[controlKeyIndex];
-                groups[groupName].rows.push({
-                    id,
-                    description,
-                    standardId,
-                    standard: standardLabels[standardId],
-                    control: controlName,
-                    compliance: complianceRate(numPassing, numFailing),
-                    group: groupName,
-                });
-            }
-        }
-    });
-    Object.keys(groups).forEach((group) => {
-        formattedData.results.push(groups[group]);
-        formattedData.totalRows += groups[group].rows.length;
-    });
-    formattedData.results = orderBy(formattedData.results, ['groupId', 'name'], ['asc', 'asc']);
-    return formattedData;
-}
-
-function canFilterByComplianceState(filterQuery, complianceStateKey) {
-    return (
-        filterQuery[complianceStateKey] &&
-        (!Array.isArray(filterQuery[complianceStateKey]) ||
-            filterQuery[complianceStateKey].length <= 1)
-    );
-}
-
-const ListTable = ({ searchComponent, entityType, query, selectedRowId, updateSelectedRow }) => {
-    const [page, setPage] = useState(0);
-    // This is a client-side implementation of filtering by the "Compliance State" Search Option
-    function filterByComplianceState(data, filterQuery, isControlList) {
-        const complianceStateKey = SEARCH_OPTIONS.COMPLIANCE.STATE;
-        if (!canFilterByComplianceState(filterQuery, complianceStateKey)) {
-            return data.results;
-        }
-        const val = filterQuery[complianceStateKey].toLowerCase();
-        const isPassing = val === 'pass';
-        const isFailing = val === 'fail';
-        const { results } = data;
-        if (isControlList) {
-            return results
-                .map((result) => {
-                    const newResult = { ...result };
-                    newResult.rows = result.rows.filter((row) => {
-                        const intValue = parseInt(row.compliance, 10); // strValue comes in the format "100.00%"
-                        if (Number.isNaN(intValue)) {
-                            return false;
-                        }
-                        if (isPassing) {
-                            return intValue === 100;
-                        }
-                        if (isFailing) {
-                            return intValue !== 100;
-                        }
-                        return true;
-                    });
-                    return newResult;
-                })
-                .filter((result) => result.rows.length);
-        }
-
-        return results.filter((item) =>
-            Object.values(standardTypes).reduce((acc, standardId) => {
-                if (!item[standardId]) {
-                    return acc;
-                }
-                const intValue = parseInt(item[standardId], 10);
-                if (isPassing) {
-                    if (acc === false) {
-                        return acc;
-                    }
-                    return intValue === 100;
-                }
-                if (isFailing) {
-                    if (acc === true) {
-                        return acc;
-                    }
-                    return intValue !== 100;
-                }
-                return acc;
-            }, null)
-        );
-    }
-
-    function getTotalRows(data, isStandard) {
-        if (!isStandard) {
-            return data.length;
-        }
-        return data.reduce((acc, group) => acc + group.rows.length, 0);
-    }
-
-    const { loading: loadingStandards, data: standardsData } = useQuery(STANDARDS_QUERY);
-    if (loadingStandards) {
-        return <Loader />;
-    }
-    const { standardId } = query;
-    const gqlQuery = getQuery(entityType);
-    const variables = getVariables(entityType, query);
-    const isControlList = entityType === entityTypes.CONTROL;
-    const formatData = isControlList ? formatStandardData : formatResourceData;
-    let tableColumns;
-    if (standardId) {
-        tableColumns = getColumnsByStandard(standardId);
-    } else if (isControlList) {
-        tableColumns = getColumnsForControl(query);
-    } else {
-        tableColumns = getColumnsByEntity(entityType, standardsData.results);
-    }
-    let tableData;
-
-    return (
-        <Query query={gqlQuery} variables={variables}>
-            {({ loading, data }) => {
-                let contents = <Loader />;
-                let headerComponent;
-                let headerText;
-                let totalRows = 0;
-
-                if (!loading || (data && data.results)) {
-                    const formattedData = formatData(data, entityType);
-                    if (!formattedData) {
-                        headerText = entityCountNounOrdinaryCase(0, entityType);
-                        contents = <NoResultsMessage message="No data matched your search." />;
-                    } else {
-                        tableData = filterByComplianceState(formattedData, query, isControlList);
-                        totalRows = getTotalRows(tableData, isControlList);
-                        const entityCountNoun = entityCountNounOrdinaryCase(totalRows, entityType);
-                        const { groupBy } = query;
-
-                        // Resouces: CLUSTER, NAMESPACE, NODE, DEPLOYMENT.
-                        // Or CATEGORY from View Standard link of sunburst graph on dashboard.
-                        // Or STANDARD on Controls tab of resource single page.
-                        // Otherwise undefined.
-                        const { length } = tableData;
-                        const groupedByText = groupBy
-                            ? ` across ${
-                                  complianceEntityTypes.includes(groupBy)
-                                      ? entityCountNounOrdinaryCase(length, groupBy)
-                                      : `${length} ${pluralize(groupBy.toLowerCase(), length)}`
-                              }`
-                            : '';
-                        headerText = `${entityCountNoun}${groupedByText}`;
-
-                        const tableElement = isControlList ? (
-                            <TableGroup
-                                groups={tableData}
-                                totalRows={totalRows}
-                                tableColumns={tableColumns}
-                                onRowClick={updateSelectedRow}
-                                entityType={entityType}
-                                idAttribute="id"
-                                selectedRowId={selectedRowId}
-                            />
-                        ) : (
-                            <Table
-                                rows={tableData}
-                                columns={tableColumns}
-                                onRowClick={updateSelectedRow}
-                                idAttribute="id"
-                                selectedRowId={selectedRowId}
-                                noDataText="No results found. Please refine your search."
-                                page={page}
-                                defaultSorted={[
-                                    {
-                                        id: 'name',
-                                        desc: false,
-                                    },
-                                ]}
-                            />
-                        );
-                        contents = (
-                            <>
-                                {data.results.errorMessage && (
-                                    <Alert
-                                        variant="danger"
-                                        isInline
-                                        title="Unable to get data"
-                                        component="p"
-                                    >
-                                        {data.results.errorMessage}
-                                    </Alert>
-                                )}
-                                {tableElement}
-                            </>
-                        );
-                    }
-                    headerComponent = isControlList ? null : (
-                        <>
-                            <div className="flex flex-1 justify-start">{searchComponent}</div>
-                            <TablePagination page={page} dataLength={totalRows} setPage={setPage} />
-                        </>
-                    );
-                }
-                return (
-                    <PanelNew testid="panel">
-                        <PanelHead>
-                            <PanelTitle testid="panel-header" text={headerText} />
-                            <PanelHeadEnd>{headerComponent}</PanelHeadEnd>
-                        </PanelHead>
-                        <PanelBody>{contents}</PanelBody>
-                    </PanelNew>
-                );
-            }}
-        </Query>
-    );
-};
-
-ListTable.propTypes = {
-    searchComponent: PropTypes.node,
-    entityType: PropTypes.string,
-    query: PropTypes.shape({
-        standardId: PropTypes.string,
-        groupBy: PropTypes.string,
-    }),
-    selectedRowId: PropTypes.string,
-    updateSelectedRow: PropTypes.func.isRequired,
-};
-
-ListTable.defaultProps = {
-    searchComponent: null,
-    selectedRowId: null,
-    entityType: null,
-    query: null,
-};
-
-export default ListTable;
diff --git a/ui/apps/platform/src/Containers/Compliance/List/TableGroup.jsx b/ui/apps/platform/src/Containers/Compliance/List/TableGroup.jsx
deleted file mode 100644
index cac5d310637a4..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/TableGroup.jsx
+++ /dev/null
@@ -1,102 +0,0 @@
-import { Component } from 'react';
-import PropTypes from 'prop-types';
-import Table from 'Components/Table';
-import Collapsible from 'react-collapsible';
-import { ChevronDown, ChevronUp } from 'react-feather';
-
-import { entityCountNounOrdinaryCase } from '../entitiesForCompliance';
-
-const icons = {
-    opened: <ChevronUp size="14" />,
-    closed: <ChevronDown size="14" />,
-};
-
-class TableGroup extends Component {
-    static propTypes = {
-        groups: PropTypes.arrayOf(
-            PropTypes.shape({
-                name: PropTypes.string.isRequired,
-                rows: PropTypes.arrayOf(PropTypes.shape()),
-            })
-        ).isRequired,
-        totalRows: PropTypes.number.isRequired,
-        onRowClick: PropTypes.func.isRequired,
-        tableColumns: PropTypes.arrayOf(PropTypes.shape({})).isRequired,
-        idAttribute: PropTypes.string.isRequired,
-        entityType: PropTypes.string.isRequired,
-        selectedRowId: PropTypes.string,
-    };
-
-    static defaultProps = {
-        selectedRowId: null,
-    };
-
-    renderSubTable = ({ rows }) => {
-        const { tableColumns, onRowClick, selectedRowId, idAttribute } = this.props;
-        if (rows.length === 0) {
-            return null;
-        }
-        return (
-            <Table
-                rows={rows}
-                columns={tableColumns}
-                onRowClick={onRowClick}
-                selectedRowId={selectedRowId}
-                idAttribute={idAttribute}
-                showPagination={false}
-                pageSize={rows.length}
-                defaultSorted={[
-                    {
-                        id: 'control',
-                        desc: false,
-                    },
-                ]}
-            />
-        );
-    };
-
-    renderGroupByCollapsible = (state, { name, rows }) => (
-        <div className="flex justify-between cursor-pointer w-full py-1">
-            <div className="flex w-full justify-between">
-                <div className="flex items-center">
-                    <div className="flex ml-4 mr-3 rounded-full bg-base-100 h-5 w-5 justify-center text-tertiary-700 items-center border border-tertiary-400">
-                        {icons[state]}
-                    </div>
-                    <h1 className="p-3 pl-0 font-700 text-lg leading-normal">{name}</h1>
-                </div>
-                <div className="flex items-center flex-shrink-0 p-3 pr-4">
-                    {entityCountNounOrdinaryCase(rows.length, this.props.entityType)}
-                </div>
-            </div>
-        </div>
-    );
-
-    renderWhenOpened = (group) => this.renderGroupByCollapsible('opened', group);
-
-    renderWhenClosed = (group) => this.renderGroupByCollapsible('closed', group);
-
-    render() {
-        const { groups, totalRows } = this.props;
-        return (
-            <div className="flex flex-col w-full">
-                {groups.map((group, idx) => (
-                    <Collapsible
-                        open={idx === 0 || totalRows < 25}
-                        key={group.name}
-                        triggerDisabled={group.rows.length === 0}
-                        triggerClassName="table-group block bg-base-100 hover:bg-tertiary-200 hover:text-tertiary-800 z-10 relative hover:z-20"
-                        triggerOpenedClassName="table-group-active bg-tertiary-300 text-tertiary-900 block z-30 top-0 sticky"
-                        trigger={this.renderWhenClosed(group)}
-                        triggerWhenOpen={this.renderWhenOpened(group)}
-                        transitionTime={0.001}
-                        contentOuterClassName="before before:absolute before:bg-tertiary-300 before:h-full before:left-0 before:w-2 before:z-10 px-1 relative"
-                    >
-                        {this.renderSubTable(group)}
-                    </Collapsible>
-                ))}
-            </div>
-        );
-    }
-}
-
-export default TableGroup;
diff --git a/ui/apps/platform/src/Containers/Compliance/List/tableColumns.jsx b/ui/apps/platform/src/Containers/Compliance/List/tableColumns.jsx
deleted file mode 100644
index f32ff66ba3da8..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/tableColumns.jsx
+++ /dev/null
@@ -1,242 +0,0 @@
-import isEmpty from 'lodash/isEmpty';
-import qs from 'qs';
-
-import { defaultHeaderClassName, defaultColumnClassName } from 'Components/Table';
-import TableCellLink from 'Components/TableCellLink';
-import { resourceTypes, standardBaseTypes } from 'constants/entityTypes';
-import { sortVersion } from 'sorters/sorters';
-import { complianceBasePath } from 'routePaths';
-
-const getColumnValue = (row, accessor) => (row[accessor] ? row[accessor] : 'N/A');
-
-const columnsForStandard = (function getColumnsForStandards() {
-    const ret = {};
-    Object.entries(standardBaseTypes).forEach(([baseType, columnName]) => {
-        ret[baseType] = {
-            accessor: baseType,
-            Header: columnName,
-            Cell: ({ original }) => getColumnValue(original, baseType),
-        };
-    });
-    return ret;
-})();
-
-function getColumnForStandard(id) {
-    return {
-        accessor: id,
-        Header: standardBaseTypes[id] || id,
-        Cell: ({ original }) => getColumnValue(original, id),
-    };
-}
-
-const getClusterColumns = (standards) => [
-    {
-        accessor: 'id',
-        Header: 'id',
-        headerClassName: 'hidden',
-        className: 'hidden',
-    },
-    {
-        accessor: 'name',
-        Header: 'Cluster',
-        Cell: ({ original, pdf }) => {
-            const url = `${complianceBasePath}/clusters/${original.id}`;
-            return (
-                <TableCellLink pdf={pdf} url={url}>
-                    {original.name}
-                </TableCellLink>
-            );
-        },
-    },
-    ...standards.map(({ id }) => getColumnForStandard(id)),
-    {
-        accessor: 'overall.average',
-        Header: 'Overall',
-    },
-];
-
-// TODO verify that this is obsolete.
-// If not obsolete, it might need query argument like getColumnsForControl function.
-const getStandardColumns = (standard) => [
-    {
-        accessor: 'id',
-        Header: 'id',
-        headerClassName: 'hidden',
-        className: 'hidden',
-    },
-    {
-        accessor: 'control',
-        sortMethod: sortVersion,
-        Header: `${standard} Controls`,
-        headerClassName: `w-5/6 ${defaultHeaderClassName}`,
-        className: `w-5/6 ${defaultColumnClassName}`,
-        Cell: ({ original, pdf }) => {
-            const url = `${complianceBasePath}/controls/${original.id}`;
-            return (
-                <TableCellLink pdf={pdf} url={url}>
-                    {`${original.control} - ${original.description}`}
-                </TableCellLink>
-            );
-        },
-    },
-    {
-        accessor: 'compliance',
-        Header: 'Compliance',
-        headerClassName: `w-1/8 flex justify-end pr-4 ${defaultHeaderClassName}`,
-        className: `w-1/8 justify-end pr-4 ${defaultColumnClassName}`,
-    },
-];
-
-const getNodeColumns = (standards) => [
-    {
-        accessor: 'id',
-        Header: 'id',
-        headerClassName: 'hidden',
-        className: 'hidden',
-    },
-    {
-        accessor: 'name',
-        Header: 'Node',
-        Cell: ({ original, pdf }) => {
-            const url = `${complianceBasePath}/nodes/${original.id}`;
-            return (
-                <TableCellLink pdf={pdf} url={url}>
-                    {original.name}
-                </TableCellLink>
-            );
-        },
-    },
-    {
-        accessor: 'cluster',
-        Header: 'Cluster',
-    },
-    ...standards.map(({ id }) => columnsForStandard[id]),
-    {
-        accessor: 'overall.average',
-        Header: 'Overall',
-    },
-];
-
-const getNamespaceColumns = (standards) => [
-    {
-        accessor: 'id',
-        Header: 'id',
-        headerClassName: 'hidden',
-        className: 'hidden',
-    },
-    {
-        accessor: 'name',
-        Header: 'Namespace',
-        Cell: ({ original, pdf }) => {
-            const url = `${complianceBasePath}/namespaces/${original.id}`;
-            return (
-                <TableCellLink pdf={pdf} url={url}>
-                    {original.name}
-                </TableCellLink>
-            );
-        },
-    },
-    {
-        accessor: 'cluster',
-        Header: 'Cluster',
-    },
-    ...standards.map(({ id }) => columnsForStandard[id]),
-    {
-        accessor: 'overall.average',
-        Header: 'Overall',
-    },
-];
-
-const getDeploymentColumns = (standards) => [
-    {
-        accessor: 'id',
-        Header: 'id',
-        headerClassName: 'hidden',
-        className: 'hidden',
-    },
-    {
-        accessor: 'name',
-        Header: 'Name',
-        Cell: ({ original, pdf }) => {
-            const url = `${complianceBasePath}/deployments/${original.id}`;
-            return (
-                <TableCellLink pdf={pdf} url={url}>
-                    {original.name}
-                </TableCellLink>
-            );
-        },
-    },
-    {
-        accessor: 'cluster',
-        Header: 'Cluster Name',
-    },
-    {
-        accessor: 'namespace',
-        Header: 'Namespace',
-    },
-    ...standards.map(({ id }) => columnsForStandard[id]),
-    {
-        accessor: 'overall.average',
-        Header: 'Overall',
-    },
-];
-
-export function getColumnsForControl(query) {
-    return [
-        {
-            accessor: 'id',
-            Header: 'id',
-            headerClassName: 'hidden',
-            className: 'hidden',
-        },
-        {
-            accessor: 'control',
-            sortMethod: sortVersion,
-            Header: `Control`,
-            headerClassName: `w-5/6 ${defaultHeaderClassName}`,
-            className: `w-5/6 ${defaultColumnClassName}`,
-            Cell: ({ original, pdf }) => {
-                const search = isEmpty(query)
-                    ? ''
-                    : qs.stringify(query, {
-                          addQueryPrefix: true,
-                          arrayFormat: 'indices',
-                          encodeValuesOnly: true,
-                      });
-                const url = `${complianceBasePath}/controls/${original.id}${search}`;
-                return (
-                    <TableCellLink pdf={pdf} url={url}>
-                        {`${original.control} - ${original.description}`}
-                    </TableCellLink>
-                );
-            },
-        },
-        {
-            accessor: 'compliance',
-            Header: 'Compliance',
-            headerClassName: `w-1/8 flex justify-end pr-4 ${defaultHeaderClassName}`,
-            className: `w-1/8 justify-end pr-4 ${defaultColumnClassName}`,
-        },
-    ];
-}
-
-export function getColumnsByEntity(entityType, standards) {
-    const filteredStandards = standards.filter(({ scopes }) => scopes.includes(entityType));
-    switch (entityType) {
-        case resourceTypes.CLUSTER:
-            return getClusterColumns(filteredStandards);
-        case resourceTypes.NODE:
-            return getNodeColumns(filteredStandards);
-        case resourceTypes.NAMESPACE:
-            return getNamespaceColumns(filteredStandards);
-        case resourceTypes.DEPLOYMENT:
-            return getDeploymentColumns(filteredStandards);
-        default:
-            return [];
-    }
-}
-
-// TODO verify that this is obsolete.
-export function getColumnsByStandard(standardID) {
-    return getStandardColumns(standardBaseTypes[standardID]);
-}
diff --git a/ui/apps/platform/src/Containers/Compliance/List/tableColumns.test.js b/ui/apps/platform/src/Containers/Compliance/List/tableColumns.test.js
deleted file mode 100644
index 717839b7a0a92..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/List/tableColumns.test.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/* eslint vitest/expect-expect: ["error", { "assertFunctionNames": ["expectColumnsToContain", "expectColumnsNotToContain"] }] */
-
-import { resourceTypes, standardTypes } from 'constants/entityTypes';
-import { getColumnsByEntity, getColumnsByStandard } from './tableColumns';
-
-function expectColumnsToContain(columns, shouldContain) {
-    const accessors = columns.map((c) => c.accessor);
-    expect(accessors).toEqual(expect.arrayContaining(shouldContain));
-}
-
-function expectColumnsNotToContain(columns, shouldNotContain) {
-    const accessors = columns.map((c) => c.accessor);
-    expect(accessors).toEqual(expect.not.arrayContaining(shouldNotContain));
-}
-
-const standards = [
-    {
-        id: 'CIS_Kubernetes_v1_5',
-        name: 'CIS Kubernetes v1.5',
-        scopes: ['CLUSTER', 'NODE'],
-    },
-    {
-        id: 'HIPAA_164',
-        name: 'HIPAA 164',
-        scopes: ['CLUSTER', 'NAMESPACE', 'DEPLOYMENT'],
-    },
-    {
-        id: 'NIST_800_190',
-        name: 'NIST SP 800-190',
-        scopes: ['CLUSTER', 'NAMESPACE', 'DEPLOYMENT', 'NODE'],
-    },
-    {
-        id: 'NIST_SP_800_53_Rev_4',
-        name: 'NIST SP 800-53',
-        scopes: ['CLUSTER', 'NAMESPACE', 'DEPLOYMENT'],
-    },
-    {
-        id: 'PCI_DSS_3_2',
-        name: 'PCI DSS 3.2.1',
-        scopes: ['CLUSTER', 'NAMESPACE', 'DEPLOYMENT'],
-    },
-];
-
-describe('Get columns', () => {
-    it('can get columns by entity with exclusion', () => {
-        expectColumnsToContain(getColumnsByEntity(resourceTypes.CLUSTER, standards), [
-            'id',
-            standardTypes.NIST_800_190,
-            standardTypes.NIST_SP_800_53_Rev_4,
-        ]);
-
-        expectColumnsToContain(getColumnsByEntity(resourceTypes.NODE, standards), [
-            standardTypes.NIST_800_190,
-        ]);
-
-        expectColumnsNotToContain(getColumnsByEntity(resourceTypes.NODE, standards), [
-            standardTypes.NIST_SP_800_53_Rev_4,
-        ]);
-    });
-
-    it('can get columns by standard', () => {
-        expectColumnsToContain(getColumnsByStandard(standardTypes.NIST_SP_800_53_Rev_4), [
-            'id',
-            'compliance',
-            'control',
-        ]);
-    });
-});
diff --git a/ui/apps/platform/src/Containers/Compliance/Page.jsx b/ui/apps/platform/src/Containers/Compliance/Page.jsx
deleted file mode 100644
index ea130f752c833..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/Page.jsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import { memo } from 'react';
-import { Route, Routes } from 'react-router-dom-v5-compat';
-import isEqual from 'lodash/isEqual';
-
-import PageNotFound from 'Components/PageNotFound';
-import searchContext from 'Containers/searchContext';
-
-import Dashboard from './Dashboard/ComplianceDashboardPage';
-import Entity from './Entity/Page';
-import List from './List/Page';
-
-const complianceListPath = `:entityId1?/:entityType2?/:entityId2?`;
-const complianceEntityPath = `:pageEntityId?/:entityType1?/:entityId1?/:entityType2?/:entityId2?`;
-
-const Page = () => (
-    <searchContext.Provider value="s">
-        <Routes>
-            <Route index element={<Dashboard />} />
-            <Route path={`clusters/${complianceListPath}`} element={<List />} />
-            <Route path={`controls/${complianceListPath}`} element={<List />} />
-            <Route path={`deployments/${complianceListPath}`} element={<List />} />
-            <Route path={`namespaces/${complianceListPath}`} element={<List />} />
-            <Route path={`nodes/${complianceListPath}`} element={<List />} />
-
-            <Route path={`cluster/${complianceEntityPath}`} element={<Entity />} />
-            <Route path={`control/${complianceEntityPath}`} element={<Entity />} />
-            <Route path={`deployment/${complianceEntityPath}`} element={<Entity />} />
-            <Route path={`namespace/${complianceEntityPath}`} element={<Entity />} />
-            <Route path={`node/${complianceEntityPath}`} element={<Entity />} />
-            <Route path={`standard/${complianceEntityPath}`} element={<Entity />} />
-
-            <Route path="*" element={<PageNotFound useCase="compliance" />} />
-        </Routes>
-    </searchContext.Provider>
-);
-
-export default memo(Page, isEqual);
diff --git a/ui/apps/platform/src/Containers/Compliance/ScanButton.jsx b/ui/apps/platform/src/Containers/Compliance/ScanButton.jsx
deleted file mode 100644
index 235d4cd851752..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/ScanButton.jsx
+++ /dev/null
@@ -1,90 +0,0 @@
-import { Component } from 'react';
-import { connect } from 'react-redux';
-import PropTypes from 'prop-types';
-import { Mutation } from '@apollo/client/react/components';
-import { RefreshCcw } from 'react-feather';
-import { Spinner } from '@patternfly/react-core';
-
-import { actions as notificationActions } from 'reducers/notifications';
-import { TRIGGER_SCAN } from 'queries/standard';
-import Button from 'Components/Button';
-
-class ScanButton extends Component {
-    static propTypes = {
-        className: PropTypes.string,
-        text: PropTypes.string.isRequired,
-        textCondensed: PropTypes.string,
-        textClass: PropTypes.string,
-        clusterId: PropTypes.string,
-        standardId: PropTypes.string,
-        loaderSize: PropTypes.number,
-        addToast: PropTypes.func.isRequired,
-        removeToast: PropTypes.func.isRequired,
-        onScanTriggered: PropTypes.func,
-        scanInProgress: PropTypes.bool,
-    };
-
-    static defaultProps = {
-        className: 'btn btn-base h-10',
-        clusterId: '*',
-        textClass: null,
-        textCondensed: null,
-        standardId: '*',
-        loaderSize: 20,
-        onScanTriggered: () => {},
-    };
-
-    onClick = (triggerScan) => () => {
-        const { clusterId, standardId } = this.props;
-        triggerScan({ variables: { clusterId, standardId } })
-            .then(() => {
-                this.props.onScanTriggered();
-            })
-            .catch((e) => {
-                this.props.addToast(e.message);
-                setTimeout(this.props.removeToast, 2000);
-            });
-    };
-
-    render() {
-        const { className, text, textCondensed, textClass, loaderSize, scanInProgress } =
-            this.props;
-
-        return (
-            <Mutation mutation={TRIGGER_SCAN}>
-                {(triggerScan, { loading }) => {
-                    return (
-                        <Button
-                            dataTestId="scan-button"
-                            className={className}
-                            text={text}
-                            textCondensed={textCondensed}
-                            textClass={textClass}
-                            icon={
-                                scanInProgress ? (
-                                    <Spinner size="md" className="mx-1 lg:ml-1 lg:mr-3" />
-                                ) : (
-                                    <RefreshCcw
-                                        size="14"
-                                        className="bg-base-100 mx-1 lg:ml-1 lg:mr-3"
-                                    />
-                                )
-                            }
-                            onClick={this.onClick(triggerScan)}
-                            isLoading={loading}
-                            disabled={loading}
-                            loaderSize={loaderSize}
-                        />
-                    );
-                }}
-            </Mutation>
-        );
-    }
-}
-
-const mapDispatchToProps = {
-    addToast: notificationActions.addNotification,
-    removeToast: notificationActions.removeOldestNotification,
-};
-
-export default connect(null, mapDispatchToProps)(ScanButton);
diff --git a/ui/apps/platform/src/Containers/Compliance/complianceRBAC.ts b/ui/apps/platform/src/Containers/Compliance/complianceRBAC.ts
deleted file mode 100644
index 48fffe318bcf7..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/complianceRBAC.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import type { HasReadAccess } from 'hooks/usePermissions';
-import type { ResourceName } from 'types/roleResources';
-
-// Apply subset of patterns from routePaths.ts file.
-
-type ResourcePredicate = (hasReadAccess: HasReadAccess) => boolean;
-
-type ResourceItem = ResourceName | ResourcePredicate;
-
-// Given array of resource names, higher-order function returns predicate function.
-function everyResource(resourceItems: ResourceItem[]): ResourcePredicate {
-    return (hasReadAccess: HasReadAccess) =>
-        resourceItems.every((resourceItem) => evaluateItem(resourceItem, hasReadAccess));
-}
-
-// Given either predicate or name, does it have read access?
-function evaluateItem(resourceItem: ResourceItem, hasReadAccess: HasReadAccess) {
-    if (typeof resourceItem === 'function') {
-        return resourceItem(hasReadAccess);
-    }
-
-    return hasReadAccess(resourceItem);
-}
-
-// Semicolon on separate line following the strings prevents an extra changed line to add a string at the end.
-// prettier-ignore
-type ComplianceRouteKey =
-    | 'compliance/clusters'
-    | 'compliance/deployments'
-    | 'compliance/namespaces'
-    | 'compliance/nodes'
-    ;
-
-// Add properties in same order as route keys to minimize merge conflicts when multiple people add strings.
-const routeRequirementsMap: Record<ComplianceRouteKey, ResourcePredicate> = {
-    'compliance/clusters': everyResource(['Cluster']),
-    'compliance/deployments': everyResource(['Cluster', 'Deployment', 'Namespace']),
-    'compliance/namespaces': everyResource(['Cluster', 'Deployment', 'Namespace']),
-    'compliance/nodes': everyResource(['Cluster', 'Node']),
-};
-
-// Component provides hasReadAccess function from usePermissions hook.
-export function isComplianceRouteEnabled(
-    hasReadAccess: HasReadAccess,
-    routeKey: ComplianceRouteKey
-) {
-    const resourcePredicate = routeRequirementsMap[routeKey];
-    return resourcePredicate(hasReadAccess);
-}
diff --git a/ui/apps/platform/src/Containers/Compliance/complianceUtils.js b/ui/apps/platform/src/Containers/Compliance/complianceUtils.js
deleted file mode 100644
index cf0639b8065a1..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/complianceUtils.js
+++ /dev/null
@@ -1,58 +0,0 @@
-import uniq from 'lodash/uniq';
-import entityTypes from 'constants/entityTypes';
-
-export function getIndicesFromAggregatedResults(results) {
-    if (!results || results.length === 0) {
-        return {};
-    }
-
-    return results[0].aggregationKeys.reduce(
-        (map, item, i) => ({ ...map, [item.scope]: i }),
-        results[0].aggregationKeys[0],
-        {}
-    );
-}
-
-export function getResourceCountFromAggregatedResults(type, data) {
-    const { nodeResults, deploymentResults, namespaceResults, clusterResults } = data;
-    let source;
-
-    switch (type) {
-        case entityTypes.NODE:
-            source = nodeResults && nodeResults.results;
-            break;
-        case entityTypes.DEPLOYMENT:
-            source = deploymentResults && deploymentResults.results;
-            break;
-        case entityTypes.NAMESPACE:
-            source = namespaceResults && namespaceResults.results;
-            break;
-        case entityTypes.CLUSTER:
-            source = clusterResults && clusterResults.results;
-            break;
-        default:
-            source = clusterResults && clusterResults.results;
-    }
-
-    if (!source || source.length === 0) {
-        return 0;
-    }
-
-    const index = getIndicesFromAggregatedResults(source)[type];
-
-    if (!index && index !== 0) {
-        return 0;
-    }
-
-    let result;
-
-    if (type === entityTypes.CONTROL) {
-        result = source;
-    } else {
-        result = source.filter((datum) => datum.numFailing + datum.numPassing);
-    }
-
-    result = uniq(result.map((datum) => datum.aggregationKeys[index].id));
-
-    return result.length;
-}
diff --git a/ui/apps/platform/src/Containers/Compliance/entitiesForCompliance.ts b/ui/apps/platform/src/Containers/Compliance/entitiesForCompliance.ts
deleted file mode 100644
index 6abe2a9258086..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/entitiesForCompliance.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-export const complianceEntityTypes = [
-    // CATEGORY is scope in Table and groupBy in ComplianceByStandard
-    'CLUSTER',
-    'CONTROL',
-    'DEPLOYMENT',
-    'NAMESPACE',
-    'NODE',
-    'SECRET', // for example, ResourceCount of namespace
-    'STANDARD', // for groupBy but standard page entity is CONTROL for address controls?s[standard]=WHAT_EVER&s[groupBy]=CATEGORY
-] as const; // necessary for type below
-
-export type ComplianceEntityType = (typeof complianceEntityTypes)[number];
-
-type EntityType = ComplianceEntityType;
-
-export const entityNounOrdinaryCaseSingular: Record<EntityType, string> = {
-    CLUSTER: 'cluster',
-    CONTROL: 'control',
-    DEPLOYMENT: 'deployment',
-    NAMESPACE: 'namespace',
-    NODE: 'node',
-    SECRET: 'secret',
-    STANDARD: 'standard',
-};
-
-export const entityNounOrdinaryCasePlural: Record<EntityType, string> = {
-    CLUSTER: 'clusters',
-    CONTROL: 'controls',
-    DEPLOYMENT: 'deployments',
-    NAMESPACE: 'namespaces',
-    NODE: 'nodes',
-    SECRET: 'secrets',
-    STANDARD: 'standards',
-};
-
-export function entityNounOrdinaryCase(count: number, entityType: EntityType): string {
-    return count === 1
-        ? entityNounOrdinaryCaseSingular[entityType]
-        : entityNounOrdinaryCasePlural[entityType];
-}
-
-export function entityCountNounOrdinaryCase(count: number, entityType: EntityType): string {
-    return `${count} ${
-        count === 1
-            ? entityNounOrdinaryCaseSingular[entityType]
-            : entityNounOrdinaryCasePlural[entityType]
-    }`;
-}
-
-export const entityNounSentenceCaseSingular: Record<EntityType, string> = {
-    CLUSTER: 'Cluster',
-    CONTROL: 'Control',
-    DEPLOYMENT: 'Deployment',
-    NAMESPACE: 'Namespace',
-    NODE: 'Node',
-    SECRET: 'Secret',
-    STANDARD: 'Standard',
-};
-
-// Instead of pluralize, which returns CVES instead of CVEs.
-export const entityNounSentenceCasePlural: Record<EntityType, string> = {
-    CLUSTER: 'Clusters',
-    CONTROL: 'Controls',
-    DEPLOYMENT: 'Deployments',
-    NAMESPACE: 'Namespaces',
-    NODE: 'Nodes',
-    SECRET: 'Secrets',
-    STANDARD: 'Standards',
-};
-
-export function entityNounSentenceCase(count: number, entityType: EntityType): string {
-    return count === 1
-        ? entityNounSentenceCaseSingular[entityType]
-        : entityNounSentenceCasePlural[entityType];
-}
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/ClusterVersion.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/ClusterVersion.jsx
deleted file mode 100644
index d618b13ae3351..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/ClusterVersion.jsx
+++ /dev/null
@@ -1,68 +0,0 @@
-import PropTypes from 'prop-types';
-import { CLUSTER_VERSION_QUERY as QUERY } from 'queries/cluster';
-import { clusterVersionLabels } from 'messages/common';
-import { getDate } from 'utils/dateUtils';
-import NoResultsMessage from 'Components/NoResultsMessage';
-
-import Widget from 'Components/Widget';
-import Query from 'Components/CacheFirstQuery';
-import Loader from 'Components/Loader';
-
-const ClusterVersion = ({ clusterId }) => {
-    const variables = { id: clusterId };
-    return (
-        <Query query={QUERY} variables={variables}>
-            {({ loading, data }) => {
-                let contents = <Loader />;
-                let headerText = '';
-                if (!loading && data) {
-                    const cluster = data.cluster || {};
-                    const { type } = cluster;
-                    const status = cluster.status || {};
-                    const { orchestratorMetadata } = status;
-                    if (!orchestratorMetadata || !type) {
-                        contents = (
-                            <NoResultsMessage message="An error occurred retrieving cluster version data." />
-                        );
-                    } else {
-                        headerText = clusterVersionLabels[type];
-                        let version;
-                        if (type === 'KUBERNETES_CLUSTER') {
-                            version = orchestratorMetadata.version;
-                        } else if (orchestratorMetadata.openshiftVersion) {
-                            version = orchestratorMetadata.openshiftVersion;
-                        } else {
-                            version = 'OpenShift version cannot be determined';
-                        }
-                        contents = (
-                            <div className="py-8 w-full flex flex-col items-center justify-between">
-                                <div className="text-4xl text-center" data-testid="cluster-version">
-                                    {version}
-                                </div>
-                                <div>
-                                    Build date:&nbsp;
-                                    {getDate(orchestratorMetadata.buildDate)}
-                                </div>
-                            </div>
-                        );
-                    }
-                }
-                return (
-                    <Widget header={headerText} bodyClassName="p-2">
-                        {contents}
-                    </Widget>
-                );
-            }}
-        </Query>
-    );
-};
-
-ClusterVersion.propTypes = {
-    clusterId: PropTypes.string,
-};
-
-ClusterVersion.defaultProps = {
-    clusterId: null,
-};
-
-export default ClusterVersion;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/ClusterVersion.test.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/ClusterVersion.test.jsx
deleted file mode 100644
index f2cc8394309b7..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/ClusterVersion.test.jsx
+++ /dev/null
@@ -1,128 +0,0 @@
-import { MockedProvider } from '@apollo/client/testing';
-import { screen } from '@testing-library/react';
-
-import { CLUSTER_VERSION_QUERY } from 'queries/cluster';
-import renderWithRouter from 'test-utils/renderWithRouter';
-import ClusterVersion from './ClusterVersion';
-
-const clusterId = '1234';
-const k8sMocks = [
-    {
-        request: {
-            query: CLUSTER_VERSION_QUERY,
-            variables: {
-                id: clusterId,
-            },
-        },
-        result: {
-            data: {
-                cluster: {
-                    id: '180ed8f0-193d-4f42-83ec-0e12d707d2f6',
-                    name: 'remote',
-                    type: 'KUBERNETES_CLUSTER',
-                    status: {
-                        orchestratorMetadata: {
-                            version: 'v1.12.8-gke.10',
-                            openshiftVersion: '',
-                            buildDate: '2019-06-19T20:48:40Z',
-                            __typename: 'OrchestratorMetadata',
-                        },
-                        __typename: 'ClusterStatus',
-                    },
-                    __typename: 'Cluster',
-                },
-            },
-        },
-    },
-];
-const openshiftMocks = [
-    {
-        request: {
-            query: CLUSTER_VERSION_QUERY,
-            variables: {
-                id: clusterId,
-            },
-        },
-        result: {
-            data: {
-                cluster: {
-                    id: 'a365a914-74c7-46b4-b2c0-77d86f2d6e64',
-                    name: 'remote',
-                    type: 'OPENSHIFT4_CLUSTER',
-                    status: {
-                        orchestratorMetadata: {
-                            version: 'v1.20.0+bbbc079',
-                            openshiftVersion: '4.7.32',
-                            buildDate: '2021-09-17T20:21:04Z',
-                            __typename: 'OrchestratorMetadata',
-                        },
-                        __typename: 'ClusterStatus',
-                    },
-                    __typename: 'Cluster',
-                },
-            },
-        },
-    },
-];
-const openshiftVersionMissingMocks = [
-    {
-        request: {
-            query: CLUSTER_VERSION_QUERY,
-            variables: {
-                id: clusterId,
-            },
-        },
-        result: {
-            data: {
-                cluster: {
-                    id: 'a365a914-74c7-46b4-b2c0-77d86f2d6e64',
-                    name: 'remote',
-                    type: 'OPENSHIFT4_CLUSTER',
-                    status: {
-                        orchestratorMetadata: {
-                            version: 'v1.20.0+bbbc079',
-                            openshiftVersion: '',
-                            buildDate: '2021-09-17T20:21:04Z',
-                            __typename: 'OrchestratorMetadata',
-                        },
-                        __typename: 'ClusterStatus',
-                    },
-                    __typename: 'Cluster',
-                },
-            },
-        },
-    },
-];
-
-describe('Compliance ClusterVersion widget', () => {
-    it('renders Kubernetes cluster without error', async () => {
-        renderWithRouter(
-            <MockedProvider mocks={k8sMocks} addTypename={false}>
-                <ClusterVersion clusterId={clusterId} entityType="CLUSTER" />
-            </MockedProvider>,
-            { route: '/some-route' }
-        );
-        const clusterVersionElement = await screen.findByTestId('cluster-version');
-        expect(clusterVersionElement).toHaveTextContent('v1.12.8-gke.10');
-    });
-    it('renders Openshift cluster without error', async () => {
-        renderWithRouter(
-            <MockedProvider mocks={openshiftMocks} addTypename={false}>
-                <ClusterVersion clusterId={clusterId} entityType="CLUSTER" />
-            </MockedProvider>,
-            { route: '/some-route' }
-        );
-        const clusterVersionElement = await screen.findByTestId('cluster-version');
-        expect(clusterVersionElement).toHaveTextContent('4.7.32');
-    });
-    it('renders Openshift with missing version cluster without error', async () => {
-        renderWithRouter(
-            <MockedProvider mocks={openshiftVersionMissingMocks} addTypename={false}>
-                <ClusterVersion clusterId={clusterId} entityType="CLUSTER" />
-            </MockedProvider>,
-            { route: '/some-route' }
-        );
-        const clusterVersionElement = await screen.findByTestId('cluster-version');
-        expect(clusterVersionElement).toHaveTextContent('OpenShift version cannot be determined');
-    });
-});
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/ComplianceByStandard.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/ComplianceByStandard.jsx
deleted file mode 100644
index a492294012b8d..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/ComplianceByStandard.jsx
+++ /dev/null
@@ -1,265 +0,0 @@
-import { useContext } from 'react';
-import PropTypes from 'prop-types';
-import capitalize from 'lodash/capitalize';
-import { Link, useLocation } from 'react-router-dom-v5-compat';
-
-import URLService from 'utils/URLService';
-import entityTypes, { standardBaseTypes } from 'constants/entityTypes';
-import Widget from 'Components/Widget';
-import Sunburst from 'Components/visuals/Sunburst';
-import Query from 'Components/CacheFirstQuery';
-import Loader from 'Components/Loader';
-import {
-    COMPLIANCE_PASS_COLOR,
-    CRITICAL_SEVERITY_COLOR,
-    IMPORTANT_HIGH_SEVERITY_COLOR,
-    MODERATE_MEDIUM_SEVERITY_COLOR,
-    noViolationsColor,
-} from 'constants/severityColors';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { COMPLIANCE_STANDARDS } from 'queries/standard';
-import queryService from 'utils/queryService';
-import searchContext from 'Containers/searchContext';
-import isGQLLoading from 'utils/gqlLoading';
-
-import { getColor } from './colorsForCompliance';
-
-// Consistent with getColor helper function.
-const sunburstLegendData = [
-    { title: '100%', color: COMPLIANCE_PASS_COLOR },
-    { title: '> 70%', color: MODERATE_MEDIUM_SEVERITY_COLOR },
-    { title: '> 50%', color: IMPORTANT_HIGH_SEVERITY_COLOR },
-    { title: '< 50%', color: CRITICAL_SEVERITY_COLOR },
-    { title: 'Skipped', color: noViolationsColor },
-];
-
-const processSunburstData = (match, location, data, standard) => {
-    const groupMapping = {};
-    let controlKeyIndex = 0;
-    let categoryKeyIndex = 0;
-    data.results.results[0].aggregationKeys.forEach(({ scope }, idx) => {
-        if (scope === entityTypes.CONTROL) {
-            controlKeyIndex = idx;
-        }
-        if (scope === entityTypes.CATEGORY) {
-            categoryKeyIndex = idx;
-        }
-    });
-
-    const statsReducer = (statsMapping, { aggregationKeys, numPassing, numFailing, unit }) => {
-        const mapping = { ...statsMapping };
-        const isGroup = unit === entityTypes.CONTROL;
-        const keyIndex = isGroup ? categoryKeyIndex : controlKeyIndex;
-        const key = `${aggregationKeys[keyIndex].id}`;
-        const group = mapping[key];
-        const passing = isGroup && group ? group.passing + numPassing : numPassing;
-        const total =
-            isGroup && group ? group.total + numPassing + numFailing : numPassing + numFailing;
-        mapping[key] = {
-            passing,
-            total,
-        };
-        return mapping;
-    };
-
-    const groupStatsMapping = data.results.results.reduce(statsReducer, {});
-    const controlStatsMapping = data.checks.results.reduce(statsReducer, {});
-
-    const { groups, controls } = data.complianceStandards.find((datum) => datum.id === standard);
-
-    groups.forEach((datum) => {
-        const groupStat = groupStatsMapping[datum.id];
-        if (groupStat !== undefined) {
-            const value = Math.round((groupStat.passing / groupStat.total) * 100);
-            groupMapping[datum.id] = {
-                name: `${datum?.name}. ${datum?.description}`,
-                color: getColor(value),
-                value,
-                children: [],
-            };
-        }
-    });
-
-    controls
-        .filter((control) => control.standardId === standard)
-        .forEach((datum) => {
-            const group = groupMapping[datum.groupId];
-            const controlStat = controlStatsMapping[datum.id];
-
-            const url = URLService.getURL(match, location)
-                .base(entityTypes.CONTROL, datum.id)
-                .url();
-
-            if (group !== undefined && controlStat !== undefined) {
-                const value = Math.round((controlStat.passing / controlStat.total) * 100);
-                group.children.push({
-                    name: `${datum?.name} - ${datum?.description}`,
-                    color: getColor(value),
-                    link: url,
-                    value,
-                });
-            }
-        });
-
-    const { passing, total } = Object.values(groupStatsMapping).reduce(
-        (acc, currVal) => ({
-            passing: acc.passing + currVal.passing,
-            total: acc.total + currVal.total,
-        }),
-        { passing: 0, total: 0 }
-    );
-
-    const totalPassing = Math.round((passing / total) * 100);
-
-    return {
-        sunburstData: Object.values(groupMapping),
-        totalPassing,
-    };
-};
-
-const getNumControls = (sunburstData) =>
-    sunburstData.reduce((acc, curr) => acc + curr.children.length, 0);
-
-const createURLLink = (match, location, entityType, standardName, entityName, searchParam) => {
-    const query = { groupBy: entityTypes.CATEGORY };
-    if (entityName) {
-        const entityKey = capitalize(entityType);
-        query[entityKey] = entityName;
-    }
-    return URLService.getURL(match, location)
-        .base(entityTypes.CONTROL)
-        .query({ [searchParam]: { standard: standardName } })
-        .url();
-};
-
-const ComplianceByStandard = ({
-    standardName,
-    standardId,
-    entityName,
-    entityType,
-    entityId,
-    className,
-}) => {
-    const location = useLocation();
-    const match = useWorkflowMatch();
-    const searchParam = useContext(searchContext);
-    const groupBy = [
-        entityTypes.STANDARD,
-        entityTypes.CATEGORY,
-        entityTypes.CONTROL,
-        ...(entityType ? [entityType] : []),
-    ];
-    const where = {
-        Standard: standardName,
-    };
-    if (entityType && entityId) {
-        where[`${entityType} ID`] = entityId;
-    }
-    const variables = {
-        groupBy,
-        where: queryService.objectToWhereClause(where),
-    };
-
-    return (
-        <Query query={COMPLIANCE_STANDARDS(standardId)} variables={variables}>
-            {({ loading, data }) => {
-                let contents = null;
-                let viewStandardLink = null;
-                if (isGQLLoading(loading, data)) {
-                    contents = <Loader />;
-                } else if (data?.checks?.results?.length && data?.results?.results?.length) {
-                    const { sunburstData, totalPassing } = processSunburstData(
-                        match,
-                        location,
-                        data,
-                        standardId
-                    );
-
-                    const url = createURLLink(
-                        match,
-                        location,
-                        entityType,
-                        standardName,
-                        entityName,
-                        searchParam
-                    );
-                    const sunburstRootData = [
-                        {
-                            text: `${sunburstData.length} Categories`,
-                        },
-                        {
-                            text: `${getNumControls(sunburstData)} Controls`,
-                            link: url,
-                        },
-                    ];
-
-                    const linkTo = URLService.getURL(match, location)
-                        .base(entityTypes.CONTROL)
-                        .query({
-                            [searchParam]: {
-                                standard: standardName,
-                                groupBy: entityTypes.CATEGORY,
-                            },
-                        })
-                        .url();
-
-                    viewStandardLink = (
-                        <Link to={linkTo} className="no-underline">
-                            <button className="btn-sm btn-base" type="button">
-                                View Standard
-                            </button>
-                        </Link>
-                    );
-
-                    contents = (
-                        <Sunburst
-                            data={sunburstData}
-                            rootData={sunburstRootData}
-                            legendData={sunburstLegendData}
-                            totalValue={totalPassing}
-                            key={entityId}
-                        />
-                    );
-                } else if (
-                    data?.checks?.results?.length === 0 &&
-                    data?.results?.results?.length === 0
-                ) {
-                    contents = (
-                        <div className="flex flex-1 items-center justify-center p-4 leading-loose">
-                            No data available. Please run a scan.
-                        </div>
-                    );
-                }
-
-                return (
-                    <Widget
-                        className={`s-2 ${className}`}
-                        header={`${standardName} Compliance`}
-                        headerComponents={viewStandardLink}
-                        id={`${standardBaseTypes[standardId]}-compliance`}
-                    >
-                        {contents}
-                    </Widget>
-                );
-            }}
-        </Query>
-    );
-};
-
-ComplianceByStandard.propTypes = {
-    standardName: PropTypes.string.isRequired,
-    standardId: PropTypes.string.isRequired,
-    entityName: PropTypes.string,
-    entityType: PropTypes.string,
-    entityId: PropTypes.string,
-    className: PropTypes.string,
-};
-
-ComplianceByStandard.defaultProps = {
-    entityId: null,
-    entityType: null,
-    entityName: null,
-    className: '',
-};
-
-export default ComplianceByStandard;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/ComplianceByStandards.tsx b/ui/apps/platform/src/Containers/Compliance/widgets/ComplianceByStandards.tsx
deleted file mode 100644
index 6bf3709fe269e..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/ComplianceByStandards.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-import type { ReactElement } from 'react';
-import { useQuery } from '@apollo/client';
-
-import Loader from 'Components/Loader';
-import { STANDARDS_QUERY } from 'queries/standard';
-import type { ComplianceStandardScope } from 'services/ComplianceService';
-
-import ComplianceByStandard from './ComplianceByStandard';
-
-type StandardsQueryDataType = {
-    results: {
-        id: string;
-        name: string;
-        scopes: ComplianceStandardScope[];
-        hidden: boolean;
-    }[];
-};
-
-type ComplianceByStandardsProps = {
-    entityId: string;
-    entityName: string;
-    entityType: ComplianceStandardScope;
-};
-
-function ComplianceByStandards({
-    entityId,
-    entityName,
-    entityType,
-}: ComplianceByStandardsProps): ReactElement {
-    const { loading, data, error } = useQuery<StandardsQueryDataType>(STANDARDS_QUERY);
-    if (loading) {
-        return <Loader />;
-    }
-
-    if (error) {
-        return (
-            <div>
-                A database error has occurred. Please check that you have the correct permissions to
-                view this information.
-            </div>
-        );
-    }
-
-    const standards = !data?.results
-        ? []
-        : !entityType
-          ? data.results
-          : data.results.filter(({ scopes }) => scopes.includes(entityType));
-
-    return (
-        <>
-            {standards.map(({ name: standardName, id: standardId }) => (
-                <ComplianceByStandard
-                    key={standardId}
-                    standardName={standardName}
-                    standardId={standardId}
-                    entityId={entityId}
-                    entityName={entityName}
-                    entityType={entityType}
-                />
-            ))}
-        </>
-    );
-}
-
-export default ComplianceByStandards;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/ControlRelatedResourceList.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/ControlRelatedResourceList.jsx
deleted file mode 100644
index 832a72e6040a3..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/ControlRelatedResourceList.jsx
+++ /dev/null
@@ -1,148 +0,0 @@
-import { useContext } from 'react';
-import PropTypes from 'prop-types';
-import URLService from 'utils/URLService';
-import entityTypes from 'constants/entityTypes';
-import useCases from 'constants/useCaseTypes';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { AGGREGATED_RESULTS as QUERY } from 'queries/controls';
-import queryService from 'utils/queryService';
-import { useLocation, Link } from 'react-router-dom-v5-compat';
-import searchContext from 'Containers/searchContext';
-
-import { entityNounOrdinaryCase } from '../entitiesForCompliance';
-import LinkListWidget from './LinkListWidget';
-
-const ControlRelatedResourceList = ({
-    listEntityType,
-    pageEntityType,
-    pageEntity,
-    limit,
-    standard,
-    className,
-}) => {
-    const linkContext = useCases.COMPLIANCE;
-    const searchParam = useContext(searchContext);
-    const location = useLocation();
-    const match = useWorkflowMatch();
-
-    function processData(data) {
-        if (!data || !data.results) {
-            return [];
-        }
-
-        const { clusters } = data;
-        let options = clusters;
-        if (listEntityType === entityTypes.NAMESPACE) {
-            options =
-                clusters?.reduce(
-                    (acc, cluster) =>
-                        acc.concat(
-                            cluster.namespaces.map((ns) => ({
-                                ...ns.metadata,
-                                name: `${cluster?.name}/${ns?.metadata?.name}`,
-                            }))
-                        ),
-                    []
-                ) || [];
-        } else if (listEntityType === entityTypes.NODE) {
-            options =
-                clusters?.reduce(
-                    (acc, cluster) =>
-                        acc.concat(
-                            cluster.nodes.map((node) => ({
-                                ...node,
-                                name: `${cluster?.name}/${node?.name}`,
-                            }))
-                        ),
-                    []
-                ) || [];
-        } else if (listEntityType === entityTypes.DEPLOYMENT) {
-            options = data.deployments || [];
-        }
-
-        function getEntityName(id) {
-            const found = options.find((item) => item.id === id);
-            return found ? found.name : null;
-        }
-
-        const ids = data.results.results
-            .filter((item) => item.numPassing > 0 || item.numFailing > 0)
-            .map((item) => item.aggregationKeys.find((key) => key.scope === listEntityType).id);
-
-        const filteredIds = [];
-        ids.forEach((id) => {
-            if (!filteredIds.includes(id)) {
-                filteredIds.push(id);
-            }
-        });
-
-        const result = filteredIds.map((id) => ({
-            label: getEntityName(id),
-            link: URLService.getURL(match, location).base(listEntityType, id).url(),
-        }));
-
-        return result;
-    }
-
-    function getHeadline(items) {
-        if (!items) {
-            return 'Loading...';
-        }
-        const count = typeof items.length !== 'undefined' ? items.length : 0;
-        return `${count} related ${entityNounOrdinaryCase(count, listEntityType)}`;
-    }
-
-    const viewAllLink =
-        pageEntity && pageEntity.id && listEntityType !== entityTypes.SECRET ? (
-            <Link
-                to={URLService.getURL(match, location)
-                    .base(listEntityType, null, linkContext)
-                    .query({ [searchParam]: { standard, [pageEntityType]: pageEntity?.name } })
-                    .url()}
-                className="no-underline"
-            >
-                <button className="btn-sm btn-base btn-sm" type="button">
-                    View All
-                </button>
-            </Link>
-        ) : null;
-
-    const variables = {
-        groupBy: [pageEntityType, listEntityType],
-        unit: entityTypes.CONTROL,
-        where: queryService.objectToWhereClause({ [`${pageEntityType} ID`]: pageEntity.id }),
-    };
-
-    return (
-        <LinkListWidget
-            query={QUERY}
-            className={`sx-2 ${className}`}
-            variables={variables}
-            processData={processData}
-            getHeadline={getHeadline}
-            headerComponents={viewAllLink}
-            limit={limit}
-            id="related-resource-list"
-        />
-    );
-};
-
-ControlRelatedResourceList.propTypes = {
-    listEntityType: PropTypes.string.isRequired,
-    pageEntityType: PropTypes.string.isRequired,
-    pageEntity: PropTypes.shape({
-        id: PropTypes.string,
-        name: PropTypes.string,
-    }),
-    limit: PropTypes.number,
-    standard: PropTypes.string.isRequired,
-    className: PropTypes.string,
-};
-
-ControlRelatedResourceList.defaultProps = {
-    pageEntity: null,
-    limit: 10,
-    className: '',
-};
-
-export default ControlRelatedResourceList;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/EntityCompliance.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/EntityCompliance.jsx
deleted file mode 100644
index 17713fdf7f18e..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/EntityCompliance.jsx
+++ /dev/null
@@ -1,131 +0,0 @@
-import { useContext } from 'react';
-import PropTypes from 'prop-types';
-import { useLocation, useNavigate } from 'react-router-dom-v5-compat';
-
-import Widget from 'Components/Widget';
-import ArcSingle from 'Components/visuals/ArcSingle';
-import Query from 'Components/CacheFirstQuery';
-import Loader from 'Components/Loader';
-import entityTypes, { standardBaseTypes } from 'constants/entityTypes';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import URLService from 'utils/URLService';
-import { AGGREGATED_RESULTS } from 'queries/controls';
-import queryService from 'utils/queryService';
-import NoResultsMessage from 'Components/NoResultsMessage';
-import { standardLabels } from 'messages/standards';
-import searchContext from 'Containers/searchContext';
-
-import { entityNounSentenceCaseSingular } from '../entitiesForCompliance';
-import VerticalBarChart from './VerticalBarChart';
-
-const EntityCompliance = ({ entityId, entityType, entityName, clusterName }) => {
-    const entityTypeLabel = entityNounSentenceCaseSingular[entityType];
-    const searchParam = useContext(searchContext);
-    const match = useWorkflowMatch();
-    const location = useLocation();
-    const navigate = useNavigate();
-
-    function getBarData(results) {
-        return results
-            .filter((item) => item.numPassing + item.numFailing)
-            .map((item) => ({
-                x: standardBaseTypes[item.aggregationKeys[0].id] || item.aggregationKeys[0].id,
-                y: (item.numPassing / (item.numPassing + item.numFailing)) * 100,
-                standard: item.aggregationKeys[0].id,
-            }));
-    }
-
-    function getTotals(results) {
-        return results.reduce(
-            (acc, curr) => {
-                acc.numPassing += curr.numPassing;
-                acc.total += curr.numPassing + curr.numFailing;
-                return acc;
-            },
-            { numPassing: 0, total: 0 }
-        );
-    }
-    function valueClick(datum) {
-        const URL = URLService.getURL(match, location)
-            .base(entityTypes.CONTROL)
-            .query({
-                [searchParam]: {
-                    [entityType]: entityName,
-                    [entityTypes.CLUSTER]: clusterName,
-                    standard: standardLabels[datum.standard] || datum.x,
-                },
-            })
-            .url();
-
-        navigate(URL);
-    }
-
-    const whereClause = { [`${entityType} ID`]: entityId, [entityTypes.CLUSTER]: clusterName };
-    const variables = {
-        unit: entityTypes.CHECK,
-        groupBy: [entityTypes.STANDARD, entityType],
-        where: queryService.objectToWhereClause(whereClause),
-    };
-    return (
-        <Query query={AGGREGATED_RESULTS} variables={variables}>
-            {({ loading, data }) => {
-                let contents = <Loader />;
-                if (!loading && data && data.controls) {
-                    // Frontend filtering of control results.
-                    const { complianceStandards } = data;
-                    const results = data.controls.results.filter((result) => {
-                        const standardId = result.aggregationKeys[0].id;
-                        return complianceStandards.some(({ id }) => id === standardId);
-                    });
-
-                    if (!results.length) {
-                        contents = (
-                            <NoResultsMessage message="No data available. Please ensure your cluster is properly configured." />
-                        );
-                    } else {
-                        const barData = getBarData(results);
-                        const totals = getTotals(results);
-                        const pct =
-                            totals.total > 0
-                                ? Math.round((totals.numPassing / totals.total) * 100)
-                                : 0;
-                        contents = (
-                            <>
-                                <div className="flex w-full items-center">
-                                    <div className="px-2">
-                                        <ArcSingle value={pct} />
-                                    </div>
-                                    <div
-                                        className="w-full flex justify-end overflow-hidden relative"
-                                        style={{ maxHeight: '129px' }}
-                                    >
-                                        <VerticalBarChart
-                                            plotProps={{ height: 145 }}
-                                            data={barData}
-                                            onValueClick={valueClick}
-                                            legend={false}
-                                        />
-                                    </div>
-                                </div>
-                            </>
-                        );
-                    }
-                }
-                return <Widget header={`${entityTypeLabel} Compliance`}>{contents}</Widget>;
-            }}
-        </Query>
-    );
-};
-EntityCompliance.propTypes = {
-    entityId: PropTypes.string.isRequired,
-    entityType: PropTypes.string.isRequired,
-    entityName: PropTypes.string,
-    clusterName: PropTypes.string,
-};
-
-EntityCompliance.defaultProps = {
-    entityName: null,
-    clusterName: null,
-};
-
-export default EntityCompliance;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/HorizontalBarChart.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/HorizontalBarChart.jsx
deleted file mode 100644
index 2f6d9b1b86f5f..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/HorizontalBarChart.jsx
+++ /dev/null
@@ -1,207 +0,0 @@
-import {
-    FlexibleWidthXYPlot,
-    XAxis,
-    YAxis,
-    VerticalGridLines,
-    HorizontalBarSeries,
-    LabelSeries,
-} from 'react-vis';
-import { Link, useNavigate } from 'react-router-dom-v5-compat';
-import PropTypes from 'prop-types';
-import merge from 'deepmerge';
-
-import { getColor } from './colorsForCompliance';
-
-const minimalMargin = { top: -15, bottom: 0, left: 0, right: 0 };
-
-const sortByYValue = (a, b) => {
-    if (a.y < b.y) {
-        return -1;
-    }
-    if (a.y > b.y) {
-        return 1;
-    }
-    return 0;
-};
-
-const HorizontalBarChart = ({
-    data,
-    containerProps = {},
-    plotProps = {},
-    seriesProps = {},
-    valueFormat = (x) => x,
-    tickValues = [0, 25, 50, 75, 100],
-    minimal = false,
-}) => {
-    const navigate = useNavigate();
-
-    const showLabel = (value) => value >= 10;
-
-    const getLabelData = () =>
-        data.sort(sortByYValue).map((item) => {
-            let label = '';
-            // This prevents overlap between the value label and the axis label
-            if (showLabel(item.x)) {
-                label = (valueFormat && valueFormat(item.x).toString()) || '';
-            }
-            const val = {
-                x: item.x - 5,
-                y: item.y,
-                yOffset: minimal ? -6 : -3,
-                label,
-            };
-            // x offset for label
-            val.x -= val.label.length;
-            return val;
-        });
-
-    const onValueClickHandler = (datum) => {
-        if (datum.link) {
-            navigate(datum.link);
-        }
-    };
-
-    const getContainerProps = () => {
-        const defaultContainerProps = {
-            className: 'relative chart-container w-full horizontal-bar-responsive',
-        };
-        return merge(defaultContainerProps, containerProps);
-    };
-
-    const getPlotProps = () => {
-        const sortedData = data.sort(sortByYValue);
-        // This determines how far to push the bar graph to the right based on the longest axis label character's length
-        const maxLength = sortedData.reduce((acc, curr) => Math.max(curr.y.length, acc), 0);
-
-        // Magic number that makes the horizontal bars a reasonable size if there are fewer than 6
-        // but shrinks them if there are 6 or more.
-        const yRangeMultiplier = Math.min(41, 210 / sortedData.length);
-        const yRange = [...sortedData.map((item, i) => (i + 1) * yRangeMultiplier), 0];
-        const defaultPlotProps = {
-            height: minimal ? 25 : 350,
-            xDomain: [0, 102],
-            yType: 'category',
-            yRange,
-            margin: minimal ? minimalMargin : { top: 33.3, left: Math.ceil(maxLength * 7.5) },
-            stackBy: 'x',
-        };
-        return merge(defaultPlotProps, plotProps);
-    };
-
-    const getSeriesProps = () => {
-        const defaultSeriesProps = {
-            style: {
-                height: minimal ? 15 : 20,
-                rx: '2px',
-                cursor: `${minimal ? '' : 'pointer'}`,
-            },
-            onValueMouseOver: null,
-            onValueMouseOut: null,
-            onValueClick: onValueClickHandler,
-        };
-        return merge(defaultSeriesProps, seriesProps);
-    };
-
-    const sortedData = data.sort(sortByYValue);
-
-    // Generate y axis links
-    const axisLinks = sortedData.reduce((acc, curr) => {
-        if (curr.link) {
-            acc[curr.y] = curr.link;
-        }
-        return acc;
-    }, {});
-
-    const containerPropsMerged = getContainerProps();
-    const plotPropsMerged = getPlotProps();
-    const seriesPropsMerged = getSeriesProps();
-
-    function tickFormat(value) {
-        let inner = value;
-        if (axisLinks[value]) {
-            inner = (
-                <Link
-                    style={{
-                        fill: 'var(--pf-t--global--text--color--link--default)',
-                    }}
-                    className="text-sm"
-                    to={axisLinks[value]}
-                >
-                    {value}
-                </Link>
-            );
-        }
-
-        return <tspan>{inner}</tspan>;
-    }
-
-    return (
-        <div {...containerPropsMerged}>
-            <FlexibleWidthXYPlot {...plotPropsMerged}>
-                {/* Empty area bar background */}
-
-                {!minimal && <VerticalGridLines tickValues={tickValues} />}
-
-                {!minimal && (
-                    <XAxis
-                        orientation="top"
-                        tickSize={0}
-                        tickFormat={valueFormat}
-                        tickValues={tickValues}
-                    />
-                )}
-
-                {/* Empty Background */}
-                <HorizontalBarSeries
-                    data={sortedData.map((item) => ({
-                        x: 0,
-                        x0: Math.ceil(sortedData[0].x / 5) * 5,
-                        y: item.y,
-                        link: item.link,
-                    }))}
-                    color="var(--pf-t--color--gray--20)"
-                    style={{
-                        height: seriesPropsMerged.style.height,
-                        rx: '2',
-                        ry: '2',
-                        cursor: `${minimal ? '' : 'pointer'}`,
-                    }}
-                    onValueClick={onValueClickHandler}
-                />
-
-                {/* Values */}
-                <HorizontalBarSeries
-                    data={sortedData.map((item) => ({ ...item, color: getColor(item.x) }))}
-                    {...seriesPropsMerged}
-                    colorType="literal"
-                />
-                <LabelSeries
-                    data={getLabelData()}
-                    className="text-xs pointer-events-none theme-light"
-                    labelAnchorY="no-change"
-                    labelAnchorX="end-alignment"
-                    style={{
-                        fill: '#ffffff',
-                        cursor: `${minimal ? '' : 'pointer'}`,
-                    }}
-                />
-
-                {!minimal && (
-                    <YAxis tickSize={0} top={26} className="text-xs" tickFormat={tickFormat} />
-                )}
-            </FlexibleWidthXYPlot>
-        </div>
-    );
-};
-
-HorizontalBarChart.propTypes = {
-    data: PropTypes.arrayOf(PropTypes.shape({})).isRequired,
-    containerProps: PropTypes.shape({}),
-    plotProps: PropTypes.shape({}),
-    seriesProps: PropTypes.shape({}),
-    valueFormat: PropTypes.func,
-    tickValues: PropTypes.arrayOf(PropTypes.number),
-    minimal: PropTypes.bool,
-};
-
-export default HorizontalBarChart;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/Labels.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/Labels.jsx
deleted file mode 100644
index 304cbcf7c4b42..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/Labels.jsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import PropTypes from 'prop-types';
-import { Tooltip } from '@patternfly/react-core';
-
-const truncate = (key) => {
-    const index = key.indexOf('/');
-    return index > 0 ? key.substr(index + 1) : key;
-};
-
-const Labels = ({ labels }) => (
-    <ul className={` ${labels.length > 4 ? `columns-2` : ``} p-3 w-full leading-normal`}>
-        {labels.map((label) => (
-            <li
-                key={label.key}
-                className="border-b border-base-300 p-2 truncate"
-                style={{
-                    columnBreakInside: 'avoid',
-                    pageBreakInside: 'avoid',
-                }}
-            >
-                <Tooltip content={`${label.key} : ${label.value || '""'}`}>
-                    <span className="text-base word-break truncate">
-                        <span className="font-700 pr-1">{`${truncate(label.key)}:`}</span>
-                        <span>{label.value || '""'}</span>
-                    </span>
-                </Tooltip>
-            </li>
-        ))}
-    </ul>
-);
-
-Labels.propTypes = {
-    labels: PropTypes.arrayOf(PropTypes.object).isRequired,
-};
-
-export default Labels;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/LinkListWidget.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/LinkListWidget.jsx
deleted file mode 100644
index ce4da2029b7a8..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/LinkListWidget.jsx
+++ /dev/null
@@ -1,132 +0,0 @@
-import PropTypes from 'prop-types';
-import { Link } from 'react-router-dom-v5-compat';
-import { Alert } from '@patternfly/react-core';
-
-import Widget from 'Components/Widget';
-import Loader from 'Components/Loader';
-import Query from 'Components/ThrowingQuery';
-import NoResultsMessage from 'Components/NoResultsMessage';
-
-function getLI(item) {
-    if (!item) {
-        return null;
-    }
-
-    const content = item.link ? (
-        <Link
-            to={item.link}
-            title={item.label}
-            className="text-base-600 underline leading-normal px-2 inline-block w-full h-8 items-center flex"
-        >
-            <span className="truncate w-full">{item.label}</span>
-        </Link>
-    ) : (
-        item.label
-    );
-    return (
-        <li
-            key={item.label}
-            className="border-b border-base-300"
-            style={{
-                columnBreakInside: 'avoid',
-                pageBreakInside: 'avoid',
-            }}
-        >
-            {content}
-        </li>
-    );
-}
-
-const LinkListWidget = ({
-    query,
-    variables,
-    processData,
-    getHeadline,
-    className,
-    headerComponents,
-    limit,
-    id,
-    showEmpty,
-}) => (
-    <Query query={query} variables={variables}>
-        {({ loading, data, error }) => {
-            let contents;
-            let headline = getHeadline();
-
-            if (loading) {
-                contents = <Loader />;
-            } else if (error) {
-                contents = (
-                    <Alert
-                        variant="warning"
-                        isInline
-                        title="Unable to get aggregated results"
-                        component="p"
-                    >
-                        {error}
-                    </Alert>
-                );
-            } else if (data) {
-                const items = processData(data);
-                headline = getHeadline(items);
-
-                if (items.length === 0) {
-                    if (!showEmpty) {
-                        return null;
-                    }
-                    contents = <NoResultsMessage message="No data matched your search." />;
-                } else {
-                    contents = (
-                        <ul
-                            className={`${
-                                items.length > 5 ? `columns-2` : `columns-1`
-                            } p-3 py-1 w-full leading-normal overflow-hidden`}
-                        >
-                            {items.slice(0, limit).map((item) => getLI(item))}
-                        </ul>
-                    );
-                }
-            }
-
-            return (
-                <Widget
-                    className={`${className} w-full h-full`}
-                    header={headline}
-                    headerComponents={headerComponents}
-                    id={id}
-                >
-                    {contents}
-                </Widget>
-            );
-        }}
-    </Query>
-);
-
-LinkListWidget.propTypes = {
-    query: PropTypes.shape({}).isRequired,
-    variables: PropTypes.shape({}),
-    processData: PropTypes.func,
-    getHeadline: PropTypes.func,
-    className: PropTypes.string,
-    headerComponents: PropTypes.node,
-    limit: PropTypes.number,
-    showEmpty: PropTypes.bool,
-    id: PropTypes.string,
-};
-
-LinkListWidget.defaultProps = {
-    variables: null,
-    processData(data) {
-        return data;
-    },
-    getHeadline() {
-        return null;
-    },
-    className: '',
-    headerComponents: null,
-    limit: 10,
-    showEmpty: false,
-    id: 'link-list-widget',
-};
-
-export default LinkListWidget;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/ResourceCount.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/ResourceCount.jsx
deleted file mode 100644
index 838b8f6795c71..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/ResourceCount.jsx
+++ /dev/null
@@ -1,100 +0,0 @@
-import { useContext } from 'react';
-import { useLocation } from 'react-router-dom-v5-compat';
-import PropTypes from 'prop-types';
-import capitalize from 'lodash/capitalize';
-
-import entityTypes from 'constants/entityTypes';
-import URLService from 'utils/URLService';
-import Widget from 'Components/Widget';
-import Query from 'Components/CacheFirstQuery';
-import Loader from 'Components/Loader';
-import CountWidget from 'Components/CountWidget';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { SEARCH_WITH_CONTROLS as QUERY } from 'queries/search';
-import queryService from 'utils/queryService';
-import useCases from 'constants/useCaseTypes';
-import searchContext from 'Containers/searchContext';
-
-import { getResourceCountFromAggregatedResults } from '../complianceUtils';
-import { entityNounSentenceCaseSingular } from '../entitiesForCompliance';
-
-const ResourceCount = ({ entityType, relatedToResourceType, relatedToResource }) => {
-    const searchParam = useContext(searchContext);
-    const match = useWorkflowMatch();
-    const location = useLocation();
-
-    function getUrl() {
-        if (entityType === entityTypes.SECRET) {
-            return URLService.getURL(match, location)
-                .set('context', useCases.SECRET)
-                .query({
-                    [searchParam]: {
-                        [`${capitalize(relatedToResourceType)}`]: relatedToResource?.name,
-                    },
-                })
-                .url();
-        }
-
-        return URLService.getURL(match, location)
-            .base(relatedToResourceType, relatedToResource.id)
-            .push(entityType)
-            .url();
-    }
-
-    function getVariables() {
-        let query;
-        switch (relatedToResourceType) {
-            case entityTypes.NAMESPACE:
-                query = {
-                    namespace: relatedToResource.name,
-                    cluster: relatedToResource.clusterName,
-                };
-                break;
-            default:
-                query = { [`${capitalize(relatedToResourceType)} ID`]: relatedToResource.id };
-        }
-
-        return {
-            query: queryService.objectToWhereClause(query),
-            categories: [],
-        };
-    }
-
-    const variables = getVariables();
-    const headerText = `${entityNounSentenceCaseSingular[entityType]} Count`;
-    const url = getUrl();
-
-    return (
-        <Query query={QUERY} variables={variables}>
-            {({ loading, data }) => {
-                const contents = <Loader />;
-                if (!loading && data) {
-                    const resourceCount = getResourceCountFromAggregatedResults(entityType, data);
-
-                    return <CountWidget title={headerText} count={resourceCount} linkUrl={url} />;
-                }
-                return (
-                    <Widget header={headerText} bodyClassName="p-2">
-                        {contents}
-                    </Widget>
-                );
-            }}
-        </Query>
-    );
-};
-
-ResourceCount.propTypes = {
-    entityType: PropTypes.string.isRequired,
-    relatedToResourceType: PropTypes.string.isRequired,
-    relatedToResource: PropTypes.shape({
-        id: PropTypes.string,
-        name: PropTypes.string,
-        clusterName: PropTypes.string,
-    }),
-};
-
-ResourceCount.defaultProps = {
-    relatedToResource: null,
-};
-
-export default ResourceCount;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/StandardsAcrossEntity.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/StandardsAcrossEntity.jsx
deleted file mode 100644
index 0682497ca2e46..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/StandardsAcrossEntity.jsx
+++ /dev/null
@@ -1,148 +0,0 @@
-import { useContext } from 'react';
-import PropTypes from 'prop-types';
-import { useLocation } from 'react-router-dom-v5-compat';
-import { useQuery } from '@apollo/client';
-import merge from 'lodash/merge';
-
-import entityTypes, { standardBaseTypes } from 'constants/entityTypes';
-import { standardLabels } from 'messages/standards';
-import URLService from 'utils/URLService';
-import Widget from 'Components/Widget';
-import Loader from 'Components/Loader';
-import NoResultsMessage from 'Components/NoResultsMessage';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { AGGREGATED_RESULTS_ACROSS_ENTITY } from 'queries/controls';
-import searchContext from 'Containers/searchContext';
-
-import { entityNounOrdinaryCasePlural } from '../entitiesForCompliance';
-import HorizontalBarChart from './HorizontalBarChart';
-
-function formatAsPercent(x) {
-    return `${x}%`;
-}
-
-function setStandardsMapping(data, key, type) {
-    const mapping = {};
-    data[key].results.forEach((result) => {
-        const standardId = result.aggregationKeys[0].id;
-        if (!data.complianceStandards.some(({ id }) => id === standardId)) {
-            return; // because it implies standardId has hideScanResults: true
-        }
-        const { numPassing, numFailing } = result;
-        if (numPassing === 0 && numFailing === 0) {
-            return;
-        }
-        if (!mapping[standardId]) {
-            mapping[standardId] = {};
-            mapping[standardId][type] = {
-                passing: numPassing,
-                total: numPassing + numFailing,
-            };
-        } else {
-            const { passing, total } = mapping[standardId][type];
-            mapping[standardId][type] = {
-                passing: passing + numPassing,
-                total: total + (numPassing + numFailing),
-            };
-        }
-    });
-
-    return mapping;
-}
-
-const StandardsAcrossEntity = ({ entityType, bodyClassName, className }) => {
-    const searchParam = useContext(searchContext);
-    const match = useWorkflowMatch();
-    const location = useLocation();
-    const headerText = `Passing standards across ${entityNounOrdinaryCasePlural[entityType]}`;
-
-    function processData(data, type) {
-        if (!data || !data.controls || !data.controls.results.length) {
-            return [];
-        }
-        const standardsMapping = merge(
-            {},
-            setStandardsMapping(data, 'results', 'checks'),
-            setStandardsMapping(data, 'controls', 'controls')
-        );
-
-        const barData = Object.keys(standardsMapping).map((standardId) => {
-            const { controls } = standardsMapping[standardId];
-            const { passing: passingControls, total: totalControls } = controls;
-            const percentagePassing = Math.round((passingControls / totalControls) * 100) || 0;
-            const link = URLService.getURL(match, location)
-                .base(entityTypes.CONTROL)
-                .query({
-                    [searchParam]: {
-                        groupBy: type,
-                        standard: standardLabels[standardId] || standardId,
-                    },
-                })
-                .url();
-            const dataPoint = {
-                y: standardBaseTypes[standardId] || standardId,
-                x: percentagePassing,
-                link,
-            };
-            return dataPoint;
-        });
-        return barData;
-    }
-
-    const variables = {
-        groupBy: [entityTypes.STANDARD, entityType],
-        unit: entityTypes.CHECK,
-    };
-    const { loading, error, data } = useQuery(AGGREGATED_RESULTS_ACROSS_ENTITY(entityType), {
-        variables,
-    });
-
-    if (error) {
-        return (
-            <Widget
-                className={`s-2 ${className}`}
-                header={headerText}
-                bodyClassName={`graph-bottom-border ${bodyClassName}`}
-            >
-                <div>
-                    A database error has occurred. Please check that you have the correct
-                    permissions to view this information.
-                </div>
-            </Widget>
-        );
-    }
-
-    let contents;
-    if (!loading && data && data.complianceStandards) {
-        const results = processData(data, entityType);
-        if (!results.length) {
-            contents = <NoResultsMessage message="No data available. Please run a scan." />;
-        } else {
-            contents = <HorizontalBarChart data={results} valueFormat={formatAsPercent} />;
-        }
-    } else {
-        contents = <Loader />;
-    }
-    return (
-        <Widget
-            className={`s-2 ${className}`}
-            header={headerText}
-            bodyClassName={`graph-bottom-border ${bodyClassName}`}
-        >
-            {contents}
-        </Widget>
-    );
-};
-
-StandardsAcrossEntity.propTypes = {
-    entityType: PropTypes.string.isRequired,
-    bodyClassName: PropTypes.string,
-    className: PropTypes.string,
-};
-
-StandardsAcrossEntity.defaultProps = {
-    bodyClassName: 'px-4 pt-1',
-    className: '',
-};
-
-export default StandardsAcrossEntity;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/StandardsByEntity.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/StandardsByEntity.jsx
deleted file mode 100644
index b500f36f0d675..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/StandardsByEntity.jsx
+++ /dev/null
@@ -1,179 +0,0 @@
-import { useContext } from 'react';
-import PropTypes from 'prop-types';
-import { useLocation } from 'react-router-dom-v5-compat';
-import { useQuery } from '@apollo/client';
-import capitalize from 'lodash/capitalize';
-import sortBy from 'lodash/sortBy';
-import chunk from 'lodash/chunk';
-
-import entityTypes from 'constants/entityTypes';
-import URLService from 'utils/URLService';
-import Widget from 'Components/Widget';
-import Loader from 'Components/Loader';
-import NoResultsMessage from 'Components/NoResultsMessage';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { standardLabels } from 'messages/standards';
-import { AGGREGATED_RESULTS_STANDARDS_BY_ENTITY } from 'queries/controls';
-import searchContext from 'Containers/searchContext';
-
-import { entityNounOrdinaryCaseSingular } from '../entitiesForCompliance';
-import VerticalClusterBar from './VerticalClusterBar';
-
-function processData(match, location, data, entityType, searchParam) {
-    if (!data || !data.controls.results.length || !data.entityList) {
-        return [];
-    }
-    const standardsGrouping = {};
-    const { controls, entityList, complianceStandards } = data;
-    controls.results.forEach((result) => {
-        const entity = entityList.find(
-            (entityObject) => entityObject.id === result.aggregationKeys[1].id
-        );
-        if (!entity) {
-            return;
-        }
-        const standard = complianceStandards.find((c) => c.id === result.aggregationKeys[0].id);
-        const { numPassing, numFailing } = result;
-        if (!standard || (numPassing === 0 && numFailing === 0)) {
-            return;
-        }
-        const percentagePassing = Math.round((numPassing / (numPassing + numFailing)) * 100);
-
-        const link = URLService.getURL(match, location)
-            .base(entityTypes.CONTROL)
-            .query({
-                [searchParam]: {
-                    [`${capitalize(entityType)}`]: entity?.name,
-                    standard: standardLabels[standard.id] || standard.id,
-                },
-            })
-            .url();
-        const dataPoint = {
-            x: entity?.name,
-            y: percentagePassing,
-            link,
-        };
-        const standardGroup = standardsGrouping[standard.id];
-        if (standardGroup) {
-            standardGroup.push(dataPoint);
-        } else {
-            standardsGrouping[standard.id] = [dataPoint];
-        }
-    });
-    const sortedStandardsGrouping = {};
-    const GRAPHS_PER_PAGE = 3;
-    const pagedStandardsGrouping = [];
-
-    Object.keys(standardsGrouping).forEach((standard) => {
-        sortedStandardsGrouping[standard] = sortBy(standardsGrouping[standard], ['x']);
-        const pageArray = chunk(sortedStandardsGrouping[standard], GRAPHS_PER_PAGE);
-        pageArray.forEach((page, pageIdx) => {
-            if (!pagedStandardsGrouping[pageIdx]) {
-                pagedStandardsGrouping[pageIdx] = {};
-            }
-            pagedStandardsGrouping[pageIdx][standard] = pageArray[pageIdx];
-        });
-    });
-    return pagedStandardsGrouping;
-}
-
-function getLabelLinks(match, location, data, entityType) {
-    if (!data) {
-        return null;
-    }
-    const { entityList } = data;
-    const labelLinks = {};
-    entityList.forEach((entity) => {
-        labelLinks[entity?.name] = URLService.getURL(match, location)
-            .base(entityType, entity?.id)
-            .url();
-    });
-    return labelLinks;
-}
-
-const StandardsByEntity = ({ entityType, bodyClassName, className }) => {
-    const searchParam = useContext(searchContext);
-    const match = useWorkflowMatch();
-    const location = useLocation();
-    const headerText = `Passing standards by ${entityNounOrdinaryCaseSingular[entityType]}`;
-
-    const variables = {
-        groupBy: [entityTypes.STANDARD, entityType],
-        unit: entityTypes.CHECK,
-    };
-    const { loading, error, data } = useQuery(AGGREGATED_RESULTS_STANDARDS_BY_ENTITY(entityType), {
-        variables,
-    });
-
-    if (error) {
-        return (
-            <Widget
-                className={`s-2 ${className}`}
-                header={headerText}
-                bodyClassName={`graph-bottom-border ${bodyClassName}`}
-            >
-                <div>
-                    A database error has occurred. Please check that you have the correct
-                    permissions to view this information.
-                </div>
-            </Widget>
-        );
-    }
-
-    let contents = <Loader />;
-    let pages;
-
-    if (!loading) {
-        if (!data || !data.results || data.results.length === 0) {
-            contents = <NoResultsMessage message="No data available. Please run a scan." />;
-        } else {
-            const formattedData = {
-                results: data && data.results,
-                controls: data && data.controls,
-                complianceStandards: data.complianceStandards,
-                entityList: data && data.clusters,
-            };
-            const results = processData(match, location, formattedData, entityType, searchParam);
-            const labelLinks = getLabelLinks(match, location, formattedData, entityType);
-            pages = results.length;
-
-            if (pages) {
-                const VerticalBarChartPaged = ({ currentPage }) => (
-                    <VerticalClusterBar
-                        id={`passing-standards-by-${entityType.toLowerCase()}`}
-                        data={results[currentPage]}
-                        labelLinks={labelLinks}
-                    />
-                );
-                VerticalBarChartPaged.propTypes = { currentPage: PropTypes.number };
-                VerticalBarChartPaged.defaultProps = { currentPage: 0 };
-                contents = <VerticalBarChartPaged />;
-            } else {
-                contents = <NoResultsMessage message="No data available. Please run a scan." />;
-            }
-        }
-    }
-
-    return (
-        <Widget
-            className={`s-2 ${className}`}
-            pages={pages}
-            header={headerText}
-            bodyClassName={`graph-bottom-border ${bodyClassName}`}
-        >
-            {contents}
-        </Widget>
-    );
-};
-StandardsByEntity.propTypes = {
-    entityType: PropTypes.string.isRequired,
-    bodyClassName: PropTypes.string,
-    className: PropTypes.string,
-};
-
-StandardsByEntity.defaultProps = {
-    bodyClassName: 'p-4',
-    className: '',
-};
-
-export default StandardsByEntity;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/VerticalBarChart.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/VerticalBarChart.jsx
deleted file mode 100644
index 6ecbc9cbe44e1..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/VerticalBarChart.jsx
+++ /dev/null
@@ -1,112 +0,0 @@
-import { Component } from 'react';
-import {
-    FlexibleWidthXYPlot,
-    XAxis,
-    YAxis,
-    VerticalGridLines,
-    HorizontalGridLines,
-    VerticalBarSeries,
-} from 'react-vis';
-import PropTypes from 'prop-types';
-import merge from 'deepmerge';
-
-import { verticalBarColors } from './colorsForCompliance';
-
-const sortByXValue = (a, b) => {
-    if (a.x < b.x) {
-        return -1;
-    }
-    if (a.x > b.x) {
-        return 1;
-    }
-    return 0;
-};
-
-// Component state was needed only for deleted HoverHint, but we will not rewrite.
-class VerticalBarChart extends Component {
-    static propTypes = {
-        data: PropTypes.arrayOf(PropTypes.object).isRequired,
-        containerProps: PropTypes.shape({}),
-        plotProps: PropTypes.shape({}),
-        seriesProps: PropTypes.shape({}),
-        tickValues: PropTypes.arrayOf(PropTypes.number),
-        tickFormat: PropTypes.func,
-        onValueClick: PropTypes.func,
-        legend: PropTypes.bool,
-    };
-
-    static defaultProps = {
-        containerProps: {},
-        plotProps: {},
-        seriesProps: {},
-        tickValues: [25, 50, 75, 100],
-        tickFormat: (x) => `${x}%`,
-        onValueClick: null,
-        legend: true,
-    };
-
-    render() {
-        const { tickValues, tickFormat, onValueClick } = this.props;
-
-        const data = this.props.data.sort(sortByXValue);
-
-        // Default props
-        const defaultPlotProps = {
-            xType: 'ordinal',
-            height: 250,
-            colorType: 'category',
-            yDomain: [0, 110],
-        };
-
-        const defaultContainerProps = {
-            className: 'relative chart-container w-full horizontal-bar-responsive',
-        };
-
-        const defaultSeriesProps = {
-            barWidth: 0.25,
-            style: {
-                opacity: '.8',
-                ry: '2px',
-                cursor: 'pointer',
-            },
-
-            colorDomain: data.map((datum) => datum.y),
-            colorRange: verticalBarColors,
-            onValueClick: (datum) => {
-                if (onValueClick) {
-                    onValueClick(datum);
-                }
-            },
-        };
-
-        // Merge props
-        const containerProps = merge(defaultContainerProps, this.props.containerProps);
-        const plotProps = merge(defaultPlotProps, this.props.plotProps);
-        const seriesProps = merge(defaultSeriesProps, this.props.seriesProps);
-        const styleProps = this.props.legend ? { top: '-16px' } : {};
-
-        // format data with colors:
-        const letDataWithColors = data.map((datum, i) => ({
-            ...datum,
-            color: verticalBarColors[i % verticalBarColors.length],
-        }));
-
-        function formatTicks(value) {
-            return <tspan>{value}</tspan>;
-        }
-
-        return (
-            <div style={styleProps} {...containerProps}>
-                <FlexibleWidthXYPlot {...plotProps}>
-                    <VerticalGridLines left={330 / data.length / 2 + 30} />
-                    <HorizontalGridLines tickValues={tickValues} />
-                    <YAxis tickValues={tickValues} tickSize={0} tickFormat={tickFormat} />
-                    <VerticalBarSeries data={letDataWithColors} {...seriesProps} />
-                    <XAxis tickSize={0} tickFormat={formatTicks} />
-                </FlexibleWidthXYPlot>
-            </div>
-        );
-    }
-}
-
-export default VerticalBarChart;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/VerticalClusterBar.jsx b/ui/apps/platform/src/Containers/Compliance/widgets/VerticalClusterBar.jsx
deleted file mode 100644
index 094a7b81a0bf8..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/VerticalClusterBar.jsx
+++ /dev/null
@@ -1,152 +0,0 @@
-import {
-    FlexibleXYPlot,
-    XAxis,
-    YAxis,
-    VerticalGridLines,
-    HorizontalGridLines,
-    VerticalBarSeries,
-} from 'react-vis';
-import PropTypes from 'prop-types';
-import { Link, useNavigate } from 'react-router-dom-v5-compat';
-import DiscreteColorLegend from 'react-vis/dist/legends/discrete-color-legend';
-import merge from 'deepmerge';
-
-import { standardBaseTypes } from 'constants/entityTypes';
-
-import { verticalBarColors } from './colorsForCompliance';
-
-function VerticalClusterBar({
-    id = '',
-    data,
-    containerProps = {},
-    plotProps = {},
-    seriesProps = {},
-    tickValues = [25, 50, 75, 100],
-    tickFormat = (x) => `${x}%`,
-    labelLinks = {},
-}) {
-    const navigate = useNavigate();
-
-    const getLegendData = () => {
-        return Object.keys(data)
-            .sort()
-            .map((key, i) => ({
-                title: standardBaseTypes[key] || key,
-                color: verticalBarColors[i % verticalBarColors.length],
-            }));
-    };
-
-    // Default props
-    const defaultPlotProps = {
-        xType: 'ordinal',
-        yDomain: [0, 100],
-        height: 270,
-    };
-
-    const defaultContainerProps = {
-        className: 'relative chart-container w-full horizontal-bar-responsive',
-    };
-
-    const defaultSeriesProps = {
-        // animation: true, //causes onValueMouseOut to fail https://github.com/uber/react-vis/issues/381
-        barWidth: 0.5,
-        style: {
-            opacity: '.85',
-            width: '10px',
-            ry: '2px',
-            cursor: 'pointer',
-        },
-        onValueClick: (datum) => {
-            if (datum.link) {
-                navigate(datum.link);
-            }
-        },
-    };
-
-    // Merge props
-    const containerPropsMerged = merge(defaultContainerProps, containerProps);
-    const plotPropsMerged = merge(defaultPlotProps, plotProps);
-    const seriesPropsMerged = merge(defaultSeriesProps, seriesProps);
-
-    function formatTicks(value) {
-        let inner = value;
-        if (labelLinks[value]) {
-            inner = (
-                <Link
-                    style={{ fill: 'currentColor' }}
-                    className="underline text-base-600 hover:text-primary-700"
-                    to={labelLinks[value]}
-                >
-                    {value}
-                </Link>
-            );
-        }
-
-        return <tspan>{inner}</tspan>;
-    }
-
-    // Calculate unique cluster names
-    let clusterNames = new Set();
-    Object.keys(data).forEach((dataSetKey) => {
-        const dataSet = data[dataSetKey];
-        dataSet.forEach((datum) => {
-            clusterNames.add(datum.x);
-        });
-    });
-    clusterNames = Array.from(clusterNames);
-
-    // Create Barseries for each data set
-    const series = [];
-    Object.keys(data)
-        .sort()
-        .forEach((key, i) => {
-            series.push(
-                <VerticalBarSeries
-                    data={data[key]}
-                    color={verticalBarColors[i % verticalBarColors.length]}
-                    className={`vertical-cluster-bar-${standardBaseTypes[key]}`}
-                    {...seriesPropsMerged}
-                    key={key}
-                />
-            );
-        });
-
-    return (
-        <div {...containerPropsMerged} data-testid={id}>
-            <div className="flex flex-col h-full">
-                <FlexibleXYPlot {...plotPropsMerged}>
-                    <VerticalGridLines
-                        left={330 / clusterNames.length / 2 + 30}
-                        tickValues={clusterNames.slice(0, clusterNames.length - 1)}
-                    />
-                    <HorizontalGridLines tickValues={tickValues} />
-                    <YAxis tickValues={tickValues} tickSize={0} tickFormat={tickFormat} />
-                    {series}
-
-                    <XAxis tickSize={0} tickFormat={formatTicks} />
-                </FlexibleXYPlot>
-                <div>
-                    <DiscreteColorLegend
-                        orientation="horizontal"
-                        items={getLegendData()}
-                        colors={verticalBarColors}
-                        className="horizontal-bar-legend"
-                    />
-                </div>
-            </div>
-        </div>
-    );
-}
-
-VerticalClusterBar.propTypes = {
-    id: PropTypes.string,
-    data: PropTypes.shape({}).isRequired,
-    containerProps: PropTypes.shape({}),
-    plotProps: PropTypes.shape({}),
-    seriesProps: PropTypes.shape({}),
-    tickValues: PropTypes.arrayOf(PropTypes.number),
-    tickFormat: PropTypes.func,
-    labelLinks: PropTypes.shape({}),
-};
-
-export default VerticalClusterBar;
diff --git a/ui/apps/platform/src/Containers/Compliance/widgets/colorsForCompliance.ts b/ui/apps/platform/src/Containers/Compliance/widgets/colorsForCompliance.ts
deleted file mode 100644
index cdd9e12529b41..0000000000000
--- a/ui/apps/platform/src/Containers/Compliance/widgets/colorsForCompliance.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import {
-    COMPLIANCE_PASS_COLOR,
-    CRITICAL_SEVERITY_COLOR,
-    IMPORTANT_HIGH_SEVERITY_COLOR,
-    MODERATE_MEDIUM_SEVERITY_COLOR,
-    noViolationsColor,
-} from 'constants/severityColors';
-
-export function getColor(value: number) {
-    if (value === 100) {
-        return COMPLIANCE_PASS_COLOR;
-    }
-    if (value >= 70) {
-        return MODERATE_MEDIUM_SEVERITY_COLOR;
-    }
-    if (value >= 50) {
-        return IMPORTANT_HIGH_SEVERITY_COLOR;
-    }
-    if (Number.isNaN(value)) {
-        return noViolationsColor; // skipped
-    }
-    return CRITICAL_SEVERITY_COLOR;
-}
-
-// For example, Passing Standards by Clusters chart.
-export const verticalBarColors = [
-    'var(--base-700)',
-    'var(--primary-700)',
-    'var(--secondary-700)',
-    'var(--base-400)',
-    'var(--primary-400)',
-    'var(--secondary-400)',
-];
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Coverage/ClusterDetailsPage.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Coverage/ClusterDetailsPage.tsx
index be117d5e6a811..a431bbf61140d 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Coverage/ClusterDetailsPage.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Coverage/ClusterDetailsPage.tsx
@@ -132,7 +132,7 @@ function ClusterDetailsPage() {
     return (
         <>
             <PageTitle title="Compliance coverage - Cluster" />
-            <PageSection hasBodyWrapper={false} className="pf-v6-u-py-md">
+            <PageSection type="breadcrumb">
                 <Breadcrumb>
                     <BreadcrumbItemLink
                         to={generatePathWithScanConfig(coverageProfileClustersPath, {
@@ -161,7 +161,6 @@ function ClusterDetailsPage() {
                     setSelectedScanConfigName={setSelectedScanConfigName}
                 />
             </PageSection>
-            <Divider component="div" />
             <PageSection>
                 <Flex
                     direction={{ default: 'column' }}
@@ -209,7 +208,6 @@ function ClusterDetailsPage() {
                     </>
                 )}
             </PageSection>
-            <Divider component="div" />
             <PageSection>
                 <ClusterDetailsTable
                     checkResultsCount={checkResultsResponse?.totalCount ?? 0}
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/CreateScanConfigPage.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/CreateScanConfigPage.tsx
index d686ad51b0f3c..1f5894bb706e6 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/CreateScanConfigPage.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/CreateScanConfigPage.tsx
@@ -1,18 +1,18 @@
 import type { ReactElement } from 'react';
 
-import { Breadcrumb, BreadcrumbItem, Divider, PageSection, Title } from '@patternfly/react-core';
+import { Breadcrumb, BreadcrumbItem, PageSection, Title } from '@patternfly/react-core';
 
 import { complianceEnhancedSchedulesPath } from 'routePaths';
 import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
 import PageTitle from 'Components/PageTitle';
 
-import ScanConfigWizardForm from './Wizard/ScanConfigWizardForm';
+import ScanConfigWizardPageSection from './Wizard/ScanConfigWizardPageSection';
 
 function CreateScanConfigPage(): ReactElement {
     return (
         <>
-            <PageTitle title="Compliance Scan Configuration" />
-            <PageSection hasBodyWrapper={false} className="pf-v6-u-py-md">
+            <PageTitle title="Create Compliance Scan Configuration" />
+            <PageSection type="breadcrumb">
                 <Breadcrumb>
                     <BreadcrumbItemLink to={complianceEnhancedSchedulesPath}>
                         Scan schedules
@@ -20,16 +20,10 @@ function CreateScanConfigPage(): ReactElement {
                     <BreadcrumbItem isActive>Create scan schedule</BreadcrumbItem>
                 </Breadcrumb>
             </PageSection>
-            <Divider component="div" />
-            <PageSection hasBodyWrapper={false} padding={{ default: 'noPadding' }}>
-                <Title headingLevel="h1" className="pf-v6-u-py-lg pf-v6-u-px-lg">
-                    Create scan schedule
-                </Title>
-            </PageSection>
-            <Divider component="div" />
-            <PageSection hasBodyWrapper={false} padding={{ default: 'noPadding' }} isFilled>
-                <ScanConfigWizardForm />
+            <PageSection>
+                <Title headingLevel="h1">Create scan schedule</Title>
             </PageSection>
+            <ScanConfigWizardPageSection pageAction="create" />
         </>
     );
 }
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/EditScanConfigDetail.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/EditScanConfigDetail.tsx
index 6ed9bef795cf7..44b54dafe5190 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/EditScanConfigDetail.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/EditScanConfigDetail.tsx
@@ -4,9 +4,6 @@ import {
     Breadcrumb,
     BreadcrumbItem,
     Bullseye,
-    Divider,
-    Flex,
-    FlexItem,
     PageSection,
     Spinner,
     Title,
@@ -17,7 +14,7 @@ import PageTitle from 'Components/PageTitle';
 import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
 import type { ComplianceScanConfigurationStatus } from 'services/ComplianceScanConfigurationService';
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
-import ScanConfigWizardForm from './Wizard/ScanConfigWizardForm';
+import ScanConfigWizardPageSection from './Wizard/ScanConfigWizardPageSection';
 import { defaultScanConfigFormValues } from './Wizard/useFormikScanConfig';
 import { convertScanConfigToFormik } from './compliance.scanConfigs.utils';
 
@@ -38,53 +35,50 @@ function EditScanConfigDetail({
 
     return (
         <>
-            <PageTitle title="Edit Compliance Scan Schedule Details" />
+            <PageTitle title="Edit Compliance Scan Schedule" />
             <PageSection type="breadcrumb">
                 <Breadcrumb>
                     <BreadcrumbItemLink to={complianceEnhancedSchedulesPath}>
                         Scan schedules
                     </BreadcrumbItemLink>
-                    {!isLoading && !error && scanConfig && (
+                    {scanConfig && (
                         <BreadcrumbItem isActive>Edit {scanConfig.scanName}</BreadcrumbItem>
                     )}
                 </Breadcrumb>
             </PageSection>
-            <PageSection padding={{ default: 'noPadding' }}>
-                {!isLoading && !error && scanConfig && (
-                    <Flex
-                        alignItems={{ default: 'alignItemsCenter' }}
-                        className="pf-v6-u-py-lg pf-v6-u-px-lg"
-                    >
-                        <FlexItem flex={{ default: 'flex_1' }}>
-                            <Title headingLevel="h1">Edit {scanConfig.scanName}</Title>
-                        </FlexItem>
-                    </Flex>
-                )}
-            </PageSection>
-            <Divider component="div" />
-            <PageSection isFilled>
-                {isLoading ? (
+            {isLoading ? (
+                <PageSection isFilled>
                     <Bullseye>
                         <Spinner />
                     </Bullseye>
-                ) : (
-                    error && (
-                        <Alert
-                            variant="warning"
-                            title="Unable to fetch scan schedule"
-                            component="p"
-                            isInline
-                        >
-                            {getAxiosErrorMessage(error)}
-                        </Alert>
-                    )
-                )}
-                {!isLoading && scanConfig && (
-                    <PageSection padding={{ default: 'noPadding' }} isFilled>
-                        <ScanConfigWizardForm initialFormValues={parsedScanConfig} />
-                    </PageSection>
-                )}
-            </PageSection>
+                </PageSection>
+            ) : (
+                <>
+                    {scanConfig && (
+                        <PageSection>
+                            <Title headingLevel="h1">Edit {scanConfig.scanName}</Title>
+                        </PageSection>
+                    )}
+                    {error && (
+                        <PageSection>
+                            <Alert
+                                variant="warning"
+                                title="Unable to fetch scan schedule"
+                                component="p"
+                                isInline
+                            >
+                                {getAxiosErrorMessage(error)}
+                            </Alert>
+                        </PageSection>
+                    )}
+                    {scanConfig && (
+                        <ScanConfigWizardPageSection
+                            initialFormValues={parsedScanConfig}
+                            pageAction="edit"
+                        />
+                    )}
+                </>
+            )}
         </>
     );
 }
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigDetailPage.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigDetailPage.tsx
index 9b2898d1beb44..e6f587d39f9b8 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigDetailPage.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigDetailPage.tsx
@@ -8,7 +8,7 @@ import useRestQuery from 'hooks/useRestQuery';
 import { getComplianceScanConfiguration } from 'services/ComplianceScanConfigurationService';
 import EditScanConfigDetail from './EditScanConfigDetail';
 import ViewScanConfigDetail from './ViewScanConfigDetail';
-import type { PageActions } from './compliance.scanConfigs.utils';
+import type { SchedulePageAction } from './compliance.scanConfigs.utils';
 
 type ScanConfigDetailPageProps = {
     hasWriteAccessForCompliance: boolean;
@@ -18,7 +18,7 @@ function ScanConfigDetailPage({
     hasWriteAccessForCompliance,
 }: ScanConfigDetailPageProps): ReactElement {
     const { scanConfigId } = useParams() as { scanConfigId: string };
-    const { pageAction } = usePageAction<PageActions>();
+    const { pageAction } = usePageAction<SchedulePageAction>();
 
     const scanConfigFetcher = useCallback(() => {
         const { request, cancel } = getComplianceScanConfiguration(scanConfigId);
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigsPage.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigsPage.tsx
index 6e98bdcfacc63..3b25225ef7acc 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigsPage.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ScanConfigsPage.tsx
@@ -4,7 +4,7 @@ import { Banner } from '@patternfly/react-core';
 import usePageAction from 'hooks/usePageAction';
 import usePermissions from 'hooks/usePermissions';
 import { complianceEnhancedSchedulesPath } from 'routePaths';
-import type { PageActions } from './compliance.scanConfigs.utils';
+import type { SchedulePageAction } from './compliance.scanConfigs.utils';
 import CreateScanConfigPage from './CreateScanConfigPage';
 import ComplianceNotFoundPage from '../ComplianceNotFoundPage';
 import ScanConfigDetailPage from './ScanConfigDetailPage';
@@ -17,7 +17,7 @@ function ScanConfigsPage() {
      * /main/compliance-enhanced/scan-configs?action=create
      * /main/compliance-enhanced/scan-configs/configId
      */
-    const { pageAction } = usePageAction<PageActions>();
+    const { pageAction } = usePageAction<SchedulePageAction>();
 
     const { hasReadWriteAccess } = usePermissions();
     const hasWriteAccessForCompliance = hasReadWriteAccess('Compliance');
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ViewScanConfigDetail.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ViewScanConfigDetail.tsx
index 2eedb04bd92ba..097da5d7bd50b 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ViewScanConfigDetail.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/ViewScanConfigDetail.tsx
@@ -5,8 +5,6 @@ import {
     AlertActionCloseButton,
     Breadcrumb,
     BreadcrumbItem,
-    Card,
-    CardBody,
     Flex,
     FlexItem,
     PageSection,
@@ -211,15 +209,7 @@ function ViewScanConfigDetail({
             </PageSection>
             {activeScanConfigTab === 'CONFIGURATION_DETAILS' && (
                 <PageSection hasBodyWrapper={false} isCenterAligned id={configDetailsTabId}>
-                    <Card>
-                        <CardBody>
-                            <ConfigDetails
-                                isLoading={isLoading}
-                                error={error}
-                                scanConfig={scanConfig}
-                            />
-                        </CardBody>
-                    </Card>
+                    <ConfigDetails isLoading={isLoading} error={error} scanConfig={scanConfig} />
                 </PageSection>
             )}
             {activeScanConfigTab === 'ALL_REPORT_JOBS' && scanConfig?.id && (
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ProfileSelection.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ProfileSelection.tsx
deleted file mode 100644
index 2de996d4ed04a..0000000000000
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ProfileSelection.tsx
+++ /dev/null
@@ -1,234 +0,0 @@
-import { useCallback, useState } from 'react';
-import type { FormEvent, ReactElement, RefObject } from 'react';
-import { useFormikContext } from 'formik';
-import type { FormikContextType } from 'formik';
-import {
-    Alert,
-    Content,
-    Divider,
-    Flex,
-    FlexItem,
-    Form,
-    PageSection,
-    Title,
-    Toolbar,
-    ToolbarContent,
-    ToolbarGroup,
-} from '@patternfly/react-core';
-import { ExpandableRowContent, Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
-
-import CompoundSearchFilter from 'Components/CompoundSearchFilter/components/CompoundSearchFilter';
-import CompoundSearchFilterLabels from 'Components/CompoundSearchFilter/components/CompoundSearchFilterLabels';
-import type { OnSearchCallback } from 'Components/CompoundSearchFilter/types';
-import { updateSearchFilter } from 'Components/CompoundSearchFilter/utils/utils';
-import TBodyUnified from 'Components/TableStateTemplates/TbodyUnified';
-import useRestQuery from 'hooks/useRestQuery';
-import useTableSelection from 'hooks/useTableSelection';
-import type { ComplianceProfileSummary } from 'services/ComplianceCommon';
-import { listProfileSummaries } from 'services/ComplianceProfileService';
-import type { SearchFilter } from 'types/search';
-import { getTableUIState } from 'utils/getTableUIState';
-
-import { complianceProfileOperatorKindLabels } from '../../compliance.constants';
-import { profileSearchFilterConfig } from '../../searchFilterConfig';
-import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
-
-const searchFilterConfig = [profileSearchFilterConfig];
-
-export type ProfileSelectionProps = {
-    alertRef: RefObject<HTMLDivElement>;
-    clusterIds: string[];
-};
-
-function ProfileSelection({ alertRef, clusterIds }: ProfileSelectionProps): ReactElement {
-    const {
-        setFieldValue,
-        values: formikValues,
-        touched: formikTouched,
-    }: FormikContextType<ScanConfigFormValues> = useFormikContext();
-
-    const [searchFilter, setSearchFilter] = useState<SearchFilter>({});
-    const [expandedProfileNames, setExpandedProfileNames] = useState<string[]>([]);
-    const setProfileExpanded = (name: string, isExpanding = true) =>
-        setExpandedProfileNames((prevExpanded) => {
-            const otherExpandedProfileNames = prevExpanded.filter(
-                (profileName) => profileName !== name
-            );
-            return isExpanding ? [...otherExpandedProfileNames, name] : otherExpandedProfileNames;
-        });
-
-    const onSearch: OnSearchCallback = (payload) => {
-        setSearchFilter((prevSearchFilter) => updateSearchFilter(prevSearchFilter, payload));
-    };
-
-    const listProfilesQuery = useCallback(() => {
-        if (clusterIds.length > 0) {
-            return listProfileSummaries(clusterIds, searchFilter);
-        }
-        return Promise.resolve([]);
-    }, [clusterIds, searchFilter]);
-    const {
-        data: profiles,
-        isLoading: isFetchingProfiles,
-        error: profilesFetchError,
-    } = useRestQuery(listProfilesQuery);
-
-    const profileList = profiles ?? [];
-
-    const profileIsPreSelected = useCallback(
-        (row) => formikValues.profiles.includes(row.name),
-        [formikValues.profiles]
-    );
-
-    const { selected, onSelect } = useTableSelection(profileList, profileIsPreSelected, 'name');
-
-    const handleSelect = (
-        event: FormEvent<HTMLInputElement>,
-        isSelected: boolean,
-        rowId: number
-    ) => {
-        onSelect(event, isSelected, rowId);
-
-        const visibleSelectedNames = profileList
-            .filter((_, index) => {
-                return index === rowId ? isSelected : selected[index];
-            })
-            .map((profile) => profile.name);
-
-        const hiddenSelectedNames = formikValues.profiles.filter(
-            (name) => !profileList.some((p) => p.name === name)
-        );
-
-        setFieldValue('profiles', [...hiddenSelectedNames, ...visibleSelectedNames]);
-    };
-
-    const isProfileExpanded = (name: string) => expandedProfileNames.includes(name);
-    const totalColumns = 7;
-
-    const tableState = getTableUIState({
-        isLoading: isFetchingProfiles,
-        data: profiles,
-        error: profilesFetchError,
-        searchFilter,
-    });
-
-    return (
-        <>
-            <PageSection hasBodyWrapper={false} padding={{ default: 'noPadding' }}>
-                <Flex direction={{ default: 'column' }} className="pf-v6-u-py-lg pf-v6-u-px-lg">
-                    <FlexItem>
-                        <Title headingLevel="h2">Profiles</Title>
-                    </FlexItem>
-                    <FlexItem>Select profiles to be included in the scan</FlexItem>
-                </Flex>
-            </PageSection>
-            <Divider component="div" />
-            <Form className="pf-v6-u-py-lg pf-v6-u-px-lg" ref={alertRef}>
-                {formikTouched.profiles && formikValues.profiles.length === 0 && (
-                    <Alert
-                        title="At least one profile is required to proceed"
-                        component="p"
-                        variant="danger"
-                        isInline
-                    />
-                )}
-                <Toolbar>
-                    <ToolbarContent>
-                        <CompoundSearchFilter
-                            config={searchFilterConfig}
-                            searchFilter={searchFilter}
-                            onSearch={onSearch}
-                        />
-                        <ToolbarGroup className="pf-v6-u-w-100">
-                            <CompoundSearchFilterLabels
-                                attributesSeparateFromConfig={[]}
-                                config={searchFilterConfig}
-                                onFilterChange={setSearchFilter}
-                                searchFilter={searchFilter}
-                            />
-                        </ToolbarGroup>
-                    </ToolbarContent>
-                </Toolbar>
-                <Table>
-                    <Thead noWrap>
-                        <Tr>
-                            <Th screenReaderText="Row selection" />
-                            <Th screenReaderText="Row expansion" />
-                            <Th>Profile</Th>
-                            <Th>Type</Th>
-                            <Th>Rule set</Th>
-                            <Th>Applicability</Th>
-                            <Th>Version</Th>
-                        </Tr>
-                    </Thead>
-                    <TBodyUnified<ComplianceProfileSummary>
-                        tableState={tableState}
-                        colSpan={totalColumns}
-                        filteredEmptyProps={{ onClearFilters: () => setSearchFilter({}) }}
-                        renderer={({ data }) =>
-                            data.map(
-                                (
-                                    {
-                                        description,
-                                        name,
-                                        productType,
-                                        ruleCount,
-                                        title,
-                                        profileVersion,
-                                        operatorKind,
-                                    },
-                                    rowIndex
-                                ) => (
-                                    <Tbody isExpanded={isProfileExpanded(name)} key={name}>
-                                        <Tr>
-                                            <Td
-                                                select={{
-                                                    rowIndex,
-                                                    onSelect: (event, isSelected) =>
-                                                        handleSelect(event, isSelected, rowIndex),
-                                                    isSelected: selected[rowIndex],
-                                                }}
-                                            />
-                                            <Td
-                                                expand={{
-                                                    rowIndex,
-                                                    isExpanded: isProfileExpanded(name),
-                                                    onToggle: () =>
-                                                        setProfileExpanded(
-                                                            name,
-                                                            !isProfileExpanded(name)
-                                                        ),
-                                                }}
-                                            />
-                                            <Td dataLabel="Profile">{name}</Td>
-                                            <Td dataLabel="Type">
-                                                {(operatorKind &&
-                                                    complianceProfileOperatorKindLabels[
-                                                        operatorKind
-                                                    ]) ??
-                                                    '—'}
-                                            </Td>
-                                            <Td dataLabel="Rule set">{ruleCount}</Td>
-                                            <Td dataLabel="Applicability">{productType}</Td>
-                                            <Td dataLabel="Version">{profileVersion || '-'}</Td>
-                                        </Tr>
-                                        <Tr isExpanded={isProfileExpanded(name)}>
-                                            <Td colSpan={totalColumns}>
-                                                <ExpandableRowContent>
-                                                    <Content component="p">{title}</Content>
-                                                    <Content component="p">{description}</Content>
-                                                </ExpandableRowContent>
-                                            </Td>
-                                        </Tr>
-                                    </Tbody>
-                                )
-                            )
-                        }
-                    />
-                </Table>
-            </Form>
-        </>
-    );
-}
-
-export default ProfileSelection;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ReportConfiguration.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ReportConfiguration.tsx
deleted file mode 100644
index 93093abad42ee..0000000000000
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ReportConfiguration.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import type { ReactElement } from 'react';
-import { useFormikContext } from 'formik';
-import type { FormikContextType } from 'formik';
-import { Divider, Flex, FlexItem, Form, PageSection, Title } from '@patternfly/react-core';
-
-import NotifierConfigurationForm from 'Components/NotifierConfiguration/NotifierConfigurationForm';
-import usePermissions from 'hooks/usePermissions';
-
-// import { getBodyDefault, getSubjectDefault } from '../compliance.scanConfigs.utils';
-import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
-
-function ReportConfiguration(): ReactElement {
-    const formik: FormikContextType<ScanConfigFormValues> = useFormikContext();
-    const { hasReadWriteAccess } = usePermissions();
-    const hasWriteAccessForIntegration = hasReadWriteAccess('Integration');
-
-    return (
-        <>
-            <PageSection hasBodyWrapper={false} padding={{ default: 'noPadding' }}>
-                <Flex direction={{ default: 'column' }} className="pf-v6-u-py-lg pf-v6-u-px-lg">
-                    <FlexItem>
-                        <Title headingLevel="h2">Report</Title>
-                    </FlexItem>
-                    <FlexItem>
-                        Optionally configure e-mail delivery destinations for reports
-                    </FlexItem>
-                </Flex>
-            </PageSection>
-            <Divider component="div" />
-            <Form className="pf-v6-u-py-lg pf-v6-u-px-lg">
-                <NotifierConfigurationForm
-                    // customBodyDefault={getBodyDefault(formik.values.profiles)}
-                    // customSubjectDefault={getSubjectDefault(
-                    //     formik.values.parameters.name,
-                    //     formik.values.profiles
-                    // )}
-                    errors={formik.errors}
-                    fieldIdPrefixForFormikAndPatternFly="report.notifierConfigurations"
-                    hasWriteAccessForIntegration={hasWriteAccessForIntegration}
-                    notifierConfigurations={formik.values.report.notifierConfigurations}
-                    setFieldValue={formik.setFieldValue}
-                />
-            </Form>
-        </>
-    );
-}
-
-export default ReportConfiguration;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ReviewConfig.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ReviewConfig.tsx
deleted file mode 100644
index b4c551c4d825b..0000000000000
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ReviewConfig.tsx
+++ /dev/null
@@ -1,118 +0,0 @@
-import { useFormikContext } from 'formik';
-import type { FormikContextType } from 'formik';
-import {
-    Alert,
-    Badge,
-    Divider,
-    Flex,
-    FlexItem,
-    List,
-    ListItem,
-    PageSection,
-    Title,
-} from '@patternfly/react-core';
-
-import NotifierConfigurationView from 'Components/NotifierConfiguration/NotifierConfigurationView';
-import type { ComplianceIntegration } from 'services/ComplianceIntegrationService';
-
-import {
-    convertFormikParametersToSchedule,
-    getBodyDefault,
-    getSubjectDefault,
-} from '../compliance.scanConfigs.utils';
-import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
-import ScanConfigParametersView from '../components/ScanConfigParametersView';
-import ScanConfigProfilesView from '../components/ScanConfigProfilesView';
-
-const headingLevel = 'h3';
-
-export type ReviewConfigProps = {
-    clusters: ComplianceIntegration[];
-    errorMessage: string;
-};
-
-function ReviewConfig({ clusters, errorMessage }: ReviewConfigProps) {
-    const { values: formikValues }: FormikContextType<ScanConfigFormValues> = useFormikContext();
-
-    const scanSchedule = convertFormikParametersToSchedule(formikValues.parameters);
-
-    function findById<T, K extends keyof T>(selectedIds: string[], items: T[], idKey: K): T[] {
-        return selectedIds
-            .map((id) => items.find((item) => String(item[idKey]) === id))
-            .filter((item): item is T => item !== undefined);
-    }
-
-    const selectedClusters = findById(formikValues.clusters, clusters, 'clusterId');
-
-    return (
-        <>
-            <PageSection hasBodyWrapper={false} padding={{ default: 'noPadding' }}>
-                <Flex direction={{ default: 'column' }} className="pf-v6-u-py-lg pf-v6-u-px-lg">
-                    <FlexItem>
-                        <Title headingLevel="h2">Review</Title>
-                    </FlexItem>
-                    <FlexItem>Review the scan schedule before you save changes</FlexItem>
-                    {errorMessage && (
-                        <Alert
-                            title={'Scan configuration request failure'}
-                            component="p"
-                            variant="danger"
-                            isInline
-                        >
-                            {errorMessage}
-                        </Alert>
-                    )}
-                </Flex>
-            </PageSection>
-            <Divider component="div" />
-            <Flex
-                direction={{ default: 'column' }}
-                spaceItems={{ default: 'spaceItemsLg' }}
-                className="pf-v6-u-pt-lg pf-v6-u-px-lg"
-            >
-                <ScanConfigParametersView
-                    headingLevel={headingLevel}
-                    scanName={formikValues.parameters.name}
-                    description={formikValues.parameters.description}
-                    scanSchedule={scanSchedule}
-                />
-                <Flex direction={{ default: 'column' }}>
-                    <Flex spaceItems={{ default: 'spaceItemsSm' }}>
-                        <Title headingLevel={headingLevel}>Clusters</Title>
-                        <Badge isRead>{selectedClusters.length}</Badge>
-                    </Flex>
-                    <List isPlain>
-                        {selectedClusters.map((cluster) => (
-                            <ListItem key={cluster.id}>{cluster.clusterName}</ListItem>
-                        ))}
-                    </List>
-                </Flex>
-                <ScanConfigProfilesView
-                    headingLevel={headingLevel}
-                    profiles={formikValues.profiles}
-                />
-                <NotifierConfigurationView
-                    headingLevel={headingLevel}
-                    customBodyDefault={getBodyDefault(formikValues.profiles)}
-                    customSubjectDefault={getSubjectDefault(
-                        formikValues.parameters.name,
-                        formikValues.profiles
-                    )}
-                    notifierConfigurations={formikValues.report.notifierConfigurations}
-                />
-                <Alert
-                    variant="info"
-                    title="Save for new versus existing scan schedule"
-                    component="p"
-                    isInline
-                    className="pf-v6-u-mb-lg"
-                >
-                    Compliance Operator runs a new scan schedule immediately upon creation, but does
-                    not run until scheduled time when you save changes to an existing scan schedule.
-                </Alert>
-            </Flex>
-        </>
-    );
-}
-
-export default ReviewConfig;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ClusterSelection.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigClustersStep.tsx
similarity index 69%
rename from ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ClusterSelection.tsx
rename to ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigClustersStep.tsx
index 9b0131e9e9afa..6a01dddfec7ae 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ClusterSelection.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigClustersStep.tsx
@@ -7,7 +7,6 @@ import {
     Alert,
     Bullseye,
     Button,
-    Divider,
     Flex,
     FlexItem,
     Form,
@@ -27,7 +26,7 @@ import type { ComplianceIntegration } from 'services/ComplianceIntegrationServic
 import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
 import ComplianceClusterStatus from '../components/ComplianceClusterStatus';
 
-export type ClusterSelectionProps = {
+export type ScanConfigClustersStepProps = {
     alertRef: RefObject<HTMLDivElement>;
     clusters: ComplianceIntegration[];
     isFetchingClusters: boolean;
@@ -41,11 +40,11 @@ function InstallClustersButton() {
     );
 }
 
-function ClusterSelection({
+function ScanConfigClustersStep({
     alertRef,
     clusters,
     isFetchingClusters,
-}: ClusterSelectionProps): ReactElement {
+}: ScanConfigClustersStepProps): ReactElement {
     const isRouteEnabled = useIsRouteEnabled();
     const isRouteEnabledForClusters = isRouteEnabled('clusters');
     const {
@@ -151,55 +150,49 @@ function ClusterSelection({
     }
 
     return (
-        <>
-            <PageSection hasBodyWrapper={false} padding={{ default: 'noPadding' }}>
-                <Flex direction={{ default: 'column' }} className="pf-v6-u-py-lg pf-v6-u-px-lg">
-                    <FlexItem>
-                        <Title headingLevel="h2">Clusters</Title>
-                    </FlexItem>
-                    <FlexItem>Select clusters to be included in the scan</FlexItem>
-                </Flex>
-            </PageSection>
-            <Divider component="div" />
-            <Form className="pf-v6-u-py-lg pf-v6-u-px-lg" ref={alertRef}>
-                <Alert
-                    title="At least one cluster must be in a Healthy state to proceed with the schedule."
-                    variant="info"
-                    component="p"
-                    isInline
-                >
-                    <p>
-                        Tip: The most common reason a cluster is marked Unhealthy is that the
-                        Compliance Operator is either not installed or is below version 1.6.
-                    </p>
-                </Alert>
-                {formikTouched.clusters && formikValues.clusters.length === 0 && (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Clusters</Title>
+                <Form ref={alertRef}>
                     <Alert
-                        title="At least one cluster is required to proceed"
+                        title="At least one cluster must be in a Healthy state to proceed with the schedule."
+                        variant="info"
                         component="p"
-                        variant="danger"
                         isInline
-                    />
-                )}
-                <Table>
-                    <Thead noWrap>
-                        <Tr>
-                            <Th
-                                select={{
-                                    onSelect: handleSelectAll,
-                                    isSelected: allRowsSelected,
-                                }}
-                            />
-                            <Th>Name</Th>
-                            <Th>Operator status</Th>
-                            <Th>Operator version</Th>
-                        </Tr>
-                    </Thead>
-                    <Tbody>{renderTableBodyContent()}</Tbody>
-                </Table>
-            </Form>
-        </>
+                    >
+                        <p>
+                            Tip: The most common reason a cluster is marked Unhealthy is that the
+                            Compliance Operator is either not installed or is below version 1.6.
+                        </p>
+                    </Alert>
+                    {formikTouched.clusters && formikValues.clusters.length === 0 && (
+                        <Alert
+                            title="At least one cluster is required to proceed"
+                            component="p"
+                            variant="danger"
+                            isInline
+                        />
+                    )}
+                    <Table>
+                        <Thead noWrap>
+                            <Tr>
+                                <Th
+                                    select={{
+                                        onSelect: handleSelectAll,
+                                        isSelected: allRowsSelected,
+                                    }}
+                                />
+                                <Th>Name</Th>
+                                <Th>Operator status</Th>
+                                <Th>Operator version</Th>
+                            </Tr>
+                        </Thead>
+                        <Tbody>{renderTableBodyContent()}</Tbody>
+                    </Table>
+                </Form>
+            </Flex>
+        </PageSection>
     );
 }
 
-export default ClusterSelection;
+export default ScanConfigClustersStep;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigDeliveryStep.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigDeliveryStep.tsx
new file mode 100644
index 0000000000000..85f938cba0e56
--- /dev/null
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigDeliveryStep.tsx
@@ -0,0 +1,34 @@
+import type { ReactElement } from 'react';
+import { useFormikContext } from 'formik';
+import type { FormikContextType } from 'formik';
+import { Flex, Form, PageSection, Title } from '@patternfly/react-core';
+
+import NotifierConfigurationForm from 'Components/NotifierConfiguration/NotifierConfigurationForm';
+import usePermissions from 'hooks/usePermissions';
+
+import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
+
+function ScanConfigDeliveryStep(): ReactElement {
+    const formik: FormikContextType<ScanConfigFormValues> = useFormikContext();
+    const { hasReadWriteAccess } = usePermissions();
+    const hasWriteAccessForIntegration = hasReadWriteAccess('Integration');
+
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Delivery</Title>
+                <Form isWidthLimited>
+                    <NotifierConfigurationForm
+                        errors={formik.errors}
+                        fieldIdPrefixForFormikAndPatternFly="report.notifierConfigurations"
+                        hasWriteAccessForIntegration={hasWriteAccessForIntegration}
+                        notifierConfigurations={formik.values.report.notifierConfigurations}
+                        setFieldValue={formik.setFieldValue}
+                    />
+                </Form>
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default ScanConfigDeliveryStep;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigOptions.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigOptions.tsx
index 9e683163df5e2..4406d7374c661 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigOptions.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigOptions.tsx
@@ -2,13 +2,11 @@ import type { FormEvent, ReactElement } from 'react';
 import { useFormikContext } from 'formik';
 import type { FormikContextType } from 'formik';
 import {
-    Divider,
     Flex,
     FlexItem,
     Form,
+    FormSection,
     PageSection,
-    Stack,
-    StackItem,
     TextArea,
     TextInput,
     TimePicker,
@@ -20,7 +18,7 @@ import FormLabelGroup from 'Components/PatternFly/FormLabelGroup';
 import RepeatScheduleDropdown from 'Components/PatternFly/RepeatScheduleDropdown';
 
 import usePageAction from 'hooks/usePageAction';
-import type { PageActions, ScanConfigFormValues } from '../compliance.scanConfigs.utils';
+import type { ScanConfigFormValues, SchedulePageAction } from '../compliance.scanConfigs.utils';
 
 import { helperTextForName, helperTextForNameEdit, helperTextForTime } from './useFormikScanConfig';
 
@@ -28,7 +26,7 @@ import './ScanConfigOptions.css';
 
 function ScanConfigOptions(): ReactElement {
     const formik: FormikContextType<ScanConfigFormValues> = useFormikContext();
-    const { pageAction } = usePageAction<PageActions>();
+    const { pageAction } = usePageAction<SchedulePageAction>();
     const isEditAction = pageAction === 'edit';
 
     function handleSelectChange(id: string, value: string): void {
@@ -46,187 +44,146 @@ function ScanConfigOptions(): ReactElement {
     }
 
     return (
-        <>
-            <PageSection hasBodyWrapper={false} padding={{ default: 'noPadding' }}>
-                <Flex direction={{ default: 'column' }} className="pf-v6-u-py-lg pf-v6-u-px-lg">
-                    <FlexItem>
-                        <Title headingLevel="h2">Parameters</Title>
-                    </FlexItem>
-                    <FlexItem>Set name and schedule to scan on a recurring basis</FlexItem>
-                </Flex>
-            </PageSection>
-            <Divider component="div" />
-            <Form className="pf-v6-u-py-lg pf-v6-u-px-lg" id="scan-schedules-parameters">
-                <Stack hasGutter>
-                    <StackItem>
-                        <Stack hasGutter>
-                            <StackItem>
-                                <FormLabelGroup
-                                    label="Name"
-                                    isRequired
-                                    fieldId="parameters.name"
-                                    errors={formik.errors}
-                                    touched={formik.touched}
-                                    helperText={
-                                        isEditAction ? helperTextForNameEdit : helperTextForName
-                                    }
-                                >
-                                    <TextInput
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Parameters</Title>
+                <Form isWidthLimited id="scan-schedules-parameters">
+                    <FormLabelGroup
+                        label="Name"
+                        isRequired
+                        fieldId="parameters.name"
+                        errors={formik.errors}
+                        touched={formik.touched}
+                        helperText={isEditAction ? helperTextForNameEdit : helperTextForName}
+                    >
+                        <TextInput
+                            isRequired
+                            type="text"
+                            id="parameters.name"
+                            name="parameters.name"
+                            value={formik.values.parameters.name}
+                            isDisabled={isEditAction}
+                            validated={
+                                formik.errors?.parameters?.name && formik.touched?.parameters?.name
+                                    ? 'error'
+                                    : 'default'
+                            }
+                            onChange={(event) => formik.handleChange(event)}
+                            onBlur={formik.handleBlur}
+                        />
+                    </FormLabelGroup>
+                    <FormLabelGroup
+                        label="Description"
+                        fieldId="parameters.description"
+                        errors={formik.errors}
+                    >
+                        <TextArea
+                            isRequired
+                            type="text"
+                            id="parameters.description"
+                            name="parameters.description"
+                            value={formik.values.parameters.description}
+                            onChange={(event) => formik.handleChange(event)}
+                            onBlur={formik.handleBlur}
+                        />
+                    </FormLabelGroup>
+                    <FormSection title="Schedule" titleElement="h3">
+                        <Flex direction={{ default: 'column' }}>
+                            <Flex direction={{ default: 'row' }}>
+                                <FlexItem>
+                                    <FormLabelGroup
+                                        label="Frequency"
+                                        fieldId="parameters.intervalType"
                                         isRequired
-                                        type="text"
-                                        id="parameters.name"
-                                        name="parameters.name"
-                                        value={formik.values.parameters.name}
-                                        isDisabled={isEditAction}
-                                        validated={
-                                            formik.errors?.parameters?.name &&
-                                            formik.touched?.parameters?.name
-                                                ? 'error'
-                                                : 'default'
+                                        errors={formik.errors}
+                                        touched={formik.touched}
+                                    >
+                                        <RepeatScheduleDropdown
+                                            fieldId="parameters.intervalType"
+                                            value={formik.values.parameters.intervalType || ''}
+                                            handleSelect={handleSelectChange}
+                                            includeDailyOption
+                                            onBlur={formik.handleBlur}
+                                        />
+                                    </FormLabelGroup>
+                                </FlexItem>
+                                <FlexItem>
+                                    <FormLabelGroup
+                                        label="On day(s)"
+                                        fieldId={
+                                            formik.values.parameters.intervalType === 'WEEKLY'
+                                                ? 'parameters.daysOfWeek'
+                                                : 'parameters.daysOfMonth'
                                         }
-                                        onChange={(event) => formik.handleChange(event)}
-                                        onBlur={formik.handleBlur}
-                                    />
-                                </FormLabelGroup>
-                            </StackItem>
-                            <StackItem>
+                                        errors={formik.errors}
+                                        isRequired={
+                                            formik.values.parameters.intervalType === 'WEEKLY' ||
+                                            formik.values.parameters.intervalType === 'MONTHLY'
+                                        }
+                                        touched={formik.touched}
+                                    >
+                                        <DayPickerDropdown
+                                            fieldId={
+                                                formik.values.parameters.intervalType === 'WEEKLY'
+                                                    ? 'parameters.daysOfWeek'
+                                                    : 'parameters.daysOfMonth'
+                                            }
+                                            value={
+                                                (formik.values.parameters.intervalType === 'WEEKLY'
+                                                    ? formik.values.parameters.daysOfWeek
+                                                    : formik.values.parameters.daysOfMonth) ?? []
+                                            }
+                                            handleSelect={onScheduledDaysChange}
+                                            intervalType={formik.values.parameters.intervalType}
+                                            isEditable={
+                                                formik.values.parameters.intervalType ===
+                                                    'MONTHLY' ||
+                                                formik.values.parameters.intervalType === 'WEEKLY'
+                                            }
+                                            toggleId={
+                                                formik.values.parameters.intervalType === 'WEEKLY'
+                                                    ? 'parameters.daysOfWeek'
+                                                    : 'parameters.daysOfMonth'
+                                            }
+                                            onBlur={() => {
+                                                const fieldId =
+                                                    formik.values.parameters.intervalType ===
+                                                    'WEEKLY'
+                                                        ? 'parameters.daysOfWeek'
+                                                        : 'parameters.daysOfMonth';
+                                                formik.setFieldTouched(fieldId, true);
+                                            }}
+                                        />
+                                    </FormLabelGroup>
+                                </FlexItem>
+                            </Flex>
+                            <FlexItem>
                                 <FormLabelGroup
-                                    label="Description"
-                                    fieldId="parameters.description"
+                                    label="Time"
+                                    fieldId="parameters.time"
                                     errors={formik.errors}
+                                    isRequired
+                                    touched={formik.touched}
+                                    helperText={helperTextForTime}
                                 >
-                                    <TextArea
-                                        isRequired
-                                        type="text"
-                                        id="parameters.description"
-                                        name="parameters.description"
-                                        value={formik.values.parameters.description}
-                                        onChange={(event) => formik.handleChange(event)}
-                                        onBlur={formik.handleBlur}
+                                    <TimePicker
+                                        time={formik.values.parameters.time}
+                                        is24Hour
+                                        onChange={handleTimeChange}
+                                        inputProps={{
+                                            onBlur: formik.handleBlur,
+                                            name: 'parameters.time',
+                                        }}
+                                        invalidFormatErrorMessage="" // error messaging is handled by FormLabelGroup
+                                        invalidMinMaxErrorMessage=""
                                     />
                                 </FormLabelGroup>
-                            </StackItem>
-                        </Stack>
-                    </StackItem>
-                    <StackItem>
-                        <Divider component="div" />
-                    </StackItem>
-                    <StackItem>
-                        <Flex direction={{ default: 'column' }}>
-                            <FlexItem>
-                                <Title headingLevel="h3">Schedule</Title>
-                            </FlexItem>
-                            <FlexItem flex={{ default: 'flexNone' }}>
-                                <Flex direction={{ default: 'column' }}>
-                                    <Flex direction={{ default: 'row' }}>
-                                        <FlexItem>
-                                            <FormLabelGroup
-                                                label="Frequency"
-                                                fieldId="parameters.intervalType"
-                                                isRequired
-                                                errors={formik.errors}
-                                                touched={formik.touched}
-                                            >
-                                                <RepeatScheduleDropdown
-                                                    fieldId="parameters.intervalType"
-                                                    value={
-                                                        formik.values.parameters.intervalType || ''
-                                                    }
-                                                    handleSelect={handleSelectChange}
-                                                    includeDailyOption
-                                                    onBlur={formik.handleBlur}
-                                                />
-                                            </FormLabelGroup>
-                                        </FlexItem>
-                                        <FlexItem>
-                                            <FormLabelGroup
-                                                label="On day(s)"
-                                                fieldId={
-                                                    formik.values.parameters.intervalType ===
-                                                    'WEEKLY'
-                                                        ? 'parameters.daysOfWeek'
-                                                        : 'parameters.daysOfMonth'
-                                                }
-                                                errors={formik.errors}
-                                                isRequired={
-                                                    formik.values.parameters.intervalType ===
-                                                        'WEEKLY' ||
-                                                    formik.values.parameters.intervalType ===
-                                                        'MONTHLY'
-                                                }
-                                                touched={formik.touched}
-                                            >
-                                                <DayPickerDropdown
-                                                    fieldId={
-                                                        formik.values.parameters.intervalType ===
-                                                        'WEEKLY'
-                                                            ? 'parameters.daysOfWeek'
-                                                            : 'parameters.daysOfMonth'
-                                                    }
-                                                    value={
-                                                        (formik.values.parameters.intervalType ===
-                                                        'WEEKLY'
-                                                            ? formik.values.parameters.daysOfWeek
-                                                            : formik.values.parameters
-                                                                  .daysOfMonth) ?? []
-                                                    }
-                                                    handleSelect={onScheduledDaysChange}
-                                                    intervalType={
-                                                        formik.values.parameters.intervalType
-                                                    }
-                                                    isEditable={
-                                                        formik.values.parameters.intervalType ===
-                                                            'MONTHLY' ||
-                                                        formik.values.parameters.intervalType ===
-                                                            'WEEKLY'
-                                                    }
-                                                    toggleId={
-                                                        formik.values.parameters.intervalType ===
-                                                        'WEEKLY'
-                                                            ? 'parameters.daysOfWeek'
-                                                            : 'parameters.daysOfMonth'
-                                                    }
-                                                    onBlur={() => {
-                                                        const fieldId =
-                                                            formik.values.parameters
-                                                                .intervalType === 'WEEKLY'
-                                                                ? 'parameters.daysOfWeek'
-                                                                : 'parameters.daysOfMonth';
-                                                        formik.setFieldTouched(fieldId, true);
-                                                    }}
-                                                />
-                                            </FormLabelGroup>
-                                        </FlexItem>
-                                    </Flex>
-                                    <FlexItem>
-                                        <FormLabelGroup
-                                            label="Time"
-                                            fieldId="parameters.time"
-                                            errors={formik.errors}
-                                            isRequired
-                                            touched={formik.touched}
-                                            helperText={helperTextForTime}
-                                        >
-                                            <TimePicker
-                                                time={formik.values.parameters.time}
-                                                is24Hour
-                                                onChange={handleTimeChange}
-                                                inputProps={{
-                                                    onBlur: formik.handleBlur,
-                                                    name: 'parameters.time',
-                                                }}
-                                                invalidFormatErrorMessage="" // error messaging is handled by FormLabelGroup
-                                                invalidMinMaxErrorMessage=""
-                                            />
-                                        </FormLabelGroup>
-                                    </FlexItem>
-                                </Flex>
                             </FlexItem>
                         </Flex>
-                    </StackItem>
-                </Stack>
-            </Form>
-        </>
+                    </FormSection>
+                </Form>
+            </Flex>
+        </PageSection>
     );
 }
 
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigProfilesStep.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigProfilesStep.tsx
new file mode 100644
index 0000000000000..3c7a6c9fac7c4
--- /dev/null
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigProfilesStep.tsx
@@ -0,0 +1,235 @@
+import { useCallback, useState } from 'react';
+import type { FormEvent, ReactElement, RefObject } from 'react';
+import { useFormikContext } from 'formik';
+import type { FormikContextType } from 'formik';
+import {
+    Alert,
+    Content,
+    Flex,
+    Form,
+    PageSection,
+    Title,
+    Toolbar,
+    ToolbarContent,
+    ToolbarGroup,
+} from '@patternfly/react-core';
+import { ExpandableRowContent, Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
+
+import CompoundSearchFilter from 'Components/CompoundSearchFilter/components/CompoundSearchFilter';
+import CompoundSearchFilterLabels from 'Components/CompoundSearchFilter/components/CompoundSearchFilterLabels';
+import type { OnSearchCallback } from 'Components/CompoundSearchFilter/types';
+import { updateSearchFilter } from 'Components/CompoundSearchFilter/utils/utils';
+import TBodyUnified from 'Components/TableStateTemplates/TbodyUnified';
+import useRestQuery from 'hooks/useRestQuery';
+import useTableSelection from 'hooks/useTableSelection';
+import type { ComplianceProfileSummary } from 'services/ComplianceCommon';
+import { listProfileSummaries } from 'services/ComplianceProfileService';
+import type { SearchFilter } from 'types/search';
+import { getTableUIState } from 'utils/getTableUIState';
+
+import { complianceProfileOperatorKindLabels } from '../../compliance.constants';
+import { profileSearchFilterConfig } from '../../searchFilterConfig';
+import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
+
+const searchFilterConfig = [profileSearchFilterConfig];
+
+export type ScanConfigProfilesStepProps = {
+    alertRef: RefObject<HTMLDivElement>;
+    clusterIds: string[];
+};
+
+function ScanConfigProfilesStep({
+    alertRef,
+    clusterIds,
+}: ScanConfigProfilesStepProps): ReactElement {
+    const {
+        setFieldValue,
+        values: formikValues,
+        touched: formikTouched,
+    }: FormikContextType<ScanConfigFormValues> = useFormikContext();
+
+    const [searchFilter, setSearchFilter] = useState<SearchFilter>({});
+    const [expandedProfileNames, setExpandedProfileNames] = useState<string[]>([]);
+    const setProfileExpanded = (name: string, isExpanding = true) =>
+        setExpandedProfileNames((prevExpanded) => {
+            const otherExpandedProfileNames = prevExpanded.filter(
+                (profileName) => profileName !== name
+            );
+            return isExpanding ? [...otherExpandedProfileNames, name] : otherExpandedProfileNames;
+        });
+
+    const onSearch: OnSearchCallback = (payload) => {
+        setSearchFilter((prevSearchFilter) => updateSearchFilter(prevSearchFilter, payload));
+    };
+
+    const listProfilesQuery = useCallback(() => {
+        if (clusterIds.length > 0) {
+            return listProfileSummaries(clusterIds, searchFilter);
+        }
+        return Promise.resolve([]);
+    }, [clusterIds, searchFilter]);
+    const {
+        data: profiles,
+        isLoading: isFetchingProfiles,
+        error: profilesFetchError,
+    } = useRestQuery(listProfilesQuery);
+
+    const profileList = profiles ?? [];
+
+    const profileIsPreSelected = useCallback(
+        (row) => formikValues.profiles.includes(row.name),
+        [formikValues.profiles]
+    );
+
+    const { selected, onSelect } = useTableSelection(profileList, profileIsPreSelected, 'name');
+
+    const handleSelect = (
+        event: FormEvent<HTMLInputElement>,
+        isSelected: boolean,
+        rowId: number
+    ) => {
+        onSelect(event, isSelected, rowId);
+
+        const visibleSelectedNames = profileList
+            .filter((_, index) => {
+                return index === rowId ? isSelected : selected[index];
+            })
+            .map((profile) => profile.name);
+
+        const hiddenSelectedNames = formikValues.profiles.filter(
+            (name) => !profileList.some((p) => p.name === name)
+        );
+
+        setFieldValue('profiles', [...hiddenSelectedNames, ...visibleSelectedNames]);
+    };
+
+    const isProfileExpanded = (name: string) => expandedProfileNames.includes(name);
+    const totalColumns = 7;
+
+    const tableState = getTableUIState({
+        isLoading: isFetchingProfiles,
+        data: profiles,
+        error: profilesFetchError,
+        searchFilter,
+    });
+
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Profiles</Title>
+                <Form ref={alertRef} isWidthLimited>
+                    {formikTouched.profiles && formikValues.profiles.length === 0 && (
+                        <Alert
+                            title="At least one profile is required to proceed"
+                            component="p"
+                            variant="danger"
+                            isInline
+                        />
+                    )}
+                    <Toolbar>
+                        <ToolbarContent>
+                            <CompoundSearchFilter
+                                config={searchFilterConfig}
+                                searchFilter={searchFilter}
+                                onSearch={onSearch}
+                            />
+                            <ToolbarGroup className="pf-v6-u-w-100">
+                                <CompoundSearchFilterLabels
+                                    attributesSeparateFromConfig={[]}
+                                    config={searchFilterConfig}
+                                    onFilterChange={setSearchFilter}
+                                    searchFilter={searchFilter}
+                                />
+                            </ToolbarGroup>
+                        </ToolbarContent>
+                    </Toolbar>
+                    <Table>
+                        <Thead noWrap>
+                            <Tr>
+                                <Th screenReaderText="Row selection" />
+                                <Th screenReaderText="Row expansion" />
+                                <Th>Profile</Th>
+                                <Th>Type</Th>
+                                <Th>Rule set</Th>
+                                <Th>Applicability</Th>
+                                <Th>Version</Th>
+                            </Tr>
+                        </Thead>
+                        <TBodyUnified<ComplianceProfileSummary>
+                            tableState={tableState}
+                            colSpan={totalColumns}
+                            filteredEmptyProps={{ onClearFilters: () => setSearchFilter({}) }}
+                            renderer={({ data }) =>
+                                data.map(
+                                    (
+                                        {
+                                            description,
+                                            name,
+                                            productType,
+                                            ruleCount,
+                                            title,
+                                            profileVersion,
+                                            operatorKind,
+                                        },
+                                        rowIndex
+                                    ) => (
+                                        <Tbody isExpanded={isProfileExpanded(name)} key={name}>
+                                            <Tr>
+                                                <Td
+                                                    select={{
+                                                        rowIndex,
+                                                        onSelect: (event, isSelected) =>
+                                                            handleSelect(
+                                                                event,
+                                                                isSelected,
+                                                                rowIndex
+                                                            ),
+                                                        isSelected: selected[rowIndex],
+                                                    }}
+                                                />
+                                                <Td
+                                                    expand={{
+                                                        rowIndex,
+                                                        isExpanded: isProfileExpanded(name),
+                                                        onToggle: () =>
+                                                            setProfileExpanded(
+                                                                name,
+                                                                !isProfileExpanded(name)
+                                                            ),
+                                                    }}
+                                                />
+                                                <Td dataLabel="Profile">{name}</Td>
+                                                <Td dataLabel="Type">
+                                                    {(operatorKind &&
+                                                        complianceProfileOperatorKindLabels[
+                                                            operatorKind
+                                                        ]) ??
+                                                        '—'}
+                                                </Td>
+                                                <Td dataLabel="Rule set">{ruleCount}</Td>
+                                                <Td dataLabel="Applicability">{productType}</Td>
+                                                <Td dataLabel="Version">{profileVersion || '-'}</Td>
+                                            </Tr>
+                                            <Tr isExpanded={isProfileExpanded(name)}>
+                                                <Td colSpan={totalColumns}>
+                                                    <ExpandableRowContent>
+                                                        <Content component="p">{title}</Content>
+                                                        <Content component="p">
+                                                            {description}
+                                                        </Content>
+                                                    </ExpandableRowContent>
+                                                </Td>
+                                            </Tr>
+                                        </Tbody>
+                                    )
+                                )
+                            }
+                        />
+                    </Table>
+                </Form>
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default ScanConfigProfilesStep;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigReviewStep.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigReviewStep.tsx
new file mode 100644
index 0000000000000..dcbf94a548aa3
--- /dev/null
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigReviewStep.tsx
@@ -0,0 +1,78 @@
+import { useFormikContext } from 'formik';
+import type { FormikContextType } from 'formik';
+import { Alert, Flex, PageSection, Title } from '@patternfly/react-core';
+
+import type { ComplianceIntegration } from 'services/ComplianceIntegrationService';
+
+import { convertFormikParametersToSchedule } from '../compliance.scanConfigs.utils';
+import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
+import ScanConfigClustersView from '../components/ScanConfigClustersView';
+import ScanConfigDeliveryView from '../components/ScanConfigDeliveryView';
+import ScanConfigParametersView from '../components/ScanConfigParametersView';
+import ScanConfigProfilesView from '../components/ScanConfigProfilesView';
+
+const headingLevel = 'h3';
+
+export type ScanConfigReviewStepProps = {
+    clusters: ComplianceIntegration[];
+    errorMessage: string;
+};
+
+function ScanConfigReviewStep({ clusters, errorMessage }: ScanConfigReviewStepProps) {
+    const { values: formikValues }: FormikContextType<ScanConfigFormValues> = useFormikContext();
+
+    const scanSchedule = convertFormikParametersToSchedule(formikValues.parameters);
+
+    function findById<T, K extends keyof T>(selectedIds: string[], items: T[], idKey: K): T[] {
+        return selectedIds
+            .map((id) => items.find((item) => String(item[idKey]) === id))
+            .filter((item): item is T => item !== undefined);
+    }
+
+    const selectedClusters = findById(formikValues.clusters, clusters, 'clusterId');
+
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Review</Title>
+                {errorMessage && (
+                    <Alert
+                        title={'Scan configuration request failure'}
+                        component="p"
+                        variant="danger"
+                        isInline
+                    >
+                        {errorMessage}
+                    </Alert>
+                )}
+                <ScanConfigParametersView
+                    headingLevel={headingLevel}
+                    scanName={formikValues.parameters.name}
+                    description={formikValues.parameters.description}
+                    scanSchedule={scanSchedule}
+                />
+                <ScanConfigClustersView clusters={selectedClusters} headingLevel={headingLevel} />
+                <ScanConfigProfilesView
+                    headingLevel={headingLevel}
+                    profiles={formikValues.profiles}
+                />
+                <ScanConfigDeliveryView
+                    headingLevel={headingLevel}
+                    notifiers={formikValues.report.notifierConfigurations}
+                />
+                <Alert
+                    variant="info"
+                    title="Save for new versus existing scan schedule"
+                    component="p"
+                    isInline
+                    className="pf-v6-u-mb-lg"
+                >
+                    Compliance Operator runs a new scan schedule immediately upon creation, but does
+                    not run until scheduled time when you save changes to an existing scan schedule.
+                </Alert>
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default ScanConfigReviewStep;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigWizardForm.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigWizardPageSection.tsx
similarity index 79%
rename from ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigWizardForm.tsx
rename to ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigWizardPageSection.tsx
index f6c6061e064b9..e6956512414ff 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigWizardForm.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/Wizard/ScanConfigWizardPageSection.tsx
@@ -1,7 +1,14 @@
 import { useCallback, useRef, useState } from 'react';
 import type { ReactElement, RefObject } from 'react';
 import { useNavigate } from 'react-router-dom-v5-compat';
-import { Button, Wizard, WizardFooter, WizardStep, useWizardContext } from '@patternfly/react-core';
+import {
+    Button,
+    PageSection,
+    Wizard,
+    WizardFooter,
+    WizardStep,
+    useWizardContext,
+} from '@patternfly/react-core';
 import type { WizardStepType } from '@patternfly/react-core';
 import { Modal } from '@patternfly/react-core/deprecated';
 import { FormikProvider } from 'formik';
@@ -19,27 +26,29 @@ import { listComplianceIntegrations } from 'services/ComplianceIntegrationServic
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
 
 import ScanConfigOptions from './ScanConfigOptions';
-import ClusterSelection from './ClusterSelection';
-import ProfileSelection from './ProfileSelection';
-import ReportConfiguration from './ReportConfiguration';
-import ReviewConfig from './ReviewConfig';
+import ScanConfigClustersStep from './ScanConfigClustersStep';
+import ScanConfigProfilesStep from './ScanConfigProfilesStep';
+import ScanConfigDeliveryStep from './ScanConfigDeliveryStep';
+import ScanConfigReviewStep from './ScanConfigReviewStep';
 import useFormikScanConfig from './useFormikScanConfig';
 import { convertFormikToScanConfig } from '../compliance.scanConfigs.utils';
-import type { ScanConfigFormValues } from '../compliance.scanConfigs.utils';
+import type { ScanConfigFormValues, SchedulePageAction } from '../compliance.scanConfigs.utils';
 
-const PARAMETERS = 'Set parameters';
+// Parameters (and so on) for step label are consistent with the corresponding step heading and view heading.
+const PARAMETERS = 'Parameters';
 const PARAMETERS_ID = 'parameters';
-const SELECT_CLUSTERS = 'Select clusters';
+const SELECT_CLUSTERS = 'Clusters';
 const SELECT_CLUSTERS_ID = 'clusters';
-const SELECT_PROFILES = 'Select profiles';
+const SELECT_PROFILES = 'Profiles';
 const SELECT_PROFILES_ID = 'profiles';
-const CONFIGURE_REPORT = 'Configure report';
+const CONFIGURE_REPORT = 'Delivery';
 const CONFIGURE_REPORT_ID = 'report';
 const REVIEW_CONFIG = 'Review';
 const REVIEW_CONFIG_ID = 'review';
 
-type ScanConfigWizardFormProps = {
+type ScanConfigWizardPageSectionProps = {
     initialFormValues?: ScanConfigFormValues;
+    pageAction: SchedulePageAction;
 };
 
 type CustomWizardFooterProps = {
@@ -115,7 +124,10 @@ function CustomWizardFooter({
     );
 }
 
-function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps): ReactElement {
+function ScanConfigWizardPageSection({
+    initialFormValues,
+    pageAction,
+}: ScanConfigWizardPageSectionProps): ReactElement {
     const { analyticsTrack } = useAnalytics();
     const navigate = useNavigate();
     const formik = useFormikScanConfig(initialFormValues);
@@ -133,6 +145,8 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
         setIsCreating(true);
         setCreateScanConfigError('');
         const complianceScanConfig = convertFormikToScanConfig(formik.values);
+        const { clusters, scanConfig } = complianceScanConfig;
+        const { notifiers, profiles, scanSchedule } = scanConfig;
 
         try {
             await saveScanConfig(complianceScanConfig);
@@ -141,6 +155,11 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                 properties: {
                     success: true,
                     errorMessage: '',
+                    action: pageAction,
+                    clusters: clusters.length,
+                    intervalType: scanSchedule.intervalType,
+                    notifiers: notifiers.length,
+                    profiles: profiles.length,
                 },
             });
             navigate(complianceEnhancedSchedulesPath);
@@ -150,6 +169,11 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                 properties: {
                     success: false,
                     errorMessage: getAxiosErrorMessage(error),
+                    action: pageAction,
+                    clusters: clusters.length,
+                    intervalType: scanSchedule.intervalType,
+                    notifiers: notifiers.length,
+                    profiles: profiles.length,
                 },
             });
             setCreateScanConfigError(getAxiosErrorMessage(error));
@@ -182,20 +206,20 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
         navigate(complianceEnhancedSchedulesPath);
     }
 
-    function canJumpToSelectClusters() {
+    function canJumpToClusters() {
         return Object.keys(formik.errors?.parameters ?? {}).length === 0;
     }
 
-    function canJumpToSelectProfiles() {
-        return canJumpToSelectClusters() && Object.keys(formik.errors?.clusters ?? {}).length === 0;
+    function canJumpToProfiles() {
+        return canJumpToClusters() && Object.keys(formik.errors?.clusters ?? {}).length === 0;
     }
 
-    function canJumpToConfigureReport() {
-        return canJumpToSelectProfiles() && Object.keys(formik.errors?.profiles ?? {}).length === 0;
+    function canJumpToDelivery() {
+        return canJumpToProfiles() && Object.keys(formik.errors?.profiles ?? {}).length === 0;
     }
 
-    function canJumpToReviewConfig() {
-        return canJumpToConfigureReport() && Object.keys(formik.errors?.report ?? {}).length === 0;
+    function canJumpToReview() {
+        return canJumpToDelivery() && Object.keys(formik.errors?.report ?? {}).length === 0;
     }
 
     function allClustersAreUnhealthy(): boolean {
@@ -203,7 +227,13 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
     }
 
     return (
-        <>
+        <PageSection
+            hasBodyWrapper={false}
+            hasOverflowScroll
+            isFilled
+            padding={{ default: 'noPadding' }}
+            type="wizard"
+        >
             <FormikProvider value={formik}>
                 <Wizard
                     navAriaLabel="Scan schedule configuration steps"
@@ -229,7 +259,7 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                         name={SELECT_CLUSTERS}
                         id={SELECT_CLUSTERS_ID}
                         body={{ hasNoPadding: true }}
-                        isDisabled={!canJumpToSelectClusters()}
+                        isDisabled={!canJumpToClusters()}
                         footer={
                             <CustomWizardFooter
                                 stepId={SELECT_CLUSTERS_ID}
@@ -240,7 +270,7 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                             />
                         }
                     >
-                        <ClusterSelection
+                        <ScanConfigClustersStep
                             alertRef={alertRef}
                             clusters={clusters ?? []}
                             isFetchingClusters={isFetchingClusters}
@@ -250,7 +280,7 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                         name={SELECT_PROFILES}
                         id={SELECT_PROFILES_ID}
                         body={{ hasNoPadding: true }}
-                        isDisabled={!canJumpToSelectProfiles()}
+                        isDisabled={!canJumpToProfiles()}
                         footer={
                             <CustomWizardFooter
                                 stepId={SELECT_PROFILES_ID}
@@ -260,7 +290,7 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                             />
                         }
                     >
-                        <ProfileSelection
+                        <ScanConfigProfilesStep
                             alertRef={alertRef}
                             clusterIds={clustersUsedForProfileData}
                         />
@@ -269,7 +299,7 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                         name={CONFIGURE_REPORT}
                         id={CONFIGURE_REPORT_ID}
                         body={{ hasNoPadding: true }}
-                        isDisabled={!canJumpToConfigureReport()}
+                        isDisabled={!canJumpToDelivery()}
                         footer={
                             <CustomWizardFooter
                                 stepId={CONFIGURE_REPORT_ID}
@@ -279,20 +309,20 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                             />
                         }
                     >
-                        <ReportConfiguration />
+                        <ScanConfigDeliveryStep />
                     </WizardStep>
                     <WizardStep
                         name={REVIEW_CONFIG}
                         id={REVIEW_CONFIG_ID}
                         body={{ hasNoPadding: true }}
-                        isDisabled={!canJumpToReviewConfig()}
+                        isDisabled={!canJumpToReview()}
                         footer={{
                             nextButtonProps: { isLoading: isCreating },
                             nextButtonText: 'Save',
                             onClose: openModal,
                         }}
                     >
-                        <ReviewConfig
+                        <ScanConfigReviewStep
                             clusters={clusters ?? []}
                             errorMessage={createScanConfigError}
                         />
@@ -318,8 +348,8 @@ function ScanConfigWizardForm({ initialFormValues }: ScanConfigWizardFormProps):
                     taken back to the list of scan configurations.
                 </p>
             </Modal>
-        </>
+        </PageSection>
     );
 }
 
-export default ScanConfigWizardForm;
+export default ScanConfigWizardPageSection;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/compliance.scanConfigs.utils.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/compliance.scanConfigs.utils.tsx
index e1f6f4ad98235..43ee0187820f1 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/compliance.scanConfigs.utils.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/compliance.scanConfigs.utils.tsx
@@ -1,5 +1,4 @@
 import type { DayOfMonth, DayOfWeek } from 'Components/PatternFly/DayPickerDropdown';
-import { getProductBranding } from 'constants/productBranding';
 import type {
     ComplianceScanConfiguration,
     ComplianceScanConfigurationStatus,
@@ -36,7 +35,7 @@ export type ScanConfigFormValues = {
     report: ScanReportConfiguration;
 };
 
-export type PageActions = 'create' | 'edit' | 'clone';
+export type SchedulePageAction = 'create' | 'edit';
 
 export function getTimeWithHourMinuteFromISO8601(timeISO8601: string) {
     // Given an ISO 8601 date time string from response,
@@ -182,15 +181,3 @@ export function convertScanConfigToFormik(
         },
     };
 }
-
-// report
-
-const { reportName } = getProductBranding();
-
-export function getBodyDefault(profiles: string[]) {
-    return `${reportName} has scanned your clusters for compliance with the profiles in your scan configuration. The attached report lists those checks and associated details to help with remediation. Profiles: ${profiles.join(',')}`;
-}
-
-export function getSubjectDefault(scanName: string, profiles: string[]) {
-    return `${reportName} Compliance Report for ${scanName} with ${profiles.length} Profiles`;
-}
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ConfigDetails.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ConfigDetails.tsx
index e70ae01b6bbf3..f0d8cee6b79ff 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ConfigDetails.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ConfigDetails.tsx
@@ -1,23 +1,12 @@
-import {
-    Alert,
-    Bullseye,
-    DescriptionListDescription,
-    DescriptionListGroup,
-    DescriptionListTerm,
-    Flex,
-    Spinner,
-} from '@patternfly/react-core';
+import { Alert, Bullseye, Flex, Spinner } from '@patternfly/react-core';
 
-import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
-import NotifierConfigurationView from 'Components/NotifierConfiguration/NotifierConfigurationView';
 import type { ComplianceScanConfigurationStatus } from 'services/ComplianceScanConfigurationService';
-import {
-    getBodyDefault,
-    getSubjectDefault,
-    getTimeWithHourMinuteFromISO8601,
-} from '../compliance.scanConfigs.utils';
-import ScanConfigParametersView from './ScanConfigParametersView';
+import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
+
+import ScanConfigActivityView from './ScanConfigActivityView';
 import ScanConfigClustersTable from './ScanConfigClustersTable';
+import ScanConfigDeliveryView from './ScanConfigDeliveryView';
+import ScanConfigParametersView from './ScanConfigParametersView';
 import ScanConfigProfilesView from './ScanConfigProfilesView';
 
 export type ConfigDetailsProps = {
@@ -47,28 +36,14 @@ function ConfigDetails({ isLoading, error, scanConfig }: ConfigDetailsProps) {
 
     if (scanConfig) {
         return (
-            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
                 <ScanConfigParametersView
                     headingLevel={headingLevel}
                     scanName={scanConfig.scanName}
                     description={scanConfig.scanConfig.description}
                     scanSchedule={scanConfig.scanConfig.scanSchedule}
-                >
-                    <DescriptionListGroup>
-                        <DescriptionListTerm>Last scanned</DescriptionListTerm>
-                        <DescriptionListDescription>
-                            {scanConfig.lastExecutedTime
-                                ? getTimeWithHourMinuteFromISO8601(scanConfig.lastExecutedTime)
-                                : 'Scan is in progress'}
-                        </DescriptionListDescription>
-                    </DescriptionListGroup>
-                    <DescriptionListGroup>
-                        <DescriptionListTerm>Last updated</DescriptionListTerm>
-                        <DescriptionListDescription>
-                            {getTimeWithHourMinuteFromISO8601(scanConfig.lastUpdatedTime)}
-                        </DescriptionListDescription>
-                    </DescriptionListGroup>
-                </ScanConfigParametersView>
+                />
+                <ScanConfigActivityView headingLevel={headingLevel} scanConfig={scanConfig} />
                 <ScanConfigClustersTable
                     headingLevel={headingLevel}
                     clusterScanStatuses={scanConfig.clusterStatus}
@@ -77,14 +52,9 @@ function ConfigDetails({ isLoading, error, scanConfig }: ConfigDetailsProps) {
                     headingLevel={headingLevel}
                     profiles={scanConfig.scanConfig.profiles}
                 />
-                <NotifierConfigurationView
+                <ScanConfigDeliveryView
                     headingLevel={headingLevel}
-                    customBodyDefault={getBodyDefault(scanConfig.scanConfig.profiles)}
-                    customSubjectDefault={getSubjectDefault(
-                        scanConfig.scanName,
-                        scanConfig.scanConfig.profiles
-                    )}
-                    notifierConfigurations={scanConfig.scanConfig.notifiers}
+                    notifiers={scanConfig.scanConfig.notifiers}
                 />
             </Flex>
         );
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ReportJobs.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ReportJobs.tsx
index d95bf0396095f..e86a537a50f31 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ReportJobs.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ReportJobs.tsx
@@ -31,7 +31,7 @@ import { getTableUIState } from 'utils/getTableUIState';
 import useDeleteDownloadModal from 'Containers/Vulnerabilities/VulnerablityReporting/hooks/useDeleteDownloadModal';
 import DeleteModal from 'Components/PatternFly/DeleteModal';
 import ReportJobStatusFilter, {
-    ensureReportJobStatuses,
+    isReportJobStatus,
 } from 'Components/ReportJob/ReportJobStatusFilter';
 import MyJobsFilter from 'Components/ReportJob/MyJobsFilter';
 import type { ReportJobStatus } from 'Components/ReportJob/types';
@@ -45,7 +45,7 @@ function getConfigName(snapshot: ComplianceReportSnapshot) {
     return snapshot.name;
 }
 
-function createQueryFromReportJobStatusFilters(jobStatusFilters: string[]) {
+function createQueryFromReportJobStatusFilters(reportJobStatuses: ReportJobStatus[]) {
     const query: Record<string, string[]> = {
         'Compliance Report State': [],
         'Compliance Report Notification Method': [],
@@ -70,8 +70,6 @@ function createQueryFromReportJobStatusFilters(jobStatusFilters: string[]) {
         },
     };
 
-    const reportJobStatuses = ensureReportJobStatuses(jobStatusFilters);
-
     reportJobStatuses.forEach((jobStatus) => {
         const queryMapping = jobStatusQueryMappings[jobStatus];
         if (queryMapping) {
@@ -103,7 +101,9 @@ function ReportJobs({ scanConfigId }: ReportJobsProps) {
         'true',
     ]);
 
-    const reportJobStatusFilters = ensureStringArray(searchFilter['Compliance Report Job Status']);
+    const reportJobStatusFilters = ensureStringArray(
+        searchFilter['Compliance Report Job Status']
+    ).filter(isReportJobStatus);
 
     const query = getRequestQueryStringForSearchFilter({
         ...createQueryFromReportJobStatusFilters(reportJobStatusFilters),
@@ -151,10 +151,8 @@ function ReportJobs({ scanConfigId }: ReportJobsProps) {
     const onReportJobStatusFilterChange = (_checked: boolean, selectedStatus: ReportJobStatus) => {
         const isStatusIncluded = reportJobStatusFilters.includes(selectedStatus);
         const newFilters = isStatusIncluded
-            ? ensureReportJobStatuses(
-                  reportJobStatusFilters.filter((status) => status !== selectedStatus)
-              )
-            : ensureReportJobStatuses([...reportJobStatusFilters, selectedStatus]);
+            ? reportJobStatusFilters.filter((status) => status !== selectedStatus)
+            : [...reportJobStatusFilters, selectedStatus];
         analyticsTrack({
             event: 'Compliance Report Job Status Filtered',
             properties: {
@@ -197,7 +195,7 @@ function ReportJobs({ scanConfigId }: ReportJobsProps) {
                                 'PARTIAL_SCAN_ERROR_EMAIL',
                                 'ERROR',
                             ]}
-                            selectedStatuses={ensureReportJobStatuses(reportJobStatusFilters)}
+                            selectedStatuses={reportJobStatusFilters}
                             onChange={onReportJobStatusFilterChange}
                         />
                     </ToolbarItem>
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigActivityView.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigActivityView.tsx
new file mode 100644
index 0000000000000..3ca82196f8056
--- /dev/null
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigActivityView.tsx
@@ -0,0 +1,47 @@
+import type { ReactElement } from 'react';
+import {
+    DescriptionList,
+    DescriptionListDescription,
+    DescriptionListGroup,
+    DescriptionListTerm,
+    Flex,
+    Title,
+} from '@patternfly/react-core';
+
+import type { ComplianceScanConfigurationStatus } from 'services/ComplianceScanConfigurationService';
+
+import { getTimeWithHourMinuteFromISO8601 } from '../compliance.scanConfigs.utils';
+
+type ScanConfigActivityViewProps = {
+    headingLevel: 'h2' | 'h3';
+    scanConfig: ComplianceScanConfigurationStatus;
+};
+
+function ScanConfigActivityView({
+    headingLevel,
+    scanConfig,
+}: ScanConfigActivityViewProps): ReactElement {
+    return (
+        <Flex direction={{ default: 'column' }}>
+            <Title headingLevel={headingLevel}>Activity</Title>
+            <DescriptionList isCompact isHorizontal>
+                <DescriptionListGroup>
+                    <DescriptionListTerm>Last scanned</DescriptionListTerm>
+                    <DescriptionListDescription>
+                        {scanConfig.lastExecutedTime
+                            ? getTimeWithHourMinuteFromISO8601(scanConfig.lastExecutedTime)
+                            : 'Scan is in progress'}
+                    </DescriptionListDescription>
+                </DescriptionListGroup>
+                <DescriptionListGroup>
+                    <DescriptionListTerm>Last updated</DescriptionListTerm>
+                    <DescriptionListDescription>
+                        {getTimeWithHourMinuteFromISO8601(scanConfig.lastUpdatedTime)}
+                    </DescriptionListDescription>
+                </DescriptionListGroup>
+            </DescriptionList>
+        </Flex>
+    );
+}
+
+export default ScanConfigActivityView;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigClustersView.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigClustersView.tsx
new file mode 100644
index 0000000000000..73a4c2c2df56d
--- /dev/null
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigClustersView.tsx
@@ -0,0 +1,30 @@
+import type { ReactElement } from 'react';
+import { Badge, Flex, List, ListItem, Title } from '@patternfly/react-core';
+
+import type { ComplianceIntegration } from 'services/ComplianceIntegrationService';
+
+type ScanConfigClustersViewProps = {
+    headingLevel: 'h2' | 'h3';
+    clusters: ComplianceIntegration[];
+};
+
+function ScanConfigClustersView({
+    headingLevel,
+    clusters,
+}: ScanConfigClustersViewProps): ReactElement {
+    return (
+        <Flex direction={{ default: 'column' }}>
+            <Flex spaceItems={{ default: 'spaceItemsSm' }}>
+                <Title headingLevel={headingLevel}>Clusters</Title>
+                <Badge isRead>{clusters.length}</Badge>
+            </Flex>
+            <List isPlain>
+                {clusters.map((cluster) => (
+                    <ListItem key={cluster.id}>{cluster.clusterName}</ListItem>
+                ))}
+            </List>
+        </Flex>
+    );
+}
+
+export default ScanConfigClustersView;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigDeliveryView.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigDeliveryView.tsx
new file mode 100644
index 0000000000000..071648d5a5105
--- /dev/null
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigDeliveryView.tsx
@@ -0,0 +1,26 @@
+import type { ReactElement } from 'react';
+import { DescriptionList, Flex, Title } from '@patternfly/react-core';
+
+import NotifierConfigurationsDescriptionListGroup from 'Components/Reports/View/NotifierConfigurationsDescriptionListGroup';
+import type { NotifierConfiguration } from 'services/ReportsService.types';
+
+type ScanConfigDeliveryViewProps = {
+    headingLevel: 'h2' | 'h3';
+    notifiers: NotifierConfiguration[];
+};
+
+function ScanConfigDeliveryView({
+    headingLevel,
+    notifiers,
+}: ScanConfigDeliveryViewProps): ReactElement {
+    return (
+        <Flex direction={{ default: 'column' }}>
+            <Title headingLevel={headingLevel}>Delivery</Title>
+            <DescriptionList isCompact isHorizontal>
+                <NotifierConfigurationsDescriptionListGroup notifiers={notifiers} />
+            </DescriptionList>
+        </Flex>
+    );
+}
+
+export default ScanConfigDeliveryView;
diff --git a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigParametersView.tsx b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigParametersView.tsx
index 16339575878c4..9721427fadf67 100644
--- a/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigParametersView.tsx
+++ b/ui/apps/platform/src/Containers/ComplianceEnhanced/Schedules/components/ScanConfigParametersView.tsx
@@ -1,22 +1,15 @@
-import type { ReactElement, ReactNode } from 'react';
-import {
-    DescriptionList,
-    DescriptionListDescription,
-    DescriptionListGroup,
-    DescriptionListTerm,
-    Flex,
-    Title,
-} from '@patternfly/react-core';
+import type { ReactElement } from 'react';
+import { DescriptionList, Flex, Title } from '@patternfly/react-core';
 
+import DetailsDescriptionListGroups from 'Components/Reports/View/DetailsDescriptionListGroups';
+import ScheduleDescriptionListGroup from 'Components/Reports/View/ScheduleDescriptionListGroup';
 import type { Schedule } from 'types/schedule.proto';
-import { formatRecurringSchedule } from 'utils/dateUtils';
 
 type ScanConfigParametersViewProps = {
     headingLevel: 'h2' | 'h3';
     scanName: string;
     description?: string;
     scanSchedule: Schedule;
-    children?: ReactNode;
 };
 
 function ScanConfigParametersView({
@@ -24,29 +17,13 @@ function ScanConfigParametersView({
     headingLevel,
     scanName,
     scanSchedule,
-    children,
 }: ScanConfigParametersViewProps): ReactElement {
     return (
         <Flex direction={{ default: 'column' }}>
             <Title headingLevel={headingLevel}>Parameters</Title>
             <DescriptionList isCompact isHorizontal>
-                <DescriptionListGroup>
-                    <DescriptionListTerm>Name</DescriptionListTerm>
-                    <DescriptionListDescription>{scanName}</DescriptionListDescription>
-                </DescriptionListGroup>
-                <DescriptionListGroup>
-                    <DescriptionListTerm>Description</DescriptionListTerm>
-                    <DescriptionListDescription>
-                        {description || <em>No description</em>}
-                    </DescriptionListDescription>
-                </DescriptionListGroup>
-                <DescriptionListGroup>
-                    <DescriptionListTerm>Schedule</DescriptionListTerm>
-                    <DescriptionListDescription>
-                        {formatRecurringSchedule(scanSchedule)}
-                    </DescriptionListDescription>
-                </DescriptionListGroup>
-                {children}
+                <DetailsDescriptionListGroups description={description ?? ''} name={scanName} />
+                <ScheduleDescriptionListGroup schedule={scanSchedule} />
             </DescriptionList>
         </Flex>
     );
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/ConfigManagementRoutes.jsx b/ui/apps/platform/src/Containers/ConfigManagement/ConfigManagementRoutes.jsx
index 64da6705b0354..b9e0da7a9c66c 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/ConfigManagementRoutes.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/ConfigManagementRoutes.jsx
@@ -1,6 +1,7 @@
 import { memo } from 'react';
 import { Route, Routes } from 'react-router-dom-v5-compat';
 import isEqual from 'lodash/isEqual';
+import { Alert } from '@patternfly/react-core';
 import PageNotFound from 'Components/PageNotFound';
 import searchContext from 'Containers/searchContext';
 import { searchParams } from 'constants/searchParams';
@@ -14,6 +15,15 @@ const entityPath = `:pageEntityId?/:entityType1?/:entityId1?/:entityType2?/:enti
 
 const ConfigManagementRoutes = () => (
     <searchContext.Provider value={searchParams.page}>
+        <Alert
+            title="Configuration Management is deprecated and will be removed in a future release"
+            component="p"
+            variant="info"
+            isInline
+        >
+            Security configuration data will integrate directly into risk and policy management
+            workflows to enhance visibility without relying on a standalone dashboard.
+        </Alert>
         <Routes>
             <Route index element={<ConfigManagementDashboardPage />} />
             <Route path={`namespace/${entityPath}`} element={<EntityPage />} />
@@ -23,7 +33,6 @@ const ConfigManagementRoutes = () => (
             <Route path={`image/${entityPath}`} element={<EntityPage />} />
             <Route path={`secret/${entityPath}`} element={<EntityPage />} />
             <Route path={`policy/${entityPath}`} element={<EntityPage />} />
-            <Route path={`control/${entityPath}`} element={<EntityPage />} />
             <Route path={`serviceaccount/${entityPath}`} element={<EntityPage />} />
             <Route path={`subject/${entityPath}`} element={<EntityPage />} />
             <Route path={`role/${entityPath}`} element={<EntityPage />} />
@@ -35,7 +44,6 @@ const ConfigManagementRoutes = () => (
             <Route path={`images/${listPath}`} element={<ListPage />} />
             <Route path={`secrets/${listPath}`} element={<ListPage />} />
             <Route path={`policies/${listPath}`} element={<ListPage />} />
-            <Route path={`controls/${listPath}`} element={<ListPage />} />
             <Route path={`serviceaccounts/${listPath}`} element={<ListPage />} />
             <Route path={`subjects/${listPath}`} element={<ListPage />} />
             <Route path={`roles/${listPath}`} element={<ListPage />} />
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.test.js b/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.test.js
index 195b0c220d372..6423988364b42 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.test.js
+++ b/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.test.js
@@ -3,14 +3,6 @@ import { getConfigMgmtCountQuery } from './ConfigMgmt.utils';
 
 describe('ConfigMgmt.utils.test', () => {
     describe('getConfigMgmtCountQuery', () => {
-        it('should return an empty string when the entity list is Controls', () => {
-            const entityListType = entityTypes.CONTROL;
-
-            const countQuery = getConfigMgmtCountQuery(entityListType);
-
-            expect(countQuery).toEqual('');
-        });
-
         it('should return an empty string when the entity list is Policies', () => {
             const entityListType = entityTypes.POLICY;
 
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.ts b/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.ts
index a4f8033fd7e4c..8d380718ed108 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.ts
+++ b/ui/apps/platform/src/Containers/ConfigManagement/ConfigMgmt.utils.ts
@@ -15,7 +15,6 @@ import { defaultSubjectSort } from './List/ConfigManagementListSubjects';
 
 const defaultSortFieldMap: Record<ConfigurationManagementEntityType, GraphQLSortOption[]> = {
     CLUSTER: defaultClusterSort,
-    CONTROL: [],
     DEPLOYMENT: defaultDeploymentSort,
     IMAGE: defaultImageSort,
     NAMESPACE: defaultNamespaceSort,
@@ -38,7 +37,7 @@ export function getConfigMgmtDefaultSort(
 export function getConfigMgmtCountQuery(entityListType: ConfigurationManagementEntityType) {
     const parsedEntityListTypeCount = defaultCountKeyMap[entityListType];
 
-    return !parsedEntityListTypeCount || entityListType === 'CONTROL' || entityListType === 'POLICY'
+    return !parsedEntityListTypeCount || entityListType === 'POLICY'
         ? ''
         : `count: ${parsedEntityListTypeCount}(query: $query)`;
 }
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/ConfigManagementDashboardPage.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/ConfigManagementDashboardPage.jsx
index 2b4880daf9abb..f73ec88623e37 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/ConfigManagementDashboardPage.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/ConfigManagementDashboardPage.jsx
@@ -1,13 +1,11 @@
 import useCaseLabels from 'messages/useCase';
 import useCaseTypes from 'constants/useCaseTypes';
-import { standardTypes } from 'constants/entityTypes';
 import usePermissions from 'hooks/usePermissions';
 
 import DashboardLayout from 'Components/DashboardLayout';
 import Header from './Header/Header';
 
 import PolicyViolationsBySeverity from './widgets/PolicyViolationsBySeverity';
-import ComplianceByControls from './widgets/ComplianceByControls';
 import UsersWithMostClusterAdminRoles from './widgets/UsersWithMostClusterAdminRoles';
 import SecretsMostUsedAcrossDeployments from './widgets/SecretsMostUsedAcrossDeployments';
 
@@ -15,7 +13,6 @@ const ConfigManagementDashboardPage = () => {
     const { hasReadAccess } = usePermissions();
     const hasReadAccessForPolicyViolationsBySeverity =
         hasReadAccess('Alert') && hasReadAccess('WorkflowAdministration');
-    const hasReadAccessForComplianceByControls = hasReadAccess('Compliance');
     const hasReadAccessForUsersWithMostClusterAdminRoles =
         hasReadAccess('Cluster') && hasReadAccess('K8sRoleBinding') && hasReadAccess('K8sSubject');
     const hasReadAccessForSecretsMostUsedAcrossDeployments =
@@ -26,9 +23,6 @@ const ConfigManagementDashboardPage = () => {
             headerComponents={<Header />}
         >
             {hasReadAccessForPolicyViolationsBySeverity && <PolicyViolationsBySeverity />}
-            {hasReadAccessForComplianceByControls && (
-                <ComplianceByControls standardOptions={[standardTypes.CIS_Kubernetes_v1_5]} />
-            )}
             {hasReadAccessForUsersWithMostClusterAdminRoles && <UsersWithMostClusterAdminRoles />}
             {hasReadAccessForSecretsMostUsedAcrossDeployments && (
                 <SecretsMostUsedAcrossDeployments />
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/Header/CISControlsTile.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/Header/CISControlsTile.jsx
deleted file mode 100644
index cd7903eb78b84..0000000000000
--- a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/Header/CISControlsTile.jsx
+++ /dev/null
@@ -1,39 +0,0 @@
-import URLService from 'utils/URLService';
-import { useLocation } from 'react-router-dom-v5-compat';
-import entityTypes from 'constants/entityTypes';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { gql, useQuery } from '@apollo/client';
-import logError from 'utils/logError';
-
-import EntityTileLink from 'Components/EntityTileLink';
-
-const NUM_CIS_CONTROLS = gql`
-    query numCISControls {
-        executedControlCount(query: "Standard: CIS")
-    }
-`;
-
-const CISControlsTile = () => {
-    const { loading, error, data } = useQuery(NUM_CIS_CONTROLS);
-    if (error) {
-        logError(error);
-    }
-
-    const match = useWorkflowMatch();
-    const location = useLocation();
-    const controlsURL = URLService.getURL(match, location).base(entityTypes.CONTROL).url();
-
-    const numCISControls = data?.executedControlCount || 0;
-    return (
-        <EntityTileLink
-            count={numCISControls}
-            entityType={entityTypes.CONTROL}
-            url={controlsURL}
-            loading={loading}
-            position="middle"
-            short
-        />
-    );
-};
-
-export default CISControlsTile;
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/Header/Header.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/Header/Header.jsx
index b2c12ad2629a0..c9eec6a85374e 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/Header/Header.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/Header/Header.jsx
@@ -1,18 +1,15 @@
 import usePermissions from 'hooks/usePermissions';
 import PoliciesTile from './PoliciesTile';
-import CISControlsTile from './CISControlsTile';
 import AppMenu from './AppMenu';
 import RBACMenu from './RBACMenu';
 
 const Header = () => {
     const { hasReadAccess } = usePermissions();
     const hasReadAccessForPoliciesTile = hasReadAccess('WorkflowAdministration');
-    const hasReadAccessForCISControlsTile = hasReadAccess('Compliance');
     return (
         <div className="flex flex-1 justify-end">
             <div className="flex">
                 {hasReadAccessForPoliciesTile && <PoliciesTile />}
-                {hasReadAccessForCISControlsTile && <CISControlsTile />}
                 <div className="flex w-32 mr-2">
                     <AppMenu />
                 </div>
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/widgets/ComplianceByControls.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/widgets/ComplianceByControls.jsx
deleted file mode 100644
index 2b93435e2fbfc..0000000000000
--- a/ui/apps/platform/src/Containers/ConfigManagement/Dashboard/widgets/ComplianceByControls.jsx
+++ /dev/null
@@ -1,395 +0,0 @@
-import { useContext, useState } from 'react';
-import { Alert } from '@patternfly/react-core';
-import PropTypes from 'prop-types';
-import { gql } from '@apollo/client';
-import { Link, useLocation } from 'react-router-dom-v5-compat';
-import queryService from 'utils/queryService';
-import entityTypes, { standardEntityTypes, standardBaseTypes } from 'constants/entityTypes';
-import { COMPLIANCE_FAIL_COLOR, COMPLIANCE_PASS_COLOR } from 'constants/severityColors';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import { standardLabels } from 'messages/standards';
-import URLService from 'utils/URLService';
-import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
-import searchContext from 'Containers/searchContext';
-import networkStatuses from 'constants/networkStatuses';
-import COMPLIANCE_STATES from 'constants/complianceStates';
-
-import ScanButton from 'Containers/Compliance/ScanButton';
-import ComplianceScanProgress from 'Containers/Compliance/Dashboard/ComplianceScanProgress';
-import { useComplianceRunStatuses } from 'Containers/Compliance/Dashboard/useComplianceRunStatuses';
-
-import Query from 'Components/CacheFirstQuery';
-import Widget from 'Components/Widget';
-import Loader from 'Components/Loader';
-import Sunburst from 'Components/visuals/Sunburst';
-import TextSelect from 'Components/TextSelect';
-import NoResultsMessage from 'Components/NoResultsMessage';
-import usePermissions from 'hooks/usePermissions';
-
-const passingColor = COMPLIANCE_PASS_COLOR;
-const failingColor = COMPLIANCE_FAIL_COLOR;
-const NAColor = 'var(--base-400)'; // same as skippedColor in ComplianceByStandards
-
-const sunburstLegendData = [
-    { title: 'Passing', color: passingColor },
-    { title: 'Failing', color: failingColor },
-    { title: 'N/A', color: NAColor },
-];
-
-const QUERY = gql`
-    query complianceByControls(
-        $groupBy: [ComplianceAggregation_Scope!]
-        $unit: ComplianceAggregation_Scope!
-        $where: String
-    ) {
-        aggregatedResults(groupBy: $groupBy, unit: $unit, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                keys {
-                    ... on ComplianceControlGroup {
-                        id
-                        name
-                        description
-                    }
-                    ... on ComplianceControl {
-                        id
-                        name
-                        description
-                    }
-                }
-            }
-        }
-    }
-`;
-
-const getPercentagePassing = (numPassing, numFailing) => {
-    if (numPassing === 0 && numFailing === 0) {
-        return 0;
-    }
-    return Math.floor((numPassing / (numPassing + numFailing)) * 100);
-};
-
-const getCategoryControlMapping = (data) => {
-    const categoryMapping = data.aggregatedResults.results.reduce((acc, curr) => {
-        const { numPassing, numFailing } = curr;
-        const [category, control] = curr.keys;
-        if (acc[category.id]) {
-            acc[category.id].controls = [
-                ...acc[category.id].controls,
-                { control, numPassing, numFailing },
-            ];
-        } else {
-            acc[category.id] = {
-                category,
-                controls: [{ control, numPassing, numFailing }],
-            };
-        }
-        return acc;
-    }, {});
-    return categoryMapping;
-};
-
-const getColor = (numPassing, numFailing) => {
-    if (!numPassing && !numFailing) {
-        return NAColor;
-    }
-    if (!numFailing) {
-        return passingColor;
-    }
-    return failingColor;
-};
-
-const getSunburstData = (categoryMapping, urlBuilder, searchParam, standardType) => {
-    const categories = Object.keys(categoryMapping);
-    const data = categories.map((categoryId) => {
-        const { category, controls } = categoryMapping[categoryId];
-        const { totalPassing, totalFailing } = controls.reduce(
-            (acc, curr) => {
-                acc.totalPassing += curr.numPassing;
-                acc.totalFailing += curr.numFailing;
-                return acc;
-            },
-            { totalPassing: 0, totalFailing: 0 }
-        );
-        const categoryValue = getPercentagePassing(totalPassing, totalFailing);
-        return {
-            name: `${category.name}. ${category.description}`,
-            color: getColor(totalPassing, totalFailing),
-            value: categoryValue,
-            children: controls.map(({ control, numPassing, numFailing }) => {
-                const value = getPercentagePassing(numPassing, numFailing);
-                const link = urlBuilder
-                    .base(entityTypes.CONTROL)
-                    .push(control.id)
-                    .query({
-                        [searchParam]: {
-                            standard: standardLabels[standardType],
-                            'Compliance State': undefined,
-                        },
-                    })
-                    .url();
-                return {
-                    name: `${control.name} - ${control.description}`,
-                    color: getColor(numPassing, numFailing),
-                    value,
-                    link,
-                };
-            }),
-        };
-    });
-    return data;
-};
-
-const getTotalPassingFailing = (data) => {
-    const result = data.aggregatedResults.results.reduce(
-        (acc, curr) => {
-            const { numPassing, numFailing } = curr;
-            const value = getPercentagePassing(numPassing, numFailing);
-            if (value === 100) {
-                acc.controlsPassing += 1;
-            } else if (!numPassing && !numFailing) {
-                acc.controlsNA += 1;
-            } else {
-                acc.controlsFailing += 1;
-            }
-            return acc;
-        },
-        { controlsPassing: 0, controlsFailing: 0, controlsNA: 0 }
-    );
-    return result;
-};
-
-const getSunburstRootData = (
-    controlsPassing,
-    controlsFailing,
-    controlsNA,
-    urlBuilder,
-    standardType,
-    searchParam
-) => {
-    const controlsPassingLink = urlBuilder
-        .base(entityTypes.CONTROL)
-        .query({
-            [searchParam]: {
-                standard: standardLabels[standardType],
-                'Compliance State': COMPLIANCE_STATES.PASS,
-            },
-        })
-        .url();
-
-    const controlsFailingLink = urlBuilder
-        .base(entityTypes.CONTROL)
-        .query({
-            [searchParam]: {
-                standard: standardLabels[standardType],
-                'Compliance State': COMPLIANCE_STATES.FAIL,
-            },
-        })
-        .url();
-
-    const controlsNALink = urlBuilder
-        .base(entityTypes.CONTROL)
-        .query({
-            [searchParam]: {
-                standard: standardLabels[standardType],
-                'Compliance State': COMPLIANCE_STATES['N/A'],
-            },
-        })
-        .url();
-
-    const sunburstRootData = [
-        {
-            text: `${controlsPassing} Controls Passing`,
-            link: controlsPassingLink,
-        },
-        {
-            text: `${controlsFailing} Controls Failing`,
-            link: controlsFailingLink,
-        },
-        {
-            text: `${controlsNA} Controls N/A`,
-            link: controlsNALink,
-        },
-    ];
-    return sunburstRootData;
-};
-
-const getSunburstProps = (data, urlBuilder, standardType, searchParam) => {
-    const categoryMapping = getCategoryControlMapping(data);
-    const { controlsPassing, controlsFailing, controlsNA } = getTotalPassingFailing(data);
-    const sunburstRootData = getSunburstRootData(
-        controlsPassing,
-        controlsFailing,
-        controlsNA,
-        urlBuilder,
-        standardType,
-        searchParam
-    );
-    const sunburstData = getSunburstData(categoryMapping, urlBuilder, searchParam, standardType);
-    return {
-        sunburstData,
-        sunburstRootData,
-        totalPassing: getPercentagePassing(controlsPassing, controlsFailing),
-    };
-};
-
-const ViewStandardButton = ({ standardType, searchParam, urlBuilder }) => {
-    const linkTo = urlBuilder
-        .base(entityTypes.CONTROL)
-        .query({
-            [searchParam]: {
-                standard: standardLabels[standardType],
-                groupBy: entityTypes.CATEGORY,
-            },
-        })
-        .url();
-
-    return (
-        <Link to={linkTo} className="no-underline btn-sm btn-base">
-            View standard
-        </Link>
-    );
-};
-
-const queriesToRefetchOnPollingComplete = [QUERY];
-
-const ComplianceByControls = ({ className, standardOptions }) => {
-    const { hasReadWriteAccess } = usePermissions();
-    const hasWriteAccessForCompliance = hasReadWriteAccess('Compliance');
-
-    const { runs, error, restartPolling, inProgressScanDetected, isCurrentScanIncomplete } =
-        useComplianceRunStatuses(queriesToRefetchOnPollingComplete);
-
-    const searchParam = useContext(searchContext);
-    const options = standardOptions.map((standard) => ({
-        label: standardLabels[standard],
-        jsonpath: standardLabels[standard],
-        value: standardLabels[standard],
-        standard,
-    }));
-    const [selectedStandard, selectStandard] = useState(options[0]);
-
-    const location = useLocation();
-    const match = useWorkflowMatch();
-
-    function onChange(datum) {
-        const standard = options.find((option) => option.value === datum);
-        selectStandard(standard);
-    }
-
-    const variables = {
-        groupBy: [standardEntityTypes.CATEGORY, standardEntityTypes.CONTROL],
-        unit: standardEntityTypes.CONTROL,
-        where: queryService.objectToWhereClause({ Standard: selectedStandard.value }),
-    };
-
-    return (
-        <Query query={QUERY} variables={variables}>
-            {({ data, networkStatus }) => {
-                const titleComponents = (
-                    <TextSelect
-                        value={selectedStandard.value}
-                        onChange={onChange}
-                        options={options}
-                    />
-                );
-
-                const headerComponents = (
-                    <div className="flex">
-                        {hasWriteAccessForCompliance && (
-                            <ScanButton
-                                key={selectedStandard.standard}
-                                className="btn-sm btn-base mr-2"
-                                text="Scan"
-                                textClass="hidden lg:block"
-                                textCondensed={`Scan ${
-                                    standardBaseTypes[selectedStandard.standard]
-                                }`}
-                                clusterId="*"
-                                standardId={selectedStandard.standard}
-                                loaderSize={10}
-                                onScanTriggered={restartPolling}
-                                scanInProgress={isCurrentScanIncomplete}
-                            />
-                        )}
-                        <ViewStandardButton
-                            urlBuilder={URLService.getURL(match, location)}
-                            standardType={selectedStandard.standard}
-                            searchParam={searchParam}
-                        />
-                    </div>
-                );
-                let contents = <Loader />;
-                if (data && networkStatus === networkStatuses.READY) {
-                    if (data.aggregatedResults.results.length) {
-                        const { sunburstData, sunburstRootData, totalPassing } = getSunburstProps(
-                            data,
-                            URLService.getURL(match, location),
-                            selectedStandard.standard,
-                            searchParam
-                        );
-                        contents = (
-                            <Sunburst
-                                data={sunburstData}
-                                rootData={sunburstRootData}
-                                legendData={sunburstLegendData}
-                                totalValue={totalPassing}
-                                key={selectedStandard.value}
-                            />
-                        );
-                    } else {
-                        contents = (
-                            <NoResultsMessage message="No data available. Please run a scan." />
-                        );
-                    }
-                }
-
-                if (isCurrentScanIncomplete) {
-                    contents = (
-                        <div className="flex-1">
-                            {error && (
-                                <Alert
-                                    variant="danger"
-                                    title="There was an error fetching compliance scan status, data below may be out of date"
-                                    component="p"
-                                >
-                                    {getAxiosErrorMessage(error)}
-                                </Alert>
-                            )}
-                            {inProgressScanDetected && !error && (
-                                <ComplianceScanProgress runs={runs} isFullHeight />
-                            )}
-                        </div>
-                    );
-                }
-                return (
-                    <Widget
-                        className={`s-2 ${className}`}
-                        id="compliance-by-controls"
-                        titleComponents={titleComponents}
-                        headerComponents={headerComponents}
-                    >
-                        {contents}
-                    </Widget>
-                );
-            }}
-        </Query>
-    );
-};
-
-ComplianceByControls.propTypes = {
-    className: PropTypes.string,
-    standardOptions: PropTypes.arrayOf(PropTypes.shape).isRequired,
-};
-
-ComplianceByControls.defaultProps = {
-    className: '',
-};
-
-export default ComplianceByControls;
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Entity.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Entity.jsx
index 9ca92c9a6e666..fbf0be763a934 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/Entity.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/Entity.jsx
@@ -9,7 +9,6 @@ import queryService from 'utils/queryService';
 
 import { getConfigMgmtDefaultSort } from './ConfigMgmt.utils';
 import ConfigManagementEntityCluster from './Entity/ConfigManagementEntityCluster';
-import ConfigManagementEntityControl from './Entity/ConfigManagementEntityControl';
 import ConfigManagementEntityDeployment from './Entity/Deployment/ConfigManagementEntityDeployment';
 import ConfigManagementEntityImage from './Entity/ConfigManagementEntityImage';
 import ConfigManagementEntityNamespace from './Entity/ConfigManagementEntityNamespace';
@@ -22,7 +21,6 @@ import ConfigManagementEntitySubject from './Entity/ConfigManagementEntitySubjec
 
 const entityComponentMap = {
     CLUSTER: ConfigManagementEntityCluster,
-    CONTROL: ConfigManagementEntityControl,
     DEPLOYMENT: ConfigManagementEntityDeployment,
     IMAGE: ConfigManagementEntityImage,
     NAMESPACE: ConfigManagementEntityNamespace,
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityCluster.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityCluster.jsx
index 85ce63540f0dc..96f32b3d16888 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityCluster.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityCluster.jsx
@@ -16,8 +16,6 @@ import queryService from 'utils/queryService';
 
 import { getConfigMgmtCountQuery } from '../ConfigMgmt.utils';
 import EntityList from '../List/EntityList';
-import getControlsWithStatus from '../List/utilities/getControlsWithStatus';
-import NodesWithFailedControls from './widgets/NodesWithFailedControls';
 import DeploymentsWithFailedPolicies from './widgets/DeploymentsWithFailedPolicies';
 import getSubListFromEntity from './getSubListFromEntity';
 
@@ -36,9 +34,6 @@ const ConfigManagementEntityCluster = ({
     if (entityListType === 'POLICY') {
         queryObject['Lifecycle Stage'] = 'DEPLOY';
     }
-    if (!queryObject.Standard && entityListType === 'CONTROL') {
-        queryObject.Standard = 'CIS';
-    }
 
     const variables = {
         id,
@@ -62,11 +57,6 @@ const ConfigManagementEntityCluster = ({
                 secretCount
                 policyCount(query: "Lifecycle Stage:DEPLOY")
                 serviceAccountCount
-                complianceControlCount(query: "Standard:CIS") {
-                    passingCount
-                    failingCount
-                    unknownCount
-                }
                 status {
                     orchestratorMetadata {
                         version
@@ -87,14 +77,8 @@ const ConfigManagementEntityCluster = ({
             'configmanagement'
         );
         const countQuery = getConfigMgmtCountQuery(entityListType);
-        const availableVars =
-            entityListType === 'CONTROL'
-                ? '$id: ID!, $query: String'
-                : '$id: ID!, $query: String, $pagination: Pagination';
-        const listQueryVars =
-            entityListType === 'CONTROL'
-                ? 'query: $query'
-                : 'query: $query, pagination: $pagination';
+        const availableVars = '$id: ID!, $query: String, $pagination: Pagination';
+        const listQueryVars = 'query: $query, pagination: $pagination';
 
         return gql`
             query getCluster_${entityListType}(${availableVars}) {
@@ -119,13 +103,9 @@ const ConfigManagementEntityCluster = ({
                     return <PageNotFound resourceType="CLUSTER" useCase="configmanagement" />;
                 }
 
-                const { complianceResults = [] } = entity;
-
                 if (entityListType) {
                     let listData = getSubListFromEntity(entity, entityListType);
-                    if (entityListType === 'CONTROL') {
-                        listData = getControlsWithStatus(complianceResults);
-                    } else if (entityListType === 'SUBJECT') {
+                    if (entityListType === 'SUBJECT') {
                         listData = listData.map((listItem) => {
                             return {
                                 ...listItem,
@@ -159,7 +139,6 @@ const ConfigManagementEntityCluster = ({
                     k8sRoleCount,
                     secretCount,
                     imageCount,
-                    complianceControlCount,
                     status: { orchestratorMetadata = null },
                 } = entity;
 
@@ -172,9 +151,6 @@ const ConfigManagementEntityCluster = ({
                     },
                 ];
 
-                const { passingCount, failingCount, unknownCount } = complianceControlCount;
-                const totalControlCount = passingCount + failingCount + unknownCount;
-
                 return (
                     <div className="w-full">
                         <CollapsibleSection title="Cluster Summary">
@@ -231,12 +207,6 @@ const ConfigManagementEntityCluster = ({
                                     value={k8sRoleCount}
                                     entityType="ROLE"
                                 />
-                                <RelatedEntityListCount
-                                    className="mx-4 min-w-48 min-h-48 mb-4"
-                                    name="CIS Controls"
-                                    value={totalControlCount}
-                                    entityType="CONTROL"
-                                />
                             </div>
                         </CollapsibleSection>
                         <CollapsibleSection title="Cluster Findings">
@@ -254,15 +224,6 @@ const ConfigManagementEntityCluster = ({
                                             }}
                                         />
                                     </Tab>
-                                    <Tab title="CIS Controls">
-                                        <NodesWithFailedControls
-                                            entityType="CLUSTER"
-                                            entityContext={{
-                                                ...entityContext,
-                                                CLUSTER: id,
-                                            }}
-                                        />
-                                    </Tab>
                                 </BinderTabs>
                             </div>
                         </CollapsibleSection>
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityControl.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityControl.jsx
deleted file mode 100644
index f94b9fb317f9b..0000000000000
--- a/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityControl.jsx
+++ /dev/null
@@ -1,142 +0,0 @@
-import { useContext } from 'react';
-import { useLocation } from 'react-router-dom-v5-compat';
-import { gql } from '@apollo/client';
-import queryService from 'utils/queryService';
-import Query from 'Components/ThrowingQuery';
-import Loader from 'Components/Loader';
-import PageNotFound from 'Components/PageNotFound';
-import CollapsibleSection from 'Components/CollapsibleSection';
-import ControlDetails from 'Components/ControlDetails';
-import RelatedEntityListCount from 'Components/RelatedEntityListCount';
-import useWorkflowMatch from 'hooks/useWorkflowMatch';
-import isGQLLoading from 'utils/gqlLoading';
-import Widget from 'Components/Widget';
-import searchContext from 'Containers/searchContext';
-import { entityComponentDefaultProps, entityComponentPropTypes } from 'constants/entityPageProps';
-import NodesWithFailedControls from './widgets/NodesWithFailedControls';
-import ConfigManagementListNodes from '../List/ConfigManagementListNodes';
-
-const QUERY = gql`
-    query getControl($id: ID!, $where: String) {
-        results: complianceControl(id: $id) {
-            interpretationText
-            description
-            id
-            name
-            standardId
-            complianceControlNodes {
-                name
-                clusterName
-                id
-                clusterId
-                osImage
-                containerRuntimeVersion
-                joinedAt
-                nodeComplianceControlCount(query: $where) {
-                    failingCount
-                    passingCount
-                    unknownCount
-                }
-            }
-        }
-    }
-`;
-
-const ConfigManagementEntityControl = ({ id, entityListType, query, entityContext }) => {
-    const location = useLocation();
-    const match = useWorkflowMatch();
-    const searchParam = useContext(searchContext);
-
-    const variables = {
-        id,
-        where: queryService.objectToWhereClause({
-            ...query[searchParam],
-            'Control Id': id,
-        }),
-    };
-
-    return (
-        <Query query={QUERY} variables={variables} fetchPolicy="network-only">
-            {({ loading, data }) => {
-                if (isGQLLoading(loading, data)) {
-                    return <Loader />;
-                }
-
-                if (!data || !data.results) {
-                    return <PageNotFound resourceType="CONTROL" useCase="configmanagement" />;
-                }
-
-                const { results: entity } = data;
-                const { complianceControlNodes } = entity;
-
-                if (entityListType) {
-                    return (
-                        <ConfigManagementListNodes
-                            match={match}
-                            location={location}
-                            data={complianceControlNodes}
-                            totalResults={complianceControlNodes?.length}
-                            entityContext={{ ...entityContext, CONTROL: id }}
-                        />
-                    );
-                }
-
-                const {
-                    standardId = '',
-                    name = '',
-                    description = '',
-                    interpretationText = '',
-                } = entity;
-
-                return (
-                    <div className="w-full">
-                        <CollapsibleSection title="Control Summary">
-                            <div className="flex flex-wrap">
-                                <ControlDetails
-                                    standardId={standardId}
-                                    control={name}
-                                    description={description}
-                                    className="mx-4 min-w-48 min-h-48 mb-4"
-                                />
-                                {!!interpretationText.length && (
-                                    <Widget
-                                        className="mx-4 min-w-48 min-h-48 mb-4 w-1/3 overflow-auto"
-                                        header="Control guidance"
-                                    >
-                                        <div className="p-4 leading-loose whitespace-pre-wrap overflow-auto">
-                                            {interpretationText}
-                                        </div>
-                                    </Widget>
-                                )}
-                                <RelatedEntityListCount
-                                    className="mx-4 min-w-48 min-h-48 mb-4"
-                                    name="Nodes"
-                                    value={complianceControlNodes.length}
-                                    entityType="NODE"
-                                />
-                            </div>
-                        </CollapsibleSection>
-                        {!(entityContext && entityContext.NODE) && (
-                            <CollapsibleSection title="Control Findings">
-                                <div className="flex shadow relative rounded bg-base-100 mb-4 ml-4 mr-4">
-                                    <NodesWithFailedControls
-                                        entityType="CONTROL"
-                                        entityContext={{
-                                            ...entityContext,
-                                            CONTROL: id,
-                                        }}
-                                    />
-                                </div>
-                            </CollapsibleSection>
-                        )}
-                    </div>
-                );
-            }}
-        </Query>
-    );
-};
-
-ConfigManagementEntityControl.propTypes = entityComponentPropTypes;
-ConfigManagementEntityControl.defaultProps = entityComponentDefaultProps;
-
-export default ConfigManagementEntityControl;
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityNode.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityNode.jsx
index 83819ddd29e1f..517c5e925568b 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityNode.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/Entity/ConfigManagementEntityNode.jsx
@@ -1,27 +1,16 @@
-import { useContext } from 'react';
 import { gql } from '@apollo/client';
 
-import NoResultsMessage from 'Components/NoResultsMessage';
 import Query from 'Components/ThrowingQuery';
 import Loader from 'Components/Loader';
 import PageNotFound from 'Components/PageNotFound';
 import CollapsibleSection from 'Components/CollapsibleSection';
 import RelatedEntity from 'Components/RelatedEntity';
-import RelatedEntityListCount from 'Components/RelatedEntityListCount';
 import Metadata from 'Components/Metadata';
-import { defaultColumnClassName, defaultHeaderClassName } from 'Components/Table';
 import { entityComponentDefaultProps, entityComponentPropTypes } from 'constants/entityPageProps';
-import searchContext from 'Containers/searchContext';
-import { standardLabels } from 'messages/standards';
-import { CONTROL_FRAGMENT } from 'queries/controls';
-import { sortVersion } from 'sorters/sorters';
 import { getDateTime } from 'utils/dateUtils';
 import isGQLLoading from 'utils/gqlLoading';
-import queryService from 'utils/queryService';
 
 import EntityList from '../List/EntityList';
-import getControlsWithStatus from '../List/utilities/getControlsWithStatus';
-import TableWidget from './widgets/TableWidget';
 
 const ConfigManagementEntityNode = ({
     id,
@@ -31,21 +20,13 @@ const ConfigManagementEntityNode = ({
     entityContext,
     pagination,
 }) => {
-    const searchParam = useContext(searchContext);
-
-    const queryObject = { ...query[searchParam] };
-    if (!queryObject.Standard) {
-        queryObject.Standard = 'CIS';
-    }
-
     const variables = {
         id,
-        query: queryService.getEntityWhereClause(queryObject),
         pagination,
     };
 
     const QUERY = gql`
-        query getNode($id: ID!, $query: String) {
+        query getNode($id: ID!) {
             node(id: $id) {
                 id
                 name
@@ -66,12 +47,8 @@ const ConfigManagementEntityNode = ({
                     key
                     value
                 }
-                complianceResults(query: $query) {
-                    ...controlFields
-                }
             }
         }
-        ${CONTROL_FRAGMENT}
     `;
 
     return (
@@ -95,7 +72,6 @@ const ConfigManagementEntityNode = ({
                     clusterName,
                     clusterId,
                     annotations,
-                    complianceResults = [],
                 } = node;
 
                 const metadataKeyValuePairs = [
@@ -126,44 +102,13 @@ const ConfigManagementEntityNode = ({
                         <EntityList
                             entityListType={entityListType}
                             entityId={entityId1}
-                            data={getControlsWithStatus(complianceResults)}
+                            data={[]}
                             query={query}
                             entityContext={{ ...entityContext, NODE: id }}
                         />
                     );
                 }
 
-                const failedComplianceResults = complianceResults
-                    .filter((cr) => cr.value.overallState === 'COMPLIANCE_STATE_FAILURE')
-                    .map((cr) => ({
-                        ...cr,
-                        standard: standardLabels[cr.control.standardId],
-                        controlName: `${cr.control.name} - ${cr.control.description}`,
-                    }));
-
-                const controlColumns = [
-                    {
-                        accessor: 'id',
-                        Header: 'id',
-                        headerClassName: 'hidden',
-                        className: 'hidden',
-                    },
-                    {
-                        accessor: 'standard',
-                        sortMethod: sortVersion,
-                        Header: 'Standard',
-                        headerClassName: `w-1/5 ${defaultHeaderClassName}`,
-                        className: `w-1/5 ${defaultColumnClassName}`,
-                    },
-                    {
-                        accessor: 'controlName',
-                        sortMethod: sortVersion,
-                        Header: 'Control',
-                        headerClassName: `w-1/2 ${defaultHeaderClassName}`,
-                        className: `w-1/2 ${defaultColumnClassName}`,
-                    },
-                ];
-
                 return (
                     <div className="w-full">
                         <CollapsibleSection title="Node Summary">
@@ -183,48 +128,8 @@ const ConfigManagementEntityNode = ({
                                         entityId={clusterId}
                                     />
                                 )}
-                                <RelatedEntityListCount
-                                    className="mx-4 min-w-48 min-h-48 mb-4"
-                                    name="CIS Controls"
-                                    value={complianceResults.length}
-                                    entityType="CONTROL"
-                                />
                             </div>
                         </CollapsibleSection>
-                        {!(entityContext && entityContext.CONTROL) && (
-                            <CollapsibleSection title="Node Findings">
-                                <div className="flex shadow relative rounded bg-base-100 mb-4 ml-4 mr-4">
-                                    {failedComplianceResults.length === 0 && (
-                                        <NoResultsMessage
-                                            message="No nodes failing controls on this node"
-                                            className="p-3 shadow"
-                                            icon="info"
-                                        />
-                                    )}
-                                    {failedComplianceResults.length > 0 && (
-                                        <TableWidget
-                                            entityType="CONTROL"
-                                            header={`${failedComplianceResults.length} controls failed across this node`}
-                                            rows={failedComplianceResults}
-                                            noDataText="No Controls"
-                                            className="bg-base-100"
-                                            columns={controlColumns}
-                                            idAttribute="control.id"
-                                            defaultSorted={[
-                                                {
-                                                    id: 'standard',
-                                                    desc: false,
-                                                },
-                                                {
-                                                    id: 'controlName',
-                                                    desc: false,
-                                                },
-                                            ]}
-                                        />
-                                    )}
-                                </div>
-                            </CollapsibleSection>
-                        )}
                     </div>
                 );
             }}
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Entity/EntityTabs.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Entity/EntityTabs.jsx
index fd6666313d9b8..ee2419a293a43 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/Entity/EntityTabs.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/Entity/EntityTabs.jsx
@@ -10,7 +10,7 @@ import entityTabsMap from '../entityTabRelationships';
 
 const TAB_GROUPS = {
     OVERVIEW: 'Overview',
-    POLICIES: 'Policies & CIS Controls',
+    POLICIES: 'Policies',
     VIOLATIONS_AND_FINDINGS: 'Violations & Findings',
     APPLICATION_RESOURCES: 'Application & Infrastructure Resources',
     RBAC_CONFIG: 'Role-Based Access Control',
@@ -35,7 +35,6 @@ const ENTITY_TO_TAB = {
     [entityTypes.COMPONENT]: TAB_GROUPS.APPLICATION_RESOURCES,
 
     [entityTypes.POLICY]: TAB_GROUPS.POLICIES,
-    [entityTypes.CONTROL]: TAB_GROUPS.POLICIES,
 };
 
 const EntityTabs = ({ entityType, entityListType, pageEntityId }) => {
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/Entity/widgets/NodesWithFailedControls.jsx b/ui/apps/platform/src/Containers/ConfigManagement/Entity/widgets/NodesWithFailedControls.jsx
deleted file mode 100644
index 36cd7cb21c6cf..0000000000000
--- a/ui/apps/platform/src/Containers/ConfigManagement/Entity/widgets/NodesWithFailedControls.jsx
+++ /dev/null
@@ -1,145 +0,0 @@
-import PropTypes from 'prop-types';
-import entityTypes from 'constants/entityTypes';
-import NoResultsMessage from 'Components/NoResultsMessage';
-import { gql, useQuery } from '@apollo/client';
-import Raven from 'raven-js';
-import queryService from 'utils/queryService';
-import { entityAcrossControlsColumns } from 'constants/listColumns';
-import uniqBy from 'lodash/uniqBy';
-
-import Loader from 'Components/Loader';
-import TableWidget from './TableWidget';
-
-const NODES_WITH_FAILING_CONTROLS = gql`
-    query nodesWithFailingControls($query: String) {
-        executedControls(query: $query) {
-            complianceControl {
-                id
-                name
-                complianceControlFailingNodes {
-                    id
-                    name
-                    clusterName
-                }
-                complianceControlPassingNodes {
-                    id
-                    name
-                    clusterName
-                }
-            }
-            controlStatus
-        }
-    }
-`;
-
-const filterByEntityContext = (entityContext) => {
-    const result = Object.keys(entityContext).reduce((acc, entityType) => {
-        const entityId = entityContext[entityType];
-        acc[`${entityType} Id`] = entityId;
-        return acc;
-    }, {});
-    return queryService.objectToWhereClause(result);
-};
-
-const getFailingNodes = (executedControls) => {
-    const failingNodes = executedControls.reduce((acc, curr) => {
-        return [...acc, ...curr.complianceControl.complianceControlFailingNodes];
-    }, []);
-    return uniqBy(failingNodes, 'id').map((node) => ({ ...node, passing: false }));
-};
-
-const getPassingNodes = (executedControls) => {
-    const passingNodes = executedControls.reduce((acc, curr) => {
-        return [...acc, ...curr.complianceControl.complianceControlPassingNodes];
-    }, []);
-    return uniqBy(passingNodes, 'id').map((node) => ({ ...node, passing: true }));
-};
-
-const NodesWithFailedControls = (props) => {
-    const { entityType, entityContext } = props;
-    const { loading, error, data } = useQuery(NODES_WITH_FAILING_CONTROLS, {
-        variables: {
-            query: filterByEntityContext(entityContext),
-        },
-        fetchPolicy: 'no-cache',
-    });
-    if (loading) {
-        return (
-            <div className="flex flex-1 items-center justify-center p-6">
-                <Loader />
-            </div>
-        );
-    }
-    if (error) {
-        Raven.captureException(error);
-    }
-    if (!data) {
-        return null;
-    }
-    const { executedControls = [] } = data;
-    if (executedControls.length === 0) {
-        return (
-            <NoResultsMessage
-                message={`No nodes failing ${
-                    entityType === entityTypes.CONTROL ? 'this control' : 'any controls'
-                }`}
-                className="p-6"
-                icon="info"
-            />
-        );
-    }
-
-    const failingNodes = getFailingNodes(executedControls);
-    const passingNodes = getPassingNodes(executedControls);
-    const numFailing = failingNodes.length;
-    const numPassing = passingNodes.length;
-    if (numPassing && !numFailing) {
-        return (
-            <NoResultsMessage
-                message={`No nodes failing ${
-                    entityType === entityTypes.CONTROL ? 'this control' : 'any controls'
-                }`}
-                className="p-3 shadow"
-                icon="info"
-            />
-        );
-    }
-    if (!numPassing && !numFailing) {
-        return (
-            <NoResultsMessage
-                message={`Findings ${
-                    entityContext[entityTypes.CONTROL] ? 'for this control' : 'across controls'
-                } could not be assessed`}
-                className="p-3 shadow"
-                icon="warn"
-            />
-        );
-    }
-    const tableHeader = `${numFailing} ${numFailing === 1 ? 'node is' : 'nodes are'} ${
-        entityType === entityTypes.CONTROL ? 'failing this control' : 'failing controls'
-    }`;
-    return (
-        <TableWidget
-            entityType={entityTypes.NODE}
-            header={tableHeader}
-            rows={failingNodes}
-            noDataText="No Nodes"
-            className="bg-base-100 w-full"
-            columns={entityAcrossControlsColumns[entityTypes.NODE]}
-            idAttribute="id"
-            defaultSorted={[
-                {
-                    id: 'name',
-                    desc: false,
-                },
-            ]}
-        />
-    );
-};
-
-NodesWithFailedControls.propTypes = {
-    entityType: PropTypes.string.isRequired,
-    entityContext: PropTypes.shape({}).isRequired,
-};
-
-export default NodesWithFailedControls;
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListClusters.jsx b/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListClusters.jsx
index bac9c7a4a5d30..503b86e558696 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListClusters.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListClusters.jsx
@@ -33,11 +33,6 @@ const CLUSTERS_QUERY = gql`
                     version
                 }
             }
-            complianceControlCount(query: "Standard:CIS") {
-                passingCount
-                failingCount
-                unknownCount
-            }
             policyStatus {
                 status
                 failingPolicies {
@@ -98,27 +93,6 @@ const buildTableColumns = (match, location) => {
             accessor: (d) => d.policyStatus.status,
             sortable: false,
         },
-        {
-            Header: `CIS Controls`,
-            headerClassName: `w-1/8 ${nonSortableHeaderClassName}`,
-            className: `w-1/8 ${defaultColumnClassName}`,
-            accessor: 'complianceControlCount',
-            Cell: ({ original }) => {
-                const { complianceControlCount } = original;
-                const { passingCount, failingCount, unknownCount } = complianceControlCount;
-                const totalCount = passingCount + failingCount + unknownCount;
-                if (!totalCount) {
-                    return <NoEntitiesIconText text="No Controls" />;
-                }
-                const url = URLService.getURL(match, location)
-                    .push(original.id)
-                    .push('CONTROL')
-                    .url();
-                const text = `${totalCount} ${pluralize('Controls', totalCount)}`;
-                return <TableCellLink url={url}>{text}</TableCellLink>;
-            },
-            sortable: false,
-        },
         {
             Header: `Users & Groups`,
             headerClassName: `w-1/8 ${nonSortableHeaderClassName}`,
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListControls.jsx b/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListControls.jsx
deleted file mode 100644
index 1d4ff3870eefc..0000000000000
--- a/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListControls.jsx
+++ /dev/null
@@ -1,181 +0,0 @@
-import { useContext } from 'react';
-import capitalize from 'lodash/capitalize';
-
-import NotApplicableIconText from 'Components/PatternFly/IconText/NotApplicableIconText';
-import PolicyStatusIconText from 'Components/PatternFly/IconText/PolicyStatusIconText';
-import { defaultColumnClassName, defaultHeaderClassName } from 'Components/Table';
-import TableCellLink from 'Components/TableCellLink';
-import searchContext from 'Containers/searchContext';
-import COMPLIANCE_STATES from 'constants/complianceStates';
-import { entityListDefaultprops, entityListPropTypes } from 'constants/entityPageProps';
-import { CLIENT_SIDE_SEARCH_OPTIONS as SEARCH_OPTIONS } from 'constants/searchOptions';
-import { standardLabels } from 'messages/standards';
-import { LIST_STANDARD_NO_NODES as QUERY } from 'queries/standard';
-import { sortStatus, sortVersion } from 'sorters/sorters';
-import queryService from 'utils/queryService';
-import { getConfigMgmtPathForEntitiesAndId } from '../entities';
-import ListFrontendPaginated from './ListFrontendPaginated';
-
-const tableColumns = [
-    {
-        Header: 'Id',
-        headerClassName: 'hidden',
-        className: 'hidden',
-        accessor: 'id',
-    },
-    {
-        Header: `Standard`,
-        headerClassName: `w-1/8 ${defaultHeaderClassName}`,
-        className: `w-1/8 ${defaultColumnClassName}`,
-        accessor: 'standard',
-    },
-    {
-        Header: `Control`,
-        headerClassName: `w-1/2 ${defaultHeaderClassName}`,
-        className: `w-1/2 ${defaultColumnClassName}`,
-        Cell: ({ original }) => {
-            const url = getConfigMgmtPathForEntitiesAndId('CONTROL', original.id);
-            return <TableCellLink url={url}>{original.control}</TableCellLink>;
-        },
-        accessor: 'control',
-        sortMethod: sortVersion,
-    },
-    {
-        Header: `Control Status`,
-        headerClassName: `w-1/8 ${defaultHeaderClassName}`,
-        className: `w-1/8 ${defaultColumnClassName} capitalize`,
-        Cell: ({ original }) => {
-            if (original.status === COMPLIANCE_STATES['N/A']) {
-                return <NotApplicableIconText />;
-            }
-            return <PolicyStatusIconText isPass={original.status === 'Pass'} />;
-        },
-        accessor: 'status',
-        sortMethod: sortStatus,
-    },
-];
-
-const filterByComplianceState = (rows, state) => {
-    if (!state || !rows) {
-        return rows;
-    }
-    const complianceState = capitalize(state);
-    const filteredRows = rows.filter((row) => {
-        if (complianceState === COMPLIANCE_STATES.PASS) {
-            return row.status === COMPLIANCE_STATES.PASS;
-        }
-        if (complianceState === COMPLIANCE_STATES.FAIL) {
-            return row.status === COMPLIANCE_STATES.FAIL;
-        }
-        return row.status === COMPLIANCE_STATES['N/A'];
-    });
-    return filteredRows;
-};
-
-const createTableRows = (data) => {
-    if (!data || !data.results || !data.results.results.length) {
-        return [];
-    }
-
-    let standardKeyIndex = 0;
-    let controlKeyIndex = 0;
-    data.results.results[0].aggregationKeys.forEach(({ scope }, idx) => {
-        if (scope === 'STANDARD') {
-            standardKeyIndex = idx;
-        }
-        if (scope === 'CONTROL') {
-            controlKeyIndex = idx;
-        }
-    });
-    const controls = {};
-    data.results.results.forEach(({ keys, numFailing, numPassing }) => {
-        if (!keys[controlKeyIndex]) {
-            return;
-        }
-        const controlId = keys[controlKeyIndex].id;
-        if (controls[controlId]) {
-            const { status } = controls[controlId];
-            if (status === COMPLIANCE_STATES.FAIL || numFailing) {
-                controls[controlId].status = COMPLIANCE_STATES.FAIL;
-            }
-        } else {
-            let status = '';
-            if (!numPassing) {
-                status = COMPLIANCE_STATES.FAIL;
-            }
-            if (!numFailing) {
-                status = COMPLIANCE_STATES.PASS;
-            }
-            if (!numPassing && !numFailing) {
-                status = COMPLIANCE_STATES['N/A'];
-            }
-            controls[controlId] = {
-                id: controlId,
-                standard: standardLabels[keys[standardKeyIndex].id],
-                control: `${keys[controlKeyIndex].name} - ${keys[controlKeyIndex].description}`,
-                status,
-            };
-        }
-    });
-    return Object.values(controls);
-};
-
-const ConfigManagementListControls = ({ className, selectedRowId, onRowClick, query, data }) => {
-    const searchParam = useContext(searchContext);
-    const autoFocusSearchInput = !selectedRowId;
-
-    const { [SEARCH_OPTIONS.COMPLIANCE.STATE]: complianceState, ...restQuery } =
-        queryService.getQueryBasedOnSearchContext(query, searchParam);
-    const queryObject = { ...restQuery };
-    if (!queryObject.Standard) {
-        queryObject.Standard = 'CIS';
-    }
-    const queryText = queryService.objectToWhereClause(queryObject);
-    const variables = {
-        where: queryText,
-        groupBy: ['STANDARD', 'CONTROL'],
-    };
-
-    function createTableRowsFilteredByComplianceState(items) {
-        const tableRows = createTableRows(items);
-        const filteredTableRows = filterByComplianceState(tableRows, complianceState);
-        return filteredTableRows;
-    }
-    return (
-        <ListFrontendPaginated
-            className={className}
-            query={QUERY}
-            variables={variables}
-            headerText="CIS Controls"
-            noDataText="No control results available. Please run a scan."
-            entityType="CONTROL"
-            tableColumns={tableColumns}
-            createTableRows={createTableRowsFilteredByComplianceState}
-            onRowClick={onRowClick}
-            selectedRowId={selectedRowId}
-            idAttribute="id"
-            defaultSorted={[
-                {
-                    id: 'status',
-                    desc: false,
-                },
-                {
-                    id: 'standard',
-                    desc: false,
-                },
-                {
-                    id: 'control',
-                    desc: false,
-                },
-            ]}
-            defaultSearchOptions={[SEARCH_OPTIONS.COMPLIANCE.STATE]}
-            data={filterByComplianceState(data, complianceState)}
-            autoFocusSearchInput={autoFocusSearchInput}
-        />
-    );
-};
-
-ConfigManagementListControls.propTypes = entityListPropTypes;
-ConfigManagementListControls.defaultProps = entityListDefaultprops;
-
-export default ConfigManagementListControls;
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListNodes.jsx b/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListNodes.jsx
index 8790d7c794462..6c77874d3fcfe 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListNodes.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/List/ConfigManagementListNodes.jsx
@@ -1,12 +1,7 @@
 import { useLocation } from 'react-router-dom-v5-compat';
 import { gql } from '@apollo/client';
-import pluralize from 'pluralize';
 
-import {
-    defaultColumnClassName,
-    defaultHeaderClassName,
-    nonSortableHeaderClassName,
-} from 'Components/Table';
+import { defaultColumnClassName, defaultHeaderClassName } from 'Components/Table';
 import TableCellLink from 'Components/TableCellLink';
 import { entityListDefaultprops, entityListPropTypes } from 'constants/entityPageProps';
 import { nodeSortFields } from 'constants/sortFields';
@@ -16,7 +11,6 @@ import queryService from 'utils/queryService';
 import URLService from 'utils/URLService';
 import { getConfigMgmtPathForEntitiesAndId } from '../entities';
 import List from './List';
-import NoEntitiesIconText from './utilities/NoEntitiesIconText';
 
 const QUERY = gql`
     query nodes($query: String, $pagination: Pagination) {
@@ -28,11 +22,6 @@ const QUERY = gql`
             osImage
             containerRuntimeVersion
             joinedAt
-            nodeComplianceControlCount(query: "Standard:CIS") {
-                failingCount
-                passingCount
-                unknownCount
-            }
         }
         count: nodeCount(query: $query)
     }
@@ -114,30 +103,6 @@ const buildTableColumns = (match, location, entityContext) => {
                   id: nodeSortFields.CLUSTER,
                   sortField: nodeSortFields.CLUSTER,
               },
-        entityContext && entityContext.CONTROL
-            ? null
-            : {
-                  Header: `CIS Controls`,
-                  headerClassName: `w-1/8 ${nonSortableHeaderClassName}`,
-                  className: `w-1/8 ${defaultColumnClassName}`,
-                  accessor: 'nodeComplianceControlCount',
-                  Cell: ({ original }) => {
-                      const { nodeComplianceControlCount } = original;
-                      const { passingCount, failingCount, unknownCount } =
-                          nodeComplianceControlCount;
-                      const controlCount = passingCount + failingCount + unknownCount;
-                      if (!controlCount) {
-                          return <NoEntitiesIconText text="No Controls" />;
-                      }
-                      const url = URLService.getURL(match, location)
-                          .push(original.id)
-                          .push('CONTROL')
-                          .url();
-                      const text = `${controlCount} ${pluralize('Controls', controlCount)}`;
-                      return <TableCellLink url={url}>{text}</TableCellLink>;
-                  },
-                  sortable: false,
-              },
     ];
     return tableColumns.filter((col) => col);
 };
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/List/EntityList.jsx b/ui/apps/platform/src/Containers/ConfigManagement/List/EntityList.jsx
index c0d77bc3f293f..94fd369953515 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/List/EntityList.jsx
+++ b/ui/apps/platform/src/Containers/ConfigManagement/List/EntityList.jsx
@@ -3,7 +3,6 @@ import PropTypes from 'prop-types';
 import PageNotFound from 'Components/PageNotFound';
 
 import ConfigManagementListClusters from './ConfigManagementListClusters';
-import ConfigManagementListControls from './ConfigManagementListControls';
 import ConfigManagementListDeployments from './ConfigManagementListDeployments';
 import ConfigManagementListImages from './ConfigManagementListImages';
 import ConfigManagementListNamespaces from './ConfigManagementListNamespaces';
@@ -16,7 +15,6 @@ import ConfigManagementListSubjects from './ConfigManagementListSubjects';
 
 const entityComponentMap = {
     CLUSTER: ConfigManagementListClusters,
-    CONTROL: ConfigManagementListControls,
     DEPLOYMENT: ConfigManagementListDeployments,
     IMAGE: ConfigManagementListImages,
     NAMESPACE: ConfigManagementListNamespaces,
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/List/utilities/getControlsWithStatus.js b/ui/apps/platform/src/Containers/ConfigManagement/List/utilities/getControlsWithStatus.js
deleted file mode 100644
index cd3fa0761203c..0000000000000
--- a/ui/apps/platform/src/Containers/ConfigManagement/List/utilities/getControlsWithStatus.js
+++ /dev/null
@@ -1,30 +0,0 @@
-import { standardLabels } from 'messages/standards';
-import COMPLIANCE_STATES from 'constants/complianceStates';
-
-const getControlStatus = (state) => {
-    let status = null;
-    if (state === 'COMPLIANCE_STATE_FAILURE') {
-        status = COMPLIANCE_STATES.FAIL;
-    } else if (state === 'COMPLIANCE_STATE_SUCCESS') {
-        status = COMPLIANCE_STATES.PASS;
-    } else {
-        status = COMPLIANCE_STATES['N/A'];
-    }
-    return status;
-};
-
-export default function getControlsWithStatus(data) {
-    const controls = {};
-    data.forEach(({ control, value }) => {
-        if (controls[control.id] && controls[control.id].status !== COMPLIANCE_STATES.FAIL) {
-            controls[control.id].status = getControlStatus(value.overallState);
-        } else if (!controls[control.id]) {
-            const controlObj = { ...control };
-            controlObj.standard = standardLabels[control.standardId];
-            controlObj.control = `${control.name} - ${control.description}`;
-            controlObj.status = getControlStatus(value.overallState);
-            controls[control.id] = controlObj;
-        }
-    });
-    return Object.values(controls);
-}
diff --git a/ui/apps/platform/src/Containers/ConfigManagement/entityTabRelationships.ts b/ui/apps/platform/src/Containers/ConfigManagement/entityTabRelationships.ts
index 9b0983733c1d6..a91a87f35ab1e 100644
--- a/ui/apps/platform/src/Containers/ConfigManagement/entityTabRelationships.ts
+++ b/ui/apps/platform/src/Containers/ConfigManagement/entityTabRelationships.ts
@@ -8,7 +8,6 @@ const entityTabsMap: Record<
     ROLE: ['SUBJECT', 'SERVICE_ACCOUNT'],
     SECRET: ['DEPLOYMENT'],
     CLUSTER: [
-        'CONTROL',
         'NODE',
         'SECRET',
         'IMAGE',
@@ -19,9 +18,8 @@ const entityTabsMap: Record<
         'ROLE',
     ],
     NAMESPACE: ['DEPLOYMENT', 'SECRET', 'IMAGE', 'SERVICE_ACCOUNT'],
-    NODE: ['CONTROL'],
+    NODE: [],
     IMAGE: ['DEPLOYMENT'],
-    CONTROL: ['NODE'],
     SUBJECT: ['ROLE'],
     DEPLOYMENT: ['IMAGE', 'SECRET'],
     POLICY: ['DEPLOYMENT'],
diff --git a/ui/apps/platform/src/Containers/Dashboard/DashboardPage.tsx b/ui/apps/platform/src/Containers/Dashboard/DashboardPage.tsx
index 87677dbc1dcaf..af1061ba4470c 100644
--- a/ui/apps/platform/src/Containers/Dashboard/DashboardPage.tsx
+++ b/ui/apps/platform/src/Containers/Dashboard/DashboardPage.tsx
@@ -9,7 +9,6 @@ import {
     Title,
 } from '@patternfly/react-core';
 
-import useFeatureFlags from 'hooks/useFeatureFlags';
 import usePermissions from 'hooks/usePermissions';
 
 import SummaryCounts from './SummaryCounts';
@@ -20,7 +19,6 @@ import ViolationsByPolicyCategory from './Widgets/ViolationsByPolicyCategory';
 import DeploymentsAtMostRisk from './Widgets/DeploymentsAtMostRisk';
 import AgingImages from './Widgets/AgingImages';
 import ViolationsByPolicySeverity from './Widgets/ViolationsByPolicySeverity';
-import ComplianceLevelsByStandard from './Widgets/ComplianceLevelsByStandard';
 
 // This value is an estimate of the minimum size the widgets need to be to
 // ensure the heading and options do not wrap and break layout.
@@ -30,20 +28,12 @@ function DashboardPage() {
     const { hasReadAccess } = usePermissions();
     const hasReadAccessForAlert = hasReadAccess('Alert');
     const hasReadAccessForCluster = hasReadAccess('Cluster');
-    const hasReadAccessForCompliance = hasReadAccess('Compliance');
     const hasReadAccessForDeployment = hasReadAccess('Deployment');
     const hasReadAccessForImage = hasReadAccess('Image');
     const hasReadAccessForNamespace = hasReadAccess('Namespace');
     const hasReadAccessForNode = hasReadAccess('Node');
     const hasReadAccessForSecret = hasReadAccess('Secret');
 
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isDeprecatedComplianceDashboardEnabled = isFeatureFlagEnabled(
-        'ROX_DEPRECATED_COMPLIANCE_DASHBOARD'
-    );
-    const hasComplianceLevelsByStandard =
-        isDeprecatedComplianceDashboardEnabled && hasReadAccessForCompliance;
-
     const hasReadAccessForSummaryCounts =
         hasReadAccessForAlert ||
         hasReadAccessForCluster ||
@@ -110,7 +100,6 @@ function DashboardPage() {
                     {hasReadAccessForDeployment && <DeploymentsAtMostRisk />}
                     {hasReadAccessForImage && <AgingImages />}
                     {hasReadAccessForAlert && <ViolationsByPolicyCategory />}
-                    {hasComplianceLevelsByStandard && <ComplianceLevelsByStandard />}
                 </Gallery>
             </PageSection>
         </>
diff --git a/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandard.cy.jsx b/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandard.cy.jsx
deleted file mode 100644
index 86c25bfddba06..0000000000000
--- a/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandard.cy.jsx
+++ /dev/null
@@ -1,126 +0,0 @@
-import ComponentTestProvider from 'test-utils/ComponentTestProvider';
-import { graphqlUrl } from 'test-utils/apiEndpoints';
-
-import { standardEntityTypes } from 'constants/entityTypes';
-import { complianceBasePath, urlEntityListTypes } from 'routePaths';
-import ComplianceLevelsByStandard from './ComplianceLevelsByStandard';
-
-/*
-These standards have been formatted for easier verification of the expected ordering in
-tests compared to a direct hard coding in the mocked response below.
-
-id: [name, numFailing, numPassing]
-*/
-const standards = {
-    CIS_Kubernetes_v1_5: ['CIS Kubernetes v1.5', 8, 2],
-    HIPAA_164: ['HIPAA 164', 7, 3],
-    NIST_800_190: ['NIST SP 800-190', 6, 4],
-    NIST_SP_800_53_Rev_4: ['NIST SP 800-53', 5, 5],
-    PCI_DSS_3_2: ['PCI DSS 3.2.1', 4, 6],
-    'ocp4-cis': ['ocp4-cis', 3, 7],
-    'ocp4-cis-node': ['ocp4-cis-node', 2, 8],
-};
-
-const mock = {
-    data: {
-        controls: {
-            results: Object.entries(standards).map(([id, [, numFailing, numPassing]]) => ({
-                aggregationKeys: [{ id, scope: 'STANDARD' }],
-                numFailing,
-                numPassing,
-                numSkipped: 0,
-                unit: 'CONTROL',
-            })),
-        },
-        complianceStandards: Object.entries(standards).map(([id, [name]]) => ({
-            id,
-            name,
-        })),
-    },
-};
-
-const setup = () => {
-    cy.intercept('POST', graphqlUrl('getAggregatedResults'), (req) => {
-        req.reply(mock);
-    });
-
-    cy.mount(
-        <ComponentTestProvider>
-            <ComplianceLevelsByStandard />
-        </ComponentTestProvider>
-    );
-};
-
-describe(Cypress.spec.relative, () => {
-    it('should render graph bars correctly order by compliance percentage', () => {
-        setup();
-
-        const standardNames = Object.values(standards).map(([name]) => name);
-        const titlesRegex = new RegExp(`${standardNames.join('|')}`);
-
-        // Default is ascending
-        // Note that we use negative indices here because the order in the DOM (bottom->top) is the opposite from
-        // how that chart is displayed to the user (top->bottom)
-        cy.findAllByText(titlesRegex).eq(-1).should('have.text', 'CIS Kubernetes v1.5');
-        cy.findAllByText(titlesRegex).eq(-2).should('have.text', 'HIPAA 164');
-        cy.findAllByText(titlesRegex).eq(-3).should('have.text', 'NIST SP 800-190');
-        cy.findAllByText(titlesRegex).eq(-4).should('have.text', 'NIST SP 800-53');
-        cy.findAllByText(titlesRegex).eq(-5).should('have.text', 'PCI DSS 3.2.1');
-        cy.findAllByText(titlesRegex).eq(-6).should('have.text', 'ocp4-cis');
-
-        // Sort by descending
-        cy.findByLabelText('Options').click();
-        cy.findByText('Descending').click();
-
-        cy.findAllByText(titlesRegex).eq(-1).should('have.text', 'ocp4-cis-node');
-        cy.findAllByText(titlesRegex).eq(-2).should('have.text', 'ocp4-cis');
-        cy.findAllByText(titlesRegex).eq(-3).should('have.text', 'PCI DSS 3.2.1');
-        cy.findAllByText(titlesRegex).eq(-4).should('have.text', 'NIST SP 800-53');
-        cy.findAllByText(titlesRegex).eq(-5).should('have.text', 'NIST SP 800-190');
-        cy.findAllByText(titlesRegex).eq(-6).should('have.text', 'HIPAA 164');
-    });
-
-    it('should visit the correct pages when widget links are clicked', () => {
-        setup();
-
-        cy.findByText('View all').click();
-        cy.url().should('include', complianceBasePath);
-
-        const standard = 'CIS Kubernetes v1.5';
-        cy.findByText(standard).click();
-        cy.url().should(
-            'include',
-            `${complianceBasePath}/${urlEntityListTypes[standardEntityTypes.CONTROL]}`
-        );
-        cy.url({ decode: true }).should('include', `?s[Cluster]=*&s[standard]=${standard}`);
-    });
-
-    it('should contain a button that resets the widget options to default', () => {
-        setup();
-        cy.findByLabelText('Options').click();
-
-        // Defaults
-        cy.findByRole('button', { name: 'Ascending' }).should('have.attr', 'aria-pressed', 'true');
-        cy.findByRole('button', { name: 'Descending' }).should(
-            'have.attr',
-            'aria-pressed',
-            'false'
-        );
-
-        cy.findByRole('button', { name: 'Descending' }).click();
-
-        cy.findByRole('button', { name: 'Ascending' }).should('have.attr', 'aria-pressed', 'false');
-        cy.findByRole('button', { name: 'Descending' }).should('have.attr', 'aria-pressed', 'true');
-
-        cy.findByLabelText('Revert to default options').click();
-
-        // Check return to defaults
-        cy.findByLabelText('Options').click();
-        cy.findByRole('button', { name: 'Ascending' }).should('have.attr', 'aria-pressed', 'true');
-        cy.findByRole('button', { name: 'Descending' }).should(
-            'have.attr',
-            'aria-pressed',
-            'false'
-        );
-    });
-});
diff --git a/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandard.tsx b/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandard.tsx
deleted file mode 100644
index 942aa0fc1ca7d..0000000000000
--- a/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandard.tsx
+++ /dev/null
@@ -1,242 +0,0 @@
-import { useMemo } from 'react';
-import { Link, useLocation } from 'react-router-dom-v5-compat';
-import {
-    EmptyState,
-    EmptyStateBody,
-    EmptyStateFooter,
-    Flex,
-    FlexItem,
-    Form,
-    FormGroup,
-    Title,
-    ToggleGroup,
-    ToggleGroupItem,
-} from '@patternfly/react-core';
-import { SyncIcon } from '@patternfly/react-icons';
-import { useQuery } from '@apollo/client';
-import isEqual from 'lodash/isEqual';
-import sortBy from 'lodash/sortBy';
-
-import WidgetCard from 'Components/PatternFly/WidgetCard';
-import useURLSearch from 'hooks/useURLSearch';
-import useWidgetConfig from 'hooks/useWidgetConfig';
-import type { SearchFilter } from 'types/search';
-
-import {
-    getRequestQueryStringForSearchFilter,
-    getUrlQueryStringForSearchFilter,
-} from 'utils/searchUtils';
-import entityTypes from 'constants/entityTypes';
-import type { StandardEntityType, standardTypes } from 'constants/entityTypes';
-import { AGGREGATED_RESULTS_ACROSS_ENTITIES } from 'queries/controls';
-import { complianceBasePath } from 'routePaths';
-import { standardLabels } from 'messages/standards';
-import ComplianceLevelsByStandardChart from './ComplianceLevelsByStandardChart';
-import type { ComplianceLevelByStandard } from './ComplianceLevelsByStandardChart';
-import WidgetOptionsMenu from './WidgetOptionsMenu';
-import WidgetOptionsResetButton from './WidgetOptionsResetButton';
-
-const fieldIdPrefix = 'compliance-levels-by-standard';
-
-type ComplianceStandard = {
-    id: string;
-    name: string;
-};
-
-type ComplianceData = {
-    complianceStandards: ComplianceStandard[];
-    complianceLevelsByStandard: ComplianceLevelByStandard[];
-};
-
-// Adapted from `processData` function in the original DashboardCompliance.js code
-function processData(
-    searchFilter: SearchFilter,
-    sortDirection: SortBy,
-    data?: AggregationResult
-): ComplianceData | undefined {
-    if (!data) {
-        return undefined;
-    }
-    const { complianceStandards, controls } = data;
-
-    const modifiedData: ComplianceLevelByStandard[] = [];
-    controls.results.forEach((result) => {
-        const aggregationName = result?.aggregationKeys[0]?.id;
-        const standard = complianceStandards.find((cs) => cs.id === aggregationName);
-
-        if (standard) {
-            const { numPassing, numFailing } = result;
-            const standardQueryValue =
-                standardLabels[standard.id] || aggregationName || 'Unrecognized standard';
-            const query = getUrlQueryStringForSearchFilter({
-                ...searchFilter,
-                Cluster: searchFilter.Cluster || '*',
-                standard: standardQueryValue,
-            });
-            const link = `${complianceBasePath}/controls?${query}`;
-            modifiedData.push({
-                name: standard.name || aggregationName || 'Unrecognized standard',
-                passing: Math.round((numPassing / (numFailing + numPassing)) * 100) || 0,
-                link,
-            });
-        }
-    });
-
-    const sorted = sortBy(modifiedData, [(datum) => datum.passing]);
-
-    if (sortDirection === 'desc') {
-        sorted.reverse();
-    }
-
-    return {
-        complianceStandards,
-        // Slice to limit number of bars in chart.
-        // Reverse since Victory charts renders items from bottom to top
-        complianceLevelsByStandard: sorted.slice(0, 6).reverse(),
-    };
-}
-
-type AggregationResult = {
-    controls: {
-        results: {
-            aggregationKeys: {
-                id: keyof typeof standardTypes;
-                scope: StandardEntityType;
-            }[];
-            numFailing: number;
-            numPassing: number;
-            numSkipped: number;
-            unit: StandardEntityType;
-        }[];
-    };
-    complianceStandards: ComplianceStandard[];
-};
-
-type SortBy = 'asc' | 'desc';
-
-const defaultConfig = { sortDataBy: 'asc' } as const;
-
-function ComplianceLevelsByStandard() {
-    const { searchFilter } = useURLSearch();
-    const { pathname } = useLocation();
-    const [{ sortDataBy }, updateConfig] = useWidgetConfig<{ sortDataBy: SortBy }>(
-        'ComplianceLevelsByStandard',
-        pathname,
-        defaultConfig
-    );
-
-    const where = getRequestQueryStringForSearchFilter({
-        // We always need to include some value for Cluster, otherwise aggregation will be performed at the namespace level
-        ...searchFilter,
-        Cluster: searchFilter.Cluster || '*',
-    });
-    const variables = {
-        groupBy: [entityTypes.STANDARD],
-        where,
-    };
-    const { loading, error, data, previousData } = useQuery<AggregationResult>(
-        AGGREGATED_RESULTS_ACROSS_ENTITIES,
-        { variables }
-    );
-
-    const complianceData = useMemo(
-        () => processData(searchFilter, sortDataBy, data || previousData),
-        [searchFilter, sortDataBy, data, previousData]
-    );
-
-    const isOptionsChanged = !isEqual(sortDataBy, defaultConfig.sortDataBy);
-
-    return (
-        <WidgetCard
-            isLoading={loading && !complianceData}
-            error={error}
-            header={
-                <Flex
-                    direction={{ default: 'row' }}
-                    alignItems={{ default: 'alignItemsCenter' }}
-                    justifyContent={{ default: 'justifyContentSpaceBetween' }}
-                >
-                    <FlexItem>
-                        <Title headingLevel="h2">Compliance by standard</Title>
-                    </FlexItem>
-                    <Flex
-                        direction={{ default: 'row' }}
-                        alignItems={{ default: 'alignItemsCenter' }}
-                    >
-                        <FlexItem>
-                            <Link to={complianceBasePath}>View all</Link>
-                        </FlexItem>
-                        <FlexItem>
-                            {isOptionsChanged && (
-                                <WidgetOptionsResetButton
-                                    onClick={() => updateConfig(defaultConfig)}
-                                />
-                            )}
-                            <WidgetOptionsMenu
-                                bodyContent={
-                                    <Form>
-                                        <FormGroup
-                                            fieldId={`${fieldIdPrefix}-sort-by`}
-                                            label="Sort by"
-                                        >
-                                            <ToggleGroup aria-label="Sort coverage by ascending or descending percentage">
-                                                <ToggleGroupItem
-                                                    text="Ascending"
-                                                    buttonId={`${fieldIdPrefix}-sort-by-asc`}
-                                                    isSelected={sortDataBy === 'asc'}
-                                                    onChange={() =>
-                                                        updateConfig({ sortDataBy: 'asc' })
-                                                    }
-                                                />
-                                                <ToggleGroupItem
-                                                    text="Descending"
-                                                    buttonId={`${fieldIdPrefix}-sort-by-desc`}
-                                                    isSelected={sortDataBy === 'desc'}
-                                                    onChange={() =>
-                                                        updateConfig({ sortDataBy: 'desc' })
-                                                    }
-                                                />
-                                            </ToggleGroup>
-                                        </FormGroup>
-                                    </Form>
-                                }
-                            />
-                        </FlexItem>
-                    </Flex>
-                </Flex>
-            }
-        >
-            {Array.isArray(complianceData?.complianceLevelsByStandard) &&
-            complianceData.complianceLevelsByStandard.length !== 0 ? (
-                <ComplianceLevelsByStandardChart
-                    complianceLevelsByStandard={complianceData.complianceLevelsByStandard}
-                />
-            ) : (
-                <EmptyState
-                    headingLevel="h3"
-                    icon={SyncIcon}
-                    titleText={
-                        Array.isArray(complianceData?.complianceStandards) &&
-                        complianceData.complianceStandards.length === 0
-                            ? 'No standards selected'
-                            : 'No results available.'
-                    }
-                    className="pf-v6-u-h-100"
-                    variant="xs"
-                >
-                    <EmptyStateBody>
-                        {Array.isArray(complianceData?.complianceStandards) &&
-                        complianceData.complianceStandards.length === 0
-                            ? 'Manage profiles on the Compliance page.'
-                            : 'Run a scan on the Compliance page.'}
-                    </EmptyStateBody>
-                    <EmptyStateFooter>
-                        <Link to={complianceBasePath}>View Compliance Dashboard</Link>
-                    </EmptyStateFooter>
-                </EmptyState>
-            )}
-        </WidgetCard>
-    );
-}
-
-export default ComplianceLevelsByStandard;
diff --git a/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandardChart.tsx b/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandardChart.tsx
deleted file mode 100644
index 5f5c193eedbb7..0000000000000
--- a/ui/apps/platform/src/Containers/Dashboard/Widgets/ComplianceLevelsByStandardChart.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-import { useState } from 'react';
-import { useNavigate } from 'react-router-dom-v5-compat';
-import {
-    Chart,
-    ChartAxis,
-    ChartBar,
-    ChartContainer,
-    ChartGroup,
-} from '@patternfly/react-charts/victory';
-import type { ChartLabelProps } from '@patternfly/react-charts/victory';
-
-import { LinkableChartLabel } from 'Components/PatternFly/Charts/LinkableChartLabel';
-import useResizeObserver from 'hooks/useResizeObserver';
-import {
-    defaultChartBarWidth,
-    defaultChartHeight,
-    navigateOnClickEvent,
-    patternflySeverityTheme,
-    solidBlueChartColor,
-} from 'utils/chartUtils';
-
-const labelLinkCallback = ({ datum }: ChartLabelProps, data: ComplianceLevelByStandard[]) => {
-    return typeof datum === 'number' ? (data[datum - 1]?.link ?? '') : '';
-};
-
-export type ComplianceLevelByStandard = {
-    name: string;
-    passing: number;
-    link: string;
-};
-
-type ComplianceLevelsByStandardChartProps = {
-    complianceLevelsByStandard: ComplianceLevelByStandard[];
-};
-
-function ComplianceLevelsByStandardChart({
-    complianceLevelsByStandard,
-}: ComplianceLevelsByStandardChartProps) {
-    const navigate = useNavigate();
-    const [widgetContainer, setWidgetContainer] = useState<HTMLDivElement | null>(null);
-    const widgetContainerResizeEntry = useResizeObserver(widgetContainer);
-
-    return (
-        <div ref={setWidgetContainer}>
-            <Chart
-                ariaDesc="Compliance coverage percentages by standard across the selected resource scope"
-                ariaTitle="Compliance coverage by standard"
-                containerComponent={<ChartContainer role="figure" />}
-                domainPadding={{ x: [20, 20] }}
-                height={defaultChartHeight}
-                width={widgetContainerResizeEntry?.contentRect.width}
-                padding={{
-                    top: 0,
-                    left: 150,
-                    right: 50,
-                    bottom: 30,
-                }}
-                theme={patternflySeverityTheme}
-            >
-                <ChartAxis
-                    tickLabelComponent={
-                        <LinkableChartLabel
-                            linkWith={(props) =>
-                                labelLinkCallback(props, complianceLevelsByStandard)
-                            }
-                        />
-                    }
-                />
-                <ChartAxis
-                    tickValues={[0, 50, 100]}
-                    tickFormat={['0', '50%', '100%']}
-                    padding={{ bottom: 10 }}
-                    dependentAxis
-                />
-                <ChartGroup horizontal>
-                    {complianceLevelsByStandard.map(({ name, passing, link }) => (
-                        <ChartBar
-                            key={name}
-                            style={{ data: { fill: solidBlueChartColor } }}
-                            barWidth={defaultChartBarWidth}
-                            data={[{ x: name, y: passing, link }]}
-                            labels={({ datum }) => `${Math.round(parseInt(datum.y, 10))}%`}
-                            events={[navigateOnClickEvent(navigate, () => link)]}
-                        />
-                    ))}
-                </ChartGroup>
-            </Chart>
-        </div>
-    );
-}
-
-export default ComplianceLevelsByStandardChart;
diff --git a/ui/apps/platform/src/Containers/MainPage/AcsFeedbackModal.tsx b/ui/apps/platform/src/Containers/MainPage/AcsFeedbackModal.tsx
deleted file mode 100644
index bdf1e52340445..0000000000000
--- a/ui/apps/platform/src/Containers/MainPage/AcsFeedbackModal.tsx
+++ /dev/null
@@ -1,109 +0,0 @@
-import type { ReactElement } from 'react';
-import { useDispatch, useSelector } from 'react-redux';
-import { createStructuredSelector } from 'reselect';
-import { FeedbackModal } from '@patternfly/react-user-feedback';
-import type { FeedbackLocale } from '@patternfly/react-user-feedback';
-
-import { getProductBranding } from 'constants/productBranding';
-import redFeedbackImage from 'images/feedback_illo.svg';
-import { selectors } from 'reducers';
-import { actions } from 'reducers/feedback';
-
-// Required for PatternFly v6 FeedbackModal styling
-import '@patternfly/react-user-feedback/dist/esm/Feedback/Feedback.css';
-
-const feedbackState = createStructuredSelector({
-    feedback: selectors.feedbackSelector,
-});
-
-function getFeedbackTranslations(lang, branding): FeedbackLocale {
-    switch (lang) {
-        case 'en-us':
-        default: {
-            const dialogSubhead =
-                branding === 'RHACS_BRANDING'
-                    ? 'Help us improve Red Hat Advanced Cluster Security for Kubernetes.'
-                    : 'Help us improve StackRox.';
-            const experienceSubhead =
-                branding === 'RHACS_BRANDING'
-                    ? 'What has your RHACS experience been like so far?'
-                    : 'What has your StackRox experience been like so far?';
-
-            return {
-                getSupport: 'Get support',
-                back: 'Back',
-                bugReported: 'Bug Reported',
-                cancel: 'Cancel',
-                close: 'Close',
-                describeBug:
-                    'Describe the bug you encountered. For urgent issues, open a support case instead.',
-                describeBugUrgentCases:
-                    'Describe the bug you encountered. For urgent issues, open a support case instead.',
-                describeReportBug:
-                    'Describe the bug you encountered. Include where it is located and what action caused it. If this issue is urgent or blocking your workflow,',
-                directInfluence:
-                    'Your feedback will directly influence the future of Red Hat’s products. Opt in below to hear about future research opportunities via email.',
-                email: 'Email',
-                enterFeedback: 'Enter your feedback',
-                feedback: 'Feedback',
-                feedbackSent: 'Feedback Sent',
-                helpUsImproveHCC: dialogSubhead,
-                howIsConsoleExperience: experienceSubhead,
-                joinMailingList: 'Join mailing list',
-                informDirectionDescription:
-                    'By participating in feedback sessions, usability tests, and interviews with our',
-                informDirection: 'Inform the direction of Red Hat',
-                learnAboutResearchOpportunities:
-                    'Learn about opportunities to share your feedback with our User Research Team.',
-                openSupportCase: 'Support Case',
-                problemProcessingRequest:
-                    'There was a problem processing the request. Try reloading the page. If the problem persists, contact',
-                support: 'Red Hat support',
-                reportABug: 'Report a bug',
-                responseSent: 'Response sent',
-                researchOpportunities: 'Yes, I would like to hear about research opportunities',
-                shareFeedback: 'Share feedback',
-                shareYourFeedback: 'Share your feedback with us!',
-                somethingWentWrong: 'Something went wrong',
-                submitFeedback: 'Submit feedback',
-                teamWillReviewBug:
-                    'We appreciate your feedback and our team will review your report shortly',
-                tellAboutExperience: 'Tell us about your experience',
-                thankYouForFeedback: 'Thank you, we appreciate your feedback.',
-                thankYouForInterest:
-                    'Thank you for your interest in user research. You have been added to our mailing list.',
-                userResearchTeam: 'User Research Team',
-                weNeverSharePersonalInformation:
-                    'We never share your personal information, and you can opt out at any time.',
-            };
-        }
-    }
-}
-
-function AcsFeedbackModal(): ReactElement | null {
-    const { feedback: showFeedbackModal } = useSelector(feedbackState);
-    const dispatch = useDispatch();
-
-    const { type } = getProductBranding();
-
-    const i18nAcsEnglish = getFeedbackTranslations('en-us', type);
-    return (
-        <FeedbackModal
-            email="test@redhat.com"
-            onShareFeedback="https://console.redhat.com/self-managed-feedback-form?source=acs"
-            onOpenSupportCase={
-                type === 'RHACS_BRANDING'
-                    ? 'https://access.redhat.com/support/cases/#/case/new/open-case?caseCreate=true'
-                    : ''
-            }
-            isOpen={showFeedbackModal}
-            feedbackImg={redFeedbackImage}
-            feedbackLocale={i18nAcsEnglish}
-            onClose={() => {
-                dispatch(actions.setFeedbackModalVisibility(false));
-            }}
-        />
-    );
-}
-
-export default AcsFeedbackModal;
diff --git a/ui/apps/platform/src/Containers/MainPage/Body.tsx b/ui/apps/platform/src/Containers/MainPage/Body.tsx
index e7cf9d4e56cd3..c6e72c34e17c4 100644
--- a/ui/apps/platform/src/Containers/MainPage/Body.tsx
+++ b/ui/apps/platform/src/Containers/MainPage/Body.tsx
@@ -19,7 +19,6 @@ import {
     clustersSecureClusterCrsPath,
     clustersSecureClusterPath,
     collectionsPath,
-    complianceBasePath,
     complianceEnhancedCoveragePath,
     complianceEnhancedSchedulesPath,
     configManagementPath,
@@ -52,11 +51,12 @@ import {
     vulnerabilitiesUserWorkloadsPath,
     vulnerabilitiesVirtualMachineCvesPath,
     vulnerabilitiesWorkloadCvesPath,
+    vulnerabilityImageReportsPath,
+    vulnerabilityNodeReportsPath,
     vulnerabilityReportsPath,
 } from 'routePaths';
 import type { RouteKey } from 'routePaths';
 
-import FeatureDisabledMessage from 'Components/FeatureDisabledMessage';
 import PageNotFound from 'Components/PageNotFound';
 import PageTitle from 'Components/PageTitle';
 import usePermissions from 'hooks/usePermissions';
@@ -173,10 +173,6 @@ const routeComponentMap: Record<RouteKey, RouteComponent> = {
         ),
         path: complianceEnhancedSchedulesPath,
     },
-    compliance: {
-        component: asyncComponent(() => import('Containers/Compliance/Page')),
-        path: complianceBasePath,
-    },
     configmanagement: {
         component: asyncComponent(
             () => import('Containers/ConfigManagement/ConfigManagementRoutes')
@@ -293,10 +289,23 @@ const routeComponentMap: Record<RouteKey, RouteComponent> = {
     },
     'vulnerabilities/reports': {
         component: asyncComponent(
-            () => import('Containers/Vulnerabilities/VulnerablityReporting/VulnReportingPage')
+            () => import('Containers/Vulnerabilities/Reports/VulnerabilityReportsPage')
         ),
         path: vulnerabilityReportsPath,
     },
+    'vulnerabilities/reports/images': {
+        component: asyncComponent(
+            () => import('Containers/Vulnerabilities/VulnerablityReporting/VulnReportingPage')
+        ),
+        path: vulnerabilityImageReportsPath,
+    },
+    'vulnerabilities/reports/nodes': {
+        component: asyncComponent(
+            () =>
+                import('Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/NodeVulnerabilityReportsPage')
+        ),
+        path: vulnerabilityNodeReportsPath,
+    },
     'vulnerability-management': {
         component: asyncComponent(() => import('Containers/VulnMgmt/WorkflowLayout')),
         path: vulnManagementPath,
@@ -368,22 +377,6 @@ function Body({ hasReadAccess, isFeatureFlagEnabled }: BodyProps): ReactElement
                         const { component: Component, path } = routeComponentMap[routeKey];
                         return <Route key={routeKey} path={`${path}/*`} element={<Component />} />;
                     })}
-                {!isFeatureFlagEnabled('ROX_LEGACY_SCANNER') && (
-                    <Route
-                        path={`${vulnerabilitiesPlatformCvesPath}/*`}
-                        element={
-                            <PageSection>
-                                <PageTitle title="Kubernetes components - Disabled" />
-                                <FeatureDisabledMessage
-                                    title="Kubernetes components"
-                                    message="The Legacy Scanner [deprecated] has been disabled by your administrator."
-                                    actionText="Go to Vulnerability Management"
-                                    url={vulnerabilitiesUserWorkloadsPath}
-                                />
-                            </PageSection>
-                        }
-                    />
-                )}
                 <Route path="*" element={<NotFoundPage />} />
             </Routes>
             {hasWriteAccessForInviting && showInviteModal && <InviteUsersModal />}
diff --git a/ui/apps/platform/src/Containers/MainPage/Header/HelpMenu.tsx b/ui/apps/platform/src/Containers/MainPage/Header/HelpMenu.tsx
index af60322a9e136..c8088a4011344 100644
--- a/ui/apps/platform/src/Containers/MainPage/Header/HelpMenu.tsx
+++ b/ui/apps/platform/src/Containers/MainPage/Header/HelpMenu.tsx
@@ -1,19 +1,16 @@
 import { useState } from 'react';
 import type { ReactElement } from 'react';
 import { Link } from 'react-router-dom-v5-compat';
-import { useDispatch } from 'react-redux';
 import { Divider, Dropdown, DropdownItem, DropdownList, MenuToggle } from '@patternfly/react-core';
 import { QuestionCircleIcon } from '@patternfly/react-icons';
 
 import useMetadata from 'hooks/useMetadata';
-import { actions } from 'reducers/feedback';
 import { apidocsPath, apidocsPathV2 } from 'routePaths';
 import { getVersionedDocs } from 'utils/versioning';
 
 function HelpMenu(): ReactElement {
     const { releaseBuild, version } = useMetadata();
     const [isHelpMenuOpen, setIsHelpMenuOpen] = useState(false);
-    const dispatch = useDispatch();
 
     return (
         <Dropdown
@@ -41,12 +38,6 @@ function HelpMenu(): ReactElement {
                 <DropdownItem component={(props) => <Link {...props} to={apidocsPathV2} />}>
                     API Reference (v2)
                 </DropdownItem>
-                <DropdownItem
-                    component="button"
-                    onClick={() => dispatch(actions.setFeedbackModalVisibility(true))}
-                >
-                    Share feedback
-                </DropdownItem>
                 {version && (
                     <>
                         <DropdownItem
diff --git a/ui/apps/platform/src/Containers/MainPage/MainPage.tsx b/ui/apps/platform/src/Containers/MainPage/MainPage.tsx
index 909e3ac107ecf..5c9551244dc8d 100644
--- a/ui/apps/platform/src/Containers/MainPage/MainPage.tsx
+++ b/ui/apps/platform/src/Containers/MainPage/MainPage.tsx
@@ -1,9 +1,8 @@
 import { useEffect, useState } from 'react';
 import type { ReactElement } from 'react';
-import { useDispatch, useSelector } from 'react-redux';
+import { useSelector } from 'react-redux';
 import { useNavigate } from 'react-router-dom-v5-compat';
-import { Button, Page } from '@patternfly/react-core';
-import { OutlinedCommentsIcon } from '@patternfly/react-icons';
+import { Page } from '@patternfly/react-core';
 
 import ErrorBoundary from 'Components/PatternFly/ErrorBoundary/ErrorBoundary';
 import LoadingSection from 'Components/PatternFly/LoadingSection';
@@ -11,7 +10,6 @@ import useFeatureFlags from 'hooks/useFeatureFlags';
 import usePermissions from 'hooks/usePermissions';
 import usePublicConfig from 'hooks/usePublicConfig';
 import { selectors } from 'reducers';
-import { actions } from 'reducers/feedback';
 import { getClustersForPermissions } from 'services/RolesService';
 import { clustersBasePath } from 'routePaths';
 
@@ -23,18 +21,15 @@ import NavigationSidebar from './Navigation/NavigationSidebar';
 import HorizontalSubnav from './Navigation/HorizontalSubnav';
 
 import Body from './Body';
-import AcsFeedbackModal from './AcsFeedbackModal';
 
 function MainPage(): ReactElement {
     const navigate = useNavigate();
-    const dispatch = useDispatch();
 
     const { isFeatureFlagEnabled, isLoadingFeatureFlags } = useFeatureFlags();
     const { hasReadAccess, hasReadWriteAccess, isLoadingPermissions } = usePermissions();
     const { publicConfig, isLoadingPublicConfig } = usePublicConfig();
     const isLoadingCentralCapabilities = useSelector(selectors.getIsLoadingCentralCapabilities);
     const [isLoadingClustersCount, setIsLoadingClustersCount] = useState(false);
-    const showFeedbackModal = useSelector(selectors.feedbackSelector);
 
     const hasWriteAccessForCluster = hasReadWriteAccess('Cluster');
 
@@ -79,26 +74,6 @@ function MainPage(): ReactElement {
             <div id="PageParent">
                 <PublicConfigHeader />
                 <Banners />
-                <Button
-                    style={{
-                        bottom: 'calc(2 * var(--pf-t--global--spacer--4xl))',
-                        position: 'absolute',
-                        right: '0',
-                        transform: 'rotate(270deg)',
-                        transformOrigin: 'bottom right',
-                        zIndex: 20000,
-                    }}
-                    icon={<OutlinedCommentsIcon />}
-                    iconPosition="left"
-                    variant="danger"
-                    id="feedback-trigger-button"
-                    onClick={() => {
-                        dispatch(actions.setFeedbackModalVisibility(true));
-                    }}
-                >
-                    Feedback
-                </Button>
-                {showFeedbackModal && <AcsFeedbackModal />}
                 <Page
                     mainContainerId="main-page-container"
                     masthead={<Header />}
diff --git a/ui/apps/platform/src/Containers/MainPage/Navigation/NavigationSidebar.tsx b/ui/apps/platform/src/Containers/MainPage/Navigation/NavigationSidebar.tsx
index c7b13a6adb01b..7b4461248fac6 100644
--- a/ui/apps/platform/src/Containers/MainPage/Navigation/NavigationSidebar.tsx
+++ b/ui/apps/platform/src/Containers/MainPage/Navigation/NavigationSidebar.tsx
@@ -20,7 +20,6 @@ import {
     baseImagesPath,
     clustersBasePath,
     collectionsBasePath,
-    complianceBasePath,
     complianceEnhancedCoveragePath,
     complianceEnhancedSchedulesPath,
     configManagementPath,
@@ -99,7 +98,7 @@ function getNavDescriptions(isFeatureFlagEnabled: IsFeatureFlagEnabled): NavDesc
             type: 'link',
             content: 'Reports',
             path: vulnerabilityReportsPath,
-            routeKey: 'vulnerabilities/reports',
+            routeKey: ['vulnerabilities/reports/images', 'vulnerabilities/reports/nodes'],
         },
         {
             type: 'separator',
@@ -162,28 +161,6 @@ function getNavDescriptions(isFeatureFlagEnabled: IsFeatureFlagEnabled): NavDesc
                     path: complianceEnhancedSchedulesPath,
                     routeKey: 'compliance-schedules',
                 },
-                {
-                    type: 'separator',
-                    key: 'preceding-classic-compliance',
-                },
-                {
-                    type: 'link',
-                    content: <NavigationContent variant="Deprecated">Dashboard</NavigationContent>,
-                    path: complianceBasePath,
-                    routeKey: 'compliance',
-                    isActive: (location) =>
-                        Boolean(
-                            matchPath({ path: `${complianceBasePath}/*` }, location.pathname)
-                        ) &&
-                        !matchPath(
-                            { path: `${complianceEnhancedCoveragePath}/*` },
-                            location.pathname
-                        ) &&
-                        !matchPath(
-                            { path: `${complianceEnhancedSchedulesPath}/*` },
-                            location.pathname
-                        ),
-                },
             ],
         },
         {
@@ -247,7 +224,9 @@ function getNavDescriptions(isFeatureFlagEnabled: IsFeatureFlagEnabled): NavDesc
                 },
                 {
                     type: 'link',
-                    content: 'Collections',
+                    content: (
+                        <NavigationContent variant="Deprecated">Collections</NavigationContent>
+                    ),
                     path: collectionsBasePath,
                     routeKey: 'collections',
                 },
diff --git a/ui/apps/platform/src/Containers/MainPage/Navigation/utils.ts b/ui/apps/platform/src/Containers/MainPage/Navigation/utils.ts
index eb1f74f612331..c4710ebfa7d61 100644
--- a/ui/apps/platform/src/Containers/MainPage/Navigation/utils.ts
+++ b/ui/apps/platform/src/Containers/MainPage/Navigation/utils.ts
@@ -17,7 +17,7 @@ export type LinkDescription = {
     type: 'link';
     content: string | TitleCallback | ReactElement;
     path: string;
-    routeKey: RouteKey;
+    routeKey: RouteKey | RouteKey[];
     description?: string;
     isActive?: IsActiveCallback; // for example, exact match
 };
diff --git a/ui/apps/platform/src/Containers/Policies/Detail/PolicyDetailContent.tsx b/ui/apps/platform/src/Containers/Policies/Detail/PolicyDetailContent.tsx
index f6ee0599c5979..3c5fd80a6c2bc 100644
--- a/ui/apps/platform/src/Containers/Policies/Detail/PolicyDetailContent.tsx
+++ b/ui/apps/platform/src/Containers/Policies/Detail/PolicyDetailContent.tsx
@@ -69,6 +69,7 @@ function PolicyDetailContent({ policy, isReview = false }: PolicyDetailContentPr
                 <PolicyFiltersSection
                     evaluationFilter={evaluationFilter}
                     lifecycleStages={lifecycleStages}
+                    eventSource={eventSource}
                 />
                 <Stack hasGutter>
                     <Title headingLevel="h2">Policy resources</Title>
diff --git a/ui/apps/platform/src/Containers/Policies/Detail/PolicyFiltersSection.tsx b/ui/apps/platform/src/Containers/Policies/Detail/PolicyFiltersSection.tsx
index d349ec2fc1534..84bc949536536 100644
--- a/ui/apps/platform/src/Containers/Policies/Detail/PolicyFiltersSection.tsx
+++ b/ui/apps/platform/src/Containers/Policies/Detail/PolicyFiltersSection.tsx
@@ -1,22 +1,22 @@
 import { Card, CardBody, DescriptionList, Stack, Title } from '@patternfly/react-core';
 
 import useFeatureFlags from 'hooks/useFeatureFlags';
-import type { EvaluationFilter, LifecycleStage } from 'types/policy.proto';
+import type { EvaluationFilter, LifecycleStage, PolicyEventSource } from 'types/policy.proto';
 import DescriptionListItem from 'Components/DescriptionListItem';
+import { containerTypeFilterApplies } from '../policies.utils';
 
 type PolicyFiltersSectionProps = {
     evaluationFilter: EvaluationFilter | null;
     lifecycleStages: LifecycleStage[];
+    eventSource: PolicyEventSource;
 };
 
 function getContainerTypeLabel(
     evaluationFilter: EvaluationFilter | null,
-    lifecycleStages: LifecycleStage[]
+    lifecycleStages: LifecycleStage[],
+    eventSource: PolicyEventSource
 ): string | null {
-    const hasDeployOrRuntime =
-        lifecycleStages.includes('DEPLOY') || lifecycleStages.includes('RUNTIME');
-
-    if (!hasDeployOrRuntime) {
+    if (!containerTypeFilterApplies(lifecycleStages, eventSource)) {
         return null;
     }
 
@@ -27,13 +27,17 @@ function getContainerTypeLabel(
     return null;
 }
 
-function PolicyFiltersSection({ evaluationFilter, lifecycleStages }: PolicyFiltersSectionProps) {
+function PolicyFiltersSection({
+    evaluationFilter,
+    lifecycleStages,
+    eventSource,
+}: PolicyFiltersSectionProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
 
     const containerTypeLabel =
         isFeatureFlagEnabled('ROX_EVALUATION_FILTER') &&
         isFeatureFlagEnabled('ROX_INIT_CONTAINER_SUPPORT')
-            ? getContainerTypeLabel(evaluationFilter, lifecycleStages)
+            ? getContainerTypeLabel(evaluationFilter, lifecycleStages, eventSource)
             : null;
 
     if (!containerTypeLabel) {
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/PolicyWizard.tsx b/ui/apps/platform/src/Containers/Policies/Wizard/PolicyWizard.tsx
index d073c1ff28a99..08f510dfc0246 100644
--- a/ui/apps/platform/src/Containers/Policies/Wizard/PolicyWizard.tsx
+++ b/ui/apps/platform/src/Containers/Policies/Wizard/PolicyWizard.tsx
@@ -169,16 +169,16 @@ function PolicyWizard({ pageAction, policy }: PolicyWizardProps): ReactElement {
                     <BreadcrumbItem isActive>{policy?.name || 'Create policy'}</BreadcrumbItem>
                 </Breadcrumb>
             </PageSection>
-            <PageSection isFilled id="policy-page">
+            <PageSection id="policy-page">
                 <Title headingLevel="h1">{policy?.name || 'Create policy'}</Title>
                 <div>Design custom security policies for your environment</div>
             </PageSection>
             <PageSection
                 hasBodyWrapper={false}
-                isFilled
                 hasOverflowScroll
+                isFilled
                 padding={{ default: 'noPadding' }}
-                className="pf-v6-u-h-100"
+                type="wizard"
             >
                 <FormikProvider value={formik}>
                     <Wizard
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaForm.tsx b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaForm.tsx
index 586f9ebbe0300..24102bcd527e4 100644
--- a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaForm.tsx
+++ b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaForm.tsx
@@ -22,8 +22,6 @@ function PolicyCriteriaForm({ hasActiveViolations }: PolicyCriteriaFormProps) {
     const { criteriaLocked } = values;
     const { isFeatureFlagEnabled } = useFeatureFlags();
 
-    const showPolicyCriteriaModal = isFeatureFlagEnabled('ROX_POLICY_CRITERIA_MODAL');
-
     function addNewPolicySection() {
         if (values.policySections.length < MAX_POLICY_SECTIONS) {
             const newPolicySection = {
@@ -88,7 +86,6 @@ function PolicyCriteriaForm({ hasActiveViolations }: PolicyCriteriaFormProps) {
     }
 
     return (
-        // TODO: (vjw, 15-Nov-2023) remove the DndProvider after the PolicyCriteriaModal flag has been made unflagged
         /*
         (dv 2024-05-01) Upgrading to React types 18 causes a type error below
 
@@ -127,17 +124,12 @@ function PolicyCriteriaForm({ hasActiveViolations }: PolicyCriteriaFormProps) {
                     </Flex>
                 </Flex>
                 <Divider component="div" orientation={{ default: 'vertical' }} />
-                {!showPolicyCriteriaModal && (
-                    <Flex
-                        className="pf-v6-u-h-100 pf-v6-u-pt-lg"
-                        id="policy-criteria-keys-container"
-                    >
-                        <PolicyCriteriaKeys
-                            keys={filteredDescriptors}
-                            eventSource={values.eventSource}
-                        />
-                    </Flex>
-                )}
+                <Flex className="pf-v6-u-h-100 pf-v6-u-pt-lg" id="policy-criteria-keys-container">
+                    <PolicyCriteriaKeys
+                        keys={filteredDescriptors}
+                        eventSource={values.eventSource}
+                    />
+                </Flex>
             </Flex>
         </DndProvider>
     );
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaModal.css b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaModal.css
deleted file mode 100644
index 242f9350d8f13..0000000000000
--- a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaModal.css
+++ /dev/null
@@ -1,8 +0,0 @@
-.pf-v6-c-tree-view__list-item .pf-v6-c-tree-view__list-item .pf-v6-c-tree-view__node-container:hover {
-    background-color: var(--pf-t--global--background--color--secondary--default) !important;
-    cursor: pointer;
-}
-
-.pf-v6-c-tree-view__node.pf-m-current .pf-v6-c-tree-view__node-container {
-    background-color: var(--pf-t--color--blue--10) !important;
-}
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaModal.tsx b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaModal.tsx
deleted file mode 100644
index 3d2ebdae55fbd..0000000000000
--- a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicyCriteriaModal.tsx
+++ /dev/null
@@ -1,215 +0,0 @@
-import { useEffect, useMemo, useState } from 'react';
-import {
-    Button,
-    Flex,
-    FlexItem,
-    Toolbar,
-    ToolbarContent,
-    ToolbarItem,
-    TreeView,
-    TreeViewSearch,
-} from '@patternfly/react-core';
-import type { TreeViewDataItem } from '@patternfly/react-core';
-import { Modal, ModalBoxBody, ModalBoxFooter } from '@patternfly/react-core/deprecated';
-import { kebabCase } from 'lodash';
-
-import type { PolicyGroup } from 'types/policy.proto';
-import type { Descriptor } from './policyCriteriaDescriptors';
-
-import './PolicyCriteriaModal.css';
-
-function getEmptyPolicyFieldCard(field) {
-    const defaultValue = field.defaultValue !== undefined ? field.defaultValue : '';
-    return {
-        fieldName: field.name,
-        booleanOperator: 'OR',
-        values: [
-            {
-                value: defaultValue,
-            },
-        ],
-        negate: false,
-        field,
-    };
-}
-
-type PolicyCriteriaModalProps = {
-    descriptors: Descriptor[];
-    existingGroups: PolicyGroup[];
-    isModalOpen: boolean;
-    onClose: () => void;
-    addPolicyFieldCardHandler: (Descriptor) => void;
-};
-
-function getKeysByCategory(keys) {
-    const categories = {};
-    keys.forEach((key) => {
-        const { category } = key;
-        if (categories[category]) {
-            categories[category].push(key);
-        } else {
-            categories[category] = [key];
-        }
-    });
-    return categories;
-}
-
-function getPolicyFieldsAsTree(existingGroups, descriptors): TreeViewDataItem[] {
-    const categories = getKeysByCategory(descriptors);
-
-    const treeList = Object.keys(categories).map((category) => ({
-        name: '',
-        title: category,
-        id: kebabCase(category),
-        children: categories[category]
-            .filter((child) => {
-                const alreadyUsed = existingGroups.find(
-                    (group) =>
-                        group.fieldName.toLowerCase() === child?.name?.toLowerCase() ||
-                        group.fieldName.toLowerCase() === child?.label?.toLowerCase()
-                );
-                return !alreadyUsed;
-            })
-            .map<TreeViewDataItem>((child: Descriptor) => ({
-                name: child.longName,
-                title: child.shortName,
-                id: kebabCase(child.name),
-            })),
-    }));
-
-    return treeList;
-}
-
-function PolicyCriteriaModal({
-    addPolicyFieldCardHandler,
-    descriptors,
-    existingGroups,
-    isModalOpen,
-    onClose,
-}: PolicyCriteriaModalProps) {
-    const [activeItems, setActiveItems] = useState<TreeViewDataItem[]>([]);
-    const [allExpanded, setAllExpanded] = useState(false);
-    const [filteredItems, setFilteredItems] = useState<TreeViewDataItem[]>([]);
-    const [isFiltered, setIsFiltered] = useState(false);
-
-    const treeDataItems = useMemo(
-        () => getPolicyFieldsAsTree(existingGroups, descriptors),
-        [descriptors, existingGroups]
-    );
-
-    useEffect(() => {
-        setFilteredItems(treeDataItems);
-        setIsFiltered(false);
-    }, [treeDataItems]);
-
-    function onSearch(evt) {
-        const input: string = evt.target.value;
-        if (input === '') {
-            setFilteredItems(treeDataItems);
-            setIsFiltered(false);
-        } else {
-            const filtered = treeDataItems.map((item) => {
-                const filteredItem = { ...item };
-                if (item.children && item.children.length > 0) {
-                    const filteredChildren = item.children.filter((child) => {
-                        const name = typeof child.name === 'string' ? child.name : '';
-                        const title = typeof child.title === 'string' ? child.title : '';
-                        return (
-                            name.toLowerCase().includes(input.toLowerCase()) ||
-                            title.toLowerCase().includes(input.toLowerCase())
-                        );
-                    });
-
-                    filteredItem.children = filteredChildren;
-                }
-
-                return filteredItem;
-            });
-
-            setFilteredItems(filtered);
-            setIsFiltered(true);
-        }
-    }
-
-    function onSelect(evt, treeViewItem) {
-        // Ignore folders for selection
-        if (treeViewItem && !treeViewItem.children) {
-            setActiveItems([treeViewItem]);
-        }
-    }
-
-    function addField() {
-        const itemKey = activeItems[0].title;
-        const itemToAdd = descriptors.find(
-            (descriptor) => descriptor.shortName === itemKey || descriptor.name === itemKey
-        );
-        const newPolicyFieldCard = getEmptyPolicyFieldCard(itemToAdd);
-
-        addPolicyFieldCardHandler(newPolicyFieldCard);
-        close();
-    }
-
-    const toolbar = (
-        <Toolbar style={{ padding: 0 }}>
-            <ToolbarContent style={{ padding: 0 }}>
-                <ToolbarItem>
-                    <TreeViewSearch
-                        onSearch={onSearch}
-                        id="input-search"
-                        name="search-input"
-                        aria-label="Filter policy criteria"
-                    />
-                </ToolbarItem>
-            </ToolbarContent>
-        </Toolbar>
-    );
-
-    function close() {
-        setIsFiltered(false);
-        setAllExpanded(false);
-        setFilteredItems(treeDataItems);
-
-        onClose();
-    }
-
-    return (
-        <Modal
-            title="Add policy criteria field"
-            isOpen={isModalOpen}
-            variant="small"
-            onClose={close}
-            aria-label="Add policy criteria field"
-            hasNoBodyWrapper
-        >
-            <ModalBoxBody>
-                <Flex direction={{ default: 'column' }}>
-                    <FlexItem>
-                        <Button variant="link" onClick={() => setAllExpanded((prev) => !prev)}>
-                            {allExpanded && 'Collapse all'}
-                            {!allExpanded && 'Expand all'}
-                        </Button>
-                        <TreeView
-                            activeItems={activeItems}
-                            data={filteredItems}
-                            onSelect={onSelect}
-                            variant="compactNoBackground"
-                            hasGuides
-                            allExpanded={allExpanded || isFiltered}
-                            toolbar={toolbar}
-                        />
-                    </FlexItem>
-                </Flex>
-            </ModalBoxBody>
-            <ModalBoxFooter>
-                <Button variant="primary" onClick={addField} isDisabled={activeItems.length === 0}>
-                    Add policy field
-                </Button>
-                <Button variant="link" onClick={onClose}>
-                    Cancel
-                </Button>
-            </ModalBoxFooter>
-        </Modal>
-    );
-}
-
-export default PolicyCriteriaModal;
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicySection.tsx b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicySection.tsx
index f09e9235734c9..449c62c0bc771 100644
--- a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicySection.tsx
+++ b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/PolicySection.tsx
@@ -13,13 +13,10 @@ import {
 } from '@patternfly/react-core';
 import { CheckIcon, PencilAltIcon, TrashIcon } from '@patternfly/react-icons';
 
-import useFeatureFlags from 'hooks/useFeatureFlags';
-import useModal from 'hooks/useModal';
 import type { Policy } from 'types/policy.proto';
 import type { Descriptor } from './policyCriteriaDescriptors';
 import PolicyGroupCard from './PolicyGroupCard';
 import PolicySectionDropTarget from './PolicySectionDropTarget';
-import PolicyCriteriaModal from './PolicyCriteriaModal';
 
 import './PolicySection.css';
 import { PolicySectionValidationError } from './PolicySectionValidationError';
@@ -32,13 +29,9 @@ type PolicySectionProps = {
 
 function PolicySection({ sectionIndex, descriptors, readOnly = false }: PolicySectionProps) {
     const [isEditingName, setIsEditingName] = useState(false);
-    const { isModalOpen, openModal, closeModal } = useModal();
     const { values, errors, setFieldValue, handleChange } = useFormikContext<Policy>();
     const { sectionName, policyGroups } = values.policySections[sectionIndex];
 
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const showPolicyCriteriaModal = isFeatureFlagEnabled('ROX_POLICY_CRITERIA_MODAL');
-
     function onEditSectionName(_, e) {
         handleChange(e);
     }
@@ -50,137 +43,97 @@ function PolicySection({ sectionIndex, descriptors, readOnly = false }: PolicySe
         );
     }
 
-    function addPolicyFieldCardHandler(fieldCard) {
-        setFieldValue(`policySections[${sectionIndex.toString()}].policyGroups`, [
-            ...policyGroups,
-            fieldCard,
-        ]);
-    }
-
     return (
-        <>
-            <Card isCompact className={!readOnly ? 'policy-section-card' : ''}>
-                <CardHeader
-                    {...(!readOnly && {
-                        actions: {
-                            actions: (
-                                <>
-                                    <Button
-                                        icon={isEditingName ? <CheckIcon /> : <PencilAltIcon />}
-                                        variant="plain"
-                                        onClick={() => setIsEditingName((prev) => !prev)}
-                                        title={
-                                            isEditingName
-                                                ? 'Save name of policy section'
-                                                : 'Edit name of policy section'
-                                        }
-                                    />
-                                    <Divider
-                                        component="div"
-                                        orientation={{ default: 'vertical' }}
-                                    />
-                                    <Button
-                                        icon={<TrashIcon />}
-                                        variant="plain"
-                                        className="pf-v6-u-mr-md"
-                                        title="Delete policy section"
-                                        onClick={onDeleteSection}
-                                    />
-                                </>
-                            ),
-                            hasNoOffset: true,
-                            className: 'pf-v6-u-py-sm',
-                        },
-                    })}
-                    className="policy-section-card-header pf-v6-u-p-0"
-                >
-                    <CardTitle className="pf-v6-u-display-flex pf-v6-u-align-self-stretch">
-                        <Flex
-                            alignItems={{ default: 'alignItemsCenter' }}
-                            flexWrap={{ default: 'nowrap' }}
-                        >
-                            <FlexItem className="pf-v6-u-pl-md">{sectionIndex + 1}</FlexItem>
-                            <Divider component="div" orientation={{ default: 'vertical' }} />
-                            <FlexItem>
-                                {isEditingName ? (
-                                    <TextInput
-                                        id={`policySections[${sectionIndex}].sectionName`}
-                                        name={`policySections[${sectionIndex}].sectionName`}
-                                        value={values.policySections[sectionIndex].sectionName}
-                                        onChange={(e, _) => onEditSectionName(_, e)}
-                                    />
-                                ) : (
-                                    <div
-                                        className="pf-v6-u-py-sm"
-                                        data-testid="policy-section-name"
-                                    >
-                                        {sectionName}
-                                    </div>
-                                )}
-                            </FlexItem>
-                        </Flex>
-                    </CardTitle>
-                </CardHeader>
-                <CardBody className="policy-section-card-body">
-                    {errors.policySections && (
-                        <PolicySectionValidationError
-                            sectionIndex={sectionIndex}
-                            errors={errors.policySections}
-                            className="pf-v6-u-mb-md"
-                        />
-                    )}
-                    {policyGroups.map((group, groupIndex) => {
-                        const descriptor = descriptors.find(
-                            (descriptorField) =>
-                                group.fieldName === descriptorField.name ||
-                                group.fieldName === descriptorField.label
-                        );
-                        return (
-                            descriptor && (
-                                <PolicyGroupCard
-                                    key={descriptor.name}
-                                    descriptor={descriptor}
-                                    groupIndex={groupIndex}
-                                    sectionIndex={sectionIndex}
-                                    readOnly={readOnly}
+        <Card isCompact className={!readOnly ? 'policy-section-card' : ''}>
+            <CardHeader
+                {...(!readOnly && {
+                    actions: {
+                        actions: (
+                            <>
+                                <Button
+                                    icon={isEditingName ? <CheckIcon /> : <PencilAltIcon />}
+                                    variant="plain"
+                                    onClick={() => setIsEditingName((prev) => !prev)}
+                                    title={
+                                        isEditingName
+                                            ? 'Save name of policy section'
+                                            : 'Edit name of policy section'
+                                    }
                                 />
-                            )
-                        );
-                    })}
-                    {!showPolicyCriteriaModal && !readOnly && (
-                        <PolicySectionDropTarget
-                            sectionIndex={sectionIndex}
-                            descriptors={descriptors}
-                        />
-                    )}
-                    {showPolicyCriteriaModal && !readOnly && (
-                        <Flex
-                            className="pf-v6-u-mt-md"
-                            justifyContent={{ default: 'justifyContentCenter' }}
-                        >
-                            <FlexItem>
+                                <Divider component="div" orientation={{ default: 'vertical' }} />
                                 <Button
-                                    key={`policySections[${sectionIndex}].sectionName-add-policy-field`}
-                                    variant="secondary"
-                                    onClick={openModal}
-                                >
-                                    Add policy field
-                                </Button>
-                            </FlexItem>
-                        </Flex>
-                    )}
-                </CardBody>
-            </Card>
-            {showPolicyCriteriaModal && (
-                <PolicyCriteriaModal
-                    descriptors={descriptors}
-                    existingGroups={policyGroups}
-                    isModalOpen={isModalOpen}
-                    onClose={closeModal}
-                    addPolicyFieldCardHandler={addPolicyFieldCardHandler}
-                />
-            )}
-        </>
+                                    icon={<TrashIcon />}
+                                    variant="plain"
+                                    className="pf-v6-u-mr-md"
+                                    title="Delete policy section"
+                                    onClick={onDeleteSection}
+                                />
+                            </>
+                        ),
+                        hasNoOffset: true,
+                        className: 'pf-v6-u-py-sm',
+                    },
+                })}
+                className="policy-section-card-header pf-v6-u-p-0"
+            >
+                <CardTitle className="pf-v6-u-display-flex pf-v6-u-align-self-stretch">
+                    <Flex
+                        alignItems={{ default: 'alignItemsCenter' }}
+                        flexWrap={{ default: 'nowrap' }}
+                    >
+                        <FlexItem className="pf-v6-u-pl-md">{sectionIndex + 1}</FlexItem>
+                        <Divider component="div" orientation={{ default: 'vertical' }} />
+                        <FlexItem>
+                            {isEditingName ? (
+                                <TextInput
+                                    id={`policySections[${sectionIndex}].sectionName`}
+                                    name={`policySections[${sectionIndex}].sectionName`}
+                                    value={values.policySections[sectionIndex].sectionName}
+                                    onChange={(e, _) => onEditSectionName(_, e)}
+                                />
+                            ) : (
+                                <div className="pf-v6-u-py-sm" data-testid="policy-section-name">
+                                    {sectionName}
+                                </div>
+                            )}
+                        </FlexItem>
+                    </Flex>
+                </CardTitle>
+            </CardHeader>
+            <CardBody className="policy-section-card-body">
+                {errors.policySections && (
+                    <PolicySectionValidationError
+                        sectionIndex={sectionIndex}
+                        errors={errors.policySections}
+                        className="pf-v6-u-mb-md"
+                    />
+                )}
+                {policyGroups.map((group, groupIndex) => {
+                    const descriptor = descriptors.find(
+                        (descriptorField) =>
+                            group.fieldName === descriptorField.name ||
+                            group.fieldName === descriptorField.label
+                    );
+                    return (
+                        descriptor && (
+                            <PolicyGroupCard
+                                key={descriptor.name}
+                                descriptor={descriptor}
+                                groupIndex={groupIndex}
+                                sectionIndex={sectionIndex}
+                                readOnly={readOnly}
+                            />
+                        )
+                    );
+                })}
+                {!readOnly && (
+                    <PolicySectionDropTarget
+                        sectionIndex={sectionIndex}
+                        descriptors={descriptors}
+                    />
+                )}
+            </CardBody>
+        </Card>
     );
 }
 
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.test.ts b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.test.ts
index cb4fc01e01c7c..7b7e942647672 100644
--- a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.test.ts
+++ b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.test.ts
@@ -15,12 +15,14 @@ import {
 // Items that are allowed independent of context.
 const allowListForItems = [
     'API',
+    'CISA',
     'CPU',
     'CVE',
     'CVSS',
     'Dockerfile',
     'IP',
     'IPC',
+    'KEV',
     'Kubernetes',
     'MUST',
     'NOT',
@@ -33,6 +35,7 @@ const allowListForItems = [
 
 // Items that are allowed only in the content of an entire string.
 const allowListForNames = [
+    'CISA Known Exploited Vulnerabilities catalog',
     'Common Vulnerability Scoring System (CVSS) score',
     'Common Vulnerability Scoring System (CVSS) score from National Vulnerability Database (NVD)',
     'Volume type (e.g. secret, configMap, hostPath) is',
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.tsx b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.tsx
index e6d2026729fc7..800718d74ced9 100644
--- a/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.tsx
+++ b/ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.tsx
@@ -683,6 +683,27 @@ export const policyCriteriaDescriptors: Descriptor[] = [
         canBooleanLogic: false,
         lifecycleStages: ['BUILD', 'DEPLOY', 'RUNTIME'],
     },
+    {
+        label: 'Known Exploited CVE',
+        name: 'CISA KEV',
+        shortName: 'Known exploited CVE',
+        longName: 'Known exploited vulnerabilities from the CISA KEV catalog',
+        category: policyCriteriaCategories.IMAGE_SCANNING,
+        type: 'radioGroup',
+        radioButtons: [
+            {
+                text: 'Yes',
+                value: true,
+            },
+            {
+                text: 'No',
+                value: false,
+            },
+        ],
+        defaultValue: true,
+        canBooleanLogic: false,
+        lifecycleStages: ['BUILD', 'DEPLOY', 'RUNTIME'],
+    },
     {
         label: 'Fixed by',
         name: 'Fixed By',
@@ -726,7 +747,6 @@ export const policyCriteriaDescriptors: Descriptor[] = [
         placeholder: '0',
         canBooleanLogic: false,
         lifecycleStages: ['BUILD', 'DEPLOY', 'RUNTIME'],
-        featureFlagDependency: ['ROX_CVE_FIX_TIMESTAMP'],
     },
     {
         label: 'Days Since CVE Was First Discovered In Image',
diff --git a/ui/apps/platform/src/Containers/Policies/Wizard/StepFilters/PolicyFiltersForm.tsx b/ui/apps/platform/src/Containers/Policies/Wizard/StepFilters/PolicyFiltersForm.tsx
index a5dbb2146a812..44ec77a40edfa 100644
--- a/ui/apps/platform/src/Containers/Policies/Wizard/StepFilters/PolicyFiltersForm.tsx
+++ b/ui/apps/platform/src/Containers/Policies/Wizard/StepFilters/PolicyFiltersForm.tsx
@@ -16,6 +16,10 @@ import { useFormikContext } from 'formik';
 import type { ClientPolicy } from 'types/policy.proto';
 import useFeatureFlags from 'hooks/useFeatureFlags';
 import { toggleItemInArray } from 'utils/arrayUtils';
+import { containerTypeFilterApplies } from '../../policies.utils';
+
+const containerTypeFilterMessage =
+    'Container type filters apply to deploy-time policies and to runtime policies with a deployment event source.';
 
 function PolicyFiltersForm() {
     const { values, setFieldValue } = useFormikContext<ClientPolicy>();
@@ -27,10 +31,10 @@ function PolicyFiltersForm() {
 
     const skipContainerTypes = values.evaluationFilter?.skipContainerTypes ?? [];
 
-    const hasDeployOrRuntime =
-        values.lifecycleStages.includes('DEPLOY') || values.lifecycleStages.includes('RUNTIME');
-
-    const containerFilterDisabled = !hasDeployOrRuntime;
+    const containerFilterDisabled = !containerTypeFilterApplies(
+        values.lifecycleStages,
+        values.eventSource
+    );
 
     useEffect(() => {
         if (containerFilterDisabled && skipContainerTypes.length > 0) {
@@ -57,7 +61,7 @@ function PolicyFiltersForm() {
                 <Stack hasGutter>
                     <Title headingLevel="h2">Filters</Title>
                     <Content component="p">
-                        Control which parts of an image or workload this policy evaluates.
+                        Control which parts of a workload this policy evaluates.
                     </Content>
                 </Stack>
             </FlexItem>
@@ -74,7 +78,7 @@ function PolicyFiltersForm() {
                             <Alert
                                 isInline
                                 variant="info"
-                                title="Container type filters require the Deploy or Runtime lifecycle stage."
+                                title={containerTypeFilterMessage}
                                 component="p"
                             />
                         )}
@@ -88,17 +92,15 @@ function PolicyFiltersForm() {
                                         isDisabled={containerFilterDisabled}
                                         onChange={handleSkipInitChange}
                                     />
-                                    <Alert
-                                        isInline
-                                        isPlain
-                                        variant="info"
-                                        title={
-                                            containerFilterDisabled
-                                                ? 'Container type filtering is only available for policies with the Deploy or Runtime lifecycle stage.'
-                                                : containerTypeDescription
-                                        }
-                                        component="p"
-                                    />
+                                    {!containerFilterDisabled && (
+                                        <Alert
+                                            isInline
+                                            isPlain
+                                            variant="info"
+                                            title={containerTypeDescription}
+                                            component="p"
+                                        />
+                                    )}
                                 </Stack>
                             </FormGroup>
                         </Form>
diff --git a/ui/apps/platform/src/Containers/Policies/policies.utils.test.ts b/ui/apps/platform/src/Containers/Policies/policies.utils.test.ts
index 5486eb100dd70..b081f25c24a2f 100644
--- a/ui/apps/platform/src/Containers/Policies/policies.utils.test.ts
+++ b/ui/apps/platform/src/Containers/Policies/policies.utils.test.ts
@@ -1,5 +1,6 @@
 import type { ClientPolicy, Policy } from 'types/policy.proto';
 import {
+    containerTypeFilterApplies,
     getClientWizardPolicy,
     getLifeCyclesUpdates,
     getPolicyOriginLabel,
@@ -885,4 +886,17 @@ describe('policies.utils', () => {
             });
         });
     });
+
+    describe('containerTypeFilterApplies', () => {
+        it('applies to deploy-time policies and runtime policies with a deployment event source', () => {
+            expect(containerTypeFilterApplies(['DEPLOY'], 'NOT_APPLICABLE')).toBe(true);
+            expect(containerTypeFilterApplies(['BUILD', 'DEPLOY'], 'NOT_APPLICABLE')).toBe(true);
+            expect(containerTypeFilterApplies(['RUNTIME'], 'DEPLOYMENT_EVENT')).toBe(true);
+            expect(containerTypeFilterApplies(['BUILD'], 'NOT_APPLICABLE')).toBe(false);
+            expect(containerTypeFilterApplies(['RUNTIME'], 'NOT_APPLICABLE')).toBe(false);
+            expect(containerTypeFilterApplies(['RUNTIME'], 'AUDIT_LOG_EVENT')).toBe(false);
+            expect(containerTypeFilterApplies(['RUNTIME'], 'NODE_EVENT')).toBe(false);
+            expect(containerTypeFilterApplies([], 'NOT_APPLICABLE')).toBe(false);
+        });
+    });
 });
diff --git a/ui/apps/platform/src/Containers/Policies/policies.utils.ts b/ui/apps/platform/src/Containers/Policies/policies.utils.ts
index aa56679a45f5f..20564da4ed15e 100644
--- a/ui/apps/platform/src/Containers/Policies/policies.utils.ts
+++ b/ui/apps/platform/src/Containers/Policies/policies.utils.ts
@@ -82,6 +82,18 @@ export const initialPolicy: ClientPolicy = {
     },
 };
 
+// Container type filters apply to deploy-time policies and to runtime policies
+// whose event source is deployment events.
+export function containerTypeFilterApplies(
+    lifecycleStages: LifecycleStage[],
+    eventSource: PolicyEventSource
+): boolean {
+    return (
+        lifecycleStages.includes('DEPLOY') ||
+        (lifecycleStages.includes('RUNTIME') && eventSource === 'DEPLOYMENT_EVENT')
+    );
+}
+
 export type PoliciesSearch = {
     pageAction?: ExtendedPageAction;
     searchFilter?: SearchFilter;
diff --git a/ui/apps/platform/src/Containers/Risk/AiRiskSummary/AiRiskSummaryCard.cy.jsx b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/AiRiskSummaryCard.cy.jsx
new file mode 100644
index 0000000000000..805198e0dac47
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/AiRiskSummaryCard.cy.jsx
@@ -0,0 +1,76 @@
+import AiRiskSummaryCard from './AiRiskSummaryCard';
+
+const summaryText = 'sync-worker scores 67/100 (Important).\nMain drivers: suspicious processes.';
+
+function setup(props = {}) {
+    cy.mount(
+        <AiRiskSummaryCard
+            summary={undefined}
+            isLoading={false}
+            error={undefined}
+            isExpanded
+            onExpand={() => {}}
+            onRetry={() => {}}
+            {...props}
+        />
+    );
+}
+
+describe(Cypress.spec.relative, () => {
+    it('should show a spinner while the summary is loading', () => {
+        setup({ isLoading: true });
+
+        cy.get('[aria-label="Generating AI risk summary"]').should('exist');
+        cy.contains('Always review AI-generated content prior to use.').should('not.exist');
+    });
+
+    it('should render an error alert with a retry action when the request fails', () => {
+        const onRetry = cy.stub().as('onRetry');
+        setup({ error: new Error('something went wrong'), onRetry });
+
+        cy.contains('Unable to generate AI risk summary').should('exist');
+        cy.contains('something went wrong').should('exist');
+        cy.contains('Always review AI-generated content prior to use.').should('not.exist');
+
+        cy.contains('button', 'Try again').click();
+        cy.get('@onRetry').should('have.been.calledOnce');
+    });
+
+    it('should render the summary with the review disclaimer on success', () => {
+        setup({ summary: summaryText });
+
+        cy.contains('AI risk briefing').should('exist');
+        cy.contains('Always review AI-generated content prior to use.').should('exist');
+        cy.contains('sync-worker scores 67/100 (Important).').should('exist');
+        cy.get('[aria-label="Generating AI risk summary"]').should('not.exist');
+    });
+
+    it('should copy the summary to the clipboard', () => {
+        setup({ summary: summaryText });
+
+        cy.get('button[aria-label="Copy AI summary to clipboard"]').click();
+
+        cy.window().then((window) => {
+            window.navigator.clipboard.readText().then((text) => {
+                expect(text).to.eq(summaryText);
+            });
+        });
+    });
+
+    it('should invoke onExpand when the collapse toggle is clicked', () => {
+        const onExpand = cy.stub().as('onExpand');
+        setup({ summary: summaryText, onExpand });
+
+        cy.get('button[aria-label="Collapse AI risk briefing"]').click();
+        cy.get('@onExpand').should('have.been.calledOnce');
+    });
+
+    it('should hide the summary body when collapsed', () => {
+        setup({ summary: summaryText, isExpanded: false });
+
+        // The title remains, but the collapsed card removes its body from the DOM.
+        cy.contains('AI risk briefing').should('exist');
+        cy.contains('sync-worker scores 67/100 (Important).').should('not.exist');
+        cy.get('button[aria-label="Expand AI risk briefing"]').should('exist');
+    });
+});
diff --git a/ui/apps/platform/src/Containers/Risk/AiRiskSummary/AiRiskSummaryCard.tsx b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/AiRiskSummaryCard.tsx
new file mode 100644
index 0000000000000..1ccc2ebbc0097
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/AiRiskSummaryCard.tsx
@@ -0,0 +1,120 @@
+import type { ReactElement } from 'react';
+import {
+    Alert,
+    AlertActionLink,
+    Bullseye,
+    Button,
+    Card,
+    CardBody,
+    CardExpandableContent,
+    CardHeader,
+    CardTitle,
+    Content,
+    Flex,
+    FlexItem,
+    Spinner,
+} from '@patternfly/react-core';
+import { CopyIcon } from '@patternfly/react-icons';
+
+import useClipboardCopy from 'hooks/useClipboardCopy';
+import AiExperienceIcon from 'images/aiExperience.svg?react';
+import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
+
+export type AiRiskSummaryCardProps = {
+    summary: string | undefined;
+    isLoading: boolean;
+    error: unknown;
+    isExpanded: boolean;
+    onExpand: () => void;
+    onRetry: () => void;
+};
+
+function AiRiskSummaryCard({
+    summary,
+    isLoading,
+    error,
+    isExpanded,
+    onExpand,
+    onRetry,
+}: AiRiskSummaryCardProps): ReactElement {
+    const { wasCopied, copyToClipboard } = useClipboardCopy();
+
+    return (
+        <Card id="ai-risk-summary-card" isExpanded={isExpanded}>
+            <CardHeader
+                onExpand={onExpand}
+                toggleButtonProps={{
+                    id: 'ai-risk-summary-toggle',
+                    'aria-label': isExpanded
+                        ? 'Collapse AI risk briefing'
+                        : 'Expand AI risk briefing',
+                    'aria-labelledby': 'ai-risk-summary-card ai-risk-summary-toggle',
+                    'aria-expanded': isExpanded,
+                }}
+                actions={{
+                    actions: (
+                        <Button
+                            variant="plain"
+                            icon={<CopyIcon />}
+                            aria-label={
+                                wasCopied ? 'Copied AI summary' : 'Copy AI summary to clipboard'
+                            }
+                            isDisabled={!summary}
+                            onClick={() => summary && copyToClipboard(summary)}
+                        />
+                    ),
+                }}
+            >
+                <CardTitle>
+                    <Flex
+                        alignItems={{ default: 'alignItemsCenter' }}
+                        spaceItems={{ default: 'spaceItemsSm' }}
+                    >
+                        <AiExperienceIcon />
+                        <FlexItem>AI risk briefing</FlexItem>
+                    </Flex>
+                </CardTitle>
+            </CardHeader>
+            <CardExpandableContent>
+                <CardBody>
+                    {isLoading && (
+                        <Bullseye>
+                            <Spinner aria-label="Generating AI risk summary" />
+                        </Bullseye>
+                    )}
+                    {!isLoading && Boolean(error) && (
+                        <Alert
+                            variant="danger"
+                            isInline
+                            title="Unable to generate AI risk summary"
+                            component="p"
+                            actionLinks={
+                                <AlertActionLink onClick={onRetry}>Try again</AlertActionLink>
+                            }
+                        >
+                            {getAxiosErrorMessage(error)}
+                        </Alert>
+                    )}
+                    {!isLoading && !error && (
+                        <Flex
+                            direction={{ default: 'column' }}
+                            spaceItems={{ default: 'spaceItemsMd' }}
+                        >
+                            <Alert
+                                variant="info"
+                                isInline
+                                title="Always review AI-generated content prior to use."
+                                component="p"
+                            />
+                            <Content component="p" style={{ whiteSpace: 'pre-wrap' }}>
+                                {summary}
+                            </Content>
+                        </Flex>
+                    )}
+                </CardBody>
+            </CardExpandableContent>
+        </Card>
+    );
+}
+
+export default AiRiskSummaryCard;
diff --git a/ui/apps/platform/src/Containers/Risk/AiRiskSummary/riskSummaryCache.test.ts b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/riskSummaryCache.test.ts
new file mode 100644
index 0000000000000..9bf846e3f1c53
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/riskSummaryCache.test.ts
@@ -0,0 +1,93 @@
+import type { DeploymentRiskSummary } from 'services/DeploymentsService';
+
+const mockFetch = vi.hoisted(() => vi.fn());
+vi.mock('services/DeploymentsService', () => ({
+    fetchDeploymentRiskSummary: mockFetch,
+}));
+
+// The cache keeps state at module scope, so load a fresh copy for each test to
+// keep them isolated (rather than adding a test-only reset to the module).
+async function loadCache() {
+    vi.resetModules();
+    return import('./riskSummaryCache');
+}
+
+describe('riskSummaryCache', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+
+    it('fetches and returns the summary for a deployment', async () => {
+        mockFetch.mockResolvedValue({ summary: 'risk briefing' });
+        const { fetchCachedDeploymentRiskSummary } = await loadCache();
+
+        await expect(fetchCachedDeploymentRiskSummary('dep-1')).resolves.toEqual({
+            summary: 'risk briefing',
+        });
+        expect(mockFetch).toHaveBeenCalledExactlyOnceWith('dep-1');
+    });
+
+    it('caches the result and does not fetch again on a subsequent call', async () => {
+        mockFetch.mockResolvedValue({ summary: 'cached' });
+        const { fetchCachedDeploymentRiskSummary } = await loadCache();
+
+        await fetchCachedDeploymentRiskSummary('dep-1');
+        await fetchCachedDeploymentRiskSummary('dep-1');
+
+        expect(mockFetch).toHaveBeenCalledTimes(1);
+    });
+
+    it('dedupes concurrent in-flight requests for the same deployment', async () => {
+        let resolveFetch: (value: DeploymentRiskSummary) => void = () => {};
+        mockFetch.mockImplementation(
+            () =>
+                new Promise<DeploymentRiskSummary>((resolve) => {
+                    resolveFetch = resolve;
+                })
+        );
+        const { fetchCachedDeploymentRiskSummary } = await loadCache();
+
+        const first = fetchCachedDeploymentRiskSummary('dep-1');
+        const second = fetchCachedDeploymentRiskSummary('dep-1');
+        expect(mockFetch).toHaveBeenCalledTimes(1);
+
+        resolveFetch({ summary: 'shared' });
+        await expect(first).resolves.toEqual({ summary: 'shared' });
+        await expect(second).resolves.toEqual({ summary: 'shared' });
+    });
+
+    it('caches per deployment id', async () => {
+        mockFetch.mockImplementation((id: string) => Promise.resolve({ summary: `summary ${id}` }));
+        const { fetchCachedDeploymentRiskSummary, peekCachedDeploymentRiskSummary } =
+            await loadCache();
+
+        await fetchCachedDeploymentRiskSummary('dep-1');
+        await fetchCachedDeploymentRiskSummary('dep-2');
+
+        expect(mockFetch).toHaveBeenCalledTimes(2);
+        expect(peekCachedDeploymentRiskSummary('dep-1')).toEqual({ summary: 'summary dep-1' });
+        expect(peekCachedDeploymentRiskSummary('dep-2')).toEqual({ summary: 'summary dep-2' });
+    });
+
+    it('does not cache failures and retries on the next attempt', async () => {
+        mockFetch
+            .mockRejectedValueOnce(new Error('boom'))
+            .mockResolvedValueOnce({ summary: 'recovered' });
+        const { fetchCachedDeploymentRiskSummary, peekCachedDeploymentRiskSummary } =
+            await loadCache();
+
+        await expect(fetchCachedDeploymentRiskSummary('dep-1')).rejects.toThrow('boom');
+        expect(peekCachedDeploymentRiskSummary('dep-1')).toBeUndefined();
+
+        await expect(fetchCachedDeploymentRiskSummary('dep-1')).resolves.toEqual({
+            summary: 'recovered',
+        });
+        expect(mockFetch).toHaveBeenCalledTimes(2);
+        expect(peekCachedDeploymentRiskSummary('dep-1')).toEqual({ summary: 'recovered' });
+    });
+
+    it('peek returns undefined before a summary has been fetched', async () => {
+        const { peekCachedDeploymentRiskSummary } = await loadCache();
+        expect(peekCachedDeploymentRiskSummary('dep-1')).toBeUndefined();
+    });
+});
diff --git a/ui/apps/platform/src/Containers/Risk/AiRiskSummary/riskSummaryCache.ts b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/riskSummaryCache.ts
new file mode 100644
index 0000000000000..a056626a85c5d
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/riskSummaryCache.ts
@@ -0,0 +1,46 @@
+import { fetchDeploymentRiskSummary } from 'services/DeploymentsService';
+import type { DeploymentRiskSummary } from 'services/DeploymentsService';
+
+// Session-scoped cache for AI risk summaries, keyed by deployment id. Generating a
+// summary is expensive and the result should be relatively stable for a deployment within a browser
+// session, so resolved summaries are cached and in-flight requests are deduped at
+// module scope. The cache therefore persists across page navigations (until a full
+// reload) - the behavior a query library would provide,
+// without the dependency. Failures are not cached, so a later attempt retries.
+
+const resolved = new Map<string, DeploymentRiskSummary>();
+const inFlight = new Map<string, Promise<DeploymentRiskSummary>>();
+
+/** Fetches the summary, returning the cached value or an in-flight request when available. */
+export function fetchCachedDeploymentRiskSummary(
+    deploymentId: string
+): Promise<DeploymentRiskSummary> {
+    const cached = resolved.get(deploymentId);
+    if (cached) {
+        return Promise.resolve(cached);
+    }
+    const pending = inFlight.get(deploymentId);
+    if (pending) {
+        return pending;
+    }
+    const request = fetchDeploymentRiskSummary(deploymentId)
+        .then((summary) => {
+            resolved.set(deploymentId, summary);
+            return summary;
+        })
+        .finally(() => {
+            inFlight.delete(deploymentId);
+        });
+    inFlight.set(deploymentId, request);
+    return request;
+}
+
+/**
+ * Synchronous read of an already-cached summary, if any. Lets a freshly mounted
+ * component render a previously fetched summary immediately without re-investigating.
+ */
+export function peekCachedDeploymentRiskSummary(
+    deploymentId: string
+): DeploymentRiskSummary | undefined {
+    return resolved.get(deploymentId);
+}
diff --git a/ui/apps/platform/src/Containers/Risk/AiRiskSummary/useAiRiskSummary.ts b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/useAiRiskSummary.ts
new file mode 100644
index 0000000000000..ecb4bf8d588d0
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Risk/AiRiskSummary/useAiRiskSummary.ts
@@ -0,0 +1,52 @@
+import { useState } from 'react';
+
+import useRestMutation from 'hooks/useRestMutation';
+import type { DeploymentRiskSummary } from 'services/DeploymentsService';
+
+import {
+    fetchCachedDeploymentRiskSummary,
+    peekCachedDeploymentRiskSummary,
+} from './riskSummaryCache';
+
+export type UseAiRiskSummaryReturn = {
+    isPresent: boolean;
+    isExpanded: boolean;
+    summary: DeploymentRiskSummary | undefined;
+    isLoading: boolean;
+    error: unknown;
+    investigate: () => void;
+    setExpanded: (isExpanded: boolean) => void;
+};
+
+export default function useAiRiskSummary(deploymentId: string): UseAiRiskSummaryReturn {
+    const [isExpanded, setIsExpanded] = useState(false);
+    const { isLoading, error, mutate } = useRestMutation(fetchCachedDeploymentRiskSummary);
+
+    // Read the summary from the session cache if it exists
+    const summary = peekCachedDeploymentRiskSummary(deploymentId);
+
+    // The card is present (collapsed or expanded) whenever there is a cached result to
+    // surface, a request in flight, an error to report, or the user has expanded it this
+    // session. A cached result on a fresh mount renders the card collapsed, so navigating
+    // back to a deployment shows that recent results exist without re-spending tokens.
+    const isPresent = Boolean(summary) || isLoading || Boolean(error) || isExpanded;
+
+    function investigate() {
+        setIsExpanded(true);
+        // Already cached this session, or a request is in flight - nothing to fetch.
+        if (summary || isLoading) {
+            return;
+        }
+        mutate(deploymentId);
+    }
+
+    return {
+        isPresent,
+        isExpanded,
+        summary,
+        isLoading,
+        error,
+        investigate,
+        setExpanded: setIsExpanded,
+    };
+}
diff --git a/ui/apps/platform/src/Containers/Risk/RiskDetailsPage.tsx b/ui/apps/platform/src/Containers/Risk/RiskDetailsPage.tsx
index 232e4bc577baf..8f1cbc5878362 100644
--- a/ui/apps/platform/src/Containers/Risk/RiskDetailsPage.tsx
+++ b/ui/apps/platform/src/Containers/Risk/RiskDetailsPage.tsx
@@ -25,10 +25,16 @@ import {
     riskPlatformViewPath,
     riskUserWorkloadsViewPath,
 } from 'routePaths';
+import useFeatureFlags from 'hooks/useFeatureFlags';
 import useIsRouteEnabled from 'hooks/useIsRouteEnabled';
+import useLightspeedStatus from 'hooks/useLightspeedStatus';
+import AiExperienceIcon from 'images/aiExperience.svg?react';
 
 import RiskDetailTabs from './RiskDetailTabs';
 import useDeploymentWithRisk from './useDeploymentWithRisk';
+import AiRiskSummaryCard from './AiRiskSummary/AiRiskSummaryCard';
+import useAiRiskSummary from './AiRiskSummary/useAiRiskSummary';
+import ConditionalTooltip from 'Components/ConditionalTooltip';
 
 function getRiskBreadcrumb(filteredWorkflowView: FilteredWorkflowView) {
     // Note: We cannot exhaustively check for all possible values of filteredWorkflowView because
@@ -52,6 +58,13 @@ function RiskDetailsPage(): ReactElement {
 
     const { filteredWorkflowView } = useFilteredWorkflowViewURLState();
 
+    const { isFeatureFlagEnabled } = useFeatureFlags();
+    const isRiskSummaryEnabled = isFeatureFlagEnabled('ROX_LIGHTSPEED_RISK_SUMMARY');
+    const { isAvailable } = useLightspeedStatus();
+    const isAiSummaryAvailable = isRiskSummaryEnabled && isAvailable;
+    const aiRiskSummary = useAiRiskSummary(deploymentId);
+    const hasAiRiskSummary = Boolean(aiRiskSummary.summary);
+
     const isRouteEnabled = useIsRouteEnabled();
     const isRouteEnabledForNetworkGraph = isRouteEnabled('network-graph');
 
@@ -76,22 +89,58 @@ function RiskDetailsPage(): ReactElement {
                         <Skeleton width="25%" screenreaderText="Loading deployment information" />
                     )}
                     <FlexItem>
-                        {isRouteEnabledForNetworkGraph && data && (
-                            <Button
-                                variant="link"
-                                href={getLinkToDeploymentInNetworkGraph({
-                                    cluster: data.deployment.clusterName,
-                                    namespace: data.deployment.namespace,
-                                    deploymentId: data.deployment.id,
-                                })}
-                                component={LinkShim}
-                            >
-                                View Deployment in Network Graph
-                            </Button>
-                        )}
+                        <Flex
+                            alignItems={{ default: 'alignItemsCenter' }}
+                            spaceItems={{ default: 'spaceItemsMd' }}
+                        >
+                            {isRouteEnabledForNetworkGraph && data && (
+                                <FlexItem>
+                                    <Button
+                                        variant="link"
+                                        href={getLinkToDeploymentInNetworkGraph({
+                                            cluster: data.deployment.clusterName,
+                                            namespace: data.deployment.namespace,
+                                            deploymentId: data.deployment.id,
+                                        })}
+                                        component={LinkShim}
+                                    >
+                                        View Deployment in Network Graph
+                                    </Button>
+                                </FlexItem>
+                            )}
+                            {isAiSummaryAvailable && data && (
+                                <FlexItem>
+                                    <ConditionalTooltip
+                                        renderTooltip={hasAiRiskSummary}
+                                        content="A Risk Summary has already been generated for this deployment."
+                                    >
+                                        <Button
+                                            variant="primary"
+                                            icon={<AiExperienceIcon />}
+                                            onClick={aiRiskSummary.investigate}
+                                            isAriaDisabled={hasAiRiskSummary}
+                                        >
+                                            Investigate with AI
+                                        </Button>
+                                    </ConditionalTooltip>
+                                </FlexItem>
+                            )}
+                        </Flex>
                     </FlexItem>
                 </Flex>
             </PageSection>
+            {isAiSummaryAvailable && aiRiskSummary.isPresent && data && (
+                <PageSection>
+                    <AiRiskSummaryCard
+                        summary={aiRiskSummary.summary?.summary}
+                        isLoading={aiRiskSummary.isLoading}
+                        error={aiRiskSummary.error}
+                        isExpanded={aiRiskSummary.isExpanded}
+                        onExpand={() => aiRiskSummary.setExpanded(!aiRiskSummary.isExpanded)}
+                        onRetry={aiRiskSummary.investigate}
+                    />
+                </PageSection>
+            )}
             {error && (
                 <TableErrorComponent
                     error={error}
diff --git a/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.cy.jsx b/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.cy.jsx
index f609bbeba28a9..15d4a0ec3f2cf 100644
--- a/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.cy.jsx
+++ b/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.cy.jsx
@@ -5,7 +5,7 @@ function patchDatabaseStatusResponse(overrides = {}) {
         req.reply({
             databaseAvailable: true,
             databaseType: 'PostgresDB',
-            databaseVersion: '15.0',
+            databaseVersion: '16.0',
             databaseIsExternal: false,
             ...overrides,
         });
@@ -20,7 +20,7 @@ describe(Cypress.spec.relative, () => {
         patchDatabaseStatusResponse();
         cy.mount(<CentralDatabaseHealthCard />);
         cy.get(`${cardHeader}:contains("no errors")`);
-        cy.get(`${cardHeader}:contains("PostgresDB 15.0")`);
+        cy.get(`${cardHeader}:contains("PostgresDB 16.0")`);
     });
 
     it('should not show a warning if the database is external', () => {
diff --git a/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.tsx b/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.tsx
index 83430c2e5b54e..66376891a1f6c 100644
--- a/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.tsx
+++ b/ui/apps/platform/src/Containers/SystemHealth/CentralDatabaseHealth/CentralDatabaseHealthCard.tsx
@@ -20,7 +20,7 @@ function isDatabaseVersionSupported(databaseVersion: string | undefined): boolea
     if (!databaseVersion) {
         return true;
     }
-    return databaseVersion.startsWith('15');
+    return databaseVersion.startsWith('16');
 }
 
 function getDatabaseHealthInfo(data: DatabaseStatus | undefined): {
@@ -42,7 +42,7 @@ function getDatabaseHealthInfo(data: DatabaseStatus | undefined): {
             messages: [
                 'Running an unsupported configuration of PostgreSQL',
                 `Current version:  ${data.databaseVersion}`,
-                `Required version: 15`,
+                `Required version: 16`,
             ],
         };
     }
diff --git a/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealth.utils.ts b/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealth.utils.ts
index f34244482922f..9c505fc548df3 100644
--- a/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealth.utils.ts
+++ b/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealth.utils.ts
@@ -1,7 +1,4 @@
-import {
-    findUpgradeState,
-    getCredentialExpirationStatus,
-} from 'Containers/Clusters/cluster.helpers';
+import { getCredentialExpirationStatus } from 'Containers/Clusters/cluster.helpers';
 import type { CertExpiryStatus } from 'Containers/Clusters/clusterTypes'; // TODO types/cluster.proto.ts
 import type { Cluster } from 'types/cluster.proto';
 
@@ -50,37 +47,6 @@ export function getCertificateExpirationCounts(
     return counts;
 }
 
-export function getSensorUpgradeCounts(clusters: Cluster[]): ClusterStatusCounts {
-    const counts = getClusterStatusCountsObject();
-
-    clusters.forEach((cluster) => {
-        if (cluster && cluster.healthStatus) {
-            switch (cluster.healthStatus.overallHealthStatus) {
-                case 'UNAVAILABLE':
-                case 'UNINITIALIZED': {
-                    counts[cluster.healthStatus.overallHealthStatus] += 1;
-                    break;
-                }
-                default: {
-                    const { upgradeStatus } = cluster.status ?? {};
-                    const upgradeState = findUpgradeState(upgradeStatus);
-
-                    const key =
-                        upgradeState?.type === 'current'
-                            ? 'HEALTHY'
-                            : upgradeState?.type === 'failure'
-                              ? 'UNHEALTHY'
-                              : 'DEGRADED';
-
-                    counts[key] += 1;
-                }
-            }
-        }
-    });
-
-    return counts;
-}
-
 export function getClusterStatusCounts(clusters: Cluster[]): ClusterStatusCounts {
     const counts = getClusterStatusCountsObject();
 
diff --git a/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealthCards.tsx b/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealthCards.tsx
index 874fdc2b7912f..8326d97f94035 100644
--- a/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealthCards.tsx
+++ b/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/ClustersHealthCards.tsx
@@ -2,7 +2,6 @@ import { useEffect, useState } from 'react';
 import type { ReactElement } from 'react';
 import { GridItem } from '@patternfly/react-core';
 
-import useFeatureFlags from 'hooks/useFeatureFlags';
 import { fetchClusters } from 'services/ClustersService';
 import type { Cluster } from 'types/cluster.proto';
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
@@ -10,7 +9,6 @@ import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
 import ClusterStatusCard from './ClusterStatusCard';
 import CredentialExpirationCard from './CredentialExpirationCard';
 import SensorCompatibilityCard from './SensorCompatibilityCard';
-import SensorUpgradeCard from './SensorUpgradeCard';
 
 type ClustersHealthCardsProps = {
     pollingCount: number;
@@ -23,9 +21,6 @@ const ClustersHealthCards = ({ pollingCount }: ClustersHealthCardsProps): ReactE
 
     const [currentDatetime, setCurrentDatetime] = useState<Date | null>(null);
 
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const showCompatibilityStatus = isFeatureFlagEnabled('ROX_SENSOR_COMPATIBILITY_STATUS');
-
     useEffect(() => {
         setIsFetching(true);
         fetchClusters()
@@ -59,19 +54,11 @@ const ClustersHealthCards = ({ pollingCount }: ClustersHealthCardsProps): ReactE
                 />
             </GridItem>
             <GridItem span={12}>
-                {showCompatibilityStatus ? (
-                    <SensorCompatibilityCard
-                        clusters={clusters}
-                        isFetchingInitialRequest={isFetchingInitialRequest}
-                        errorMessageFetching={errorMessageFetching}
-                    />
-                ) : (
-                    <SensorUpgradeCard
-                        clusters={clusters}
-                        isFetchingInitialRequest={isFetchingInitialRequest}
-                        errorMessageFetching={errorMessageFetching}
-                    />
-                )}
+                <SensorCompatibilityCard
+                    clusters={clusters}
+                    isFetchingInitialRequest={isFetchingInitialRequest}
+                    errorMessageFetching={errorMessageFetching}
+                />
             </GridItem>
             <GridItem span={12}>
                 <CredentialExpirationCard
diff --git a/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/SensorUpgradeCard.tsx b/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/SensorUpgradeCard.tsx
deleted file mode 100644
index 25c39c23920ad..0000000000000
--- a/ui/apps/platform/src/Containers/SystemHealth/ClustersHealth/SensorUpgradeCard.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-import type { ReactElement } from 'react';
-import { Alert, Card, CardBody } from '@patternfly/react-core';
-import { Table, Tbody, Th, Tr } from '@patternfly/react-table';
-
-import type { Cluster } from 'types/cluster.proto';
-
-import { getSensorUpgradeCounts } from './ClustersHealth.utils';
-import ClustersHealthCardHeader from './ClustersHealthCardHeader';
-import {
-    TdDegraded,
-    TdHealthy,
-    TdTotal,
-    TdUnavailable,
-    TdUnhealthy,
-    TdUninitialized,
-    TheadClustersHealth,
-} from './ClustersHealthTable';
-
-const dataLabelHealthy = 'Up to date';
-const dataLabelUnhealthy = 'Failed';
-const dataLabelDegraded = 'Out of date';
-
-export type SensorUpgradeCardProps = {
-    clusters: Cluster[];
-    isFetchingInitialRequest: boolean;
-    errorMessageFetching: string;
-};
-
-function SensorUpgradeCard({
-    clusters,
-    isFetchingInitialRequest,
-    errorMessageFetching,
-}: SensorUpgradeCardProps): ReactElement {
-    const counts =
-        !isFetchingInitialRequest && !errorMessageFetching
-            ? getSensorUpgradeCounts(clusters)
-            : null;
-
-    /*
-     * Render card header without body:
-     * with spinner, if fetching first request
-     * with check mark, if counts are healthy: HEALTHY !== 0 and UNHEALTHY === 0 && DEGRADED === 0
-     *
-     * Render card body:
-     * for request error
-     * for table of counts if not healthy: HEALTHY === 0 || UNHEALTHY !== 0 || DEGRADED !== 0
-     */
-
-    return (
-        <Card isCompact>
-            <ClustersHealthCardHeader
-                counts={counts}
-                isFetchingInitialRequest={isFetchingInitialRequest}
-                title="Sensor upgrade"
-            />
-            {errorMessageFetching ? (
-                <CardBody>
-                    <Alert isInline variant="warning" title={errorMessageFetching} component="p" />
-                </CardBody>
-            ) : counts !== null &&
-              (counts.HEALTHY === 0 || counts.UNHEALTHY !== 0 || counts.DEGRADED !== 0) ? (
-                <CardBody>
-                    <Table variant="compact">
-                        <TheadClustersHealth
-                            dataLabelHealthy={dataLabelHealthy}
-                            dataLabelUnhealthy={dataLabelUnhealthy}
-                            dataLabelDegraded={dataLabelDegraded}
-                        />
-                        <Tbody>
-                            <Tr>
-                                <Th scope="row">Clusters</Th>
-                                <TdHealthy count={counts.HEALTHY} dataLabel={dataLabelHealthy} />
-                                <TdUnhealthy
-                                    count={counts.UNHEALTHY}
-                                    dataLabel={dataLabelUnhealthy}
-                                />
-                                <TdDegraded count={counts.DEGRADED} dataLabel={dataLabelDegraded} />
-                                <TdUnavailable count={counts.UNAVAILABLE} />
-                                <TdUninitialized count={counts.UNINITIALIZED} />
-                                <TdTotal count={clusters.length} />
-                            </Tr>
-                        </Tbody>
-                    </Table>
-                </CardBody>
-            ) : null}
-        </Card>
-    );
-}
-
-export default SensorUpgradeCard;
diff --git a/ui/apps/platform/src/Containers/SystemHealth/SystemHealthPage.tsx b/ui/apps/platform/src/Containers/SystemHealth/SystemHealthPage.tsx
index 35af7fe92200a..54b146c40e019 100644
--- a/ui/apps/platform/src/Containers/SystemHealth/SystemHealthPage.tsx
+++ b/ui/apps/platform/src/Containers/SystemHealth/SystemHealthPage.tsx
@@ -1,13 +1,5 @@
 import { useState } from 'react';
-import {
-    Divider,
-    Flex,
-    FlexItem,
-    Grid,
-    GridItem,
-    PageSection,
-    Title,
-} from '@patternfly/react-core';
+import { Flex, FlexItem, Grid, GridItem, PageSection, Title } from '@patternfly/react-core';
 
 import useCentralCapabilities from 'hooks/useCentralCapabilities';
 import useInterval from 'hooks/useInterval';
@@ -139,31 +131,6 @@ function SystemHealthPage() {
                             />
                         </GridItem>
                     )}
-                    {!isLegacyScannerEnabled && (
-                        <GridItem span={12}>
-                            <Divider />
-                        </GridItem>
-                    )}
-                    {!isLegacyScannerEnabled && hasReadAccessForAdministration && (
-                        <GridItem span={12}>
-                            <VulnerabilityDefinitionsHealthCard
-                                component="SCANNER"
-                                pollingCount={pollingCountSlower}
-                                disabled={!isLegacyScannerEnabled}
-                                disabledMessage="Legacy Scanner [deprecated] has been disabled by your administrator"
-                            />
-                        </GridItem>
-                    )}
-                    {!isLegacyScannerEnabled && (
-                        <GridItem span={12}>
-                            <CertificateCard
-                                component="SCANNER"
-                                pollingCount={pollingCountSlower}
-                                disabled={!isLegacyScannerEnabled}
-                                disabledMessage="Legacy scanner [deprecated] has been disabled by your administrator"
-                            />
-                        </GridItem>
-                    )}
                 </Grid>
             </PageSection>
         </>
diff --git a/ui/apps/platform/src/Containers/Violations/Details/ViolationDetailsPage.tsx b/ui/apps/platform/src/Containers/Violations/Details/ViolationDetailsPage.tsx
index d83d5853dfa96..0609ab702a8d5 100644
--- a/ui/apps/platform/src/Containers/Violations/Details/ViolationDetailsPage.tsx
+++ b/ui/apps/platform/src/Containers/Violations/Details/ViolationDetailsPage.tsx
@@ -135,11 +135,7 @@ function ViolationDetailsPage(): ReactElement {
                     </Label>
                 )}
             </LabelGroup>
-            <PageSection
-                hasBodyWrapper={false}
-                variant="default"
-                padding={{ default: 'noPadding' }}
-            >
+            <PageSection type="tabs">
                 <Tabs
                     mountOnEnter
                     activeKey={activeTabKey}
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/CvesMenu.jsx b/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/CvesMenu.jsx
index a96718de1638f..17bdcf56d1087 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/CvesMenu.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/CvesMenu.jsx
@@ -5,6 +5,7 @@ import Loader from 'Components/Loader';
 import Menu from 'Components/Menu';
 import entityTypes from 'constants/entityTypes';
 import workflowStateContext from 'Containers/workflowStateContext';
+import useIsLegacyScannerEnabled from 'hooks/useIsLegacyScannerEnabled';
 import queryService from 'utils/queryService';
 
 function getURL(workflowState, entityType) {
@@ -26,6 +27,7 @@ const cveCountsQuery = gql`
 
 const CvesMenu = () => {
     const workflowState = useContext(workflowStateContext);
+    const isLegacyScannerEnabled = useIsLegacyScannerEnabled();
 
     const { loading, data = {} } = useQuery(cveCountsQuery, {
         variables: {
@@ -45,17 +47,20 @@ const CvesMenu = () => {
                   label: `${data.nodeVulnerabilityCount} Node CVEs`,
                   link: getURL(workflowState, entityTypes.NODE_CVE),
               },
-              {
-                  label: `${data.clusterVulnerabilityCount} Platform CVEs`,
-                  link: getURL(workflowState, entityTypes.CLUSTER_CVE),
-              },
+              ...(isLegacyScannerEnabled
+                  ? [
+                        {
+                            label: `${data.clusterVulnerabilityCount} Platform CVEs`,
+                            link: getURL(workflowState, entityTypes.CLUSTER_CVE),
+                        },
+                    ]
+                  : []),
           ]
         : [];
 
+    const clusterVulnCount = isLegacyScannerEnabled ? data.clusterVulnerabilityCount : 0;
     const totalCveCount =
-        data.imageVulnerabilityCount +
-            data.nodeVulnerabilityCount +
-            data.clusterVulnerabilityCount || 0;
+        data.imageVulnerabilityCount + data.nodeVulnerabilityCount + clusterVulnCount || 0;
     const menuTitle = `${totalCveCount} CVEs`;
 
     return (
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/VulnMgmtDashboardPage.jsx b/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/VulnMgmtDashboardPage.jsx
index 173485b8a42d9..55b8a3edbeefe 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/VulnMgmtDashboardPage.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/Dashboard/VulnMgmtDashboardPage.jsx
@@ -1,6 +1,7 @@
 import { useContext } from 'react';
 import { useNavigate } from 'react-router-dom-v5-compat';
 
+import useIsLegacyScannerEnabled from 'hooks/useIsLegacyScannerEnabled';
 import usePermissions from 'hooks/usePermissions';
 import entityTypes from 'constants/entityTypes';
 import { createOptions } from 'utils/workflowUtils';
@@ -30,6 +31,7 @@ const entityMenuTypes = [
 
 const VulnMgmtDashboardPage = () => {
     const navigate = useNavigate();
+    const isLegacyScannerEnabled = useIsLegacyScannerEnabled();
     const { hasReadAccess } = usePermissions();
     const hasReadAccessForIntegration = hasReadAccess('Integration');
     const workflowState = useContext(workflowStateContext);
@@ -118,9 +120,11 @@ const VulnMgmtDashboardPage = () => {
                 <div className="s-2 md:sy-2 md:sx-2 lg:sy-4 xxxl:sx-2">
                     <MostCommonVulnerabilities search={searchState} />
                 </div>
-                <div className="s-2 xxxl:sx-2">
-                    <ClustersWithMostClusterVulnerabilities />
-                </div>
+                {isLegacyScannerEnabled && (
+                    <div className="s-2 xxxl:sx-2">
+                        <ClustersWithMostClusterVulnerabilities />
+                    </div>
+                )}
             </DashboardLayout>
         </>
     );
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/Entity/Cluster/VulnMgmtClusterOverview.jsx b/ui/apps/platform/src/Containers/VulnMgmt/Entity/Cluster/VulnMgmtClusterOverview.jsx
index 77c7c3c7bfc5d..66fe1b0f3f7ff 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/Entity/Cluster/VulnMgmtClusterOverview.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/Entity/Cluster/VulnMgmtClusterOverview.jsx
@@ -8,6 +8,7 @@ import BinderTabs from 'Components/BinderTabs';
 import Tab from 'Components/Tab';
 import workflowStateContext from 'Containers/workflowStateContext';
 import entityTypes from 'constants/entityTypes';
+import useIsLegacyScannerEnabled from 'hooks/useIsLegacyScannerEnabled';
 import { OVERVIEW_LIMIT } from 'constants/workflowPages.constants';
 import { entityGridContainerClassName } from '../WorkflowEntityPage';
 
@@ -35,6 +36,7 @@ const emptyCluster = {
 
 const VulnMgmtClusterOverview = ({ data, entityContext }) => {
     const workflowState = useContext(workflowStateContext);
+    const isLegacyScannerEnabled = useIsLegacyScannerEnabled();
 
     // guard against incomplete GraphQL-cached data
     const safeData = { ...emptyCluster, ...data };
@@ -140,16 +142,18 @@ const VulnMgmtClusterOverview = ({ data, entityContext }) => {
                                     id={safeData?.id}
                                 />
                             </Tab>
-                            <Tab title="Fixable Platform CVEs">
-                                <TableWidgetFixableCves
-                                    workflowState={workflowState}
-                                    entityContext={entityContext}
-                                    entityType={entityTypes.CLUSTER}
-                                    vulnType={entityTypes.CLUSTER_CVE}
-                                    name={safeData?.name}
-                                    id={safeData?.id}
-                                />
-                            </Tab>
+                            {isLegacyScannerEnabled && (
+                                <Tab title="Fixable Platform CVEs">
+                                    <TableWidgetFixableCves
+                                        workflowState={workflowState}
+                                        entityContext={entityContext}
+                                        entityType={entityTypes.CLUSTER}
+                                        vulnType={entityTypes.CLUSTER_CVE}
+                                        name={safeData?.name}
+                                        id={safeData?.id}
+                                    />
+                                </Tab>
+                            )}
                         </BinderTabs>
                     </div>
                 </CollapsibleSection>
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/Entity/EntityTabs.tsx b/ui/apps/platform/src/Containers/VulnMgmt/Entity/EntityTabs.tsx
index 0e919f7202a81..2215086f4ba37 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/Entity/EntityTabs.tsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/Entity/EntityTabs.tsx
@@ -8,6 +8,7 @@ import {
     entityGroupMap,
 } from 'utils/entityRelationships';
 import type { VulnerabilityManagementEntityType } from 'utils/entityRelationships';
+import useIsLegacyScannerEnabled from 'hooks/useIsLegacyScannerEnabled';
 import workflowStateContext from '../../workflowStateContext';
 import { entityNounSentenceCasePlural } from '../entitiesForVulnerabilityManagement';
 
@@ -18,6 +19,8 @@ export type EntityTabsProps = {
 
 function EntityTabs({ entityType, activeTab }: EntityTabsProps): ReactElement {
     const workflowState = useContext(workflowStateContext);
+    const isLegacyScannerEnabled = useIsLegacyScannerEnabled();
+
     function getTab(tabType) {
         return {
             group: entityGroups[entityGroupMap[tabType]],
@@ -30,7 +33,7 @@ function EntityTabs({ entityType, activeTab }: EntityTabsProps): ReactElement {
     const relationships = [
         ...getVulnerabilityManagementEntityTypesByRelationship(entityType, 'MATCHES'),
         ...getVulnerabilityManagementEntityTypesByRelationship(entityType, 'CONTAINS'),
-    ];
+    ].filter((rel) => isLegacyScannerEnabled || rel !== 'CLUSTER_CVE');
 
     const entityTabs = relationships.map((entityTypeByRelationship) =>
         getTab(entityTypeByRelationship)
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/Entity/RelatedEntitiesSideList.tsx b/ui/apps/platform/src/Containers/VulnMgmt/Entity/RelatedEntitiesSideList.tsx
index 624b40389dc63..3ee2f2c8626e5 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/Entity/RelatedEntitiesSideList.tsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/Entity/RelatedEntitiesSideList.tsx
@@ -3,6 +3,7 @@ import type { ReactNode } from 'react';
 
 import { defaultCountKeyMap as countKeyMap } from 'constants/workflowPages.constants';
 import workflowStateContext from 'Containers/workflowStateContext';
+import useIsLegacyScannerEnabled from 'hooks/useIsLegacyScannerEnabled';
 import { getVulnerabilityManagementEntityTypesByRelationship } from 'utils/entityRelationships';
 import type { VulnerabilityManagementEntityType } from 'utils/entityRelationships';
 
@@ -20,12 +21,18 @@ function RelatedEntitiesSideList({
     entityContext,
 }: RelatedEntitiesSideListProps): ReactNode {
     const workflowState = useContext(workflowStateContext);
+    const isLegacyScannerEnabled = useIsLegacyScannerEnabled();
     const { useCase } = workflowState;
     if (!useCase) {
         return null;
     }
 
-    const matches = getVulnerabilityManagementEntityTypesByRelationship(entityType, 'MATCHES')
+    const matchRelationships = getVulnerabilityManagementEntityTypesByRelationship(
+        entityType,
+        'MATCHES'
+    ).filter((rel) => isLegacyScannerEnabled || rel !== 'CLUSTER_CVE');
+
+    const matches = matchRelationships
         .map((matchEntity) => {
             const count = data[countKeyMap[matchEntity]];
 
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/Entity/WorkflowEntityPageLayout.jsx b/ui/apps/platform/src/Containers/VulnMgmt/Entity/WorkflowEntityPageLayout.jsx
index c68e5da194d96..1754d84423292 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/Entity/WorkflowEntityPageLayout.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/Entity/WorkflowEntityPageLayout.jsx
@@ -10,6 +10,7 @@ import { searchParams, sortParams, pagingParams } from 'constants/searchParams';
 import { WorkflowState } from 'utils/WorkflowState';
 import { getVulnerabilityManagementEntityTypes } from 'utils/entityRelationships';
 import useEntityName from 'hooks/useEntityName';
+import useFeatureFlags from 'hooks/useFeatureFlags';
 
 import { entityNounSentenceCaseSingular } from '../entitiesForVulnerabilityManagement';
 import getSidePanelEntity from '../getSidePanelEntity';
@@ -19,6 +20,7 @@ import EntityTabs from './EntityTabs';
 
 const WorkflowEntityPageLayout = () => {
     const location = useLocation();
+    const { isFeatureFlagEnabled } = useFeatureFlags();
 
     const workflowState = parseURL(location);
     const { stateStack, useCase, search } = workflowState;
@@ -79,7 +81,9 @@ const WorkflowEntityPageLayout = () => {
                         <div className="flex items-center">
                             <EntitiesMenu
                                 text="All Entities"
-                                options={getVulnerabilityManagementEntityTypes()}
+                                options={getVulnerabilityManagementEntityTypes(
+                                    isFeatureFlagEnabled
+                                )}
                             />
                         </div>
                     </div>
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/List/Clusters/VulnMgmtListClusters.jsx b/ui/apps/platform/src/Containers/VulnMgmt/List/Clusters/VulnMgmtListClusters.jsx
index 78ded8414b4ee..9863f1600d9b1 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/List/Clusters/VulnMgmtListClusters.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/List/Clusters/VulnMgmtListClusters.jsx
@@ -15,6 +15,7 @@ import { CLUSTER_LIST_FRAGMENT_UPDATED } from 'Containers/VulnMgmt/VulnMgmt.frag
 import { workflowListPropTypes, workflowListDefaultProps } from 'constants/entityPageProps';
 import { clusterSortFields } from 'constants/sortFields';
 import { LIST_PAGE_SIZE } from 'constants/workflowPages.constants';
+import useIsLegacyScannerEnabled from 'hooks/useIsLegacyScannerEnabled';
 import removeEntityContextColumns from '../tableUtils';
 import { vulMgmtPolicyQuery } from '../../Entity/VulnMgmtPolicyQueryUtil';
 import { getVulnMgmtPathForEntitiesAndId } from '../../VulnMgmt.utils/entities';
@@ -29,6 +30,7 @@ export const defaultClusterSort = [
 ];
 
 const VulnMgmtListClusters = ({ selectedRowId, search, sort, page, data, totalResults }) => {
+    const isLegacyScannerEnabled = useIsLegacyScannerEnabled();
     const query = gql`
         query getClusters(
             $query: String
@@ -135,39 +137,41 @@ const VulnMgmtListClusters = ({ selectedRowId, search, sort, page, data, totalRe
                 accessor: 'vulnCounter.all.total',
                 sortField: clusterSortFields.CVE_COUNT,
             },
-            {
-                Header: `Platform CVEs`,
-                entityType: entityTypes.CLUSTER_CVE,
-                headerClassName: `w-1/8 ${defaultHeaderClassName}`,
-                className: `w-1/8 ${defaultColumnClassName}`,
-                Cell: ({ original, pdf }) => {
-                    const { clusterVulnerabilityCounter, id } = original;
-                    if (
-                        !clusterVulnerabilityCounter ||
-                        clusterVulnerabilityCounter.all.total === 0
-                    ) {
-                        return 'No CVEs';
-                    }
-
-                    const newState = workflowState
-                        .pushListItem(id)
-                        .pushList(entityTypes.CLUSTER_CVE);
-                    const url = newState.toUrl();
-                    const fixableUrl = newState.setSearch({ Fixable: true }).toUrl();
-
-                    return (
-                        <CVEStackedPill
-                            vulnCounter={clusterVulnerabilityCounter}
-                            url={url}
-                            fixableUrl={fixableUrl}
-                            hideLink={pdf}
-                        />
-                    );
-                },
-                id: clusterSortFields.CVE_COUNT,
-                accessor: 'vulnCounter.all.total',
-                sortField: clusterSortFields.CVE_COUNT,
-            },
+            isLegacyScannerEnabled
+                ? {
+                      Header: `Platform CVEs`,
+                      entityType: entityTypes.CLUSTER_CVE,
+                      headerClassName: `w-1/8 ${defaultHeaderClassName}`,
+                      className: `w-1/8 ${defaultColumnClassName}`,
+                      Cell: ({ original, pdf }) => {
+                          const { clusterVulnerabilityCounter, id } = original;
+                          if (
+                              !clusterVulnerabilityCounter ||
+                              clusterVulnerabilityCounter.all.total === 0
+                          ) {
+                              return 'No CVEs';
+                          }
+
+                          const newState = workflowState
+                              .pushListItem(id)
+                              .pushList(entityTypes.CLUSTER_CVE);
+                          const url = newState.toUrl();
+                          const fixableUrl = newState.setSearch({ Fixable: true }).toUrl();
+
+                          return (
+                              <CVEStackedPill
+                                  vulnCounter={clusterVulnerabilityCounter}
+                                  url={url}
+                                  fixableUrl={fixableUrl}
+                                  hideLink={pdf}
+                              />
+                          );
+                      },
+                      id: clusterSortFields.CVE_COUNT,
+                      accessor: 'vulnCounter.all.total',
+                      sortField: clusterSortFields.CVE_COUNT,
+                  }
+                : null,
             {
                 Header: `K8S Version`,
                 headerClassName: `w-1/10 ${nonSortableHeaderClassName}`,
@@ -220,7 +224,7 @@ const VulnMgmtListClusters = ({ selectedRowId, search, sort, page, data, totalRe
             },
         ];
 
-        return removeEntityContextColumns(tableColumns, workflowState);
+        return removeEntityContextColumns(tableColumns.filter(Boolean), workflowState);
     }
 
     return (
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/List/WorkflowListPageLayout.jsx b/ui/apps/platform/src/Containers/VulnMgmt/List/WorkflowListPageLayout.jsx
index 22c206a94c8f0..6fecb901ea4af 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/List/WorkflowListPageLayout.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/List/WorkflowListPageLayout.jsx
@@ -9,6 +9,7 @@ import parseURL from 'utils/URLParser';
 import workflowStateContext from 'Containers/workflowStateContext';
 import { WorkflowState } from 'utils/WorkflowState';
 import { getVulnerabilityManagementEntityTypes } from 'utils/entityRelationships';
+import useFeatureFlags from 'hooks/useFeatureFlags';
 
 import { entityNounSentenceCasePlural } from '../entitiesForVulnerabilityManagement';
 import getSidePanelEntity from '../getSidePanelEntity';
@@ -18,6 +19,7 @@ import ListComponent from './VulnMgmtList';
 
 const WorkflowListPageLayout = () => {
     const location = useLocation();
+    const { isFeatureFlagEnabled } = useFeatureFlags();
 
     const workflowState = parseURL(location);
     const { useCase, search, sort, paging } = workflowState;
@@ -66,7 +68,9 @@ const WorkflowListPageLayout = () => {
                         <div className="flex items-center pl-2">
                             <EntitiesMenu
                                 text="All Entities"
-                                options={getVulnerabilityManagementEntityTypes()}
+                                options={getVulnerabilityManagementEntityTypes(
+                                    isFeatureFlagEnabled
+                                )}
                             />
                         </div>
                     </div>
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/widgets/CvesByCvssScore.jsx b/ui/apps/platform/src/Containers/VulnMgmt/widgets/CvesByCvssScore.jsx
index 19c500517c944..2aa1642136b1b 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/widgets/CvesByCvssScore.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/widgets/CvesByCvssScore.jsx
@@ -12,7 +12,6 @@ import workflowStateContext from 'Containers/workflowStateContext';
 import { vulnerabilitySeverityColorMap } from 'constants/severityColors';
 import { vulnerabilitySeverityLabels } from 'messages/common';
 import { getScopeQuery } from 'Containers/VulnMgmt/Entity/VulnMgmtPolicyQueryUtil';
-import useFeatureFlags from 'hooks/useFeatureFlags';
 
 import ViewAllButton from './ViewAllButton';
 
@@ -57,8 +56,7 @@ const vulnerabilitySeverities = [
 ];
 
 const CvesByCvssScore = ({ entityContext, parentContext }) => {
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isNewImageDataModelEnabled = isFeatureFlagEnabled('ROX_FLATTEN_IMAGE_DATA');
+    const isNewImageDataModelEnabled = true;
     let queryToUse = IMAGE_CVES_QUERY;
     let linkTypeToUse = entityTypes.IMAGE_CVE;
 
diff --git a/ui/apps/platform/src/Containers/VulnMgmt/widgets/TopRiskiestEntities.jsx b/ui/apps/platform/src/Containers/VulnMgmt/widgets/TopRiskiestEntities.jsx
index 01f17ab001edb..ca9e5c4d83f18 100644
--- a/ui/apps/platform/src/Containers/VulnMgmt/widgets/TopRiskiestEntities.jsx
+++ b/ui/apps/platform/src/Containers/VulnMgmt/widgets/TopRiskiestEntities.jsx
@@ -20,7 +20,6 @@ import {
     entityNounOrdinaryCasePlural,
     entityNounSentenceCaseSingular,
 } from '../entitiesForVulnerabilityManagement';
-import useFeatureFlags from 'hooks/useFeatureFlags';
 
 import NumberedList from './NumberedList';
 import ViewAllButton from './ViewAllButton';
@@ -325,8 +324,7 @@ const processData = (data, entityType, workflowState) => {
 };
 
 const TopRiskiestEntities = ({ entityContext, search, limit }) => {
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isNewImageDataModelEnabled = isFeatureFlagEnabled('ROX_FLATTEN_IMAGE_DATA');
+    const isNewImageDataModelEnabled = true;
     const entities = getEntitiesByContext(entityContext);
     const [selectedEntity, setSelectedEntity] = useState(entities[0].value);
 
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/imageVulnerabilityReportValidationSchemas.ts b/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/imageVulnerabilityReportValidationSchemas.ts
deleted file mode 100644
index 09285d0710036..0000000000000
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/imageVulnerabilityReportValidationSchemas.ts
+++ /dev/null
@@ -1,216 +0,0 @@
-import { isValid, parse } from 'date-fns';
-import * as yup from 'yup';
-
-import type { DeliveryType, DetailsType } from 'Components/Reports/reports.types';
-import type { Schedule } from 'types/schedule.proto';
-import { imageTypes } from 'services/ReportsService.types';
-import type {
-    CvesSince,
-    ImageType,
-    ImageVulnerabilityReportConfiguration,
-    ImageVulnerabilityReportConfigurationForCollection,
-    ImageVulnerabilityReportFiltersForEntity,
-} from 'services/ReportsService.types';
-import { vulnerabilitySeverities } from 'types/cve.proto';
-
-import { ensureExhaustive } from 'utils/type.utils';
-
-import type {
-    ImageVulnerabilityResourceScope,
-    ImageVulnerabilityResourcesConfiguration,
-} from '../imageVulnerabilityReports.types';
-
-const validationSchemaDetails: yup.ObjectSchema<DetailsType> = yup.object().shape({
-    name: yup.string().trim().required('Report name is required'),
-    description: yup.string().ensure(),
-});
-
-const validationSchemaResources: yup.ObjectSchema<ImageVulnerabilityResourcesConfiguration> = yup
-    .object()
-    .shape({
-        vulnReportFilters: yup.object().shape({
-            imageTypes: yup
-                .array()
-                .of(yup.string().oneOf(imageTypes).required())
-                .min(1, 'Select at least one image type')
-                .required(),
-        }),
-        resourceScope: yup
-            .object()
-            .test(
-                'resource-scope-required',
-                'Resource scope is required for deployed images',
-                function test(value) {
-                    // resourceScope can be either CollectionScope or EntityScope, which .shape()
-                    // can't express. Cast so property access is type checked.
-                    const resourceScope = value as ImageVulnerabilityResourceScope;
-                    const imageTypesValue: ImageType[] =
-                        this.parent?.vulnReportFilters?.imageTypes ?? [];
-                    const hasDeployed = imageTypesValue.includes('DEPLOYED');
-
-                    if (!hasDeployed) {
-                        return true;
-                    }
-
-                    if ('collectionScope' in resourceScope) {
-                        return Boolean(resourceScope.collectionScope.collectionId);
-                    }
-                    if ('entityScope' in resourceScope) {
-                        return resourceScope.entityScope.rules.length > 0;
-                    }
-                    return false;
-                }
-            ) as unknown as yup.Schema<ImageVulnerabilityResourceScope>,
-    });
-
-function isCvesSinceValid(filters: CvesSince): boolean {
-    if ('allVuln' in filters) {
-        return true;
-    }
-    if ('sinceLastSentScheduledReport' in filters) {
-        return true;
-    }
-    if ('sinceStartDate' in filters) {
-        if (!filters.sinceStartDate) {
-            return false;
-        }
-        // parse() is lenient. partial strings like "2026-10" pass isValid.
-        // Checking for "T" ensures the value is likely a full ISO timestamp.
-        return filters.sinceStartDate.includes('T') && isValid(parse(filters.sinceStartDate));
-    }
-    return false;
-}
-
-const validationSchemaFilters = yup.lazy((values: ImageVulnerabilityReportConfiguration) => {
-    if ('entityScope' in values.resourceScope) {
-        return yup.object().shape({
-            vulnReportFilters: yup
-                .object()
-                .shape({
-                    query: yup.string().required('At least one filter is required'),
-                })
-                .test(
-                    'cves-since-entity',
-                    'CVE date range is required',
-                    function test(reportFilters) {
-                        // CvesSince is a union type that .shape() can't express.
-                        // cast so property access is type checked.
-                        const filters = reportFilters as ImageVulnerabilityReportFiltersForEntity;
-                        if ('sinceStartDate' in filters && !isCvesSinceValid(filters)) {
-                            return this.createError({
-                                path: 'vulnReportFilters.sinceStartDate',
-                                message: 'A valid start date is required',
-                            });
-                        }
-                        return isCvesSinceValid(filters);
-                    }
-                ),
-        });
-    }
-
-    return yup.object().shape({
-        vulnReportFilters: yup
-            .object()
-            .shape({
-                severities: yup
-                    .array()
-                    .of(yup.string().oneOf(vulnerabilitySeverities).required())
-                    .min(1, 'Select at least one CVE severity')
-                    .required('CVE severity is required'),
-                fixability: yup
-                    .string()
-                    .oneOf(['FIXABLE', 'NOT_FIXABLE', 'BOTH'])
-                    .required('CVE status is required'),
-            })
-            .test(
-                'cves-since-collection',
-                'CVE date range is required',
-                function test(reportFilters) {
-                    // CvesSince is a union type that .shape() can't express.
-                    // cast so property access is type checked.
-                    const filters =
-                        reportFilters as ImageVulnerabilityReportConfigurationForCollection['vulnReportFilters'];
-                    if ('sinceStartDate' in filters && !isCvesSinceValid(filters)) {
-                        return this.createError({
-                            path: 'vulnReportFilters.sinceStartDate',
-                            message: 'A valid start date is required',
-                        });
-                    }
-                    return isCvesSinceValid(filters);
-                }
-            ),
-    });
-});
-
-const validationSchemaDelivery: yup.ObjectSchema<DeliveryType> = yup.object().shape({
-    notifiers: yup
-        .array()
-        .of(
-            yup.object().shape({
-                emailConfig: yup.object().shape({
-                    notifierId: yup.string().required('Email notifier is required'),
-                    mailingLists: yup
-                        .array()
-                        .of(yup.string().required())
-                        .min(1, 'At least one distribution list email is required')
-                        .required(),
-                    customSubject: yup.string().defined(),
-                    customBody: yup.string().defined(),
-                }),
-                notifierName: yup.string().defined(),
-            })
-        )
-        .defined(),
-    schedule: yup
-        .object()
-        .nullable()
-        .defined()
-        .test('schedule-days-required', 'At least one day must be selected', function test(value) {
-            if (value == null) {
-                return true;
-            }
-            // Schedule is a union type that .shape() can't express.
-            // Cast so property access is type-checked.
-            const schedule = value as Schedule;
-            if (schedule.intervalType === 'UNSET' || schedule.intervalType === 'DAILY') {
-                return true;
-            }
-            if ('daysOfWeek' in schedule && schedule.daysOfWeek.days.length === 0) {
-                return this.createError({
-                    path: 'schedule.daysOfWeek.days',
-                    message: 'At least one day must be selected',
-                });
-            }
-            if ('daysOfMonth' in schedule && schedule.daysOfMonth.days.length === 0) {
-                return this.createError({
-                    path: 'schedule.daysOfMonth.days',
-                    message: 'At least one day must be selected',
-                });
-            }
-            return true;
-        }) as unknown as yup.Schema<Schedule | null>,
-});
-
-export const wizardStepIds = ['details', 'resources', 'filters', 'delivery', 'review'] as const;
-export type WizardStepId = (typeof wizardStepIds)[number];
-
-export function isWizardStepId(id: string): id is WizardStepId {
-    return wizardStepIds.includes(id as WizardStepId);
-}
-
-export function getValidationSchema(stepId: WizardStepId): yup.Schema | yup.Lazy<unknown> {
-    switch (stepId) {
-        case 'details':
-            return validationSchemaDetails;
-        case 'resources':
-            return validationSchemaResources;
-        case 'filters':
-            return validationSchemaFilters;
-        case 'delivery':
-            return validationSchemaDelivery;
-        case 'review':
-            return yup.object().shape({});
-        default:
-            return ensureExhaustive(stepId);
-    }
-}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.types.ts b/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.types.ts
deleted file mode 100644
index e2f51f4ae3e9e..0000000000000
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.types.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import type {
-    CollectionScope,
-    CvesSince,
-    EntityScope,
-    Fixability,
-    ImageType,
-    NotifierConfiguration,
-} from 'services/ReportsService.types';
-import type { VulnerabilitySeverity } from 'types/cve.proto';
-import type { Schedule } from 'types/schedule.proto';
-
-// Types because Resources and Filters for view and wizard combine data properties.
-
-export type ImageVulnerabilityResourceScope =
-    | {
-          collectionScope: CollectionScope;
-      }
-    | {
-          entityScope: EntityScope;
-      };
-
-export type ImageVulnerabilityResourcesConfiguration = {
-    resourceScope: ImageVulnerabilityResourceScope;
-    vulnReportFilters: {
-        imageTypes: ImageType[]; // more closely related to resources although in vulnReportFilters
-    };
-};
-
-export type ImageVulnerabilityFiltersConfiguration = {
-    vulnReportFilters: ImageVulnerabilityFiltersWithoutCvesSince & CvesSince;
-};
-
-export type ImageVulnerabilityFiltersWithoutCvesSince =
-    | ImageVulnerabilityFiltersForEntityWithoutCvesSince
-    | ImageVulnerabilityFiltersForCollectionWithoutCvesSince;
-
-export type ImageVulnerabilityFiltersConfigurationForEntity = {
-    vulnReportFilters: ImageVulnerabilityFiltersForEntityWithoutCvesSince & CvesSince;
-};
-
-export type ImageVulnerabilityFiltersForEntityWithoutCvesSince = {
-    query: string;
-};
-
-export type ImageVulnerabilityFiltersConfigurationForCollection = {
-    vulnReportFilters: ImageVulnerabilityFiltersForCollectionWithoutCvesSince & CvesSince;
-};
-
-export type ImageVulnerabilityFiltersForCollectionWithoutCvesSince = {
-    fixability: Fixability;
-    severities: VulnerabilitySeverity[];
-};
-
-export type DestinationsConfiguration = {
-    notifiers: NotifierConfiguration[];
-    schedule: Schedule | null;
-};
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Node/CVEsTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Node/CVEsTable.tsx
index cc9e80449e16b..4f2488c8c442d 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Node/CVEsTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Node/CVEsTable.tsx
@@ -79,9 +79,9 @@ function CVEsTable({ tableState, getSortParams, onClearFilters }: CVEsTableProps
                 <Tr>
                     <ExpandRowTh />
                     <Th sort={getSortParams(CVE_SORT_FIELD)}>CVE</Th>
-                    <Th sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}>Top severity</Th>
+                    <Th sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}>Top CVE severity</Th>
                     <Th sort={getSortParams(CVE_STATUS_SORT_FIELD)}>CVE status</Th>
-                    <Th sort={getSortParams(CVSS_SORT_FIELD)}>CVSS</Th>
+                    <Th sort={getSortParams(CVSS_SORT_FIELD)}>Top CVSS</Th>
                     <Th>Affected components</Th>
                 </Tr>
             </Thead>
@@ -114,13 +114,13 @@ function CVEsTable({ tableState, getSortParams, onClearFilters }: CVEsTableProps
                                     <Td dataLabel="CVE" modifier="nowrap">
                                         <Link to={getNodeEntityPagePath('CVE', cve)}>{cve}</Link>
                                     </Td>
-                                    <Td dataLabel="Top severity">
+                                    <Td dataLabel="Top CVE severity">
                                         <VulnerabilitySeverityIconText severity={topSeverity} />
                                     </Td>
                                     <Td dataLabel="CVE status">
                                         <VulnerabilityFixableIconText isFixable={isFixableInNode} />
                                     </Td>
-                                    <Td dataLabel="CVSS">
+                                    <Td dataLabel="Top CVSS">
                                         <CvssFormatted cvss={cvss} scoreVersion={scoreVersion} />
                                     </Td>
                                     <Td dataLabel="Affected components">
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.cy.jsx b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.cy.jsx
index 87c9882b9b9c8..63f87555670b7 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.cy.jsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.cy.jsx
@@ -173,7 +173,7 @@ describe(Cypress.spec.relative, () => {
                 cy.findAllByRole('row')
                     .eq(rowIndex)
                     .within(() => {
-                        cy.get(`td[data-label="CVE severity"]:contains("${expectedSeverity}")`);
+                        cy.get(`td[data-label="Top CVE severity"]:contains("${expectedSeverity}")`);
                     });
             });
         });
@@ -277,7 +277,7 @@ describe(Cypress.spec.relative, () => {
                     .eq(rowIndex)
                     .within(() => {
                         cy.get(
-                            `td[data-label="CVSS"]:contains("${expectedCVSS} (${expectedVersion})")`
+                            `td[data-label="Top CVSS"]:contains("${expectedCVSS} (${expectedVersion})")`
                         );
                     });
             });
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.tsx
index 869aff6e9509d..20674365abeab 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/NodeCve/AffectedNodesTable.tsx
@@ -109,9 +109,9 @@ function AffectedNodesTable({
                 <Tr>
                     <Th screenReaderText="Row expansion" />
                     <Th sort={getSortParams(NODE_SORT_FIELD)}>Node</Th>
-                    <Th sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}>CVE severity</Th>
+                    <Th sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}>Top CVE severity</Th>
                     <Th sort={getSortParams(CVE_STATUS_SORT_FIELD)}>CVE status</Th>
-                    <Th sort={getSortParams(CVSS_SORT_FIELD)}>CVSS</Th>
+                    <Th sort={getSortParams(CVSS_SORT_FIELD)}>Top CVSS</Th>
                     <Th sort={getSortParams(CLUSTER_SORT_FIELD)}>Cluster</Th>
                     <Th sort={getSortParams(OPERATING_SYSTEM_SORT_FIELD)}>Operating system</Th>
                     <Th>Affected components</Th>
@@ -152,13 +152,13 @@ function AffectedNodesTable({
                                             <Truncate position="middle" content={name} />
                                         </Link>
                                     </Td>
-                                    <Td dataLabel="CVE severity" modifier="nowrap">
+                                    <Td dataLabel="Top CVE severity" modifier="nowrap">
                                         <VulnerabilitySeverityIconText severity={topSeverity} />
                                     </Td>
                                     <Td dataLabel="CVE status" modifier="nowrap">
                                         <VulnerabilityFixableIconText isFixable={isFixableInNode} />
                                     </Td>
-                                    <Td dataLabel="CVSS" modifier="nowrap">
+                                    <Td dataLabel="Top CVSS" modifier="nowrap">
                                         <CvssFormatted cvss={cvss} scoreVersion={scoreVersion} />
                                     </Td>
                                     <Td dataLabel="Cluster">
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Overview/NodeCvesOverviewPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Overview/NodeCvesOverviewPage.tsx
index cd57c2fff943e..4aae855f98bcc 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Overview/NodeCvesOverviewPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/Overview/NodeCvesOverviewPage.tsx
@@ -1,4 +1,5 @@
-import { useEffect } from 'react';
+import { useEffect, useState } from 'react';
+import { useNavigate } from 'react-router-dom-v5-compat';
 import {
     Alert,
     DropdownItem,
@@ -10,6 +11,12 @@ import {
 } from '@patternfly/react-core';
 import { useApolloClient } from '@apollo/client';
 
+import SelectExclusiveSingleTabs from 'Components/CompoundSearchFilter/components/SelectExclusiveSingleTabs';
+import type { OnSearchPayload } from 'Components/CompoundSearchFilter/types';
+import {
+    getSearchFilterConfigWithFeatureFlagDependency,
+    updateSearchFilter,
+} from 'Components/CompoundSearchFilter/utils/utils';
 import PageTitle from 'Components/PageTitle';
 import ExternalLink from 'Components/PatternFly/IconText/ExternalLink';
 import MenuDropdown from 'Components/PatternFly/MenuDropdown';
@@ -25,28 +32,29 @@ import useAnalytics, {
     NODE_CVE_ENTITY_CONTEXT_VIEWED,
     NODE_CVE_FILTER_APPLIED,
 } from 'hooks/useAnalytics';
+import { runNodeViewBasedReport } from 'services/NodeReportsService';
 import { getHasSearchApplied } from 'utils/searchUtils';
 import { getVersionedDocs } from 'utils/versioning';
 import { createFilterTracker } from 'utils/analyticsEventTracking';
+import { vulnerabilityNodeViewBasedJobsPath } from 'routePaths';
 
 import {
-    clusterSearchFilterConfig,
-    nodeCVESearchFilterConfig,
-    nodeComponentSearchFilterConfig,
-    nodeSearchFilterConfig,
+    attributeForSnoozed,
+    searchFilterConfigForNodeVulnerabilityResultsAndViewBasedReport,
 } from '../../searchFilterConfig';
 import AdvancedFiltersToolbar from '../../components/AdvancedFiltersToolbar';
-import SnoozedCveToggleButton from '../../components/SnoozedCveToggleButton';
+import CreateViewBasedReportModal from '../../components/CreateViewBasedReportModal';
 import SnoozeCvesModal from '../../components/SnoozeCvesModal/SnoozeCvesModal';
 import useSnoozeCveModal from '../../components/SnoozeCvesModal/useSnoozeCveModal';
 import useHasLegacySnoozeAbility from '../../hooks/useHasLegacySnoozeAbility';
-import useSnoozedCveCount from '../../hooks/useSnoozedCveCount';
 import TableEntityToolbar from '../../components/TableEntityToolbar';
 import EntityTypeToggleGroup from '../../components/EntityTypeToggleGroup';
+import { createScheduledReportForNodeVulnerabilitiesURL } from '../../Reports/NodeVulnerabilityReports/nodeVulnerabilityReports.utils';
 import { nodeEntityTabValues } from '../../types';
 import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
-import { parseQuerySearchFilter } from '../../utils/searchUtils';
+import { getRegexScopedQueryString, parseQuerySearchFilter } from '../../utils/searchUtils';
 
+import CreateReportDropdown from '../components/CreateReportDropdown';
 import CVEsTable, {
     defaultSortOption as cveDefaultSortOption,
     sortFields as cveSortFields,
@@ -57,13 +65,6 @@ import NodesTable, {
 } from './NodesTable';
 import { useNodeCveEntityCounts } from './useNodeCveEntityCounts';
 
-const searchFilterConfig = [
-    clusterSearchFilterConfig,
-    nodeCVESearchFilterConfig,
-    nodeSearchFilterConfig,
-    nodeComponentSearchFilterConfig,
-];
-
 function NodeCvesOverviewPage() {
     const apolloClient = useApolloClient();
     const { analyticsTrack } = useAnalytics();
@@ -84,15 +85,23 @@ function NodeCvesOverviewPage() {
         onSort: () => pagination.setPage(1),
     });
 
-    const querySearchFilter = parseQuerySearchFilter(searchFilter);
+    // Default to Observed tab in UI and corresponding search filter in API when unspecified.
+    const querySearchFilter = parseQuerySearchFilter({
+        [attributeForSnoozed.searchTerm]: attributeForSnoozed.inputProps.options[0].value,
+        ...searchFilter,
+    });
     const isFiltered = getHasSearchApplied(querySearchFilter);
 
     const isViewingSnoozedCves = querySearchFilter['CVE Snoozed']?.[0] === 'true';
     const hasLegacySnoozeAbility = useHasLegacySnoozeAbility();
     const selectedCves = useMap<string, { cve: string }>();
     const { snoozeModalOptions, setSnoozeModalOptions, snoozeActionCreator } = useSnoozeCveModal();
-    const snoozedCveCount = useSnoozedCveCount('Node');
     const { version } = useMetadata();
+    const [isCreateViewBasedReportModalOpen, setIsCreateViewBasedReportModalOpen] = useState(false);
+    const navigate = useNavigate();
+
+    // Unlike WorkloadCves pages, 'CVE Snoozed' is in search filter of NodeCves page.
+    const viewBasedQueryString = getRegexScopedQueryString(querySearchFilter);
 
     function onEntityTabChange(entityTab: 'CVE' | 'Node') {
         pagination.setPage(1);
@@ -121,6 +130,11 @@ function NodeCvesOverviewPage() {
         pagination.setPage(1);
     }
 
+    function onSelectSnoozedTab(payload: OnSearchPayload) {
+        setSearchFilter(updateSearchFilter(searchFilter, payload));
+        pagination.setPage(1);
+    }
+
     const { data } = useNodeCveEntityCounts(querySearchFilter);
 
     const entityCounts = {
@@ -128,6 +142,12 @@ function NodeCvesOverviewPage() {
         Node: data?.nodeCount ?? 0,
     };
 
+    // Keep getSearchFilterConfigWithFeatureFlagDependency for ROX_SCANNER_V4.
+    const searchFilterConfig = getSearchFilterConfigWithFeatureFlagDependency(
+        isFeatureFlagEnabled,
+        searchFilterConfigForNodeVulnerabilityResultsAndViewBasedReport
+    );
+
     const filterToolbar = (
         <AdvancedFiltersToolbar
             searchFilter={searchFilter}
@@ -138,7 +158,16 @@ function NodeCvesOverviewPage() {
                 pagination.setPage(1);
                 trackAppliedFilter(NODE_CVE_FILTER_APPLIED, searchPayload);
             }}
-        />
+        >
+            <CreateReportDropdown
+                onSelectExportReportAsCSV={() => {
+                    setIsCreateViewBasedReportModalOpen(true);
+                }}
+                onSelectCreateScheduledReport={() => {
+                    navigate(createScheduledReportForNodeVulnerabilitiesURL(querySearchFilter));
+                }}
+            />
+        </AdvancedFiltersToolbar>
     );
 
     const entityToggleGroup = (
@@ -177,13 +206,6 @@ function NodeCvesOverviewPage() {
                         <Title headingLevel="h1">Node CVEs</Title>
                         <FlexItem>Prioritize and manage scanned CVEs across nodes</FlexItem>
                     </Flex>
-                    <FlexItem>
-                        <SnoozedCveToggleButton
-                            searchFilter={searchFilter}
-                            setSearchFilter={setSearchFilter}
-                            snoozedCveCount={snoozedCveCount}
-                        />
-                    </FlexItem>
                 </Flex>
             </PageSection>
             {showScannerV4NodeScannerInfoAlert && (
@@ -210,7 +232,15 @@ function NodeCvesOverviewPage() {
                     </Alert>
                 </PageSection>
             )}
-            <PageSection isCenterAligned>
+            <PageSection type="tabs">
+                <SelectExclusiveSingleTabs
+                    attribute={attributeForSnoozed}
+                    onSelectTab={onSelectSnoozedTab}
+                    searchFilter={searchFilter}
+                    tabContentId="node-cves"
+                />
+            </PageSection>
+            <PageSection id="node-cves" isCenterAligned>
                 <TableEntityToolbar
                     filterToolbar={filterToolbar}
                     entityToggleGroup={entityToggleGroup}
@@ -269,6 +299,14 @@ function NodeCvesOverviewPage() {
                     />
                 )}
             </PageSection>
+            <CreateViewBasedReportModal
+                isOpen={isCreateViewBasedReportModalOpen}
+                setIsOpen={setIsCreateViewBasedReportModalOpen}
+                query={viewBasedQueryString}
+                areaOfConcern="Nodes"
+                runViewBasedReport={runNodeViewBasedReport}
+                vulnerabilityViewBasedJobsPath={vulnerabilityNodeViewBasedJobsPath}
+            />
         </>
     );
 }
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/components/CreateReportDropdown.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/components/CreateReportDropdown.tsx
new file mode 100644
index 0000000000000..0b01da356feae
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/NodeCves/components/CreateReportDropdown.tsx
@@ -0,0 +1,108 @@
+import { useState } from 'react';
+import type { MouseEvent as ReactMouseEvent, Ref } from 'react';
+import { Dropdown, DropdownItem, DropdownList, MenuToggle } from '@patternfly/react-core';
+import type { MenuToggleElement } from '@patternfly/react-core';
+
+import useFeatureFlags from 'hooks/useFeatureFlags';
+import usePermissions from 'hooks/usePermissions';
+import type { FeatureFlagEnvVar } from 'types/featureFlag';
+import type { ResourceName } from 'types/roleResources';
+import { ensureExhaustive } from 'utils/type.utils';
+
+// TODO move deduplicated file to Vulnerabilities/components folder after release.
+
+type DropdownItem = {
+    text: 'Export report as CSV' | 'Create scheduled report';
+    description: string;
+    featureFlagDependency?: FeatureFlagEnvVar;
+    writeAccessRequirement?: ResourceName;
+};
+
+const dropdownItems: DropdownItem[] = [
+    {
+        text: 'Export report as CSV',
+        description:
+            'Export a view-based CSV report from this view using the filters you’ve applied.',
+    },
+    {
+        text: 'Create scheduled report',
+        description: 'Create a scheduled report from this view using the filters you’ve applied.',
+        writeAccessRequirement: 'WorkflowAdministration',
+    },
+] as const;
+
+type DropdownItemText = (typeof dropdownItems)[number]['text'];
+
+export type CreateReportDropdownProps = {
+    onSelectExportReportAsCSV: () => void;
+    onSelectCreateScheduledReport: () => void;
+};
+
+function CreateReportDropdown({
+    onSelectExportReportAsCSV,
+    onSelectCreateScheduledReport,
+}: CreateReportDropdownProps) {
+    const [isOpen, setIsOpen] = useState(false);
+    const { isFeatureFlagEnabled } = useFeatureFlags();
+    const { hasReadWriteAccess } = usePermissions();
+
+    const onToggleClick = () => {
+        setIsOpen((prev) => !prev);
+    };
+
+    const onSelectHandler = (
+        _event: ReactMouseEvent<Element, MouseEvent> | undefined,
+        value: DropdownItemText
+    ) => {
+        switch (value) {
+            case 'Export report as CSV':
+                onSelectExportReportAsCSV();
+                break;
+            case 'Create scheduled report':
+                onSelectCreateScheduledReport();
+                break;
+            default:
+                ensureExhaustive(value);
+        }
+        setIsOpen(false);
+    };
+
+    return (
+        <>
+            <Dropdown
+                isOpen={isOpen}
+                onSelect={onSelectHandler}
+                onOpenChange={(isOpen: boolean) => setIsOpen(isOpen)}
+                toggle={(toggleRef: Ref<MenuToggleElement>) => (
+                    <MenuToggle ref={toggleRef} onClick={onToggleClick} isExpanded={isOpen}>
+                        Create report
+                    </MenuToggle>
+                )}
+                shouldFocusToggleOnSelect
+                popperProps={{ position: 'right', appendTo: () => document.body }}
+            >
+                <DropdownList>
+                    {dropdownItems.map((dropdownItem) => {
+                        const { description, text } = dropdownItem;
+                        const isEnabled =
+                            !('featureFlagDependency' in dropdownItem) ||
+                            !dropdownItem.featureFlagDependency ||
+                            isFeatureFlagEnabled(dropdownItem.featureFlagDependency);
+                        const hasAccess =
+                            !('writeAccessRequirement' in dropdownItem) ||
+                            !dropdownItem.writeAccessRequirement ||
+                            hasReadWriteAccess(dropdownItem.writeAccessRequirement);
+
+                        return isEnabled && hasAccess ? (
+                            <DropdownItem key={text} value={text} description={description}>
+                                {text}
+                            </DropdownItem>
+                        ) : null;
+                    })}
+                </DropdownList>
+            </Dropdown>
+        </>
+    );
+}
+
+export default CreateReportDropdown;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/NodeVulnerabilityReports/nodeVulnerabilityReports.types.ts b/ui/apps/platform/src/Containers/Vulnerabilities/NodeVulnerabilityReports/nodeVulnerabilityReports.types.ts
deleted file mode 100644
index c4e214aee730c..0000000000000
--- a/ui/apps/platform/src/Containers/Vulnerabilities/NodeVulnerabilityReports/nodeVulnerabilityReports.types.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import type { CvesSince, EntityScope, NotifierConfiguration } from 'services/ReportsService.types';
-import type { Schedule } from 'types/schedule.proto';
-
-export type NodeVulnerabilityResourcesConfiguration = {
-    resourceScope: {
-        entityScope: EntityScope;
-    };
-};
-
-export type NodeVulnerabilityFiltersConfiguration = {
-    vulnReportFilters: {
-        query: string;
-    } & CvesSince;
-};
-
-export type NodeVulnerabilityReportConfiguration = {
-    id: string;
-    name: string;
-    description: string;
-    type: 'NODE_VULNERABILITY';
-    notifiers: NotifierConfiguration[];
-    schedule: Schedule | null;
-} & NodeVulnerabilityResourcesConfiguration &
-    NodeVulnerabilityFiltersConfiguration;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/PlatformCves/Overview/PlatformCvesOverviewPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/PlatformCves/Overview/PlatformCvesOverviewPage.tsx
index 1d764299e9979..adb0b21d2c7bf 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/PlatformCves/Overview/PlatformCvesOverviewPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/PlatformCves/Overview/PlatformCvesOverviewPage.tsx
@@ -9,6 +9,9 @@ import {
 } from '@patternfly/react-core';
 import { useApolloClient } from '@apollo/client';
 
+import SelectExclusiveSingleTabs from 'Components/CompoundSearchFilter/components/SelectExclusiveSingleTabs';
+import type { OnSearchPayload } from 'Components/CompoundSearchFilter/types';
+import { updateSearchFilter } from 'Components/CompoundSearchFilter/utils/utils';
 import PageTitle from 'Components/PageTitle';
 import MenuDropdown from 'Components/PatternFly/MenuDropdown';
 import useURLStringUnion from 'hooks/useURLStringUnion';
@@ -30,9 +33,11 @@ import TableEntityToolbar from '../../components/TableEntityToolbar';
 
 import { parseQuerySearchFilter } from '../../utils/searchUtils';
 import AdvancedFiltersToolbar from '../../components/AdvancedFiltersToolbar';
-import useSnoozedCveCount from '../../hooks/useSnoozedCveCount';
-import { clusterSearchFilterConfig, platformCVESearchFilterConfig } from '../../searchFilterConfig';
-import SnoozedCveToggleButton from '../../components/SnoozedCveToggleButton';
+import {
+    attributeForSnoozed,
+    clusterSearchFilterConfig,
+    platformCVESearchFilterConfig,
+} from '../../searchFilterConfig';
 import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
 import EntityTypeToggleGroup from '../../components/EntityTypeToggleGroup';
 import { platformEntityTabValues } from '../../types';
@@ -65,14 +70,17 @@ function PlatformCvesOverviewPage() {
         onSort: () => pagination.setPage(1),
     });
 
-    const querySearchFilter = parseQuerySearchFilter(searchFilter);
+    // Default to Observed tab in UI and corresponding search filter in API when unspecified.
+    const querySearchFilter = parseQuerySearchFilter({
+        [attributeForSnoozed.searchTerm]: attributeForSnoozed.inputProps.options[0].value,
+        ...searchFilter,
+    });
     const isFiltered = getHasSearchApplied(querySearchFilter);
 
     const isViewingSnoozedCves = querySearchFilter['CVE Snoozed']?.[0] === 'true';
     const hasLegacySnoozeAbility = useHasLegacySnoozeAbility();
     const selectedCves = useMap<string, { cve: string }>();
     const { snoozeModalOptions, setSnoozeModalOptions, snoozeActionCreator } = useSnoozeCveModal();
-    const snoozedCveCount = useSnoozedCveCount('Platform');
 
     function onEntityTabChange(entityTab: 'CVE' | 'Cluster') {
         pagination.setPage(1);
@@ -108,6 +116,11 @@ function PlatformCvesOverviewPage() {
         pagination.setPage(1);
     }
 
+    function onSelectSnoozedTab(payload: OnSearchPayload) {
+        setSearchFilter(updateSearchFilter(searchFilter, payload));
+        pagination.setPage(1);
+    }
+
     const filterToolbar = (
         <AdvancedFiltersToolbar
             searchFilter={searchFilter}
@@ -158,15 +171,16 @@ function PlatformCvesOverviewPage() {
                         <Title headingLevel="h1">Kubernetes components</Title>
                         <FlexItem>Prioritize and manage scanned CVEs across clusters</FlexItem>
                     </Flex>
-                    <FlexItem>
-                        <SnoozedCveToggleButton
-                            searchFilter={searchFilter}
-                            setSearchFilter={setSearchFilter}
-                            snoozedCveCount={snoozedCveCount}
-                        />
-                    </FlexItem>
                 </Flex>
             </PageSection>
+            <PageSection type="tabs">
+                <SelectExclusiveSingleTabs
+                    attribute={attributeForSnoozed}
+                    onSelectTab={onSelectSnoozedTab}
+                    searchFilter={searchFilter}
+                    tabContentId="TODO"
+                />
+            </PageSection>
             <PageSection isFilled>
                 <TableEntityToolbar
                     filterToolbar={filterToolbar}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersView.tsx
similarity index 93%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersView.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersView.tsx
index 1066de8e59cdf..939711e6eec31 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersView.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersView.tsx
@@ -15,9 +15,9 @@ import type {
     CompoundSearchFilterAttribute,
     CompoundSearchFilterConfig,
 } from 'Components/CompoundSearchFilter/types';
+import type { ImageVulnerabilityReportFiltersConfigurationForEntity } from 'services/ReportsService.types';
 import { getSearchFilterFromSearchString } from 'utils/searchUtils';
 
-import type { ImageVulnerabilityFiltersConfigurationForEntity } from '../imageVulnerabilityReports.types';
 import { getTextForCvesSince } from '../imageVulnerabilityReports.utils';
 
 export type ImageVulnerabilityFiltersViewProps = {
@@ -25,7 +25,7 @@ export type ImageVulnerabilityFiltersViewProps = {
     headingLevel: 'h2' | 'h3';
     horizontalTermWidthModifier: BreakpointModifiers;
     searchFilterConfig: CompoundSearchFilterConfig;
-    values: ImageVulnerabilityFiltersConfigurationForEntity;
+    values: ImageVulnerabilityReportFiltersConfigurationForEntity;
 };
 
 function ImageVulnerabilityFiltersView({
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersViewForCollection.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersViewForCollection.tsx
similarity index 94%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersViewForCollection.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersViewForCollection.tsx
index f2ff0ee193db7..a56026f4da25f 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersViewForCollection.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityFiltersViewForCollection.tsx
@@ -12,14 +12,14 @@ import type { BreakpointModifiers } from '@patternfly/react-core';
 
 import { fixabilityLabels } from 'constants/reportConstants';
 import { vulnerabilitySeverityLabels } from 'messages/common';
+import type { ImageVulnerabilityReportFiltersConfigurationForCollection } from 'services/ReportsService.types';
 
-import type { ImageVulnerabilityFiltersConfigurationForCollection } from '../imageVulnerabilityReports.types';
 import { getTextForCvesSince } from '../imageVulnerabilityReports.utils';
 
 export type ImageVulnerabilityFiltersViewForCollectionProps = {
     headingLevel: 'h2' | 'h3';
     horizontalTermWidthModifier: BreakpointModifiers;
-    values: ImageVulnerabilityFiltersConfigurationForCollection;
+    values: ImageVulnerabilityReportFiltersConfigurationForCollection;
 };
 
 function ImageVulnerabilityFiltersViewForCollection({
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityReportView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityReportView.tsx
similarity index 100%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityReportView.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityReportView.tsx
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityResourcesView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityResourcesView.tsx
similarity index 68%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityResourcesView.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityResourcesView.tsx
index 7281a9af4647d..fab006fe1e464 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/View/ImageVulnerabilityResourcesView.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/View/ImageVulnerabilityResourcesView.tsx
@@ -11,14 +11,25 @@ import {
 import type { BreakpointModifiers } from '@patternfly/react-core';
 
 import EntityScopeDescriptionListGroups from 'Components/EntityScope/EntityScopeDescriptionListGroups';
+import type {
+    ConfiguredReportSnapshot,
+    ImageVulnerabilityReportResourcesConfiguration,
+} from 'services/ReportsService.types';
 
-import type { ImageVulnerabilityResourcesConfiguration } from '../imageVulnerabilityReports.types';
 import { imageTypeLabelMap } from '../imageVulnerabilityReports.utils';
 
+// Although migration might have moved collectionScope into resourceScope
+// for report configurations, old snapshots might lack the resourceScope property.
+// Therefore, resourceScope && … && (…) below.
+// Return collection name from legacy property in report configuration of job snapshot.
+function collectionSnapshotName(values: ConfiguredReportSnapshot): string | undefined {
+    return values.collectionSnapshot?.name;
+}
+
 export type ImageVulnerabilityResourcesViewProps = {
     headingLevel: 'h2' | 'h3';
     horizontalTermWidthModifier: BreakpointModifiers;
-    values: ImageVulnerabilityResourcesConfiguration;
+    values: ImageVulnerabilityReportResourcesConfiguration;
 };
 
 function ImageVulnerabilityResourcesView({
@@ -29,6 +40,8 @@ function ImageVulnerabilityResourcesView({
     const { resourceScope, vulnReportFilters } = values;
     const { imageTypes } = vulnReportFilters;
 
+    const collectionName = collectionSnapshotName(values as unknown as ConfiguredReportSnapshot);
+
     return (
         <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
             <FlexItem>
@@ -56,7 +69,15 @@ function ImageVulnerabilityResourcesView({
                             )}
                         </DescriptionListDescription>
                     </DescriptionListGroup>
-                    {'collectionScope' in resourceScope && (
+                    {!resourceScope && collectionName && (
+                        <DescriptionListGroup>
+                            <DescriptionListTerm>Collection</DescriptionListTerm>
+                            <DescriptionListDescription>
+                                {collectionName}
+                            </DescriptionListDescription>
+                        </DescriptionListGroup>
+                    )}
+                    {resourceScope && 'collectionScope' in resourceScope && (
                         <DescriptionListGroup>
                             <DescriptionListTerm>Collection</DescriptionListTerm>
                             <DescriptionListDescription>
@@ -64,7 +85,7 @@ function ImageVulnerabilityResourcesView({
                             </DescriptionListDescription>
                         </DescriptionListGroup>
                     )}
-                    {'entityScope' in resourceScope && (
+                    {resourceScope && 'entityScope' in resourceScope && (
                         <EntityScopeDescriptionListGroups entityScope={resourceScope.entityScope} />
                     )}
                 </DescriptionList>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage.tsx
similarity index 88%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage.tsx
index f94a5f9e0de99..021c87280c4b4 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage.tsx
@@ -37,16 +37,15 @@ import {
     getValueByCaseInsensitiveKey,
     searchValueAsArray,
 } from 'utils/searchUtils';
-import { vulnerabilityConfigurationReportsPath } from 'routePaths';
+import { vulnerabilityImageConfigurationsReportsPath, vulnerabilityReportsPath } from 'routePaths';
 
 import {
     attributesSeparateFromConfigForImageVulnerabilityReport,
     searchFilterConfigForImageVulnerabilityReport,
-} from '../../searchFilterConfig';
+} from '../../../searchFilterConfig';
 
-import { defaultImageVulnerabilityReportConfiguration } from '../imageVulnerabilityReports.defaults';
-
-import ImageVulnerabilityReportWizard from './ImageVulnerabilityReportWizard';
+import { defaultImageVulnerabilityReportConfiguration } from './imageVulnerabilityReports.defaults';
+import ImageVulnerabilityReportWizardPageSection from './ImageVulnerabilityReportWizardPageSection';
 
 const searchFilterLabelsForImages: SearchFieldLabel[] = [
     'Image',
@@ -176,7 +175,10 @@ function ImageVulnerabilityReportWizardPage({
                 <>
                     <PageSection type="breadcrumb">
                         <Breadcrumb>
-                            <BreadcrumbItemLink to={vulnerabilityConfigurationReportsPath}>
+                            <BreadcrumbItemLink to={vulnerabilityReportsPath}>
+                                Vulnerability reports
+                            </BreadcrumbItemLink>
+                            <BreadcrumbItemLink to={vulnerabilityImageConfigurationsReportsPath}>
                                 Image vulnerability reports
                             </BreadcrumbItemLink>
                             <BreadcrumbItem isActive>{heading}</BreadcrumbItem>
@@ -198,21 +200,14 @@ function ImageVulnerabilityReportWizardPage({
                             </Alert>
                         </PageSection>
                     ) : reportConfiguration !== null ? (
-                        <PageSection
-                            hasBodyWrapper={false}
-                            isFilled
-                            hasOverflowScroll
-                            padding={{ default: 'noPadding' }}
-                        >
-                            <ImageVulnerabilityReportWizard
-                                attributesSeparateFromConfig={
-                                    attributesSeparateFromConfigForImageVulnerabilityReport
-                                }
-                                initialValues={reportConfiguration}
-                                pageAction={pageAction}
-                                searchFilterConfig={searchFilterConfig}
-                            />
-                        </PageSection>
+                        <ImageVulnerabilityReportWizardPageSection
+                            attributesSeparateFromConfig={
+                                attributesSeparateFromConfigForImageVulnerabilityReport
+                            }
+                            initialValues={reportConfiguration}
+                            pageAction={pageAction}
+                            searchFilterConfig={searchFilterConfig}
+                        />
                     ) : null}
                 </>
             )}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizard.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPageSection.tsx
similarity index 58%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizard.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPageSection.tsx
index 3f6b18abb558a..38908d5c020a2 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizard.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPageSection.tsx
@@ -1,7 +1,13 @@
 import { useEffect, useState } from 'react';
 import type { ReactElement } from 'react';
-import { useNavigate } from 'react-router-dom-v5-compat';
-import { Wizard, WizardFooter, WizardStep, useWizardContext } from '@patternfly/react-core';
+import { generatePath, useNavigate } from 'react-router-dom-v5-compat';
+import {
+    PageSection,
+    Wizard,
+    WizardFooter,
+    WizardStep,
+    useWizardContext,
+} from '@patternfly/react-core';
 import type { WizardStepType } from '@patternfly/react-core';
 import { useFormik } from 'formik';
 import type { FormikProps } from 'formik';
@@ -23,7 +29,7 @@ import type {
     ImageVulnerabilityReportConfigurationForCollection,
     ImageVulnerabilityReportConfigurationForEntity,
 } from 'services/ReportsService.types';
-import { vulnerabilityConfigurationReportsPath } from 'routePaths';
+import { vulnerabilityImageConfigurationsReportsDetailsPath } from 'routePaths';
 
 import { getValueForCvesSince } from '../imageVulnerabilityReports.utils';
 
@@ -89,19 +95,19 @@ function ValidatingWizardFooter({ formik, stepId, onClose }: ValidatingWizardFoo
     );
 }
 
-export type ImageVulnerabilityReportWizardProps = {
+export type ImageVulnerabilityReportWizardPageSectionProps = {
     attributesSeparateFromConfig: SelectSearchFilterAttribute[];
     initialValues: ImageVulnerabilityReportConfiguration;
     pageAction: ReportPageAction;
     searchFilterConfig: CompoundSearchFilterConfig;
 };
 
-function ImageVulnerabilityReportWizard({
+function ImageVulnerabilityReportWizardPageSection({
     attributesSeparateFromConfig,
     initialValues,
     pageAction,
     searchFilterConfig,
-}: ImageVulnerabilityReportWizardProps): ReactElement {
+}: ImageVulnerabilityReportWizardPageSectionProps): ReactElement {
     const { analyticsTrack } = useAnalytics();
     const navigate = useNavigate();
     const [error, setError] = useState<Error | null>(null);
@@ -138,7 +144,11 @@ function ImageVulnerabilityReportWizard({
                         navigate(-1);
                     } else {
                         // Go to page for new report.
-                        navigate(`${vulnerabilityConfigurationReportsPath}/${data.id}`);
+                        navigate(
+                            generatePath(vulnerabilityImageConfigurationsReportsDetailsPath, {
+                                reportId: data.id,
+                            })
+                        );
                     }
                 })
                 .catch((errorCaught) => {
@@ -150,11 +160,11 @@ function ImageVulnerabilityReportWizard({
         },
     });
 
-    const { dirty, isSubmitting, isValid, submitForm, validateForm, values } = formik;
+    const { dirty, isSubmitting, isValid, submitForm, validateForm } = formik;
 
     useEffect(() => {
-        validateForm(values).catch(() => {});
-    }, [stepId, validateForm, values]);
+        validateForm().catch(() => {});
+    }, [stepId, validateForm]);
 
     function isStepValid(id: WizardStepId): boolean {
         try {
@@ -183,90 +193,114 @@ function ImageVulnerabilityReportWizard({
     const isDeliveryValid = isStepValid('delivery');
 
     return (
-        <Wizard
-            onClose={onClose}
-            onSave={submitForm}
-            onStepChange={onStepChange}
-            isVisitRequired={pageAction !== 'edit' && pageAction !== 'clone'}
+        <PageSection
+            hasBodyWrapper={false}
+            isFilled
+            hasOverflowScroll
+            padding={{ default: 'noPadding' }}
+            type="wizard"
         >
-            <WizardStep
-                id="details"
-                name="Details"
-                body={{ hasNoPadding: true }}
-                footer={
-                    <ValidatingWizardFooter formik={formik} stepId="details" onClose={onClose} />
-                }
-            >
-                <DetailsStep formik={formik} pageAction={pageAction} />
-            </WizardStep>
-            <WizardStep
-                id="resources"
-                name="Resources"
-                body={{ hasNoPadding: true }}
-                isDisabled={!isDetailsValid}
-                footer={
-                    <ValidatingWizardFooter formik={formik} stepId="resources" onClose={onClose} />
-                }
-            >
-                <ImageVulnerabilityResourcesStep formik={formik} />
-            </WizardStep>
-            <WizardStep
-                id="filters"
-                name="Filters"
-                body={{ hasNoPadding: true }}
-                isDisabled={!isDetailsValid || !isResourcesValid}
-                footer={
-                    <ValidatingWizardFooter formik={formik} stepId="filters" onClose={onClose} />
-                }
+            <Wizard
+                onClose={onClose}
+                onSave={submitForm}
+                onStepChange={onStepChange}
+                isVisitRequired={pageAction !== 'edit' && pageAction !== 'clone'}
             >
-                {hasFormikPropsForEntity(formik) && (
-                    <ImageVulnerabilityFiltersStep
+                <WizardStep
+                    id="details"
+                    name="Details"
+                    body={{ hasNoPadding: true }}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="details"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    <DetailsStep formik={formik} pageAction={pageAction} />
+                </WizardStep>
+                <WizardStep
+                    id="resources"
+                    name="Resources"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={!isDetailsValid}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="resources"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    <ImageVulnerabilityResourcesStep formik={formik} />
+                </WizardStep>
+                <WizardStep
+                    id="filters"
+                    name="Filters"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={!isDetailsValid || !isResourcesValid}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="filters"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    {hasFormikPropsForEntity(formik) && (
+                        <ImageVulnerabilityFiltersStep
+                            attributesSeparateFromConfig={attributesSeparateFromConfig}
+                            formik={formik}
+                            searchFilterConfig={searchFilterConfig}
+                        />
+                    )}
+                    {hasFormikPropsForCollection(formik) && (
+                        <ImageVulnerabilityFiltersStepForCollection formik={formik} />
+                    )}
+                </WizardStep>
+                <WizardStep
+                    id="delivery"
+                    name="Delivery"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={!isDetailsValid || !isResourcesValid || !isFiltersValid}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="delivery"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    <DeliveryStep formik={formik} />
+                </WizardStep>
+                <WizardStep
+                    id="review"
+                    name="Review"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={
+                        !isDetailsValid || !isResourcesValid || !isFiltersValid || !isDeliveryValid
+                    }
+                    footer={{
+                        isNextDisabled: !(
+                            (dirty || pageAction === 'clone') &&
+                            isValid &&
+                            !isSubmitting
+                        ),
+                        nextButtonProps: { isLoading: isSubmitting },
+                        nextButtonText: 'Save',
+                    }}
+                >
+                    <ImageVulnerabilityReviewStep
                         attributesSeparateFromConfig={attributesSeparateFromConfig}
-                        formik={formik}
+                        error={error}
                         searchFilterConfig={searchFilterConfig}
+                        values={formik.values}
                     />
-                )}
-                {hasFormikPropsForCollection(formik) && (
-                    <ImageVulnerabilityFiltersStepForCollection formik={formik} />
-                )}
-            </WizardStep>
-            <WizardStep
-                id="delivery"
-                name="Delivery"
-                body={{ hasNoPadding: true }}
-                isDisabled={!isDetailsValid || !isResourcesValid || !isFiltersValid}
-                footer={
-                    <ValidatingWizardFooter formik={formik} stepId="delivery" onClose={onClose} />
-                }
-            >
-                <DeliveryStep formik={formik} />
-            </WizardStep>
-            <WizardStep
-                id="review"
-                name="Review"
-                body={{ hasNoPadding: true }}
-                isDisabled={
-                    !isDetailsValid || !isResourcesValid || !isFiltersValid || !isDeliveryValid
-                }
-                footer={{
-                    isNextDisabled: !(
-                        (dirty || pageAction === 'clone') &&
-                        isValid &&
-                        !isSubmitting
-                    ),
-                    nextButtonProps: { isLoading: isSubmitting },
-                    nextButtonText: 'Save',
-                }}
-            >
-                <ImageVulnerabilityReviewStep
-                    attributesSeparateFromConfig={attributesSeparateFromConfig}
-                    error={error}
-                    searchFilterConfig={searchFilterConfig}
-                    values={formik.values}
-                />
-            </WizardStep>
-        </Wizard>
+                </WizardStep>
+            </Wizard>
+        </PageSection>
     );
 }
 
-export default ImageVulnerabilityReportWizard;
+export default ImageVulnerabilityReportWizardPageSection;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step2/CollectionScopeSelect.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/CollectionScopeSelect.tsx
similarity index 100%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step2/CollectionScopeSelect.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/CollectionScopeSelect.tsx
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step2/ImageTypeSelect.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/ImageTypeSelect.tsx
similarity index 100%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step2/ImageTypeSelect.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/ImageTypeSelect.tsx
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step2/ImageVulnerabilityResourcesStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/ImageVulnerabilityResourcesStep.tsx
similarity index 93%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step2/ImageVulnerabilityResourcesStep.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/ImageVulnerabilityResourcesStep.tsx
index 20680096a2c0a..de2d2c4568776 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step2/ImageVulnerabilityResourcesStep.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/ImageVulnerabilityResourcesStep.tsx
@@ -15,12 +15,10 @@ import type {
     EntityScope,
     EntityScopeRule,
     ImageType,
+    ImageVulnerabilityReportFiltersConfiguration,
+    ImageVulnerabilityReportResourcesConfiguration,
 } from 'services/ReportsService.types';
 
-import type {
-    ImageVulnerabilityFiltersConfiguration,
-    ImageVulnerabilityResourcesConfiguration,
-} from '../../imageVulnerabilityReports.types';
 import {
     replaceFiltersForCollectionFromQueryInConfiguration,
     replaceFiltersForEntityFromFixabilityAndSeverityInConfiguration,
@@ -34,13 +32,15 @@ function hasWatchedImagesOnly(imageTypes: ImageType[]) {
 }
 
 export type ImageVulnerabilityResourcesStepProps<
-    T extends ImageVulnerabilityResourcesConfiguration = ImageVulnerabilityResourcesConfiguration,
+    T extends ImageVulnerabilityReportResourcesConfiguration =
+        ImageVulnerabilityReportResourcesConfiguration,
 > = {
     formik: FormikProps<T>;
 };
 
 function ImageVulnerabilityResourcesStep<
-    T extends ImageVulnerabilityResourcesConfiguration = ImageVulnerabilityResourcesConfiguration,
+    T extends ImageVulnerabilityReportResourcesConfiguration =
+        ImageVulnerabilityReportResourcesConfiguration,
 >({ formik }: ImageVulnerabilityResourcesStepProps<T>): ReactElement {
     const [collectionScopeSelected, setCollectionScopeSelected] = useState<CollectionScope>(
         'collectionScope' in formik.values.resourceScope
@@ -57,11 +57,11 @@ function ImageVulnerabilityResourcesStep<
     // If user selects entityScope again, then restore it instead of having forgotten it.
     // Forgive double type assertion until we delete deprecated collections.
     const [vulnReportFiltersForEntityScope, setVulnReportFiltersForEntityScope] = useState<
-        ImageVulnerabilityResourcesConfiguration['vulnReportFilters']
+        ImageVulnerabilityReportResourcesConfiguration['vulnReportFilters']
     >(
         replaceFiltersForEntityFromFixabilityAndSeverityInConfiguration(
-            formik.values as unknown as ImageVulnerabilityFiltersConfiguration
-        ) as unknown as ImageVulnerabilityResourcesConfiguration['vulnReportFilters']
+            formik.values as unknown as ImageVulnerabilityReportFiltersConfiguration
+        ) as unknown as ImageVulnerabilityReportResourcesConfiguration['vulnReportFilters']
     );
 
     // Remember rules property of entityScope if user selects WATCHED only.
@@ -103,7 +103,7 @@ function ImageVulnerabilityResourcesStep<
         formik.setFieldValue(
             'vulnReportFilters',
             replaceFiltersForCollectionFromQueryInConfiguration(
-                formik.values as unknown as ImageVulnerabilityFiltersConfiguration
+                formik.values as unknown as ImageVulnerabilityReportFiltersConfiguration
             )
         );
     }
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/validationSchemaResources.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/validationSchemaResources.ts
new file mode 100644
index 0000000000000..e46f3ab07a246
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step2/validationSchemaResources.ts
@@ -0,0 +1,45 @@
+import * as yup from 'yup';
+
+import { imageTypes } from 'services/ReportsService.types';
+import type {
+    ImageType,
+    ImageVulnerabilityReportResourceScope,
+    ImageVulnerabilityReportResourcesConfiguration,
+} from 'services/ReportsService.types';
+
+export const validationSchemaResources: yup.ObjectSchema<ImageVulnerabilityReportResourcesConfiguration> =
+    yup.object().shape({
+        vulnReportFilters: yup.object().shape({
+            imageTypes: yup
+                .array()
+                .of(yup.string().oneOf(imageTypes).required())
+                .min(1, 'Select at least one image type')
+                .required(),
+        }),
+        resourceScope: yup
+            .object()
+            .test(
+                'resource-scope-required',
+                'Resource scope is required for deployed images',
+                function test(value) {
+                    // resourceScope can be either CollectionScope or EntityScope, which .shape()
+                    // can't express. Cast so property access is type checked.
+                    const resourceScope = value as ImageVulnerabilityReportResourceScope;
+                    const imageTypesValue: ImageType[] =
+                        this.parent?.vulnReportFilters?.imageTypes ?? [];
+                    const hasDeployed = imageTypesValue.includes('DEPLOYED');
+
+                    if (!hasDeployed) {
+                        return true;
+                    }
+
+                    if ('collectionScope' in resourceScope) {
+                        return Boolean(resourceScope.collectionScope.collectionId);
+                    }
+                    if ('entityScope' in resourceScope) {
+                        return resourceScope.entityScope.rules.length > 0;
+                    }
+                    return false;
+                }
+            ) as unknown as yup.Schema<ImageVulnerabilityReportResourceScope>,
+    });
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersSince.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersSince.tsx
similarity index 95%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersSince.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersSince.tsx
index 6878dbf03d007..7f4bca0a3ba89 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersSince.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersSince.tsx
@@ -5,21 +5,23 @@ import type { FormikProps } from 'formik';
 
 import FormLabelGroup from 'Components/PatternFly/FormLabelGroup';
 import SelectSingle from 'Components/SelectSingle/SelectSingle';
+import type { ImageVulnerabilityReportFiltersConfiguration } from 'services/ReportsService.types';
 
-import type { ImageVulnerabilityFiltersConfiguration } from '../../imageVulnerabilityReports.types';
 import {
     getReportFiltersWithoutCvesSince,
     getValueForCvesSince,
 } from '../../imageVulnerabilityReports.utils';
 
 export type ImageVulnerabilityFiltersSinceProps<
-    T extends ImageVulnerabilityFiltersConfiguration = ImageVulnerabilityFiltersConfiguration,
+    T extends ImageVulnerabilityReportFiltersConfiguration =
+        ImageVulnerabilityReportFiltersConfiguration,
 > = {
     formik: FormikProps<T>;
 };
 
 function ImageVulnerabilityFiltersSince<
-    T extends ImageVulnerabilityFiltersConfiguration = ImageVulnerabilityFiltersConfiguration,
+    T extends ImageVulnerabilityReportFiltersConfiguration =
+        ImageVulnerabilityReportFiltersConfiguration,
 >({ formik }: ImageVulnerabilityFiltersSinceProps<T>): ReactElement {
     // Initialize with either selected start date or unspecified value.
     // Objective of local state is remember date in scenario:
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStep.tsx
similarity index 60%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStep.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStep.tsx
index 9bc20c5516647..50d71fb149696 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStep.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStep.tsx
@@ -1,5 +1,6 @@
 import type { ReactElement } from 'react';
 import { Flex, Form, PageSection, Title } from '@patternfly/react-core';
+import { getIn } from 'formik';
 import type { FormikProps } from 'formik';
 
 import type {
@@ -8,14 +9,13 @@ import type {
 } from 'Components/CompoundSearchFilter/types';
 
 import FiltersQuery from 'Components/Reports/Step/FiltersQuery';
-
-import type { ImageVulnerabilityFiltersConfigurationForEntity } from '../../imageVulnerabilityReports.types';
+import type { ImageVulnerabilityReportFiltersConfigurationForEntity } from 'services/ReportsService.types';
 
 import ImageVulnerabilityFiltersSince from './ImageVulnerabilityFiltersSince';
 
 export type ImageVulnerabilityFiltersStepProps<
-    T extends ImageVulnerabilityFiltersConfigurationForEntity =
-        ImageVulnerabilityFiltersConfigurationForEntity,
+    T extends ImageVulnerabilityReportFiltersConfigurationForEntity =
+        ImageVulnerabilityReportFiltersConfigurationForEntity,
 > = {
     attributesSeparateFromConfig: SelectSearchFilterAttribute[];
     formik: FormikProps<T>;
@@ -23,13 +23,20 @@ export type ImageVulnerabilityFiltersStepProps<
 };
 
 function ImageVulnerabilityFiltersStep<
-    T extends ImageVulnerabilityFiltersConfigurationForEntity =
-        ImageVulnerabilityFiltersConfigurationForEntity,
+    T extends ImageVulnerabilityReportFiltersConfigurationForEntity =
+        ImageVulnerabilityReportFiltersConfigurationForEntity,
 >({
     attributesSeparateFromConfig,
     formik,
     searchFilterConfig,
 }: ImageVulnerabilityFiltersStepProps<T>): ReactElement {
+    const queryPath = 'vulnReportFilters.query';
+
+    function setQueryValue(value: string, shouldValidate?: boolean) {
+        formik.setFieldValue(queryPath, value, shouldValidate);
+    }
+
+    // getIn call prevents TypeScript error for optional chaining in errors and touched objects.
     return (
         <PageSection>
             <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
@@ -38,8 +45,11 @@ function ImageVulnerabilityFiltersStep<
                     <ImageVulnerabilityFiltersSince formik={formik} />
                     <FiltersQuery
                         attributesSeparateFromConfig={attributesSeparateFromConfig}
-                        formik={formik}
+                        error={getIn(formik.errors, queryPath)}
+                        query={formik.values.vulnReportFilters.query}
                         searchFilterConfig={searchFilterConfig}
+                        setQueryValue={setQueryValue}
+                        touched={getIn(formik.touched, queryPath)}
                     />
                 </Form>
             </Flex>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStepForCollection.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStepForCollection.tsx
similarity index 89%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStepForCollection.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStepForCollection.tsx
index 5abc7f98f8308..91b7780f67ac5 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStepForCollection.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/ImageVulnerabilityFiltersStepForCollection.tsx
@@ -7,9 +7,9 @@ import SearchFilterSelectInclusive from 'Components/CompoundSearchFilter/compone
 import FormLabelGroup from 'Components/PatternFly/FormLabelGroup';
 import type { OnSearchPayload } from 'Components/CompoundSearchFilter/types';
 import { updateSearchFilter } from 'Components/CompoundSearchFilter/utils/utils';
+import type { ImageVulnerabilityReportFiltersConfigurationForCollection } from 'services/ReportsService.types';
 
-import { attributeForSeverityInBackendAndViewBasedReport } from '../../../searchFilterConfig';
-import type { ImageVulnerabilityFiltersConfigurationForCollection } from '../../imageVulnerabilityReports.types';
+import { attributeForSeverityInBackendAndViewBasedReport } from '../../../../searchFilterConfig';
 import {
     attributeForFixabilityInFiltersStepForCollection,
     getFixabilityFromSearchFilter,
@@ -20,15 +20,15 @@ import {
 import ImageVulnerabilityFiltersSince from './ImageVulnerabilityFiltersSince';
 
 export type ImageVulnerabilityFiltersStepForCollectionProps<
-    T extends ImageVulnerabilityFiltersConfigurationForCollection =
-        ImageVulnerabilityFiltersConfigurationForCollection,
+    T extends ImageVulnerabilityReportFiltersConfigurationForCollection =
+        ImageVulnerabilityReportFiltersConfigurationForCollection,
 > = {
     formik: FormikProps<T>;
 };
 
 function ImageVulnerabilityFiltersStepForCollection<
-    T extends ImageVulnerabilityFiltersConfigurationForCollection =
-        ImageVulnerabilityFiltersConfigurationForCollection,
+    T extends ImageVulnerabilityReportFiltersConfigurationForCollection =
+        ImageVulnerabilityReportFiltersConfigurationForCollection,
 >({ formik }: ImageVulnerabilityFiltersStepForCollectionProps<T>): ReactElement {
     const searchFilter = getSearchFilterFromReportConfiguration(formik.values.vulnReportFilters);
 
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/validationSchemaFilters.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/validationSchemaFilters.ts
new file mode 100644
index 0000000000000..86264538e7d29
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step3/validationSchemaFilters.ts
@@ -0,0 +1,89 @@
+import * as yup from 'yup';
+import { isValid, parse } from 'date-fns';
+
+import type {
+    CvesSince,
+    ImageVulnerabilityReportConfiguration,
+    ImageVulnerabilityReportConfigurationForCollection,
+    ImageVulnerabilityReportFiltersForEntity,
+} from 'services/ReportsService.types';
+import { vulnerabilitySeverities } from 'types/cve.proto';
+
+function isCvesSinceValid(filters: CvesSince): boolean {
+    if ('allVuln' in filters) {
+        return true;
+    }
+    if ('sinceLastSentScheduledReport' in filters) {
+        return true;
+    }
+    if ('sinceStartDate' in filters) {
+        if (!filters.sinceStartDate) {
+            return false;
+        }
+        // parse() is lenient. partial strings like "2026-10" pass isValid.
+        // Checking for "T" ensures the value is likely a full ISO timestamp.
+        return filters.sinceStartDate.includes('T') && isValid(parse(filters.sinceStartDate));
+    }
+    return false;
+}
+
+export const validationSchemaFilters = yup.lazy((values: ImageVulnerabilityReportConfiguration) => {
+    if ('entityScope' in values.resourceScope) {
+        return yup.object().shape({
+            vulnReportFilters: yup
+                .object()
+                .shape({
+                    query: yup.string().required('At least one filter is required'),
+                })
+                .test(
+                    'cves-since-entity',
+                    'CVE date range is required',
+                    function test(reportFilters) {
+                        // CvesSince is a union type that .shape() can't express.
+                        // cast so property access is type checked.
+                        const filters = reportFilters as ImageVulnerabilityReportFiltersForEntity;
+                        if ('sinceStartDate' in filters && !isCvesSinceValid(filters)) {
+                            return this.createError({
+                                path: 'vulnReportFilters.sinceStartDate',
+                                message: 'A valid start date is required',
+                            });
+                        }
+                        return isCvesSinceValid(filters);
+                    }
+                ),
+        });
+    }
+
+    return yup.object().shape({
+        vulnReportFilters: yup
+            .object()
+            .shape({
+                severities: yup
+                    .array()
+                    .of(yup.string().oneOf(vulnerabilitySeverities).required())
+                    .min(1, 'Select at least one CVE severity')
+                    .required('CVE severity is required'),
+                fixability: yup
+                    .string()
+                    .oneOf(['FIXABLE', 'NOT_FIXABLE', 'BOTH'])
+                    .required('CVE status is required'),
+            })
+            .test(
+                'cves-since-collection',
+                'CVE date range is required',
+                function test(reportFilters) {
+                    // CvesSince is a union type that .shape() can't express.
+                    // cast so property access is type checked.
+                    const filters =
+                        reportFilters as ImageVulnerabilityReportConfigurationForCollection['vulnReportFilters'];
+                    if ('sinceStartDate' in filters && !isCvesSinceValid(filters)) {
+                        return this.createError({
+                            path: 'vulnReportFilters.sinceStartDate',
+                            message: 'A valid start date is required',
+                        });
+                    }
+                    return isCvesSinceValid(filters);
+                }
+            ),
+    });
+});
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step5/ImageVulnerabilityReviewStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step5/ImageVulnerabilityReviewStep.tsx
similarity index 100%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/Wizard/Step5/ImageVulnerabilityReviewStep.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/Step5/ImageVulnerabilityReviewStep.tsx
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/imageVulnerabilityReportValidationSchemas.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/imageVulnerabilityReportValidationSchemas.ts
new file mode 100644
index 0000000000000..0ecf679dfc98c
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/imageVulnerabilityReportValidationSchemas.ts
@@ -0,0 +1,32 @@
+import * as yup from 'yup';
+
+import { validationSchemaDelivery } from 'Components/Reports/Step/validationSchemaDelivery';
+import { validationSchemaDetails } from 'Components/Reports/Step/validationSchemaDetails';
+import { ensureExhaustive } from 'utils/type.utils';
+
+import { validationSchemaResources } from './Step2/validationSchemaResources';
+import { validationSchemaFilters } from './Step3/validationSchemaFilters';
+
+export const wizardStepIds = ['details', 'resources', 'filters', 'delivery', 'review'] as const;
+export type WizardStepId = (typeof wizardStepIds)[number];
+
+export function isWizardStepId(id: string): id is WizardStepId {
+    return wizardStepIds.includes(id as WizardStepId);
+}
+
+export function getValidationSchema(stepId: WizardStepId): yup.Schema | yup.Lazy<unknown> {
+    switch (stepId) {
+        case 'details':
+            return validationSchemaDetails;
+        case 'resources':
+            return validationSchemaResources;
+        case 'filters':
+            return validationSchemaFilters;
+        case 'delivery':
+            return validationSchemaDelivery;
+        case 'review':
+            return yup.object().shape({});
+        default:
+            return ensureExhaustive(stepId);
+    }
+}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.defaults.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/imageVulnerabilityReports.defaults.ts
similarity index 90%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.defaults.ts
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/imageVulnerabilityReports.defaults.ts
index 84410a28adb3f..7a880d4a22a11 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.defaults.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/Wizard/imageVulnerabilityReports.defaults.ts
@@ -4,8 +4,8 @@ import type {
 } from 'services/ReportsService.types';
 import { getRequestQueryStringForSearchFilter } from 'utils/searchUtils';
 
-import { defaultStorage } from '../WorkloadCves/Overview/WorkloadCvesOverviewPage';
-import { fixableStatusToFixability, severityLabelToSeverity } from '../utils/searchUtils';
+import { defaultStorage } from '../../../WorkloadCves/Overview/WorkloadCvesOverviewPage';
+import { fixableStatusToFixability, severityLabelToSeverity } from '../../../utils/searchUtils';
 
 const {
     preferences: { defaultFilters },
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.utils.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/imageVulnerabilityReports.utils.ts
similarity index 86%
rename from ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.utils.ts
rename to ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/imageVulnerabilityReports.utils.ts
index b52ce41d6ffcf..285062891cc05 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/ImageVulnerabilityReports/imageVulnerabilityReports.utils.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/ImageVulnerabilityReports/imageVulnerabilityReports.utils.ts
@@ -6,6 +6,9 @@ import type {
     ImageVulnerabilityReportConfiguration,
     ImageVulnerabilityReportConfigurationForCollection,
     ImageVulnerabilityReportConfigurationForEntity,
+    ImageVulnerabilityReportFiltersConfiguration,
+    ImageVulnerabilityReportFiltersForCollectionWithoutCvesSince,
+    ImageVulnerabilityReportFiltersWithoutCvesSince,
 } from 'services/ReportsService.types';
 import type { VulnerabilitySeverity } from 'types/cve.proto';
 import type { SearchFilter } from 'types/search';
@@ -16,28 +19,25 @@ import {
     searchValueAsArray,
 } from 'utils/searchUtils';
 import { ensureExhaustive } from 'utils/type.utils';
-import { vulnerabilityConfigurationReportsPath } from 'routePaths';
-
-import type {
-    ImageVulnerabilityFiltersConfiguration,
-    ImageVulnerabilityFiltersForCollectionWithoutCvesSince,
-    ImageVulnerabilityFiltersWithoutCvesSince,
-} from './imageVulnerabilityReports.types';
+import { vulnerabilityImageConfigurationsReportsPath } from 'routePaths';
 
 // TypeScript needs help because entityScope and vulnReportFilters have mutual dependencies.
 // entityScope implies query but not fixability nore severities
 // collectionScope implies fixability and severities but not query
 
+// Although migration might have moved collectionScope into resourceScope
+// for report configurations, old snapshots might lack the resourceScope property.
+
 export function hasConfigurationForCollection(
     values: ImageVulnerabilityReportConfiguration
 ): values is ImageVulnerabilityReportConfigurationForCollection {
-    return 'collectionScope' in values.resourceScope;
+    return Boolean(values.resourceScope) && 'collectionScope' in values.resourceScope;
 }
 
 export function hasConfigurationForEntity(
     values: ImageVulnerabilityReportConfiguration
 ): values is ImageVulnerabilityReportConfigurationForEntity {
-    return 'entityScope' in values.resourceScope;
+    return Boolean(values.resourceScope) && 'entityScope' in values.resourceScope;
 }
 
 export function getTextForCvesSince(vulnReportFilters: CvesSince) {
@@ -69,8 +69,8 @@ export function getValueForCvesSince(vulnReportFilters: CvesSince) {
 // For future entity scope only, replace helper function call with the following:
 // const { query } = formik.values.vulnReportFilters;
 export function getReportFiltersWithoutCvesSince(
-    values: ImageVulnerabilityFiltersConfiguration
-): ImageVulnerabilityFiltersWithoutCvesSince {
+    values: ImageVulnerabilityReportFiltersConfiguration
+): ImageVulnerabilityReportFiltersWithoutCvesSince {
     // Idiom to ignore properties is awkward because of disjunction.
     /* eslint-disable @typescript-eslint/no-unused-vars */
     // eslint-diable-next-line @typescript-eslint/ban-ts-comment
@@ -114,7 +114,8 @@ function getFixableArrayFromFixability(fixability: Fixability): string[] {
 // TypeScript needs if statement and default return statement, but code does not call in that scenario.
 export function replaceFiltersForCollectionFromQueryInConfiguration({
     vulnReportFilters,
-}: ImageVulnerabilityFiltersConfiguration): ImageVulnerabilityFiltersWithoutCvesSince & CvesSince {
+}: ImageVulnerabilityReportFiltersConfiguration): ImageVulnerabilityReportFiltersWithoutCvesSince &
+    CvesSince {
     if ('query' in vulnReportFilters) {
         const { query, ...restOfFilters } = vulnReportFilters;
         const searchFilter = getSearchFilterFromSearchString(query);
@@ -133,7 +134,8 @@ export function replaceFiltersForCollectionFromQueryInConfiguration({
 // otherwise return the original vulnReportFilters object for entityScope.
 export function replaceFiltersForEntityFromFixabilityAndSeverityInConfiguration({
     vulnReportFilters,
-}: ImageVulnerabilityFiltersConfiguration): ImageVulnerabilityFiltersWithoutCvesSince & CvesSince {
+}: ImageVulnerabilityReportFiltersConfiguration): ImageVulnerabilityReportFiltersWithoutCvesSince &
+    CvesSince {
     if ('fixability' in vulnReportFilters && 'severities' in vulnReportFilters) {
         const { fixability, severities, ...restOfFilters } = vulnReportFilters;
 
@@ -167,7 +169,7 @@ export const attributeForFixabilityInFiltersStepForCollection: SelectExclusiveSi
 
 // Pseudo search filter (for select elements) corresponds to property names and preceding pseudo attribute.
 export function getSearchFilterFromReportConfiguration(
-    vulnReportFilters: ImageVulnerabilityFiltersForCollectionWithoutCvesSince
+    vulnReportFilters: ImageVulnerabilityReportFiltersForCollectionWithoutCvesSince
 ): SearchFilter {
     return {
         Fixable: vulnReportFilters.fixability,
@@ -195,5 +197,5 @@ export const imageTypeLabelMap: Record<ImageType, string> = {
 // 3. from search filter to request query (save report configuration)
 export function createScheduledReportForImageVulnerabilitiesURL(searchFilter: SearchFilter) {
     const query = getUrlQueryStringForSearchFilter(searchFilter);
-    return `${vulnerabilityConfigurationReportsPath}?action=createFromFilters&${query}`;
+    return `${vulnerabilityImageConfigurationsReportsPath}?action=createFromFilters&${query}`;
 }
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/NodeConfigurationsList.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/NodeConfigurationsList.tsx
new file mode 100644
index 0000000000000..226798eef0499
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/NodeConfigurationsList.tsx
@@ -0,0 +1,461 @@
+import { useCallback, useState } from 'react';
+import { Link, generatePath, useNavigate } from 'react-router-dom-v5-compat';
+import {
+    Alert,
+    AlertActionCloseButton,
+    AlertGroup,
+    Button,
+    Content,
+    DropdownItem,
+    Flex,
+    FlexItem,
+    PageSection,
+    Pagination,
+    SearchInput,
+    Toolbar,
+    ToolbarContent,
+    ToolbarItem,
+} from '@patternfly/react-core';
+import { ActionsColumn, Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
+import type { IAction } from '@patternfly/react-table';
+
+import HelpIconTh from 'Components/HelpIconTh';
+import MenuDropdown from 'Components/PatternFly/MenuDropdown';
+import PageTitle from 'Components/PageTitle';
+import JobStatusPopoverContent from 'Components/ReportJob/JobStatusPopoverContent';
+import MyLastJobStatus from 'Components/ReportJob/MyLastJobStatus';
+import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
+import useAuthStatus from 'hooks/useAuthStatus';
+import useToasts from 'hooks/patternfly/useToasts';
+import type { Toast } from 'hooks/patternfly/useToasts';
+import usePermissions from 'hooks/usePermissions';
+import useRestQuery from 'hooks/useRestQuery';
+import useTableSelection from 'hooks/useTableSelection';
+import useURLPagination from 'hooks/useURLPagination';
+import useURLSearch from 'hooks/useURLSearch';
+import useURLSort from 'hooks/useURLSort';
+import {
+    vulnerabilityNodeConfigurationsReportsDetailsPath,
+    vulnerabilityNodeConfigurationsReportsPath,
+} from 'routePaths';
+import {
+    deleteNodeReportConfiguration,
+    fetchMyNodeReportHistory,
+    fetchNodeReportConfigurations,
+    fetchNodeReportConfigurationsCount,
+    nodeReportDownloadURL,
+    runNodeReport,
+} from 'services/NodeReportsService';
+import { getTableUIState } from 'utils/getTableUIState';
+
+import DeleteReportsModal from '../../components/DeleteReportsModal';
+import useRunReport from '../../../VulnerablityReporting/api/useRunReport';
+import { useWatchLastSnapshotForReports } from '../../../VulnerablityReporting/api/useWatchLastSnapshotForReports';
+import useDeleteModal from '../../../VulnerablityReporting/hooks/useDeleteModal';
+
+const CreateReportsButton = () => {
+    return (
+        <Link to={`${vulnerabilityNodeConfigurationsReportsPath}?action=create`}>
+            <Button variant="primary">Create report</Button>
+        </Link>
+    );
+};
+
+const reportNameSearchKey = 'Report Name';
+
+const sortOptions = {
+    sortFields: [reportNameSearchKey],
+    defaultSortOption: { field: reportNameSearchKey, direction: 'asc' } as const,
+};
+
+function NodeConfigurationsList() {
+    const navigate = useNavigate();
+    const { currentUser } = useAuthStatus();
+    const { toasts, addToast, removeToast } = useToasts();
+
+    const { hasReadWriteAccess, hasReadAccess } = usePermissions();
+    const hasDeleteAccessForReport = hasReadWriteAccess('WorkflowAdministration');
+    const hasWriteAccessForReport =
+        hasReadWriteAccess('WorkflowAdministration') && hasReadAccess('Integration');
+
+    // single source of truth for which optional columns actually render, should prevent drift if
+    // any permissions change above
+    const hasSelectColumn = hasDeleteAccessForReport;
+    const hasActionsColumn = hasDeleteAccessForReport || hasWriteAccessForReport;
+
+    const { page, perPage, setPage, setPerPage } = useURLPagination(10);
+    const { sortOption, getSortParams } = useURLSort(sortOptions);
+    const { searchFilter, setSearchFilter } = useURLSearch();
+    const [searchValue, setSearchValue] = useState(() => {
+        const value = searchFilter?.[reportNameSearchKey];
+        return typeof value === 'string' ? value : '';
+    });
+
+    const fetchReportConfigurationsCallback = useCallback(
+        () =>
+            fetchNodeReportConfigurations({
+                searchFilter,
+                page,
+                perPage,
+                sortOption,
+            }),
+        [searchFilter, page, perPage, sortOption]
+    );
+    const {
+        data: reportConfigurations,
+        isLoading: isListLoading,
+        error: listError,
+        refetch: refetchList,
+    } = useRestQuery(fetchReportConfigurationsCallback);
+
+    const fetchReportConfigurationsCountCallback = useCallback(
+        () => fetchNodeReportConfigurationsCount(searchFilter),
+        [searchFilter]
+    );
+    const { data: countData, refetch: refetchCount } = useRestQuery(
+        fetchReportConfigurationsCountCallback
+    );
+
+    const { reportSnapshots, isLoading: isLoadingReportSnapshots } = useWatchLastSnapshotForReports(
+        reportConfigurations ?? null,
+        fetchMyNodeReportHistory
+    );
+
+    const { isRunning, runError, runReport } = useRunReport({
+        runReportRequest: runNodeReport,
+        onCompleted: ({ reportNotificationMethod }) => {
+            if (reportNotificationMethod === 'EMAIL') {
+                addToast('The report has been sent to the configured email notifier', 'success');
+            } else if (reportNotificationMethod === 'DOWNLOAD') {
+                addToast(
+                    'The report generation has started and will be available for download once complete',
+                    'success'
+                );
+            }
+            refetchList();
+        },
+    });
+
+    // table should still load even if countData is not available
+    const totalReports = countData?.count ?? 0;
+
+    const tableState = getTableUIState({
+        isLoading: isListLoading,
+        data: reportConfigurations,
+        error: listError,
+        searchFilter,
+    });
+
+    const {
+        selected,
+        numSelected,
+        allRowsSelected,
+        hasSelections,
+        onSelect,
+        onSelectAll,
+        onClearAll: onClearAllSelected,
+        getSelectedIds,
+    } = useTableSelection(reportConfigurations ?? []);
+
+    const {
+        openDeleteModal,
+        isDeleteModalOpen,
+        closeDeleteModal,
+        isDeleting,
+        onDelete,
+        deleteResults,
+        reportIdsToDelete,
+    } = useDeleteModal({
+        deleteFunction: deleteNodeReportConfiguration,
+        onCompleted: () => {
+            onClearAllSelected();
+            refetchList();
+            refetchCount();
+        },
+    });
+
+    function onConfirmDeleteSelection() {
+        openDeleteModal(getSelectedIds());
+    }
+
+    const colSpan = 4 + (hasSelectColumn ? 1 : 0) + (hasActionsColumn ? 1 : 0);
+
+    function onClearFilters() {
+        setSearchValue('');
+        setSearchFilter({});
+        setPage(1);
+    }
+
+    return (
+        <>
+            <AlertGroup isToast isLiveRegion>
+                {toasts.map(({ key, variant, title, children }: Toast) => (
+                    <Alert
+                        key={key}
+                        variant={variant}
+                        title={title}
+                        component="p"
+                        timeout
+                        onTimeout={() => removeToast(key)}
+                        actionClose={
+                            <AlertActionCloseButton
+                                title={title}
+                                variantLabel={variant}
+                                onClose={() => removeToast(key)}
+                            />
+                        }
+                    >
+                        {children}
+                    </Alert>
+                ))}
+            </AlertGroup>
+            <PageTitle title="Node vulnerability reports - Scheduled reports" />
+            <PageSection>
+                {runError && <Alert variant="danger" isInline title={runError} component="p" />}
+                <Flex direction={{ default: 'row' }} alignItems={{ default: 'alignItemsCenter' }}>
+                    <FlexItem>
+                        <Content component="p">
+                            Configure scheduled reports for node vulnerabilities.
+                        </Content>
+                    </FlexItem>
+                    {reportConfigurations &&
+                        reportConfigurations.length > 0 &&
+                        hasWriteAccessForReport && (
+                            <FlexItem align={{ default: 'alignRight' }}>
+                                <CreateReportsButton />
+                            </FlexItem>
+                        )}
+                </Flex>
+            </PageSection>
+            <PageSection>
+                <Toolbar>
+                    <ToolbarContent>
+                        <ToolbarItem className="pf-v6-u-flex-grow-1">
+                            <SearchInput
+                                placeholder="Filter by report name"
+                                value={searchValue}
+                                onChange={(_event, value) => setSearchValue(value)}
+                                onSearch={(_event, value) => {
+                                    setSearchValue(value);
+                                    setSearchFilter({ [reportNameSearchKey]: value });
+                                    setPage(1);
+                                }}
+                                onClear={onClearFilters}
+                            />
+                        </ToolbarItem>
+                        {hasDeleteAccessForReport && (
+                            <ToolbarItem>
+                                <MenuDropdown toggleText="Bulk actions" isDisabled={!hasSelections}>
+                                    <DropdownItem key="delete" onClick={onConfirmDeleteSelection}>
+                                        Delete ({numSelected})
+                                    </DropdownItem>
+                                </MenuDropdown>
+                            </ToolbarItem>
+                        )}
+                        <ToolbarItem variant="pagination" align={{ default: 'alignEnd' }}>
+                            <Pagination
+                                itemCount={totalReports}
+                                page={page}
+                                perPage={perPage}
+                                onSetPage={(_, newPage) => setPage(newPage)}
+                                onPerPageSelect={(_, newPerPage) => setPerPage(newPerPage)}
+                                isCompact
+                            />
+                        </ToolbarItem>
+                    </ToolbarContent>
+                </Toolbar>
+                <Table>
+                    <Thead noWrap>
+                        <Tr>
+                            {hasSelectColumn && (
+                                <Th
+                                    select={{
+                                        onSelect: onSelectAll,
+                                        isSelected: allRowsSelected,
+                                    }}
+                                />
+                            )}
+                            <Th sort={getSortParams(reportNameSearchKey)}>Report</Th>
+                            <HelpIconTh
+                                popoverContent={
+                                    <div>
+                                        A set of user-configured rules to select nodes by Custom
+                                        scope
+                                    </div>
+                                }
+                            >
+                                Resources
+                            </HelpIconTh>
+                            <Th>Description</Th>
+                            <HelpIconTh
+                                popoverContent={
+                                    <JobStatusPopoverContent
+                                        statuses={[
+                                            'WAITING',
+                                            'PREPARING',
+                                            'DOWNLOAD_GENERATED',
+                                            'EMAIL_DELIVERED',
+                                            'ERROR',
+                                        ]}
+                                    />
+                                }
+                            >
+                                My last job status
+                            </HelpIconTh>
+                            {hasActionsColumn && <Th screenReaderText="Row actions" />}
+                        </Tr>
+                    </Thead>
+                    <TbodyUnified
+                        tableState={tableState}
+                        colSpan={colSpan}
+                        errorProps={{ title: 'Unable to get node report configurations' }}
+                        emptyProps={{
+                            title: 'No node vulnerability reports yet',
+                            message: hasWriteAccessForReport
+                                ? 'To get started, create a report'
+                                : '',
+                            children: hasWriteAccessForReport ? <CreateReportsButton /> : undefined,
+                        }}
+                        filteredEmptyProps={{ onClearFilters }}
+                        renderer={({ data }) =>
+                            data.map((report, rowIndex) => {
+                                const reportURL = generatePath(
+                                    vulnerabilityNodeConfigurationsReportsDetailsPath,
+                                    {
+                                        reportId: report.id,
+                                    }
+                                );
+                                const snapshot = reportSnapshots[report.id];
+                                const isReportStatusPending =
+                                    snapshot?.reportStatus.runState === 'PREPARING' ||
+                                    snapshot?.reportStatus.runState === 'WAITING';
+
+                                const writeActions: IAction[] = hasWriteAccessForReport
+                                    ? [
+                                          {
+                                              title: 'Edit report',
+                                              onClick: (event) => {
+                                                  event.preventDefault();
+                                                  navigate(`${reportURL}?action=edit`);
+                                              },
+                                              isDisabled: isReportStatusPending,
+                                          },
+                                          { isSeparator: true },
+                                          {
+                                              title: 'Send report',
+                                              description:
+                                                  report.notifiers.length === 0
+                                                      ? 'No delivery destinations set'
+                                                      : '',
+                                              onClick: (event) => {
+                                                  event.preventDefault();
+                                                  runReport(report.id, 'EMAIL');
+                                              },
+                                              isDisabled:
+                                                  isReportStatusPending ||
+                                                  report.notifiers.length === 0,
+                                          },
+                                          {
+                                              title: 'Generate download',
+                                              onClick: (event) => {
+                                                  event.preventDefault();
+                                                  runReport(report.id, 'DOWNLOAD');
+                                              },
+                                              isDisabled: isReportStatusPending,
+                                          },
+                                          {
+                                              title: 'Clone report',
+                                              onClick: (event) => {
+                                                  event.preventDefault();
+                                                  navigate(`${reportURL}?action=clone`);
+                                              },
+                                          },
+                                      ]
+                                    : [];
+                                const deleteActions: IAction[] = hasDeleteAccessForReport
+                                    ? [
+                                          {
+                                              title: (
+                                                  <span
+                                                      className={
+                                                          !isReportStatusPending
+                                                              ? 'pf-v6-u-text-color-status-danger'
+                                                              : ''
+                                                      }
+                                                  >
+                                                      Delete report
+                                                  </span>
+                                              ),
+                                              onClick: (event) => {
+                                                  event.preventDefault();
+                                                  openDeleteModal([report.id]);
+                                              },
+                                              isDisabled: isReportStatusPending,
+                                          },
+                                      ]
+                                    : [];
+                                const rowActions: IAction[] = [
+                                    ...writeActions,
+                                    ...(writeActions.length > 0 && deleteActions.length > 0
+                                        ? [{ isSeparator: true } as IAction]
+                                        : []),
+                                    ...deleteActions,
+                                ];
+
+                                return (
+                                    <Tbody key={report.id}>
+                                        <Tr>
+                                            {hasSelectColumn && (
+                                                <Td
+                                                    select={{
+                                                        rowIndex,
+                                                        onSelect,
+                                                        isSelected: selected[rowIndex],
+                                                    }}
+                                                />
+                                            )}
+                                            <Td dataLabel="Report">
+                                                <Link to={reportURL}>{report.name}</Link>
+                                            </Td>
+                                            <Td dataLabel="Resources">Custom scope</Td>
+                                            <Td dataLabel="Description">
+                                                {report.description || '-'}
+                                            </Td>
+                                            <Td dataLabel="My last job status">
+                                                <MyLastJobStatus
+                                                    snapshot={snapshot}
+                                                    isLoadingSnapshots={isLoadingReportSnapshots}
+                                                    currentUserId={currentUser.userId}
+                                                    baseDownloadURL={nodeReportDownloadURL}
+                                                />
+                                            </Td>
+                                            {hasActionsColumn && (
+                                                <Td isActionCell>
+                                                    <ActionsColumn
+                                                        items={rowActions}
+                                                        isDisabled={isRunning}
+                                                    />
+                                                </Td>
+                                            )}
+                                        </Tr>
+                                    </Tbody>
+                                );
+                            })
+                        }
+                    />
+                </Table>
+            </PageSection>
+            <DeleteReportsModal
+                isOpen={isDeleteModalOpen}
+                onClose={closeDeleteModal}
+                isDeleting={isDeleting}
+                onDelete={onDelete}
+                reportIdsToDelete={reportIdsToDelete}
+                deleteResults={deleteResults}
+                reportConfigurations={reportConfigurations ?? null}
+            />
+        </>
+    );
+}
+
+export default NodeConfigurationsList;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeReportJobs.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeReportJobs.tsx
new file mode 100644
index 0000000000000..71e36325a0b25
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeReportJobs.tsx
@@ -0,0 +1,159 @@
+import { useCallback, useMemo } from 'react';
+import {
+    Pagination,
+    Toolbar,
+    ToolbarContent,
+    ToolbarItem,
+    useInterval,
+} from '@patternfly/react-core';
+
+import MyJobsFilter from 'Components/ReportJob/MyJobsFilter';
+import ReportJobStatusFilter, {
+    isReportJobStatus,
+} from 'Components/ReportJob/ReportJobStatusFilter';
+import type { ReportJobStatus } from 'Components/ReportJob/types';
+import useRestQuery from 'hooks/useRestQuery';
+import useURLPagination from 'hooks/useURLPagination';
+import useURLSearch from 'hooks/useURLSearch';
+import useURLSort from 'hooks/useURLSort';
+import useURLStringUnion from 'hooks/useURLStringUnion';
+import { fetchMyNodeReportHistory, fetchNodeReportHistory } from 'services/NodeReportsService';
+import { toggleItemInArray } from 'utils/arrayUtils';
+import { ensureBoolean, ensureStringArray } from 'utils/ensure';
+import { getTableUIState } from 'utils/getTableUIState';
+
+import NodeReportJobsTable from './NodeReportJobsTable';
+import { getRequestQueryString } from '../../../../VulnerablityReporting/api/apiUtils';
+
+export type NodeReportJobsProps = {
+    reportId: string;
+};
+
+const sortOptions = {
+    sortFields: ['Report Completion Time'],
+    defaultSortOption: { field: 'Report Completion Time', direction: 'desc' } as const,
+};
+
+const reportStateByJobStatus: Partial<Record<ReportJobStatus, string>> = {
+    WAITING: 'WAITING',
+    PREPARING: 'PREPARING',
+    ERROR: 'FAILURE',
+    DOWNLOAD_GENERATED: 'GENERATED',
+    EMAIL_DELIVERED: 'DELIVERED',
+};
+
+function NodeReportJobs({ reportId }: NodeReportJobsProps) {
+    const { page, perPage, setPage, setPerPage } = useURLPagination(10);
+    const { sortOption, getSortParams } = useURLSort(sortOptions);
+    const { searchFilter, setSearchFilter } = useURLSearch();
+    const [isViewingOnlyMyJobs, setIsViewingOnlyMyJobs] = useURLStringUnion('viewOnlyMyJobs', [
+        'false',
+        'true',
+    ]);
+
+    const reportJobStatusFilters = useMemo(() => {
+        return ensureStringArray(searchFilter['Report Job Status']).filter(isReportJobStatus);
+    }, [searchFilter]);
+
+    const fetchNodeReportsHistoryCallback = useCallback(() => {
+        const fetchHistory =
+            isViewingOnlyMyJobs === 'true' ? fetchMyNodeReportHistory : fetchNodeReportHistory;
+
+        const query = getRequestQueryString({
+            'Report state': reportJobStatusFilters.flatMap(
+                (status) => reportStateByJobStatus[status] ?? []
+            ),
+        });
+
+        return fetchHistory({
+            id: reportId,
+            query,
+            page,
+            perPage,
+            sortOption,
+        });
+    }, [reportId, reportJobStatusFilters, page, perPage, sortOption, isViewingOnlyMyJobs]);
+
+    const { data, isLoading, error, refetch } = useRestQuery(fetchNodeReportsHistoryCallback, {
+        clearErrorBeforeRequest: false,
+    });
+
+    const tableState = getTableUIState({
+        isLoading,
+        data,
+        error,
+        searchFilter,
+        isPolling: true,
+    });
+
+    const onReportJobStatusFilterChange = (_checked: boolean, selectedStatus: ReportJobStatus) => {
+        const newFilters = toggleItemInArray(reportJobStatusFilters, selectedStatus);
+        setSearchFilter({
+            ...searchFilter,
+            'Report Job Status': newFilters,
+        });
+        setPage(1);
+    };
+
+    const onMyJobsFilterChange = (checked: boolean) => {
+        setIsViewingOnlyMyJobs(String(checked));
+        setPage(1);
+    };
+
+    useInterval(refetch, 10000);
+
+    return (
+        <>
+            <Toolbar>
+                <ToolbarContent>
+                    <ToolbarItem alignItems="center">
+                        <ReportJobStatusFilter
+                            availableStatuses={[
+                                'WAITING',
+                                'PREPARING',
+                                'DOWNLOAD_GENERATED',
+                                'EMAIL_DELIVERED',
+                                'ERROR',
+                            ]}
+                            selectedStatuses={reportJobStatusFilters}
+                            onChange={onReportJobStatusFilterChange}
+                        />
+                    </ToolbarItem>
+                    <ToolbarItem alignSelf="center">
+                        <MyJobsFilter
+                            isViewingOnlyMyJobs={ensureBoolean(isViewingOnlyMyJobs)}
+                            onMyJobsFilterChange={onMyJobsFilterChange}
+                        />
+                    </ToolbarItem>
+                    <ToolbarItem variant="pagination" align={{ default: 'alignEnd' }}>
+                        <Pagination
+                            toggleTemplate={({ firstIndex, lastIndex }) => (
+                                <span>
+                                    <b>
+                                        {firstIndex} - {lastIndex}
+                                    </b>{' '}
+                                    of <b>many</b>
+                                </span>
+                            )}
+                            page={page}
+                            perPage={perPage}
+                            onSetPage={(_, newPage) => setPage(newPage)}
+                            onPerPageSelect={(_, newPerPage) => setPerPage(newPerPage)}
+                            isCompact
+                        />
+                    </ToolbarItem>
+                </ToolbarContent>
+            </Toolbar>
+            <NodeReportJobsTable
+                tableState={tableState}
+                getSortParams={getSortParams}
+                onClearFilters={() => {
+                    setSearchFilter({});
+                    setPage(1);
+                }}
+            />
+        </>
+    );
+}
+
+export default NodeReportJobs;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeReportJobsTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeReportJobsTable.tsx
new file mode 100644
index 0000000000000..82ed39d09a5c7
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeReportJobsTable.tsx
@@ -0,0 +1,140 @@
+import { Flex, FlexItem } from '@patternfly/react-core';
+import { ExpandableRowContent, Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
+
+import ReportJobStatus from 'Components/ReportJob/ReportJobStatus';
+import { onDownloadReport } from 'Components/ReportJob/utils';
+import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
+import useAuthStatus from 'hooks/useAuthStatus';
+import useSet from 'hooks/useSet';
+import type { GetSortParams } from 'hooks/useURLSort';
+import { nodeReportDownloadURL } from 'services/NodeReportsService';
+import type {
+    ConfiguredReportSnapshot,
+    NodeVulnerabilityReportConfiguration,
+} from 'services/ReportsService.types';
+import { getDateTime } from 'utils/dateUtils';
+import type { TableUIState } from 'utils/getTableUIState';
+
+import NodeVulnerabilityReportView from './NodeVulnerabilityReportView';
+import {
+    attributesSeparateFromConfigForNodeVulnerabilityReport,
+    searchFilterConfigForNodeVulnerabilityReport,
+} from '../../../../searchFilterConfig';
+import JobDetails from '../../../../VulnerablityReporting/ViewVulnReport/JobDetails';
+
+export type NodeReportJobsTableProps = {
+    tableState: TableUIState<ConfiguredReportSnapshot>;
+    getSortParams: GetSortParams;
+    onClearFilters: () => void;
+};
+
+function NodeReportJobsTable({
+    tableState,
+    getSortParams,
+    onClearFilters,
+}: NodeReportJobsTableProps) {
+    const { currentUser } = useAuthStatus();
+    const expandedRowSet = useSet<string>();
+
+    return (
+        <Table aria-label="Node report jobs table">
+            <Thead>
+                <Tr>
+                    <Th screenReaderText="Row expansion" />
+                    <Th>Job status</Th>
+                    <Th sort={getSortParams('Report Completion Time')}>Completed</Th>
+                    <Th>Requester</Th>
+                </Tr>
+            </Thead>
+            <TbodyUnified
+                tableState={tableState}
+                colSpan={4}
+                emptyProps={{
+                    title: 'No report jobs found',
+                    message:
+                        'Send or generate a report from the Actions menu to create a report job.',
+                }}
+                filteredEmptyProps={{ onClearFilters }}
+                renderer={({ data }) =>
+                    data.map((snapshot, rowIndex) => {
+                        const { user, reportStatus, isDownloadAvailable, reportJobId, name } =
+                            snapshot;
+                        const areDownloadActionsDisabled = currentUser.userId !== user.id;
+                        const isExpanded = expandedRowSet.has(reportJobId);
+
+                        return (
+                            <Tbody key={reportJobId} isExpanded={isExpanded}>
+                                <Tr>
+                                    <Td
+                                        expand={{
+                                            rowIndex,
+                                            isExpanded,
+                                            onToggle: () => expandedRowSet.toggle(reportJobId),
+                                        }}
+                                    />
+                                    <Td dataLabel="Job status">
+                                        <ReportJobStatus
+                                            reportStatus={reportStatus}
+                                            isDownloadAvailable={isDownloadAvailable}
+                                            areDownloadActionsDisabled={areDownloadActionsDisabled}
+                                            onDownload={() =>
+                                                onDownloadReport({
+                                                    reportJobId,
+                                                    name,
+                                                    completedAt: reportStatus.completedAt,
+                                                    baseDownloadURL: nodeReportDownloadURL,
+                                                })
+                                            }
+                                        />
+                                    </Td>
+                                    <Td dataLabel="Completed">
+                                        {reportStatus.completedAt
+                                            ? getDateTime(reportStatus.completedAt)
+                                            : '-'}
+                                    </Td>
+                                    <Td dataLabel="Requester">{user.name}</Td>
+                                </Tr>
+                                <Tr isExpanded={isExpanded}>
+                                    <Td colSpan={4}>
+                                        <ExpandableRowContent>
+                                            <Flex
+                                                direction={{ default: 'column' }}
+                                                spaceItems={{ default: 'spaceItemsLg' }}
+                                            >
+                                                <FlexItem>
+                                                    <JobDetails
+                                                        reportStatus={reportStatus}
+                                                        isDownloadAvailable={isDownloadAvailable}
+                                                    />
+                                                </FlexItem>
+                                                <FlexItem>
+                                                    <NodeVulnerabilityReportView
+                                                        attributesSeparateFromConfig={
+                                                            attributesSeparateFromConfigForNodeVulnerabilityReport
+                                                        }
+                                                        headingLevel="h2"
+                                                        horizontalTermWidthModifier={{
+                                                            default: '24ch',
+                                                        }}
+                                                        searchFilterConfig={
+                                                            searchFilterConfigForNodeVulnerabilityReport
+                                                        }
+                                                        values={
+                                                            snapshot as unknown as NodeVulnerabilityReportConfiguration
+                                                        }
+                                                    />
+                                                </FlexItem>
+                                            </Flex>
+                                        </ExpandableRowContent>
+                                    </Td>
+                                </Tr>
+                            </Tbody>
+                        );
+                    })
+                }
+            />
+        </Table>
+    );
+}
+
+export default NodeReportJobsTable;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityFiltersView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityFiltersView.tsx
new file mode 100644
index 0000000000000..515fc9399382a
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityFiltersView.tsx
@@ -0,0 +1,70 @@
+import type { ReactElement } from 'react';
+import {
+    DescriptionList,
+    DescriptionListDescription,
+    DescriptionListGroup,
+    DescriptionListTerm,
+    Flex,
+    FlexItem,
+    Title,
+} from '@patternfly/react-core';
+import type { BreakpointModifiers } from '@patternfly/react-core';
+
+import CompoundSearchFilterDescriptionListGroups from 'Components/CompoundSearchFilter/components/CompoundSearchFilterDescriptionListGroups';
+import type {
+    CompoundSearchFilterAttribute,
+    CompoundSearchFilterConfig,
+} from 'Components/CompoundSearchFilter/types';
+import { getSearchFilterFromSearchString } from 'utils/searchUtils';
+
+import type { NodeVulnerabilityReportFiltersConfiguration } from 'services/ReportsService.types';
+
+export type NodeVulnerabilityFiltersViewProps = {
+    attributesSeparateFromConfig: CompoundSearchFilterAttribute[];
+    headingLevel: 'h2' | 'h3';
+    horizontalTermWidthModifier: BreakpointModifiers;
+    searchFilterConfig: CompoundSearchFilterConfig;
+    values: NodeVulnerabilityReportFiltersConfiguration;
+};
+
+function NodeVulnerabilityFiltersView({
+    attributesSeparateFromConfig,
+    headingLevel,
+    horizontalTermWidthModifier,
+    searchFilterConfig,
+    values,
+}: NodeVulnerabilityFiltersViewProps): ReactElement {
+    // Render separate attributes (more likely to be specified) preceding config.
+    const attributesFromConfig = searchFilterConfig.flatMap(({ attributes }) => attributes);
+    const attributes = [...attributesSeparateFromConfig, ...attributesFromConfig];
+
+    const { nodeVulnReportFilters } = values;
+    const { query } = nodeVulnReportFilters;
+    const searchFilter = getSearchFilterFromSearchString(query);
+
+    return (
+        <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
+            <FlexItem>
+                <Title headingLevel={headingLevel}>Filters</Title>
+            </FlexItem>
+            <FlexItem>
+                <DescriptionList
+                    isCompact
+                    isHorizontal
+                    horizontalTermWidthModifier={horizontalTermWidthModifier}
+                >
+                    <CompoundSearchFilterDescriptionListGroups
+                        attributes={attributes}
+                        searchFilter={searchFilter}
+                    />
+                    <DescriptionListGroup>
+                        <DescriptionListTerm>CVEs discovered in node since</DescriptionListTerm>
+                        <DescriptionListDescription>All time</DescriptionListDescription>
+                    </DescriptionListGroup>
+                </DescriptionList>
+            </FlexItem>
+        </Flex>
+    );
+}
+
+export default NodeVulnerabilityFiltersView;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityReportView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityReportView.tsx
new file mode 100644
index 0000000000000..70793d3840ad3
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityReportView.tsx
@@ -0,0 +1,59 @@
+import type { ReactElement } from 'react';
+import { Flex } from '@patternfly/react-core';
+import type { BreakpointModifiers } from '@patternfly/react-core';
+
+import type {
+    CompoundSearchFilterAttribute,
+    CompoundSearchFilterConfig,
+} from 'Components/CompoundSearchFilter/types';
+import DeliveryView from 'Components/Reports/View/DeliveryView';
+import DetailsView from 'Components/Reports/View/DetailsView';
+import type { NodeVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+
+import NodeVulnerabilityFiltersView from './NodeVulnerabilityFiltersView';
+import NodeVulnerabilityResourcesView from './NodeVulnerabilityResourcesView';
+
+export type NodeVulnerabilityReportViewProps = {
+    attributesSeparateFromConfig: CompoundSearchFilterAttribute[];
+    headingLevel: 'h2' | 'h3';
+    horizontalTermWidthModifier: BreakpointModifiers;
+    searchFilterConfig: CompoundSearchFilterConfig;
+    values: NodeVulnerabilityReportConfiguration;
+};
+
+function NodeVulnerabilityReportView({
+    attributesSeparateFromConfig,
+    headingLevel,
+    horizontalTermWidthModifier,
+    searchFilterConfig,
+    values,
+}: NodeVulnerabilityReportViewProps): ReactElement {
+    return (
+        <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+            <DetailsView
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                values={values}
+            />
+            <NodeVulnerabilityResourcesView
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                values={values}
+            />
+            <NodeVulnerabilityFiltersView
+                attributesSeparateFromConfig={attributesSeparateFromConfig}
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                searchFilterConfig={searchFilterConfig}
+                values={values}
+            />
+            <DeliveryView
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                values={values}
+            />
+        </Flex>
+    );
+}
+
+export default NodeVulnerabilityReportView;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityReportViewPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityReportViewPage.tsx
new file mode 100644
index 0000000000000..b25829af152f6
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityReportViewPage.tsx
@@ -0,0 +1,305 @@
+import { useCallback } from 'react';
+import { generatePath, useNavigate, useParams } from 'react-router-dom-v5-compat';
+import {
+    Alert,
+    AlertActionCloseButton,
+    AlertGroup,
+    Breadcrumb,
+    BreadcrumbItem,
+    Bullseye,
+    Divider,
+    DropdownItem,
+    Flex,
+    FlexItem,
+    PageSection,
+    Spinner,
+    Tab,
+    TabTitleText,
+    Tabs,
+    Title,
+} from '@patternfly/react-core';
+
+import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
+import NotFoundMessage from 'Components/NotFoundMessage/NotFoundMessage';
+import PageTitle from 'Components/PageTitle';
+import MenuDropdown from 'Components/PatternFly/MenuDropdown';
+import ReportJobsHelpAction from 'Components/ReportJob/ReportJobsHelpAction';
+import { jobContextTabs } from 'Components/ReportJob/types';
+import useToasts from 'hooks/patternfly/useToasts';
+import type { Toast } from 'hooks/patternfly/useToasts';
+import usePermissions from 'hooks/usePermissions';
+import useRestQuery from 'hooks/useRestQuery';
+import useURLStringUnion from 'hooks/useURLStringUnion';
+import {
+    vulnerabilityNodeConfigurationsReportsDetailsPath,
+    vulnerabilityNodeConfigurationsReportsPath,
+    vulnerabilityReportsPath,
+} from 'routePaths';
+import {
+    deleteNodeReportConfiguration,
+    fetchMyNodeReportHistory,
+    fetchNodeReportConfiguration,
+    runNodeReport,
+} from 'services/NodeReportsService';
+import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
+
+import DeleteReportsModal from '../../../components/DeleteReportsModal';
+import NodeReportJobs from './NodeReportJobs';
+import NodeVulnerabilityReportView from './NodeVulnerabilityReportView';
+import {
+    attributesSeparateFromConfigForNodeVulnerabilityReport,
+    searchFilterConfigForNodeVulnerabilityReport,
+} from '../../../../searchFilterConfig';
+import useRunReport from '../../../../VulnerablityReporting/api/useRunReport';
+import { useWatchLastSnapshotForReports } from '../../../../VulnerablityReporting/api/useWatchLastSnapshotForReports';
+import useDeleteModal from '../../../../VulnerablityReporting/hooks/useDeleteModal';
+
+const configDetailsTabId = 'NodeVulnReportsConfigDetails';
+const allReportJobsTabId = 'NodeVulnReportsConfigReportJobs';
+
+function NodeVulnerabilityReportViewPage() {
+    const navigate = useNavigate();
+    const { reportId } = useParams() as { reportId: string };
+    const [selectedTab, setSelectedTab] = useURLStringUnion('reportJobsTab', jobContextTabs);
+
+    const { hasReadWriteAccess, hasReadAccess } = usePermissions();
+    const hasDeleteAccessForReport = hasReadWriteAccess('WorkflowAdministration');
+    const hasWriteAccessForReport =
+        hasReadWriteAccess('WorkflowAdministration') && hasReadAccess('Integration');
+
+    const fetchReportConfigurationCallback = useCallback(
+        () => fetchNodeReportConfiguration(reportId),
+        [reportId]
+    );
+    const {
+        data: reportConfiguration,
+        isLoading,
+        error: fetchError,
+    } = useRestQuery(fetchReportConfigurationCallback);
+
+    const { reportSnapshots } = useWatchLastSnapshotForReports(
+        reportConfiguration ?? null,
+        fetchMyNodeReportHistory
+    );
+    const reportSnapshot = reportSnapshots[reportId];
+
+    const { toasts, addToast, removeToast } = useToasts();
+
+    const { isRunning, runError, runReport } = useRunReport({
+        runReportRequest: runNodeReport,
+        onCompleted: ({ reportNotificationMethod }) => {
+            if (reportNotificationMethod === 'EMAIL') {
+                addToast('The report has been sent to the configured email notifier', 'success');
+            } else if (reportNotificationMethod === 'DOWNLOAD') {
+                addToast(
+                    'The report generation has started and will be available for download once complete',
+                    'success'
+                );
+            }
+        },
+    });
+
+    const {
+        openDeleteModal,
+        isDeleteModalOpen,
+        closeDeleteModal,
+        isDeleting,
+        onDelete,
+        deleteResults,
+        reportIdsToDelete,
+    } = useDeleteModal({
+        deleteFunction: deleteNodeReportConfiguration,
+        onCompleted: () => {
+            navigate(vulnerabilityNodeConfigurationsReportsPath);
+        },
+    });
+
+    const reportPageURL = generatePath(vulnerabilityNodeConfigurationsReportsDetailsPath, {
+        reportId,
+    });
+
+    const isReportStatusPending =
+        reportSnapshot?.reportStatus.runState === 'PREPARING' ||
+        reportSnapshot?.reportStatus.runState === 'WAITING';
+
+    return (
+        <>
+            <AlertGroup isToast isLiveRegion>
+                {toasts.map(({ key, variant, title, children }: Toast) => (
+                    <Alert
+                        key={key}
+                        variant={variant}
+                        title={title}
+                        component="p"
+                        timeout
+                        onTimeout={() => removeToast(key)}
+                        actionClose={
+                            <AlertActionCloseButton
+                                title={title}
+                                variantLabel={variant}
+                                onClose={() => removeToast(key)}
+                            />
+                        }
+                    >
+                        {children}
+                    </Alert>
+                ))}
+            </AlertGroup>
+            {runError && <Alert variant="danger" isInline title={runError} component="p" />}
+            <PageTitle title="View node vulnerability report" />
+            {isLoading ? (
+                <Bullseye>
+                    <Spinner />
+                </Bullseye>
+            ) : fetchError || !reportConfiguration ? (
+                <NotFoundMessage
+                    title="Error fetching the node vulnerability report"
+                    message={fetchError ? getAxiosErrorMessage(fetchError) : 'No data available'}
+                    actionText="Go to node vulnerability reports"
+                    url={vulnerabilityNodeConfigurationsReportsPath}
+                />
+            ) : (
+                <>
+                    <PageSection type="breadcrumb">
+                        <Breadcrumb>
+                            <BreadcrumbItemLink to={vulnerabilityReportsPath}>
+                                Vulnerability reports
+                            </BreadcrumbItemLink>
+                            <BreadcrumbItemLink to={vulnerabilityNodeConfigurationsReportsPath}>
+                                Node vulnerability reports
+                            </BreadcrumbItemLink>
+                            <BreadcrumbItem isActive>{reportConfiguration.name}</BreadcrumbItem>
+                        </Breadcrumb>
+                    </PageSection>
+                    <PageSection>
+                        <Flex>
+                            <FlexItem flex={{ default: 'flex_1' }}>
+                                <Title headingLevel="h1">{reportConfiguration.name}</Title>
+                            </FlexItem>
+                            {(hasWriteAccessForReport || hasDeleteAccessForReport) && (
+                                <FlexItem>
+                                    <MenuDropdown
+                                        toggleText="Actions"
+                                        popperProps={{ position: 'end' }}
+                                    >
+                                        {hasWriteAccessForReport && (
+                                            <DropdownItem
+                                                onClick={() =>
+                                                    navigate(`${reportPageURL}?action=edit`)
+                                                }
+                                                isDisabled={isReportStatusPending || isRunning}
+                                            >
+                                                Edit report
+                                            </DropdownItem>
+                                        )}
+                                        {hasWriteAccessForReport && <Divider component="li" />}
+                                        {hasWriteAccessForReport && (
+                                            <DropdownItem
+                                                onClick={() => runReport(reportId, 'EMAIL')}
+                                                isDisabled={
+                                                    isReportStatusPending ||
+                                                    isRunning ||
+                                                    reportConfiguration.notifiers.length === 0
+                                                }
+                                                description={
+                                                    reportConfiguration.notifiers.length === 0
+                                                        ? 'No delivery destinations set'
+                                                        : ''
+                                                }
+                                            >
+                                                Send report
+                                            </DropdownItem>
+                                        )}
+                                        {hasWriteAccessForReport && (
+                                            <DropdownItem
+                                                onClick={() => runReport(reportId, 'DOWNLOAD')}
+                                                isDisabled={isReportStatusPending || isRunning}
+                                            >
+                                                Generate download
+                                            </DropdownItem>
+                                        )}
+                                        {hasWriteAccessForReport && (
+                                            <DropdownItem
+                                                onClick={() =>
+                                                    navigate(`${reportPageURL}?action=clone`)
+                                                }
+                                            >
+                                                Clone report
+                                            </DropdownItem>
+                                        )}
+                                        {hasDeleteAccessForReport && (
+                                            <>
+                                                {hasWriteAccessForReport && (
+                                                    <Divider component="li" />
+                                                )}
+                                                <DropdownItem
+                                                    isDanger
+                                                    onClick={() =>
+                                                        openDeleteModal([reportConfiguration.id])
+                                                    }
+                                                >
+                                                    Delete report
+                                                </DropdownItem>
+                                            </>
+                                        )}
+                                    </MenuDropdown>
+                                </FlexItem>
+                            )}
+                        </Flex>
+                    </PageSection>
+                    <PageSection type="tabs">
+                        <Tabs
+                            activeKey={selectedTab}
+                            onSelect={(_e, tab) => {
+                                setSelectedTab(tab);
+                            }}
+                            aria-label="Node report details tabs"
+                            usePageInsets
+                        >
+                            <Tab
+                                tabContentId={configDetailsTabId}
+                                eventKey="CONFIGURATION_DETAILS"
+                                title={<TabTitleText>Configuration details</TabTitleText>}
+                            />
+                            <Tab
+                                tabContentId={allReportJobsTabId}
+                                eventKey="ALL_REPORT_JOBS"
+                                title={<TabTitleText>All report jobs</TabTitleText>}
+                                actions={<ReportJobsHelpAction reportType="Vulnerability" />}
+                            />
+                        </Tabs>
+                    </PageSection>
+                    {selectedTab === 'CONFIGURATION_DETAILS' && (
+                        <PageSection isFilled hasOverflowScroll id={configDetailsTabId}>
+                            <NodeVulnerabilityReportView
+                                attributesSeparateFromConfig={
+                                    attributesSeparateFromConfigForNodeVulnerabilityReport
+                                }
+                                headingLevel="h2"
+                                horizontalTermWidthModifier={{ default: '24ch' }}
+                                values={reportConfiguration}
+                                searchFilterConfig={searchFilterConfigForNodeVulnerabilityReport}
+                            />
+                        </PageSection>
+                    )}
+                    {selectedTab === 'ALL_REPORT_JOBS' && (
+                        <PageSection id={allReportJobsTabId}>
+                            <NodeReportJobs reportId={reportId} />
+                        </PageSection>
+                    )}
+                    <DeleteReportsModal
+                        isOpen={isDeleteModalOpen}
+                        onClose={closeDeleteModal}
+                        isDeleting={isDeleting}
+                        onDelete={onDelete}
+                        reportIdsToDelete={reportIdsToDelete}
+                        deleteResults={deleteResults}
+                        reportConfigurations={[reportConfiguration]}
+                    />
+                </>
+            )}
+        </>
+    );
+}
+
+export default NodeVulnerabilityReportViewPage;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityResourcesView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityResourcesView.tsx
new file mode 100644
index 0000000000000..db170edaddf8c
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/View/NodeVulnerabilityResourcesView.tsx
@@ -0,0 +1,42 @@
+import type { ReactElement } from 'react';
+import { DescriptionList, Flex, FlexItem, Title } from '@patternfly/react-core';
+import type { BreakpointModifiers } from '@patternfly/react-core';
+
+import EntityScopeDescriptionListGroups from 'Components/EntityScope/EntityScopeDescriptionListGroups';
+
+import type { NodeVulnerabilityReportResourcesConfiguration } from 'services/ReportsService.types';
+
+export type NodeVulnerabilityResourcesViewProps = {
+    headingLevel: 'h2' | 'h3';
+    horizontalTermWidthModifier: BreakpointModifiers;
+    values: NodeVulnerabilityReportResourcesConfiguration;
+};
+
+function NodeVulnerabilityResourcesView({
+    headingLevel,
+    horizontalTermWidthModifier,
+    values,
+}: NodeVulnerabilityResourcesViewProps): ReactElement {
+    return (
+        <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
+            <FlexItem>
+                <Title headingLevel={headingLevel}>Resources</Title>
+            </FlexItem>
+            <FlexItem>
+                <DescriptionList
+                    isCompact
+                    isHorizontal
+                    horizontalTermWidthModifier={horizontalTermWidthModifier}
+                >
+                    {'entityScope' in values.resourceScope && (
+                        <EntityScopeDescriptionListGroups
+                            entityScope={values.resourceScope.entityScope}
+                        />
+                    )}
+                </DescriptionList>
+            </FlexItem>
+        </Flex>
+    );
+}
+
+export default NodeVulnerabilityResourcesView;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/NodeVulnerabilityReportWizardPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/NodeVulnerabilityReportWizardPage.tsx
new file mode 100644
index 0000000000000..4946c33d11197
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/NodeVulnerabilityReportWizardPage.tsx
@@ -0,0 +1,191 @@
+import { useEffect, useState } from 'react';
+import type { ReactElement } from 'react';
+import { useParams } from 'react-router-dom-v5-compat';
+import {
+    Alert,
+    Breadcrumb,
+    BreadcrumbItem,
+    Bullseye,
+    PageSection,
+    Spinner,
+    Title,
+} from '@patternfly/react-core';
+import { cloneDeep } from 'lodash';
+
+import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
+import { getSearchFilterConfigWithFeatureFlagDependency } from 'Components/CompoundSearchFilter/utils/utils';
+import {
+    getEntityScopeRulesFromSearchFilterForCluster,
+    getSearchFilterWithoutEntityScope,
+} from 'Components/EntityScope/utils';
+import PageTitle from 'Components/PageTitle';
+import type { ReportPageAction } from 'Components/Reports/reports.types';
+import useFeatureFlags from 'hooks/useFeatureFlags';
+import useURLSearch from 'hooks/useURLSearch';
+import { fetchNodeReportConfiguration } from 'services/NodeReportsService';
+import type { NodeVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
+import {
+    applyRegexSearchModifiers,
+    deleteKeysCaseInsensitive,
+    getHasSearchApplied,
+    getRequestQueryStringForSearchFilter,
+    // getValueByCaseInsensitiveKey,
+} from 'utils/searchUtils';
+import { vulnerabilityNodeConfigurationsReportsPath, vulnerabilityReportsPath } from 'routePaths';
+
+import {
+    attributesSeparateFromConfigForNodeVulnerabilityReport,
+    searchFilterConfigForNodeVulnerabilityReport,
+} from '../../../../searchFilterConfig';
+
+import { defaultNodeVulnerabilityReportConfiguration } from './nodeVulnerabilityReportConfiguration.defaults';
+
+import NodeVulnerabilityReportWizardPageSection from './NodeVulnerabilityReportWizardPageSection';
+
+type NodeVulnerabilityReportWizardPageProps = {
+    pageAction: ReportPageAction;
+};
+
+function NodeVulnerabilityReportWizardPage({
+    pageAction,
+}: NodeVulnerabilityReportWizardPageProps): ReactElement {
+    const { reportId } = useParams();
+    const { isFeatureFlagEnabled } = useFeatureFlags();
+    const { searchFilter } = useURLSearch();
+
+    // Keep getSearchFilterConfigWithFeatureFlagDependency for ROX_SCANNER_V4.
+    const searchFilterConfig = getSearchFilterConfigWithFeatureFlagDependency(
+        isFeatureFlagEnabled,
+        searchFilterConfigForNodeVulnerabilityReport
+    );
+
+    // Initialize null for conditional (non) rendering of wizard element
+    // until after asynchronous clone, edit, or createFromFilters updates state,
+    const [reportConfiguration, setReportConfiguration] =
+        useState<NodeVulnerabilityReportConfiguration | null>(null);
+    const [error, setError] = useState<Error | null>(null);
+    const [isLoading, setIsLoading] = useState(false);
+
+    useEffect(() => {
+        if (reportId) {
+            // action is 'clone' or 'edit'
+            setIsLoading(true);
+            fetchNodeReportConfiguration(reportId)
+                .then((data) => {
+                    setError(null);
+                    setReportConfiguration(
+                        pageAction === 'clone'
+                            ? { ...data, id: '', name: `${data.name} (COPY)` }
+                            : data
+                    );
+                })
+                .catch((error) => {
+                    setError(error);
+                    setReportConfiguration(defaultNodeVulnerabilityReportConfiguration);
+                })
+                .finally(() => {
+                    setIsLoading(false);
+                });
+        } else if (pageAction === 'createFromFilters' && getHasSearchApplied(searchFilter)) {
+            const reportConfigurationFromFilters: NodeVulnerabilityReportConfiguration = cloneDeep(
+                defaultNodeVulnerabilityReportConfiguration
+            );
+
+            const rules = getEntityScopeRulesFromSearchFilterForCluster(searchFilter);
+
+            reportConfigurationFromFilters.resourceScope.entityScope.rules = rules;
+
+            // Inconsistency in time filter:
+            // CVE Created Time from results means first discovered in system not in node.
+            // sinceStartTime in report configuration means first discovered in node.
+            // Therefore:
+            // Call deleteKeysCaseInsensitive function to delete from search filter for query.
+            // If relation is After then set corresponding property of report configuration.
+            const searchFieldLabelForTime = 'CVE Created Time';
+            // allVuln only for MVP because data does not yet exist for sinceStartDate filter.
+            /*
+            const value = getValueByCaseInsensitiveKey(searchFilter, searchFieldLabelForTime);
+            if (typeof value === 'string' && value.startsWith('>')) {
+                const result = />(\d\d)\/(\d\d)\/(\d\d\d\d)/.exec(value);
+                if (Array.isArray(result)) {
+                    // Date format differs!
+                    const [, mm, dd, yyyy] = result;
+                    const { query } = reportConfigurationFromFilters.nodeVulnReportFilters;
+                    reportConfigurationFromFilters.nodeVulnReportFilters = {
+                        query,
+                        sinceStartDate: `${yyyy}-${mm}-${dd}T00:00:00.000Z`,
+                    };
+                }
+            }
+            */
+
+            const searchFilterWithoutEntityScope = getSearchFilterWithoutEntityScope(
+                deleteKeysCaseInsensitive(searchFilter, [searchFieldLabelForTime])
+            );
+
+            reportConfigurationFromFilters.nodeVulnReportFilters.query =
+                getRequestQueryStringForSearchFilter(
+                    applyRegexSearchModifiers(searchFilterWithoutEntityScope)
+                );
+
+            setReportConfiguration(reportConfigurationFromFilters);
+        } else {
+            setReportConfiguration(defaultNodeVulnerabilityReportConfiguration); // create
+        }
+    }, [pageAction, reportId, searchFilter]);
+
+    const heading = reportConfiguration?.name || 'Create report';
+
+    return (
+        <>
+            <PageTitle title="Node vulnerability reports - Scheduled report" />
+            {isLoading ? (
+                <Bullseye>
+                    <Spinner />
+                </Bullseye>
+            ) : (
+                <>
+                    <PageSection type="breadcrumb">
+                        <Breadcrumb>
+                            <BreadcrumbItemLink to={vulnerabilityReportsPath}>
+                                Vulnerability reports
+                            </BreadcrumbItemLink>
+                            <BreadcrumbItemLink to={vulnerabilityNodeConfigurationsReportsPath}>
+                                Node vulnerability reports
+                            </BreadcrumbItemLink>
+                            <BreadcrumbItem isActive>{heading}</BreadcrumbItem>
+                        </Breadcrumb>
+                    </PageSection>
+                    <PageSection>
+                        <Title headingLevel="h1">{heading}</Title>
+                        <div>Configure scheduled reports for node vulnerabilities.</div>
+                    </PageSection>
+                    {error ? (
+                        <PageSection isFilled>
+                            <Alert
+                                variant="danger"
+                                title="Unable to fetch report"
+                                isInline
+                                component="p"
+                            >
+                                {getAxiosErrorMessage(error)}
+                            </Alert>
+                        </PageSection>
+                    ) : reportConfiguration !== null ? (
+                        <NodeVulnerabilityReportWizardPageSection
+                            attributesSeparateFromConfig={
+                                attributesSeparateFromConfigForNodeVulnerabilityReport
+                            }
+                            initialValues={reportConfiguration}
+                            pageAction={pageAction}
+                            searchFilterConfig={searchFilterConfig}
+                        />
+                    ) : null}
+                </>
+            )}
+        </>
+    );
+}
+
+export default NodeVulnerabilityReportWizardPage;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/NodeVulnerabilityReportWizardPageSection.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/NodeVulnerabilityReportWizardPageSection.tsx
new file mode 100644
index 0000000000000..a657f1444d7a1
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/NodeVulnerabilityReportWizardPageSection.tsx
@@ -0,0 +1,281 @@
+import { useEffect, useState } from 'react';
+import type { ReactElement } from 'react';
+import { generatePath, useNavigate } from 'react-router-dom-v5-compat';
+import {
+    PageSection,
+    Wizard,
+    WizardFooter,
+    WizardStep,
+    useWizardContext,
+} from '@patternfly/react-core';
+import type { WizardStepType } from '@patternfly/react-core';
+import { useFormik } from 'formik';
+import type { FormikProps } from 'formik';
+import merge from 'lodash/merge';
+import set from 'lodash/set';
+import * as yup from 'yup';
+
+import type {
+    CompoundSearchFilterConfig,
+    GenericSelectSearchFilterAttribute,
+} from 'Components/CompoundSearchFilter/types';
+import DeliveryStep from 'Components/Reports/Step/DeliveryStep';
+import DetailsStep from 'Components/Reports/Step/DetailsStep';
+import type { ReportPageAction } from 'Components/Reports/reports.types';
+import useAnalytics, { NODE_VULNERABILITY_REPORTS_WIZARD_SAVE_CLICKED } from 'hooks/useAnalytics';
+import {
+    createNodeReportConfiguration,
+    updateNodeReportConfiguration,
+} from 'services/NodeReportsService';
+import type { NodeVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+import { vulnerabilityNodeConfigurationsReportsDetailsPath } from 'routePaths';
+
+import { getValidationSchema, isWizardStepId } from './nodeVulnerabilityReportValidationSchemas';
+import type { WizardStepId } from './nodeVulnerabilityReportValidationSchemas';
+import NodeVulnerabilityResourcesStep from './Step2/NodeVulnerabilityResourcesStep';
+import NodeVulnerabilityFiltersStep from './Step3/NodeVulnerabilityFiltersStep';
+import NodeVulnerabilityReviewStep from './Step5/NodeVulnerabilityReviewStep';
+
+type ValidatingWizardFooterProps = {
+    formik: FormikProps<NodeVulnerabilityReportConfiguration>;
+    stepId: WizardStepId;
+    onClose: () => void;
+};
+
+function ValidatingWizardFooter({ formik, stepId, onClose }: ValidatingWizardFooterProps) {
+    const { activeStep, goToNextStep, goToPrevStep } = useWizardContext();
+
+    function handleNext() {
+        try {
+            // abortEarly is false so all errors on the current step are returned and can be touched
+            getValidationSchema(stepId).validateSync(formik.values, { abortEarly: false });
+            Promise.resolve(goToNextStep()).catch(() => {});
+        } catch (error) {
+            // touches fields that failed validation on the current step so errors are displayed
+            if (error instanceof yup.ValidationError) {
+                const touched: Record<string, unknown> = {};
+                error.inner.forEach((err) => {
+                    if (err.path) {
+                        set(touched, err.path, true);
+                    }
+                });
+                formik.setTouched(merge({}, formik.touched, touched));
+            }
+        }
+    }
+
+    return (
+        <WizardFooter
+            activeStep={activeStep}
+            isBackDisabled={stepId === 'details'}
+            onNext={handleNext}
+            onBack={goToPrevStep}
+            onClose={onClose}
+        />
+    );
+}
+
+export type NodeVulnerabilityReportWizardPageSectionProps = {
+    attributesSeparateFromConfig: GenericSelectSearchFilterAttribute[];
+    initialValues: NodeVulnerabilityReportConfiguration;
+    pageAction: ReportPageAction;
+    searchFilterConfig: CompoundSearchFilterConfig;
+};
+
+function NodeVulnerabilityReportWizardPageSection({
+    attributesSeparateFromConfig,
+    initialValues,
+    pageAction,
+    searchFilterConfig,
+}: NodeVulnerabilityReportWizardPageSectionProps): ReactElement {
+    const { analyticsTrack } = useAnalytics();
+    const navigate = useNavigate();
+    const [error, setError] = useState<Error | null>(null);
+    const [stepId, setStepId] = useState<WizardStepId>('details');
+
+    const formik = useFormik({
+        initialValues,
+        validateOnMount: true,
+        validationSchema: getValidationSchema(stepId),
+        onSubmit: (values: NodeVulnerabilityReportConfiguration, { setSubmitting }) => {
+            const request =
+                pageAction === 'edit'
+                    ? updateNodeReportConfiguration(values.id, values)
+                    : createNodeReportConfiguration(values);
+
+            request
+                .then((data) => {
+                    const { notifiers, resourceScope, schedule } = values;
+                    analyticsTrack({
+                        event: NODE_VULNERABILITY_REPORTS_WIZARD_SAVE_CLICKED,
+                        properties: {
+                            action: pageAction,
+                            cvesSince: 'allVuln', // getValueForCvesSince(nodeVulnReportFilters),
+                            intervalType: schedule?.intervalType ?? 'UNSET',
+                            notifiers: notifiers.length,
+                            resourceScope: Object.keys(resourceScope)[0] ?? '',
+                        },
+                    });
+
+                    if (pageAction === 'edit') {
+                        // Go back either to reports table or page for existing report.
+                        navigate(-1);
+                    } else {
+                        // Go to page for new report.
+                        const reportURL = generatePath(
+                            vulnerabilityNodeConfigurationsReportsDetailsPath,
+                            {
+                                reportId: data.id,
+                            }
+                        );
+                        navigate(reportURL);
+                    }
+                })
+                .catch((errorCaught) => {
+                    setError(errorCaught);
+                })
+                .finally(() => {
+                    setSubmitting(false);
+                });
+        },
+    });
+
+    const { dirty, isSubmitting, isValid, submitForm, validateForm } = formik;
+
+    useEffect(() => {
+        validateForm().catch(() => {});
+    }, [stepId, validateForm]);
+
+    function isStepValid(id: WizardStepId): boolean {
+        try {
+            getValidationSchema(id).validateSync(formik.values);
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    function onStepChange(_event: unknown, currentStep: WizardStepType): void {
+        const id = String(currentStep.id);
+        if (isWizardStepId(id)) {
+            setStepId(id);
+        }
+    }
+
+    function onClose() {
+        // Go back either to reports table or page for existing report ore results page (for createFromFilters).
+        navigate(-1);
+    }
+
+    const isDetailsValid = isStepValid('details');
+    const isResourcesValid = isStepValid('resources');
+    const isFiltersValid = isStepValid('filters');
+    const isDeliveryValid = isStepValid('delivery');
+
+    return (
+        <PageSection
+            hasBodyWrapper={false}
+            isFilled
+            hasOverflowScroll
+            padding={{ default: 'noPadding' }}
+            type="wizard"
+        >
+            <Wizard
+                onClose={onClose}
+                onSave={submitForm}
+                onStepChange={onStepChange}
+                isVisitRequired={pageAction !== 'edit' && pageAction !== 'clone'}
+            >
+                <WizardStep
+                    id="details"
+                    name="Details"
+                    body={{ hasNoPadding: true }}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="details"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    <DetailsStep formik={formik} pageAction={pageAction} />
+                </WizardStep>
+                <WizardStep
+                    id="resources"
+                    name="Resources"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={!isDetailsValid}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="resources"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    <NodeVulnerabilityResourcesStep formik={formik} />
+                </WizardStep>
+                <WizardStep
+                    id="filters"
+                    name="Filters"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={!isDetailsValid || !isResourcesValid}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="filters"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    <NodeVulnerabilityFiltersStep
+                        attributesSeparateFromConfig={attributesSeparateFromConfig}
+                        formik={formik}
+                        searchFilterConfig={searchFilterConfig}
+                    />
+                </WizardStep>
+                <WizardStep
+                    id="delivery"
+                    name="Delivery"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={!isDetailsValid || !isResourcesValid || !isFiltersValid}
+                    footer={
+                        <ValidatingWizardFooter
+                            formik={formik}
+                            stepId="delivery"
+                            onClose={onClose}
+                        />
+                    }
+                >
+                    <DeliveryStep formik={formik} />
+                </WizardStep>
+                <WizardStep
+                    id="review"
+                    name="Review"
+                    body={{ hasNoPadding: true }}
+                    isDisabled={
+                        !isDetailsValid || !isResourcesValid || !isFiltersValid || !isDeliveryValid
+                    }
+                    footer={{
+                        isNextDisabled: !(
+                            (dirty || pageAction === 'clone') &&
+                            isValid &&
+                            !isSubmitting
+                        ),
+                        nextButtonProps: { isLoading: isSubmitting },
+                        nextButtonText: 'Save',
+                    }}
+                >
+                    <NodeVulnerabilityReviewStep
+                        attributesSeparateFromConfig={attributesSeparateFromConfig}
+                        error={error}
+                        searchFilterConfig={searchFilterConfig}
+                        values={formik.values}
+                    />
+                </WizardStep>
+            </Wizard>
+        </PageSection>
+    );
+}
+
+export default NodeVulnerabilityReportWizardPageSection;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step2/NodeVulnerabilityResourcesStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step2/NodeVulnerabilityResourcesStep.tsx
new file mode 100644
index 0000000000000..23dc7270de214
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step2/NodeVulnerabilityResourcesStep.tsx
@@ -0,0 +1,93 @@
+import { useState } from 'react';
+import type { ReactElement } from 'react';
+import { Flex, Form, PageSection, Radio, Title } from '@patternfly/react-core';
+import type { FormikProps } from 'formik';
+
+import EntityScopeCompoundSearchFilter from 'Components/EntityScope/EntityScopeCompoundSearchFilter';
+import {
+    getEntityScopeRulesFromSearchFilterForCluster,
+    getSearchFilterFromEntityScopeRulesForCluster,
+} from 'Components/EntityScope/utils';
+import { searchFilterConfigForCluster } from 'Components/EntityScope/searchFilterConfig';
+import FormLabelGroup from 'Components/PatternFly/FormLabelGroup';
+import type {
+    EntityScope,
+    NodeVulnerabilityReportResourcesConfiguration,
+} from 'services/ReportsService.types';
+
+export type NodeVulnerabilityResourcesStepProps<
+    T extends NodeVulnerabilityReportResourcesConfiguration =
+        NodeVulnerabilityReportResourcesConfiguration,
+> = {
+    formik: FormikProps<T>;
+};
+
+function NodeVulnerabilityResourcesStep<
+    T extends NodeVulnerabilityReportResourcesConfiguration =
+        NodeVulnerabilityReportResourcesConfiguration,
+>({ formik }: NodeVulnerabilityResourcesStepProps<T>): ReactElement {
+    const [entityScopeSelected, setEntityScopeSelected] = useState<EntityScope>(
+        'entityScope' in formik.values.resourceScope
+            ? formik.values.resourceScope.entityScope
+            : { rules: [] }
+    );
+
+    function onChangeToEntityScope() {
+        // Set resourceScope to remove any other (future) scope property.
+        formik.setFieldValue('resourceScope', { entityScope: entityScopeSelected });
+    }
+
+    function setEntityScope(entityScope: EntityScope) {
+        setEntityScopeSelected(entityScope);
+        formik.setFieldValue('resourceScope.entityScope', entityScope);
+    }
+
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Resources</Title>
+                <Form isWidthLimited>
+                    <FormLabelGroup
+                        label="Scope method"
+                        isRequired
+                        fieldId="resourceScope"
+                        touched={formik.touched}
+                        errors={formik.errors}
+                    >
+                        <Flex
+                            direction={{ default: 'column' }}
+                            spaceItems={{ default: 'spaceItemsLg' }}
+                        >
+                            <Radio
+                                id="entityScope"
+                                isChecked
+                                label="Custom scope"
+                                name="entityScope"
+                                onChange={onChangeToEntityScope}
+                                body={
+                                    <EntityScopeCompoundSearchFilter
+                                        entityScope={
+                                            'entityScope' in formik.values.resourceScope
+                                                ? formik.values.resourceScope.entityScope
+                                                : null
+                                        }
+                                        getEntityScopeRulesFromSearchFilter={
+                                            getEntityScopeRulesFromSearchFilterForCluster
+                                        }
+                                        getSearchFilterFromEntityScopeRules={
+                                            getSearchFilterFromEntityScopeRulesForCluster
+                                        }
+                                        searchFilterConfig={searchFilterConfigForCluster}
+                                        setEntityScope={setEntityScope}
+                                    />
+                                }
+                            />
+                        </Flex>
+                    </FormLabelGroup>
+                </Form>
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default NodeVulnerabilityResourcesStep;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step2/validationSchemaResources.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step2/validationSchemaResources.ts
new file mode 100644
index 0000000000000..bd37635bde8af
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step2/validationSchemaResources.ts
@@ -0,0 +1,21 @@
+import * as yup from 'yup';
+
+import type {
+    NodeVulnerabilityReportResourceScope,
+    NodeVulnerabilityReportResourcesConfiguration,
+} from 'services/ReportsService.types';
+
+export const validationSchemaResources: yup.ObjectSchema<NodeVulnerabilityReportResourcesConfiguration> =
+    yup.object().shape({
+        resourceScope: yup
+            .object()
+            .test('resource-scope-required', 'Resource scope is required', (value) => {
+                // resourceScope can be either EntityScope, or possible future saved scope,
+                // which .shape() can't express. Cast so property access is type checked.
+                const resourceScope = value as NodeVulnerabilityReportResourceScope;
+                if ('entityScope' in resourceScope) {
+                    return resourceScope.entityScope.rules.length > 0;
+                }
+                return false;
+            }) as unknown as yup.Schema<NodeVulnerabilityReportResourceScope>,
+    });
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/NodeVulnerabilityFiltersSince.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/NodeVulnerabilityFiltersSince.tsx
new file mode 100644
index 0000000000000..a107ab2700a7f
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/NodeVulnerabilityFiltersSince.tsx
@@ -0,0 +1,58 @@
+import type { ReactElement } from 'react';
+import { FormGroup, Grid, GridItem, SelectOption } from '@patternfly/react-core';
+import type { FormikProps } from 'formik';
+
+import SelectSingle from 'Components/SelectSingle/SelectSingle';
+import type { NodeVulnerabilityReportFiltersConfiguration } from 'services/ReportsService.types';
+
+export type NodeVulnerabilityFiltersSinceProps<
+    T extends NodeVulnerabilityReportFiltersConfiguration =
+        NodeVulnerabilityReportFiltersConfiguration,
+> = {
+    formik: FormikProps<T>;
+};
+
+function NodeVulnerabilityFiltersSince<
+    T extends NodeVulnerabilityReportFiltersConfiguration =
+        NodeVulnerabilityReportFiltersConfiguration,
+>({ formik }: NodeVulnerabilityFiltersSinceProps<T>): ReactElement {
+    const value = 'allVuln' in formik.values.nodeVulnReportFilters ? 'allVuln' : ''; // just so formik prop is used
+    // Grid renders the related form groups side-by-side.
+    // https://www.patternfly.org/components/forms/form#grid-form
+    return (
+        <Grid hasGutter>
+            <GridItem span={6}>
+                <FormGroup label="CVEs discovered in node since" isRequired>
+                    <SelectSingle
+                        id="CvesSince"
+                        isDisabled
+                        value={value}
+                        handleSelect={() => {}}
+                        menuAppendTo={() => document.body}
+                    >
+                        <SelectOption
+                            value="sinceLastSentScheduledReport"
+                            description="At least one delivery destination and schedule will be required in the next step."
+                        >
+                            Last scheduled report that was successfully sent
+                        </SelectOption>
+                        <SelectOption
+                            value="sinceStartDate"
+                            description="Custom start date for the discovered CVE that were run on-demand or downloaded"
+                        >
+                            Custom start date
+                        </SelectOption>
+                        <SelectOption
+                            value="allVuln"
+                            description="Show all detected CVEs from the beginning of cluster setup"
+                        >
+                            All time
+                        </SelectOption>
+                    </SelectSingle>
+                </FormGroup>
+            </GridItem>
+        </Grid>
+    );
+}
+
+export default NodeVulnerabilityFiltersSince;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/NodeVulnerabilityFiltersStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/NodeVulnerabilityFiltersStep.tsx
new file mode 100644
index 0000000000000..c7c73897e1a70
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/NodeVulnerabilityFiltersStep.tsx
@@ -0,0 +1,61 @@
+import type { ReactElement } from 'react';
+import { Flex, Form, PageSection, Title } from '@patternfly/react-core';
+import { getIn } from 'formik';
+import type { FormikProps } from 'formik';
+
+import type {
+    CompoundSearchFilterConfig,
+    GenericSelectSearchFilterAttribute,
+} from 'Components/CompoundSearchFilter/types';
+
+import FiltersQuery from 'Components/Reports/Step/FiltersQuery';
+
+import type { NodeVulnerabilityReportFiltersConfiguration } from 'services/ReportsService.types';
+
+import NodeVulnerabilityFiltersSince from './NodeVulnerabilityFiltersSince';
+
+export type NodeVulnerabilityFiltersStepProps<
+    T extends NodeVulnerabilityReportFiltersConfiguration =
+        NodeVulnerabilityReportFiltersConfiguration,
+> = {
+    attributesSeparateFromConfig: GenericSelectSearchFilterAttribute[];
+    formik: FormikProps<T>;
+    searchFilterConfig: CompoundSearchFilterConfig;
+};
+
+function NodeVulnerabilityFiltersStep<
+    T extends NodeVulnerabilityReportFiltersConfiguration =
+        NodeVulnerabilityReportFiltersConfiguration,
+>({
+    attributesSeparateFromConfig,
+    formik,
+    searchFilterConfig,
+}: NodeVulnerabilityFiltersStepProps<T>): ReactElement {
+    const queryPath = 'nodeVulnReportFilters.query';
+
+    function setQueryValue(value: string, shouldValidate?: boolean) {
+        formik.setFieldValue(queryPath, value, shouldValidate);
+    }
+
+    // getIn call prevents TypeScript error for optional chaining in errors and touched objects.
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Filters</Title>
+                <Form isHorizontal isWidthLimited>
+                    <NodeVulnerabilityFiltersSince formik={formik} />
+                    <FiltersQuery
+                        attributesSeparateFromConfig={attributesSeparateFromConfig}
+                        error={getIn(formik.errors, queryPath)}
+                        query={formik.values.nodeVulnReportFilters.query}
+                        searchFilterConfig={searchFilterConfig}
+                        setQueryValue={setQueryValue}
+                        touched={getIn(formik.touched, queryPath)}
+                    />
+                </Form>
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default NodeVulnerabilityFiltersStep;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/validationSchemaFilters.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/validationSchemaFilters.ts
new file mode 100644
index 0000000000000..cbffc1ef4295f
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step3/validationSchemaFilters.ts
@@ -0,0 +1,51 @@
+import * as yup from 'yup';
+// import { isValid, parse } from 'date-fns';
+
+import type {
+    // CvesSince,
+    // NodeVulnerabilityReportFilters
+    NodeVulnerabilityReportFiltersConfiguration,
+} from 'services/ReportsService.types';
+
+// allVuln only for MVP because data does not yet exist for sinceStartDate filter.
+/*
+function isCvesSinceValid(filters: CvesSince): boolean {
+    if ('allVuln' in filters) {
+        return true;
+    }
+    if ('sinceLastSentScheduledReport' in filters) {
+        return true;
+    }
+    if ('sinceStartDate' in filters) {
+        if (!filters.sinceStartDate) {
+            return false;
+        }
+        // parse() is lenient. partial strings like "2026-10" pass isValid.
+        // Checking for "T" ensures the value is likely a full ISO timestamp.
+        return filters.sinceStartDate.includes('T') && isValid(parse(filters.sinceStartDate));
+    }
+    return false;
+}
+*/
+
+export const validationSchemaFilters: yup.ObjectSchema<NodeVulnerabilityReportFiltersConfiguration> =
+    yup.object().shape({
+        nodeVulnReportFilters: yup.object().shape({
+            allVuln: yup.boolean().required(), // temporary for MVP scope
+            query: yup.string().required('At least one filter is required'),
+        }),
+        /*
+        .test('cves-since-entity', 'CVE date range is required', function test(reportFilters) {
+            // CvesSince is a union type that .shape() can't express.
+            // cast so property access is type checked.
+            const filters = reportFilters as NodeVulnerabilityReportFilters;
+            if ('sinceStartDate' in filters && !isCvesSinceValid(filters)) {
+                return this.createError({
+                    path: 'nodeVulnReportFilters.sinceStartDate',
+                    message: 'A valid start date is required',
+                });
+            }
+            return isCvesSinceValid(filters);
+        }),
+        */
+    });
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step5/NodeVulnerabilityReviewStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step5/NodeVulnerabilityReviewStep.tsx
new file mode 100644
index 0000000000000..fe902f37d976b
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/Step5/NodeVulnerabilityReviewStep.tsx
@@ -0,0 +1,52 @@
+import type { ReactElement } from 'react';
+import { Alert, Flex, PageSection, Title } from '@patternfly/react-core';
+
+import type {
+    CompoundSearchFilterConfig,
+    GenericSelectSearchFilterAttribute,
+} from 'Components/CompoundSearchFilter/types';
+import type { NodeVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
+
+import NodeVulnerabilityReportView from '../../View/NodeVulnerabilityReportView';
+
+export type NodeVulnerabilityReviewStepProps = {
+    attributesSeparateFromConfig: GenericSelectSearchFilterAttribute[];
+    error: Error | null;
+    searchFilterConfig: CompoundSearchFilterConfig;
+    values: NodeVulnerabilityReportConfiguration;
+};
+
+function NodeVulnerabilityReviewStep({
+    attributesSeparateFromConfig,
+    error,
+    searchFilterConfig,
+    values,
+}: NodeVulnerabilityReviewStepProps): ReactElement {
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Review</Title>
+                {error && (
+                    <Alert
+                        variant="danger"
+                        isInline
+                        title="Error saving report configuration"
+                        component="p"
+                    >
+                        {getAxiosErrorMessage(error)}
+                    </Alert>
+                )}
+                <NodeVulnerabilityReportView
+                    attributesSeparateFromConfig={attributesSeparateFromConfig}
+                    headingLevel="h3"
+                    horizontalTermWidthModifier={{ default: '24ch' }}
+                    searchFilterConfig={searchFilterConfig}
+                    values={values}
+                />
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default NodeVulnerabilityReviewStep;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/nodeVulnerabilityReportConfiguration.defaults.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/nodeVulnerabilityReportConfiguration.defaults.ts
new file mode 100644
index 0000000000000..ee9508dd17846
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/nodeVulnerabilityReportConfiguration.defaults.ts
@@ -0,0 +1,31 @@
+import type { NodeVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+import { getRequestQueryStringForSearchFilter } from 'utils/searchUtils';
+
+import { defaultStorage } from '../../../../WorkloadCves/Overview/WorkloadCvesOverviewPage';
+import { fixableStatusToFixability, severityLabelToSeverity } from '../../../../utils/searchUtils';
+
+const {
+    preferences: { defaultFilters },
+} = defaultStorage;
+
+export const defaultNodeVulnerabilityReportConfiguration: NodeVulnerabilityReportConfiguration = {
+    type: 'NODE_VULNERABILITY',
+    id: '',
+    name: '',
+    description: '',
+    notifiers: [],
+    schedule: null,
+    nodeVulnReportFilters: {
+        allVuln: true,
+        query: getRequestQueryStringForSearchFilter({
+            Severity: defaultFilters.Severity.map(severityLabelToSeverity),
+            Fixable: defaultFilters.Fixable.map(fixableStatusToFixability),
+            'CVE Snoozed': 'false',
+        }),
+    },
+    resourceScope: {
+        entityScope: {
+            rules: [],
+        },
+    },
+} as const;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/nodeVulnerabilityReportValidationSchemas.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/nodeVulnerabilityReportValidationSchemas.ts
new file mode 100644
index 0000000000000..0ecf679dfc98c
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/Configurations/Wizard/nodeVulnerabilityReportValidationSchemas.ts
@@ -0,0 +1,32 @@
+import * as yup from 'yup';
+
+import { validationSchemaDelivery } from 'Components/Reports/Step/validationSchemaDelivery';
+import { validationSchemaDetails } from 'Components/Reports/Step/validationSchemaDetails';
+import { ensureExhaustive } from 'utils/type.utils';
+
+import { validationSchemaResources } from './Step2/validationSchemaResources';
+import { validationSchemaFilters } from './Step3/validationSchemaFilters';
+
+export const wizardStepIds = ['details', 'resources', 'filters', 'delivery', 'review'] as const;
+export type WizardStepId = (typeof wizardStepIds)[number];
+
+export function isWizardStepId(id: string): id is WizardStepId {
+    return wizardStepIds.includes(id as WizardStepId);
+}
+
+export function getValidationSchema(stepId: WizardStepId): yup.Schema | yup.Lazy<unknown> {
+    switch (stepId) {
+        case 'details':
+            return validationSchemaDetails;
+        case 'resources':
+            return validationSchemaResources;
+        case 'filters':
+            return validationSchemaFilters;
+        case 'delivery':
+            return validationSchemaDelivery;
+        case 'review':
+            return yup.object().shape({});
+        default:
+            return ensureExhaustive(stepId);
+    }
+}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/NodeVulnerabilityReportsLayout.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/NodeVulnerabilityReportsLayout.tsx
new file mode 100644
index 0000000000000..51eb164dd6eaf
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/NodeVulnerabilityReportsLayout.tsx
@@ -0,0 +1,86 @@
+import {
+    Breadcrumb,
+    BreadcrumbItem,
+    PageSection,
+    Tab,
+    TabContent,
+    Tabs,
+    Title,
+} from '@patternfly/react-core';
+import type { ReactNode } from 'react';
+import { useLocation, useNavigate } from 'react-router-dom-v5-compat';
+
+import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
+import PageTitle from 'Components/PageTitle';
+import usePermissions from 'hooks/usePermissions';
+import {
+    vulnerabilityNodeConfigurationsReportsPath,
+    vulnerabilityNodeViewBasedJobsPath,
+    vulnerabilityReportsPath,
+} from 'routePaths';
+
+function NodeVulnerabilityReportsLayout({ children }: { children: ReactNode }) {
+    const location = useLocation();
+    const navigate = useNavigate();
+
+    const { hasReadAccess } = usePermissions();
+    const hasReadAccessForReport = hasReadAccess('WorkflowAdministration');
+
+    const activeKey = location.pathname.startsWith(vulnerabilityNodeConfigurationsReportsPath)
+        ? 'configurations'
+        : 'view-based-jobs';
+
+    return (
+        <>
+            <PageTitle title="Node vulnerability reports" />
+            <PageSection type="breadcrumb">
+                <Breadcrumb>
+                    <BreadcrumbItemLink to={vulnerabilityReportsPath}>
+                        Vulnerability reports
+                    </BreadcrumbItemLink>
+                    <BreadcrumbItem isActive>Node vulnerability reports</BreadcrumbItem>
+                </Breadcrumb>
+            </PageSection>
+            <PageSection>
+                <Title headingLevel="h1">Node vulnerability reports</Title>
+            </PageSection>
+            <PageSection type="tabs">
+                <Tabs
+                    activeKey={activeKey}
+                    onSelect={(_event, tabKey) => {
+                        navigate(
+                            tabKey === 'configurations'
+                                ? vulnerabilityNodeConfigurationsReportsPath
+                                : vulnerabilityNodeViewBasedJobsPath
+                        );
+                    }}
+                    usePageInsets
+                >
+                    {hasReadAccessForReport && (
+                        <Tab
+                            eventKey="configurations"
+                            title="Report configurations"
+                            tabContentId="report-configurations-tab-content"
+                        />
+                    )}
+                    <Tab
+                        eventKey="view-based-jobs"
+                        title="View-based jobs"
+                        tabContentId="view-based-jobs-tab-content"
+                    />
+                </Tabs>
+            </PageSection>
+            <TabContent
+                id={
+                    activeKey === 'configurations'
+                        ? 'report-configurations-tab-content'
+                        : 'view-based-jobs-tab-content'
+                }
+            >
+                {children}
+            </TabContent>
+        </>
+    );
+}
+
+export default NodeVulnerabilityReportsLayout;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/NodeVulnerabilityReportsPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/NodeVulnerabilityReportsPage.tsx
new file mode 100644
index 0000000000000..4e39e62175636
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/NodeVulnerabilityReportsPage.tsx
@@ -0,0 +1,74 @@
+import { Navigate, Route, Routes } from 'react-router-dom-v5-compat';
+
+import PageNotFound from 'Components/PageNotFound';
+import type { ReportPageAction } from 'Components/Reports/reports.types';
+import usePageAction from 'hooks/usePageAction';
+import usePermissions from 'hooks/usePermissions';
+
+import NodeConfigurationsList from './Configurations/NodeConfigurationsList';
+import NodeVulnerabilityReportWizardPage from './Configurations/Wizard/NodeVulnerabilityReportWizardPage';
+import NodeVulnerabilityReportViewPage from './Configurations/View/NodeVulnerabilityReportViewPage';
+import NodeVulnerabilityReportsLayout from './NodeVulnerabilityReportsLayout';
+import NodeViewBasedJobsPage from './ViewBasedJobs/NodeViewBasedJobsPage';
+
+function NodeVulnerabilityReportsPage() {
+    const { pageAction } = usePageAction<ReportPageAction>();
+    const { hasReadAccess, hasReadWriteAccess } = usePermissions();
+
+    const hasReadAccessForReport = hasReadAccess('WorkflowAdministration');
+    const hasWriteAccessForReport =
+        hasReadWriteAccess('WorkflowAdministration') && hasReadAccess('Integration');
+
+    return (
+        <Routes>
+            <Route
+                index
+                element={
+                    <Navigate
+                        to={hasReadAccessForReport ? 'configurations' : 'view-based-jobs'}
+                        replace
+                    />
+                }
+            />
+            {hasReadAccessForReport && (
+                <Route
+                    path="configurations"
+                    element={
+                        (pageAction === 'create' || pageAction === 'createFromFilters') &&
+                        hasWriteAccessForReport ? (
+                            <NodeVulnerabilityReportWizardPage pageAction={pageAction} />
+                        ) : (
+                            <NodeVulnerabilityReportsLayout>
+                                <NodeConfigurationsList />
+                            </NodeVulnerabilityReportsLayout>
+                        )
+                    }
+                />
+            )}
+            <Route
+                path="view-based-jobs"
+                element={
+                    <NodeVulnerabilityReportsLayout>
+                        <NodeViewBasedJobsPage />
+                    </NodeVulnerabilityReportsLayout>
+                }
+            />
+            {hasReadAccessForReport && (
+                <Route
+                    path="configurations/:reportId"
+                    element={
+                        (pageAction === 'clone' || pageAction === 'edit') &&
+                        hasWriteAccessForReport ? (
+                            <NodeVulnerabilityReportWizardPage pageAction={pageAction} />
+                        ) : (
+                            <NodeVulnerabilityReportViewPage />
+                        )
+                    }
+                />
+            )}
+            <Route path="*" element={<PageNotFound />} />
+        </Routes>
+    );
+}
+
+export default NodeVulnerabilityReportsPage;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/ViewBasedJobs/NodeViewBasedJobsPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/ViewBasedJobs/NodeViewBasedJobsPage.tsx
new file mode 100644
index 0000000000000..68fd94a662277
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/ViewBasedJobs/NodeViewBasedJobsPage.tsx
@@ -0,0 +1,170 @@
+import { useCallback, useMemo } from 'react';
+import {
+    Content,
+    PageSection,
+    Pagination,
+    Toolbar,
+    ToolbarContent,
+    ToolbarItem,
+    useInterval,
+} from '@patternfly/react-core';
+
+import PageTitle from 'Components/PageTitle';
+import MyJobsFilter from 'Components/ReportJob/MyJobsFilter';
+import ReportJobStatusFilter, {
+    isReportJobStatus,
+} from 'Components/ReportJob/ReportJobStatusFilter';
+import type { ReportJobStatus } from 'Components/ReportJob/types';
+import useRestQuery from 'hooks/useRestQuery';
+import useURLPagination from 'hooks/useURLPagination';
+import useURLSearch from 'hooks/useURLSearch';
+import useURLSort from 'hooks/useURLSort';
+import useURLStringUnion from 'hooks/useURLStringUnion';
+import {
+    getViewBasedMyNodeReportHistory,
+    getViewBasedNodeReportHistory,
+} from 'services/NodeReportsService';
+import { toggleItemInArray } from 'utils/arrayUtils';
+import { ensureBoolean, ensureStringArray } from 'utils/ensure';
+import { getTableUIState } from 'utils/getTableUIState';
+
+import NodeViewBasedReportsTable from './NodeViewBasedJobsTable';
+
+const sortOptions = {
+    sortFields: ['Report Completion Time'],
+    defaultSortOption: { field: 'Report Completion Time', direction: 'desc' } as const,
+};
+
+const reportStateByJobStatus: Partial<Record<ReportJobStatus, string>> = {
+    WAITING: 'WAITING',
+    PREPARING: 'PREPARING',
+    ERROR: 'FAILURE',
+    DOWNLOAD_GENERATED: 'GENERATED',
+};
+
+function NodeViewBasedJobsPage() {
+    const { page, perPage, setPage, setPerPage } = useURLPagination(10);
+    const { sortOption, getSortParams } = useURLSort(sortOptions);
+    const { searchFilter, setSearchFilter } = useURLSearch();
+    const [isViewingOnlyMyJobs, setIsViewingOnlyMyJobs] = useURLStringUnion('viewOnlyMyJobs', [
+        'false',
+        'true',
+    ]);
+
+    const reportJobStatusFilters = useMemo(() => {
+        return ensureStringArray(searchFilter['Report Job Status']).filter(isReportJobStatus);
+    }, [searchFilter]);
+
+    const fetchViewBasedNodeReportsHistoryCallback = useCallback(() => {
+        const fetchHistory =
+            isViewingOnlyMyJobs === 'true'
+                ? getViewBasedMyNodeReportHistory
+                : getViewBasedNodeReportHistory;
+
+        return fetchHistory({
+            searchFilter: {
+                'Report State': reportJobStatusFilters.flatMap(
+                    (status) => reportStateByJobStatus[status] ?? []
+                ),
+            },
+            page,
+            perPage,
+            sortOption,
+        });
+    }, [reportJobStatusFilters, page, perPage, sortOption, isViewingOnlyMyJobs]);
+
+    const { data, isLoading, error, refetch } = useRestQuery(
+        fetchViewBasedNodeReportsHistoryCallback,
+        {
+            clearErrorBeforeRequest: false,
+        }
+    );
+
+    const tableState = getTableUIState({
+        isLoading,
+        data,
+        error,
+        searchFilter,
+        isPolling: true,
+    });
+
+    const onReportJobStatusFilterChange = (_checked: boolean, selectedStatus: ReportJobStatus) => {
+        const newFilters = toggleItemInArray(reportJobStatusFilters, selectedStatus);
+        setSearchFilter({
+            ...searchFilter,
+            'Report Job Status': newFilters,
+        });
+        setPage(1);
+    };
+
+    const onMyJobsFilterChange = (checked: boolean) => {
+        setIsViewingOnlyMyJobs(String(checked));
+        setPage(1);
+    };
+
+    useInterval(refetch, 10000);
+
+    return (
+        <>
+            <PageTitle title="Node vulnerability reports - View-based jobs" />
+            <PageSection>
+                <Content component="p">
+                    Check job status and download view-based reports in CSV format. Jobs are purged
+                    according to retention settings.
+                </Content>
+            </PageSection>
+            <PageSection>
+                <Toolbar>
+                    <ToolbarContent>
+                        <ToolbarItem alignItems="center">
+                            <ReportJobStatusFilter
+                                availableStatuses={[
+                                    'WAITING',
+                                    'PREPARING',
+                                    'DOWNLOAD_GENERATED',
+                                    'ERROR',
+                                ]}
+                                selectedStatuses={reportJobStatusFilters}
+                                onChange={onReportJobStatusFilterChange}
+                            />
+                        </ToolbarItem>
+                        <ToolbarItem alignSelf="center">
+                            <MyJobsFilter
+                                isViewingOnlyMyJobs={ensureBoolean(isViewingOnlyMyJobs)}
+                                onMyJobsFilterChange={onMyJobsFilterChange}
+                            />
+                        </ToolbarItem>
+                        <ToolbarItem variant="pagination" align={{ default: 'alignEnd' }}>
+                            {/* TODO: Change this to determinate pagination pattern */}
+                            <Pagination
+                                toggleTemplate={({ firstIndex, lastIndex }) => (
+                                    <span>
+                                        <b>
+                                            {firstIndex} - {lastIndex}
+                                        </b>{' '}
+                                        of <b>many</b>
+                                    </span>
+                                )}
+                                page={page}
+                                perPage={perPage}
+                                onSetPage={(_, newPage) => setPage(newPage)}
+                                onPerPageSelect={(_, newPerPage) => setPerPage(newPerPage)}
+                                isCompact
+                            />
+                        </ToolbarItem>
+                    </ToolbarContent>
+                </Toolbar>
+                <NodeViewBasedReportsTable
+                    tableState={tableState}
+                    getSortParams={getSortParams}
+                    onClearFilters={() => {
+                        setSearchFilter({});
+                        setPage(1);
+                    }}
+                />
+            </PageSection>
+        </>
+    );
+}
+
+export default NodeViewBasedJobsPage;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/ViewBasedJobs/NodeViewBasedJobsTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/ViewBasedJobs/NodeViewBasedJobsTable.tsx
new file mode 100644
index 0000000000000..7a1815809a944
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/ViewBasedJobs/NodeViewBasedJobsTable.tsx
@@ -0,0 +1,89 @@
+import { Link } from 'react-router-dom-v5-compat';
+import { Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
+
+import ReportJobStatus from 'Components/ReportJob/ReportJobStatus';
+import { onDownloadReport } from 'Components/ReportJob/utils';
+import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
+import useAuthStatus from 'hooks/useAuthStatus';
+import type { GetSortParams } from 'hooks/useURLSort';
+import { vulnerabilitiesNodeCvesPath } from 'routePaths';
+import type { NodeViewBasedReportSnapshot } from 'services/ReportsService.types';
+import { getDateTime } from 'utils/dateUtils';
+import type { TableUIState } from 'utils/getTableUIState';
+
+export type NodeViewBasedJobsTableProps = {
+    tableState: TableUIState<NodeViewBasedReportSnapshot>;
+    getSortParams: GetSortParams;
+    onClearFilters: () => void;
+};
+
+function NodeViewBasedJobsTable({
+    tableState,
+    getSortParams,
+    onClearFilters,
+}: NodeViewBasedJobsTableProps) {
+    const { currentUser } = useAuthStatus();
+
+    return (
+        <Table aria-label="Node view-based jobs table">
+            <Thead>
+                <Tr>
+                    <Th width={20}>Job name</Th>
+                    <Th>Requester</Th>
+                    <Th>Job status</Th>
+                    <Th sort={getSortParams('Report Completion Time')}>Completed</Th>
+                </Tr>
+            </Thead>
+            <TbodyUnified
+                tableState={tableState}
+                colSpan={4}
+                emptyProps={{
+                    title: 'No view-based jobs found',
+                    message:
+                        'From the Node CVEs page, select "Export report as CSV" to generate a view-based report.',
+                    children: <Link to={vulnerabilitiesNodeCvesPath}>Go to Node CVEs</Link>,
+                }}
+                filteredEmptyProps={{ onClearFilters }}
+                renderer={({ data }) =>
+                    data.map((snapshot) => {
+                        const { user, reportStatus, isDownloadAvailable, reportJobId, name } =
+                            snapshot;
+                        const areDownloadActionsDisabled = currentUser.userId !== user.id;
+
+                        return (
+                            <Tbody key={reportJobId}>
+                                <Tr>
+                                    <Td dataLabel="Job name">{name}</Td>
+                                    <Td dataLabel="Requester">{user.name}</Td>
+                                    <Td dataLabel="Job status">
+                                        <ReportJobStatus
+                                            reportStatus={reportStatus}
+                                            isDownloadAvailable={isDownloadAvailable}
+                                            areDownloadActionsDisabled={areDownloadActionsDisabled}
+                                            onDownload={() =>
+                                                onDownloadReport({
+                                                    reportJobId,
+                                                    name,
+                                                    completedAt: reportStatus.completedAt,
+                                                    baseDownloadURL:
+                                                        '/api/reports/node/jobs/download',
+                                                })
+                                            }
+                                        />
+                                    </Td>
+                                    <Td dataLabel="Completed">
+                                        {reportStatus.completedAt
+                                            ? getDateTime(reportStatus.completedAt)
+                                            : '-'}
+                                    </Td>
+                                </Tr>
+                            </Tbody>
+                        );
+                    })
+                }
+            />
+        </Table>
+    );
+}
+
+export default NodeViewBasedJobsTable;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/nodeVulnerabilityReports.utils.ts b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/nodeVulnerabilityReports.utils.ts
new file mode 100644
index 0000000000000..3ac1d2b19bb18
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/NodeVulnerabilityReports/nodeVulnerabilityReports.utils.ts
@@ -0,0 +1,13 @@
+import type { SearchFilter } from 'types/search';
+import { getUrlQueryStringForSearchFilter } from 'utils/searchUtils';
+import { vulnerabilityNodeConfigurationsReportsPath } from 'routePaths';
+
+// Unlike view-based report that receives request query directly,
+// (create) scheduled report (from filter) receives it indirectly:
+// 1. from search filter to URL query (navigate from results page to report wizard)
+// 2. from URL query to search filter (initialize configuration in report wizard)
+// 3. from search filter to request query (save report configuration)
+export function createScheduledReportForNodeVulnerabilitiesURL(searchFilter: SearchFilter) {
+    const query = getUrlQueryStringForSearchFilter(searchFilter);
+    return `${vulnerabilityNodeConfigurationsReportsPath}?action=createFromFilters&${query}`;
+}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityFiltersView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityFiltersView.tsx
new file mode 100644
index 0000000000000..a3d3916137231
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityFiltersView.tsx
@@ -0,0 +1,58 @@
+import type { ReactElement } from 'react';
+import { DescriptionList, Flex, FlexItem, Title } from '@patternfly/react-core';
+import type { BreakpointModifiers } from '@patternfly/react-core';
+
+import CompoundSearchFilterDescriptionListGroups from 'Components/CompoundSearchFilter/components/CompoundSearchFilterDescriptionListGroups';
+import type {
+    CompoundSearchFilterAttribute,
+    CompoundSearchFilterConfig,
+} from 'Components/CompoundSearchFilter/types';
+import { getSearchFilterFromSearchString } from 'utils/searchUtils';
+
+import type { VirtualMachineVulnerabilityReportFiltersConfiguration } from 'services/ReportsService.types';
+
+export type VirtualMachineVulnerabilityFiltersViewProps = {
+    attributesSeparateFromConfig: CompoundSearchFilterAttribute[];
+    headingLevel: 'h2' | 'h3';
+    horizontalTermWidthModifier: BreakpointModifiers;
+    searchFilterConfig: CompoundSearchFilterConfig;
+    values: VirtualMachineVulnerabilityReportFiltersConfiguration;
+};
+
+function VirtualMachineVulnerabilityFiltersView({
+    attributesSeparateFromConfig,
+    headingLevel,
+    horizontalTermWidthModifier,
+    searchFilterConfig,
+    values,
+}: VirtualMachineVulnerabilityFiltersViewProps): ReactElement {
+    // Render separate attributes (more likely to be specified) preceding config.
+    const attributesFromConfig = searchFilterConfig.flatMap(({ attributes }) => attributes);
+    const attributes = [...attributesSeparateFromConfig, ...attributesFromConfig];
+
+    const { virtualMachineVulnReportFilters } = values;
+    const { query } = virtualMachineVulnReportFilters;
+    const searchFilter = getSearchFilterFromSearchString(query);
+
+    return (
+        <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
+            <FlexItem>
+                <Title headingLevel={headingLevel}>Filters</Title>
+            </FlexItem>
+            <FlexItem>
+                <DescriptionList
+                    isCompact
+                    isHorizontal
+                    horizontalTermWidthModifier={horizontalTermWidthModifier}
+                >
+                    <CompoundSearchFilterDescriptionListGroups
+                        attributes={attributes}
+                        searchFilter={searchFilter}
+                    />
+                </DescriptionList>
+            </FlexItem>
+        </Flex>
+    );
+}
+
+export default VirtualMachineVulnerabilityFiltersView;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityReportView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityReportView.tsx
new file mode 100644
index 0000000000000..bc2fd614e57cb
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityReportView.tsx
@@ -0,0 +1,59 @@
+import type { ReactElement } from 'react';
+import { Flex } from '@patternfly/react-core';
+import type { BreakpointModifiers } from '@patternfly/react-core';
+
+import type {
+    CompoundSearchFilterAttribute,
+    CompoundSearchFilterConfig,
+} from 'Components/CompoundSearchFilter/types';
+import DeliveryView from 'Components/Reports/View/DeliveryView';
+import DetailsView from 'Components/Reports/View/DetailsView';
+import type { VirtualMachineVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+
+import VirtualMachineVulnerabilityFiltersView from './VirtualMachineVulnerabilityFiltersView';
+import VirtualMachineVulnerabilityResourcesView from './VirtualMachineVulnerabilityResourcesView';
+
+export type VirtualMachineVulnerabilityReportViewProps = {
+    attributesSeparateFromConfig: CompoundSearchFilterAttribute[];
+    headingLevel: 'h2' | 'h3';
+    horizontalTermWidthModifier: BreakpointModifiers;
+    searchFilterConfig: CompoundSearchFilterConfig;
+    values: VirtualMachineVulnerabilityReportConfiguration;
+};
+
+function VirtualMachineVulnerabilityReportView({
+    attributesSeparateFromConfig,
+    headingLevel,
+    horizontalTermWidthModifier,
+    searchFilterConfig,
+    values,
+}: VirtualMachineVulnerabilityReportViewProps): ReactElement {
+    return (
+        <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+            <DetailsView
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                values={values}
+            />
+            <VirtualMachineVulnerabilityResourcesView
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                values={values}
+            />
+            <VirtualMachineVulnerabilityFiltersView
+                attributesSeparateFromConfig={attributesSeparateFromConfig}
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                searchFilterConfig={searchFilterConfig}
+                values={values}
+            />
+            <DeliveryView
+                headingLevel={headingLevel}
+                horizontalTermWidthModifier={horizontalTermWidthModifier}
+                values={values}
+            />
+        </Flex>
+    );
+}
+
+export default VirtualMachineVulnerabilityReportView;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityResourcesView.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityResourcesView.tsx
new file mode 100644
index 0000000000000..41268b84e1324
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/View/VirtualMachineVulnerabilityResourcesView.tsx
@@ -0,0 +1,42 @@
+import type { ReactElement } from 'react';
+import { DescriptionList, Flex, FlexItem, Title } from '@patternfly/react-core';
+import type { BreakpointModifiers } from '@patternfly/react-core';
+
+import EntityScopeDescriptionListGroups from 'Components/EntityScope/EntityScopeDescriptionListGroups';
+
+import type { VirtualMachineVulnerabilityReportResourcesConfiguration } from 'services/ReportsService.types';
+
+export type VirtualMachineVulnerabilityResourcesViewProps = {
+    headingLevel: 'h2' | 'h3';
+    horizontalTermWidthModifier: BreakpointModifiers;
+    values: VirtualMachineVulnerabilityReportResourcesConfiguration;
+};
+
+function VirtualMachineVulnerabilityResourcesView({
+    headingLevel,
+    horizontalTermWidthModifier,
+    values,
+}: VirtualMachineVulnerabilityResourcesViewProps): ReactElement {
+    return (
+        <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
+            <FlexItem>
+                <Title headingLevel={headingLevel}>Resources</Title>
+            </FlexItem>
+            <FlexItem>
+                <DescriptionList
+                    isCompact
+                    isHorizontal
+                    horizontalTermWidthModifier={horizontalTermWidthModifier}
+                >
+                    {'entityScope' in values.resourceScope && (
+                        <EntityScopeDescriptionListGroups
+                            entityScope={values.resourceScope.entityScope}
+                        />
+                    )}
+                </DescriptionList>
+            </FlexItem>
+        </Flex>
+    );
+}
+
+export default VirtualMachineVulnerabilityResourcesView;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step2/VirtualMachineVulnerabilityResourcesStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step2/VirtualMachineVulnerabilityResourcesStep.tsx
new file mode 100644
index 0000000000000..2b3499feb72c4
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step2/VirtualMachineVulnerabilityResourcesStep.tsx
@@ -0,0 +1,93 @@
+import { useState } from 'react';
+import type { ReactElement } from 'react';
+import { Flex, Form, PageSection, Radio, Title } from '@patternfly/react-core';
+import type { FormikProps } from 'formik';
+
+import EntityScopeCompoundSearchFilter from 'Components/EntityScope/EntityScopeCompoundSearchFilter';
+import {
+    getEntityScopeRulesFromSearchFilterForClusterNamespace,
+    getSearchFilterFromEntityScopeRulesForClusterNamespace,
+} from 'Components/EntityScope/utils';
+import { searchFilterConfigForClusterNamespace } from 'Components/EntityScope/searchFilterConfig';
+import FormLabelGroup from 'Components/PatternFly/FormLabelGroup';
+import type {
+    EntityScope,
+    VirtualMachineVulnerabilityReportResourcesConfiguration,
+} from 'services/ReportsService.types';
+
+export type VirtualMachineVulnerabilityResourcesStepProps<
+    T extends VirtualMachineVulnerabilityReportResourcesConfiguration =
+        VirtualMachineVulnerabilityReportResourcesConfiguration,
+> = {
+    formik: FormikProps<T>;
+};
+
+function VirtualMachineVulnerabilityResourcesStep<
+    T extends VirtualMachineVulnerabilityReportResourcesConfiguration =
+        VirtualMachineVulnerabilityReportResourcesConfiguration,
+>({ formik }: VirtualMachineVulnerabilityResourcesStepProps<T>): ReactElement {
+    const [entityScopeSelected, setEntityScopeSelected] = useState<EntityScope>(
+        'entityScope' in formik.values.resourceScope
+            ? formik.values.resourceScope.entityScope
+            : { rules: [] }
+    );
+
+    function onChangeToEntityScope() {
+        // Set resourceScope to remove any other (future) scope property.
+        formik.setFieldValue('resourceScope', { entityScope: entityScopeSelected });
+    }
+
+    function setEntityScope(entityScope: EntityScope) {
+        setEntityScopeSelected(entityScope);
+        formik.setFieldValue('resourceScope.entityScope', entityScope);
+    }
+
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Resources</Title>
+                <Form isWidthLimited>
+                    <FormLabelGroup
+                        label="Scope method"
+                        isRequired
+                        fieldId="resourceScope"
+                        touched={formik.touched}
+                        errors={formik.errors}
+                    >
+                        <Flex
+                            direction={{ default: 'column' }}
+                            spaceItems={{ default: 'spaceItemsLg' }}
+                        >
+                            <Radio
+                                id="entityScope"
+                                isChecked
+                                label="Custom scope"
+                                name="entityScope"
+                                onChange={onChangeToEntityScope}
+                                body={
+                                    <EntityScopeCompoundSearchFilter
+                                        entityScope={
+                                            'entityScope' in formik.values.resourceScope
+                                                ? formik.values.resourceScope.entityScope
+                                                : null
+                                        }
+                                        getEntityScopeRulesFromSearchFilter={
+                                            getEntityScopeRulesFromSearchFilterForClusterNamespace
+                                        }
+                                        getSearchFilterFromEntityScopeRules={
+                                            getSearchFilterFromEntityScopeRulesForClusterNamespace
+                                        }
+                                        searchFilterConfig={searchFilterConfigForClusterNamespace}
+                                        setEntityScope={setEntityScope}
+                                    />
+                                }
+                            />
+                        </Flex>
+                    </FormLabelGroup>
+                </Form>
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default VirtualMachineVulnerabilityResourcesStep;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step3/VirtualMachineVulnerabilityFiltersStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step3/VirtualMachineVulnerabilityFiltersStep.tsx
new file mode 100644
index 0000000000000..63ff404e76c3c
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step3/VirtualMachineVulnerabilityFiltersStep.tsx
@@ -0,0 +1,58 @@
+import type { ReactElement } from 'react';
+import { Flex, Form, PageSection, Title } from '@patternfly/react-core';
+import { getIn } from 'formik';
+import type { FormikProps } from 'formik';
+
+import type {
+    CompoundSearchFilterConfig,
+    SelectSearchFilterAttribute,
+} from 'Components/CompoundSearchFilter/types';
+
+import FiltersQuery from 'Components/Reports/Step/FiltersQuery';
+
+import type { VirtualMachineVulnerabilityReportFiltersConfiguration } from 'services/ReportsService.types';
+
+export type VirtualMachineVulnerabilityFiltersStepProps<
+    T extends VirtualMachineVulnerabilityReportFiltersConfiguration =
+        VirtualMachineVulnerabilityReportFiltersConfiguration,
+> = {
+    attributesSeparateFromConfig: SelectSearchFilterAttribute[];
+    formik: FormikProps<T>;
+    searchFilterConfig: CompoundSearchFilterConfig;
+};
+
+function VirtualMachineVulnerabilityFiltersStep<
+    T extends VirtualMachineVulnerabilityReportFiltersConfiguration =
+        VirtualMachineVulnerabilityReportFiltersConfiguration,
+>({
+    attributesSeparateFromConfig,
+    formik,
+    searchFilterConfig,
+}: VirtualMachineVulnerabilityFiltersStepProps<T>): ReactElement {
+    const queryPath = 'virtualMachineVulnReportFilters.query';
+
+    function setQueryValue(value: string, shouldValidate?: boolean) {
+        formik.setFieldValue(queryPath, value, shouldValidate);
+    }
+
+    // getIn call prevents TypeScript error for optional chaining in errors and touched objects.
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Filters</Title>
+                <Form isHorizontal isWidthLimited>
+                    <FiltersQuery
+                        attributesSeparateFromConfig={attributesSeparateFromConfig}
+                        error={getIn(formik.errors, queryPath)}
+                        query={formik.values.virtualMachineVulnReportFilters.query}
+                        searchFilterConfig={searchFilterConfig}
+                        setQueryValue={setQueryValue}
+                        touched={getIn(formik.touched, queryPath)}
+                    />
+                </Form>
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default VirtualMachineVulnerabilityFiltersStep;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step5/VirtualMachineVulnerabilityReviewStep.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step5/VirtualMachineVulnerabilityReviewStep.tsx
new file mode 100644
index 0000000000000..a7faf25350e96
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VirtualMachineVulnerabilityReports/Configurations/Wizard/Step5/VirtualMachineVulnerabilityReviewStep.tsx
@@ -0,0 +1,52 @@
+import type { ReactElement } from 'react';
+import { Alert, Flex, PageSection, Title } from '@patternfly/react-core';
+
+import type {
+    CompoundSearchFilterConfig,
+    SelectSearchFilterAttribute,
+} from 'Components/CompoundSearchFilter/types';
+import type { VirtualMachineVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
+
+import VirtualMachineVulnerabilityReportView from '../../View/VirtualMachineVulnerabilityReportView';
+
+export type VirtualMachineVulnerabilityReviewStepProps = {
+    attributesSeparateFromConfig: SelectSearchFilterAttribute[];
+    error: Error | null;
+    searchFilterConfig: CompoundSearchFilterConfig;
+    values: VirtualMachineVulnerabilityReportConfiguration;
+};
+
+function VirtualMachineVulnerabilityReviewStep({
+    attributesSeparateFromConfig,
+    error,
+    searchFilterConfig,
+    values,
+}: VirtualMachineVulnerabilityReviewStepProps): ReactElement {
+    return (
+        <PageSection>
+            <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsLg' }}>
+                <Title headingLevel="h2">Review</Title>
+                {error && (
+                    <Alert
+                        variant="danger"
+                        isInline
+                        title="Error saving report configuration"
+                        component="p"
+                    >
+                        {getAxiosErrorMessage(error)}
+                    </Alert>
+                )}
+                <VirtualMachineVulnerabilityReportView
+                    attributesSeparateFromConfig={attributesSeparateFromConfig}
+                    headingLevel="h3"
+                    horizontalTermWidthModifier={{ default: '24ch' }}
+                    searchFilterConfig={searchFilterConfig}
+                    values={values}
+                />
+            </Flex>
+        </PageSection>
+    );
+}
+
+export default VirtualMachineVulnerabilityReviewStep;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VulnerabilityReportsPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VulnerabilityReportsPage.tsx
new file mode 100644
index 0000000000000..d0f37fb1db4d6
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/VulnerabilityReportsPage.tsx
@@ -0,0 +1,83 @@
+import { useNavigate } from 'react-router-dom-v5-compat';
+import {
+    Card,
+    CardBody,
+    CardHeader,
+    CardTitle,
+    Flex,
+    FlexItem,
+    Gallery,
+    GalleryItem,
+    PageSection,
+    Title,
+} from '@patternfly/react-core';
+
+import PageTitle from 'Components/PageTitle';
+import useIsRouteEnabled from 'hooks/useIsRouteEnabled';
+import { vulnerabilityImageReportsPath, vulnerabilityNodeReportsPath } from 'routePaths';
+
+function VulnerabilityReportsPage() {
+    const navigate = useNavigate();
+    const isRouteEnabled = useIsRouteEnabled();
+    const isImageReportsEnabled = isRouteEnabled('vulnerabilities/reports/images');
+    const isNodeReportsEnabled = isRouteEnabled('vulnerabilities/reports/nodes');
+
+    return (
+        <>
+            <PageTitle title="Vulnerability reports" />
+            <PageSection>
+                <Flex direction={{ default: 'column' }}>
+                    <Title headingLevel="h1">Vulnerability reports</Title>
+                    <FlexItem>
+                        Configure scheduled vulnerability reports and view-based exports by report
+                        type.
+                    </FlexItem>
+                </Flex>
+            </PageSection>
+            <PageSection>
+                <Gallery hasGutter>
+                    {isImageReportsEnabled && (
+                        <GalleryItem>
+                            <Card isClickable isFullHeight>
+                                <CardHeader
+                                    selectableActions={{
+                                        onClickAction: () =>
+                                            navigate(vulnerabilityImageReportsPath),
+                                        selectableActionAriaLabel:
+                                            'View Image vulnerability reports',
+                                    }}
+                                >
+                                    <CardTitle>Image vulnerability reports</CardTitle>
+                                </CardHeader>
+                                <CardBody>
+                                    CVE reports scoped to workload images, platform components, all
+                                    deployed images, and inactive images across your clusters.
+                                </CardBody>
+                            </Card>
+                        </GalleryItem>
+                    )}
+                    {isNodeReportsEnabled && (
+                        <GalleryItem>
+                            <Card isClickable isFullHeight>
+                                <CardHeader
+                                    selectableActions={{
+                                        onClickAction: () => navigate(vulnerabilityNodeReportsPath),
+                                        selectableActionAriaLabel:
+                                            'View Node vulnerability reports',
+                                    }}
+                                >
+                                    <CardTitle>Node vulnerability reports</CardTitle>
+                                </CardHeader>
+                                <CardBody>
+                                    OS and runtime CVEs across nodes in selected clusters.
+                                </CardBody>
+                            </Card>
+                        </GalleryItem>
+                    )}
+                </Gallery>
+            </PageSection>
+        </>
+    );
+}
+
+export default VulnerabilityReportsPage;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/Reports/components/DeleteReportsModal.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/components/DeleteReportsModal.tsx
new file mode 100644
index 0000000000000..f9a74a416e7c4
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/Reports/components/DeleteReportsModal.tsx
@@ -0,0 +1,114 @@
+import {
+    Alert,
+    AlertGroup,
+    Button,
+    Modal,
+    ModalBody,
+    ModalFooter,
+    ModalHeader,
+    Title,
+} from '@patternfly/react-core';
+import pluralize from 'pluralize';
+
+import type { ReportConfigurationBase } from 'services/ReportsService.types';
+
+import {
+    isErrorDeleteResult,
+    isSuccessDeleteResult,
+} from '../../VulnerablityReporting/hooks/useDeleteModal';
+import type { DeleteResult } from '../../VulnerablityReporting/hooks/useDeleteModal';
+
+export type DeleteReportsModalProps = {
+    isOpen: boolean;
+    onClose: () => void;
+    isDeleting: boolean;
+    onDelete: () => void;
+    reportIdsToDelete: string[];
+    deleteResults: DeleteResult[] | null;
+    reportConfigurations: ReportConfigurationBase[] | null;
+};
+
+function DeleteReportsModal({
+    isOpen,
+    onClose,
+    isDeleting,
+    onDelete,
+    reportIdsToDelete,
+    deleteResults,
+    reportConfigurations,
+}: DeleteReportsModalProps) {
+    const numSuccessfulDeletions = deleteResults?.filter(isSuccessDeleteResult).length ?? 0;
+    const title = `Permanently delete ${reportIdsToDelete.length} report ${pluralize(
+        'configuration',
+        reportIdsToDelete.length
+    )}?`;
+
+    return (
+        <Modal
+            aria-labelledby="delete-reports-modal-title"
+            variant="small"
+            isOpen={isOpen}
+            onClose={onClose}
+        >
+            <ModalHeader>
+                <Title id="delete-reports-modal-title" headingLevel="h2">
+                    {title}
+                </Title>
+            </ModalHeader>
+            <ModalBody>
+                <AlertGroup>
+                    {numSuccessfulDeletions > 0 && (
+                        <Alert
+                            component="p"
+                            isInline
+                            title={`Successfully deleted ${numSuccessfulDeletions} report ${pluralize(
+                                'configuration',
+                                numSuccessfulDeletions
+                            )}`}
+                            variant="success"
+                        />
+                    )}
+                    {deleteResults?.filter(isErrorDeleteResult).map((deleteResult) => {
+                        const reportConfiguration = reportConfigurations?.find(
+                            (configuration) => configuration.id === deleteResult.id
+                        );
+                        if (!reportConfiguration) {
+                            return null;
+                        }
+                        return (
+                            <Alert
+                                component="p"
+                                isInline
+                                key={deleteResult.id}
+                                title={`Failed to delete "${reportConfiguration.name}"`}
+                                variant="danger"
+                            >
+                                {deleteResult.error}
+                            </Alert>
+                        );
+                    })}
+                </AlertGroup>
+                <p>
+                    The selected report {pluralize('configuration', reportIdsToDelete.length)} and
+                    any attached downloadable reports will be permanently deleted. The action cannot
+                    be undone.
+                </p>
+            </ModalBody>
+            <ModalFooter>
+                <Button
+                    variant="danger"
+                    isLoading={isDeleting}
+                    isDisabled={isDeleting}
+                    onClick={onDelete}
+                >
+                    Delete
+                </Button>
+                <Button variant="link" onClick={onClose} isDisabled={isDeleting}>
+                    Cancel
+                </Button>
+            </ModalFooter>
+        </Modal>
+    );
+}
+
+export default DeleteReportsModal;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCVEsTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesCveTable.tsx
similarity index 69%
rename from ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCVEsTable.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesCveTable.tsx
index a14668f04b6c6..1fda7aa8133a7 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCVEsTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesCveTable.tsx
@@ -1,64 +1,91 @@
 import { useCallback } from 'react';
 import { Link } from 'react-router-dom-v5-compat';
-import { Flex, Pagination } from '@patternfly/react-core';
 import { Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
 
 import CvssFormatted from 'Components/CvssFormatted';
 import DateDistance from 'Components/DateDistance';
 import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
+import type { UseURLPaginationResult } from 'hooks/useURLPagination';
 import useRestQuery from 'hooks/useRestQuery';
-import useURLPagination from 'hooks/useURLPagination';
+import useURLSort from 'hooks/useURLSort';
 import { listVMCVEs } from 'services/VirtualMachineService';
+import type { SearchFilter } from 'types/search';
 import { getTableUIState } from 'utils/getTableUIState';
 
 import SeverityCountLabels from '../../components/SeverityCountLabels';
+import TableEntityToolbar from '../../components/TableEntityToolbar';
 import { getVirtualMachineEntityPagePath } from '../../utils/searchUtils';
-import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
+import {
+    CVE_PUBLISHED_ON_SORT_FIELD,
+    CVE_SORT_FIELD,
+    CVSS_SORT_FIELD,
+} from '../../utils/sortFields';
 import { formatEpssProbabilityAsPercent } from '../../WorkloadCves/Tables/table.utils';
+import VirtualMachineCvesFilterToolbar from './VirtualMachineCvesFilterToolbar';
+import VirtualMachineCvesToggleGroup from './VirtualMachineCvesToggleGroup';
 
-function VirtualMachineCVEsTable() {
-    const { page, perPage, setPage, setPerPage } = useURLPagination(DEFAULT_VM_PAGE_SIZE);
+const sortFields = [CVE_SORT_FIELD, CVSS_SORT_FIELD, CVE_PUBLISHED_ON_SORT_FIELD];
+
+const defaultSortOption = { field: CVSS_SORT_FIELD, direction: 'desc' } as const;
+
+type VirtualMachineCvesCveTableProps = {
+    searchFilter: SearchFilter;
+    pagination: UseURLPaginationResult;
+    isFiltered: boolean;
+    onClearFilters: () => void;
+};
+
+function VirtualMachineCvesCveTable({
+    searchFilter,
+    pagination,
+    isFiltered,
+    onClearFilters,
+}: VirtualMachineCvesCveTableProps) {
+    const { page, perPage } = pagination;
+    const { sortOption, getSortParams } = useURLSort({
+        sortFields,
+        defaultSortOption,
+        onSort: () => pagination.setPage(1, 'replace'),
+    });
 
     const fetchVirtualMachineCVEs = useCallback(
-        () => listVMCVEs({ page, perPage }),
-        [page, perPage]
+        () => listVMCVEs({ searchFilter, page, perPage, sortOption }),
+        [searchFilter, page, perPage, sortOption]
     );
     const { data, isLoading, error } = useRestQuery(fetchVirtualMachineCVEs);
 
+    const totalCount = data?.totalCount ?? 0;
+
     const tableState = getTableUIState({
         isLoading,
         data: data?.cves ?? [],
         error,
-        searchFilter: {},
+        searchFilter,
     });
 
     return (
         <>
-            <Flex justifyContent={{ default: 'justifyContentFlexEnd' }}>
-                <Pagination
-                    itemCount={data?.totalCount ?? 0}
-                    perPage={perPage}
-                    page={page}
-                    onSetPage={(_, newPage) => setPage(newPage)}
-                    onPerPageSelect={(_, newPerPage) => {
-                        setPerPage(newPerPage);
-                    }}
-                />
-            </Flex>
+            <TableEntityToolbar
+                filterToolbar={<VirtualMachineCvesFilterToolbar />}
+                entityToggleGroup={<VirtualMachineCvesToggleGroup />}
+                pagination={pagination}
+                tableRowCount={totalCount}
+                isFiltered={isFiltered}
+            />
             <Table
                 borders={tableState.type === 'COMPLETE'}
                 variant="compact"
                 aria-live="polite"
-                aria-busy={false}
+                aria-busy={isLoading}
             >
                 <Thead noWrap>
                     <Tr>
-                        <Th>CVE</Th>
+                        <Th sort={getSortParams(CVE_SORT_FIELD)}>CVE</Th>
                         <Th>Virtual machines by severity</Th>
-                        <Th>Top CVSS</Th>
+                        <Th sort={getSortParams(CVSS_SORT_FIELD)}>Top CVSS</Th>
                         <Th>Affected virtual machines</Th>
                         <Th>EPSS probability</Th>
-                        <Th>First discovered</Th>
+                        <Th sort={getSortParams(CVE_PUBLISHED_ON_SORT_FIELD)}>Published</Th>
                     </Tr>
                 </Thead>
                 <TbodyUnified
@@ -68,6 +95,7 @@ function VirtualMachineCVEsTable() {
                         message:
                             'No CVEs have been detected for virtual machines across your secured clusters',
                     }}
+                    filteredEmptyProps={{ onClearFilters }}
                     renderer={({ data }) => (
                         <Tbody>
                             {data.map((virtualMachineCve) => {
@@ -110,7 +138,7 @@ function VirtualMachineCVEsTable() {
                                                 virtualMachineCve.epssProbability
                                             )}
                                         </Td>
-                                        <Td dataLabel="First discovered">
+                                        <Td dataLabel="Published">
                                             <DateDistance date={virtualMachineCve.publishedOn} />
                                         </Td>
                                     </Tr>
@@ -124,4 +152,4 @@ function VirtualMachineCVEsTable() {
     );
 }
 
-export default VirtualMachineCVEsTable;
+export default VirtualMachineCvesCveTable;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesFilterToolbar.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesFilterToolbar.tsx
new file mode 100644
index 0000000000000..5d861a6256bda
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesFilterToolbar.tsx
@@ -0,0 +1,43 @@
+import useURLPagination from 'hooks/useURLPagination';
+import useURLSearch from 'hooks/useURLSearch';
+
+import AdvancedFiltersToolbar from '../../components/AdvancedFiltersToolbar';
+import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
+import {
+    virtualMachineCVESearchFilterConfig,
+    virtualMachineComponentSearchFilterConfig,
+    virtualMachinesClusterSearchFilterConfig,
+    virtualMachinesNamespaceSearchFilterConfig,
+    virtualMachinesSearchFilterConfig,
+} from '../../searchFilterConfig';
+
+const searchFilterConfig = [
+    virtualMachinesClusterSearchFilterConfig,
+    virtualMachineCVESearchFilterConfig,
+    virtualMachinesNamespaceSearchFilterConfig,
+    virtualMachinesSearchFilterConfig,
+    virtualMachineComponentSearchFilterConfig,
+];
+
+// Shared filter toolbar for both overview tables, which each render their own toolbar.
+// Factored out to make sure the two tables stay in sync. State is read from the URL, not props.
+function VirtualMachineCvesFilterToolbar() {
+    const { searchFilter, setSearchFilter } = useURLSearch();
+    const { setPage } = useURLPagination(DEFAULT_VM_PAGE_SIZE);
+
+    return (
+        <AdvancedFiltersToolbar
+            searchFilter={searchFilter}
+            searchFilterConfig={searchFilterConfig}
+            defaultSearchFilterEntity="Virtual machine"
+            includeCveSeverityFilters={false}
+            includeCveStatusFilters={false}
+            onFilterChange={(newFilter) => {
+                setSearchFilter(newFilter);
+                setPage(1, 'replace');
+            }}
+        />
+    );
+}
+
+export default VirtualMachineCvesFilterToolbar;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesOverviewPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesOverviewPage.tsx
index 46ba07fc89d27..ffe629f7ca169 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesOverviewPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesOverviewPage.tsx
@@ -1,69 +1,67 @@
-import {
-    Content,
-    Flex,
-    PageSection,
-    Title,
-    ToggleGroup,
-    ToggleGroupItem,
-} from '@patternfly/react-core';
+import { Content, Flex, PageSection, Title } from '@patternfly/react-core';
 
 import PageTitle from 'Components/PageTitle';
-import TechnologyPreviewLabel from 'Components/PatternFly/PreviewLabel/TechnologyPreviewLabel';
+import { useManagedColumns } from 'hooks/useManagedColumns';
 import useFeatureFlags from 'hooks/useFeatureFlags';
+import useURLPagination from 'hooks/useURLPagination';
+import useURLSearch from 'hooks/useURLSearch';
 import useURLStringUnion from 'hooks/useURLStringUnion';
+import { getHasSearchApplied } from 'utils/searchUtils';
 
+import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
 import { virtualMachineEntityTabValues } from '../../types';
 import VirtualMachineScanScopeAlert from '../components/VirtualMachineScanScopeAlert';
-import VirtualMachineCVEsTable from './VirtualMachineCVEsTable';
-import VirtualMachinesCvesTable from './VirtualMachinesCvesTable';
+import VirtualMachineCvesCveTable from './VirtualMachineCvesCveTable';
+import VirtualMachineCvesVmTable, { defaultColumns } from './VirtualMachineCvesVmTable';
 
 function VirtualMachineCvesOverviewPage() {
     const { isFeatureFlagEnabled } = useFeatureFlags();
     const isEnhancedDataModelEnabled = isFeatureFlagEnabled(
         'ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL'
     );
-    const [activeEntityTabKey, setActiveEntityTabKey] = useURLStringUnion(
-        'entityTab',
-        virtualMachineEntityTabValues
-    );
+    const [activeEntityTabKey] = useURLStringUnion('entityTab', virtualMachineEntityTabValues);
+    const { searchFilter, setSearchFilter } = useURLSearch();
+    const pagination = useURLPagination(DEFAULT_VM_PAGE_SIZE);
+    const managedColumnState = useManagedColumns('VirtualMachinesCvesTable', defaultColumns);
+
+    const isFiltered = getHasSearchApplied(searchFilter);
+
+    function onClearFilters() {
+        setSearchFilter({});
+        pagination.setPage(1);
+    }
 
     return (
         <>
             <PageTitle title="Virtual Machine CVEs Overview" />
             <PageSection component="div">
                 <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>
-                    <Flex alignItems={{ default: 'alignItemsCenter' }}>
-                        <Title headingLevel="h1">Virtual machine vulnerabilities</Title>
-                        <TechnologyPreviewLabel />
-                    </Flex>
+                    <Title headingLevel="h1">Virtual machine vulnerabilities</Title>
                     <Content component="p">
                         Prioritize and remediate observed CVEs across virtual machines
                     </Content>
                 </Flex>
             </PageSection>
-            <PageSection hasBodyWrapper={false}>
+            <PageSection>
                 <VirtualMachineScanScopeAlert />
-                {isEnhancedDataModelEnabled && (
-                    <ToggleGroup aria-label="Entity type toggle items">
-                        <ToggleGroupItem
-                            text="CVEs"
-                            buttonId="CVE"
-                            isSelected={activeEntityTabKey === 'CVE'}
-                            onChange={() => setActiveEntityTabKey('CVE')}
-                        />
-                        <ToggleGroupItem
-                            text="Virtual Machines"
-                            buttonId="VirtualMachine"
-                            isSelected={activeEntityTabKey === 'VirtualMachine'}
-                            onChange={() => setActiveEntityTabKey('VirtualMachine')}
-                        />
-                    </ToggleGroup>
-                )}
+            </PageSection>
+            <PageSection isCenterAligned>
                 {isEnhancedDataModelEnabled && activeEntityTabKey === 'CVE' && (
-                    <VirtualMachineCVEsTable />
+                    <VirtualMachineCvesCveTable
+                        searchFilter={searchFilter}
+                        pagination={pagination}
+                        isFiltered={isFiltered}
+                        onClearFilters={onClearFilters}
+                    />
                 )}
                 {(!isEnhancedDataModelEnabled || activeEntityTabKey === 'VirtualMachine') && (
-                    <VirtualMachinesCvesTable />
+                    <VirtualMachineCvesVmTable
+                        searchFilter={searchFilter}
+                        pagination={pagination}
+                        managedColumnState={managedColumnState}
+                        isFiltered={isFiltered}
+                        onClearFilters={onClearFilters}
+                    />
                 )}
             </PageSection>
         </>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesToggleGroup.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesToggleGroup.tsx
new file mode 100644
index 0000000000000..efca36f316d5c
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesToggleGroup.tsx
@@ -0,0 +1,45 @@
+import { ToggleGroup, ToggleGroupItem } from '@patternfly/react-core';
+
+import useURLPagination from 'hooks/useURLPagination';
+import useURLParameter from 'hooks/useURLParameter';
+import useURLStringUnion from 'hooks/useURLStringUnion';
+
+import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
+import { virtualMachineEntityTabValues } from '../../types';
+import type { VirtualMachineEntityTab } from '../../types';
+
+// Shared entity toggle for both overview tables, which each render their own toolbar.
+// Factored out to make sure the two tables stay in sync. State is read from the URL, not props.
+function VirtualMachineCvesToggleGroup() {
+    const [activeEntityTabKey, setActiveEntityTabKey] = useURLStringUnion(
+        'entityTab',
+        virtualMachineEntityTabValues
+    );
+    const { setPage } = useURLPagination(DEFAULT_VM_PAGE_SIZE);
+    const [, setSortOption] = useURLParameter('sortOption', undefined);
+
+    function selectEntityTab(entityTab: VirtualMachineEntityTab) {
+        setActiveEntityTabKey(entityTab);
+        setPage(1);
+        setSortOption(undefined);
+    }
+
+    return (
+        <ToggleGroup aria-label="Entity type toggle items">
+            <ToggleGroupItem
+                text="CVEs"
+                buttonId="CVE"
+                isSelected={activeEntityTabKey === 'CVE'}
+                onChange={() => selectEntityTab('CVE')}
+            />
+            <ToggleGroupItem
+                text="Virtual Machines"
+                buttonId="VirtualMachine"
+                isSelected={activeEntityTabKey === 'VirtualMachine'}
+                onChange={() => selectEntityTab('VirtualMachine')}
+            />
+        </ToggleGroup>
+    );
+}
+
+export default VirtualMachineCvesToggleGroup;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachinesCvesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesVmTable.tsx
similarity index 75%
rename from ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachinesCvesTable.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesVmTable.tsx
index 6b663a7647d9b..fb5f86aa3ca45 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachinesCvesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/Overview/VirtualMachineCvesVmTable.tsx
@@ -1,43 +1,34 @@
 import { useCallback } from 'react';
 import { Link } from 'react-router-dom-v5-compat';
-import { Flex, FlexItem, Pagination } from '@patternfly/react-core';
+import { ToolbarItem } from '@patternfly/react-core';
 import { InnerScrollContainer, Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
 
 import ColumnManagementButton from 'Components/ColumnManagementButton';
 import DateDistance from 'Components/DateDistance';
 import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
-import {
-    generateVisibilityForColumns,
-    getHiddenColumnCount,
-    useManagedColumns,
-} from 'hooks/useManagedColumns';
+import { generateVisibilityForColumns, getHiddenColumnCount } from 'hooks/useManagedColumns';
+import type { ManagedColumns } from 'hooks/useManagedColumns';
 import useFeatureFlags from 'hooks/useFeatureFlags';
 import useRestQuery from 'hooks/useRestQuery';
-import useURLPagination from 'hooks/useURLPagination';
-import useURLSearch from 'hooks/useURLSearch';
+import type { UseURLPaginationResult } from 'hooks/useURLPagination';
 import useURLSort from 'hooks/useURLSort';
 import { listVMs } from 'services/VirtualMachineService';
+import type { SearchFilter } from 'types/search';
 import { getTableUIState } from 'utils/getTableUIState';
 
-import AdvancedFiltersToolbar from '../../components/AdvancedFiltersToolbar';
 import SeverityCountLabels from '../../components/SeverityCountLabels';
-import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
-import {
-    virtualMachinesClusterSearchFilterConfig,
-    virtualMachinesNamespaceSearchFilterConfig,
-    virtualMachinesSearchFilterConfig,
-} from '../../searchFilterConfig';
+import TableEntityToolbar from '../../components/TableEntityToolbar';
 import { getVirtualMachineEntityPagePath } from '../../utils/searchUtils';
-import { VIRTUAL_MACHINE_SORT_FIELD } from '../../utils/sortFields';
+import {
+    CLUSTER_SORT_FIELD,
+    NAMESPACE_SORT_FIELD,
+    VIRTUAL_MACHINE_SORT_FIELD,
+} from '../../utils/sortFields';
+import VirtualMachineCvesFilterToolbar from './VirtualMachineCvesFilterToolbar';
+import VirtualMachineCvesToggleGroup from './VirtualMachineCvesToggleGroup';
 import VirtualMachinesCvesTableLegacy from './VirtualMachinesCvesTableLegacy';
 
-const searchFilterConfig = [
-    virtualMachinesClusterSearchFilterConfig,
-    virtualMachinesNamespaceSearchFilterConfig,
-    virtualMachinesSearchFilterConfig,
-];
-
-const sortFields = [VIRTUAL_MACHINE_SORT_FIELD];
+const sortFields = [VIRTUAL_MACHINE_SORT_FIELD, CLUSTER_SORT_FIELD, NAMESPACE_SORT_FIELD];
 
 const defaultSortOption = { field: VIRTUAL_MACHINE_SORT_FIELD, direction: 'asc' } as const;
 
@@ -69,14 +60,28 @@ export const defaultColumns = {
     },
 } as const;
 
-function VirtualMachinesCvesTableEnhanced() {
-    const managedColumnState = useManagedColumns('VirtualMachinesCvesTable', defaultColumns);
-    const { page, perPage, setPage, setPerPage } = useURLPagination(DEFAULT_VM_PAGE_SIZE);
-    const { searchFilter, setSearchFilter } = useURLSearch();
+type VirtualMachineCvesVmTableProps = {
+    searchFilter: SearchFilter;
+    pagination: UseURLPaginationResult;
+    managedColumnState: ManagedColumns<keyof typeof defaultColumns>;
+    isFiltered: boolean;
+    onClearFilters: () => void;
+};
+
+type VirtualMachineCvesVmTableEnhancedProps = VirtualMachineCvesVmTableProps;
+
+function VirtualMachineCvesVmTableEnhanced({
+    searchFilter,
+    pagination,
+    managedColumnState,
+    isFiltered,
+    onClearFilters,
+}: VirtualMachineCvesVmTableEnhancedProps) {
+    const { page, perPage } = pagination;
     const { sortOption, getSortParams } = useURLSort({
         sortFields,
         defaultSortOption,
-        onSort: () => setPage(1),
+        onSort: () => pagination.setPage(1, 'replace'),
     });
 
     const getVisibilityClass = generateVisibilityForColumns(managedColumnState.columns);
@@ -88,6 +93,9 @@ function VirtualMachinesCvesTableEnhanced() {
         [searchFilter, page, perPage, sortOption]
     );
     const { data, isLoading, error } = useRestQuery(fetchVirtualMachines);
+
+    const totalCount = data?.totalCount ?? 0;
+
     const tableState = getTableUIState({
         isLoading,
         data: data?.vms ?? [],
@@ -97,40 +105,26 @@ function VirtualMachinesCvesTableEnhanced() {
 
     return (
         <>
-            <Flex justifyContent={{ default: 'justifyContentFlexEnd' }}>
-                <FlexItem fullWidth={{ default: 'fullWidth' }}>
-                    <AdvancedFiltersToolbar
-                        defaultSearchFilterEntity="Virtual Machine"
-                        includeCveSeverityFilters={false}
-                        includeCveStatusFilters={false}
-                        searchFilter={searchFilter}
-                        searchFilterConfig={searchFilterConfig}
-                        onFilterChange={(newFilter) => {
-                            setSearchFilter(newFilter);
-                            setPage(1, 'replace');
-                        }}
+            <TableEntityToolbar
+                filterToolbar={<VirtualMachineCvesFilterToolbar />}
+                entityToggleGroup={<VirtualMachineCvesToggleGroup />}
+                pagination={pagination}
+                tableRowCount={totalCount}
+                isFiltered={isFiltered}
+            >
+                <ToolbarItem>
+                    <ColumnManagementButton
+                        columnConfig={managedColumnState.columns}
+                        onApplyColumns={managedColumnState.setVisibility}
                     />
-                </FlexItem>
-                <ColumnManagementButton
-                    columnConfig={managedColumnState.columns}
-                    onApplyColumns={managedColumnState.setVisibility}
-                />
-                <Pagination
-                    itemCount={data?.totalCount ?? 0}
-                    perPage={perPage}
-                    page={page}
-                    onSetPage={(_, newPage) => setPage(newPage)}
-                    onPerPageSelect={(_, newPerPage) => {
-                        setPerPage(newPerPage);
-                    }}
-                />
-            </Flex>
+                </ToolbarItem>
+            </TableEntityToolbar>
             <InnerScrollContainer>
                 <Table
                     borders={tableState.type === 'COMPLETE'}
                     variant="compact"
                     aria-live="polite"
-                    aria-busy={false}
+                    aria-busy={isLoading}
                 >
                     <Thead>
                         <Tr>
@@ -144,8 +138,18 @@ function VirtualMachinesCvesTableEnhanced() {
                             <Th className={getVisibilityClass('cvesBySeverity')}>
                                 CVEs by severity
                             </Th>
-                            <Th className={getVisibilityClass('cluster')}>Cluster</Th>
-                            <Th className={getVisibilityClass('namespace')}>Namespace</Th>
+                            <Th
+                                className={getVisibilityClass('cluster')}
+                                sort={getSortParams(CLUSTER_SORT_FIELD)}
+                            >
+                                Cluster
+                            </Th>
+                            <Th
+                                className={getVisibilityClass('namespace')}
+                                sort={getSortParams(NAMESPACE_SORT_FIELD)}
+                            >
+                                Namespace
+                            </Th>
                             <Th className={getVisibilityClass('scannedComponents')}>
                                 Scanned components
                             </Th>
@@ -161,6 +165,7 @@ function VirtualMachinesCvesTableEnhanced() {
                         emptyProps={{
                             message: 'No CVEs have been detected',
                         }}
+                        filteredEmptyProps={{ onClearFilters }}
                         renderer={({ data }) => (
                             <Tbody>
                                 {data.map((virtualMachine) => {
@@ -236,17 +241,17 @@ function VirtualMachinesCvesTableEnhanced() {
     );
 }
 
-function VirtualMachinesCvesTable() {
+function VirtualMachineCvesVmTable(props: VirtualMachineCvesVmTableProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
     const isEnhancedDataModelEnabled = isFeatureFlagEnabled(
         'ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL'
     );
 
     if (isEnhancedDataModelEnabled) {
-        return <VirtualMachinesCvesTableEnhanced />;
+        return <VirtualMachineCvesVmTableEnhanced {...props} />;
     }
 
     return <VirtualMachinesCvesTableLegacy />;
 }
 
-export default VirtualMachinesCvesTable;
+export default VirtualMachineCvesVmTable;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePage.tsx
index e8aa21601c2db..47142ed5a6ff1 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePage.tsx
@@ -4,7 +4,6 @@ import {
     Breadcrumb,
     BreadcrumbItem,
     Content,
-    Divider,
     PageSection,
     Skeleton,
     Tab,
@@ -54,7 +53,7 @@ function VirtualMachinePage() {
             <PageTitle
                 title={`Virtual Machine CVEs - Virtual Machine ${virtualMachineDetail?.name}`}
             />
-            <PageSection>
+            <PageSection type="breadcrumb">
                 <Breadcrumb>
                     <BreadcrumbItemLink to={virtualMachineCveOverviewPath}>
                         Virtual Machines
@@ -69,7 +68,6 @@ function VirtualMachinePage() {
                     </BreadcrumbItem>
                 </Breadcrumb>
             </PageSection>
-            <Divider component="div" />
             <PageSection>
                 <VirtualMachinePageHeader
                     virtualMachineDetail={virtualMachineDetail}
@@ -77,7 +75,7 @@ function VirtualMachinePage() {
                     error={error}
                 />
             </PageSection>
-            <PageSection padding={{ default: 'noPadding' }}>
+            <PageSection type="tabs">
                 <Tabs
                     activeKey={activeTabKey}
                     onSelect={(_, key) => {
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageHeaderLegacy.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageHeaderLegacy.tsx
index 025c165cbdeeb..a6124b41323bf 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageHeaderLegacy.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageHeaderLegacy.tsx
@@ -1,6 +1,5 @@
 import { Alert, Flex, Label, LabelGroup, Title } from '@patternfly/react-core';
 
-import TechnologyPreviewLabel from 'Components/PatternFly/PreviewLabel/TechnologyPreviewLabel';
 import type { VirtualMachine } from 'services/VirtualMachineService';
 import { getDateTime } from 'utils/dateUtils';
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
@@ -46,10 +45,7 @@ function VirtualMachinePageHeaderLegacy({
 
     return (
         <Flex direction={{ default: 'column' }} alignItems={{ default: 'alignItemsFlexStart' }}>
-            <Flex alignItems={{ default: 'alignItemsCenter' }}>
-                <Title headingLevel="h1">{virtualMachine.name}</Title>
-                <TechnologyPreviewLabel />
-            </Flex>
+            <Title headingLevel="h1">{virtualMachine.name}</Title>
             <LabelGroup numLabels={5}>
                 <Label>
                     In: {virtualMachine.clusterName}/{virtualMachine.namespace}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageLegacy.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageLegacy.tsx
index af4edbfbe7083..5aedb6133d22a 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageLegacy.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageLegacy.tsx
@@ -4,7 +4,6 @@ import {
     Breadcrumb,
     BreadcrumbItem,
     Content,
-    Divider,
     PageSection,
     Skeleton,
     Tab,
@@ -95,7 +94,7 @@ function VirtualMachinePageLegacy() {
     return (
         <>
             <PageTitle title={`Virtual Machine CVEs - Virtual Machine ${virtualMachine?.name}`} />
-            <PageSection>
+            <PageSection type="breadcrumb">
                 <Breadcrumb>
                     <BreadcrumbItemLink to={virtualMachineCveOverviewPath}>
                         Virtual Machines
@@ -110,7 +109,6 @@ function VirtualMachinePageLegacy() {
                     </BreadcrumbItem>
                 </Breadcrumb>
             </PageSection>
-            <Divider component="div" />
             <PageSection>
                 <VirtualMachinePageHeaderLegacy
                     virtualMachine={virtualMachine}
@@ -118,7 +116,7 @@ function VirtualMachinePageLegacy() {
                     error={error}
                 />
             </PageSection>
-            <PageSection padding={{ default: 'noPadding' }}>
+            <PageSection type="tabs">
                 <Tabs
                     activeKey={activeTabKey}
                     onSelect={(_, key) => {
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageVulnerabilities.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageVulnerabilities.tsx
index b6d64c4787426..318ffb3bfd6c9 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageVulnerabilities.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachinePageVulnerabilities.tsx
@@ -12,16 +12,24 @@ import useRestQuery from 'hooks/useRestQuery';
 import useURLPagination from 'hooks/useURLPagination';
 import useURLSearch from 'hooks/useURLSearch';
 import useURLSort from 'hooks/useURLSort';
-import { listVMCVEsByVM } from 'services/VirtualMachineService';
+import { getVMVulnSummary, listVMCVEsByVM } from 'services/VirtualMachineService';
 import { getTableUIState } from 'utils/getTableUIState';
 
 import AdvancedFiltersToolbar from '../../components/AdvancedFiltersToolbar';
+import BySeveritySummaryCard from '../../components/BySeveritySummaryCard';
+import CvesByStatusSummaryCard from '../../components/CvesByStatusSummaryCard';
+import { SummaryCard, SummaryCardLayout } from '../../components/SummaryCardLayout';
 import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
-import VirtualMachineScanScopeAlert from '../components/VirtualMachineScanScopeAlert';
+import AffectedComponentsTable from '../components/AffectedComponentsTable';
 import {
     virtualMachineCVESearchFilterConfig,
     virtualMachineComponentSearchFilterConfig,
 } from '../../searchFilterConfig';
+import {
+    getHiddenSeverities,
+    getHiddenStatuses,
+    parseQuerySearchFilter,
+} from '../../utils/searchUtils';
 import {
     CVE_EPSS_PROBABILITY_SORT_FIELD,
     CVE_SEVERITY_SORT_FIELD,
@@ -55,6 +63,7 @@ function VirtualMachinePageVulnerabilities({
 }: VirtualMachinePageVulnerabilitiesProps) {
     const { page, perPage, setPage, setPerPage } = useURLPagination(DEFAULT_VM_PAGE_SIZE);
     const { searchFilter, setSearchFilter } = useURLSearch();
+    const querySearchFilter = parseQuerySearchFilter(searchFilter);
     const { sortOption, getSortParams } = useURLSort({
         sortFields,
         defaultSortOption,
@@ -63,6 +72,16 @@ function VirtualMachinePageVulnerabilities({
     const expandedRowSet = useSet<string>();
     const colSpan = 7;
 
+    const fetchSummary = useCallback(
+        () => getVMVulnSummary(virtualMachineId, parseQuerySearchFilter(searchFilter)),
+        [virtualMachineId, searchFilter]
+    );
+    const {
+        data: summary,
+        isLoading: isLoadingSummary,
+        error: summaryError,
+    } = useRestQuery(fetchSummary);
+
     const fetchCVEs = useCallback(
         () => listVMCVEsByVM(virtualMachineId, { searchFilter, page, perPage, sortOption }),
         [virtualMachineId, searchFilter, page, perPage, sortOption]
@@ -83,7 +102,6 @@ function VirtualMachinePageVulnerabilities({
 
     return (
         <Flex direction={{ default: 'column' }} gap={{ default: 'gapMd' }}>
-            <VirtualMachineScanScopeAlert />
             <Flex justifyContent={{ default: 'justifyContentFlexEnd' }}>
                 <FlexItem fullWidth={{ default: 'fullWidth' }}>
                     <AdvancedFiltersToolbar
@@ -107,14 +125,37 @@ function VirtualMachinePageVulnerabilities({
                     }}
                 />
             </Flex>
+            <SummaryCardLayout error={summaryError} isLoading={isLoadingSummary}>
+                <SummaryCard
+                    data={summary}
+                    loadingText="Loading virtual machine vulnerabilities by severity summary"
+                    renderer={({ data }) => (
+                        <BySeveritySummaryCard
+                            title="CVEs by severity"
+                            severityCounts={data.severityCounts}
+                            hiddenSeverities={getHiddenSeverities(querySearchFilter)}
+                        />
+                    )}
+                />
+                <SummaryCard
+                    data={summary}
+                    loadingText="Loading virtual machine vulnerabilities by status summary"
+                    renderer={({ data }) => (
+                        <CvesByStatusSummaryCard
+                            cveStatusCounts={data.severityCounts}
+                            hiddenStatuses={getHiddenStatuses(querySearchFilter)}
+                        />
+                    )}
+                />
+            </SummaryCardLayout>
             <Table borders={tableState.type === 'COMPLETE'} variant="compact" aria-live="polite">
                 <Thead noWrap>
                     <Tr>
                         <Th screenReaderText="Row expansion" />
                         <Th sort={getSortParams(CVE_SORT_FIELD)}>CVE</Th>
-                        <Th sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}>CVE severity</Th>
+                        <Th sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}>Top CVE severity</Th>
                         <Th sort={getSortParams(CVE_STATUS_SORT_FIELD)}>CVE status</Th>
-                        <Th sort={getSortParams(CVSS_SORT_FIELD)}>CVSS</Th>
+                        <Th sort={getSortParams(CVSS_SORT_FIELD)}>Top CVSS</Th>
                         <Th sort={getSortParams(CVE_EPSS_PROBABILITY_SORT_FIELD)}>
                             EPSS probability
                         </Th>
@@ -144,7 +185,7 @@ function VirtualMachinePageVulnerabilities({
                                         <Td dataLabel="CVE">
                                             <Truncate position="middle" content={cve.cve} />
                                         </Td>
-                                        <Td dataLabel="CVE severity" modifier="nowrap">
+                                        <Td dataLabel="Top CVE severity" modifier="nowrap">
                                             <VulnerabilitySeverityIconText
                                                 severity={cve.severity}
                                             />
@@ -154,7 +195,7 @@ function VirtualMachinePageVulnerabilities({
                                                 isFixable={cve.isFixable}
                                             />
                                         </Td>
-                                        <Td dataLabel="CVSS" modifier="nowrap">
+                                        <Td dataLabel="Top CVSS" modifier="nowrap">
                                             <CvssFormatted cvss={cve.cvss} />
                                         </Td>
                                         <Td dataLabel="EPSS probability">
@@ -168,7 +209,12 @@ function VirtualMachinePageVulnerabilities({
                                         <Td />
                                         <Td colSpan={colSpan - 1}>
                                             <ExpandableRowContent>
-                                                Affected component details coming soon
+                                                {isExpanded && (
+                                                    <AffectedComponentsTable
+                                                        virtualMachineId={virtualMachineId}
+                                                        cveId={cve.cve}
+                                                    />
+                                                )}
                                             </ExpandableRowContent>
                                         </Td>
                                     </Tr>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachineVulnerabilitiesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachineVulnerabilitiesTable.tsx
index 0208980734d71..ddc01e1ecc3b3 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachineVulnerabilitiesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/VirtualMachineVulnerabilitiesTable.tsx
@@ -34,7 +34,7 @@ export const defaultColumns = {
         isUntoggleAble: true,
     },
     cveSeverity: {
-        title: 'CVE severity',
+        title: 'Top CVE severity',
         isShownByDefault: true,
     },
     cveStatus: {
@@ -42,7 +42,7 @@ export const defaultColumns = {
         isShownByDefault: true,
     },
     cvss: {
-        title: 'CVSS',
+        title: 'Top CVSS',
         isShownByDefault: true,
     },
     epssProbability: {
@@ -90,14 +90,14 @@ function VirtualMachineVulnerabilitiesTable({
                         className={getVisibilityClass('cveSeverity')}
                         sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}
                     >
-                        CVE severity
+                        Top CVE severity
                     </Th>
                     <Th className={getVisibilityClass('cveStatus')}>CVE status</Th>
                     <Th
                         className={getVisibilityClass('cvss')}
                         sort={getSortParams(CVSS_SORT_FIELD)}
                     >
-                        CVSS
+                        Top CVSS
                     </Th>
                     <Th
                         className={getVisibilityClass('epssProbability')}
@@ -140,7 +140,7 @@ function VirtualMachineVulnerabilitiesTable({
                                     </Td>
                                     <Td
                                         className={getVisibilityClass('cveSeverity')}
-                                        dataLabel="CVE severity"
+                                        dataLabel="Top CVE severity"
                                     >
                                         <VulnerabilitySeverityIconText
                                             severity={vulnerability.severity}
@@ -154,7 +154,7 @@ function VirtualMachineVulnerabilitiesTable({
                                             isFixable={vulnerability.isFixable}
                                         />
                                     </Td>
-                                    <Td className={getVisibilityClass('cvss')} dataLabel="CVSS">
+                                    <Td className={getVisibilityClass('cvss')} dataLabel="Top CVSS">
                                         <CvssFormatted
                                             cvss={vulnerability.cvss}
                                             scoreVersion="v3"
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/virtualMachineUtils.ts b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/virtualMachineUtils.ts
index fa7b438352d9d..16636ddcd8a74 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/virtualMachineUtils.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachine/virtualMachineUtils.ts
@@ -9,4 +9,5 @@ export const stateDisplayMap: Record<VirtualMachineV2State, string> = {
 export const agentStatusDisplayMap: Record<AgentStatus, string> = {
     AGENT_STATUS_UNKNOWN: 'Unknown',
     AGENT_STATUS_ACTIVE: 'Active',
+    AGENT_STATUS_INACTIVE: 'Inactive',
 };
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesSummaryCard.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesSummaryCard.tsx
index 1846761323535..81827f4afe461 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesSummaryCard.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesSummaryCard.tsx
@@ -1,5 +1,4 @@
 import { Card, CardBody, CardTitle, Grid, GridItem } from '@patternfly/react-core';
-import pluralize from 'pluralize';
 
 type AffectedVirtualMachinesSummaryCardProps = {
     affectedVirtualMachinesCount: number;
@@ -21,7 +20,7 @@ function AffectedVirtualMachinesSummaryCard({
                         {`${affectedVirtualMachinesCount} / ${totalVirtualMachinesCount} affected virtual machines`}
                     </GridItem>
                     <GridItem span={12}>
-                        {`${affectedGuestOsCount} ${pluralize('Guest OS', affectedGuestOsCount)} affected`}
+                        {`${affectedGuestOsCount} ${affectedGuestOsCount === 1 ? 'Guest OS' : 'Guest OSes'} affected`}
                     </GridItem>
                 </Grid>
             </CardBody>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesTable.tsx
index 32552de916352..28782384ab32a 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/AffectedVirtualMachinesTable.tsx
@@ -8,19 +8,40 @@ import VulnerabilityFixableIconText from 'Components/PatternFly/IconText/Vulnera
 import VulnerabilitySeverityIconText from 'Components/PatternFly/IconText/VulnerabilitySeverityIconText';
 import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
 import useSet from 'hooks/useSet';
+import type { UseURLSortResult } from 'hooks/useURLSort';
 import type { TableUIState } from 'utils/getTableUIState';
 
 import type { VMCVEAffectedVMRow } from 'services/VirtualMachineService';
 
 import { getVirtualMachineEntityPagePath } from '../../utils/searchUtils';
+import AffectedComponentsTable from '../components/AffectedComponentsTable';
+import {
+    CVE_SEVERITY_SORT_FIELD,
+    CVSS_SORT_FIELD,
+    GUEST_OS_SORT_FIELD,
+    VIRTUAL_MACHINE_SORT_FIELD,
+} from '../../utils/sortFields';
+
+export const sortFields = [
+    VIRTUAL_MACHINE_SORT_FIELD,
+    CVE_SEVERITY_SORT_FIELD,
+    CVSS_SORT_FIELD,
+    GUEST_OS_SORT_FIELD,
+];
+
+export const defaultSortOption = { field: CVE_SEVERITY_SORT_FIELD, direction: 'desc' } as const;
 
 export type AffectedVirtualMachinesTableProps = {
+    cveId: string;
     tableState: TableUIState<VMCVEAffectedVMRow>;
+    getSortParams: UseURLSortResult['getSortParams'];
     onClearFilters: () => void;
 };
 
 function AffectedVirtualMachinesTable({
+    cveId,
     tableState,
+    getSortParams,
     onClearFilters,
 }: AffectedVirtualMachinesTableProps) {
     const colSpan = 7;
@@ -31,11 +52,11 @@ function AffectedVirtualMachinesTable({
             <Thead noWrap>
                 <Tr>
                     <Th screenReaderText="Row expansion" />
-                    <Th>Virtual machine</Th>
-                    <Th>CVE severity</Th>
+                    <Th sort={getSortParams(VIRTUAL_MACHINE_SORT_FIELD)}>Virtual machine</Th>
+                    <Th sort={getSortParams(CVE_SEVERITY_SORT_FIELD)}>Top CVE severity</Th>
                     <Th>CVE status</Th>
-                    <Th>CVSS</Th>
-                    <Th>Guest OS</Th>
+                    <Th sort={getSortParams(CVSS_SORT_FIELD)}>Top CVSS</Th>
+                    <Th sort={getSortParams(GUEST_OS_SORT_FIELD)}>Guest OS</Th>
                     <Th>Affected components</Th>
                 </Tr>
             </Thead>
@@ -74,7 +95,7 @@ function AffectedVirtualMachinesTable({
                                             />
                                         </Link>
                                     </Td>
-                                    <Td dataLabel="CVE severity" modifier="nowrap">
+                                    <Td dataLabel="Top CVE severity" modifier="nowrap">
                                         <VulnerabilitySeverityIconText
                                             severity={virtualMachine.severity}
                                         />
@@ -84,7 +105,7 @@ function AffectedVirtualMachinesTable({
                                             isFixable={virtualMachine.isFixable}
                                         />
                                     </Td>
-                                    <Td dataLabel="CVSS" modifier="nowrap">
+                                    <Td dataLabel="Top CVSS" modifier="nowrap">
                                         <CvssFormatted cvss={virtualMachine.cvss} />
                                     </Td>
                                     <Td dataLabel="Guest OS">
@@ -101,7 +122,12 @@ function AffectedVirtualMachinesTable({
                                     <Td />
                                     <Td colSpan={colSpan - 1}>
                                         <ExpandableRowContent>
-                                            Affected component details coming soon
+                                            {isExpanded && (
+                                                <AffectedComponentsTable
+                                                    virtualMachineId={virtualMachine.vmId}
+                                                    cveId={cveId}
+                                                />
+                                            )}
                                         </ExpandableRowContent>
                                     </Td>
                                 </Tr>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/VirtualMachineCvePage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/VirtualMachineCvePage.tsx
index 92f2e71a222f4..c793f359cbc69 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/VirtualMachineCvePage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/VirtualMachineCve/VirtualMachineCvePage.tsx
@@ -7,42 +7,73 @@ import {
     Flex,
     PageSection,
     Pagination,
-    Split,
-    SplitItem,
-    Title,
 } from '@patternfly/react-core';
-import pluralize from 'pluralize';
 
 import PageTitle from 'Components/PageTitle';
 import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
 import useRestQuery from 'hooks/useRestQuery';
 import useURLPagination from 'hooks/useURLPagination';
+import useURLSearch from 'hooks/useURLSearch';
+import useURLSort from 'hooks/useURLSort';
 import { getVMCVEDetail, listVMCVEAffectedVMs } from 'services/VirtualMachineService';
 import { getTableUIState } from 'utils/getTableUIState';
 
+import AdvancedFiltersToolbar from '../../components/AdvancedFiltersToolbar';
 import BySeveritySummaryCard from '../../components/BySeveritySummaryCard';
 import { SummaryCard, SummaryCardLayout } from '../../components/SummaryCardLayout';
 import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
-import { getOverviewPagePath } from '../../utils/searchUtils';
+import {
+    virtualMachineComponentSearchFilterConfig,
+    virtualMachinesClusterSearchFilterConfig,
+    virtualMachinesNamespaceSearchFilterConfig,
+    virtualMachinesSearchFilterConfig,
+} from '../../searchFilterConfig';
+import {
+    getHiddenSeverities,
+    getOverviewPagePath,
+    parseQuerySearchFilter,
+} from '../../utils/searchUtils';
 import AffectedVirtualMachinesSummaryCard from './AffectedVirtualMachinesSummaryCard';
-import AffectedVirtualMachinesTable from './AffectedVirtualMachinesTable';
+import AffectedVirtualMachinesTable, {
+    defaultSortOption,
+    sortFields,
+} from './AffectedVirtualMachinesTable';
 import VirtualMachineCvePageHeader from './VirtualMachineCvePageHeader';
 
+const searchFilterConfig = [
+    virtualMachinesClusterSearchFilterConfig,
+    virtualMachinesNamespaceSearchFilterConfig,
+    virtualMachinesSearchFilterConfig,
+    virtualMachineComponentSearchFilterConfig,
+];
+
 const virtualMachineCveOverviewCvePath = getOverviewPagePath('VirtualMachine', {
     entityTab: 'CVE',
 });
 
 function VirtualMachineCvePage() {
     const { cveId } = useParams<{ cveId: string }>();
-
-    const fetchCveDetail = useCallback(() => getVMCVEDetail(cveId ?? ''), [cveId]);
-    const { data: cveDetail, isLoading, error } = useRestQuery(fetchCveDetail);
+    const { searchFilter, setSearchFilter } = useURLSearch();
+    const querySearchFilter = parseQuerySearchFilter(searchFilter);
 
     const { page, perPage, setPage, setPerPage } = useURLPagination(DEFAULT_VM_PAGE_SIZE);
+    const { sortOption, getSortParams } = useURLSort({ sortFields, defaultSortOption });
+
+    const fetchCveDetail = useCallback(
+        () => getVMCVEDetail(cveId ?? '', parseQuerySearchFilter(searchFilter)),
+        [cveId, searchFilter]
+    );
+    const { data: cveDetail, isLoading, error } = useRestQuery(fetchCveDetail);
 
     const fetchAffectedVMs = useCallback(
-        () => listVMCVEAffectedVMs(cveId ?? '', { page, perPage }),
-        [cveId, page, perPage]
+        () =>
+            listVMCVEAffectedVMs(cveId ?? '', {
+                searchFilter: parseQuerySearchFilter(searchFilter),
+                sortOption,
+                page,
+                perPage,
+            }),
+        [cveId, searchFilter, sortOption, page, perPage]
     );
     const {
         data: affectedVMsData,
@@ -54,7 +85,7 @@ function VirtualMachineCvePage() {
         isLoading: isLoadingAffectedVMs,
         data: affectedVMsData?.vms ?? [],
         error: affectedVMsError,
-        searchFilter: {},
+        searchFilter,
     });
 
     const affectedVMCount = affectedVMsData?.totalCount ?? 0;
@@ -62,7 +93,7 @@ function VirtualMachineCvePage() {
     return (
         <>
             <PageTitle title={`Virtual Machine CVEs - ${cveId}`} />
-            <PageSection>
+            <PageSection type="breadcrumb">
                 <Breadcrumb>
                     <BreadcrumbItemLink to={virtualMachineCveOverviewCvePath}>
                         CVEs
@@ -70,12 +101,21 @@ function VirtualMachineCvePage() {
                     <BreadcrumbItem isActive>{cveId}</BreadcrumbItem>
                 </Breadcrumb>
             </PageSection>
-            <Divider component="div" />
             <PageSection>
                 <VirtualMachineCvePageHeader cveDetail={cveDetail} />
             </PageSection>
             <Divider component="div" />
             <PageSection hasBodyWrapper={false}>
+                <AdvancedFiltersToolbar
+                    searchFilterConfig={searchFilterConfig}
+                    searchFilter={searchFilter}
+                    defaultSearchFilterEntity="Virtual machine"
+                    additionalContextFilter={{ CVE: `"${cveId ?? ''}"` }}
+                    onFilterChange={(newFilter) => {
+                        setSearchFilter(newFilter);
+                        setPage(1);
+                    }}
+                />
                 <SummaryCardLayout error={error} isLoading={isLoading}>
                     <SummaryCard
                         data={cveDetail}
@@ -95,35 +135,29 @@ function VirtualMachineCvePage() {
                             <BySeveritySummaryCard
                                 title="VMs by severity"
                                 severityCounts={data.vmSeverityCounts}
-                                hiddenSeverities={new Set()}
+                                hiddenSeverities={getHiddenSeverities(querySearchFilter)}
                             />
                         )}
                     />
                 </SummaryCardLayout>
                 <Divider component="div" />
-                <Split hasGutter className="pf-v6-u-align-items-baseline">
-                    <SplitItem isFilled>
-                        <Flex alignItems={{ default: 'alignItemsCenter' }}>
-                            <Title headingLevel="h2">
-                                {`${affectedVMCount} ${pluralize('virtual machine', affectedVMCount)} affected`}
-                            </Title>
-                        </Flex>
-                    </SplitItem>
-                    <SplitItem>
-                        <Pagination
-                            itemCount={affectedVMCount}
-                            perPage={perPage}
-                            page={page}
-                            onSetPage={(_, newPage) => setPage(newPage)}
-                            onPerPageSelect={(_, newPerPage) => {
-                                setPerPage(newPerPage);
-                            }}
-                        />
-                    </SplitItem>
-                </Split>
+                <Flex justifyContent={{ default: 'justifyContentFlexEnd' }}>
+                    <Pagination
+                        itemCount={affectedVMCount}
+                        perPage={perPage}
+                        page={page}
+                        onSetPage={(_, newPage) => setPage(newPage)}
+                        onPerPageSelect={(_, newPerPage) => {
+                            setPerPage(newPerPage);
+                        }}
+                    />
+                </Flex>
                 <AffectedVirtualMachinesTable
+                    cveId={cveId ?? ''}
                     tableState={tableState}
+                    getSortParams={getSortParams}
                     onClearFilters={() => {
+                        setSearchFilter({});
                         setPage(1);
                     }}
                 />
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/components/AffectedComponentsTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/components/AffectedComponentsTable.tsx
new file mode 100644
index 0000000000000..c8db0243edde5
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VirtualMachineCves/components/AffectedComponentsTable.tsx
@@ -0,0 +1,77 @@
+import { useCallback } from 'react';
+import { Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
+
+import TbodyUnified from 'Components/TableStateTemplates/TbodyUnified';
+import useRestQuery from 'hooks/useRestQuery';
+import { getVMCVEComponents } from 'services/VirtualMachineService';
+import { getTableUIState } from 'utils/getTableUIState';
+
+import AdvisoryLinkOrText from '../../components/AdvisoryLinkOrText';
+import FixedByVersion from '../../components/FixedByVersion';
+import { sourceTypeLabels } from '../../constants';
+
+export type AffectedComponentsTableProps = {
+    virtualMachineId: string;
+    cveId: string;
+};
+
+function AffectedComponentsTable({ virtualMachineId, cveId }: AffectedComponentsTableProps) {
+    const colSpan = 5;
+    const fetchComponents = useCallback(
+        () => getVMCVEComponents(virtualMachineId, cveId),
+        [virtualMachineId, cveId]
+    );
+    const { data, isLoading, error } = useRestQuery(fetchComponents);
+
+    const tableState = getTableUIState({
+        isLoading,
+        data: data?.components,
+        error,
+        searchFilter: {},
+    });
+
+    return (
+        <Table variant="compact">
+            <Thead noWrap>
+                <Tr>
+                    <Th>Component</Th>
+                    <Th>Version</Th>
+                    <Th>CVE fixed in</Th>
+                    <Th>Advisory</Th>
+                    <Th>Type</Th>
+                </Tr>
+            </Thead>
+            <TbodyUnified
+                tableState={tableState}
+                colSpan={colSpan}
+                errorProps={{
+                    title: 'There was an error loading affected components',
+                }}
+                emptyProps={{
+                    message: 'There are no affected components',
+                }}
+                renderer={({ data }) => (
+                    <Tbody>
+                        {data.map(
+                            ({ componentName, componentVersion, source, fixedBy, advisory }) => (
+                                <Tr key={`${componentName}-${componentVersion}`}>
+                                    <Td dataLabel="Component">{componentName}</Td>
+                                    <Td dataLabel="Version">{componentVersion}</Td>
+                                    <Td dataLabel="CVE fixed in">
+                                        <FixedByVersion fixedByVersion={fixedBy ?? ''} />
+                                    </Td>
+                                    <Td dataLabel="Advisory">
+                                        <AdvisoryLinkOrText advisory={advisory} />
+                                    </Td>
+                                    <Td dataLabel="Type">{sourceTypeLabels[source]}</Td>
+                                </Tr>
+                            )
+                        )}
+                    </Tbody>
+                )}
+            />
+        </Table>
+    );
+}
+
+export default AffectedComponentsTable;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ReportJobs.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ReportJobs.tsx
index 694a64bf6f093..c64d1b7bd9b3a 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ReportJobs.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ReportJobs.tsx
@@ -47,7 +47,7 @@ import { runStates } from 'types/reportJob';
 import type { RunState } from 'types/reportJob';
 import ReportJobStatus from 'Components/ReportJob/ReportJobStatus';
 
-import ImageVulnerabilityReportView from '../../ImageVulnerabilityReports/View/ImageVulnerabilityReportView';
+import ImageVulnerabilityReportView from '../../Reports/ImageVulnerabilityReports/View/ImageVulnerabilityReportView';
 import {
     attributesSeparateFromConfigForImageVulnerabilityReport,
     searchFilterConfigForImageVulnerabilityReport,
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ViewVulnReportPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ViewVulnReportPage.tsx
index c0c78befa2059..9fe794c6b4e55 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ViewVulnReportPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/ViewVulnReport/ViewVulnReportPage.tsx
@@ -19,7 +19,11 @@ import {
     Title,
 } from '@patternfly/react-core';
 
-import { vulnerabilityConfigurationReportsPath } from 'routePaths';
+import {
+    vulnerabilityImageConfigurationsReportsDetailsPath,
+    vulnerabilityImageConfigurationsReportsPath,
+    vulnerabilityReportsPath,
+} from 'routePaths';
 
 import DeleteModal from 'Components/PatternFly/DeleteModal';
 import PageTitle from 'Components/PageTitle';
@@ -28,6 +32,11 @@ import NotFoundMessage from 'Components/NotFoundMessage/NotFoundMessage';
 import usePermissions from 'hooks/usePermissions';
 import useToasts from 'hooks/patternfly/useToasts';
 import type { Toast } from 'hooks/patternfly/useToasts';
+import {
+    deleteReportConfiguration,
+    fetchReportHistory,
+    runReportRequest,
+} from 'services/ReportsService';
 import type { ReportConfiguration } from 'services/ReportsService.types';
 
 import MenuDropdown from 'Components/PatternFly/MenuDropdown';
@@ -35,7 +44,7 @@ import ReportJobsHelpAction from 'Components/ReportJob/ReportJobsHelpAction';
 import type { JobContextTab } from 'Components/ReportJob/types';
 import { ensureJobContextTab } from 'Components/ReportJob/utils';
 
-import ImageVulnerabilityReportView from '../../ImageVulnerabilityReports/View/ImageVulnerabilityReportView';
+import ImageVulnerabilityReportView from '../../Reports/ImageVulnerabilityReports/View/ImageVulnerabilityReportView';
 import {
     attributesSeparateFromConfigForImageVulnerabilityReport,
     searchFilterConfigForImageVulnerabilityReport,
@@ -45,7 +54,6 @@ import useFetchReport from '../api/useFetchReport';
 import useRunReport from '../api/useRunReport';
 import { useWatchLastSnapshotForReports } from '../api/useWatchLastSnapshotForReports';
 import useDeleteModal, { isErrorDeleteResult } from '../hooks/useDeleteModal';
-import { vulnerabilityConfigurationReportDetailsPath } from '../pathsForVulnerabilityReporting';
 
 // resourceScope: {} after roll back to previous version that does not support a newer resource scope.
 // Do not let user clone or edit report configuration which might cause worse problems after roll forward.
@@ -68,7 +76,10 @@ function ViewVulnReportPage() {
         hasReadAccess('Integration'); // for notifiers
 
     const { reportConfiguration, isLoading, error: fetchError } = useFetchReport(reportId);
-    const { reportSnapshots } = useWatchLastSnapshotForReports(reportConfiguration);
+    const { reportSnapshots } = useWatchLastSnapshotForReports(
+        reportConfiguration,
+        fetchReportHistory
+    );
     const reportSnapshot = reportSnapshots[reportId];
 
     const {
@@ -79,14 +90,16 @@ function ViewVulnReportPage() {
         onDelete,
         deleteResults,
     } = useDeleteModal({
+        deleteFunction: deleteReportConfiguration,
         onCompleted: () => {
-            navigate(vulnerabilityConfigurationReportsPath);
+            navigate(vulnerabilityImageConfigurationsReportsPath);
         },
     });
 
     const { toasts, addToast, removeToast } = useToasts();
 
     const { isRunning, runError, runReport } = useRunReport({
+        runReportRequest,
         onCompleted: ({ reportNotificationMethod }) => {
             if (reportNotificationMethod === 'EMAIL') {
                 addToast('The report has been sent to the configured email notifier', 'success');
@@ -113,12 +126,12 @@ function ViewVulnReportPage() {
                 title="Error fetching the report configuration"
                 message={fetchError || 'No data available'}
                 actionText="Go to reports"
-                url={vulnerabilityConfigurationReportsPath}
+                url={vulnerabilityImageConfigurationsReportsPath}
             />
         );
     }
 
-    const vulnReportPageURL = generatePath(vulnerabilityConfigurationReportDetailsPath, {
+    const vulnReportPageURL = generatePath(vulnerabilityImageConfigurationsReportsDetailsPath, {
         reportId: reportConfiguration.id,
     });
 
@@ -153,7 +166,10 @@ function ViewVulnReportPage() {
             <PageTitle title="View vulnerability report" />
             <PageSection type="breadcrumb">
                 <Breadcrumb>
-                    <BreadcrumbItemLink to={vulnerabilityConfigurationReportsPath}>
+                    <BreadcrumbItemLink to={vulnerabilityReportsPath}>
+                        Vulnerability reports
+                    </BreadcrumbItemLink>
+                    <BreadcrumbItemLink to={vulnerabilityImageConfigurationsReportsPath}>
                         Image vulnerability reports
                     </BreadcrumbItemLink>
                     <BreadcrumbItem isActive>{reportConfiguration.name}</BreadcrumbItem>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReportingPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReportingPage.tsx
index ccee7874305e0..a5668edb5ba68 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReportingPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReportingPage.tsx
@@ -5,7 +5,7 @@ import type { ReportPageAction } from 'Components/Reports/reports.types';
 import usePageAction from 'hooks/usePageAction';
 import usePermissions from 'hooks/usePermissions';
 
-import ImageVulnerabilityReportWizardPage from '../ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage';
+import ImageVulnerabilityReportWizardPage from '../Reports/ImageVulnerabilityReports/Wizard/ImageVulnerabilityReportWizardPage';
 
 import ViewVulnReportPage from './ViewVulnReport/ViewVulnReportPage';
 import VulnReportingLayout from './VulnReports/VulnReportingLayout';
@@ -27,14 +27,14 @@ function VulnReportingPage() {
                 path="/"
                 element={
                     <Navigate
-                        to={isReportConfigurationEnabled ? 'configuration' : 'view-based'}
+                        to={isReportConfigurationEnabled ? 'configurations' : 'view-based-jobs'}
                         replace
                     />
                 }
             />
             {isReportConfigurationEnabled && (
                 <Route
-                    path="/configuration"
+                    path="/configurations"
                     element={
                         (pageAction === 'create' || pageAction === 'createFromFilters') &&
                         hasWriteAccessForReport ? (
@@ -47,7 +47,7 @@ function VulnReportingPage() {
             )}
             {isReportConfigurationEnabled && (
                 <Route
-                    path="/configuration/:reportId"
+                    path="/configurations/:reportId"
                     element={
                         (pageAction === 'clone' || pageAction === 'edit') &&
                         hasWriteAccessForReport ? (
@@ -58,7 +58,7 @@ function VulnReportingPage() {
                     }
                 />
             )}
-            <Route path="/view-based" element={<VulnReportingLayout />} />
+            <Route path="/view-based-jobs" element={<VulnReportingLayout />} />
             <Route path="*" element={<PageNotFound />} />
         </Routes>
     );
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ConfigReportsTab.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ConfigReportsTab.tsx
index 03994c92dc9a5..f426756ce8783 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ConfigReportsTab.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ConfigReportsTab.tsx
@@ -24,14 +24,16 @@ import {
 import { ActionsColumn, Table, Tbody, Td, Th, Thead, Tr } from '@patternfly/react-table';
 import { ExclamationCircleIcon, FileIcon, SearchIcon } from '@patternfly/react-icons';
 
-import { vulnerabilityConfigurationReportsPath } from 'routePaths';
+import {
+    vulnerabilityImageConfigurationsReportsDetailsPath,
+    vulnerabilityImageConfigurationsReportsPath,
+} from 'routePaths';
 import useIsRouteEnabled from 'hooks/useIsRouteEnabled';
 import usePermissions from 'hooks/usePermissions';
 import useURLPagination from 'hooks/useURLPagination';
 import useURLSearch from 'hooks/useURLSearch';
 import useURLSort from 'hooks/useURLSort';
 
-import DeleteModal from 'Components/PatternFly/DeleteModal';
 import PageTitle from 'Components/PageTitle';
 import EmptyStateTemplate from 'Components/EmptyStateTemplate/EmptyStateTemplate';
 import CollectionsFormModal from 'Containers/Collections/CollectionsFormModal';
@@ -39,23 +41,26 @@ import useToasts from 'hooks/patternfly/useToasts';
 import type { Toast } from 'hooks/patternfly/useToasts';
 import MenuDropdown from 'Components/PatternFly/MenuDropdown';
 import useTableSelection from 'hooks/useTableSelection';
-import pluralize from 'pluralize';
 import HelpIconTh from 'Components/HelpIconTh';
 import JobStatusPopoverContent from 'Components/ReportJob/JobStatusPopoverContent';
 import MyLastJobStatus from 'Components/ReportJob/MyLastJobStatus';
 import useAuthStatus from 'hooks/useAuthStatus';
-import { reportDownloadURL } from 'services/ReportsService';
-import type { ImageVulnerabilityReportConfiguration } from 'services/ReportsService.types';
+import {
+    deleteReportConfiguration,
+    fetchReportHistory,
+    reportDownloadURL,
+    runReportRequest,
+} from 'services/ReportsService';
+import type {
+    ImageVulnerabilityReportConfiguration,
+    ImageVulnerabilityReportResourceScope,
+} from 'services/ReportsService.types';
 
-import type { ImageVulnerabilityResourceScope } from '../../ImageVulnerabilityReports/imageVulnerabilityReports.types';
+import useDeleteModal from '../hooks/useDeleteModal';
+import DeleteReportsModal from '../../Reports/components/DeleteReportsModal';
 import useFetchReports from '../api/useFetchReports';
 import useRunReport from '../api/useRunReport';
 import { useWatchLastSnapshotForReports } from '../api/useWatchLastSnapshotForReports';
-import useDeleteModal, {
-    isErrorDeleteResult,
-    isSuccessDeleteResult,
-} from '../hooks/useDeleteModal';
-import { vulnerabilityConfigurationReportDetailsPath } from '../pathsForVulnerabilityReporting';
 
 // resourceScope: {} after roll back to previous version that does not support a newer resource scope.
 // Do not let user clone or edit report configuration which might cause worse problems after roll forward.
@@ -65,7 +70,7 @@ function isResourceScopeAbsent({ resourceScope }: ImageVulnerabilityReportConfig
 
 const CreateReportsButton = () => {
     return (
-        <Link to={`${vulnerabilityConfigurationReportsPath}?action=create`}>
+        <Link to={`${vulnerabilityImageConfigurationsReportsPath}?action=create`}>
             <Button variant="primary">Create report</Button>
         </Link>
     );
@@ -115,9 +120,12 @@ function ConfigReportsTab() {
         perPage,
         sortOption,
     });
-    const { reportSnapshots, isLoading: isLoadingReportSnapshots } =
-        useWatchLastSnapshotForReports(reportConfigurations);
+    const { reportSnapshots, isLoading: isLoadingReportSnapshots } = useWatchLastSnapshotForReports(
+        reportConfigurations,
+        fetchReportHistory
+    );
     const { isRunning, runError, runReport } = useRunReport({
+        runReportRequest,
         onCompleted: ({ reportNotificationMethod }) => {
             if (reportNotificationMethod === 'EMAIL') {
                 addToast('The report has been sent to the configured email notifier', 'success');
@@ -151,6 +159,7 @@ function ConfigReportsTab() {
         deleteResults,
         reportIdsToDelete,
     } = useDeleteModal({
+        deleteFunction: deleteReportConfiguration,
         onCompleted: () => {
             onClearAllSelected();
             fetchReports();
@@ -159,7 +168,7 @@ function ConfigReportsTab() {
 
     // Because callback function exists independent of conditional rendering,
     // TypeScript does not know for sure that it is has a collectionScope property.
-    function onClickCollectionLink(resourceScope: ImageVulnerabilityResourceScope) {
+    function onClickCollectionLink(resourceScope: ImageVulnerabilityReportResourceScope) {
         if ('collectionScope' in resourceScope) {
             setCollectionModalId(resourceScope.collectionScope.collectionId);
         }
@@ -170,8 +179,6 @@ function ConfigReportsTab() {
         openDeleteModal(selectedIds);
     }
 
-    const numSuccessfulDeletions = deleteResults?.filter(isSuccessDeleteResult).length || 0;
-
     return (
         <>
             <AlertGroup isToast isLiveRegion>
@@ -385,7 +392,7 @@ function ConfigReportsTab() {
                         )}
                         {reportConfigurations.map((report, rowIndex) => {
                             const vulnReportURL = generatePath(
-                                vulnerabilityConfigurationReportDetailsPath,
+                                vulnerabilityImageConfigurationsReportsDetailsPath,
                                 {
                                     reportId: report.id,
                                 }
@@ -525,54 +532,15 @@ function ConfigReportsTab() {
                     </Table>
                 )}
             </PageSection>
-            <DeleteModal
-                title={`Permanently delete (${reportIdsToDelete.length}) ${pluralize(
-                    'report',
-                    reportIdsToDelete.length
-                )}?`}
+            <DeleteReportsModal
                 isOpen={isDeleteModalOpen}
                 onClose={closeDeleteModal}
                 isDeleting={isDeleting}
                 onDelete={onDelete}
-            >
-                <AlertGroup>
-                    {numSuccessfulDeletions > 0 && (
-                        <Alert
-                            isInline
-                            variant="success"
-                            title={`Successfully deleted ${numSuccessfulDeletions} ${pluralize(
-                                'report',
-                                numSuccessfulDeletions
-                            )}`}
-                            component="p"
-                            className="pf-v6-u-mb-sm"
-                        />
-                    )}
-                    {deleteResults?.filter(isErrorDeleteResult).map((deleteResult) => {
-                        const report = reportConfigurations?.find(
-                            (reportConfig) => reportConfig.id === deleteResult.id
-                        );
-                        if (!report) {
-                            return null;
-                        }
-                        return (
-                            <Alert
-                                isInline
-                                variant="danger"
-                                title={`Failed to delete "${report.name}"`}
-                                component="p"
-                                className="pf-v6-u-mb-sm"
-                            >
-                                {deleteResult.error}
-                            </Alert>
-                        );
-                    })}
-                </AlertGroup>
-                <p>
-                    The selected report(s) and any attached downloadable reports will be permanently
-                    deleted. The action cannot be undone.
-                </p>
-            </DeleteModal>
+                reportIdsToDelete={reportIdsToDelete}
+                deleteResults={deleteResults}
+                reportConfigurations={reportConfigurations}
+            />
             {collectionModalId && (
                 <CollectionsFormModal
                     hasWriteAccessForCollections={false}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportJobDetails.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportJobDetails.tsx
index 9074b60bb3627..d9003406cfd98 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportJobDetails.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportJobDetails.tsx
@@ -9,6 +9,7 @@ import {
 
 import type { ViewBasedReportSnapshot } from 'services/ReportsService.types';
 import CompoundSearchFilterDescriptionListGroups from 'Components/CompoundSearchFilter/components/CompoundSearchFilterDescriptionListGroups';
+import { Origin } from 'Components/CompoundSearchFilter/attributes/imageCVE';
 import { getSearchFilterFromSearchString } from 'utils/searchUtils';
 import {
     attributesSeparateFromConfigForImageVulnerabilityReport,
@@ -33,6 +34,10 @@ function ViewBasedReportJobDetails({ reportSnapshot }: ViewBasedReportJobDetails
     const attributes = [
         ...attributesSeparateFromConfigForImageVulnerabilityReport,
         ...attributesFromConfig,
+        // Origin is not part of the shared workload/view-based config (that config also drives
+        // the overview page filter input, which is out of scope). Append it here so a view-based
+        // report created from the image/deployment single pages displays the CVE origin filter.
+        Origin,
     ];
 
     return (
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTab.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTab.tsx
index df9a7a17ad624..2527790711611 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTab.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTab.tsx
@@ -21,7 +21,7 @@ import useURLStringUnion from 'hooks/useURLStringUnion';
 import { fetchViewBasedReportHistory } from 'services/ReportsService';
 import PageTitle from 'Components/PageTitle';
 import ReportJobStatusFilter, {
-    ensureReportJobStatuses,
+    isReportJobStatus,
 } from 'Components/ReportJob/ReportJobStatusFilter';
 import MyJobsFilter from 'Components/ReportJob/MyJobsFilter';
 import type { ReportJobStatus } from 'Components/ReportJob/types';
@@ -33,7 +33,7 @@ const sortOptions = {
     defaultSortOption: { field: 'Report Completion Time', direction: 'desc' } as const,
 };
 
-function createQueryFromReportJobStatusFilters(jobStatusFilters: string[]) {
+function createQueryFromReportJobStatusFilters(reportJobStatuses: ReportJobStatus[]) {
     const query: Record<string, string[]> = {
         'Report State': [],
     };
@@ -48,8 +48,6 @@ function createQueryFromReportJobStatusFilters(jobStatusFilters: string[]) {
         },
     };
 
-    const reportJobStatuses = ensureReportJobStatuses(jobStatusFilters);
-
     reportJobStatuses.forEach((jobStatus) => {
         const queryMapping = jobStatusQueryMappings[jobStatus];
         if (queryMapping) {
@@ -73,7 +71,7 @@ function ViewBasedReportsTab() {
     ]);
 
     const reportJobStatusFilters = useMemo(() => {
-        return ensureStringArray(searchFilter['Report Job Status']);
+        return ensureStringArray(searchFilter['Report Job Status']).filter(isReportJobStatus);
     }, [searchFilter]);
 
     const fetchViewBasedReportsHistoryCallback = useCallback(() => {
@@ -110,7 +108,7 @@ function ViewBasedReportsTab() {
         );
         setSearchFilter({
             ...searchFilter,
-            'Report Job Status': ensureReportJobStatuses(newFilters),
+            'Report Job Status': newFilters,
         });
         setPage(1);
 
@@ -146,11 +144,11 @@ function ViewBasedReportsTab() {
 
     return (
         <>
-            <PageTitle title="Image vulnerability reports - View-based reports" />
+            <PageTitle title="Image vulnerability reports - View-based jobs" />
             <PageSection>
                 <Content component="p">
-                    Check job status and download view-based reports in CSV format. Requests are
-                    purged according to retention settings.
+                    Check job status and download view-based reports in CSV format. Jobs are purged
+                    according to retention settings.
                 </Content>
             </PageSection>
             <PageSection>
@@ -164,7 +162,7 @@ function ViewBasedReportsTab() {
                                     'DOWNLOAD_GENERATED',
                                     'ERROR',
                                 ]}
-                                selectedStatuses={ensureReportJobStatuses(reportJobStatusFilters)}
+                                selectedStatuses={reportJobStatusFilters}
                                 onChange={onReportJobStatusFilterChange}
                             />
                         </ToolbarItem>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTable.tsx
index 59b635ddc13a7..c4380c371fce6 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/ViewBasedReportsTable.tsx
@@ -93,10 +93,10 @@ function ViewBasedReportsTable<T extends ViewBasedReportSnapshot>({
 
     return (
         <>
-            <Table aria-label="View-based reports table">
+            <Table aria-label="View-based jobs table">
                 <Thead>
                     <Tr>
-                        <Th width={20}>Request name</Th>
+                        <Th width={20}>Job name</Th>
                         <Th>Requester</Th>
                         <Th>Job status</Th>
                         <Th sort={getSortParams('Report Completion Time')}>Completed</Th>
@@ -119,7 +119,7 @@ function ViewBasedReportsTable<T extends ViewBasedReportSnapshot>({
                             return (
                                 <Tbody key={reportJobId}>
                                     <Tr>
-                                        <Td dataLabel="Request name">
+                                        <Td dataLabel="Job name">
                                             <Button
                                                 variant="link"
                                                 isInline
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/VulnReportingLayout.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/VulnReportingLayout.tsx
index ed726dcb21c72..51b40315dc985 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/VulnReportingLayout.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/VulnReports/VulnReportingLayout.tsx
@@ -1,11 +1,21 @@
-import { PageSection, Tab, TabContent, Tabs, Title } from '@patternfly/react-core';
+import {
+    Breadcrumb,
+    BreadcrumbItem,
+    PageSection,
+    Tab,
+    TabContent,
+    Tabs,
+    Title,
+} from '@patternfly/react-core';
 import { useLocation, useNavigate } from 'react-router-dom-v5-compat';
 
+import BreadcrumbItemLink from 'Components/BreadcrumbItemLink';
 import PageTitle from 'Components/PageTitle';
 import usePermissions from 'hooks/usePermissions';
 import {
-    vulnerabilityConfigurationReportsPath,
-    vulnerabilityViewBasedReportsPath,
+    vulnerabilityImageConfigurationsReportsPath,
+    vulnerabilityImageViewBasedJobsPath,
+    vulnerabilityReportsPath,
 } from 'routePaths';
 
 import ConfigReportsTab from './ConfigReportsTab';
@@ -24,15 +34,15 @@ function VulnReportingLayout() {
                   {
                       id: 'report-configuration',
                       title: 'Report configurations',
-                      path: vulnerabilityConfigurationReportsPath,
+                      path: vulnerabilityImageConfigurationsReportsPath,
                       content: <ConfigReportsTab />,
                   },
               ]
             : []),
         {
-            id: 'view-based-reports',
-            title: 'View-based reports',
-            path: vulnerabilityViewBasedReportsPath,
+            id: 'view-based-jobs',
+            title: 'View-based jobs',
+            path: vulnerabilityImageViewBasedJobsPath,
             content: <ViewBasedReportsTab />,
         },
     ];
@@ -47,6 +57,14 @@ function VulnReportingLayout() {
     return (
         <>
             <PageTitle title="Image vulnerability reports" />
+            <PageSection type="breadcrumb">
+                <Breadcrumb>
+                    <BreadcrumbItemLink to={vulnerabilityReportsPath}>
+                        Vulnerability reports
+                    </BreadcrumbItemLink>
+                    <BreadcrumbItem isActive>Image vulnerability reports</BreadcrumbItem>
+                </Breadcrumb>
+            </PageSection>
             <PageSection>
                 <Title headingLevel="h1">Image vulnerability reports</Title>
             </PageSection>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useRunReport.ts b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useRunReport.ts
index ae141823900e7..9c53548a10e66 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useRunReport.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useRunReport.ts
@@ -4,12 +4,16 @@ import useAnalytics, {
     VULNERABILITY_REPORT_DOWNLOAD_GENERATED,
     VULNERABILITY_REPORT_SENT_MANUALLY,
 } from 'hooks/useAnalytics';
-import { runReportRequest } from 'services/ReportsService';
+import type { RunReportResponse } from 'services/ReportsService.types';
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
 import type { ReportNotificationMethod } from 'types/reportJob';
 
 export type UseSaveReportProps = {
     onCompleted: (context: { reportNotificationMethod: ReportNotificationMethod }) => void;
+    runReportRequest: (
+        reportConfigId: string,
+        reportNotificationMethod: ReportNotificationMethod
+    ) => Promise<RunReportResponse>;
 };
 
 type Result = {
@@ -28,7 +32,7 @@ const defaultResult = {
     runError: null,
 };
 
-function useRunReport({ onCompleted }: UseSaveReportProps): SaveReportResult {
+function useRunReport({ onCompleted, runReportRequest }: UseSaveReportProps): SaveReportResult {
     const { analyticsTrack } = useAnalytics();
     const [result, setResult] = useState<Result>(defaultResult);
 
@@ -63,7 +67,7 @@ function useRunReport({ onCompleted }: UseSaveReportProps): SaveReportResult {
                     });
                 });
         },
-        [analyticsTrack, onCompleted]
+        [analyticsTrack, onCompleted, runReportRequest]
     );
 
     return {
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useWatchLastSnapshotForReports.ts b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useWatchLastSnapshotForReports.ts
index 0cb2c988fac2f..adb9dc77dd247 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useWatchLastSnapshotForReports.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/api/useWatchLastSnapshotForReports.ts
@@ -1,29 +1,17 @@
 import { useCallback } from 'react';
 
-import { fetchReportHistory } from 'services/ReportsService';
-import type { ReportConfiguration, ReportSnapshot } from 'services/ReportsService.types';
+import type { FetchReportHistoryServiceParams } from 'services/ReportsService';
+import type { ConfiguredReportSnapshot, ReportSnapshot } from 'services/ReportsService.types';
 import useInterval from 'hooks/useInterval';
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
 import useRestQuery from 'hooks/useRestQuery';
 
-// TODO investigate whether this hook is for generic or specific report type.
+// Only the config id is needed, so accept a minimal shape to support any report type.
+type ReportConfigurationRef = { id: string };
 
-async function fetchLastReportJobForConfiguration(
-    reportConfigurationId: string
-): Promise<ReportSnapshot> {
-    const reportSnapshot = await fetchReportHistory({
-        id: reportConfigurationId,
-        query: '',
-        page: 1,
-        perPage: 1,
-        showMyHistory: true,
-        sortOption: {
-            field: 'Report Completion Time',
-            reversed: true,
-        },
-    });
-    return reportSnapshot[0] ?? null;
-}
+type FetchReportHistory = (
+    params: FetchReportHistoryServiceParams
+) => Promise<ConfiguredReportSnapshot[]>;
 
 type ReportSnapshotLookup = Partial<Record<string, ReportSnapshot | null>>;
 
@@ -38,7 +26,8 @@ export type FetchLastSnapshotReturn = Result & {
 };
 
 export function useWatchLastSnapshotForReports(
-    reportConfigurations: ReportConfiguration | ReportConfiguration[] | null
+    reportConfigurations: ReportConfigurationRef | ReportConfigurationRef[] | null,
+    fetchReportHistory: FetchReportHistory
 ): FetchLastSnapshotReturn {
     const fetchSnapshotsCallback = useCallback(() => {
         if (!reportConfigurations) {
@@ -46,6 +35,19 @@ export function useWatchLastSnapshotForReports(
             return Promise.resolve(result);
         }
 
+        const fetchLastReportJobForConfiguration = (id: string) =>
+            fetchReportHistory({
+                id,
+                query: '',
+                page: 1,
+                perPage: 1,
+                showMyHistory: true,
+                sortOption: {
+                    field: 'Report Completion Time',
+                    reversed: true,
+                },
+            }).then((snapshots) => snapshots[0] ?? null);
+
         const promise: Promise<ReportSnapshotLookup> = new Promise((resolve, reject) => {
             const configurations = Array.isArray(reportConfigurations)
                 ? reportConfigurations
@@ -65,7 +67,7 @@ export function useWatchLastSnapshotForReports(
         });
 
         return promise;
-    }, [reportConfigurations]);
+    }, [reportConfigurations, fetchReportHistory]);
     const { data, isLoading, error, refetch } = useRestQuery(fetchSnapshotsCallback);
 
     useInterval(refetch, 10000);
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/hooks/useDeleteModal.ts b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/hooks/useDeleteModal.ts
index bc6fa97316fa1..251a0de3810dd 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/hooks/useDeleteModal.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/hooks/useDeleteModal.ts
@@ -1,7 +1,6 @@
 import { useState } from 'react';
 
 import useModal from 'hooks/useModal';
-import { deleteReportConfiguration } from 'services/ReportsService';
 import type { Empty } from 'services/types';
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
 
@@ -17,9 +16,10 @@ type ErrorDeleteResult = {
     error: string;
 };
 
-type DeleteResult = SuccessDeleteResult | ErrorDeleteResult;
+export type DeleteResult = SuccessDeleteResult | ErrorDeleteResult;
 
 export type UseDeleteModalProps = {
+    deleteFunction: (id: string) => Promise<Empty>;
     onCompleted: () => void;
 };
 
@@ -43,7 +43,10 @@ export function isErrorDeleteResult(deleteResult: DeleteResult): deleteResult is
     return deleteResult.success === false;
 }
 
-function useDeleteModal({ onCompleted }: UseDeleteModalProps): UseDeleteModalResult {
+function useDeleteModal({
+    deleteFunction,
+    onCompleted,
+}: UseDeleteModalProps): UseDeleteModalResult {
     const { isModalOpen: isDeleteModalOpen, openModal, closeModal } = useModal();
     const [reportIdsToDelete, setReportIdsToDelete] = useState<string[]>([]);
     const [isDeleting, setIsDeleting] = useState(false);
@@ -66,7 +69,7 @@ function useDeleteModal({ onCompleted }: UseDeleteModalProps): UseDeleteModalRes
     // potential errors.
     async function onSafeDelete(id: string): Promise<DeleteResult> {
         try {
-            const result = await deleteReportConfiguration(id);
+            const result = await deleteFunction(id);
             return { success: true, id, result };
         } catch (error) {
             return {
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/pathsForVulnerabilityReporting.ts b/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/pathsForVulnerabilityReporting.ts
deleted file mode 100644
index e8b090d693838..0000000000000
--- a/ui/apps/platform/src/Containers/Vulnerabilities/VulnerablityReporting/pathsForVulnerabilityReporting.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import { vulnerabilityConfigurationReportsPath } from 'routePaths';
-
-export const vulnerabilityConfigurationReportDetailsPath = `${vulnerabilityConfigurationReportsPath}/:reportId`;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPage.tsx
index 85e602d4f41c1..781bc43717a38 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPage.tsx
@@ -20,8 +20,10 @@ import TableErrorComponent from 'Components/PatternFly/TableErrorComponent';
 import useURLStringUnion from 'hooks/useURLStringUnion';
 import useURLPagination from 'hooks/useURLPagination';
 import useURLSearch from 'hooks/useURLSearch';
+import { runImageViewBasedReport } from 'services/ReportsService';
 import type { VulnerabilityState } from 'types/cve.proto';
 import { wrapInQuotes } from 'utils/searchUtils';
+import { vulnerabilityImageViewBasedJobsPath } from 'routePaths';
 
 import DeploymentPageHeader, { deploymentMetadataFragment } from './DeploymentPageHeader';
 import type { DeploymentMetadata } from './DeploymentPageHeader';
@@ -31,10 +33,10 @@ import { getRegexScopedQueryString, parseQuerySearchFilter } from '../../utils/s
 import DeploymentPageResources from './DeploymentPageResources';
 import DeploymentPageVulnerabilities from './DeploymentPageVulnerabilities';
 import DeploymentPageDetails from './DeploymentPageDetails';
-import { createScheduledReportForImageVulnerabilitiesURL } from '../../ImageVulnerabilityReports/imageVulnerabilityReports.utils';
+import { createScheduledReportForImageVulnerabilitiesURL } from '../../Reports/ImageVulnerabilityReports/imageVulnerabilityReports.utils';
 import useWorkloadCveViewContext from '../hooks/useWorkloadCveViewContext';
 import CreateReportDropdown from '../components/CreateReportDropdown';
-import CreateViewBasedReportModal from '../components/CreateViewBasedReportModal';
+import CreateViewBasedReportModal from '../../components/CreateViewBasedReportModal';
 
 const deploymentMetadataQuery = gql`
     ${deploymentMetadataFragment}
@@ -194,6 +196,8 @@ function DeploymentPage({ showVulnerabilityStateTabs, vulnerabilityState }: Depl
                     setIsOpen={setIsCreateViewBasedReportModalOpen}
                     query={getRegexScopedQueryString(deploymentScopedSearchFilterForReport)}
                     areaOfConcern={viewContext}
+                    runViewBasedReport={runImageViewBasedReport}
+                    vulnerabilityViewBasedJobsPath={vulnerabilityImageViewBasedJobsPath}
                 />
             )}
         </>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPageVulnerabilities.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPageVulnerabilities.tsx
index d614fc6259805..a3e15ee2e8be6 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPageVulnerabilities.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPageVulnerabilities.tsx
@@ -40,6 +40,7 @@ import {
     getVulnStateScopedQueryString,
     parseQuerySearchFilter,
 } from '../../utils/searchUtils';
+import { Origin } from 'Components/CompoundSearchFilter/attributes/imageCVE';
 import {
     imageCVESearchFilterConfig,
     imageComponentSearchFilterConfig,
@@ -182,9 +183,11 @@ function DeploymentPageVulnerabilities({
     const managedColumnState = useManagedColumns(tableId, defaultColumns);
 
     const isEpssProbabilityColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
+    const isOriginColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
 
     const columnConfig = overrideManagedColumns(managedColumnState.columns, {
         epssProbability: hideColumnIf(!isEpssProbabilityColumnEnabled),
+        origin: hideColumnIf(!isOriginColumnEnabled),
     });
 
     // Keep searchFilterConfigWithFeatureFlagDependency for ROX_SCANNER_V4 also Advisory.
@@ -193,10 +196,13 @@ function DeploymentPageVulnerabilities({
         // imageCVESearchFilterConfig,
         {
             ...imageCVESearchFilterConfig,
-            attributes: imageCVESearchFilterConfig.attributes.filter(
-                ({ searchTerm }) =>
-                    searchTerm !== 'EPSS Probability' || isEpssProbabilityColumnEnabled
-            ),
+            attributes: [
+                ...imageCVESearchFilterConfig.attributes.filter(
+                    ({ searchTerm }) =>
+                        searchTerm !== 'EPSS Probability' || isEpssProbabilityColumnEnabled
+                ),
+                Origin, // CVE origin filter is scoped to the single deployment page
+            ],
         },
         imageSearchFilterConfig,
         imageComponentSearchFilterConfig,
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/DeploymentResourceTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/DeploymentResourceTable.tsx
index 1be1393ee613c..ae50ae8db38e4 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/DeploymentResourceTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/DeploymentResourceTable.tsx
@@ -44,24 +44,6 @@ export type DeploymentResources = {
     }[];
 };
 
-export const deploymentResourcesFragment = gql`
-    fragment DeploymentResources on Image {
-        deploymentCount(query: $query)
-        deployments(query: $query, pagination: $pagination) {
-            id
-            name
-            type
-            clusterName
-            namespace
-            created
-        }
-    }
-`;
-
-/**
- * Same fields as DeploymentResources but on ImageV2; when ROX_FLATTEN_IMAGE_DATA is enabled,
- * we call ImageV2 resolver which returns ImageV2 type.
- */
 export const deploymentResourcesV2Fragment = gql`
     fragment DeploymentResourcesV2 on ImageV2 {
         deploymentCount(query: $query)
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePage.tsx
index 226d26f49b32b..738d703b69800 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePage.tsx
@@ -27,7 +27,6 @@ import PageTitle from 'Components/PageTitle';
 import useURLStringUnion from 'hooks/useURLStringUnion';
 import EmptyStateTemplate from 'Components/EmptyStateTemplate';
 import { getAxiosErrorMessage } from 'utils/responseErrorUtils';
-import useFeatureFlags from 'hooks/useFeatureFlags';
 import useIsScannerV4Enabled from 'hooks/useIsScannerV4Enabled';
 import usePermissions from 'hooks/usePermissions';
 import useURLPagination from 'hooks/useURLPagination';
@@ -35,20 +34,18 @@ import useURLSearch from 'hooks/useURLSearch';
 import type { ColumnConfigOverrides } from 'hooks/useManagedColumns';
 import type { GenerateSbomImageParams } from 'services/ImageSbomService';
 import type { VulnerabilityState } from 'types/cve.proto';
+import { runImageViewBasedReport } from 'services/ReportsService';
+import { vulnerabilityImageViewBasedJobsPath } from 'routePaths';
 
 import HeaderLoadingSkeleton from '../../components/HeaderLoadingSkeleton';
-import GenerateSbomModal, {
-    getSbomGenerationStatusMessage,
-} from '../../components/GenerateSbomModal';
+import GenerateSbomModal from '../../components/GenerateSbomModal';
+import { getSbomGenerationStatusMessage } from '../../utils/getSbomGenerationStatusMessage';
 import useInvalidateVulnerabilityQueries from '../../hooks/useInvalidateVulnerabilityQueries';
 import ImagePageVulnerabilities from './ImagePageVulnerabilities';
 import ImagePageResources from './ImagePageResources';
 import ImagePageSignatureVerification from './ImagePageSignatureVerification';
 import { detailsTabValues } from '../../types';
-import ImageDetailBadges, {
-    imageDetailsFragment,
-    imageV2DetailsFragment,
-} from '../components/ImageDetailBadges';
+import ImageDetailBadges, { imageV2DetailsFragment } from '../components/ImageDetailBadges';
 import type { ImageDetails } from '../components/ImageDetailBadges';
 import getImageScanMessage from '../utils/getImageScanMessage';
 import { DEFAULT_VM_PAGE_SIZE } from '../../constants';
@@ -56,25 +53,9 @@ import { getImageBaseNameDisplay } from '../utils/images';
 import { getRegexScopedQueryString, parseQuerySearchFilter } from '../../utils/searchUtils';
 import useWorkloadCveViewContext from '../hooks/useWorkloadCveViewContext';
 import type { defaultColumns as deploymentResourcesDefaultColumns } from './DeploymentResourceTable';
-import { createScheduledReportForImageVulnerabilitiesURL } from '../../ImageVulnerabilityReports/imageVulnerabilityReports.utils';
+import { createScheduledReportForImageVulnerabilitiesURL } from '../../Reports/ImageVulnerabilityReports/imageVulnerabilityReports.utils';
 import CreateReportDropdown from '../components/CreateReportDropdown';
-import CreateViewBasedReportModal from '../components/CreateViewBasedReportModal';
-
-const imageDetailsQuery = gql`
-    ${imageDetailsFragment}
-    query getImageDetails($id: ID!) {
-        image(id: $id) {
-            id
-            name {
-                registry
-                remote
-                tag
-                fullName
-            }
-            ...ImageDetails
-        }
-    }
-`;
+import CreateViewBasedReportModal from '../../components/CreateViewBasedReportModal';
 
 const imageV2DetailsQuery = gql`
     ${imageV2DetailsFragment}
@@ -129,23 +110,13 @@ function ImagePage({
     deploymentResourceColumnOverrides,
 }: ImagePageProps) {
     const navigate = useNavigate();
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isNewImageDataModelEnabled = isFeatureFlagEnabled('ROX_FLATTEN_IMAGE_DATA');
     const { urlBuilder, pageTitle, baseSearchFilter, viewContext } = useWorkloadCveViewContext();
     const { imageId } = useParams() as { imageId: string };
 
-    const v1Query = useQuery<{ image: ImageData }, { id: string }>(imageDetailsQuery, {
+    const { data, error } = useQuery<{ image: ImageData }, { id: string }>(imageV2DetailsQuery, {
         variables: { id: imageId },
-        skip: isNewImageDataModelEnabled,
     });
 
-    const v2Query = useQuery<{ image: ImageData }, { id: string }>(imageV2DetailsQuery, {
-        variables: { id: imageId },
-        skip: !isNewImageDataModelEnabled,
-    });
-
-    const data = isNewImageDataModelEnabled ? v2Query.data : v1Query.data;
-    const error = isNewImageDataModelEnabled ? v2Query.error : v1Query.error;
     const [activeTabKey, setActiveTabKey] = useURLStringUnion('detailsTab', detailsTabValues);
     const { invalidateAll: refetchAll } = useInvalidateVulnerabilityQueries();
 
@@ -171,7 +142,7 @@ function ImagePage({
     // Create a scoped search filter that includes the image SHA filter plus any applied search filters.
     const imageScopedSearchFilterForReport = {
         ...baseSearchFilter,
-        ...(isNewImageDataModelEnabled ? { 'Image ID': [imageId] } : { 'Image SHA': [imageId] }),
+        'Image ID': [imageId],
         ...querySearchFilter,
         'Vulnerability State': [vulnerabilityState],
     };
@@ -182,8 +153,16 @@ function ImagePage({
         imageData && imageName
             ? `${imageName.registry}/${getImageBaseNameDisplay(imageData.id, imageName)}`
             : 'NAME UNKNOWN';
-    const scanMessage = getImageScanMessage(imageData?.notes ?? [], imageData?.scanNotes ?? []);
+    const imageNotes = imageData?.notes ?? [];
+    const scanNotes = imageData?.scanNotes ?? [];
+    const scanMessage = getImageScanMessage(imageNotes, scanNotes);
     const hasScanMessage = !isEmpty(scanMessage);
+    // SBOM generation is only blocked when the image has no scan data at all;
+    // CVE-accuracy caveats (e.g. no base OS) must not disable it (ROX-36762).
+    const sbomGenerationStatusMessage = getSbomGenerationStatusMessage({
+        isScannerV4Enabled,
+        imageNotes,
+    });
 
     const workloadCveOverviewImagePath = urlBuilder.imageList('OBSERVED');
 
@@ -233,10 +212,7 @@ function ImagePage({
                                 {hasWriteAccessForImage && (
                                     <FlexItem alignSelf={{ default: 'alignSelfCenter' }}>
                                         <OptionalSbomButtonTooltip
-                                            message={getSbomGenerationStatusMessage({
-                                                isScannerV4Enabled,
-                                                hasScanMessage,
-                                            })}
+                                            message={sbomGenerationStatusMessage}
                                         >
                                             <Button
                                                 variant="secondary"
@@ -247,8 +223,7 @@ function ImagePage({
                                                     });
                                                 }}
                                                 isAriaDisabled={
-                                                    !isScannerV4Enabled ||
-                                                    hasScanMessage ||
+                                                    sbomGenerationStatusMessage !== undefined ||
                                                     !imageData.name?.fullName
                                                 }
                                             >
@@ -386,6 +361,8 @@ function ImagePage({
                     setIsOpen={setIsCreateViewBasedReportModalOpen}
                     query={getRegexScopedQueryString(imageScopedSearchFilterForReport)}
                     areaOfConcern={viewContext}
+                    runViewBasedReport={runImageViewBasedReport}
+                    vulnerabilityViewBasedJobsPath={vulnerabilityImageViewBasedJobsPath}
                 />
             )}
         </>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageResources.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageResources.tsx
index 2c095f2d98ab8..ae358efb31c63 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageResources.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageResources.tsx
@@ -8,7 +8,6 @@ import {
     Spinner,
 } from '@patternfly/react-core';
 import { gql, useQuery } from '@apollo/client';
-import type { DocumentNode } from '@apollo/client';
 import type { Pagination as PaginationParam } from 'services/types';
 
 import TableErrorComponent from 'Components/PatternFly/TableErrorComponent';
@@ -17,11 +16,9 @@ import type { ColumnConfigOverrides } from 'hooks/useManagedColumns';
 import type { UseURLPaginationResult } from 'hooks/useURLPagination';
 import useURLSort from 'hooks/useURLSort';
 import useSelectToggle from 'hooks/patternfly/useSelectToggle';
-import useFeatureFlags from 'hooks/useFeatureFlags';
 
 import { getPaginationParams, getRequestQueryStringForSearchFilter } from 'utils/searchUtils';
 import DeploymentResourceTable, {
-    deploymentResourcesFragment,
     deploymentResourcesV2Fragment,
     deploymentResourcesTableId,
     defaultColumns as deploymentResourcesDefaultColumns,
@@ -37,16 +34,6 @@ export type ImagePageResourcesProps = {
     >;
 };
 
-const imageResourcesQuery = gql`
-    ${deploymentResourcesFragment}
-    query getImageResources($id: ID!, $query: String, $pagination: Pagination) {
-        image(id: $id) {
-            id
-            ...DeploymentResources
-        }
-    }
-`;
-
 const imageV2ResourcesQuery = gql`
     ${deploymentResourcesV2Fragment}
     query getImageResources($id: ID!, $query: String, $pagination: Pagination) {
@@ -58,16 +45,11 @@ const imageV2ResourcesQuery = gql`
     }
 `;
 
-export const getImageResourcesQuery = (isNewImageDataModelEnabled: boolean): DocumentNode =>
-    isNewImageDataModelEnabled ? imageV2ResourcesQuery : imageResourcesQuery;
-
 function ImagePageResources({
     imageId,
     pagination,
     deploymentResourceColumnOverrides,
 }: ImagePageResourcesProps) {
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isNewImageDataModelEnabled = isFeatureFlagEnabled('ROX_FLATTEN_IMAGE_DATA');
     const { baseSearchFilter } = useWorkloadCveViewContext();
     const { page, perPage, setPage, setPerPage } = pagination;
     const { sortOption, getSortParams } = useURLSort({
@@ -80,11 +62,10 @@ function ImagePageResources({
 
     const { data, previousData, loading, error } = useQuery<
         {
-            image: DeploymentResources | null; // Legacy image data model, will be null when ROX_FLATTEN_IMAGE_DATA is enabled
-            imageV2: DeploymentResources | null; // New image data model, will be null when ROX_FLATTEN_IMAGE_DATA is disabled
+            imageV2: DeploymentResources | null;
         },
         { id: string; query: string; pagination: PaginationParam }
-    >(getImageResourcesQuery(isNewImageDataModelEnabled), {
+    >(imageV2ResourcesQuery, {
         variables: {
             id: imageId,
             query: getRequestQueryStringForSearchFilter(baseSearchFilter),
@@ -92,9 +73,7 @@ function ImagePageResources({
         },
     });
 
-    const imageResourcesData =
-        (data && (isNewImageDataModelEnabled ? data.imageV2 : data.image)) ??
-        (previousData && (isNewImageDataModelEnabled ? previousData.imageV2 : previousData.image));
+    const imageResourcesData = data?.imageV2 ?? previousData?.imageV2;
     const deploymentCount = imageResourcesData?.deploymentCount ?? 0;
 
     const deploymentResourceColumnState = useManagedColumns(
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageVulnerabilities.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageVulnerabilities.tsx
index 97a8c6ca68244..6fbed26d3c086 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageVulnerabilities.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageVulnerabilities.tsx
@@ -12,7 +12,6 @@ import {
     pluralize,
 } from '@patternfly/react-core';
 import { gql, useQuery } from '@apollo/client';
-import type { DocumentNode } from '@apollo/client';
 import type { SearchFilter } from 'types/search';
 import type { UseURLPaginationResult } from 'hooks/useURLPagination';
 import useURLSort from 'hooks/useURLSort';
@@ -51,10 +50,7 @@ import {
     parseQuerySearchFilter,
 } from '../../utils/searchUtils';
 import BySeveritySummaryCard from '../../components/BySeveritySummaryCard';
-import {
-    imageMetadataContextFragment,
-    imageV2MetadataContextFragment,
-} from '../Tables/table.utils';
+import { imageV2MetadataContextFragment } from '../Tables/table.utils';
 import type { ImageMetadataContext } from '../Tables/table.utils';
 import VulnerabilityStateTabs, {
     vulnStateTabContentId,
@@ -64,6 +60,7 @@ import type { ExceptionRequestModalProps } from '../../components/ExceptionReque
 import CompletedExceptionRequestModal from '../../components/ExceptionRequestModal/CompletedExceptionRequestModal';
 import useExceptionRequestModal from '../../hooks/useExceptionRequestModal';
 import useWorkloadCveViewContext from '../hooks/useWorkloadCveViewContext';
+import { Origin } from 'Components/CompoundSearchFilter/attributes/imageCVE';
 import {
     imageCVESearchFilterConfig,
     imageComponentSearchFilterConfig,
@@ -71,29 +68,6 @@ import {
 import BaseImageAssessmentCard from '../components/BaseImageAssessmentCard';
 import type { BaseImage } from '../components/ImageDetailBadges';
 
-export const imageVulnerabilitiesQuery = gql`
-    ${imageMetadataContextFragment}
-    ${resourceCountByCveSeverityAndStatusFragment}
-    ${imageVulnerabilitiesFragment}
-    query getCVEsForImage(
-        $id: ID!
-        $query: String!
-        $pagination: Pagination!
-        $statusesForExceptionCount: [String!]
-    ) {
-        image(id: $id) {
-            ...ImageMetadataContext
-            imageVulnerabilityCount(query: $query)
-            imageCVECountBySeverity(query: $query) {
-                ...ResourceCountsByCVESeverityAndStatus
-            }
-            imageVulnerabilities(query: $query, pagination: $pagination) {
-                ...ImageVulnerabilityFields
-            }
-        }
-    }
-`;
-
 export const imageV2VulnerabilitiesQuery = gql`
     ${imageV2MetadataContextFragment}
     ${resourceCountByCveSeverityAndStatusFragment}
@@ -117,9 +91,6 @@ export const imageV2VulnerabilitiesQuery = gql`
     }
 `;
 
-export const getImageVulnerabilitiesQuery = (isNewImageDataModelEnabled: boolean): DocumentNode =>
-    isNewImageDataModelEnabled ? imageV2VulnerabilitiesQuery : imageVulnerabilitiesQuery;
-
 const defaultSortFields = ['CVE', 'CVSS', 'Severity'];
 
 export type ImagePageVulnerabilitiesProps = {
@@ -152,8 +123,6 @@ function ImagePageVulnerabilities({
     setSearchFilter,
 }: ImagePageVulnerabilitiesProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isBaseImageDetectionEnabled = isFeatureFlagEnabled('ROX_BASE_IMAGE_DETECTION');
-    const isNewImageDataModelEnabled = isFeatureFlagEnabled('ROX_FLATTEN_IMAGE_DATA');
 
     const { analyticsTrack } = useAnalytics();
     const trackAppliedFilter = createFilterTracker(analyticsTrack);
@@ -176,20 +145,11 @@ function ImagePageVulnerabilities({
     // TODO Split metadata, counts, and vulnerabilities into separate queries
     const { data, loading, error } = useQuery<
         {
-            image:
-                | (ImageMetadataContext & {
-                      imageCVECountBySeverity: ResourceCountByCveSeverityAndStatus;
-                      imageVulnerabilityCount: number;
-                      imageVulnerabilities: ImageVulnerability[];
-                  })
-                | null; // Legacy image data model, will be null when ROX_FLATTEN_IMAGE_DATA is enabled
-            imageV2:
-                | (ImageMetadataContext & {
-                      imageCVECountBySeverity: ResourceCountByCveSeverityAndStatus;
-                      imageVulnerabilityCount: number;
-                      imageVulnerabilities: ImageVulnerability[];
-                  })
-                | null; // New image data model, will be null when ROX_FLATTEN_IMAGE_DATA is disabled
+            imageV2: ImageMetadataContext & {
+                imageCVECountBySeverity: ResourceCountByCveSeverityAndStatus;
+                imageVulnerabilityCount: number;
+                imageVulnerabilities: ImageVulnerability[];
+            };
         },
         {
             id: string;
@@ -197,7 +157,7 @@ function ImagePageVulnerabilities({
             pagination: PaginationParam;
             statusesForExceptionCount: string[];
         }
-    >(getImageVulnerabilitiesQuery(isNewImageDataModelEnabled), {
+    >(imageV2VulnerabilitiesQuery, {
         variables: {
             id: imageId,
             query: getVulnStateScopedQueryString(
@@ -209,9 +169,6 @@ function ImagePageVulnerabilities({
         },
     });
 
-    const imageData =
-        (data && (isNewImageDataModelEnabled ? data.imageV2 : data.image)) || undefined;
-
     const isFiltered = getHasSearchApplied(querySearchFilter);
 
     const selectedCves = useMap<string, ExceptionRequestModalProps['cves'][number]>();
@@ -230,13 +187,14 @@ function ImagePageVulnerabilities({
 
     const tableState = getTableUIState({
         isLoading: loading,
-        data: imageData?.imageVulnerabilities,
+        data: data?.imageV2.imageVulnerabilities,
         error,
         searchFilter,
     });
 
     const isNvdCvssColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
     const isEpssProbabilityColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
+    const isOriginColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
 
     const managedColumnState = useManagedColumns(tableId, defaultColumns);
 
@@ -244,6 +202,7 @@ function ImagePageVulnerabilities({
         cveSelection: hideColumnIf(!canSelectRows),
         nvdCvss: hideColumnIf(!isNvdCvssColumnEnabled),
         epssProbability: hideColumnIf(!isEpssProbabilityColumnEnabled),
+        origin: hideColumnIf(!isOriginColumnEnabled),
         requestDetails: hideColumnIf(vulnerabilityState === 'OBSERVED'),
         rowActions: hideColumnIf(createTableActions === undefined),
     });
@@ -254,10 +213,13 @@ function ImagePageVulnerabilities({
         // imageCVESearchFilterConfig,
         {
             ...imageCVESearchFilterConfig,
-            attributes: imageCVESearchFilterConfig.attributes.filter(
-                ({ searchTerm }) =>
-                    searchTerm !== 'EPSS Probability' || isEpssProbabilityColumnEnabled
-            ),
+            attributes: [
+                ...imageCVESearchFilterConfig.attributes.filter(
+                    ({ searchTerm }) =>
+                        searchTerm !== 'EPSS Probability' || isEpssProbabilityColumnEnabled
+                ),
+                Origin, // CVE origin filter is scoped to the single image page
+            ],
         },
         imageComponentSearchFilterConfig,
     ];
@@ -269,7 +231,7 @@ function ImagePageVulnerabilities({
 
     const hiddenSeverities = getHiddenSeverities(querySearchFilter);
     const hiddenStatuses = getHiddenStatuses(querySearchFilter);
-    const totalVulnerabilityCount = imageData?.imageVulnerabilityCount ?? 0;
+    const totalVulnerabilityCount = data?.imageV2?.imageVulnerabilityCount ?? 0;
 
     return (
         <>
@@ -298,7 +260,7 @@ function ImagePageVulnerabilities({
                 </Content>
             </PageSection>
             <Divider component="div" />
-            {isBaseImageDetectionEnabled && baseImage && (
+            {baseImage && (
                 <PageSection component="div">
                     <BaseImageAssessmentCard baseImage={baseImage} />
                 </PageSection>
@@ -325,9 +287,7 @@ function ImagePageVulnerabilities({
                         trackAppliedFilter(WORKLOAD_CVE_FILTER_APPLIED, searchPayload);
                     }}
                     additionalContextFilter={{
-                        ...(isNewImageDataModelEnabled
-                            ? { 'Image ID': imageId }
-                            : { 'Image SHA': imageId }),
+                        'Image ID': imageId,
                         ...baseSearchFilter,
                     }}
                 >
@@ -335,7 +295,7 @@ function ImagePageVulnerabilities({
                 </AdvancedFiltersToolbar>
                 <SummaryCardLayout error={error} isLoading={loading}>
                     <SummaryCard
-                        data={imageData}
+                        data={data?.imageV2}
                         loadingText="Loading image vulnerability summary"
                         renderer={({ data }) => (
                             <BySeveritySummaryCard
@@ -346,7 +306,7 @@ function ImagePageVulnerabilities({
                         )}
                     />
                     <SummaryCard
-                        data={imageData}
+                        data={data?.imageV2}
                         loadingText="Loading image vulnerability summary"
                         renderer={({ data }) => (
                             <CvesByStatusSummaryCard
@@ -424,7 +384,7 @@ function ImagePageVulnerabilities({
                     aria-busy={loading ? 'true' : 'false'}
                 >
                     <ImageVulnerabilitiesTable
-                        imageMetadata={imageData}
+                        imageMetadata={data?.imageV2}
                         tableState={tableState}
                         getSortParams={getSortParams}
                         isFiltered={isFiltered}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/ImageCve/ImageCvePage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/ImageCve/ImageCvePage.tsx
index 7e68292e107c9..789d6945d7e6a 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/ImageCve/ImageCvePage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/ImageCve/ImageCvePage.tsx
@@ -87,6 +87,9 @@ export const imageCveMetadataQuery = gql`
                     epss {
                         epssProbability
                     }
+                    exploit {
+                        knownRansomwareCampaignUse
+                    }
                 }
             }
         }
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/WorkloadCvesOverviewPage.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/WorkloadCvesOverviewPage.tsx
index de581e93a88dd..fa974e37a488d 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/WorkloadCvesOverviewPage.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/WorkloadCvesOverviewPage.tsx
@@ -34,7 +34,9 @@ import type { SearchFilter } from 'types/search';
 import { useIsFirstRender } from 'hooks/useIsFirstRender';
 import { hideColumnIf } from 'hooks/useManagedColumns';
 import useURLSort from 'hooks/useURLSort';
+import { runImageViewBasedReport } from 'services/ReportsService';
 import type { VulnerabilityState } from 'types/cve.proto';
+import { vulnerabilityImageViewBasedJobsPath } from 'routePaths';
 
 import { searchFilterConfigForWorkloadVulnerabilityResultsAndViewBasedReport } from '../../searchFilterConfig';
 import { isVulnMgmtLocalStorage, workloadEntityTabValues } from '../../types';
@@ -63,9 +65,9 @@ import useVulnerabilityState from '../hooks/useVulnerabilityState';
 import useWorkloadCveViewContext from '../hooks/useWorkloadCveViewContext';
 import DefaultFilterModal from '../components/DefaultFilterModal';
 import CreateReportDropdown from '../components/CreateReportDropdown';
-import CreateViewBasedReportModal from '../components/CreateViewBasedReportModal';
+import CreateViewBasedReportModal from '../../components/CreateViewBasedReportModal';
 import { imageListQuery } from '../Tables/ImageOverviewTable';
-import { createScheduledReportForImageVulnerabilitiesURL } from '../../ImageVulnerabilityReports/imageVulnerabilityReports.utils';
+import { createScheduledReportForImageVulnerabilitiesURL } from '../../Reports/ImageVulnerabilityReports/imageVulnerabilityReports.utils';
 import useHasRequestExceptionsAbility from '../../hooks/useHasRequestExceptionsAbility';
 import VulnerabilitiesOverview from './VulnerabilitiesOverview';
 
@@ -483,6 +485,8 @@ function WorkloadCvesOverviewPage() {
                         setIsOpen={setIsCreateViewBasedReportModalOpen}
                         query={workloadCvesScopedQueryString}
                         areaOfConcern={viewContext}
+                        runViewBasedReport={runImageViewBasedReport}
+                        vulnerabilityViewBasedJobsPath={vulnerabilityImageViewBasedJobsPath}
                     />
                 )}
             </PageSection>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/useImages.ts b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/useImages.ts
index 076233df8de86..8a7d37ccb1b5c 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/useImages.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Overview/useImages.ts
@@ -4,8 +4,7 @@ import type { QueryHookOptions } from '@apollo/client';
 import { getPaginationParams } from 'utils/searchUtils';
 import type { ApiSortOption } from 'types/search';
 import type useURLPagination from 'hooks/useURLPagination';
-import useFeatureFlags from 'hooks/useFeatureFlags';
-import { imageListQuery, imageV2ListQuery } from '../Tables/ImageOverviewTable';
+import { imageV2ListQuery } from '../Tables/ImageOverviewTable';
 import type { Image } from '../Tables/ImageOverviewTable';
 
 export function useImages({
@@ -19,12 +18,10 @@ export function useImages({
     sortOption: ApiSortOption | undefined;
     options?: Omit<QueryHookOptions<{ images: Image[] }>, 'variables'>;
 }) {
-    const { isFeatureFlagEnabled } = useFeatureFlags();
-    const isNewImageDataModelEnabled = isFeatureFlagEnabled('ROX_FLATTEN_IMAGE_DATA');
     const { page, perPage } = pagination;
     return useQuery<{
         images: Image[];
-    }>(isNewImageDataModelEnabled ? imageV2ListQuery : imageListQuery, {
+    }>(imageV2ListQuery, {
         variables: {
             query,
             pagination: getPaginationParams({ page, perPage, sortOption }),
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/AffectedImagesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/AffectedImagesTable.tsx
index bcae00f4b83f7..b3a5d2476e8e7 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/AffectedImagesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/AffectedImagesTable.tsx
@@ -47,7 +47,7 @@ export const defaultColumns = {
         isUntoggleAble: true,
     },
     cveSeverity: {
-        title: 'CVE severity',
+        title: 'Top CVE severity',
         isShownByDefault: true,
     },
     cveStatus: {
@@ -55,7 +55,7 @@ export const defaultColumns = {
         isShownByDefault: true,
     },
     cvss: {
-        title: 'CVSS',
+        title: 'Top CVSS',
         isShownByDefault: true,
     },
     nvdCvss: {
@@ -165,13 +165,13 @@ function AffectedImagesTable({
                         className={getVisibilityClass('cveSeverity')}
                         sort={getSortParams('Severity')}
                     >
-                        CVE severity
+                        Top CVE severity
                     </Th>
                     <Th className={getVisibilityClass('cveStatus')}>
                         CVE status
                         {isFiltered && <DynamicColumnIcon />}
                     </Th>
-                    <Th className={getVisibilityClass('cvss')}>CVSS</Th>
+                    <Th className={getVisibilityClass('cvss')}>Top CVSS</Th>
                     <Th className={getVisibilityClass('nvdCvss')}>NVD CVSS</Th>
                     <Th
                         className={getVisibilityClass('operatingSystem')}
@@ -248,7 +248,7 @@ function AffectedImagesTable({
                                     </Td>
                                     <Td
                                         className={getVisibilityClass('cveSeverity')}
-                                        dataLabel="CVE severity"
+                                        dataLabel="Top CVE severity"
                                         modifier="nowrap"
                                     >
                                         <VulnerabilitySeverityIconText severity={topSeverity} />
@@ -264,7 +264,7 @@ function AffectedImagesTable({
                                     </Td>
                                     <Td
                                         className={getVisibilityClass('cvss')}
-                                        dataLabel="CVSS"
+                                        dataLabel="Top CVSS"
                                         modifier="nowrap"
                                     >
                                         <CvssFormatted cvss={cvss} scoreVersion={scoreVersion} />
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentComponentVulnerabilitiesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentComponentVulnerabilitiesTable.tsx
index 9453b2bd55852..4cd5efd00a24e 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentComponentVulnerabilitiesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentComponentVulnerabilitiesTable.tsx
@@ -10,6 +10,7 @@ import type { VulnerabilityState } from 'types/cve.proto';
 import CvssFormatted from 'Components/CvssFormatted';
 
 import AdvisoryLinkOrText from '../../components/AdvisoryLinkOrText';
+import { getOriginDisplayName } from '../../utils/vulnerabilityUtils';
 import PendingExceptionLabel from '../../components/PendingExceptionLabel';
 import ImageNameLink from '../components/ImageNameLink';
 import {
@@ -37,6 +38,7 @@ export const deploymentComponentVulnerabilitiesFragment = gql`
             cvss
             scoreVersion
             fixedByVersion
+            origin
             advisory {
                 name
                 link
@@ -68,8 +70,10 @@ function DeploymentComponentVulnerabilitiesTable({
 }: DeploymentComponentVulnerabilitiesTableProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
     const isAdvisoryColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
+    const isOriginColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
 
-    const colSpanForDockerfileLayer = 8 + (isAdvisoryColumnEnabled ? 1 : 0);
+    const colSpanForDockerfileLayer =
+        8 + (isAdvisoryColumnEnabled ? 1 : 0) + (isOriginColumnEnabled ? 1 : 0);
 
     const { sortOption, getSortParams } = useTableSort({ sortFields, defaultSortOption });
     const componentVulns = images.flatMap(({ imageMetadataContext, componentVulnerabilities }) =>
@@ -89,6 +93,7 @@ function DeploymentComponentVulnerabilitiesTable({
                     <Th>CVE fixed in</Th>
                     {isAdvisoryColumnEnabled && <Th>Advisory</Th>}
                     <Th>Source</Th>
+                    {isOriginColumnEnabled && <Th>CVE origin</Th>}
                     <Th>Location</Th>
                 </Tr>
             </Thead>
@@ -101,6 +106,7 @@ function DeploymentComponentVulnerabilitiesTable({
                     cvss,
                     scoreVersion,
                     fixedByVersion,
+                    origin,
                     advisory,
                     location,
                     source,
@@ -161,6 +167,9 @@ function DeploymentComponentVulnerabilitiesTable({
                                 </Td>
                             )}
                             <Td dataLabel="Source">{source}</Td>
+                            {isOriginColumnEnabled && (
+                                <Td dataLabel="CVE origin">{getOriginDisplayName(origin)}</Td>
+                            )}
                             <Td dataLabel="Location">
                                 <ComponentLocation location={location} source={source} />
                             </Td>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentVulnerabilitiesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentVulnerabilitiesTable.tsx
index dd3910522cb85..f1a03409d619b 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentVulnerabilitiesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentVulnerabilitiesTable.tsx
@@ -5,6 +5,7 @@ import { ExpandableRowContent, Table, Tbody, Td, Th, Thead, Tr } from '@patternf
 import { gql } from '@apollo/client';
 
 import useFeatureFlags from 'hooks/useFeatureFlags';
+import useMetadata from 'hooks/useMetadata';
 import useSet from 'hooks/useSet';
 import type { UseURLSortResult } from 'hooks/useURLSort';
 import VulnerabilitySeverityIconText from 'Components/PatternFly/IconText/VulnerabilitySeverityIconText';
@@ -27,7 +28,7 @@ import DeploymentComponentVulnerabilitiesTable, {
 } from './DeploymentComponentVulnerabilitiesTable';
 import PartialCVEDataAlert from '../../components/PartialCVEDataAlert';
 import useWorkloadCveViewContext from '../hooks/useWorkloadCveViewContext';
-import { infoForEpssProbability } from './infoForTh';
+import { getInfoForCveOrigin, infoForEpssProbability } from './infoForTh';
 import { formatEpssProbabilityAsPercent } from './table.utils';
 import type { FormattedDeploymentVulnerability } from './table.utils';
 
@@ -48,7 +49,7 @@ export const defaultColumns = {
         isShownByDefault: true,
     },
     cveSeverity: {
-        title: 'CVE severity',
+        title: 'Top CVE severity',
         isShownByDefault: true,
     },
     cveStatus: {
@@ -63,6 +64,10 @@ export const defaultColumns = {
         title: 'Affected components',
         isShownByDefault: true,
     },
+    origin: {
+        title: 'CVE origin',
+        isShownByDefault: true,
+    },
     firstDiscovered: {
         title: 'First discovered',
         isShownByDefault: true,
@@ -87,6 +92,9 @@ export const deploymentWithVulnerabilitiesFragment = gql`
                 epss {
                     epssProbability
                 }
+                exploit {
+                    knownRansomwareCampaignUse
+                }
             }
             operatingSystem
             publishedOn
@@ -120,6 +128,7 @@ function DeploymentVulnerabilitiesTable({
     tableConfig,
 }: DeploymentVulnerabilitiesTableProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
+    const { version } = useMetadata();
     const { urlBuilder } = useWorkloadCveViewContext();
     const getVisibilityClass = generateVisibilityForColumns(tableConfig);
     const hiddenColumnCount = getHiddenColumnCount(tableConfig);
@@ -139,7 +148,7 @@ function DeploymentVulnerabilitiesTable({
                         className={getVisibilityClass('cveSeverity')}
                         sort={getSortParams('Severity')}
                     >
-                        CVE severity
+                        Top CVE severity
                     </Th>
                     <Th className={getVisibilityClass('cveStatus')}>
                         CVE status
@@ -156,6 +165,12 @@ function DeploymentVulnerabilitiesTable({
                         Affected components
                         {isFiltered && <DynamicColumnIcon />}
                     </Th>
+                    <Th
+                        className={getVisibilityClass('origin')}
+                        info={getInfoForCveOrigin(version, 'deployment')}
+                    >
+                        CVE origin
+                    </Th>
                     <Th className={getVisibilityClass('firstDiscovered')}>First discovered</Th>
                     <Th className={getVisibilityClass('publishedOn')}>Published</Th>
                 </Tr>
@@ -175,6 +190,7 @@ function DeploymentVulnerabilitiesTable({
                             severity,
                             summary,
                             isFixable,
+                            origin,
                             images,
                             affectedComponentsText,
                             discoveredAtImage,
@@ -186,13 +202,8 @@ function DeploymentVulnerabilitiesTable({
                         const labels: ReactNode[] = [];
                         if (
                             isFeatureFlagEnabled('ROX_SCANNER_V4') &&
-                            isFeatureFlagEnabled('ROX_CISA_KEV') &&
                             hasKnownExploit(cveBaseInfo?.exploit)
                         ) {
-                            // Add in deploymentWithVulnerabilitiesFragment following epss:
-                            // exploit {
-                            //     knownRansomwareCampaignUse
-                            // }
                             labels.push(<KnownExploitLabel key="exploit" isCompact />);
                             if (hasKnownRansomwareCampaignUse(cveBaseInfo?.exploit)) {
                                 labels.push(
@@ -250,7 +261,7 @@ function DeploymentVulnerabilitiesTable({
                                     <Td
                                         className={getVisibilityClass('cveSeverity')}
                                         modifier="nowrap"
-                                        dataLabel="CVE severity"
+                                        dataLabel="Top CVE severity"
                                     >
                                         <VulnerabilitySeverityIconText severity={severity} />
                                     </Td>
@@ -274,6 +285,12 @@ function DeploymentVulnerabilitiesTable({
                                     >
                                         {affectedComponentsText}
                                     </Td>
+                                    <Td
+                                        className={getVisibilityClass('origin')}
+                                        dataLabel="CVE origin"
+                                    >
+                                        {origin}
+                                    </Td>
                                     <Td
                                         className={getVisibilityClass('firstDiscovered')}
                                         modifier="nowrap"
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.cy.jsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.cy.jsx
index 40539b413a11d..1aabe1ddf4b56 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.cy.jsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.cy.jsx
@@ -5,8 +5,7 @@ import ImageComponentVulnerabilitiesTable from './ImageComponentVulnerabilitiesT
 const MockFeatureFlagsProvider = ({ children }) => (
     <FeatureFlagsContext.Provider
         value={{
-            isFeatureFlagEnabled: (flag) =>
-                flag === 'ROX_BASE_IMAGE_DETECTION' || flag === 'ROX_SCANNER_V4',
+            isFeatureFlagEnabled: (flag) => flag === 'ROX_SCANNER_V4',
             isLoadingFeatureFlags: false,
             error: undefined,
         }}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.tsx
index 76354933f5cd5..0d73b14112fb4 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageComponentVulnerabilitiesTable.tsx
@@ -4,8 +4,11 @@ import { gql } from '@apollo/client';
 
 import useFeatureFlags from 'hooks/useFeatureFlags';
 import useTableSort from 'hooks/useTableSort';
+import VulnerabilitySeverityIconText from 'Components/PatternFly/IconText/VulnerabilitySeverityIconText';
+import CvssFormatted from 'Components/CvssFormatted';
 
 import AdvisoryLinkOrText from '../../components/AdvisoryLinkOrText';
+import { getOriginDisplayName } from '../../utils/vulnerabilityUtils';
 import {
     flattenImageComponentVulns,
     imageMetadataContextFragment,
@@ -29,7 +32,10 @@ export const imageComponentVulnerabilitiesFragment = gql`
         inBaseImageLayer
         imageVulnerabilities(query: $query) {
             severity
+            cvss
+            scoreVersion
             fixedByVersion
+            origin
             advisory {
                 name
                 link
@@ -54,10 +60,10 @@ function ImageComponentVulnerabilitiesTable({
 }: ImageComponentVulnerabilitiesTableProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
     const isAdvisoryColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
-    const isLayerTypeColumnEnabled = isFeatureFlagEnabled('ROX_BASE_IMAGE_DETECTION');
+    const isOriginColumnEnabled = isFeatureFlagEnabled('ROX_SCANNER_V4');
 
     const colSpanForDockerfileLayer =
-        5 + (isAdvisoryColumnEnabled ? 1 : 0) + (isLayerTypeColumnEnabled ? 1 : 0);
+        8 + (isAdvisoryColumnEnabled ? 1 : 0) + (isOriginColumnEnabled ? 1 : 0);
 
     const { sortOption, getSortParams } = useTableSort({ sortFields, defaultSortOption });
     const componentVulns = flattenImageComponentVulns(
@@ -72,10 +78,13 @@ function ImageComponentVulnerabilitiesTable({
                 <Tr>
                     <Th sort={getSortParams('Component')}>Component</Th>
                     <Th>Version</Th>
+                    <Th>CVE severity</Th>
+                    <Th>CVSS</Th>
                     <Th>CVE fixed in</Th>
                     {isAdvisoryColumnEnabled && <Th>Advisory</Th>}
                     <Th>Source</Th>
-                    {isLayerTypeColumnEnabled && <Th>Layer type</Th>}
+                    {isOriginColumnEnabled && <Th>CVE origin</Th>}
+                    <Th>Layer type</Th>
                     <Th>Location</Th>
                 </Tr>
             </Thead>
@@ -84,7 +93,11 @@ function ImageComponentVulnerabilitiesTable({
                     image,
                     name,
                     version,
+                    severity,
+                    cvss,
+                    scoreVersion,
                     fixedByVersion,
+                    origin,
                     advisory,
                     location,
                     source,
@@ -105,6 +118,12 @@ function ImageComponentVulnerabilitiesTable({
                         <Tr>
                             <Td dataLabel="Component">{name}</Td>
                             <Td dataLabel="Version">{version}</Td>
+                            <Td dataLabel="CVE severity" modifier="nowrap">
+                                <VulnerabilitySeverityIconText severity={severity} />
+                            </Td>
+                            <Td dataLabel="CVSS" modifier="nowrap">
+                                <CvssFormatted cvss={cvss} scoreVersion={scoreVersion} />
+                            </Td>
                             <Td dataLabel="CVE fixed in" modifier="nowrap">
                                 <FixedByVersion fixedByVersion={fixedByVersion} />
                             </Td>
@@ -114,13 +133,14 @@ function ImageComponentVulnerabilitiesTable({
                                 </Td>
                             )}
                             <Td dataLabel="Source">{source}</Td>
-                            {isLayerTypeColumnEnabled && (
-                                <Td dataLabel="Layer type">
-                                    <Label color={inBaseImageLayer ? 'blue' : 'grey'} isCompact>
-                                        {inBaseImageLayer ? 'Base image' : 'Application'}
-                                    </Label>
-                                </Td>
+                            {isOriginColumnEnabled && (
+                                <Td dataLabel="CVE origin">{getOriginDisplayName(origin)}</Td>
                             )}
+                            <Td dataLabel="Layer type">
+                                <Label color={inBaseImageLayer ? 'blue' : 'grey'} isCompact>
+                                    {inBaseImageLayer ? 'Base image' : 'Application'}
+                                </Label>
+                            </Td>
                             <Td dataLabel="Location">
                                 <ComponentLocation location={location} source={source} />
                             </Td>
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageOverviewTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageOverviewTable.tsx
index 0a07ab0cad316..f2c05a740dc21 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageOverviewTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageOverviewTable.tsx
@@ -20,9 +20,8 @@ import type { ManagedColumns } from 'hooks/useManagedColumns';
 import useIsScannerV4Enabled from 'hooks/useIsScannerV4Enabled';
 import usePermissions from 'hooks/usePermissions';
 import type { GenerateSbomImageParams } from 'services/ImageSbomService';
-import GenerateSbomModal, {
-    getSbomGenerationStatusMessage,
-} from '../../components/GenerateSbomModal';
+import GenerateSbomModal from '../../components/GenerateSbomModal';
+import { getSbomGenerationStatusMessage } from '../../utils/getSbomGenerationStatusMessage';
 import ImageNameLink from '../components/ImageNameLink';
 import SeverityCountLabels from '../../components/SeverityCountLabels';
 import type {
@@ -330,12 +329,11 @@ function ImageOverviewTable({
                         }
 
                         if (hasWriteAccessForImage) {
-                            const isAriaDisabled =
-                                !isScannerV4Enabled || hasScanMessage || !name?.fullName;
                             const description = getSbomGenerationStatusMessage({
                                 isScannerV4Enabled,
-                                hasScanMessage,
+                                imageNotes: notes,
                             });
+                            const isAriaDisabled = description !== undefined || !name?.fullName;
 
                             rowActions.push({
                                 title: 'Generate SBOM',
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageVulnerabilitiesTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageVulnerabilitiesTable.tsx
index c29f9984e5298..b4e68f0706a33 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageVulnerabilitiesTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageVulnerabilitiesTable.tsx
@@ -15,6 +15,7 @@ import type { IAction } from '@patternfly/react-table';
 import { gql } from '@apollo/client';
 
 import useFeatureFlags from 'hooks/useFeatureFlags';
+import useMetadata from 'hooks/useMetadata';
 import useSet from 'hooks/useSet';
 import type { UseURLSortResult } from 'hooks/useURLSort';
 import VulnerabilityFixableIconText from 'Components/PatternFly/IconText/VulnerabilityFixableIconText';
@@ -32,6 +33,7 @@ import type { TableUIState } from 'utils/getTableUIState';
 import { generateVisibilityForColumns, getHiddenColumnCount } from 'hooks/useManagedColumns';
 import type { ManagedColumns } from 'hooks/useManagedColumns';
 import {
+    getAggregateOrigin,
     getIsSomeVulnerabilityFixable,
     hasKnownExploit,
     hasKnownRansomwareCampaignUse,
@@ -53,7 +55,7 @@ import PendingExceptionLabel from '../../components/PendingExceptionLabel';
 import ExceptionDetailsCell from '../components/ExceptionDetailsCell';
 import PartialCVEDataAlert from '../../components/PartialCVEDataAlert';
 import useWorkloadCveViewContext from '../hooks/useWorkloadCveViewContext';
-import { infoForEpssProbability } from './infoForTh';
+import { getInfoForCveOrigin, infoForEpssProbability } from './infoForTh';
 import { formatEpssProbabilityAsPercent } from './table.utils';
 
 export const tableId = 'WorkloadCvesImageVulnerabilitiesTable';
@@ -74,7 +76,7 @@ export const defaultColumns = {
         isUntoggleAble: true,
     },
     cveSeverity: {
-        title: 'CVE severity',
+        title: 'Top CVE severity',
         isShownByDefault: true,
     },
     cveStatus: {
@@ -82,7 +84,7 @@ export const defaultColumns = {
         isShownByDefault: true,
     },
     cvss: {
-        title: 'CVSS',
+        title: 'Top CVSS',
         isShownByDefault: true,
     },
     nvdCvss: {
@@ -97,6 +99,10 @@ export const defaultColumns = {
         title: 'Affected components',
         isShownByDefault: true,
     },
+    origin: {
+        title: 'CVE origin',
+        isShownByDefault: true,
+    },
     firstDiscovered: {
         title: 'First discovered',
         isShownByDefault: true,
@@ -131,6 +137,9 @@ export const imageVulnerabilitiesFragment = gql`
             epss {
                 epssProbability
             }
+            exploit {
+                knownRansomwareCampaignUse
+            }
         }
         discoveredAtImage
         publishedOn
@@ -184,6 +193,7 @@ function ImageVulnerabilitiesTable({
     tableConfig,
 }: ImageVulnerabilitiesTableProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
+    const { version } = useMetadata();
     const { urlBuilder } = useWorkloadCveViewContext();
     const getVisibilityClass = generateVisibilityForColumns(tableConfig);
     const hiddenColumnCount = getHiddenColumnCount(tableConfig);
@@ -207,14 +217,14 @@ function ImageVulnerabilitiesTable({
                         className={getVisibilityClass('cveSeverity')}
                         sort={getSortParams('Severity')}
                     >
-                        CVE severity
+                        Top CVE severity
                     </Th>
                     <Th className={getVisibilityClass('cveStatus')}>
                         CVE status
                         {isFiltered && <DynamicColumnIcon />}
                     </Th>
                     <Th className={getVisibilityClass('cvss')} sort={getSortParams('CVSS')}>
-                        CVSS
+                        Top CVSS
                     </Th>
                     <Th className={getVisibilityClass('nvdCvss')}>NVD CVSS</Th>
                     <Th
@@ -228,6 +238,12 @@ function ImageVulnerabilitiesTable({
                         Affected components
                         {isFiltered && <DynamicColumnIcon />}
                     </Th>
+                    <Th
+                        className={getVisibilityClass('origin')}
+                        info={getInfoForCveOrigin(version, 'image')}
+                    >
+                        CVE origin
+                    </Th>
                     <Th className={getVisibilityClass('firstDiscovered')} modifier="nowrap">
                         First discovered
                     </Th>
@@ -271,18 +287,14 @@ function ImageVulnerabilitiesTable({
                             (imageComponent) => imageComponent.imageVulnerabilities
                         );
                         const isFixableInImage = getIsSomeVulnerabilityFixable(vulnerabilities);
+                        const aggregateOrigin = getAggregateOrigin(vulnerabilities);
                         const epssProbability = cveBaseInfo?.epss?.epssProbability;
 
                         const labels: ReactNode[] = [];
                         if (
                             isFeatureFlagEnabled('ROX_SCANNER_V4') &&
-                            isFeatureFlagEnabled('ROX_CISA_KEV') &&
                             hasKnownExploit(cveBaseInfo?.exploit)
                         ) {
-                            // Add in imageVulnerabilitiesFragment following epss:
-                            // exploit {
-                            //     knownRansomwareCampaignUse
-                            // }
                             labels.push(<KnownExploitLabel key="exploit" isCompact />);
                             if (hasKnownRansomwareCampaignUse(cveBaseInfo?.exploit)) {
                                 labels.push(
@@ -344,7 +356,7 @@ function ImageVulnerabilitiesTable({
                                     <Td
                                         className={getVisibilityClass('cveSeverity')}
                                         modifier="nowrap"
-                                        dataLabel="CVE severity"
+                                        dataLabel="Top CVE severity"
                                     >
                                         {isVulnerabilitySeverity(severity) && (
                                             <VulnerabilitySeverityIconText severity={severity} />
@@ -362,7 +374,7 @@ function ImageVulnerabilitiesTable({
                                     <Td
                                         className={getVisibilityClass('cvss')}
                                         modifier="nowrap"
-                                        dataLabel="CVSS"
+                                        dataLabel="Top CVSS"
                                     >
                                         <CvssFormatted cvss={cvss} scoreVersion={scoreVersion} />
                                     </Td>
@@ -391,6 +403,12 @@ function ImageVulnerabilitiesTable({
                                             ? imageComponents[0].name
                                             : `${imageComponents.length} components`}
                                     </Td>
+                                    <Td
+                                        className={getVisibilityClass('origin')}
+                                        dataLabel="CVE origin"
+                                    >
+                                        {aggregateOrigin}
+                                    </Td>
                                     <Td
                                         className={getVisibilityClass('firstDiscovered')}
                                         dataLabel="First discovered"
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/WorkloadCVEOverviewTable.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/WorkloadCVEOverviewTable.tsx
index 888e0d91905d1..0446283adc510 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/WorkloadCVEOverviewTable.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/WorkloadCVEOverviewTable.tsx
@@ -152,6 +152,9 @@ export const cveListQuery = gql`
                     epss {
                         epssProbability
                     }
+                    exploit {
+                        knownRansomwareCampaignUse
+                    }
                 }
             }
             pendingExceptionCount: exceptionCount(requestStatus: $statusesForExceptionCount)
@@ -348,13 +351,8 @@ function WorkloadCVEOverviewTable({
                             const labels: ReactNode[] = [];
                             if (
                                 isFeatureFlagEnabled('ROX_SCANNER_V4') &&
-                                isFeatureFlagEnabled('ROX_CISA_KEV') &&
                                 hasKnownExploit(cveBaseInfo?.exploit)
                             ) {
-                                // Add in cveListQuery following epss:
-                                // exploit {
-                                //     knownRansomwareCampaignUse
-                                // }
                                 labels.push(<KnownExploitLabel key="exploit" isCompact />);
                                 if (hasKnownRansomwareCampaignUse(cveBaseInfo?.exploit)) {
                                     labels.push(
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/infoForTh.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/infoForTh.tsx
index 573dddf0f2d4d..b4ae4caac0158 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/infoForTh.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/infoForTh.tsx
@@ -3,6 +3,7 @@ import type { ThProps } from '@patternfly/react-table';
 
 import ExternalLink from 'Components/PatternFly/IconText/ExternalLink';
 import PopoverBodyContent from 'Components/PopoverBodyContent';
+import { getVersionedDocs } from 'utils/versioning';
 
 export const infoForEpssProbability: ThProps['info'] = {
     // ariaLabel for OutlinedQuestionCircleIcon
@@ -34,3 +35,43 @@ export const infoForEpssProbability: ThProps['info'] = {
         />
     ),
 };
+
+// The CVE origin popover links to versioned RHACS documentation, so it must be
+// built with the current version rather than defined as a static object.
+export function getInfoForCveOrigin(
+    version: string,
+    resourceType: 'image' | 'deployment'
+): ThProps['info'] {
+    return {
+        ariaLabel: 'Information about CVE origin',
+        popover: (
+            <PopoverBodyContent
+                headerContent="CVE origin"
+                bodyContent={
+                    <Flex direction={{ default: 'column' }}>
+                        <FlexItem>
+                            Where the CVE assessment comes from for components in this{' '}
+                            {resourceType}. Values are supported OS vendors, OSV.dev, Other, or
+                            Multiple when components differ.
+                        </FlexItem>
+                        <FlexItem>
+                            For more information, see{' '}
+                            <ExternalLink>
+                                <a
+                                    href={getVersionedDocs(
+                                        version,
+                                        'operating/examine-images-for-vulnerabilities#supported-operating-systems_examine-images-for-vulnerabilities'
+                                    )}
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                >
+                                    Supported operating systems (RHACS)
+                                </a>
+                            </ExternalLink>
+                        </FlexItem>
+                    </Flex>
+                }
+            />
+        ),
+    };
+}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/table.utils.ts b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/table.utils.ts
index 70077e05412bc..a29eefaa326ba 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/table.utils.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/table.utils.ts
@@ -9,6 +9,7 @@ import type { SourceType } from 'types/image.proto';
 import type { ApiSortOptionSingle } from 'types/search';
 
 import {
+    getAggregateOrigin,
     getHighestVulnerabilitySeverity,
     getIsSomeVulnerabilityFixable,
 } from '../../utils/vulnerabilityUtils';
@@ -82,7 +83,10 @@ export type ComponentVulnerabilityBase = {
     inBaseImageLayer?: boolean;
     imageVulnerabilities: {
         severity: string;
+        cvss: number;
+        scoreVersion: string;
         fixedByVersion: string;
+        origin?: string;
         advisory?: Advisory | null;
         pendingExceptionCount: number;
     }[];
@@ -99,6 +103,7 @@ export type DeploymentComponentVulnerability = Omit<
         cvss: number;
         scoreVersion: string;
         fixedByVersion: string;
+        origin?: string;
         advisory?: Advisory | null;
         discoveredAtImage: string | null;
         publishedOn: string | null;
@@ -120,6 +125,8 @@ export type TableDataRow = {
     fixedByVersion: string;
     advisory?: Advisory | null;
     severity: VulnerabilitySeverity;
+    cvss: number;
+    scoreVersion: string;
     version: string;
     location: string;
     source: SourceType;
@@ -128,6 +135,7 @@ export type TableDataRow = {
         instruction: string;
         value: string;
     } | null;
+    origin?: string;
     pendingExceptionCount: number;
     inBaseImageLayer?: boolean;
 };
@@ -158,23 +166,13 @@ export function flattenImageComponentVulns(
 export function flattenDeploymentComponentVulns(
     imageMetadataContext: ImageMetadataContext,
     componentVulnerabilities: DeploymentComponentVulnerability[]
-): (TableDataRow & {
-    cvss: number;
-    scoreVersion: string;
-})[] {
+): TableDataRow[] {
     const image = imageMetadataContext;
     const layers = imageMetadataContext.metadata?.v1?.layers ?? [];
 
     return componentVulnerabilities.map((component) => {
         const vulnerability = component.imageVulnerabilities[0];
-        const cvss = vulnerability?.cvss ?? 0;
-        const scoreVersion = vulnerability?.scoreVersion ?? 'N/A';
-
-        return {
-            ...extractCommonComponentFields(image, layers, component, vulnerability),
-            scoreVersion,
-            cvss,
-        };
+        return extractCommonComponentFields(image, layers, component, vulnerability);
     });
 }
 
@@ -203,7 +201,10 @@ function extractCommonComponentFields(
         vulnerability?.severity && isVulnerabilitySeverity(vulnerability.severity)
             ? vulnerability.severity
             : 'UNKNOWN_VULNERABILITY_SEVERITY';
+    const cvss = vulnerability?.cvss ?? 0;
+    const scoreVersion = vulnerability?.scoreVersion ?? 'N/A';
     const fixedByVersion = vulnerability?.fixedByVersion ?? 'N/A';
+    const origin = vulnerability?.origin;
     const advisory = vulnerability?.advisory;
     const pendingExceptionCount = vulnerability?.pendingExceptionCount ?? 0;
 
@@ -219,7 +220,10 @@ function extractCommonComponentFields(
         },
         layer,
         severity,
+        cvss,
+        scoreVersion,
         fixedByVersion,
+        origin,
         advisory,
         pendingExceptionCount,
         inBaseImageLayer,
@@ -277,6 +281,7 @@ export type FormattedDeploymentVulnerability = {
     operatingSystem: string;
     severity: VulnerabilitySeverity;
     isFixable: boolean;
+    origin: string;
     discoveredAtImage: Date | null;
     publishedOn: Date | null;
     summary: string;
@@ -310,6 +315,7 @@ export function formatVulnerabilityData(
         const allVulnerabilities = allVulnerableComponents.flatMap((c) => c.imageVulnerabilities);
         const highestVulnSeverity = getHighestVulnerabilitySeverity(allVulnerabilities);
         const isFixableInDeployment = getIsSomeVulnerabilityFixable(allVulnerabilities);
+        const origin = getAggregateOrigin(allVulnerabilities);
         const allDiscoveredDates = allVulnerableComponents
             .flatMap((c) => c.imageVulnerabilities.map((v) => v.discoveredAtImage))
             .filter((d): d is string => d !== null);
@@ -343,6 +349,7 @@ export function formatVulnerabilityData(
             operatingSystem,
             severity: highestVulnSeverity,
             isFixable: isFixableInDeployment,
+            origin,
             discoveredAtImage: oldestDiscoveredVulnDate,
             publishedOn: publishedOnDate,
             summary,
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/components/ImageDetailBadges.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/components/ImageDetailBadges.tsx
index 3db64197881fa..70314f9d39851 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/components/ImageDetailBadges.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/components/ImageDetailBadges.tsx
@@ -31,40 +31,6 @@ export type ImageDetails = {
     baseImage: BaseImage | null;
 };
 
-export const imageDetailsFragment = gql`
-    fragment ImageDetails on Image {
-        deploymentCount
-        operatingSystem
-        metadata {
-            v1 {
-                created
-            }
-        }
-        dataSource {
-            name
-        }
-        scanTime
-        scanNotes
-        notes
-        signatureCount
-        signatureVerificationData {
-            results {
-                description
-                status
-                verificationTime
-                verifiedImageReferences
-                verifierId
-                verifierName
-            }
-        }
-        baseImage {
-            imageSha
-            names
-            created
-        }
-    }
-`;
-
 export const imageV2DetailsFragment = gql`
     fragment ImageV2Details on ImageV2 {
         deploymentCount
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/components/AdvancedFiltersToolbar.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/components/AdvancedFiltersToolbar.tsx
index 52d6164f76834..ebb1f2786f954 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/components/AdvancedFiltersToolbar.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/components/AdvancedFiltersToolbar.tsx
@@ -19,7 +19,6 @@ import {
     attributeForClusterCveFixableInFrontend,
     attributeForFixableInFrontendAndLocalStorage,
     attributeForSeverityInFrontendAndLocalStorage,
-    attributeForSnoozed,
 } from '../searchFilterConfig';
 import { normalizeSearchFilterKeys } from '../utils/searchUtils';
 
@@ -59,7 +58,7 @@ function AdvancedFiltersToolbar({
     // components render correctly even for bookmarked URLs from before the rename.
     const normalizedFilter = useMemo(() => normalizeSearchFilterKeys(searchFilter), [searchFilter]);
 
-    const attributesSeparateFromConfig: CompoundSearchFilterAttribute[] = [attributeForSnoozed];
+    const attributesSeparateFromConfig: CompoundSearchFilterAttribute[] = [];
     if (includeCveSeverityFilters) {
         attributesSeparateFromConfig.push(attributeForSeverityInFrontendAndLocalStorage);
     }
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/components/CreateViewBasedReportModal.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/components/CreateViewBasedReportModal.tsx
similarity index 89%
rename from ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/components/CreateViewBasedReportModal.tsx
rename to ui/apps/platform/src/Containers/Vulnerabilities/components/CreateViewBasedReportModal.tsx
index 3625ac08040c5..7ea4e81375703 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/components/CreateViewBasedReportModal.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/components/CreateViewBasedReportModal.tsx
@@ -3,9 +3,8 @@ import { Alert, Button, Flex, FlexItem } from '@patternfly/react-core';
 import { Modal } from '@patternfly/react-core/deprecated';
 import { Link } from 'react-router-dom';
 
-import { runViewBasedReport } from 'services/ReportsService';
-import { vulnerabilityViewBasedReportsPath } from 'routePaths';
 import useAnalytics, { VIEW_BASED_REPORT_GENERATED } from 'hooks/useAnalytics';
+import type { RunReportResponseViewBased } from 'services/ReportsService.types';
 
 type Message =
     | {
@@ -27,6 +26,14 @@ export type CreateViewBasedReportModalProps = {
     setIsOpen: (value: boolean) => void;
     query: string;
     areaOfConcern: string;
+    runViewBasedReport: ({
+        query,
+        areaOfConcern,
+    }: {
+        query: string;
+        areaOfConcern: string;
+    }) => Promise<RunReportResponseViewBased>;
+    vulnerabilityViewBasedJobsPath: string;
 };
 
 function CreateViewBasedReportModal({
@@ -34,6 +41,8 @@ function CreateViewBasedReportModal({
     setIsOpen,
     query,
     areaOfConcern,
+    runViewBasedReport,
+    vulnerabilityViewBasedJobsPath,
 }: CreateViewBasedReportModalProps) {
     const { analyticsTrack } = useAnalytics();
     const [isTriggeringReportGeneration, setIsTriggeringReportGeneration] = useState(false);
@@ -103,8 +112,8 @@ function CreateViewBasedReportModal({
             <Flex gap={{ default: 'gapMd' }}>
                 <FlexItem>
                     Generate a CSV report based on this view and the filters you’ve applied. Once
-                    completed, this report will be available in the view-based reports section until
-                    it is purged according to your retention settings.
+                    completed, this report will be available on the View-based jobs tab until it is
+                    purged according to your retention settings.
                 </FlexItem>
                 {message?.type === 'success' && (
                     <Alert
@@ -132,10 +141,7 @@ function CreateViewBasedReportModal({
                                         variant="link"
                                         isInline
                                         component={(props) => (
-                                            <Link
-                                                {...props}
-                                                to={vulnerabilityViewBasedReportsPath}
-                                            />
+                                            <Link {...props} to={vulnerabilityViewBasedJobsPath} />
                                         )}
                                     >
                                         View status in reports table
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/components/CvePageHeader.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/components/CvePageHeader.tsx
index 90fb0b09986ae..6d5dc038a70de 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/components/CvePageHeader.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/components/CvePageHeader.tsx
@@ -52,11 +52,7 @@ function CvePageHeader({ data }: CvePageHeaderProps) {
     const hasEpssProbabilityLabel = isEpssProbabilityColumnEnabled && Boolean(cveBaseInfo); // not (yet) for Node CVE
 
     const labels: ReactNode[] = [];
-    if (
-        isFeatureFlagEnabled('ROX_SCANNER_V4') &&
-        isFeatureFlagEnabled('ROX_CISA_KEV') &&
-        hasKnownExploit(cveBaseInfo?.exploit)
-    ) {
+    if (isFeatureFlagEnabled('ROX_SCANNER_V4') && hasKnownExploit(cveBaseInfo?.exploit)) {
         labels.push(<KnownExploitLabel key="exploit" isCompact={false} />);
         if (hasKnownRansomwareCampaignUse(cveBaseInfo?.exploit)) {
             labels.push(
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/components/GenerateSbomModal.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/components/GenerateSbomModal.tsx
index 72abb1d553184..d44ab35d5cbe5 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/components/GenerateSbomModal.tsx
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/components/GenerateSbomModal.tsx
@@ -18,24 +18,6 @@ import useRestMutation from 'hooks/useRestMutation';
 import { generateAndSaveSbom } from 'services/ImageSbomService';
 import type { GenerateSbomImageParams } from 'services/ImageSbomService';
 
-export function getSbomGenerationStatusMessage({
-    isScannerV4Enabled,
-    hasScanMessage,
-}: {
-    isScannerV4Enabled: boolean;
-    hasScanMessage: boolean;
-}): string | undefined {
-    if (!isScannerV4Enabled) {
-        return 'SBOM generation requires Scanner V4';
-    }
-
-    if (hasScanMessage) {
-        return 'SBOM generation is unavailable due to incomplete scan data';
-    }
-
-    return undefined;
-}
-
 export type GenerateSbomModalProps = {
     onClose: () => void;
     image: GenerateSbomImageParams;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/components/SnoozedCveToggleButton.cy.jsx b/ui/apps/platform/src/Containers/Vulnerabilities/components/SnoozedCveToggleButton.cy.jsx
deleted file mode 100644
index 89bf49b8b0d55..0000000000000
--- a/ui/apps/platform/src/Containers/Vulnerabilities/components/SnoozedCveToggleButton.cy.jsx
+++ /dev/null
@@ -1,83 +0,0 @@
-import { useState } from 'react';
-import SnoozedCveToggleButton from './SnoozedCveToggleButton';
-
-function Wrapper({ startingSearchFilter = {}, snoozedCveCount }) {
-    const [searchFilter, setSearchFilter] = useState(startingSearchFilter);
-
-    return (
-        <>
-            <div>
-                <h1>Filters</h1>
-                {Object.entries(searchFilter).map(([key, values]) => (
-                    <div key={key}>
-                        {key}:{values.join(',')}
-                    </div>
-                ))}
-            </div>
-            <SnoozedCveToggleButton
-                searchFilter={searchFilter}
-                setSearchFilter={setSearchFilter}
-                snoozedCveCount={snoozedCveCount}
-            />
-        </>
-    );
-}
-
-const snoozedFilterSelector =
-    'div:has(h1:contains("Filters")) div:contains("CVE Snoozed:true") div';
-
-const severityFilterSelector =
-    'div:has(h1:contains("Filters")) div:contains("Severity:Critical,Important") div';
-
-describe(Cypress.spec.relative, () => {
-    it('should manage the toggling of the snoozed CVE filter', () => {
-        cy.mount(<Wrapper />);
-
-        // Default is off
-        cy.get(snoozedFilterSelector).should('not.exist');
-
-        // Toggle on
-        cy.findByText('Show snoozed CVEs').click();
-        cy.get(snoozedFilterSelector).should('exist');
-
-        // Toggle off
-        cy.findByText('Show observed CVEs').click();
-        cy.get(snoozedFilterSelector).should('not.exist');
-    });
-
-    it('should not change the state of existing filters when toggling the snoozed CVE filter', () => {
-        cy.mount(<Wrapper startingSearchFilter={{ Severity: ['Critical', 'Important'] }} />);
-
-        // Default is off
-        cy.get(snoozedFilterSelector).should('not.exist');
-        cy.get(severityFilterSelector).should('exist');
-
-        // Toggle on
-        cy.findByText('Show snoozed CVEs').click();
-        cy.get(snoozedFilterSelector).should('exist');
-        cy.get(severityFilterSelector).should('exist');
-
-        // Toggle off
-        cy.findByText('Show observed CVEs').click();
-        cy.get(snoozedFilterSelector).should('not.exist');
-        cy.get(severityFilterSelector).should('exist');
-    });
-
-    it('should correctly display the current snoozed CVE count', () => {
-        // Badge should not show when no count is provided
-        cy.mount(<Wrapper snoozedCveCount={undefined} />);
-        cy.get('button .pf-v6-c-badge').should('not.exist');
-
-        // Badge should not show when count is 0
-        cy.mount(<Wrapper snoozedCveCount={0} />);
-        cy.get('button .pf-v6-c-badge').should('not.exist');
-
-        // Badge should show when count is > 0
-        cy.mount(<Wrapper snoozedCveCount={1} />);
-        cy.get('button .pf-v6-c-badge').contains('1');
-
-        // Badge should not show when viewing snoozed CVEs
-        cy.findByText('Show snoozed CVEs').click();
-        cy.get('button .pf-v6-c-badge').should('not.exist');
-    });
-});
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/components/SnoozedCveToggleButton.tsx b/ui/apps/platform/src/Containers/Vulnerabilities/components/SnoozedCveToggleButton.tsx
deleted file mode 100644
index 189fcae3d7116..0000000000000
--- a/ui/apps/platform/src/Containers/Vulnerabilities/components/SnoozedCveToggleButton.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import { Button } from '@patternfly/react-core';
-import type { SearchFilter } from 'types/search';
-
-export type SnoozedCveToggleButtonProps = {
-    searchFilter: SearchFilter;
-    setSearchFilter: (searchFilter: SearchFilter) => void;
-    snoozedCveCount: number | undefined;
-};
-
-function SnoozedCveToggleButton({
-    searchFilter,
-    setSearchFilter,
-    snoozedCveCount,
-}: SnoozedCveToggleButtonProps) {
-    const isSnoozeFilterActive = searchFilter['CVE Snoozed']?.[0] === 'true';
-    const buttonText = isSnoozeFilterActive ? 'Show observed CVEs' : 'Show snoozed CVEs';
-    const showCountBadge =
-        typeof snoozedCveCount === 'number' && snoozedCveCount > 0 && !isSnoozeFilterActive;
-    const badgeCount = showCountBadge ? { isRead: true, count: snoozedCveCount } : undefined;
-
-    function toggleSnoozeFilter() {
-        const nextFilter = { ...searchFilter };
-        if (isSnoozeFilterActive) {
-            delete nextFilter['CVE Snoozed'];
-        } else {
-            nextFilter['CVE Snoozed'] = ['true'];
-        }
-        setSearchFilter(nextFilter);
-    }
-
-    return (
-        <Button variant="secondary" onClick={toggleSnoozeFilter} countOptions={badgeCount}>
-            {buttonText}
-        </Button>
-    );
-}
-
-export default SnoozedCveToggleButton;
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/hooks/useInvalidateVulnerabilityQueries.ts b/ui/apps/platform/src/Containers/Vulnerabilities/hooks/useInvalidateVulnerabilityQueries.ts
index c36336fc21d36..42685413a3a1c 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/hooks/useInvalidateVulnerabilityQueries.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/hooks/useInvalidateVulnerabilityQueries.ts
@@ -7,7 +7,7 @@ import { imageListQuery } from '../WorkloadCves/Tables/ImageOverviewTable';
 import { cveListQuery } from '../WorkloadCves/Tables/WorkloadCVEOverviewTable';
 import { deploymentListQuery } from '../WorkloadCves/Tables/DeploymentOverviewTable';
 import { deploymentVulnerabilitiesQuery } from '../WorkloadCves/Deployment/DeploymentPageVulnerabilities';
-import { imageVulnerabilitiesQuery } from '../WorkloadCves/Image/ImagePageVulnerabilities';
+import { imageV2VulnerabilitiesQuery } from '../WorkloadCves/Image/ImagePageVulnerabilities';
 import {
     imageCveAffectedDeploymentsQuery,
     imageCveAffectedImagesQuery,
@@ -41,7 +41,7 @@ const queryFieldNames = uniq(
         imageCveAffectedDeploymentsQuery,
         imageCveAffectedImagesQuery,
         // Query for the Workload CVE image detail page
-        imageVulnerabilitiesQuery,
+        imageV2VulnerabilitiesQuery,
         // Query for the Workload CVE deployment detail page
         deploymentVulnerabilitiesQuery,
     ].flatMap(extractTopLevelFieldNames)
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/hooks/useSnoozedCveCount.ts b/ui/apps/platform/src/Containers/Vulnerabilities/hooks/useSnoozedCveCount.ts
deleted file mode 100644
index 2c98d59ab0e33..0000000000000
--- a/ui/apps/platform/src/Containers/Vulnerabilities/hooks/useSnoozedCveCount.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { gql, useQuery } from '@apollo/client';
-
-const snoozedNodeCveCountQuery = gql`
-    query getSnoozedNodeCveCount {
-        count: nodeCVECount(query: "CVE Snoozed:true")
-    }
-`;
-
-const snoozedPlatformCveCountQuery = gql`
-    query getSnoozedPlatformCveCount {
-        count: platformCVECount(query: "CVE Snoozed:true")
-    }
-`;
-
-export default function useSnoozedCveCount(cveType: 'Node' | 'Platform'): number | undefined {
-    const totalNodeCountRequest = useQuery<{ count: number }>(
-        cveType === 'Node' ? snoozedNodeCveCountQuery : snoozedPlatformCveCountQuery
-    );
-
-    return totalNodeCountRequest.data?.count;
-}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/searchFilterConfig.ts b/ui/apps/platform/src/Containers/Vulnerabilities/searchFilterConfig.ts
index 56dd4f52f9f4f..8faf9e5cede98 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/searchFilterConfig.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/searchFilterConfig.ts
@@ -10,6 +10,7 @@
 
 import type {
     CompoundSearchFilterEntity,
+    GenericSelectSearchFilterAttribute,
     SelectExclusiveSingleSearchFilterAttribute,
     SelectSearchFilterAttribute,
     SelectSearchFilterOption,
@@ -29,9 +30,12 @@ import {
     Name,
 } from 'Components/CompoundSearchFilter/attributes/deployment';
 import { imageAttributes } from 'Components/CompoundSearchFilter/attributes/image';
-import { imageCVEAttributes } from 'Components/CompoundSearchFilter/attributes/imageCVE';
+import { Origin, imageCVEAttributes } from 'Components/CompoundSearchFilter/attributes/imageCVE';
 import { imageComponentAttributes } from 'Components/CompoundSearchFilter/attributes/imageComponent';
 import {
+    Annotation as namespaceAnnotation,
+    ID as namespaceId,
+    Label as namespaceLabel,
     Name as namespaceName,
     namespaceAttributes,
 } from 'Components/CompoundSearchFilter/attributes/namespace';
@@ -40,12 +44,16 @@ import { nodeCVEAttributes } from 'Components/CompoundSearchFilter/attributes/no
 import { nodeComponentAttributes } from 'Components/CompoundSearchFilter/attributes/nodeComponent';
 import { platformCVEAttributes } from 'Components/CompoundSearchFilter/attributes/platformCVE';
 import {
+    VirtualMachineCVECvss,
+    VirtualMachineCVEDiscoveredTime,
     VirtualMachineCVEName,
     VirtualMachineComponentName,
     VirtualMachineComponentSource,
     VirtualMachineComponentVersion,
+    VirtualMachineGuestOs,
     VirtualMachineID,
     VirtualMachineName,
+    VirtualMachineScanTime,
 } from 'Components/CompoundSearchFilter/attributes/virtualMachine';
 import { vulnerabilitySeverityLabels } from 'messages/common';
 
@@ -120,14 +128,19 @@ export const platformCVESearchFilterConfig: CompoundSearchFilterEntity = {
 
 export const virtualMachinesSearchFilterConfig: CompoundSearchFilterEntity = {
     displayName: 'Virtual machine',
-    searchCategory: 'VIRTUAL_MACHINES',
-    attributes: [VirtualMachineID, VirtualMachineName],
+    searchCategory: 'SEARCH_UNSET',
+    attributes: [
+        VirtualMachineGuestOs,
+        VirtualMachineID,
+        VirtualMachineName,
+        VirtualMachineScanTime,
+    ],
 };
 
 export const virtualMachineCVESearchFilterConfig: CompoundSearchFilterEntity = {
     displayName: 'CVE',
     searchCategory: 'SEARCH_UNSET', // we don't have autocomplete for virtual machines
-    attributes: [VirtualMachineCVEName],
+    attributes: [VirtualMachineCVECvss, VirtualMachineCVEDiscoveredTime, VirtualMachineCVEName],
 };
 
 export const virtualMachineComponentLegacySearchFilterConfig: CompoundSearchFilterEntity = {
@@ -149,26 +162,32 @@ export const virtualMachineComponentSearchFilterConfig: CompoundSearchFilterEnti
 export const virtualMachinesClusterSearchFilterConfig: CompoundSearchFilterEntity = {
     displayName: 'Cluster',
     searchCategory: 'CLUSTERS',
-    attributes: [clusterIdAttribute, clusterNameAttribute],
+    attributes: [
+        clusterIdAttribute,
+        clusterLabelAttribute,
+        clusterNameAttribute,
+        clusterPlatformTypeAttribute,
+        clusterTypeAttribute,
+    ],
 };
 
 export const virtualMachinesNamespaceSearchFilterConfig: CompoundSearchFilterEntity = {
     displayName: 'Namespace',
     searchCategory: 'SEARCH_UNSET', // virtual machine pipeline doesn't add namespace
-    attributes: [namespaceName],
+    attributes: [namespaceAnnotation, namespaceId, namespaceLabel, namespaceName],
 };
 
 // attributes for separate search filter elements in AdvancedFiltersToolbar.tsx file
 
 export const attributeForSnoozed: SelectExclusiveSingleSearchFilterAttribute = {
-    displayName: 'CVE snoozed', // corresponds to Show snoozed CVEs
-    filterChipLabel: 'CVE snoozed',
+    displayName: 'Vulnerability state',
+    filterChipLabel: 'Vulnerability state',
     searchTerm: 'CVE Snoozed',
-    inputType: 'select-exclusive-single', // placeholder because interaction is Show snoozed CVEs button
+    inputType: 'select-exclusive-single',
     inputProps: {
         options: [
-            { label: 'true', value: 'true' }, // Snoozed
-            { label: 'false', value: 'false' }, // Observed
+            { label: 'Observed', value: 'false' },
+            { label: 'Snoozed', value: 'true' },
         ],
     },
 };
@@ -226,6 +245,7 @@ export const attributeForSeverityInFrontendAndLocalStorage: SelectSearchFilterAt
         ],
     },
 };
+
 export const attributeForSeverityInBackendAndViewBasedReport: SelectSearchFilterAttribute = {
     displayName: 'CVE severity',
     filterChipLabel: 'CVE severity',
@@ -243,9 +263,12 @@ export const attributeForSeverityInBackendAndViewBasedReport: SelectSearchFilter
 export const searchFilterConfigForImageVulnerabilityReport = [
     {
         ...imageCVESearchFilterConfig,
-        attributes: imageCVESearchFilterConfig.attributes.filter(
-            ({ searchTerm }) => searchTerm !== 'CVE Created Time'
-        ),
+        attributes: [
+            ...imageCVESearchFilterConfig.attributes.filter(
+                ({ searchTerm }) => searchTerm !== 'CVE Created Time' // created in **system** is confusing for report
+            ),
+            Origin, // CVE origin filter is scoped to reports (plus single image/deployment pages)
+        ],
     },
     imageSearchFilterConfig,
     imageComponentSearchFilterConfig,
@@ -260,6 +283,25 @@ export const searchFilterConfigForWorkloadVulnerabilityResultsAndViewBasedReport
     namespaceSearchFilterConfig,
 ];
 
+// Scheduled report has resources instead of cluster.
+export const searchFilterConfigForNodeVulnerabilityReport = [
+    {
+        ...nodeCVESearchFilterConfig,
+        attributes: nodeCVESearchFilterConfig.attributes.filter(
+            ({ searchTerm }) => searchTerm !== 'CVE Created Time' // created in **system** is confusing for report
+        ),
+    },
+    nodeSearchFilterConfig,
+    nodeComponentSearchFilterConfig,
+];
+
+export const searchFilterConfigForNodeVulnerabilityResultsAndViewBasedReport = [
+    clusterSearchFilterConfig,
+    nodeCVESearchFilterConfig,
+    nodeSearchFilterConfig,
+    nodeComponentSearchFilterConfig,
+];
+
 export const attributeForPlatformComponent: SelectSearchFilterAttribute = {
     displayName: 'Area of concern', // corresponds to horizontal navigation
     filterChipLabel: 'Area of concern',
@@ -289,9 +331,17 @@ export const attributeForVulnerabilityState: SelectSearchFilterAttribute = {
 };
 
 // For scheduled and view-based report.
+
 export const attributesSeparateFromConfigForImageVulnerabilityReport = [
     attributeForPlatformComponent,
     attributeForVulnerabilityState,
     attributeForSeverityInBackendAndViewBasedReport, // Formerly under Vulnerability parameters
     attributeForFixableInBackendAndViewBasedReport,
 ];
+
+export const attributesSeparateFromConfigForNodeVulnerabilityReport: GenericSelectSearchFilterAttribute[] =
+    [
+        attributeForSnoozed,
+        attributeForSeverityInBackendAndViewBasedReport, // Formerly under Vulnerability parameters
+        attributeForFixableInBackendAndViewBasedReport,
+    ];
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/utils/getSbomGenerationStatusMessage.test.ts b/ui/apps/platform/src/Containers/Vulnerabilities/utils/getSbomGenerationStatusMessage.test.ts
new file mode 100644
index 0000000000000..9b75a4b2af78e
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/utils/getSbomGenerationStatusMessage.test.ts
@@ -0,0 +1,61 @@
+import { getSbomGenerationStatusMessage } from './getSbomGenerationStatusMessage';
+
+describe('getSbomGenerationStatusMessage', () => {
+    it('should return undefined (enabled) when Scanner V4 is enabled and there are no notes', () => {
+        expect(
+            getSbomGenerationStatusMessage({
+                isScannerV4Enabled: true,
+                imageNotes: [],
+            })
+        ).toBeUndefined();
+    });
+
+    it('should return the Scanner V4 message when Scanner V4 is not enabled', () => {
+        expect(
+            getSbomGenerationStatusMessage({
+                isScannerV4Enabled: false,
+                imageNotes: [],
+            })
+        ).toBe('SBOM generation requires Scanner V4');
+    });
+
+    it('should prefer the Scanner V4 message even when scan data is missing', () => {
+        expect(
+            getSbomGenerationStatusMessage({
+                isScannerV4Enabled: false,
+                imageNotes: ['MISSING_SCAN_DATA'],
+            })
+        ).toBe('SBOM generation requires Scanner V4');
+    });
+
+    it('should block generation when image notes contain MISSING_SCAN_DATA', () => {
+        expect(
+            getSbomGenerationStatusMessage({
+                isScannerV4Enabled: true,
+                imageNotes: ['MISSING_SCAN_DATA'],
+            })
+        ).toBe('SBOM generation is unavailable due to incomplete scan data');
+    });
+
+    it('should block generation when image notes contain MISSING_METADATA', () => {
+        expect(
+            getSbomGenerationStatusMessage({
+                isScannerV4Enabled: true,
+                imageNotes: ['MISSING_METADATA'],
+            })
+        ).toBe('SBOM generation is unavailable due to incomplete scan data');
+    });
+
+    // The core of ROX-36762: an image with no detectable base OS (e.g. FROM scratch)
+    // has scan data but only scan-level notes (OS_UNAVAILABLE etc.), never the
+    // image-level MISSING_* notes. Those scan-level notes must not block generation,
+    // so with empty imageNotes the function keeps SBOM generation enabled.
+    it('should NOT block generation when the image has no missing-data notes', () => {
+        expect(
+            getSbomGenerationStatusMessage({
+                isScannerV4Enabled: true,
+                imageNotes: [],
+            })
+        ).toBeUndefined();
+    });
+});
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/utils/getSbomGenerationStatusMessage.ts b/ui/apps/platform/src/Containers/Vulnerabilities/utils/getSbomGenerationStatusMessage.ts
new file mode 100644
index 0000000000000..21a91f589b242
--- /dev/null
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/utils/getSbomGenerationStatusMessage.ts
@@ -0,0 +1,28 @@
+// Image-level notes that indicate the image has no usable scan data at all.
+// These genuinely prevent SBOM generation. Scan-level notes such as
+// OS_UNAVAILABLE / OS_CVES_UNAVAILABLE / OS_CVES_STALE only affect CVE accuracy
+// (the image was still scanned), so they must NOT block SBOM generation — the
+// backend endpoint and roxctl produce an SBOM for those images (ROX-36762).
+const noScanDataImageNotes = ['MISSING_METADATA', 'MISSING_SCAN_DATA'];
+
+export function hasNoScanData(imageNotes: string[]): boolean {
+    return imageNotes?.some((note) => noScanDataImageNotes.includes(note)) ?? false;
+}
+
+export function getSbomGenerationStatusMessage({
+    isScannerV4Enabled,
+    imageNotes,
+}: {
+    isScannerV4Enabled: boolean;
+    imageNotes: string[];
+}): string | undefined {
+    if (!isScannerV4Enabled) {
+        return 'SBOM generation requires Scanner V4';
+    }
+
+    if (hasNoScanData(imageNotes)) {
+        return 'SBOM generation is unavailable due to incomplete scan data';
+    }
+
+    return undefined;
+}
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/utils/sortFields.ts b/ui/apps/platform/src/Containers/Vulnerabilities/utils/sortFields.ts
index d79fe2c8b0c28..7fa1b67923b10 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/utils/sortFields.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/utils/sortFields.ts
@@ -6,8 +6,10 @@ export const CVE_SEVERITY_SORT_FIELD = 'Severity';
 export const CVE_STATUS_SORT_FIELD = 'Fixable';
 export const CVE_TYPE_SORT_FIELD = 'CVE Type';
 export const CVE_COUNT_SORT_FIELD = 'CVE Count';
+export const CVE_PUBLISHED_ON_SORT_FIELD = 'CVE Published On';
 export const OPERATING_SYSTEM_SORT_FIELD = 'Operating System';
 export const COMPONENT_SORT_FIELD = 'Component';
+export const NAMESPACE_SORT_FIELD = 'Namespace';
 
 // Cluster sort fields
 export const CLUSTER_SORT_FIELD = 'Cluster';
@@ -23,3 +25,4 @@ export const NODE_SCAN_TIME_SORT_FIELD = 'Node Scan Time';
 
 // Virtual Machine sort fields
 export const VIRTUAL_MACHINE_SORT_FIELD = 'Virtual Machine Name';
+export const GUEST_OS_SORT_FIELD = 'Guest OS';
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.test.ts b/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.test.ts
index d95e38d4d5f2e..1fc281ae818a7 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.test.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.test.ts
@@ -1,9 +1,11 @@
 import type { NonEmptyArray } from 'utils/type.utils';
 import {
+    getAggregateOrigin,
     getEarliestDiscoveredAtTime,
     getHighestCvssScore,
     getHighestVulnerabilitySeverity,
     getIsSomeVulnerabilityFixable,
+    getOriginDisplayName,
 } from './vulnerabilityUtils';
 
 const CRITICAL = 'CRITICAL_VULNERABILITY_SEVERITY';
@@ -100,4 +102,62 @@ describe('vulnerability utils', () => {
             expect(getEarliestDiscoveredAtTime(vulnerabilities)).toEqual('2021-01-01T00:00:00Z');
         });
     });
+
+    describe('getOriginDisplayName', () => {
+        const testCases = [
+            { origin: 'VULN_ORIGIN_ALPINE', expected: 'Alpine Linux' },
+            { origin: 'VULN_ORIGIN_RED_HAT', expected: 'Red Hat' },
+            { origin: 'VULN_ORIGIN_UBUNTU', expected: 'Ubuntu' },
+            { origin: 'VULN_ORIGIN_OTHER', expected: 'Other' },
+        ];
+
+        testCases.forEach(({ origin, expected }) => {
+            it(`returns '${expected}' for origin: ${origin}`, () => {
+                expect(getOriginDisplayName(origin)).toEqual(expected);
+            });
+        });
+
+        it('returns the raw value for an unrecognized origin', () => {
+            expect(getOriginDisplayName('VULN_ORIGIN_FUTURE')).toEqual('VULN_ORIGIN_FUTURE');
+        });
+
+        it("returns 'Other' when the origin is null or undefined", () => {
+            expect(getOriginDisplayName(null)).toEqual('Other');
+            expect(getOriginDisplayName(undefined)).toEqual('Other');
+        });
+    });
+
+    describe('getAggregateOrigin', () => {
+        it('returns the display name when all vulnerabilities share a single origin', () => {
+            const vulnerabilities = [
+                { origin: 'VULN_ORIGIN_UBUNTU' },
+                { origin: 'VULN_ORIGIN_UBUNTU' },
+            ];
+            expect(getAggregateOrigin(vulnerabilities)).toEqual('Ubuntu');
+        });
+
+        it("returns 'Multiple' when vulnerabilities have more than one distinct origin", () => {
+            const vulnerabilities = [
+                { origin: 'VULN_ORIGIN_UBUNTU' },
+                { origin: 'VULN_ORIGIN_RED_HAT' },
+            ];
+            expect(getAggregateOrigin(vulnerabilities)).toEqual('Multiple');
+        });
+
+        it("returns 'Other' when there are no vulnerabilities", () => {
+            expect(getAggregateOrigin([])).toEqual('Other');
+        });
+
+        it("returns 'Other' when no vulnerability has an origin", () => {
+            const vulnerabilities = [{ origin: undefined }, {}];
+            expect(getAggregateOrigin(vulnerabilities)).toEqual('Other');
+        });
+
+        it("returns 'Multiple' when a known origin is mixed with a missing origin", () => {
+            // A missing origin counts as the distinct 'Other' origin, so it aggregates to
+            // 'Multiple' rather than collapsing to the single known origin.
+            const vulnerabilities = [{ origin: 'VULN_ORIGIN_RED_HAT' }, { origin: undefined }];
+            expect(getAggregateOrigin(vulnerabilities)).toEqual('Multiple');
+        });
+    });
 });
diff --git a/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts b/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts
index 8e4c4774b8ab1..91d770dfb743d 100644
--- a/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts
+++ b/ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts
@@ -77,6 +77,44 @@ export function getEarliestDiscoveredAtTime(
     return earliestDiscoveredAt;
 }
 
+const OTHER_ORIGIN_DISPLAY_NAME = 'Other';
+
+export const originDisplayNames: Partial<Record<string, string>> = {
+    VULN_ORIGIN_ALPINE: 'Alpine Linux',
+    VULN_ORIGIN_AMAZON: 'Amazon Linux',
+    VULN_ORIGIN_DEBIAN: 'Debian',
+    VULN_ORIGIN_ORACLE: 'Oracle Linux',
+    VULN_ORIGIN_OSV: 'OSV.dev',
+    VULN_ORIGIN_PHOTON: 'Photon OS',
+    VULN_ORIGIN_RED_HAT: 'Red Hat',
+    VULN_ORIGIN_SUSE: 'SUSE',
+    VULN_ORIGIN_UBUNTU: 'Ubuntu',
+    VULN_ORIGIN_OTHER: OTHER_ORIGIN_DISPLAY_NAME,
+};
+
+export function getOriginDisplayName(origin: string | null | undefined): string {
+    if (!origin) {
+        return OTHER_ORIGIN_DISPLAY_NAME;
+    }
+    return originDisplayNames[origin] ?? origin;
+}
+
+export function getAggregateOrigin(vulnerabilities: { origin?: string }[]): string {
+    // A missing origin is treated as 'Other', which is a distinct origin, so a CVE that
+    // originates from Red Hat data in one component and has no origin in another aggregates
+    // to 'Multiple' rather than 'Red Hat'.
+    const distinctOrigins = [
+        ...new Set(vulnerabilities.map(({ origin }) => origin || 'VULN_ORIGIN_OTHER')),
+    ];
+    if (distinctOrigins.length === 0) {
+        return OTHER_ORIGIN_DISPLAY_NAME;
+    }
+    if (distinctOrigins.length === 1) {
+        return getOriginDisplayName(distinctOrigins[0]);
+    }
+    return 'Multiple';
+}
+
 export function hasKnownExploit(exploit: Exploit | null | undefined): exploit is Exploit {
     return Boolean(exploit);
 }
diff --git a/ui/apps/platform/src/constants/accessControl.ts b/ui/apps/platform/src/constants/accessControl.ts
index 167886222f398..ade3865244ec7 100644
--- a/ui/apps/platform/src/constants/accessControl.ts
+++ b/ui/apps/platform/src/constants/accessControl.ts
@@ -14,6 +14,7 @@ export const authProviderLabels = {
     userpki: 'User Certificates',
     iap: 'Google IAP',
     openshift: 'OpenShift Auth',
+    'openshift-with-acm-roles': 'OpenShift Auth with ACM Roles',
 };
 
 export const oidcCallbackModes = [
diff --git a/ui/apps/platform/src/constants/complianceStates.js b/ui/apps/platform/src/constants/complianceStates.js
deleted file mode 100644
index fe4989164657f..0000000000000
--- a/ui/apps/platform/src/constants/complianceStates.js
+++ /dev/null
@@ -1,5 +0,0 @@
-export default {
-    PASS: 'Pass',
-    FAIL: 'Fail',
-    'N/A': 'N/A',
-};
diff --git a/ui/apps/platform/src/constants/componentTypes.js b/ui/apps/platform/src/constants/componentTypes.js
deleted file mode 100644
index 279c49b28392f..0000000000000
--- a/ui/apps/platform/src/constants/componentTypes.js
+++ /dev/null
@@ -1,14 +0,0 @@
-const componentTypes = {
-    HEADER: 'header',
-    RELATED_ENTITIES_LIST: 'relatedEntitiesList',
-    ENTITY_COMPLIANCE: 'entityCompliance',
-    LIST_TABLE: 'listTable',
-    STANDARDS_BY_CLUSTER: 'standardsByCluster',
-    STANDARDS_ACROSS_CLUSTERS: 'standardsAcrossClusters',
-    STANDARDS_ACROSS_NAMESPACES: 'standardsAcrossNamespaces',
-    STANDARDS_ACROSS_NODES: 'standardsAcrossNodes',
-    RESOURCE_COUNT: 'resourceCount',
-    COMPLIANCE_BY_STANDARD: 'complianceByStandard',
-};
-
-export default componentTypes;
diff --git a/ui/apps/platform/src/constants/entityTypes.ts b/ui/apps/platform/src/constants/entityTypes.ts
index 9e6de55d21fd4..e6af08941ba74 100644
--- a/ui/apps/platform/src/constants/entityTypes.ts
+++ b/ui/apps/platform/src/constants/entityTypes.ts
@@ -15,8 +15,7 @@ export type ResourceType =
     | 'IMAGE_CVE'
     | 'NODE_CVE'
     | 'CLUSTER_CVE'
-    | 'POLICY'
-    | 'CONTROL';
+    | 'POLICY';
 
 export const resourceTypes = {
     NAMESPACE: 'NAMESPACE',
@@ -34,7 +33,6 @@ export const resourceTypes = {
     NODE_CVE: 'NODE_CVE',
     CLUSTER_CVE: 'CLUSTER_CVE',
     POLICY: 'POLICY',
-    CONTROL: 'CONTROL',
 } as const;
 
 export type RbacConfigType = 'SUBJECT' | 'SERVICE_ACCOUNT' | 'ROLE';
@@ -47,38 +45,10 @@ export const rbacConfigTypes: Record<RbacConfigType, RbacConfigType> = {
 
 export type AccessControlEntityType = 'ACCESS_SCOPE' | 'AUTH_PROVIDER' | 'PERMISSION_SET' | 'ROLE';
 
-export type StandardEntityType = 'CONTROL' | 'CATEGORY' | 'STANDARD' | 'CHECK';
-
-export const standardEntityTypes: Record<StandardEntityType, StandardEntityType> = {
-    CONTROL: 'CONTROL',
-    CATEGORY: 'CATEGORY',
-    STANDARD: 'STANDARD',
-    CHECK: 'CHECK',
-};
-
-export const standardTypes = {
-    PCI_DSS_3_2: 'PCI_DSS_3_2',
-    NIST_800_190: 'NIST_800_190',
-    NIST_SP_800_53_Rev_4: 'NIST_SP_800_53_Rev_4',
-    HIPAA_164: 'HIPAA_164',
-    CIS_Kubernetes_v1_5: 'CIS_Kubernetes_v1_5',
-    CIS_Docker_v1_1_0: 'CIS_Docker_v1_1_0',
-    CIS_Docker_v1_2_0: 'CIS_Docker_v1_2_0',
-};
-
-export const standardBaseTypes = {
-    [standardTypes.PCI_DSS_3_2]: 'PCI',
-    [standardTypes.NIST_800_190]: 'NIST SP 800-190',
-    [standardTypes.NIST_SP_800_53_Rev_4]: 'NIST SP 800-53',
-    [standardTypes.HIPAA_164]: 'HIPAA',
-    [standardTypes.CIS_Kubernetes_v1_5]: 'CIS K8s',
-};
-
 export const searchCategories: Record<string, SearchCategory> = {
     NAMESPACE: 'NAMESPACES',
     NODE: 'NODES',
     CLUSTER: 'CLUSTERS',
-    CONTROL: 'COMPLIANCE',
     CVE: 'VULNERABILITIES',
     CLUSTER_CVE: 'CLUSTER_VULNERABILITIES',
     IMAGE_CVE: 'IMAGE_VULNERABILITIES_V2', // flat CVE data model
@@ -98,7 +68,5 @@ export const searchCategories: Record<string, SearchCategory> = {
 
 export default {
     ...resourceTypes,
-    ...standardTypes,
-    ...standardEntityTypes,
     ...rbacConfigTypes,
 } as const;
diff --git a/ui/apps/platform/src/constants/searchOptions.ts b/ui/apps/platform/src/constants/searchOptions.ts
index 886a3be4dbf4e..28403c1ee36ea 100644
--- a/ui/apps/platform/src/constants/searchOptions.ts
+++ b/ui/apps/platform/src/constants/searchOptions.ts
@@ -1,7 +1,4 @@
 export const CLIENT_SIDE_SEARCH_OPTIONS = {
-    COMPLIANCE: {
-        STATE: 'Compliance State',
-    },
     POLICY_STATUS: {
         CATEGORY: 'Policy Status',
         VALUES: {
diff --git a/ui/apps/platform/src/constants/severityColors.ts b/ui/apps/platform/src/constants/severityColors.ts
index 4e441f5ecced0..af1a906992cea 100644
--- a/ui/apps/platform/src/constants/severityColors.ts
+++ b/ui/apps/platform/src/constants/severityColors.ts
@@ -18,9 +18,6 @@ export const CRITICAL_SEVERITY_COLOR =
 export const UNKNOWN_SEVERITY_COLOR =
     'var(--pf-t--global--icon--color--severity--undefined--default)';
 
-export const COMPLIANCE_PASS_COLOR = LOW_SEVERITY_COLOR; // so long as LOW_SEVERITY_COLOR is blue!
-export const COMPLIANCE_FAIL_COLOR = CRITICAL_SEVERITY_COLOR;
-
 export const policySeverityColorMap: Record<PolicySeverity, string> = {
     LOW_SEVERITY: LOW_SEVERITY_COLOR,
     MEDIUM_SEVERITY: MODERATE_MEDIUM_SEVERITY_COLOR,
diff --git a/ui/apps/platform/src/constants/useCaseTypes.js b/ui/apps/platform/src/constants/useCaseTypes.js
index e0c773a4cbb52..3a92e95f54681 100644
--- a/ui/apps/platform/src/constants/useCaseTypes.js
+++ b/ui/apps/platform/src/constants/useCaseTypes.js
@@ -2,7 +2,6 @@
 export type UseCase =
     | 'ACCESS_CONTROL'
     | 'CLUSTERS'
-    | 'COMPLIANCE'
     | 'CONFIG_MANAGEMENT'
     | 'DEPLOYMENT'
     | 'POLICY'
@@ -17,7 +16,6 @@ const useCaseTypes = {
     ACCESS_CONTROL: 'access-control',
     CONFIG_MANAGEMENT: 'configmanagement',
     VULN_MANAGEMENT: 'vulnerability-management',
-    COMPLIANCE: 'compliance',
     CLUSTERS: 'clusters',
     RISK: 'risk',
     SECRET: 'secrets',
diff --git a/ui/apps/platform/src/hooks/useAnalytics.test.ts b/ui/apps/platform/src/hooks/useAnalytics.test.ts
index c2459343a2416..56f18c7c4b593 100644
--- a/ui/apps/platform/src/hooks/useAnalytics.test.ts
+++ b/ui/apps/platform/src/hooks/useAnalytics.test.ts
@@ -49,6 +49,7 @@ describe('getRedactedOriginProperties', () => {
         });
     });
 
+    // Be aware that compliance/controls route has been removed.
     test('scrubs top level string search values', () => {
         const originalSearchParams = [
             's[groupBy]=CLUSTER',
@@ -71,6 +72,7 @@ describe('getRedactedOriginProperties', () => {
         });
     });
 
+    // Be aware that compliance/controls route has been removed.
     test('scrubs only s and s2 search keys', () => {
         const originalSearchParams = [
             's[bogus%20standard]=NIST%20SP%20800-190',
diff --git a/ui/apps/platform/src/hooks/useAnalytics.ts b/ui/apps/platform/src/hooks/useAnalytics.ts
index b0538fdc31627..7a8e59980948e 100644
--- a/ui/apps/platform/src/hooks/useAnalytics.ts
+++ b/ui/apps/platform/src/hooks/useAnalytics.ts
@@ -3,8 +3,10 @@ import Raven from 'raven-js';
 import mapValues from 'lodash/mapValues';
 
 import type { ReportPageAction } from 'Components/Reports/reports.types';
+import type { SchedulePageAction } from 'Containers/ComplianceEnhanced/Schedules/compliance.scanConfigs.utils';
 import type { ImageType } from 'services/ReportsService.types';
 import type { Telemetry } from 'types/config.proto';
+import type { Schedule } from 'types/schedule.proto';
 import { ensureExhaustive, tupleTypeGuard } from 'utils/type.utils';
 import type { UnionFrom } from 'utils/type.utils';
 import { getQueryObject, getQueryString } from 'utils/queryStringUtils';
@@ -64,6 +66,8 @@ export const AGING_IMAGES_WIDGET_CLICKED = 'Aging Images Widget Link Clicked';
 
 export const IMAGE_VULNERABILITY_REPORTS_WIZARD_SAVE_CLICKED =
     'Image Vulnerability Reports Wizard Save Clicked';
+export const NODE_VULNERABILITY_REPORTS_WIZARD_SAVE_CLICKED =
+    'Node Vulnerability Reports Wizard Save Clicked';
 
 // cluster-init-bundles
 export const CREATE_INIT_BUNDLE_CLICKED = 'Create Init Bundle Clicked';
@@ -384,6 +388,16 @@ export type AnalyticsEvent =
               resourceScope: string;
           };
       }
+    | {
+          event: typeof NODE_VULNERABILITY_REPORTS_WIZARD_SAVE_CLICKED;
+          properties: {
+              action: ReportPageAction;
+              cvesSince: 'allVuln'; // | 'sinceLastSentScheduledReport' | 'sinceStartDate'
+              intervalType: Schedule['intervalType'];
+              notifiers: number;
+              resourceScope: string;
+          };
+      }
     /**
      * Tracks each time the user clicks the "Create Bundle" button
      * source: 'No Clusters' is superseded by the following event in 4.10
@@ -536,6 +550,11 @@ export type AnalyticsEvent =
           properties: {
               success: true | false;
               errorMessage: string;
+              action: SchedulePageAction;
+              clusters: number;
+              intervalType: Schedule['intervalType'];
+              notifiers: number;
+              profiles: number;
           };
       }
     | {
diff --git a/ui/apps/platform/src/hooks/useLightspeedStatus.tsx b/ui/apps/platform/src/hooks/useLightspeedStatus.tsx
new file mode 100644
index 0000000000000..039d348b1ab95
--- /dev/null
+++ b/ui/apps/platform/src/hooks/useLightspeedStatus.tsx
@@ -0,0 +1,24 @@
+import { createContext, useContext } from 'react';
+
+import type { LightspeedStatusContextType } from 'providers/LightspeedStatusProvider';
+
+export const LightspeedStatusContext = createContext<LightspeedStatusContextType | undefined>(
+    undefined
+);
+
+function useLightspeedStatus(): LightspeedStatusContextType {
+    const context = useContext(LightspeedStatusContext);
+    if (context === undefined) {
+        return {
+            isAvailable: false,
+            isLoading: false,
+            error: new Error(
+                'useLightspeedStatus must be used within a LightspeedStatusProvider - returning static default values'
+            ),
+        };
+    }
+
+    return context;
+}
+
+export default useLightspeedStatus;
diff --git a/ui/apps/platform/src/images/aiExperience.svg b/ui/apps/platform/src/images/aiExperience.svg
new file mode 100644
index 0000000000000..dee09c3c4071c
--- /dev/null
+++ b/ui/apps/platform/src/images/aiExperience.svg
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="AI-experience" xmlns="http://www.w3.org/2000/svg" class="pf-v6-svg" width="1em"
+  height="1em" viewBox="0 0 32 32" fill="currentColor" role="img" aria-hidden="true">
+  <path id="icon"
+    d="M26.03125,16.96191c-5.90527-.46875-10.53076-5.09473-10.99902-11-.0415-.51953-.5166-.96094-1.03809-.96094s-.99658.44238-1.03809.96191c-.46777,5.9043-5.09375,10.53027-10.99121,10.99902-.52344.03711-.96973.51367-.96973,1.03809,0,.52148.44189.99707.96191,1.03809,5.90527.46875,10.53125,5.09473,10.99951,11,.0415.51953.5166.96094,1.0376.96094.52197,0,.99707-.44238,1.03857-.96191.46777-5.9043,5.09326-10.53027,10.99854-10.99902.51953-.04199.96191-.51562.96191-1.03809,0-.52148-.44238-.99707-.96191-1.03809ZM13.99414,25.76465c-1.4126-3.54492-4.21875-6.35059-7.7666-7.76367,3.54639-1.41309,6.354-4.2207,7.76709-7.76562,1.4126,3.54492,4.21826,6.35059,7.76611,7.76367-3.5459,1.41309-6.35352,4.2207-7.7666,7.76562ZM30.50195,7c0,.28906-.20898.53613-.49805.58984-2.2334.4082-4.00879,2.18359-4.41699,4.41699-.05371.28906-.30078.49805-.58984.49805s-.53613-.20898-.58984-.49805c-.40723-2.2334-2.18262-4.00879-4.41699-4.41699-.28906-.05371-.49805-.30078-.49805-.58984s.20898-.53613.49805-.58984c2.23438-.4082,4.00977-2.18359,4.41699-4.41699.05371-.28906.30078-.49805.58984-.49805s.53613.20898.58984.49805c.4082,2.2334,2.18359,4.00879,4.41699,4.41699.28906.05371.49805.30078.49805.58984Z" />
+</svg>
diff --git a/ui/apps/platform/src/images/cluster.svg b/ui/apps/platform/src/images/cluster.svg
deleted file mode 100644
index cb453959b6259..0000000000000
--- a/ui/apps/platform/src/images/cluster.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg height="56" viewBox="0 0 56 56" width="56" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><circle cx="28" cy="28" fill="#e9f0ff" r="28"/><circle cx="28" cy="28" fill="#3b73eb" r="3.555556"/><circle cx="20" cy="28" fill="#fff" r="3.555556"/><circle cx="24.444444" cy="20.888889" fill="#99b9ff" r="3.555556"/><circle cx="32.444444" cy="20.888889" fill="#345394" r="3.555556"/><circle cx="32.444444" cy="35.111111" fill="#345394" r="3.555556"/><circle cx="24.444444" cy="35.111111" fill="#3b73eb" r="3.555556"/><circle cx="16.444444" cy="35.111111" fill="#3b73eb" r="2.666667"/><circle cx="39.555556" cy="35.111111" fill="#fff" r="2.666667"/><circle cx="39.555556" cy="20.888889" fill="#6390f0" r="2.666667"/><circle cx="16.444444" cy="20.888889" fill="#3b73eb" r="2.666667"/><circle cx="28" cy="14.666667" fill="#3b73eb" r="2.666667"/><circle cx="28" cy="41.333333" fill="#99b9ff" r="2.666667"/><g fill="#3b73eb"><circle cx="20.444444" cy="41.333333" r="2.222222"/><circle cx="35.555556" cy="41.333333" r="2.222222"/><circle cx="35.555556" cy="14.666667" r="2.222222"/><circle cx="20.444444" cy="14.666667" r="2.222222"/><circle cx="36" cy="28" r="3.555556"/><circle cx="42.222222" cy="28" r="1.777778"/><circle cx="13.777778" cy="28" r="1.777778"/></g></g></svg>
\ No newline at end of file
diff --git a/ui/apps/platform/src/images/container-runtime.svg b/ui/apps/platform/src/images/container-runtime.svg
deleted file mode 100644
index 42f5bcd52de41..0000000000000
--- a/ui/apps/platform/src/images/container-runtime.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg height="56" viewBox="0 0 56 56" width="56" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><circle cx="28" cy="28" fill="#e9f0ff" r="28"/><g stroke-width="1.8"><rect fill="#fff" height="18.2" rx="2.7" stroke="#345394" width="27.2" x="14.9" y="18.9"/><g stroke="#7699e5" stroke-linecap="round" transform="translate(18.5 22)"><path d="m1.4375 1.05050505v9.65682275"/><path d="m7.17708333 1.05050505v9.65682275"/><path d="m12.9166667 1.05050505v9.65682275"/><path d="m18.65625 1.05050505v9.65682275"/></g></g></g></svg>
\ No newline at end of file
diff --git a/ui/apps/platform/src/images/feedback_illo.svg b/ui/apps/platform/src/images/feedback_illo.svg
deleted file mode 100644
index a96f52cf57b51..0000000000000
--- a/ui/apps/platform/src/images/feedback_illo.svg
+++ /dev/null
@@ -1,515 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 26.3.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 viewBox="0 0 627 1080" style="enable-background:new 0 0 627 1080;" xml:space="preserve">
-<style type="text/css">
-	.st0{fill:#F5F5F5;}
-	.st1{fill:#EE0000;}
-	.st2{fill:#FFFFFF;}
-	.st3{fill:none;}
-	.st4{fill:none;stroke:#EE0000;stroke-width:2;stroke-linecap:round;stroke-miterlimit:10;}
-	.st5{fill:#DEDEDE;}
-	.st6{fill:none;stroke:#EE0000;stroke-width:2;stroke-miterlimit:10;}
-	.st7{fill:#AAAAAA;}
-	.st8{fill:none;stroke:#EE0000;stroke-width:9;stroke-miterlimit:10;}
-	.st9{fill:#F56D6D;}
-	.st10{fill:#FFFFFF;stroke:#DEDEDE;stroke-width:2.4363;stroke-miterlimit:10;}
-	.st11{fill:none;stroke:#EE0000;stroke-width:1.8269;stroke-linecap:round;stroke-miterlimit:10;}
-	.st12{clip-path:url(#SVGID_00000006708115112344082280000015676319740623644035_);fill:#C9C9C9;}
-	.st13{fill:#FAB6B6;}
-	.st14{fill:none;stroke:#DEDEDE;stroke-width:2.4363;stroke-miterlimit:10;}
-	.st15{clip-path:url(#SVGID_00000089550960143504709990000006872349005933077158_);}
-	.st16{clip-path:url(#SVGID_00000049917554778345275620000007266228223859393450_);fill:#EE0000;}
-	.st17{clip-path:url(#SVGID_00000049917554778345275620000007266228223859393450_);}
-	.st18{fill:none;stroke:#DEDEDE;stroke-miterlimit:10;}
-	.st19{fill:none;stroke:#000000;stroke-width:1.05;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st20{fill:#4D4D4D;}
-	.st21{clip-path:url(#SVGID_00000109739521277973935990000005446138732564482186_);fill:#F56D6D;}
-	.st22{fill:none;stroke:#F56D6D;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st23{clip-path:url(#SVGID_00000098912303722433873210000006740478188654000817_);fill:#F56D6D;}
-	.st24{clip-path:url(#SVGID_00000050648154256307375430000000221889288154094482_);}
-	.st25{fill:#8F0000;}
-	.st26{fill:#5F0000;}
-	.st27{fill:none;stroke:#5F0000;stroke-width:2.1583;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st28{fill:#8B8B8B;}
-	.st29{fill:none;stroke:#000000;stroke-width:2;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st30{fill:none;stroke:#EE0000;stroke-width:4;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st31{fill:#C9C9C9;}
-	.st32{fill:none;stroke:#5F0000;stroke-width:2.1583;stroke-linecap:round;stroke-miterlimit:10;}
-	.st33{fill:none;stroke:#F3F3F3;stroke-width:1.5723;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st34{clip-path:url(#SVGID_00000073710463406131195850000015792772397650804912_);fill:#5F0000;}
-	.st35{fill:none;stroke:#EE0000;stroke-width:3.0844;stroke-linecap:round;stroke-miterlimit:10;}
-	.st36{fill:none;stroke:#EE0000;stroke-width:3.0844;stroke-miterlimit:10;}
-	.st37{fill:none;stroke:#EE0000;stroke-width:13.8799;stroke-miterlimit:10;}
-	.st38{fill:#FFFFFF;stroke:#DEDEDE;stroke-width:3.7572;stroke-miterlimit:10;}
-	.st39{fill:none;stroke:#EE0000;stroke-width:2.8175;stroke-linecap:round;stroke-miterlimit:10;}
-	.st40{clip-path:url(#SVGID_00000166640534823149311240000003323603682097089678_);fill:#C9C9C9;}
-	.st41{fill:none;stroke:#DEDEDE;stroke-width:3.7572;stroke-miterlimit:10;}
-	.st42{clip-path:url(#SVGID_00000163056657646014874400000012007078979449275058_);}
-	.st43{clip-path:url(#SVGID_00000044146432087832930890000007102219783589702309_);fill:#EE0000;}
-	.st44{clip-path:url(#SVGID_00000044146432087832930890000007102219783589702309_);}
-	.st45{fill:none;stroke:#DEDEDE;stroke-width:1.5422;stroke-miterlimit:10;}
-	.st46{fill:none;stroke:#000000;stroke-width:1.6194;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st47{clip-path:url(#SVGID_00000091736783555419402230000013485446496879320977_);fill:#F56D6D;}
-	.st48{fill:none;stroke:#F56D6D;stroke-width:1.5422;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st49{clip-path:url(#SVGID_00000135665242292760675720000014394939948769625515_);fill:#F56D6D;}
-	.st50{clip-path:url(#SVGID_00000183956834382274756430000002692159795553697973_);}
-	.st51{fill:none;stroke:#5F0000;stroke-width:3.3285;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st52{fill:none;stroke:#000000;stroke-width:3.0844;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st53{fill:none;stroke:#EE0000;stroke-width:6.1689;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st54{fill:none;stroke:#5F0000;stroke-width:3.3285;stroke-linecap:round;stroke-miterlimit:10;}
-	.st55{fill:none;stroke:#F3F3F3;stroke-width:2.4249;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st56{clip-path:url(#SVGID_00000078750127377637257870000011636197965346789269_);fill:#5F0000;}
-	.st57{fill:none;stroke:#EE0000;stroke-width:1.071;stroke-linecap:round;stroke-miterlimit:10;}
-	.st58{fill:none;stroke:#EE0000;stroke-width:1.071;stroke-miterlimit:10;}
-	.st59{fill:none;stroke:#EE0000;stroke-width:4.8194;stroke-miterlimit:10;}
-	.st60{fill:#FFFFFF;stroke:#DEDEDE;stroke-width:1.3046;stroke-miterlimit:10;}
-	.st61{fill:none;stroke:#EE0000;stroke-width:0.9783;stroke-linecap:round;stroke-miterlimit:10;}
-	.st62{clip-path:url(#SVGID_00000078764508886898884370000011178292867063652244_);fill:#C9C9C9;}
-	.st63{fill:none;stroke:#DEDEDE;stroke-width:1.3046;stroke-miterlimit:10;}
-	.st64{clip-path:url(#SVGID_00000025415398135347721680000001928825862555566994_);}
-	.st65{clip-path:url(#SVGID_00000067234523078145239350000016432767384618365315_);fill:#EE0000;}
-	.st66{clip-path:url(#SVGID_00000067234523078145239350000016432767384618365315_);}
-	.st67{fill:none;stroke:#DEDEDE;stroke-width:0.5355;stroke-miterlimit:10;}
-	.st68{fill:none;stroke:#000000;stroke-width:0.5623;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st69{clip-path:url(#SVGID_00000114777613506260806570000003873718088348024468_);fill:#F56D6D;}
-	.st70{fill:none;stroke:#F56D6D;stroke-width:0.5355;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st71{clip-path:url(#SVGID_00000157283891915667419350000011643576673149798826_);fill:#F56D6D;}
-	.st72{clip-path:url(#SVGID_00000137838271739867383990000000844840008565815454_);}
-	.st73{fill:none;stroke:#5F0000;stroke-width:1.1557;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st74{fill:none;stroke:#000000;stroke-width:1.071;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st75{fill:none;stroke:#EE0000;stroke-width:2.1419;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st76{fill:none;stroke:#5F0000;stroke-width:1.1557;stroke-linecap:round;stroke-miterlimit:10;}
-	.st77{fill:none;stroke:#F3F3F3;stroke-width:0.842;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st78{clip-path:url(#SVGID_00000075870309040546232460000017446829817087706284_);fill:#5F0000;}
-	.st79{fill:none;stroke:#EE0000;stroke-width:2.1932;stroke-linecap:round;stroke-miterlimit:10;}
-	.st80{fill:none;stroke:#EE0000;stroke-width:2.1932;stroke-miterlimit:10;}
-	.st81{fill:none;stroke:#EE0000;stroke-width:9.8696;stroke-miterlimit:10;}
-	.st82{fill:#FFFFFF;stroke:#DEDEDE;stroke-width:2.6716;stroke-miterlimit:10;}
-	.st83{fill:none;stroke:#EE0000;stroke-width:2.0034;stroke-linecap:round;stroke-miterlimit:10;}
-	.st84{clip-path:url(#SVGID_00000014605712171222924180000001252509896969434003_);fill:#C9C9C9;}
-	.st85{fill:none;stroke:#DEDEDE;stroke-width:2.6716;stroke-miterlimit:10;}
-	.st86{clip-path:url(#SVGID_00000052069686170060349110000010558511540841722244_);}
-	.st87{clip-path:url(#SVGID_00000168828406074164671250000004629291926362034601_);fill:#EE0000;}
-	.st88{clip-path:url(#SVGID_00000168828406074164671250000004629291926362034601_);}
-	.st89{fill:none;stroke:#DEDEDE;stroke-width:1.0966;stroke-miterlimit:10;}
-	.st90{fill:none;stroke:#000000;stroke-width:1.1515;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st91{clip-path:url(#SVGID_00000027590383559149524600000002658658000206395062_);fill:#F56D6D;}
-	.st92{fill:none;stroke:#F56D6D;stroke-width:1.0966;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st93{clip-path:url(#SVGID_00000121244254495607397800000004157032463484945051_);fill:#F56D6D;}
-	.st94{clip-path:url(#SVGID_00000147206420076767377590000018114159783982054016_);}
-	.st95{fill:none;stroke:#5F0000;stroke-width:2.3668;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st96{fill:none;stroke:#000000;stroke-width:2.1932;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st97{fill:none;stroke:#EE0000;stroke-width:4.3865;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st98{fill:none;stroke:#5F0000;stroke-width:2.3668;stroke-linecap:round;stroke-miterlimit:10;}
-	.st99{fill:none;stroke:#F3F3F3;stroke-width:1.7242;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st100{clip-path:url(#SVGID_00000000198478802910157520000016005328533812647845_);fill:#5F0000;}
-	.st101{fill:none;stroke:#EE0000;stroke-width:2.5957;stroke-linecap:round;stroke-miterlimit:10;}
-	.st102{fill:none;stroke:#EE0000;stroke-width:2.5957;stroke-miterlimit:10;}
-	.st103{fill:none;stroke:#EE0000;stroke-width:11.6806;stroke-miterlimit:10;}
-	.st104{fill:#FFFFFF;stroke:#DEDEDE;stroke-width:3.1619;stroke-miterlimit:10;}
-	.st105{fill:none;stroke:#EE0000;stroke-width:2.371;stroke-linecap:round;stroke-miterlimit:10;}
-	.st106{clip-path:url(#SVGID_00000008864991715029096570000017135687964293412483_);fill:#C9C9C9;}
-	.st107{fill:none;stroke:#DEDEDE;stroke-width:3.1619;stroke-miterlimit:10;}
-	.st108{clip-path:url(#SVGID_00000155128589710759560260000017586195763219504799_);}
-	.st109{clip-path:url(#SVGID_00000011731168176994482810000004869014155340885658_);fill:#EE0000;}
-	.st110{clip-path:url(#SVGID_00000011731168176994482810000004869014155340885658_);}
-	.st111{fill:none;stroke:#DEDEDE;stroke-width:1.2978;stroke-miterlimit:10;}
-	.st112{fill:none;stroke:#000000;stroke-width:1.3628;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st113{clip-path:url(#SVGID_00000181797222044963275140000007323840534319895703_);fill:#F56D6D;}
-	.st114{fill:none;stroke:#F56D6D;stroke-width:1.2978;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st115{clip-path:url(#SVGID_00000036227324985480594550000002359428645886480007_);fill:#F56D6D;}
-	.st116{clip-path:url(#SVGID_00000070796947189942177730000012260740732188180905_);}
-	.st117{fill:none;stroke:#5F0000;stroke-width:2.8011;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st118{fill:none;stroke:#000000;stroke-width:2.5957;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st119{fill:none;stroke:#EE0000;stroke-width:5.1914;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st120{fill:none;stroke:#5F0000;stroke-width:2.8011;stroke-linecap:round;stroke-miterlimit:10;}
-	.st121{fill:none;stroke:#F3F3F3;stroke-width:2.0406;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st122{clip-path:url(#SVGID_00000037665627892968617850000012928015356655310517_);fill:#5F0000;}
-	.st123{fill:none;stroke:#EE0000;stroke-width:1.5354;stroke-linecap:round;stroke-miterlimit:10;}
-	.st124{fill:#2E2E2E;}
-	.st125{fill:none;stroke:#EE0000;stroke-width:1.5354;stroke-miterlimit:10;}
-	.st126{fill:none;stroke:#EE0000;stroke-width:6.9095;stroke-miterlimit:10;}
-	.st127{fill:#FFFFFF;stroke:#DEDEDE;stroke-width:1.8704;stroke-miterlimit:10;}
-	.st128{fill:none;stroke:#EE0000;stroke-width:1.4025;stroke-linecap:round;stroke-miterlimit:10;}
-	.st129{clip-path:url(#SVGID_00000174566254552292606640000016359272541058496935_);fill:#C9C9C9;}
-	.st130{fill:none;stroke:#DEDEDE;stroke-width:1.8704;stroke-miterlimit:10;}
-	.st131{clip-path:url(#SVGID_00000026882444298494810640000006477025923400810642_);}
-	.st132{clip-path:url(#SVGID_00000111163231907425820710000017462925419646612872_);fill:#EE0000;}
-	.st133{clip-path:url(#SVGID_00000111163231907425820710000017462925419646612872_);}
-	.st134{fill:none;stroke:#DEDEDE;stroke-width:0.7677;stroke-miterlimit:10;}
-	.st135{fill:none;stroke:#000000;stroke-width:0.8061;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st136{clip-path:url(#SVGID_00000012446783136329012280000014905043656953640632_);fill:#F56D6D;}
-	.st137{fill:none;stroke:#F56D6D;stroke-width:0.7677;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st138{clip-path:url(#SVGID_00000173122830956378347500000013993213955844337542_);fill:#F56D6D;}
-	.st139{clip-path:url(#SVGID_00000080899059377733137340000007340890177540968332_);}
-	.st140{fill:none;stroke:#5F0000;stroke-width:1.6569;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st141{fill:none;stroke:#000000;stroke-width:1.5354;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st142{fill:none;stroke:#EE0000;stroke-width:3.0709;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st143{fill:none;stroke:#5F0000;stroke-width:1.6569;stroke-linecap:round;stroke-miterlimit:10;}
-	.st144{fill:none;stroke:#F3F3F3;stroke-width:1.2071;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st145{clip-path:url(#SVGID_00000068641291138106409800000011620504687806063524_);fill:#5F0000;}
-	.st146{fill:none;stroke:#EE0000;stroke-width:1.334;stroke-linecap:round;stroke-miterlimit:10;}
-	.st147{fill:none;stroke:#EE0000;stroke-width:1.334;stroke-miterlimit:10;}
-	.st148{fill:none;stroke:#EE0000;stroke-width:6.0028;stroke-miterlimit:10;}
-	.st149{fill:#FFFFFF;stroke:#DEDEDE;stroke-width:1.6249;stroke-miterlimit:10;}
-	.st150{fill:none;stroke:#EE0000;stroke-width:1.2185;stroke-linecap:round;stroke-miterlimit:10;}
-	.st151{clip-path:url(#SVGID_00000150096592059499158860000010900178948281710470_);fill:#C9C9C9;}
-	.st152{fill:none;stroke:#DEDEDE;stroke-width:1.6249;stroke-miterlimit:10;}
-	.st153{clip-path:url(#SVGID_00000137834980472026085670000002753745244574823072_);}
-	.st154{clip-path:url(#SVGID_00000165924632876083039310000009529279545505905051_);fill:#EE0000;}
-	.st155{clip-path:url(#SVGID_00000165924632876083039310000009529279545505905051_);}
-	.st156{fill:none;stroke:#DEDEDE;stroke-width:0.667;stroke-miterlimit:10;}
-	.st157{fill:none;stroke:#000000;stroke-width:0.7003;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st158{clip-path:url(#SVGID_00000116212318332953135240000007611814934741604261_);fill:#F56D6D;}
-	.st159{fill:none;stroke:#F56D6D;stroke-width:0.667;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st160{clip-path:url(#SVGID_00000083059793431339903430000005578127512728447667_);fill:#F56D6D;}
-	.st161{clip-path:url(#SVGID_00000150818466296814771810000014277308594035853237_);}
-	.st162{fill:none;stroke:#5F0000;stroke-width:1.4395;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st163{fill:none;stroke:#000000;stroke-width:1.334;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st164{fill:none;stroke:#EE0000;stroke-width:2.6679;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st165{fill:none;stroke:#5F0000;stroke-width:1.4395;stroke-linecap:round;stroke-miterlimit:10;}
-	.st166{fill:none;stroke:#F3F3F3;stroke-width:1.0487;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
-	.st167{clip-path:url(#SVGID_00000166638570600685955120000010424802414485368979_);fill:#5F0000;}
-	.st168{clip-path:url(#SVGID_00000124872981973017353780000006374056794333574037_);}
-	.st169{clip-path:url(#SVGID_00000072987508624033663720000013749633848115108498_);fill:#C9C9C9;}
-	.st170{clip-path:url(#SVGID_00000075156294089137249400000014363128133458251141_);}
-	.st171{clip-path:url(#SVGID_00000125567235255620526170000017093376311056768175_);fill:#EE0000;}
-	.st172{clip-path:url(#SVGID_00000125567235255620526170000017093376311056768175_);}
-	.st173{clip-path:url(#SVGID_00000050633586613344266130000001428914092805440132_);fill:#F56D6D;}
-	.st174{clip-path:url(#SVGID_00000146469417322526492750000015543559239464545419_);fill:#F56D6D;}
-	.st175{clip-path:url(#SVGID_00000076561343087716053130000004699866100645341879_);}
-	.st176{clip-path:url(#SVGID_00000118399179700397791620000016299840000906329783_);fill:#5F0000;}
-	.st177{display:none;}
-	.st178{display:inline;}
-</style>
-<g id="Art">
-	<rect class="st0" width="627" height="1080"/>
-	<g>
-		<defs>
-			<rect id="SVGID_00000030478150072949898910000000573185149040828305_" width="627" height="1080"/>
-		</defs>
-		<clipPath id="SVGID_00000091701908906138057560000011345483664930876597_">
-			<use xlink:href="#SVGID_00000030478150072949898910000000573185149040828305_"  style="overflow:visible;"/>
-		</clipPath>
-		<g style="clip-path:url(#SVGID_00000091701908906138057560000011345483664930876597_);">
-			<path class="st79" d="M412.6,761.1h-11.5v-30.8h11.5c4.4,0,8,3.6,8,8v14.8C420.6,757.5,417,761.1,412.6,761.1z"/>
-			<path class="st5" d="M461.2,207.2c-4.6,0-8.8,0.5-12.6,1.5c0-0.4,0-0.8,0-1.2c0-19.9-16.1-36-36-36c-17.6,0-32.2,12.6-35.4,29.2
-				c-2.5-0.6-5-1-7.7-1c-16.7,0-30.2,13.5-30.2,30.2s13.5,30.2,30.2,30.2h93.3c14.6,0,26.4-11.8,26.4-26.4
-				C489.1,219,477,207.2,461.2,207.2z"/>
-			<path class="st5" d="M-126.5,255.6c-54.1,49.7-48.3,133.4-10.3,180.9S-20.5,520.2,8.8,651.5s69.8,226.1,197.3,232.2
-				s175.8-87.9,175.8-165.5c0-32.1,7.2-64.7,22.4-93.1c9.3-17.3,22.3-32,37.5-44.3c14.9-12,33-20.3,46.8-33.5
-				c26.7-25.6,38.5-63.9,33.4-100.3c-1.9-13.4-6-26.6-12.2-38.6c-15-29.2-43.8-50.3-75.3-58.5c-24.1-6.2-50.1-5.5-74.8-5.3
-				c-30.7,0.2-61.4,1.4-92.1,0.2c-27.1-1-55.6-3.1-81-13.3c-1.5-0.6-3-1.2-4.5-1.9c-66.4-30.2-116.3-78.4-170.6-94.8
-				S-94.6,226.3-126.5,255.6z"/>
-			<polygon class="st1" points="211.1,224.3 211.1,286.6 211.1,348.9 211.1,411.1 211.1,473.4 399.5,473.4 399.5,411.1 399.5,348.9 
-				399.5,286.6 399.5,224.3 			"/>
-			<polygon class="st80" points="211.1,224.3 211.1,286.6 211.1,348.9 211.1,411.1 211.1,473.4 399.5,473.4 399.5,411.1 
-				399.5,348.9 399.5,286.6 399.5,224.3 			"/>
-			<g>
-				<g>
-					<rect x="197.4" y="224.3" class="st2" width="188.4" height="62.3"/>
-					<g>
-						<circle class="st1" cx="356.3" cy="245.9" r="4.3"/>
-						<circle class="st7" cx="356.3" cy="265" r="4.3"/>
-					</g>
-					<line class="st81" x1="218.4" y1="255.4" x2="317.8" y2="255.4"/>
-				</g>
-				<rect x="197.4" y="286.6" class="st2" width="188.4" height="62.3"/>
-				<g>
-					<line class="st81" x1="361.9" y1="302.9" x2="361.9" y2="332.5"/>
-					<line class="st81" x1="344.2" y1="302.9" x2="344.2" y2="332.5"/>
-				</g>
-				<g>
-					<circle class="st7" cx="283.8" cy="317.7" r="4.3"/>
-					<circle class="st7" cx="258.4" cy="317.7" r="4.3"/>
-					<circle class="st1" cx="233" cy="317.7" r="4.3"/>
-				</g>
-			</g>
-			<g>
-				<g>
-					<rect x="197.4" y="348.9" class="st2" width="188.4" height="62.3"/>
-					<g>
-						<circle class="st1" cx="356.3" cy="370.4" r="4.3"/>
-						<circle class="st7" cx="356.3" cy="389.6" r="4.3"/>
-					</g>
-					<line class="st81" x1="218.4" y1="380" x2="317.8" y2="380"/>
-				</g>
-				<rect x="197.4" y="411.1" class="st2" width="188.4" height="62.3"/>
-				<g>
-					<line class="st81" x1="361.9" y1="427.5" x2="361.9" y2="457.1"/>
-					<line class="st81" x1="344.2" y1="427.5" x2="344.2" y2="457.1"/>
-				</g>
-				<g>
-					<circle class="st1" cx="283.8" cy="442.3" r="4.3"/>
-					<circle class="st7" cx="258.4" cy="442.3" r="4.3"/>
-					<circle class="st7" cx="233" cy="442.3" r="4.3"/>
-				</g>
-			</g>
-			<path class="st1" d="M395.4,783.8h-27.3c-4.4,0-8-3.6-8-8v-45.5h43.2v45.5C403.4,780.3,399.8,783.8,395.4,783.8z"/>
-			<path class="st9" d="M395.4,783.8h-13.6v-53.5h21.6v45.5C403.4,780.3,399.8,783.8,395.4,783.8z"/>
-			<g>
-				<rect x="197.4" y="224.3" class="st80" width="188.4" height="62.3"/>
-				<rect x="197.4" y="286.6" class="st80" width="188.4" height="62.3"/>
-				<rect x="197.4" y="348.9" class="st80" width="188.4" height="62.3"/>
-				<rect x="197.4" y="411.1" class="st80" width="188.4" height="62.3"/>
-			</g>
-			<path class="st82" d="M162.9,453.1c0,30.7-23,56-52.7,59.6c-2,0.3-4,0.5-6,0.5h-218.9c-26.4,0-47.9-21.4-47.9-47.9
-				c0-26.4,21.4-47.9,47.9-47.9c8.6,0,16.7,2.3,23.7,6.3c4.2-39.3,39.5-77.3,91.3-77.3c32.6,0,65,20.5,76.4,49.4
-				c8.1-1.9,16.9-2.8,26.2-2.8C136,393,162.9,419.9,162.9,453.1z"/>
-			<polyline class="st80" points="-67.2,513 -67.2,784.6 426.6,784.6 			"/>
-			<line class="st83" x1="356.9" y1="730.3" x2="406.7" y2="730.3"/>
-			<g>
-				<g>
-					<rect x="288.2" y="528" class="st1" width="162.8" height="15.3"/>
-					<rect x="330.1" y="556.3" class="st1" width="70.3" height="15.3"/>
-					<g>
-						<defs>
-							<rect id="SVGID_00000098198498282565201720000006500919177504849079_" x="420.5" y="556.3" width="155.7" height="15.3"/>
-						</defs>
-						<use xlink:href="#SVGID_00000098198498282565201720000006500919177504849079_"  style="overflow:visible;fill:#FAB6B6;"/>
-						<clipPath id="SVGID_00000122692942108225823270000004227092211703644576_">
-							<use xlink:href="#SVGID_00000098198498282565201720000006500919177504849079_"  style="overflow:visible;"/>
-						</clipPath>
-						<path style="clip-path:url(#SVGID_00000122692942108225823270000004227092211703644576_);fill:#C9C9C9;" d="M-126.5,255.6
-							c-54.1,49.7-48.3,133.4-10.3,180.9S-20.5,520.2,8.8,651.5s69.8,226.1,197.3,232.2s175.8-87.9,175.8-165.5
-							c0-32.1,7.2-64.7,22.4-93.1c9.3-17.3,22.3-32,37.5-44.3c14.9-12,33-20.3,46.8-33.5c26.7-25.6,38.5-63.9,33.4-100.3
-							c-1.9-13.4-6-26.6-12.2-38.6c-15-29.2-43.8-50.3-75.3-58.5c-24.1-6.2-50.1-5.5-74.8-5.3c-30.7,0.2-61.4,1.4-92.1,0.2
-							c-27.1-1-55.6-3.1-81-13.3c-1.5-0.6-3-1.2-4.5-1.9c-66.4-30.2-116.3-78.4-170.6-94.8S-94.6,226.3-126.5,255.6z"/>
-					</g>
-				</g>
-				
-					<rect x="471.1" y="528" transform="matrix(-1 -1.224647e-16 1.224647e-16 -1 998.9557 1071.3041)" class="st13" width="56.9" height="15.3"/>
-			</g>
-			<path class="st85" d="M162.9,453.1c0,30.7-23,56-52.7,59.6c-2,0.3-4,0.5-6,0.5h-218.9c-26.4,0-47.9-21.4-47.9-47.9
-				c0-26.4,21.4-47.9,47.9-47.9c8.6,0,16.7,2.3,23.7,6.3c4.2-39.3,39.5-77.3,91.3-77.3c32.6,0,65,20.5,76.4,49.4
-				c8.1-1.9,16.9-2.8,26.2-2.8C136,393,162.9,419.9,162.9,453.1z"/>
-			<path class="st85" d="M-66.2,397.8c3.6-5.9,8.1-11.3,13.3-16c10-9.1,27.3-19.9,53.1-19.9c6.6,0,13.3,1.1,19.6,3"/>
-			<g>
-				<defs>
-					<path id="SVGID_00000131332644888028706030000004590838571574609547_" d="M-126.5,255.6c-54.1,49.7-48.3,133.4-10.3,180.9
-						S-20.5,520.2,8.8,651.5s69.8,226.1,197.3,232.2s175.8-87.9,175.8-165.5c0-32.1,7.2-64.7,22.4-93.1c9.3-17.3,22.3-32,37.5-44.3
-						c14.9-12,33-20.3,46.8-33.5c26.7-25.6,38.5-63.9,33.4-100.3c-1.9-13.4-6-26.6-12.2-38.6c-15-29.2-43.8-50.3-75.3-58.5
-						c-24.1-6.2-50.1-5.5-74.8-5.3c-30.7,0.2-61.4,1.4-92.1,0.2c-27.1-1-55.6-3.1-81-13.3c-1.5-0.6-3-1.2-4.5-1.9
-						c-66.4-30.2-116.3-78.4-170.6-94.8S-94.6,226.3-126.5,255.6z"/>
-				</defs>
-				<clipPath id="SVGID_00000181074001035392061590000015592144580685155736_">
-					<use xlink:href="#SVGID_00000131332644888028706030000004590838571574609547_"  style="overflow:visible;"/>
-				</clipPath>
-				<g style="clip-path:url(#SVGID_00000181074001035392061590000015592144580685155736_);">
-					<rect x="420.5" y="556.3" class="st1" width="155.7" height="15.3"/>
-					
-						<rect x="471.1" y="528" transform="matrix(-1 -1.224647e-16 1.224647e-16 -1 998.9557 1071.3041)" class="st1" width="56.9" height="15.3"/>
-				</g>
-			</g>
-			<g>
-				<g>
-					<rect x="5.7" y="193.6" width="166.6" height="187.4"/>
-				</g>
-				<rect x="-1.9" y="186" class="st2" width="166.6" height="187.4"/>
-				<g>
-					<defs>
-						<rect id="SVGID_00000114066785860905654030000015037738350416964267_" x="-1.9" y="186" width="166.6" height="187.4"/>
-					</defs>
-					<clipPath id="SVGID_00000011015769419845100900000018157497980372406161_">
-						<use xlink:href="#SVGID_00000114066785860905654030000015037738350416964267_"  style="overflow:visible;"/>
-					</clipPath>
-					<path style="clip-path:url(#SVGID_00000011015769419845100900000018157497980372406161_);fill:#EE0000;" d="M-9.6,300
-						c3.3-0.8,16.1-3.5,23.5-1.4s9.4,5.6,11.1,11.4l1.4,46.2l-46.6-0.9L-9.6,300z"/>
-					<polygon style="clip-path:url(#SVGID_00000011015769419845100900000018157497980372406161_);" points="125.3,368.8 
-						150.1,308.1 181.5,308.1 158.9,368.9 					"/>
-				</g>
-			</g>
-			<path class="st13" d="M41.9,281.6c-2,3.8-6,7.2-9.6,9.3c-3.5,2.1-5.8,3.8-5.8,3.8s6.7-0.2,11.5,2.5s13,22.5,17.5,28.3
-				s14,9.4,18.1,8.1c1.9-0.6,2.3,0.2,2.3,0.2s-6.2-7.9-10.8-16.3c-4.6-8.4-5.8-12.1-4.5-16.9c1.3-4.8-11.4-18.6-11.4-18.6
-				L41.9,281.6z"/>
-			<path class="st89" d="M94,279.1c0,0-1.7,1.2-2,1.7c-0.3,0.5-4.1-2.9-4.6-6.1c-0.5-3.1,3-2.3,3-2.3L94,279.1z"/>
-			<path class="st13" d="M108,238.9c0.4,1.9,0.1,8.8-0.8,12.2c-1.6,6-3.4,7.4-4.6,10s-0.3,6.8,2,12.4c0.9,2.3-0.3,3.4-2.7,3.1
-				s-4.4-1.4-4.4-1.4s-1.4,1.5-0.7,2.8c0.7,1.3-2.2,1.5-2.7,1.6c0,0-2.2-1.2-3.9-3.3c-1.7-2-2.9-1.8-2.2,2c0.7,3.8,2.1,4.7,2.1,4.7
-				s0,1.6-0.7,2.5c-0.7,0.9-1.8-0.5-3.1,1.7s-2.3,4-4.6,3.9c-2.3-0.1-6.2-2.1-8.9-6.7c0,0-1.3-1.3-4.6,1.7c-3.3,3-6.2,9.6-7.4,14.3
-				c0,0-2.9,2.3-9.6-1.3s-9.4-17.7-9.4-17.7s13.9-33.9,23.1-42.5c9.3-8.7,23.1-13.4,31.9-11.3C105.7,230,108,238.9,108,238.9z"/>
-			<path class="st90" d="M92.9,258c0,0-0.2,1.2,1.2,1.1c1.4-0.1,3.4-0.3,4.2,0.2c0.8,0.8,0.2,1.6,0.2,1.6s0.1,0.8,1.5,0.8"/>
-			<path d="M98.6,260.6c0,0-1,1.4-2.5,1.8c0,0-0.7-0.9-0.9-1.1c0,0,1-1.6,1.9-1.9c0.9-0.2,1.4,0.2,1.6,0.4
-				C98.8,260.2,98.6,260.6,98.6,260.6z"/>
-			<path d="M90.6,252.3c0,0,3-0.5,5.2,0s4.2,2.2,5,3c0.8,0.9,1.7,1.4,1.7,1.4s1.4,0,2-1c0,0-3.8-4.1-7.1-4.7S90.6,252.3,90.6,252.3z
-				"/>
-			<path class="st20" d="M26.6,294.7c0,0,3.5-1.9,7.8-1.3s9.3,3.9,13.5,12.6s7.6,19.4,13.1,23.6c4.5,3.4,9.2,3.4,13.4,1.8
-				c0,0,6.3,7.2,8.6,11.1c2.3,3.8,2,12.2-4.9,17.3c-2.2,1.6-3.8,12.2-3.9,12.8H20.9c0,0-5.2-27.8-4.6-41.8c0.6-14-1.2-20.1-0.2-23.9
-				S23.1,297.2,26.6,294.7z"/>
-			<path d="M40.8,325.8c0,0-5.7,19.3-7.8,28.5c-2.1,9.2,0.5,20,0.5,20l8.5,0.2c0,0-2.1-13.3-2.1-27.4
-				C40,333.1,40.8,325.8,40.8,325.8z"/>
-			<path class="st13" d="M9,347.7c0,0,0.1,16.3,3.7,26.1h22.7c0,0-1.5-13.5,0.4-25.3c1.9-11.8-14.3-11.5-16-11.5
-				C18,337,9.4,337.2,9,347.7z"/>
-			<path class="st20" d="M15.6,307.6c1.4-3.3,6-8.6,8-9.5s7.3-2,12.7,4.7c5.4,6.7,5.4,16.5,4.5,23c-0.9,6.5-4.2,16.4-5.1,22.7
-				c0,0-0.7-1.6-12.1-2.5C12.2,345.2,9,347.7,9,347.7s0.1-9.5,1.1-19.2C11,318.8,13,313.7,15.6,307.6z"/>
-			<g>
-				<path class="st13" d="M106.8,358c2.2,1.5,6.1,3.5,6.9,3.9c0.8,0.4,6,5.6,6.5,6s0.2,1-0.9,1.1c-1.1,0.1-2.1-0.9-2.1-0.9l-6.4-4"
-					/>
-				<path class="st13" d="M118.3,369.3c-1.1,0.2-2.5-0.5-3.2-1c-0.7-0.5-3.4-2.3-3.4-2.3c-0.7-0.4-3.4-2-3.6-2.1
-					c0.1,0.2,1.7,1.8,2.4,2.6c0.9,1.1,2.3,3.4,2.3,3.4s-1,0.4-1.7,0c-0.7-0.4-3.1-2.4-4.3-3.3c-1.2-0.8-4.8-1.5-4.8-1.5
-					c-1.4-0.2-5.2,0.1-7.7,0.3c-2.6,0.3-4.4-0.3-5.9-1c-1.2-0.5-2.1-0.7-4-0.3c-1.9,0.3-4.8,1.9-8.7,4.8l-6.5,4.3
-					c-3.4,0-20.9,0.9-20.9,0.9s23.4-14,28.5-16.4c5.2-2.3,10.5-3.5,14.4-3c3.9,0.5,8.1,0.8,10,0.9c1.9,0.1,2.3-0.1,4.1,1.1
-					c0.8,0.5,3.7,3.5,6.6,5.1c1.5,0.8,4.1,4.4,5.5,5.2C118.6,367.8,118.9,369.2,118.3,369.3z"/>
-			</g>
-			<polygon points="121.4,368.8 155.2,368.8 155.2,373 64.3,373 64.3,368.9 			"/>
-			<rect x="-1.9" y="186" class="st80" width="166.6" height="187.4"/>
-			<g>
-				<defs>
-					<path id="SVGID_00000124151004977291594090000009204928939703776907_" d="M108,238.9c0.4,1.9,0.1,8.8-0.8,12.2
-						c-1.6,6-3.4,7.4-4.6,10s-0.3,6.8,2,12.4c0.9,2.3-0.3,3.4-2.7,3.1s-4.4-1.4-4.4-1.4s-1.4,1.5-0.7,2.8c0.7,1.3-2.2,1.5-2.7,1.6
-						c0,0-2.2-1.2-3.9-3.3c-1.7-2-2.9-1.8-2.2,2c0.7,3.8,2.1,4.7,2.1,4.7s0,1.6-0.7,2.5c-0.7,0.9-1.8-0.5-3.1,1.7s-2.3,4-4.6,3.9
-						c-2.3-0.1-6.2-2.1-8.9-6.7c0,0-1.3-1.3-4.6,1.7c-3.3,3-6.2,9.6-7.4,14.3c0,0-2.9,2.3-9.6-1.3s-9.4-17.7-9.4-17.7
-						s13.9-33.9,23.1-42.5c9.3-8.7,23.1-13.4,31.9-11.3C105.7,230,108,238.9,108,238.9z"/>
-				</defs>
-				<clipPath id="SVGID_00000143608525723932860630000016065321821723656112_">
-					<use xlink:href="#SVGID_00000124151004977291594090000009204928939703776907_"  style="overflow:visible;"/>
-				</clipPath>
-				<path style="clip-path:url(#SVGID_00000143608525723932860630000016065321821723656112_);fill:#F56D6D;" d="M72.8,284.6
-					c-3.7-8.1-3.2-15.2-3.2-15.2l-7.1,28.1"/>
-			</g>
-			<path d="M93.8,221.8c0,0-9.3-5.5-19.6-4c-10.3,1.4-17,6.3-21,13.8c-4,7.4-4.9,17.5-5.9,21.1c-1,3.6-3.5,5-7.2,5.8
-				c-3.8,0.8-8.8,2.5-9.8,7.1S27.7,278,25,278.3s-7,0.4-9,4.2c-2.1,3.8-1.4,11.3,2.9,13.1c4.4,1.9,9.4,0.5,11.9-1.4
-				c0,0,8,5.5,18.3,3.3c10.3-2.1,14-13.5,14.6-18.6c0.5-5.1,1.5-22.2,5.7-26.9c4.3-4.7,9.2-3.6,9.2-3.6s0.8,1.4,3.1,1.3
-				c2.3-0.2,8.7-1.9,13.8-6.4c5.1-4.6,10.5-3.3,12.6-0.9c0,0,4.7,0.1,8.4-3.4s5.3-14.2-2.2-18.7c-7.5-4.5-13.9-0.7-14.7,1.7
-				c-0.7,2.4-0.2,3.5-0.2,3.5S96.3,223.1,93.8,221.8z"/>
-			<path class="st13" d="M78.6,248.5c0,0-0.4-2.9-3.4-4c-2.9-1.1-5.6,2.3-6,6.2s0.2,8.5,2.7,9.5c2.5,1,3.5-0.7,3.5-0.7"/>
-			<path class="st92" d="M78.6,248.5c0,0-0.4-2.9-3.4-4c-2.9-1.1-5.6,2.3-6,6.2s0.2,8.5,2.7,9.5c2.5,1,3.5-0.7,3.5-0.7"/>
-			<g>
-				<defs>
-					<path id="SVGID_00000109747587975565709820000008243379611192448689_" d="M108,238.9c0.4,1.9,0.1,8.8-0.8,12.2
-						c-1.6,6-3.4,7.4-4.6,10s-0.3,6.8,2,12.4c0.9,2.3-0.3,3.4-2.7,3.1s-4.4-1.4-4.4-1.4s-1.4,1.5-0.7,2.8c0.7,1.3-2.2,1.5-2.7,1.6
-						c0,0-2.2-1.2-3.9-3.3c-1.7-2-2.9-1.8-2.2,2c0.7,3.8,2.1,4.7,2.1,4.7s0,1.6-0.7,2.5c-0.7,0.9-1.8-0.5-3.1,1.7s-2.3,4-4.6,3.9
-						c-2.3-0.1-6.2-2.1-8.9-6.7c0,0-1.3-1.3-4.6,1.7c-3.3,3-6.2,9.6-7.4,14.3c0,0-2.9,2.3-9.6-1.3s-9.4-17.7-9.4-17.7
-						s13.9-33.9,23.1-42.5c9.3-8.7,23.1-13.4,31.9-11.3C105.7,230,108,238.9,108,238.9z"/>
-				</defs>
-				<clipPath id="SVGID_00000098916397546184520180000007468261681619521937_">
-					<use xlink:href="#SVGID_00000109747587975565709820000008243379611192448689_"  style="overflow:visible;"/>
-				</clipPath>
-				<path style="clip-path:url(#SVGID_00000098916397546184520180000007468261681619521937_);fill:#F56D6D;" d="M88.5,275.2
-					c0.8-0.2,2,0.5,2.9,1.1c1.1,0.7,2.3,1.4,3.4,2.2c0.7,0.5,1.7,0.7,2.5,0.9l-6.8,6.1l-0.7,0.1c0,0-1.1-0.7-1.8-3.6
-					C87.3,279.3,87,275.8,88.5,275.2z"/>
-			</g>
-			<path d="M70.2,218.7c4.3-1.6,11.8-2.8,22,0c10.2,2.8,14.1,7.8,14.1,7.8l-4.4,4.9"/>
-			<path class="st1" d="M223.3,682l11.2,102.5H57c0.8-10.5,3.1-32.3,1.1-40.9c-3.5-14.6-6.1-38.5-7.9-59.9l-0.1,0h-9.8l-42-6.7
-				l-16-5.1c0,0,4-20.5,9.7-37.9c5.7-17.4,18-51,34.6-65.9c16.6-14.9,43.9-18,59.5-20.8c0.6-0.1,1.1-0.3,1.7-0.4
-				c6.7-1.7,8.3-2.7,16.1-8.9c8.5-6.7,21.7-31.5,24-39.3c2.3-7.8,3.5-16.9,3.1-20.1c-0.1-1.1-0.4-3-0.7-5l9.4-3.4
-				c0,0,27.5,61.9,25.9,66.5c-1.6,4.5-3.4,9.1-3.4,9.1c-0.5,1.3,4.3,6.6,7.8,9.3c1.5,1.2,2.8,2,3.2,2.3c4.2,2.7,8.9,4.8,13.7,6.1
-				c20.5,5.5,51.2,14.4,53.4,43.9c1.6,21.7,12.6,61.9,12.6,61.9L223.3,682z"/>
-			<g>
-				<g>
-					<defs>
-						<path id="SVGID_00000165206872934833681660000008342438903769357482_" d="M223.3,682l11.2,102.5H57
-							c0.8-10.5,3.1-32.3,1.1-40.9c-3.5-14.6-6.1-38.5-7.9-59.9l-0.1,0h-9.8l-42-6.7l-16-5.1c0,0,4-20.5,9.7-37.9
-							c5.7-17.4,18-51,34.6-65.9c16.6-14.9,43.9-18,59.5-20.8c0.6-0.1,1.1-0.3,1.7-0.4c6.7-1.7,8.3-2.7,16.1-8.9
-							c8.5-6.7,21.7-31.5,24-39.3c2.3-7.8,3.5-16.9,3.1-20.1c-0.1-1.1-0.4-3-0.7-5l9.4-3.4c0,0,27.5,61.9,25.9,66.5
-							c-1.6,4.5-3.4,9.1-3.4,9.1c-0.5,1.3,4.3,6.6,7.8,9.3c1.5,1.2,2.8,2,3.2,2.3c4.2,2.7,8.9,4.8,13.7,6.1
-							c20.5,5.5,51.2,14.4,53.4,43.9c1.6,21.7,12.6,61.9,12.6,61.9L223.3,682z"/>
-					</defs>
-					<clipPath id="SVGID_00000133495410729533208770000013054651250329891469_">
-						<use xlink:href="#SVGID_00000165206872934833681660000008342438903769357482_"  style="overflow:visible;"/>
-					</clipPath>
-					<g style="clip-path:url(#SVGID_00000133495410729533208770000013054651250329891469_);">
-						<path d="M97.6,548c-14.1,2.6-55.6,7.9-69.3,27.8S0.5,648.6-2.7,673c-3.2,24.4-25.1,0.4-25.1,0.4L0.3,571.7l45-33l29.1-3.6
-							l19.3,4.1L97.6,548z"/>
-					</g>
-					<path style="clip-path:url(#SVGID_00000133495410729533208770000013054651250329891469_);" d="M68.8,620.1c0,0-7.8,20.8-3,54.3
-						c3.2,22.6,13.1,66.6,5.7,115c-7.9,52-21.5,3.4-21.5,2.5c0-0.9-1.8-108.4-1.8-108.4l4.5-0.4c0,0,7.6-44.5,10.3-52.1
-						C65.7,623.4,68.8,620.1,68.8,620.1z"/>
-				</g>
-			</g>
-			<path class="st25" d="M170.1,555.2c-1.6,5.9-2.7,16.1-25.1,13.7c-20.1-2.2-45.2-18.7-51.1-23.9c2.8-1.3,5.2-3.1,10.1-6.9
-				c8.5-6.7,21.7-31.5,24-39.3c2.3-7.8,3.5-16.9,3.1-20.1c-0.1-1.1-0.4-3-0.7-5l9.4-3.4c0,0,27.5,61.9,25.9,66.5
-				c-1.6,4.5-3.4,9.1-3.4,9.1C163.8,549.6,167.3,553,170.1,555.2z"/>
-			<path class="st26" d="M137.6,471.1c0,2.9-0.2,6.2-0.7,9.9c-3.6,29.6-15.4,45.6-22.8,55c-5.3,6.8-11.6,10.1-16.6,12.1
-				c-1.6-1.2-2.9-2.2-3.7-2.9c2.8-1.3,5.2-3.1,10.1-6.9c8.5-6.7,21.7-31.5,24-39.3c2.3-7.8,3.5-16.9,3.1-20.1c-0.1-1.1-0.4-3-0.7-5
-				L137.6,471.1z"/>
-			<path class="st26" d="M170.1,555.2c1.5,8.7-5.3,12.1-13,13.6c-4.7-8.3-12.9-35.2-14.2-41.8c-1.6-7.7-0.3-17.4-0.3-17.4l6,3.7
-				l16.5,19.6c0.2,0.8,0.4,1.6,0.5,2.2c0,0.1,0,0.2,0.1,0.3c0,0.2,0.1,0.4,0.1,0.5c0,0.1,0,0.1,0,0.2c0,0.2,0,0.4,0,0.5
-				c0,0,0,0.1,0,0.1c0,0,0,0.1,0,0.1c-1.6,4.5-3.4,9.1-3.4,9.1C164.1,549.5,167.3,553,170.1,555.2z"/>
-			<path d="M213.6,612.1c0,0-4,7.5-4.7,12.5c-0.6,5.1-9,54.1-2.5,76.8l8.5-17.5c0,0-5.6-33.4-3.8-56.3
-				C211.5,622,213.6,612.1,213.6,612.1z"/>
-			<path class="st25" d="M224.6,455.4c1.6,8-3.4,22.4-4.2,25.6c-1.5,6.4-5.8,7.1-7.5,8.8c-1.7,1.7-2,8-4.9,16.4
-				c-2.9,8.5-5.9,7.9-16.8,20.9c-10.9,12.9-16.4,17.8-20,16.8c-3.6-1-11-4.8-17.6-12.1c-6.6-7.2-10.4-15.2-12.6-26.6
-				c-2.2-11.4,0.3-30.7,6.2-45.9c5.9-15.2,30.2-38.8,48-31.7S224.6,455.4,224.6,455.4z"/>
-			<path class="st26" d="M131.9,492.1c0,0,13.7-2.8,16.2-25.2l-12.7,9.5"/>
-			<path d="M147.3,465.5c2.5,3.2,5.9,1.2,7.3-1.8c1.4-2.9,6.8-12.8,11.1-15.2c4.3-2.4,8.5-0.5,8.5-0.5c1.7-4.8,6.2-14.2,11.7-11.8
-				c5.2,2.2,31.4,23.7,39.1,21.1c0,0,1.7-3.5,1.6-5c-0.1-2.4-1-5.4-2.3-8.6c-2.2-5.4-7.5-15.9-16.7-23.9c-4.4-3.9-10-6.7-16-9.1
-				c-18.6-7.2-42.6-0.2-52.5,12.9c-16.6,22-8.3,43.8-8.3,43.8L147.3,465.5z"/>
-			<path d="M218.6,482.4c-0.7-1.5-3.5-3.5-6.8-3.3c-3.3,0.2-5.4,0.9-5.6,0.6c-0.2-0.3,1.5-3.3,5.3-3.6c3.8-0.3,5.4,0.5,6.6,1.4
-				c1.2,0.8,1.9,2.4,2,3.7c0.1,1.4-1.1,3.5-1.1,3.3C219,484.3,219.4,484.1,218.6,482.4z"/>
-			<path d="M195.4,473c0.5-0.6,0.9-1.7,0.1-3.7s-9.1-8.7-14.7-8.8c-5.6-0.1-9.5,3.3-10.5,4.1c-1,0.8-2.4,3.5-2.4,3.5
-				s6.8-2.9,13.9-2.4C188.9,466.4,195.4,473,195.4,473z"/>
-			<ellipse transform="matrix(0.3194 -0.9476 0.9476 0.3194 -331.1777 500.8143)" cx="183.1" cy="481" rx="4.9" ry="4"/>
-			<path class="st25" d="M174.3,473c0,0,1.9,0.7,2.9,0.8c0,0,2.6,2.5,6.8,3.8c4.2,1.3,5.2,1,5.8,1.7c0.6,0.7,1,1.6,1,1.6l2.1-5.1
-				l-2.5-4.6l-10.3-2.6"/>
-			<ellipse transform="matrix(0.3883 -0.9215 0.9215 0.3883 -324.0901 492.4334)" cx="208.9" cy="490.3" rx="4.2" ry="2.3"/>
-			<path class="st25" d="M205.8,492c0,0,2,1.5,4.4,1.7c0,0-1.9,1.4-3.2,0.6C205.8,493.5,205.8,492,205.8,492z"/>
-			<path d="M170.4,504c0,0-2.1,4.1,0,10.6c1.3,4,6.6,9.2,12.4,9.9c2.5,0.3,4.4-0.9,7.4-5.1c1.4-1.9,2.9-2.2,2.9-2.2s-6.9-0.7-14.4-5
-				C171.1,507.9,170.4,504,170.4,504z"/>
-			<path class="st2" d="M191,516.9c0,0,0,0.1-0.1,0.1c-0.4,0.7-1.6,3-2.1,3.6c0,0-1.5,0.4-4.1,0c-2.4-0.4-5.7-1.6-7.9-3.1
-				c-4.8-3.5-7.1-7.2-7.5-8c-0.1-3.4,0.9-5.4,0.9-5.4s0.7,3.9,8.2,8.2C183.7,515.1,188.4,516.3,191,516.9z"/>
-			<path class="st95" d="M170.4,504c0,0-2.1,4.1,0,10.6c1.3,4,6.6,9.2,12.4,9.9c2.5,0.3,4.4-0.9,7.4-5.1c1.4-1.9,2.9-2.2,2.9-2.2
-				s-6.9-0.7-14.4-5C171.1,507.9,170.4,504,170.4,504z"/>
-			<path class="st26" d="M169.3,523c0,0,2.9,2.6,5.3,4.1c2.5,1.5,3.6,1.5,3.9,2.1s-3.3,2.7-6.6,0.6S169.3,523,169.3,523z"/>
-			<rect x="170.9" y="776.7" class="st28" width="144.2" height="7.6"/>
-			<polygon points="170.9,784.2 86.2,784.2 83.4,776.7 170.9,776.7 			"/>
-			<path class="st96" d="M174.5,474.4c0,0,1.9,0.7,2.9,0.8c0,0,3,1.2,7.2,2.5c4.2,1.3,4.6,0.8,5.3,1.6c0.6,0.7,1,1.6,1,1.6"/>
-			<path class="st25" d="M178.5,482.4c0,0,3.6,2.5,6.9,2.7c0,0-3.5,1.9-5.2,1.3C178.6,485.7,178.5,482.4,178.5,482.4z"/>
-			<path class="st25" d="M212.8,487.6c0,0-0.1,0.6-0.8,0.4c-3.1-0.8-4.6-2.6-5.4-2.6s-2.2,0.7-2.2,0.7l5.7-6.2l5.3,0.9L212.8,487.6z
-				"/>
-			<path class="st96" d="M204.4,486.1c0,0,1.1-0.4,2-0.4s1.8,1.3,4.3,2.1c1.4,0.4,1.4,2,1.4,2s0.7,0.7,2,0.6"/>
-			<path class="st1" d="M180.9,407c-10.6-0.8-15.8,0.7-22.6,3.5c-1.5,0.6-3.8,1.9-5.1,2.9c-1.2,1-2.1,4.8-2.1,4.8l9-2.1
-				c2.4-0.7,4.2-1.5,4.2-1.5s4-2.3,15.1-3.2c5.4-0.4,12.7,0.7,18.5,3c5.4,2.1,9.5,5.4,9.5,5.4s-0.4-1.5-2.2-3.1
-				c-1.8-1.6-7.5-5.1-9-5.8C192.1,408.5,187.7,407.5,180.9,407z"/>
-			
-				<ellipse transform="matrix(0.1941 -0.981 0.981 0.1941 -346.8104 507.8661)" class="st20" cx="135.7" cy="465" rx="20.7" ry="12.5"/>
-			<path d="M137.8,465.6c-1.5,8.4-5.7,15.8-11.6,15c-0.2,0-0.4-0.1-0.6-0.1c0,0,0,0,0,0c-2.5-4.2-3.4-10.5-2.2-17.3
-				c1.4-8.1,5.5-14.6,10.3-17.3c0,0-1.4,3.4-1.4,3.4C136.7,450.8,139.2,457.8,137.8,465.6z"/>
-			<path class="st97" d="M129.9,473.7c0,0,8.7,21.2,11.3,25.2s9.7,9.4,9.7,9.4"/>
-			<path class="st31" d="M134,453.3c1.5-8.3,8.7-21.7,16.6-30.1c3-3.1,7.4-6.5,10.4-8.6c0.9-0.6,0.3-2-0.7-1.8
-				c-2.3,0.4-5.1,1.1-7.2,2.3c0,0-19.8,14.3-24.4,36.7L134,453.3z"/>
-			
-				<ellipse transform="matrix(0.1941 -0.981 0.981 0.1941 -350.3379 498.3344)" class="st1" cx="128.1" cy="462.4" rx="14.7" ry="8.9"/>
-			<path class="st98" d="M185.1,508c0,0,2.7,0.2,3.7,0.6c1,0.4,3.8,2.6,5.5,2.9c1.7,0.4,3,0.2,3.8-1.1s0.4-5.2,0.1-7.9
-				c-0.4-2.8-0.3-12.9,1.5-16.7c1.8-3.8,3.5-4.5,3.5-4.5"/>
-			<path class="st98" d="M181.1,504.8c0,0-2.1-1.7-0.4-4.4"/>
-			<path class="st98" d="M196.9,517.6c0,0-2,0.5-3.9-0.4c0,0-6.9-0.7-14.4-5c-7.5-4.3-8.2-8.2-8.2-8.2s-2.2-1.7-2.4-3.4"/>
-			<g>
-				<path class="st99" d="M131.2,452.1c0.4,0.3,0.7,0.7,1,1.1"/>
-				<path class="st99" d="M120.9,466.7c-0.2-1.6-0.2-3.4,0.2-5.3c0.9-5.4,3.9-9.6,6.9-10.2"/>
-			</g>
-			<ellipse transform="matrix(0.1547 -0.988 0.988 0.1547 -654.6464 590.0183)" cx="17.5" cy="677.6" rx="4.9" ry="35.6"/>
-			<path class="st3" d="M47,638.5c0,0,1,21,3.1,45.3c1.8,21.3,4.5,45.3,7.9,59.9c2.4,10.1-1.3,40.9-1.3,40.9h177.7L223.3,682
-				l29.8-12.5c0,0-10.1-29.8-12.6-61.9c-1.7-21.7-20.3-32.5-26.5-34.7c-6.2-2.2-11.4-5.9-23.2-8.3c-7.9-1.6-14.8-4.8-20.7-9.4"/>
-			<g>
-				<defs>
-					<path id="SVGID_00000030460306218417437520000012087255028741197485_" d="M192.1,738.9L180,758.4c0,0-1.4,1.1-2.6,0.1
-						c-1.3-1-1.4-5.9-1.7-7.2c-0.3-1.3-1.3-2.3-1.3-2.3c-1.9,0.6-14.9,12.5-18.7,14.7c-3.8,2.2-7.2,3.1-10.5,1.9
-						c-3.3-1.1-8.9-2.8-13.4-2.8c-4.6,0-52.4,0.5-76.5-1.3c-32.6-2.4-53.4-11.2-56.3-12.7s-3.5-3.1-3.9-10.8
-						c-0.3-7.7-0.8-39,3.1-67.6c0,0,0,0,0-0.1c5.8,0.4,12.8,1.1,20.3,2.3c12.3,1.9,23,4.5,29,6.8l-0.1,0.4
-						c-2.9,16.4-5.2,31.5-5.6,34.2c11.4,4.2,32.4,12.6,53.6,17c25.3,5.2,40,5.7,40,5.7c3.8,0,19.6-7.7,22.1-8.9
-						c2.5-1.1,2.7-1.1,4.3-1.1c1.6,0,3.4,1.2,3.4,1.2s4.9-0.8,6.7-0.5c1.8,0.3,3.7,2.3,3.7,2.3s3.7,0.3,5.5,0.7
-						C183,731,192.1,738.9,192.1,738.9z"/>
-				</defs>
-				<use xlink:href="#SVGID_00000030460306218417437520000012087255028741197485_"  style="overflow:visible;fill:#8F0000;"/>
-				<clipPath id="SVGID_00000030483204087296490950000010242438878764063123_">
-					<use xlink:href="#SVGID_00000030460306218417437520000012087255028741197485_"  style="overflow:visible;"/>
-				</clipPath>
-				<path style="clip-path:url(#SVGID_00000030483204087296490950000010242438878764063123_);fill:#5F0000;" d="M174.4,749.1
-					c-1.6-1.7-5.7-5.6-7.3-6.1s-6-3-7.1-3c0,0-6.9,3.2-11.9,8.5c-5,5.3-10.4,13.5-16.3,14.3l8.1,6.1c0,0,7.5,3.3,13.2,2.7
-					S167,764,167,764L174.4,749.1z"/>
-				<path style="clip-path:url(#SVGID_00000030483204087296490950000010242438878764063123_);fill:#5F0000;" d="M47.5,679.6
-					c0,0-35.5-4.1-51,8.1l-3.8-23.6l25.9-7.3h31.2l2.7,5.1"/>
-			</g>
-			<polygon points="358.8,668.3 208.9,668.3 170.9,776.7 319.6,776.7 362.1,670.7 			"/>
-			<path class="st98" d="M41.9,714.2c-11.7-4.6-20.5-2.3-20.5-2.3"/>
-			<g>
-				<polygon class="st28" points="358.8,668.3 208.9,668.3 212.4,670.7 362.1,670.7 				"/>
-			</g>
-			<line class="st80" x1="-67.2" y1="784.6" x2="426.6" y2="784.6"/>
-		</g>
-	</g>
-</g>
-<g id="Artboard_labels" class="st177">
-</g>
-</svg>
diff --git a/ui/apps/platform/src/images/hostname.svg b/ui/apps/platform/src/images/hostname.svg
deleted file mode 100644
index 255a610953b9e..0000000000000
--- a/ui/apps/platform/src/images/hostname.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg height="56" viewBox="0 0 56 56" width="56" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><circle cx="28" cy="28" fill="#e9f0ff" r="28"/><g fill-rule="nonzero" transform="translate(17 14)"><path d="m16.8831461 16.1510204c2.8612359-.2020408 5.0983146-2.6265306 5.0983146-5.5285714 0-2.522449-1.7303371-4.75714288-4.097191-5.37551022-.5067416-3.01836735-3.1269663-5.24693878-6.2724719-5.24693878-2.28033713 0-4.39382027 1.2244898-5.51853937 3.15918367-.21629214-.04285714-.44494382-.06122449-.66741573-.06122449-1.92191012 0-3.48539326 1.5489796-3.48539326 3.45306123 0 .24489796.0247191.48367347.0741573.71632653-1.24213483.89387755-1.99606741 2.33877551-1.99606741 3.86938776 0 2.5836735 2.09494382 4.8857143 4.5730337 5.0204082h.03707866 12.21741571c.0061798 0 .0247191 0 .0370787-.0061225z" fill="#fff" stroke="#345394" stroke-width="2"/><path d="m4.64101124 14.944898c-1.84775281-.1102041-3.39887641-1.8489796-3.39887641-3.8081633 0-1.26734694.68595506-2.4489796 1.79213483-3.08571429.25955057-.14693878.37078652-.45918368.26573034-.73469388-.09269663-.23877551-.13595506-.49591837-.13595506-.76530612 0-1.2367347 1.01348315-2.24081633 2.26179776-2.24081633.26573033 0 .5252809.04285714.77247191.13469388.29662921.11020408.63033708-.0244898.76629213-.3122449.84044944-1.7755102 2.66966292-2.92040816 4.65337076-2.92040816 2.6634832 0 4.8634832 1.97755102 5.116854 4.59795918.0247191.27551021.2348314.49591837.5067415.53877551 2.008427.34285714 3.5224719 2.17959184 3.5224719 4.27346941 0 2.222449-1.7674157 4.1571428-3.9426966 4.322449z" fill="#fff"/><g fill="#7699e5"><path d="m11 18.2020408c-.3398876 0-.6117978.2693878-.6117978.6061225v7.1020408c-.84662917.2571428-1.47696624 1.0346939-1.49550557 1.9469388-.01235955.5571428.19157303 1.0897959.58089888 1.4938775.38932584.4040816.91460669.6367347 1.47696629.6489796h.0494382c1.1370787 0 2.0825843-.9183673 2.1073034-2.0387755.0123595-.5571429-.1915731-1.0897959-.5808989-1.4938776-.2533708-.2632653-.5685393-.4530612-.9146067-.5571428v-7.1020408c0-.3367347-.2719102-.6061225-.6117978-.6061225zm.6426966 9.1040816c.1606742.1714286.2533708.3918368.247191.6244898-.0123595.4714286-.4078651.8571429-.8837078.8571429h-.0247191c-.2348315-.0061224-.4573034-.1040816-.6179776-.2693878-.1606741-.1714285-.2533707-.3918367-.247191-.6244897.0123596-.4714286.4078652-.8571429.8837079-.8571429h.0247191c.2348315 0 .4511236.0979592.6179775.2693877z"/><path d="m7.06966292 18.8081633v3.3979591c0 .5877552-.48202247 1.0591837-1.06910112 1.0591837h-1.80449438c-.26573034-.8571428-1.06910113-1.4877551-2.02078652-1.4877551-1.16179775 0-2.11348315.9367347-2.11348315 2.0938776 0 1.1571428.94550562 2.0938775 2.11348315 2.0938775.95168539 0 1.75505618-.6244898 2.02078652-1.4877551h1.80449438c1.26685393 0 2.29269663-1.022449 2.29269663-2.2714286v-3.3979591c0-.3367347-.27191012-.6061225-.61179776-.6061225-.33370786 0-.61179775.2693878-.61179775.6061225zm-4.89438202 5.9448979c-.48820225 0-.88988764-.3918367-.88988764-.8816326s.39550562-.8816327.88988764-.8816327c.48820225 0 .88988764.3918368.88988764.8816327s-.39550562.8816326-.88988764.8816326z"/><path d="m15.9994382 24.4836735h1.8044944c.2657303.8571428 1.0691011 1.4877551 2.0207865 1.4877551 1.1617978 0 2.1134831-.9367347 2.1134831-2.0938776 0-1.1571428-.9455056-2.0938775-2.1134831-2.0938775-.9516854 0-1.7550562.6244898-2.0207865 1.4877551h-1.8044944c-.5932584 0-1.0691011-.477551-1.0691011-1.0591837v-3.3979592c0-.3367347-.2719101-.6061224-.6117978-.6061224-.3398876 0-.6117977.2693877-.6117977.6061224v3.3979592c0 1.2489796 1.0258427 2.2714286 2.2926966 2.2714286zm3.8252809-1.4877551c.4882022 0 .8898876.3918367.8898876.8816326s-.3955056.8816327-.8898876.8816327-.8898876-.3918368-.8898876-.8816327.3955056-.8816326.8898876-.8816326z"/></g></g></g></svg>
\ No newline at end of file
diff --git a/ui/apps/platform/src/images/ip-address.svg b/ui/apps/platform/src/images/ip-address.svg
deleted file mode 100644
index 6158007184328..0000000000000
--- a/ui/apps/platform/src/images/ip-address.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg height="56" viewBox="0 0 56 56" width="56" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><circle cx="28" cy="28" fill="#e9f0ff" r="28"/><g transform="translate(13 15)"><path d="m9.50441871 28.0068132h9.97849459v.9809725h-9.97849459z" fill="#99b9ff"/><path d="m22.9753865 8.38736289c0-4.61052294-3.7916332-8.33826638-8.4317793-8.38736289-4.68984376 0-8.48172042 3.72774344-8.5316616 8.28916988 0 1.37350517.34934472 2.74677092.99784946 3.97298652l7.48387094 13.243129 7.483871-13.243129c.6487483-1.1771191.9978495-2.50152775.9978495-3.87479351z" fill="#345394"/><path d="m20.4807628 8.38736289c0 3.25066891-2.6805024 5.88583511-5.9870968 5.88583511s-5.98709675-2.6351662-5.98709675-5.88583511c0-3.25066892 2.68050235-5.88583509 5.98709675-5.88583509s5.9870968 2.63516617 5.9870968 5.88583509z" fill="#fff"/><g fill="#99b9ff"><g transform="translate(16.963441 7.357294)"><path d="m11.5001176 3.48250032h-.9978494v-1.96194504c0-.29433964-.1995212-.49048625-.4989248-.49048625h-2.49462361v-.98097252h2.49462361c.8482695 0 1.4967742.63753637 1.4967742 1.47145877z"/><path d="m10.5022682 15.2541705h-3.49247314c-.84802592 0-1.4967742-.6377758-1.4967742-1.4714588v-1.4714587c0-.2943397-.19952118-.4904863-.49892473-.4904863h-1.49677419v-.9809725h1.49677419c.84826946 0 1.4967742.6375364 1.4967742 1.4714588v1.4714587c0 .2943397.19976472.4904863.49892473.4904863h3.49247314z"/><path d="m10.5022682 10.3493079h-.99784949v-2.45243126c0-.29433964-.19952118-.49048626-.49892473-.49048626h-2.49462365v-.98097252h2.49462365c.84826946 0 1.49677422.63753637 1.49677422 1.47145878z"/><path d="m9.00549398 19.1780606h-7.48387096c-.84802592 0-1.4967742-.6377758-1.4967742-1.4714588v-.9809725h.99784946v.9809725c0 .2943396.19976473.4904863.49892474.4904863h7.48387096z"/></g><path d="m27.465709 26.0448682c0 .5417383-.4465474.9809725-.9978494.9809725-.5510585 0-.9978495-.4392342-.9978495-.9809725 0-.5417382.446791-.9809725.9978495-.9809725.551302 0 .9978494.4392343.9978494.9809725z"/><path d="m28.9624832 22.1209781c0 .5417383-.4465474.9809725-.9978494.9809725-.5510585 0-.9978495-.4392342-.9978495-.9809725 0-.5417382.446791-.9809725.9978495-.9809725.551302 0 .9978494.4392343.9978494.9809725z"/><path d="m27.9646338 18.1970881c0 .5417382-.4465475.9809725-.9978495.9809725-.5510585 0-.9978495-.4392343-.9978495-.9809725 0-.5417383.446791-.9809726.9978495-.9809726.551302 0 .9978495.4392343.9978495.9809726z"/><path d="m26.9667843 5.9349316h-2.4946237v-.98097251h2.4946237c.2994036 0 .4989247-.19614662.4989247-.49048626v-2.94291755h.9978495v2.94291755c0 .83368299-.6485047 1.47145877-1.4967742 1.47145877z"/><path d="m28.9624832 1.03006903c0 .54173827-.4465474.98097251-.9978494.98097251-.5510585 0-.9978495-.43923424-.9978495-.98097251 0-.54173821.446791-.98097252.9978495-.98097252.551302 0 .9978494.43923431.9978494.98097252z"/><path d="m28.9624832 11.3302804c0 .5417383-.4465474.9809726-.9978494.9809726-.5510585 0-.9978495-.4392343-.9978495-.9809726 0-.5417382.446791-.9809725.9978495-.9809725.551302 0 .9978494.4392343.9978494.9809725z"/><path d="m1.52162302 10.3493079h-.99784947v-1.96194501c0-.8339224.64874828-1.47145877 1.4967742-1.47145877h2.49462365v.98097252h-2.49462365c-.29916001 0-.49892473.19614662-.49892473.49048625z"/><path d="m5.01409613 22.6114644h-3.49247311v-.9809725h3.49247311c.29940355 0 .49892473-.1961467.49892473-.4904863v-1.4714588c0-.8339224.64874828-1.4714587 1.4967742-1.4714587h1.49677419v.9809725h-1.49677419c-.29916001 0-.49892473.1961466-.49892473.4904862v1.4714588c0 .833683-.64850474 1.4714588-1.4967742 1.4714588z"/><path d="m2.51947248 17.7066018h-.99784946v-2.9429176c0-.8339224.64874827-1.4714587 1.49677419-1.4714587h2.49462365v.9809725h-2.49462365c-.29916001 0-.49892473.1961466-.49892473.4904862z"/><path d="m10.5022682 26.5353544h-7.48387099v-.9809725h7.48387099c.2994035 0 .4989247-.1961466.4989247-.4904862v-.9809726h.9978495v.9809726c0 .833683-.6485048 1.4714587-1.4967742 1.4714587z"/><path d="m3.51732194 26.0448682c0 .5417383-.44654743.9809725-.99784946.9809725-.5510585 0-.99784946-.4392342-.99784946-.9809725 0-.5417382.44679096-.9809725.99784946-.9809725.55130203 0 .99784946.4392343.99784946.9809725z"/><path d="m2.02054775 22.1209781c0 .5417383-.44654743.9809725-.99784947.9809725-.55105849 0-.99784946-.4392342-.99784946-.9809725 0-.5417382.44679097-.9809725.99784946-.9809725.55130204 0 .99784947.4392343.99784947.9809725z"/><path d="m3.01839721 18.1970881c0 .5417382-.44654743.9809725-.99784946.9809725-.5510585 0-.99784947-.4392343-.99784947-.9809725 0-.5417383.44679097-.9809726.99784947-.9809726.55130203 0 .99784946.4392343.99784946.9809726z"/><path d="m4.5151714 5.9349316h-2.49462365c-.84802592 0-1.4967742-.63777578-1.4967742-1.47145877v-2.94291755h.99784947v2.94291755c0 .29433964.19976472.49048626.49892473.49048626h2.49462365z"/><path d="m2.02054775 1.03006903c0 .54173827-.44654743.98097251-.99784947.98097251-.55105849 0-.99784946-.43923424-.99784946-.98097251 0-.54173821.44679097-.98097252.99784946-.98097252.55130204 0 .99784947.43923431.99784947.98097252z"/><path d="m2.02054775 10.8397942c0 .5417383-.44654743.9809725-.99784947.9809725-.55105849 0-.99784946-.4392342-.99784946-.9809725 0-.5417382.44679097-.98097253.99784946-.98097253.55130204 0 .99784947.43923433.99784947.98097253z"/></g></g></g></svg>
\ No newline at end of file
diff --git a/ui/apps/platform/src/images/ns-icon.svg b/ui/apps/platform/src/images/ns-icon.svg
deleted file mode 100644
index c1afa410faeae..0000000000000
--- a/ui/apps/platform/src/images/ns-icon.svg
+++ /dev/null
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="56px" height="56px" viewBox="0 0 56 56" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-    <!-- Generator: Sketch 53.2 (72643) - https://sketchapp.com -->
-    <title>Group 4</title>
-    <desc>Created with Sketch.</desc>
-    <g id="network-graph" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
-        <g id="Artboard-(1)" transform="translate(-123.000000, -464.000000)">
-            <g id="Group-8" transform="translate(57.000000, 411.000000)">
-                <g id="Group-3">
-                    <g id="Group-4" transform="translate(66.000000, 53.000000)">
-                        <circle id="Oval" fill="#E9F0FF" cx="28" cy="28" r="28"></circle>
-                        <rect id="Rectangle" stroke="#AAC2F5" stroke-width="2" fill="#F7F9FF" x="17" y="18" width="22" height="22" rx="4"></rect>
-                        <path d="M28.8099607,33 L26.7322264,33 L23.3783202,27.1675783 L23.3308593,27.1675783 C23.3976565,28.1976615 23.4310546,28.9324198 23.4310546,29.3718751 L23.4310546,33 L21.9703125,33 L21.9703125,25.2902346 L24.0322265,25.2902346 L27.3808592,31.0646485 L27.4177733,31.0646485 C27.3650386,30.0626904 27.3386717,29.354299 27.3386717,28.9394532 L27.3386717,25.2902346 L28.8099607,25.2902346 L28.8099607,33 Z M35.3015621,30.8589844 C35.3015621,31.5550816 35.0510764,32.1035136 34.5500973,32.5042969 C34.0491182,32.9050801 33.3521526,33.1054687 32.4591794,33.1054687 C31.636519,33.1054687 30.908792,32.9507828 30.2759763,32.6414063 L30.2759763,31.1226563 C30.7962914,31.3546887 31.236619,31.5181636 31.5969724,31.613086 C31.9573257,31.7080083 32.2869123,31.7554688 32.5857419,31.7554688 C32.9443374,31.7554688 33.2194323,31.6869148 33.4110348,31.5498047 C33.6026373,31.4126947 33.6984372,31.2087905 33.6984372,30.938086 C33.6984372,30.7869134 33.6562501,30.6524421 33.5718747,30.534668 C33.4874992,30.416894 33.3635747,30.3035162 33.2000973,30.1945313 C33.03662,30.0855464 32.7035178,29.9115247 32.200781,29.672461 C31.7296849,29.4509755 31.3763681,29.2382824 31.14082,29.0343751 C30.905272,28.8304678 30.7171879,28.5931655 30.5765622,28.3224611 C30.4359365,28.0517566 30.3656248,27.7353535 30.3656248,27.3732423 C30.3656248,26.6912077 30.5967748,26.1550803 31.0590818,25.7648439 C31.5213888,25.3746076 32.1603472,25.1794924 32.9759762,25.1794924 C33.3767595,25.1794924 33.7590799,25.2269529 34.1229489,25.3218752 C34.4868179,25.4167976 34.8673805,25.55039 35.2646481,25.7226564 L34.7373043,26.9935548 C34.3259742,26.824804 33.9858408,26.7070318 33.7168942,26.6402345 C33.4479475,26.5734373 33.1833994,26.5400392 32.9232419,26.5400392 C32.6138653,26.5400392 32.376563,26.6121088 32.2113278,26.7562502 C32.0460926,26.9003915 31.9634763,27.0884756 31.9634763,27.320508 C31.9634763,27.4646493 31.9968744,27.5903316 32.0636716,27.6975587 C32.1304688,27.8047858 32.2368154,27.9084957 32.3827145,28.0086915 C32.5286137,28.1088873 32.8740204,28.2890613 33.418945,28.5492189 C34.1396517,28.8937518 34.6335921,29.2391585 34.9007809,29.5854493 C35.1679697,29.9317401 35.3015621,30.3562476 35.3015621,30.8589844 Z" id="NS" fill="#6A6E88" fill-rule="nonzero"></path>
-                    </g>
-                </g>
-            </g>
-        </g>
-    </g>
-</svg>
\ No newline at end of file
diff --git a/ui/apps/platform/src/images/side-panel-icons/control.svg b/ui/apps/platform/src/images/side-panel-icons/control.svg
deleted file mode 100755
index 46833004b3865..0000000000000
--- a/ui/apps/platform/src/images/side-panel-icons/control.svg
+++ /dev/null
@@ -1,5 +0,0 @@
-<svg width="31" height="31" viewBox="0 0 31 31" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M3.57338 2H27.4266C28.2956 2 29 2.78342 29 3.74983V27.2502C29 28.2166 28.2956 29 27.4266 29H3.57338C2.70443 29 2 28.2166 2 27.2502L2 3.74983C2 2.78342 2.70443 2 3.57338 2V2Z" fill="#8C9CF0" fill-opacity="0.194848" stroke="#5771F7" stroke-width="1.61165" stroke-dasharray="1 1"/>
-<rect x="8" y="8" width="15" height="15" rx="2" fill="#DBE3FF" stroke="#4B5CB7"/>
-<path d="M11 17L14 19.5L20 11" stroke="#4B5CB7" stroke-width="1.5" stroke-linecap="round"/>
-</svg>
diff --git a/ui/apps/platform/src/index.tsx b/ui/apps/platform/src/index.tsx
index 2036977768d4a..ee2273eaf84bf 100644
--- a/ui/apps/platform/src/index.tsx
+++ b/ui/apps/platform/src/index.tsx
@@ -31,6 +31,7 @@ import installRaven from 'init/installRaven';
 import configureApollo from 'init/configureApolloClient';
 import { setAnalyticsSource } from 'init/initializeAnalytics';
 import { FeatureFlagsProvider } from 'providers/FeatureFlagProvider';
+import { LightspeedStatusProvider } from 'providers/LightspeedStatusProvider';
 import { PublicConfigProvider } from 'providers/PublicConfigProvider';
 import { TelemetryConfigProvider } from 'providers/TelemetryConfigProvider';
 import { MetadataProvider } from 'providers/MetadataProvider';
@@ -71,7 +72,9 @@ root.render(
                                 <PublicConfigProvider>
                                     <TelemetryConfigProvider>
                                         <MetadataProvider>
-                                            <AppPage />
+                                            <LightspeedStatusProvider>
+                                                <AppPage />
+                                            </LightspeedStatusProvider>
                                         </MetadataProvider>
                                     </TelemetryConfigProvider>
                                 </PublicConfigProvider>
diff --git a/ui/apps/platform/src/messages/common.ts b/ui/apps/platform/src/messages/common.ts
index d1c96f0427624..97ebee8416f75 100644
--- a/ui/apps/platform/src/messages/common.ts
+++ b/ui/apps/platform/src/messages/common.ts
@@ -73,7 +73,6 @@ export const resourceLabels = Object.freeze({
     NODE: 'node',
     DEPLOYMENT: 'deployment',
     SECRET: 'secret',
-    CONTROL: 'control',
     CVE: 'CVE',
     IMAGE_CVE: 'Image CVE',
     NODE_CVE: 'Node CVE',
@@ -83,7 +82,6 @@ export const resourceLabels = Object.freeze({
     IMAGE_COMPONENT: 'image component',
     IMAGE: 'image',
     POLICY: 'policy',
-    CHECK: 'check',
     ROLE: 'role',
 });
 
diff --git a/ui/apps/platform/src/messages/standards.js b/ui/apps/platform/src/messages/standards.js
deleted file mode 100644
index 805b292fd3108..0000000000000
--- a/ui/apps/platform/src/messages/standards.js
+++ /dev/null
@@ -1,16 +0,0 @@
-import { standardTypes } from 'constants/entityTypes';
-
-export const standardLabels = {
-    [standardTypes.PCI_DSS_3_2]: 'PCI DSS 3.2.1',
-    [standardTypes.NIST_800_190]: 'NIST SP 800-190',
-    [standardTypes.NIST_SP_800_53_Rev_4]: 'NIST SP 800-53',
-    [standardTypes.HIPAA_164]: 'HIPAA 164',
-    [standardTypes.CIS_Kubernetes_v1_5]: 'CIS Kubernetes v1.5',
-};
-
-export const standardShortLabels = {
-    ...standardLabels,
-    [standardTypes.CIS_Kubernetes_v1_5]: 'CIS K8s v1.5',
-};
-
-export default standardLabels;
diff --git a/ui/apps/platform/src/messages/useCase.js b/ui/apps/platform/src/messages/useCase.js
index 8f76c615d5238..fd1365417c666 100644
--- a/ui/apps/platform/src/messages/useCase.js
+++ b/ui/apps/platform/src/messages/useCase.js
@@ -13,8 +13,6 @@ const legacyPageLabels = {
 const useCaseLabels = {
     [useCaseTypes.CONFIG_MANAGEMENT]: 'Configuration Management',
     [useCaseTypes.VULN_MANAGEMENT]: 'Vulnerability Management',
-    [useCaseTypes.COMPLIANCE]: 'Compliance',
-    COMPLIANCE: 'Compliance',
     RISK: 'Risk',
     SECRET: 'Secret',
     POLICY: 'Policy',
diff --git a/ui/apps/platform/src/providers/LightspeedStatusProvider.tsx b/ui/apps/platform/src/providers/LightspeedStatusProvider.tsx
new file mode 100644
index 0000000000000..a944006ee1315
--- /dev/null
+++ b/ui/apps/platform/src/providers/LightspeedStatusProvider.tsx
@@ -0,0 +1,47 @@
+import { useCallback, useMemo } from 'react';
+import type { ReactNode } from 'react';
+
+import { LightspeedStatusContext } from 'hooks/useLightspeedStatus';
+import useFeatureFlags from 'hooks/useFeatureFlags';
+import useRestQuery from 'hooks/useRestQuery';
+import { fetchLightspeedStatus } from 'services/MetadataService';
+
+export type LightspeedStatusProviderProps = {
+    children: ReactNode;
+};
+
+export type LightspeedStatusContextType = {
+    isAvailable: boolean;
+    isLoading: boolean;
+    error: Error | undefined;
+};
+
+export function LightspeedStatusProvider({ children }: LightspeedStatusProviderProps) {
+    const { isFeatureFlagEnabled } = useFeatureFlags();
+    const isRiskSummaryEnabled = isFeatureFlagEnabled('ROX_LIGHTSPEED_RISK_SUMMARY');
+
+    const { data, isLoading, error } = useRestQuery(
+        useCallback(
+            () =>
+                isRiskSummaryEnabled
+                    ? fetchLightspeedStatus()
+                    : Promise.resolve({ available: false, message: 'Feature disabled' }),
+            [isRiskSummaryEnabled]
+        )
+    );
+
+    const value: LightspeedStatusContextType = useMemo(
+        () => ({
+            isAvailable: data?.available ?? false,
+            isLoading,
+            error,
+        }),
+        [data?.available, isLoading, error]
+    );
+
+    return (
+        <LightspeedStatusContext.Provider value={value}>
+            {children}
+        </LightspeedStatusContext.Provider>
+    );
+}
diff --git a/ui/apps/platform/src/queries/cluster.js b/ui/apps/platform/src/queries/cluster.js
index 62fa049d636db..d1fab1ec63ddf 100644
--- a/ui/apps/platform/src/queries/cluster.js
+++ b/ui/apps/platform/src/queries/cluster.js
@@ -14,15 +14,6 @@ export const CLUSTERS_QUERY = gql`
                     openshiftVersion
                 }
             }
-            complianceResults {
-                resource {
-                    __typename
-                }
-                control {
-                    id
-                    name
-                }
-            }
             policyStatus {
                 status
                 failingPolicies {
@@ -42,20 +33,3 @@ export const CLUSTER_NAME = gql`
         }
     }
 `;
-
-export const CLUSTER_VERSION_QUERY = gql`
-    query getClusterVersion($id: ID!) {
-        cluster(id: $id) {
-            id
-            name
-            type
-            status {
-                orchestratorMetadata {
-                    version
-                    openshiftVersion
-                    buildDate
-                }
-            }
-        }
-    }
-`;
diff --git a/ui/apps/platform/src/queries/controls.js b/ui/apps/platform/src/queries/controls.js
deleted file mode 100644
index d1cbb7e5a9f65..0000000000000
--- a/ui/apps/platform/src/queries/controls.js
+++ /dev/null
@@ -1,250 +0,0 @@
-import { gql } from '@apollo/client';
-
-export const AGGREGATED_RESULTS_ACROSS_ENTITY = (entityType) => gql`
-    query getAggregatedResultsAcrossEntity_${entityType}(
-        $groupBy: [ComplianceAggregation_Scope!]
-        $unit: ComplianceAggregation_Scope!
-        $where: String
-    ) {
-        results: aggregatedResults(groupBy: $groupBy, unit: $unit, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        controls: aggregatedResults(groupBy: $groupBy, unit: CONTROL, where: $where) {
-            results {
-                __typename
-                aggregationKeys {
-                    __typename
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        complianceStandards: complianceStandards {
-            id
-            name
-        }
-    }
-`;
-
-export const AGGREGATED_RESULTS = gql`
-    query getAggregatedResults(
-        $groupBy: [ComplianceAggregation_Scope!]
-        $unit: ComplianceAggregation_Scope!
-        $where: String
-    ) {
-        results: aggregatedResults(groupBy: $groupBy, unit: $unit, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        controls: aggregatedResults(groupBy: $groupBy, unit: CONTROL, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        complianceStandards: complianceStandards {
-            id
-            name
-        }
-        clusters {
-            id
-            name
-            namespaces {
-                metadata {
-                    id
-                    name
-                }
-            }
-            nodes {
-                id
-                name
-            }
-        }
-        deployments {
-            id
-            name
-        }
-    }
-`;
-
-export const AGGREGATED_RESULTS_ACROSS_ENTITIES = gql`
-    query getAggregatedResults($groupBy: [ComplianceAggregation_Scope!], $where: String) {
-        controls: aggregatedResults(groupBy: $groupBy, unit: CONTROL, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        complianceStandards: complianceStandards {
-            id
-            name
-        }
-    }
-`;
-
-export const AGGREGATED_RESULTS_STANDARDS_BY_ENTITY = (entityType) => gql`
-    query getAggregatedResultsByEntity_${entityType}(
-        $groupBy: [ComplianceAggregation_Scope!]
-        $unit: ComplianceAggregation_Scope!
-        $where: String
-    ) {
-        results: aggregatedResults(groupBy: $groupBy, unit: $unit, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        controls: aggregatedResults(groupBy: $groupBy, unit: CONTROL, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        complianceStandards: complianceStandards {
-            id
-            name
-        }
-        clusters: complianceClusters {
-            id
-            name
-        }
-    }
-`;
-
-export const AGGREGATED_RESULTS_WITH_CONTROLS = gql`
-    query getAggregatedResults(
-        $groupBy: [ComplianceAggregation_Scope!]
-        $unit: ComplianceAggregation_Scope!
-        $where: String!
-    ) {
-        results: aggregatedResults(groupBy: $groupBy, unit: $unit, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        complianceStandards {
-            id
-            name
-            controls {
-                id
-                name
-                description
-            }
-        }
-    }
-`;
-
-export const CONTROL_NAME = gql`
-    query getControlName($id: ID!) {
-        control: complianceControl(id: $id) {
-            id
-            name
-            description
-        }
-    }
-`;
-
-export const CONTROL_QUERY = gql`
-    query controlById($id: ID!, $groupBy: [ComplianceAggregation_Scope!], $where: String) {
-        results: complianceControl(id: $id) {
-            interpretationText
-            description
-            id
-            name
-            standardId
-        }
-
-        complianceStandards {
-            id
-            name
-        }
-
-        entities: aggregatedResults(groupBy: $groupBy, unit: CONTROL, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                keys {
-                    ... on ComplianceDomain_Node {
-                        clusterName
-                        id
-                        name
-                    }
-                }
-                numFailing
-                numPassing
-                numSkipped
-            }
-        }
-    }
-`;
-
-export const CONTROL_FRAGMENT = gql`
-    fragment controlFields on ControlResult {
-        resource {
-            __typename
-        }
-        control {
-            id
-            standardId
-            name
-            description
-        }
-        value {
-            overallState
-        }
-    }
-`;
diff --git a/ui/apps/platform/src/queries/node.js b/ui/apps/platform/src/queries/node.js
index f05e8fcae2b11..08d9df12fd29b 100644
--- a/ui/apps/platform/src/queries/node.js
+++ b/ui/apps/platform/src/queries/node.js
@@ -25,54 +25,6 @@ export const NODE_FRAGMENT = gql`
             key
             value
         }
-        nodeComplianceControlCount(query: "Standard:CIS") {
-            failingCount
-            passingCount
-            unknownCount
-        }
-    }
-`;
-export const NODES_QUERY = gql`
-    query nodes($query: String) {
-        results: nodes(query: $query) {
-            id
-            name
-            clusterName
-            clusterId
-            osImage
-            containerRuntimeVersion
-            joinedAt
-            complianceResults {
-                resource {
-                    __typename
-                }
-                control {
-                    id
-                }
-            }
-        }
-    }
-`;
-
-export const NODE_QUERY = gql`
-    query getNode($id: ID!) {
-        node(id: $id) {
-            ...nodeFields
-        }
-    }
-    ${NODE_FRAGMENT}
-`;
-
-export const NODES_BY_CLUSTER = gql`
-    query getNodesByCluster($id: ID!) {
-        results: cluster(id: $id) {
-            id
-            name
-            nodes {
-                id
-                name
-            }
-        }
     }
 `;
 
@@ -84,19 +36,3 @@ export const NODE_NAME = gql`
         }
     }
 `;
-
-export const NODE_COMPLIANCE = gql`
-    query compliance {
-        aggregatedResults(groupBy: [STANDARD, NODE], unit: CONTROL) {
-            results {
-                aggregationKeys {
-                    id
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-    }
-`;
diff --git a/ui/apps/platform/src/queries/search.js b/ui/apps/platform/src/queries/search.js
index 1d3a9dd4afb01..ff486a258cb84 100644
--- a/ui/apps/platform/src/queries/search.js
+++ b/ui/apps/platform/src/queries/search.js
@@ -17,70 +17,3 @@ export const SEARCH = gql`
         }
     }
 `;
-
-export const SEARCH_WITH_CONTROLS = gql`
-    query searchWithControls($query: String!) {
-        deploymentResults: aggregatedResults(
-            groupBy: [DEPLOYMENT, CONTROL]
-            unit: CONTROL
-            where: $query
-        ) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-
-        namespaceResults: aggregatedResults(
-            groupBy: [NAMESPACE, CONTROL]
-            unit: CONTROL
-            where: $query
-        ) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-
-        clusterResults: aggregatedResults(
-            groupBy: [CLUSTER, CONTROL]
-            unit: CONTROL
-            where: $query
-        ) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        nodeResults: aggregatedResults(groupBy: [NODE], unit: CONTROL, where: $query) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-    }
-`;
diff --git a/ui/apps/platform/src/queries/standard.js b/ui/apps/platform/src/queries/standard.js
deleted file mode 100644
index 3ec429476a784..0000000000000
--- a/ui/apps/platform/src/queries/standard.js
+++ /dev/null
@@ -1,164 +0,0 @@
-import { gql } from '@apollo/client';
-
-export const LIST_STANDARD = gql`
-    query controls($groupBy: [ComplianceAggregation_Scope!], $where: String) {
-        results: aggregatedResults(groupBy: $groupBy, unit: CHECK, where: $where) {
-            results {
-                aggregationKeys {
-                    scope
-                }
-                keys {
-                    ... on ComplianceStandardMetadata {
-                        id
-                        name
-                    }
-                    ... on ComplianceControlGroup {
-                        id
-                        name
-                        description
-                    }
-                    ... on ComplianceControl {
-                        id
-                        name
-                        description
-                        standardId
-                    }
-                    ... on ComplianceDomain_Cluster {
-                        id
-                        name
-                    }
-                    ... on ComplianceDomain_Node {
-                        id
-                        name
-                        clusterName
-                    }
-                    ... on Namespace {
-                        metadata {
-                            id
-                            name
-                            clusterName
-                        }
-                    }
-                    __typename
-                }
-                numPassing
-                numFailing
-                numSkipped
-            }
-        }
-    }
-`;
-
-export const LIST_STANDARD_NO_NODES = gql`
-    query controls($groupBy: [ComplianceAggregation_Scope!], $where: String) {
-        results: aggregatedResults(groupBy: $groupBy, unit: CHECK, where: $where) {
-            results {
-                aggregationKeys {
-                    scope
-                }
-                keys {
-                    ... on ComplianceStandardMetadata {
-                        id
-                    }
-                    ... on ComplianceControlGroup {
-                        id
-                        name
-                        description
-                    }
-                    ... on ComplianceControl {
-                        id
-                        name
-                        description
-                        standardId
-                    }
-                    ... on ComplianceDomain_Cluster {
-                        id
-                        name
-                    }
-                    ... on Namespace {
-                        metadata {
-                            id
-                            name
-                            clusterName
-                        }
-                    }
-                    __typename
-                }
-                numPassing
-                numFailing
-                numSkipped
-            }
-        }
-    }
-`;
-
-export const COMPLIANCE_STANDARDS = (standardId) => gql`
-    query complianceStandards_${standardId.replace(
-        /\W/g,
-        '_'
-    )}($groupBy: [ComplianceAggregation_Scope!], $where: String) {
-        complianceStandards {
-            id
-            name
-            controls {
-                standardId
-                groupId
-                id
-                name
-                description
-            }
-            groups {
-                standardId
-                id
-                name
-                description
-            }
-        }
-        results: aggregatedResults(groupBy: $groupBy, unit: CONTROL, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-        checks: aggregatedResults(groupBy: $groupBy, unit: CHECK, where: $where) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                numFailing
-                numPassing
-                numSkipped
-                unit
-            }
-        }
-    }
-`;
-
-export const TRIGGER_SCAN = gql`
-    mutation triggerScan($clusterId: ID!, $standardId: ID!) {
-        complianceTriggerRuns(clusterId: $clusterId, standardId: $standardId) {
-            id
-            standardId
-            clusterId
-            state
-            errorMessage
-        }
-    }
-`;
-
-export const STANDARDS_QUERY = gql`
-    query getComplianceStandards {
-        results: complianceStandards {
-            id
-            name
-            scopes
-        }
-    }
-`;
diff --git a/ui/apps/platform/src/queries/table.js b/ui/apps/platform/src/queries/table.js
deleted file mode 100644
index 03bd5923445e7..0000000000000
--- a/ui/apps/platform/src/queries/table.js
+++ /dev/null
@@ -1,133 +0,0 @@
-import { gql } from '@apollo/client';
-
-export const CLUSTERS_QUERY = gql`
-    query clustersList($where: String) {
-        results: aggregatedResults(
-            groupBy: [CLUSTER, STANDARD]
-            unit: CONTROL
-            where: $where
-            collapseBy: CLUSTER
-        ) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                keys {
-                    ... on ComplianceDomain_Cluster {
-                        name
-                    }
-                    ... on ComplianceStandardMetadata {
-                        name
-                    }
-                    __typename
-                }
-                numPassing
-                numFailing
-                numSkipped
-            }
-            errorMessage
-        }
-    }
-`;
-
-export const NAMESPACES_QUERY = gql`
-    query namespaceList($where: String) {
-        results: aggregatedResults(
-            groupBy: [NAMESPACE, STANDARD]
-            unit: CONTROL
-            where: $where
-            collapseBy: NAMESPACE
-        ) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                keys {
-                    ... on Namespace {
-                        metadata {
-                            id
-                            name
-                            clusterName
-                        }
-                    }
-                    ... on ComplianceStandardMetadata {
-                        name
-                    }
-                    __typename
-                }
-                numPassing
-                numFailing
-                numSkipped
-            }
-            errorMessage
-        }
-    }
-`;
-
-export const NODES_QUERY = gql`
-    query nodesList($where: String) {
-        results: aggregatedResults(
-            groupBy: [NODE, STANDARD]
-            unit: CONTROL
-            where: $where
-            collapseBy: NODE
-        ) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                keys {
-                    ... on ComplianceDomain_Node {
-                        name
-                        clusterName
-                    }
-                    ... on ComplianceStandardMetadata {
-                        name
-                    }
-                    __typename
-                }
-                numPassing
-                numFailing
-                numSkipped
-                unit
-            }
-            errorMessage
-        }
-    }
-`;
-
-export const DEPLOYMENTS_QUERY = gql`
-    query deploymentsList($where: String) {
-        results: aggregatedResults(
-            groupBy: [DEPLOYMENT, STANDARD]
-            unit: CONTROL
-            where: $where
-            collapseBy: DEPLOYMENT
-        ) {
-            results {
-                aggregationKeys {
-                    id
-                    scope
-                }
-                keys {
-                    ... on ComplianceDomain_Deployment {
-                        name
-                        id
-                        namespace
-                        clusterName
-                    }
-
-                    __typename
-                }
-                numPassing
-                numFailing
-                numSkipped
-                unit
-            }
-            errorMessage
-        }
-    }
-`;
diff --git a/ui/apps/platform/src/reducers/feedback.ts b/ui/apps/platform/src/reducers/feedback.ts
deleted file mode 100644
index 8ea3b2e56c805..0000000000000
--- a/ui/apps/platform/src/reducers/feedback.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { combineReducers } from 'redux';
-import type { Reducer } from 'redux';
-
-// Action types
-
-export type SetFeedbackModalVisibilityAction = {
-    type: 'feedback/SET_MODAL_VISIBILITY';
-    show: boolean;
-};
-
-// Action creator functions
-
-export const actions = {
-    setFeedbackModalVisibility: (show: boolean): SetFeedbackModalVisibilityAction => ({
-        type: 'feedback/SET_MODAL_VISIBILITY',
-        show,
-    }),
-};
-
-// Reducers
-
-const showFeedbackModal: Reducer<boolean, SetFeedbackModalVisibilityAction> = (
-    state = false,
-    action
-) => {
-    switch (action.type) {
-        case 'feedback/SET_MODAL_VISIBILITY':
-            return action.show;
-        default:
-            return state;
-    }
-};
-
-const reducer = combineReducers({
-    showFeedbackModal,
-});
-
-export default reducer;
-
-// Selectors
-
-type State = ReturnType<typeof reducer>;
-
-const feedbackSelector = (state: State) => state.showFeedbackModal;
-
-export const selectors = {
-    feedbackSelector,
-};
diff --git a/ui/apps/platform/src/reducers/groups.js b/ui/apps/platform/src/reducers/groups.js
index 763d38f677872..5416f27ed3f7d 100644
--- a/ui/apps/platform/src/reducers/groups.js
+++ b/ui/apps/platform/src/reducers/groups.js
@@ -6,7 +6,6 @@ import { createFetchingActionTypes, createFetchingActions } from 'utils/fetching
 export const types = {
     FETCH_RULE_GROUPS: createFetchingActionTypes('groups/FETCH_RULE_GROUPS'),
     SAVE_RULE_GROUP: 'groups/SAVE_RULE_GROUP',
-    DELETE_RULE_GROUP: 'groups/DELETE_RULE_GROUP',
 };
 
 export const actions = {
@@ -17,10 +16,6 @@ export const actions = {
         defaultRole,
         id,
     }),
-    deleteRuleGroup: (group) => ({
-        type: types.DELETE_RULE_GROUP,
-        group,
-    }),
 };
 
 const groups = (state = [], action) => {
diff --git a/ui/apps/platform/src/reducers/index.js b/ui/apps/platform/src/reducers/index.js
index 2d5f9a4a00cd2..17724d264e4ab 100644
--- a/ui/apps/platform/src/reducers/index.js
+++ b/ui/apps/platform/src/reducers/index.js
@@ -4,11 +4,9 @@ import { connectRouter } from 'connected-react-router';
 
 import bindSelectors from 'utils/bindSelectors';
 import auth, { selectors as authSelectors } from './auth';
-import feedback, { selectors as feedbackSelectors } from './feedback';
 import invite, { selectors as inviteSelectors } from './invite';
 import notifications, { selectors as notificationSelectors } from './notifications';
 import roles, { selectors as roleSelectors } from './roles';
-import searchAutoComplete, { selectors as searchAutoCompleteSelectors } from './searchAutocomplete';
 import serverResponseStatus, {
     selectors as serverResponseStatusSelectors,
 } from './serverResponseStatus';
@@ -23,11 +21,9 @@ import centralCapabilities, {
 
 const appReducer = combineReducers({
     auth,
-    feedback,
     invite,
     notifications,
     roles,
-    searchAutoComplete,
     serverResponseStatus,
     loading,
     groups,
@@ -48,11 +44,9 @@ export default createRootReducer;
 
 const getApp = (state) => state.app;
 const getAuth = (state) => getApp(state).auth;
-const getFeedback = (state) => getApp(state).feedback;
 const getInvite = (state) => getApp(state).invite;
 const getNotifications = (state) => getApp(state).notifications;
 const getRoles = (state) => getApp(state).roles;
-const getSearchAutocomplete = (state) => getApp(state).searchAutoComplete;
 const getServerResponseStatus = (state) => getApp(state).serverResponseStatus;
 const getLoadingStatus = (state) => getApp(state).loading;
 
@@ -61,11 +55,9 @@ const getCentralCapabilities = (state) => getApp(state).centralCapabilities;
 
 const boundSelectors = {
     ...bindSelectors(getAuth, authSelectors),
-    ...bindSelectors(getFeedback, feedbackSelectors),
     ...bindSelectors(getInvite, inviteSelectors),
     ...bindSelectors(getNotifications, notificationSelectors),
     ...bindSelectors(getRoles, roleSelectors),
-    ...bindSelectors(getSearchAutocomplete, searchAutoCompleteSelectors),
     ...bindSelectors(getServerResponseStatus, serverResponseStatusSelectors),
     ...bindSelectors(getLoadingStatus, loadingSelectors),
 
diff --git a/ui/apps/platform/src/reducers/roles.js b/ui/apps/platform/src/reducers/roles.js
index 4e9b2d87c3741..13fe27efba559 100644
--- a/ui/apps/platform/src/reducers/roles.js
+++ b/ui/apps/platform/src/reducers/roles.js
@@ -13,26 +13,11 @@ export const ACCESS_LEVEL = Object.freeze({
 export const types = {
     FETCH_USER_ROLE_PERMISSIONS: createFetchingActionTypes('roles/FETCH_USER_ROLE_PERMISSIONS'),
     FETCH_ROLES: createFetchingActionTypes('roles/FETCH_ROLES'),
-    SELECTED_ROLE: 'roles/SELECTED_ROLE',
-    SAVE_ROLE: 'roles/SAVE_ROLE',
-    DELETE_ROLE: 'roles/DELETE_ROLE',
 };
 
 export const actions = {
     fetchUserRolePermissions: createFetchingActions(types.FETCH_USER_ROLE_PERMISSIONS),
     fetchRoles: createFetchingActions(types.FETCH_ROLES),
-    selectRole: (role) => ({
-        type: types.SELECTED_ROLE,
-        role,
-    }),
-    saveRole: (role) => ({
-        type: types.SAVE_ROLE,
-        role,
-    }),
-    deleteRole: (id) => ({
-        type: types.DELETE_ROLE,
-        id,
-    }),
 };
 
 const roles = (state = [], action) => {
@@ -42,19 +27,6 @@ const roles = (state = [], action) => {
     return state;
 };
 
-const selectedRole = (state = null, action) => {
-    if (action.type === types.FETCH_ROLES.SUCCESS && !state) {
-        if (action.response.roles.length) {
-            return action.response.roles[0];
-        }
-        return state;
-    }
-    if (action.type === types.SELECTED_ROLE && action.role) {
-        return isEqual(action.role, state) ? state : action.role;
-    }
-    return state;
-};
-
 const userRolePermissions = (state = null, action) => {
     if (action.type === types.FETCH_USER_ROLE_PERMISSIONS.SUCCESS) {
         return isEqual(action.response, state) ? state : action.response;
@@ -93,22 +65,16 @@ const isLoading = (state = true, action) => {
 
 const reducer = combineReducers({
     roles,
-    selectedRole,
     userRolePermissions,
     error,
     isLoading,
 });
 
 const getRoles = (state) => state.roles;
-const getSelectedRole = (state) => state.selectedRole;
 const getUserRolePermissions = (state) => state.userRolePermissions;
 const getUserRolePermissionsError = (state) => state.error;
 const getIsLoadingUserRolePermissions = (state) => state.isLoading;
 
-/*
- * Given resource string (for example, "Integration") and role or permissionSet object,
- * return access level (for example, "READ_ACCESS").
- */
 const getAccessForPermission = (resource, userRolePermissionsArg) => {
     return userRolePermissionsArg?.resourceToAccess?.[resource] ?? ACCESS_LEVEL.NO_ACCESS;
 };
@@ -118,7 +84,6 @@ export const getHasReadPermission = (resource, userRolePermissionsArg) => {
     if (access === ACCESS_LEVEL.READ_WRITE_ACCESS || access === ACCESS_LEVEL.READ_ACCESS) {
         return true;
     }
-    // If the given resource doesn't yield the required access, try with the replacing resource (if there is any).
     if (replacedResourceMapping.has(resource)) {
         const replacingResourceAccess = getAccessForPermission(
             replacedResourceMapping.get(resource),
@@ -129,7 +94,6 @@ export const getHasReadPermission = (resource, userRolePermissionsArg) => {
             replacingResourceAccess === ACCESS_LEVEL.READ_ACCESS
         );
     }
-    // Return false if neither the resource nor the replacing resource have the correct access.
     return false;
 };
 
@@ -138,7 +102,6 @@ export const getHasReadWritePermission = (resource, userRolePermissionsArg) => {
     if (access === ACCESS_LEVEL.READ_WRITE_ACCESS) {
         return true;
     }
-    // If the given resource doesn't yield the required access, try with the replacing resource (if there is any).
     if (replacedResourceMapping.has(resource)) {
         const replacingResourceAccess = getAccessForPermission(
             replacedResourceMapping.get(resource),
@@ -146,13 +109,11 @@ export const getHasReadWritePermission = (resource, userRolePermissionsArg) => {
         );
         return replacingResourceAccess === ACCESS_LEVEL.READ_WRITE_ACCESS;
     }
-    // Return false if neither the resource nor the replacing resource have the correct access.
     return false;
 };
 
 export const selectors = {
     getRoles,
-    getSelectedRole,
     getUserRolePermissions,
     getUserRolePermissionsError,
     getIsLoadingUserRolePermissions,
diff --git a/ui/apps/platform/src/reducers/roles.test.js b/ui/apps/platform/src/reducers/roles.test.js
index d63f8d79418ae..73dfef5bd619b 100644
--- a/ui/apps/platform/src/reducers/roles.test.js
+++ b/ui/apps/platform/src/reducers/roles.test.js
@@ -4,7 +4,6 @@ describe('roles reducer', () => {
     it('should return the initial state', () => {
         const expected = {
             roles: [],
-            selectedRole: null,
             userRolePermissions: null,
             error: null,
             isLoading: true,
diff --git a/ui/apps/platform/src/reducers/searchAutocomplete.js b/ui/apps/platform/src/reducers/searchAutocomplete.js
deleted file mode 100644
index 2f6196a4200eb..0000000000000
--- a/ui/apps/platform/src/reducers/searchAutocomplete.js
+++ /dev/null
@@ -1,57 +0,0 @@
-import { combineReducers } from 'redux';
-import isEqual from 'lodash/isEqual';
-
-export const types = {
-    SEND_AUTOCOMPLETE_REQUEST: 'autocomplete/SEND_AUTOCOMPLETE_REQUEST',
-    RECORD_AUTOCOMPLETE_RESPONSE: 'autocomplete/RECORD_AUTOCOMPLETE_RESPONSE',
-    CLEAR_AUTOCOMPLETE: 'autocomplete/CLEAR_AUTOCOMPLETE',
-    SET_ALL_SEARCH_OPTIONS: 'search/SET_ALL_SEARCH_OPTIONS',
-};
-
-export const actions = {
-    sendAutoCompleteRequest: (request) => ({
-        type: types.SEND_AUTOCOMPLETE_REQUEST,
-        ...request,
-    }),
-    recordAutoCompleteResponse: (autoCompleteResults) => ({
-        type: types.RECORD_AUTOCOMPLETE_RESPONSE,
-        autoCompleteResults,
-    }),
-    clearAutoComplete: () => ({ type: types.CLEAR_AUTOCOMPLETE }),
-    setAllSearchOptions: (options) => ({ type: types.SET_ALL_SEARCH_OPTIONS, options }),
-};
-
-const autoCompleteResults = (state = [], action) => {
-    if (action.type === types.RECORD_AUTOCOMPLETE_RESPONSE) {
-        return action.autoCompleteResults;
-    }
-    if (action.type === types.CLEAR_AUTOCOMPLETE) {
-        return [];
-    }
-    return state;
-};
-
-const allSearchOptions = (state = [], action) => {
-    if (action.type === 'search/SET_ALL_SEARCH_OPTIONS') {
-        const { options } = action;
-        if (options.length % 2 === 0) {
-            return isEqual(options, state) ? state : options;
-        }
-    }
-    return state;
-};
-
-const reducer = combineReducers({
-    autoCompleteResults,
-    allSearchOptions,
-});
-
-const getAutoCompleteResults = (state) => state.autoCompleteResults;
-const getAllSearchOptions = (state) => state.allSearchOptions;
-
-export const selectors = {
-    getAutoCompleteResults,
-    getAllSearchOptions,
-};
-
-export default reducer;
diff --git a/ui/apps/platform/src/routePaths.test.ts b/ui/apps/platform/src/routePaths.test.ts
index fb28cd02823be..4980660e36e16 100644
--- a/ui/apps/platform/src/routePaths.test.ts
+++ b/ui/apps/platform/src/routePaths.test.ts
@@ -14,28 +14,16 @@ import { getLinkToDeploymentInNetworkGraph, isRouteEnabled } from './routePaths'
  */
 describe('routePaths', () => {
     describe('isRouteEnabled for base-images', () => {
-        it('should enable route when feature flag is enabled and user has ImageAdministration read access', () => {
+        it('should enable route when user has ImageAdministration read access', () => {
             const hasReadAccess: HasReadAccess = vi.fn(
                 (resource) => resource === 'ImageAdministration'
             );
-            const isFeatureFlagEnabled: IsFeatureFlagEnabled = vi.fn(
-                (flag) => flag === 'ROX_BASE_IMAGE_DETECTION'
-            );
+            const isFeatureFlagEnabled: IsFeatureFlagEnabled = vi.fn(() => false);
 
             const enabled = isRouteEnabled({ hasReadAccess, isFeatureFlagEnabled }, 'base-images');
 
             expect(enabled).toBe(true);
             expect(hasReadAccess).toHaveBeenCalledWith('ImageAdministration');
-            expect(isFeatureFlagEnabled).toHaveBeenCalledWith('ROX_BASE_IMAGE_DETECTION');
-        });
-
-        it('should disable route when feature flag is disabled', () => {
-            const hasReadAccess: HasReadAccess = vi.fn(() => true);
-            const isFeatureFlagEnabled: IsFeatureFlagEnabled = vi.fn(() => false);
-
-            const enabled = isRouteEnabled({ hasReadAccess, isFeatureFlagEnabled }, 'base-images');
-
-            expect(enabled).toBe(false);
         });
 
         it('should disable route when user lacks ImageAdministration read access', () => {
diff --git a/ui/apps/platform/src/routePaths.ts b/ui/apps/platform/src/routePaths.ts
index 92fa55b5b2b39..ed0adfd920c75 100644
--- a/ui/apps/platform/src/routePaths.ts
+++ b/ui/apps/platform/src/routePaths.ts
@@ -2,7 +2,7 @@
  * Application route paths constants.
  */
 
-import { rbacConfigTypes, resourceTypes, standardEntityTypes } from 'constants/entityTypes';
+import { rbacConfigTypes, resourceTypes } from 'constants/entityTypes';
 import type { IsFeatureFlagEnabled } from 'hooks/useFeatureFlags';
 import type { HasReadAccess } from 'hooks/usePermissions';
 import type { ResourceName } from 'types/roleResources';
@@ -38,7 +38,6 @@ export const clustersSecureClusterPath = `${clustersBasePath}/secure-a-cluster`;
 export const clustersSecureClusterCrsPath = `${clustersBasePath}/secure-a-cluster-crs`;
 export const collectionsBasePath = `${mainPath}/collections`;
 export const collectionsPath = `${mainPath}/collections/:collectionId?`;
-export const complianceBasePath = `${mainPath}/compliance`;
 export const complianceEnhancedBasePath = `${mainPath}/compliance`;
 export const complianceEnhancedCoveragePath = `${complianceEnhancedBasePath}/coverage`;
 export const complianceEnhancedSchedulesPath = `${complianceEnhancedBasePath}/schedules`;
@@ -99,8 +98,15 @@ export const vulnerabilitiesImagesWithoutCvesPath = `${vulnerabilitiesBasePath}/
 export const vulnerabilitiesViewPath = `${vulnerabilitiesBasePath}/results/:viewTemplate/:viewId`;
 
 export const vulnerabilityReportsPath = `${vulnerabilitiesBasePath}/reports`;
-export const vulnerabilityConfigurationReportsPath = `${vulnerabilityReportsPath}/configuration`;
-export const vulnerabilityViewBasedReportsPath = `${vulnerabilityReportsPath}/view-based`;
+export const vulnerabilityImageReportsPath = `${vulnerabilityReportsPath}/images`;
+export const vulnerabilityImageConfigurationsReportsPath = `${vulnerabilityImageReportsPath}/configurations`;
+export const vulnerabilityImageConfigurationsReportsDetailsPath = `${vulnerabilityImageConfigurationsReportsPath}/:reportId`;
+export const vulnerabilityImageViewBasedJobsPath = `${vulnerabilityImageReportsPath}/view-based-jobs`;
+
+export const vulnerabilityNodeReportsPath = `${vulnerabilityReportsPath}/nodes`;
+export const vulnerabilityNodeConfigurationsReportsPath = `${vulnerabilityNodeReportsPath}/configurations`;
+export const vulnerabilityNodeConfigurationsReportsDetailsPath = `${vulnerabilityNodeConfigurationsReportsPath}/:reportId`;
+export const vulnerabilityNodeViewBasedJobsPath = `${vulnerabilityNodeReportsPath}/view-based-jobs`;
 
 // Vulnerability Management 1.0 path for links from Dashboard:
 
@@ -171,7 +177,6 @@ export type RouteKey =
     | 'clusters/secure-a-cluster-crs'
     | 'clusters'
     | 'collections'
-    | 'compliance'
     | 'compliance-coverage'
     | 'compliance-schedules'
     | 'configmanagement'
@@ -194,6 +199,8 @@ export type RouteKey =
     | 'vulnerabilities/exception-management'
     | 'vulnerabilities/node-cves'
     | 'vulnerabilities/reports'
+    | 'vulnerabilities/reports/images'
+    | 'vulnerabilities/reports/nodes'
     | 'vulnerabilities/user-workloads'
     | 'vulnerabilities/platform'
     | 'vulnerabilities/all-images'
@@ -249,25 +256,6 @@ const routeRequirementsMap: Record<RouteKey, RouteRequirements> = {
     collections: {
         resourceAccessRequirements: everyResource(['Deployment', 'WorkflowAdministration']),
     },
-    compliance: {
-        featureFlagRequirements: allEnabled(['ROX_DEPRECATED_COMPLIANCE_DASHBOARD']),
-        // Same resources as compliance-enhanced although lack of commented-out resources affects entire list or entity pages.
-        resourceAccessRequirements: everyResource([
-            // 'Alert', // for Deployment
-            // 'Cluster',
-            'Compliance',
-            // 'Deployment',
-            // 'Image', // for Deployment and Namespace
-            // 'K8sRole', // for Cluster
-            // 'K8sRoleBinding', // for Cluster
-            // 'K8sSubject', // for Cluster
-            // 'Namespace',
-            // 'NetworkPolicy', // for Namespace
-            // 'Node',
-            // 'Secret', // for Deployment and Namespace
-            // 'ServiceAccount', // for Cluster and Deployment
-        ]),
-    },
     'compliance-coverage': {
         resourceAccessRequirements: everyResource(['Compliance', 'Cluster']),
     },
@@ -279,7 +267,6 @@ const routeRequirementsMap: Record<RouteKey, RouteRequirements> = {
         resourceAccessRequirements: someResource([
             everyResource(['Alert', 'WorkflowAdministration']), // PolicyViolationsBySeverity
             // 'Cluster',
-            'Compliance',
             // 'Deployment',
             // 'Image',
             // 'K8sRole',
@@ -369,9 +356,17 @@ const routeRequirementsMap: Record<RouteKey, RouteRequirements> = {
         featureFlagRequirements: allEnabled(['ROX_LEGACY_SCANNER']),
         resourceAccessRequirements: everyResource(['Cluster']),
     },
+    // This is a lightweight page with cards that link to the individually gated report types
+    // below. NavigationSidebar decides link visibility by checking the sub-route keys directly
     'vulnerabilities/reports': {
+        resourceAccessRequirements: everyResource([]),
+    },
+    'vulnerabilities/reports/images': {
         resourceAccessRequirements: everyResource(['Deployment', 'Image']),
     },
+    'vulnerabilities/reports/nodes': {
+        resourceAccessRequirements: everyResource(['Cluster', 'Node']),
+    },
     'vulnerabilities/user-workloads': {
         resourceAccessRequirements: everyResource(['Deployment', 'Image']),
     },
@@ -392,7 +387,6 @@ const routeRequirementsMap: Record<RouteKey, RouteRequirements> = {
         resourceAccessRequirements: everyResource(['Cluster']),
     },
     'base-images': {
-        featureFlagRequirements: allEnabled(['ROX_BASE_IMAGE_DETECTION']),
         resourceAccessRequirements: everyResource(['ImageAdministration']),
     },
     'vulnerability-management': {
@@ -414,9 +408,15 @@ type RoutePredicates = {
 };
 
 export function isRouteEnabled(
-    { hasReadAccess, isFeatureFlagEnabled }: RoutePredicates,
-    routeKey: RouteKey
-) {
+    routePredicates: RoutePredicates,
+    routeKey: RouteKey | RouteKey[]
+): boolean {
+    // An array is enabled if any one of the route keys is enabled.
+    if (Array.isArray(routeKey)) {
+        return routeKey.some((key) => isRouteEnabled(routePredicates, key));
+    }
+
+    const { hasReadAccess, isFeatureFlagEnabled } = routePredicates;
     const { featureFlagRequirements, resourceAccessRequirements } = routeRequirementsMap[routeKey];
 
     const areFeatureFlagRequirementsMet = featureFlagRequirements
@@ -447,7 +447,6 @@ export const urlEntityListTypes: Record<string, string> = {
     [resourceTypes.COMPONENT]: 'components', // TODO verify obsolete because non-postgres
     [resourceTypes.NODE_COMPONENT]: 'node-components',
     [resourceTypes.IMAGE_COMPONENT]: 'image-components',
-    [standardEntityTypes.CONTROL]: 'controls',
     [rbacConfigTypes.SERVICE_ACCOUNT]: 'serviceaccounts',
     [rbacConfigTypes.SUBJECT]: 'subjects',
     [rbacConfigTypes.ROLE]: 'roles',
@@ -468,8 +467,6 @@ export const urlEntityTypes: Record<string, string> = {
     [resourceTypes.COMPONENT]: 'component', // TODO verify obsolete because non-postgres
     [resourceTypes.NODE_COMPONENT]: 'node-component',
     [resourceTypes.IMAGE_COMPONENT]: 'image-component',
-    [standardEntityTypes.CONTROL]: 'control',
-    [standardEntityTypes.STANDARD]: 'standard',
     [rbacConfigTypes.SERVICE_ACCOUNT]: 'serviceaccount',
     [rbacConfigTypes.SUBJECT]: 'subject',
     [rbacConfigTypes.ROLE]: 'role',
@@ -484,6 +481,7 @@ const vulnerabilitiesPathToLabelMap: Record<string, string> = {
     [vulnerabilitiesPlatformCvesPath]: 'Platform CVEs',
     [vulnerabilitiesNodeCvesPath]: 'Node CVEs',
     [vulnerabilityReportsPath]: 'Reports',
+    [vulnerabilityImageReportsPath]: 'Image reports',
     [exceptionManagementPath]: 'Exception Management',
 };
 
@@ -492,8 +490,6 @@ export const basePathToLabelMap: Record<string, string> = {
     [networkBasePath]: 'Network Graph',
     [listeningEndpointsBasePath]: 'Listening Endpoints',
     [violationsBasePath]: 'Violations',
-    [complianceBasePath]: 'Compliance',
-    // [complianceEnhancedBasePath]: 'Compliance (2.0)',
     ...vulnerabilitiesPathToLabelMap,
     ...vulnManagementPathToLabelMap,
     [configManagementPath]: 'Configuration Management',
diff --git a/ui/apps/platform/src/sagas/groupSagas.js b/ui/apps/platform/src/sagas/groupSagas.js
index a30ad168c3be8..bf49401d17e1d 100644
--- a/ui/apps/platform/src/sagas/groupSagas.js
+++ b/ui/apps/platform/src/sagas/groupSagas.js
@@ -1,6 +1,5 @@
-import { all, call, fork, put, select, takeLatest } from 'redux-saga/effects';
+import { all, call, put, select, takeLatest } from 'redux-saga/effects';
 import {
-    deleteRuleGroup as serviceDeleteRuleGroup,
     fetchGroups as serviceFetchGroups,
     getDefaultGroup as serviceGetDefaultGroup,
     updateOrAddGroup as serviceUpdateOrAddGroup,
@@ -66,28 +65,9 @@ function* saveRuleGroup(action) {
     }
 }
 
-function* deleteRuleGroup(action) {
-    const { group } = action;
-    try {
-        yield call(serviceDeleteRuleGroup, group);
-        yield call(getRuleGroups);
-    } catch (error) {
-        Raven.captureException(error);
-    }
-}
-
-function* watchSaveRuleGroup() {
-    yield takeLatest(types.SAVE_RULE_GROUP, saveRuleGroup);
-}
-
-function* watchDeleteRuleGroup() {
-    yield takeLatest(types.DELETE_RULE_GROUP, deleteRuleGroup);
-}
-
 export default function* groups() {
     yield all([
         takeLatest(types.FETCH_RULE_GROUPS.REQUEST, getRuleGroups),
-        fork(watchSaveRuleGroup),
-        fork(watchDeleteRuleGroup),
+        takeLatest(types.SAVE_RULE_GROUP, saveRuleGroup),
     ]);
 }
diff --git a/ui/apps/platform/src/sagas/index.js b/ui/apps/platform/src/sagas/index.js
index 769f824e4a97c..96f5cfd2de5e9 100644
--- a/ui/apps/platform/src/sagas/index.js
+++ b/ui/apps/platform/src/sagas/index.js
@@ -2,10 +2,9 @@ import { all, fork } from 'redux-saga/effects';
 
 import authProviders from './authSagas';
 import roles from './roleSagas';
-import searchAutoComplete from './searchAutocompleteSagas';
 
 import groups from './groupSagas';
 
 export default function* root() {
-    yield all([fork(authProviders), fork(roles), fork(searchAutoComplete), fork(groups)]);
+    yield all([fork(authProviders), fork(roles), fork(groups)]);
 }
diff --git a/ui/apps/platform/src/sagas/roleSagas.js b/ui/apps/platform/src/sagas/roleSagas.js
index 862de22e0dfb7..e3be95248d78e 100644
--- a/ui/apps/platform/src/sagas/roleSagas.js
+++ b/ui/apps/platform/src/sagas/roleSagas.js
@@ -1,15 +1,6 @@
-import { all, call, fork, put, select, takeLatest } from 'redux-saga/effects';
-import {
-    createRole as serviceCreateRole,
-    deleteRole as serviceDeleteRole,
-    fetchRoles as serviceFetchRoles,
-    updateRole as serviceUpdateRole,
-} from 'services/RolesService';
+import { all, call, put, takeLatest } from 'redux-saga/effects';
+import { fetchRoles as serviceFetchRoles } from 'services/RolesService';
 import { actions, types } from 'reducers/roles';
-import { selectors } from 'reducers';
-
-import Raven from 'raven-js';
-import { actions as notificationActions } from 'reducers/notifications';
 
 function* getRoles() {
     try {
@@ -20,67 +11,6 @@ function* getRoles() {
     }
 }
 
-function* saveRole(action) {
-    try {
-        const { role } = action;
-        const roles = yield select(selectors.getRoles);
-        const isNewRole = !roles.filter((currRole) => currRole.name === role.name).length;
-        if (isNewRole) {
-            yield call(serviceCreateRole, role);
-            yield put(actions.selectRole(role));
-        } else {
-            yield call(serviceUpdateRole, role);
-            yield put(actions.selectRole(role));
-        }
-        yield call(getRoles);
-    } catch (error) {
-        yield put(notificationActions.addNotification(error.response.data.error));
-        yield put(notificationActions.removeOldestNotification());
-        Raven.captureException(error);
-    }
-}
-
-function* deleteRole(action) {
-    const { id } = action;
-    try {
-        yield call(serviceDeleteRole, id);
-        yield put(actions.fetchRoles.request());
-    } catch (error) {
-        yield put(notificationActions.addNotification(error.response.data.error));
-        yield put(notificationActions.removeOldestNotification());
-        Raven.captureException(error);
-    }
-}
-
-function* selectRole(action) {
-    const { role } = action;
-    try {
-        if (!role) {
-            const roles = yield select(selectors.getRoles);
-            yield put(actions.selectRole(roles[0]));
-        }
-    } catch (error) {
-        Raven.captureException(error);
-    }
-}
-
-function* watchSaveRole() {
-    yield takeLatest(types.SAVE_ROLE, saveRole);
-}
-
-function* watchDeleteRole() {
-    yield takeLatest(types.DELETE_ROLE, deleteRole);
-}
-
-function* watchSelectRole() {
-    yield takeLatest(types.SELECTED_ROLE, selectRole);
-}
-
 export default function* integrations() {
-    yield all([
-        takeLatest(types.FETCH_ROLES.REQUEST, getRoles),
-        fork(watchSaveRole),
-        fork(watchDeleteRole),
-        fork(watchSelectRole),
-    ]);
+    yield all([takeLatest(types.FETCH_ROLES.REQUEST, getRoles)]);
 }
diff --git a/ui/apps/platform/src/sagas/searchAutocompleteSagas.js b/ui/apps/platform/src/sagas/searchAutocompleteSagas.js
deleted file mode 100644
index 6e1f507029d63..0000000000000
--- a/ui/apps/platform/src/sagas/searchAutocompleteSagas.js
+++ /dev/null
@@ -1,24 +0,0 @@
-import { call, fork, put, take } from 'redux-saga/effects';
-
-import { fetchAutoCompleteResults as serviceFetchAutoCompleteResults } from 'services/SearchService';
-import { actions, types } from 'reducers/searchAutocomplete';
-
-function* getAutoCompleteResults(request) {
-    try {
-        const result = yield call(serviceFetchAutoCompleteResults, request);
-        yield put(actions.recordAutoCompleteResponse(result));
-    } catch {
-        yield put(actions.recordAutoCompleteResponse([]));
-    }
-}
-
-function* watchFetchRequest() {
-    while (true) {
-        const request = yield take(types.SEND_AUTOCOMPLETE_REQUEST);
-        yield fork(getAutoCompleteResults, request);
-    }
-}
-
-export default function* searchAutoComplete() {
-    yield fork(watchFetchRequest);
-}
diff --git a/ui/apps/platform/src/services/AuthService/AuthService.ts b/ui/apps/platform/src/services/AuthService/AuthService.ts
index 33f3f5c2e1114..ca9a50a4d82ef 100644
--- a/ui/apps/platform/src/services/AuthService/AuthService.ts
+++ b/ui/apps/platform/src/services/AuthService/AuthService.ts
@@ -46,7 +46,14 @@ export class AuthHttpError extends Error {
     isInvalidAuth = (): boolean => this.code === 401;
 }
 
-export type AuthProviderType = 'auth0' | 'oidc' | 'saml' | 'userpki' | 'iap' | 'openshift';
+export type AuthProviderType =
+    | 'auth0'
+    | 'oidc'
+    | 'saml'
+    | 'userpki'
+    | 'iap'
+    | 'openshift'
+    | 'openshift-with-acm-roles';
 
 export type AuthProviderConfig = Record<
     string,
diff --git a/ui/apps/platform/src/services/ClustersService.ts b/ui/apps/platform/src/services/ClustersService.ts
index 9aa7e844f39f5..65d6d58889f85 100644
--- a/ui/apps/platform/src/services/ClustersService.ts
+++ b/ui/apps/platform/src/services/ClustersService.ts
@@ -15,8 +15,6 @@ const clustersUrl = '/v1/clusters';
 const clusterDefaultsUrl = '/v1/cluster-defaults';
 const clusterInitUrl = '/v1/cluster-init';
 const upgradesUrl = '/v1/sensorupgrades';
-const autoUpgradeConfigUrl = `${upgradesUrl}/config`;
-const manualUpgradeUrl = `${upgradesUrl}/cluster`;
 
 export type ClusterLabels = Record<string, string>;
 
@@ -82,42 +80,6 @@ export function fetchClusterWithRetentionInformation(id: string): Promise<Cluste
     });
 }
 
-export type AutoUpgradeConfig = {
-    enableAutoUpgrade: boolean;
-    autoUpgradeFeature: 'SUPPORTED' | 'NOT_SUPPORTED';
-};
-
-/**
- * Checks is auto upgrade is supported
- */
-export function isAutoUpgradeSupported(autoUpgradeConfig: AutoUpgradeConfig) {
-    return autoUpgradeConfig.autoUpgradeFeature === 'SUPPORTED';
-}
-
-/**
- * Gets the cluster autoupgrade config.
- */
-export function getAutoUpgradeConfig(): Promise<AutoUpgradeConfig> {
-    return axios.get<{ config: AutoUpgradeConfig }>(autoUpgradeConfigUrl).then((response) => {
-        return response?.data?.config ?? {};
-    });
-}
-
-/**
- * Saves the cluster autoupgrade config.
- */
-export function saveAutoUpgradeConfig(config: AutoUpgradeConfig): Promise<Empty> {
-    const wrappedObject = { config: { enableAutoUpgrade: config.enableAutoUpgrade } };
-    return axios.post<Empty>(autoUpgradeConfigUrl, wrappedObject).then((response) => response.data);
-}
-
-/**
- * Manually start a sensor upgrade given the cluster ID.
- */
-export function upgradeCluster(id: string): Promise<Empty> {
-    return axios.post(`${manualUpgradeUrl}/${id}`);
-}
-
 /**
  * Start a cluster cert rotation.
  */
@@ -125,13 +87,6 @@ export function rotateClusterCerts(id: string): Promise<Empty> {
     return axios.post(`${upgradesUrl}/rotateclustercerts/${id}`);
 }
 
-/**
- * Manually start a sensor upgrade for an array of clusters.
- */
-export function upgradeClusters(ids: string[] = []): Promise<Empty[]> {
-    return Promise.all(ids.map((id) => upgradeCluster(id)));
-}
-
 /**
  * Deletes cluster given the cluster ID. Returns an empty object.
  */
diff --git a/ui/apps/platform/src/services/ComplianceService.ts b/ui/apps/platform/src/services/ComplianceService.ts
deleted file mode 100644
index e02a44003d9bf..0000000000000
--- a/ui/apps/platform/src/services/ComplianceService.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import axios from './instance';
-import type { Empty } from './types';
-
-const standardsUrl = '/v1/compliance/standards';
-
-export type ComplianceStandardScope = 'UNSET' | 'CLUSTER' | 'NAMESPACE' | 'DEPLOYMENT' | 'NODE';
-
-export type ComplianceStandardMetadata = {
-    id: string;
-    name: string;
-    description: string;
-    numImplementedChecks: number; // int32
-    scopes: ComplianceStandardScope[];
-    dynamic: boolean;
-    hideScanResults: boolean;
-};
-
-export function fetchComplianceStandards(): Promise<ComplianceStandardMetadata[]> {
-    return axios
-        .get<{ standards: ComplianceStandardMetadata[] }>(standardsUrl)
-        .then((response) => response.data?.standards ?? []);
-}
-
-/*
- * Temporary frontend work-around for 4.1 version,
- * because standards are not always sorted in ascending order by name.
- */
-
-function compareStandardsByName(
-    standardPrev: ComplianceStandardMetadata,
-    standardNext: ComplianceStandardMetadata
-) {
-    const { name: namePrev } = standardPrev;
-    const { name: nameNext } = standardNext;
-
-    return namePrev < nameNext ? -1 : namePrev > nameNext ? 1 : 0;
-}
-
-export function fetchComplianceStandardsSortedByName(): Promise<ComplianceStandardMetadata[]> {
-    return fetchComplianceStandards().then((standards) => standards.sort(compareStandardsByName));
-}
-
-export function patchComplianceStandard(id: string, hideScanResults: boolean): Promise<Empty> {
-    return axios
-        .patch<Empty>(`${standardsUrl}/${id}`, { hideScanResults })
-        .then((response) => response.data);
-}
diff --git a/ui/apps/platform/src/services/DeploymentsService.ts b/ui/apps/platform/src/services/DeploymentsService.ts
index 40564d1394989..054cce9a94bee 100644
--- a/ui/apps/platform/src/services/DeploymentsService.ts
+++ b/ui/apps/platform/src/services/DeploymentsService.ts
@@ -154,3 +154,19 @@ export type DeploymentWithRisk = {
     deployment: Deployment;
     risk?: Risk;
 };
+
+export type DeploymentRiskSummary = {
+    summary: string;
+};
+
+/**
+ * Fetches an AI-generated risk summary for a deployment by ID.
+ */
+export function fetchDeploymentRiskSummary(id: string): Promise<DeploymentRiskSummary> {
+    if (!id) {
+        throw new Error('Deployment ID must be specified');
+    }
+    return axios
+        .get<DeploymentRiskSummary>(`${deploymentWithRiskUrl}/${id}/ai-summary`, { timeout: 60000 })
+        .then((response) => response.data);
+}
diff --git a/ui/apps/platform/src/services/GroupsService.ts b/ui/apps/platform/src/services/GroupsService.ts
index 83e0bffeae953..16b5cfd43fc20 100644
--- a/ui/apps/platform/src/services/GroupsService.ts
+++ b/ui/apps/platform/src/services/GroupsService.ts
@@ -48,14 +48,3 @@ export function getDefaultGroup({
             response: response.data?.groups[0],
         }));
 }
-
-/**
- * Deletes a group rule.
- */
-export function deleteRuleGroup(data: Group) {
-    const { key, authProviderId, value, id } = data.props;
-    return axios.delete(
-        `${url}?authProviderId=${authProviderId}&key=${key}&value=${value}&id=${id}`,
-        {}
-    );
-}
diff --git a/ui/apps/platform/src/services/MetadataService.ts b/ui/apps/platform/src/services/MetadataService.ts
index 59df280e2a037..0fede63fa82d3 100644
--- a/ui/apps/platform/src/services/MetadataService.ts
+++ b/ui/apps/platform/src/services/MetadataService.ts
@@ -56,3 +56,12 @@ export function fetchCentralCapabilities(): Promise<CentralServicesCapabilities>
         .get<CentralServicesCapabilities>('/v1/central-capabilities')
         .then((response) => response.data);
 }
+
+export type LightspeedStatus = {
+    available: boolean;
+    message: string;
+};
+
+export function fetchLightspeedStatus(): Promise<LightspeedStatus> {
+    return axios.get<LightspeedStatus>('/v1/lightspeed/status').then((response) => response.data);
+}
diff --git a/ui/apps/platform/src/services/NodeReportsService.ts b/ui/apps/platform/src/services/NodeReportsService.ts
new file mode 100644
index 0000000000000..6f4cbfbffd434
--- /dev/null
+++ b/ui/apps/platform/src/services/NodeReportsService.ts
@@ -0,0 +1,238 @@
+import queryString from 'qs';
+
+import type { ReportNotificationMethod } from 'types/reportJob';
+import type { SearchFilter, SearchQueryOptions } from 'types/search';
+import {
+    buildNestedRawQueryParams,
+    getListQueryParams,
+    getPaginationParams,
+    getRequestQueryStringForSearchFilter,
+} from 'utils/searchUtils';
+
+import { makeCancellableAxiosRequest } from './cancellationUtils';
+import type { CancellableRequest } from './cancellationUtils';
+import axios from './instance';
+import type { FetchReportHistoryServiceParams } from './ReportsService';
+import { isConfiguredReportSnapshot } from './ReportsService.types';
+import type {
+    ConfiguredReportSnapshot,
+    NodeViewBasedReportSnapshot,
+    NodeVulnerabilityReportConfiguration,
+    ReportHistoryResponse,
+    ReportRequestViewBased,
+    RunReportResponse,
+    RunReportResponseViewBased,
+} from './ReportsService.types';
+import type { Empty } from './types';
+
+// https://github.com/stackrox/stackrox/blob/master/proto/api/v2/node_report_service.proto
+
+export const nodeReportDownloadURL = '/api/reports/node/jobs/download';
+
+// Configuration of scheduled reports
+
+// PostNodeReportConfiguration
+export function createNodeReportConfiguration(
+    configuration: NodeVulnerabilityReportConfiguration
+): Promise<NodeVulnerabilityReportConfiguration> {
+    return axios
+        .post<NodeVulnerabilityReportConfiguration>(
+            '/v2/reports/node/configurations',
+            configuration
+        )
+        .then((response) => response.data);
+}
+
+// UpdateNodeReportConfiguration
+export function updateNodeReportConfiguration(
+    reportId: string,
+    configuration: NodeVulnerabilityReportConfiguration
+): Promise<Empty> {
+    return axios
+        .put<Empty>(`/v2/reports/node/configurations/${reportId}`, configuration)
+        .then((response) => response.data);
+}
+
+// ListNodeReportConfigurations
+export function fetchNodeReportConfigurations({
+    searchFilter,
+    page,
+    perPage,
+    sortOption,
+}: SearchQueryOptions): CancellableRequest<NodeVulnerabilityReportConfiguration[]> {
+    const params = getListQueryParams({ searchFilter, sortOption, page, perPage });
+    return makeCancellableAxiosRequest((signal) =>
+        axios
+            .get<{
+                reportConfigs: NodeVulnerabilityReportConfiguration[];
+            }>(`/v2/reports/node/configurations?${params}`, { signal })
+            .then((response) => response?.data?.reportConfigs ?? [])
+    );
+}
+
+// CountNodeReportConfigurations
+export function fetchNodeReportConfigurationsCount(
+    searchFilter: SearchFilter
+): CancellableRequest<{ count: number }> {
+    const params = queryString.stringify(
+        { query: getRequestQueryStringForSearchFilter(searchFilter) },
+        { arrayFormat: 'repeat' }
+    );
+    return makeCancellableAxiosRequest((signal) =>
+        axios
+            .get<{ count: number }>(`/v2/reports/node/configuration-count?${params}`, { signal })
+            .then((response) => response.data)
+    );
+}
+
+// GetNodeReportConfiguration
+export function fetchNodeReportConfiguration(
+    reportId: string
+): Promise<NodeVulnerabilityReportConfiguration> {
+    return axios
+        .get<NodeVulnerabilityReportConfiguration>(`/v2/reports/node/configurations/${reportId}`)
+        .then((response) => response.data);
+}
+
+// DeleteNodeReportConfiguration
+export function deleteNodeReportConfiguration(reportId: string): Promise<Empty> {
+    return axios
+        .delete<Empty>(`/v2/reports/node/configurations/${reportId}`)
+        .then((response) => response.data);
+}
+
+// Configuration-based jobs
+
+// RunNodeReport
+export function runNodeReport(
+    reportConfigId: string,
+    reportNotificationMethod: ReportNotificationMethod
+): Promise<RunReportResponse> {
+    return axios
+        .post<RunReportResponse>('/v2/reports/node/run', {
+            reportConfigId,
+            reportNotificationMethod,
+        })
+        .then((response) => response.data);
+}
+
+type FetchNodeReportHistoryServiceParams = Omit<FetchReportHistoryServiceParams, 'showMyHistory'>;
+
+// GetNodeReportHistory
+export function fetchNodeReportHistory({
+    id,
+    query,
+    page,
+    perPage,
+    sortOption,
+}: FetchNodeReportHistoryServiceParams): Promise<ConfiguredReportSnapshot[]> {
+    const params = queryString.stringify(
+        {
+            reportParamQuery: {
+                query,
+                pagination: getPaginationParams({ page, perPage, sortOption }),
+            },
+        },
+        { arrayFormat: 'repeat', allowDots: true }
+    );
+    return axios
+        .get<ReportHistoryResponse>(`/v2/reports/node/configurations/${id}/history?${params}`)
+        .then((response) => {
+            const snapshots = response.data?.reportSnapshots ?? [];
+            return snapshots.filter(isConfiguredReportSnapshot);
+        });
+}
+
+// GetMyNodeReportHistory
+export function fetchMyNodeReportHistory({
+    id,
+    query,
+    page,
+    perPage,
+    sortOption,
+}: FetchNodeReportHistoryServiceParams): Promise<ConfiguredReportSnapshot[]> {
+    const params = queryString.stringify(
+        {
+            reportParamQuery: {
+                query,
+                pagination: getPaginationParams({ page, perPage, sortOption }),
+            },
+        },
+        { arrayFormat: 'repeat', allowDots: true }
+    );
+    return axios
+        .get<ReportHistoryResponse>(`/v2/reports/node/configurations/${id}/my-history?${params}`)
+        .then((response) => {
+            const snapshots = response.data?.reportSnapshots ?? [];
+            return snapshots.filter(isConfiguredReportSnapshot);
+        });
+}
+
+// Job management
+
+// GetNodeReportStatus
+
+// CancelNodeReport
+
+// DeleteNodeReport
+
+// View-based jobs
+
+// PostViewBasedNodeReport
+export function runNodeViewBasedReport({
+    query,
+    areaOfConcern,
+}: {
+    query: string;
+    areaOfConcern: string;
+}): Promise<RunReportResponseViewBased> {
+    const requestBody: ReportRequestViewBased = {
+        type: 'NODE_VULNERABILITY',
+        nodeVulnReportFilters: {
+            query,
+        },
+        areaOfConcern, // 'Nodes' for analytics ony
+    };
+
+    return axios
+        .post<RunReportResponseViewBased>('/v2/reports/node/view-based/run', requestBody)
+        .then((response) => response.data);
+}
+
+// GetViewBasedNodeReportHistory
+export function getViewBasedNodeReportHistory({
+    searchFilter,
+    page,
+    perPage,
+    sortOption,
+}: SearchQueryOptions): Promise<NodeViewBasedReportSnapshot[]> {
+    const params = buildNestedRawQueryParams(
+        { searchFilter, page, perPage, sortOption },
+        'reportParamQuery'
+    );
+
+    return axios
+        .get<{
+            reportSnapshots: NodeViewBasedReportSnapshot[];
+        }>(`/v2/reports/node/view-based/history?${params}`)
+        .then((response) => response.data?.reportSnapshots ?? []);
+}
+
+// GetViewBasedMyNodeReportHistory
+export function getViewBasedMyNodeReportHistory({
+    searchFilter,
+    page,
+    perPage,
+    sortOption,
+}: SearchQueryOptions): Promise<NodeViewBasedReportSnapshot[]> {
+    const params = buildNestedRawQueryParams(
+        { searchFilter, page, perPage, sortOption },
+        'reportParamQuery'
+    );
+
+    return axios
+        .get<{
+            reportSnapshots: NodeViewBasedReportSnapshot[];
+        }>(`/v2/reports/node/view-based/my-history?${params}`)
+        .then((response) => response.data?.reportSnapshots ?? []);
+}
diff --git a/ui/apps/platform/src/services/ReportsService.ts b/ui/apps/platform/src/services/ReportsService.ts
index d09b10a9e3dce..d68fe3836b21a 100644
--- a/ui/apps/platform/src/services/ReportsService.ts
+++ b/ui/apps/platform/src/services/ReportsService.ts
@@ -6,7 +6,7 @@ import {
 } from 'services/ReportsService.types';
 import type {
     ConfiguredReportSnapshot,
-    ReportConfiguration,
+    ImageVulnerabilityReportConfiguration,
     ReportHistoryResponse,
     ReportRequestViewBased,
     RunReportResponse,
@@ -15,17 +15,45 @@ import type {
 } from 'services/ReportsService.types';
 import type { ApiSortOption, SearchFilter } from 'types/search';
 import { buildNestedRawQueryParams, getPaginationParams } from 'utils/searchUtils';
-import type { ReportNotificationMethod, ReportStatus } from 'types/reportJob';
+import type { ReportNotificationMethod } from 'types/reportJob';
 import { sanitizeFilename } from 'utils/fileUtils';
 
 import axios from './instance';
+import { makeCancellableAxiosRequest } from './cancellationUtils';
+import type { CancellableRequest } from './cancellationUtils';
 import type { Empty } from './types';
 import { saveFile } from './DownloadService';
 
 // The following functions are built around the new VM Reporting Enhancements
 export const reportDownloadURL = '/api/reports/jobs/download';
 
-// @TODO: Same logic is used in fetchReportConfigurations. Maybe consider something more DRY
+// https://github.com/stackrox/stackrox/blob/master/proto/api/v2/report_service.proto
+
+// Configuration of scheduled reports
+
+// Promise because of TS2339 in ImageVulnerabilityReportWizard component
+// PostReportConfiguration
+export function createReportConfiguration(
+    configuration: ImageVulnerabilityReportConfiguration
+): Promise<ImageVulnerabilityReportConfiguration> {
+    return axios
+        .post<ImageVulnerabilityReportConfiguration>('/v2/reports/configurations', configuration)
+        .then((response) => response.data);
+}
+
+// Promise because of TS2339 in ImageVulnerabilityReportWizard component
+// UpdateReportConfiguration
+export function updateReportConfiguration(
+    reportId: string,
+    configuration: ImageVulnerabilityReportConfiguration
+): Promise<Empty> {
+    return axios
+        .put<Empty>(`/v2/reports/configurations/${reportId}`, configuration)
+        .then((response) => response.data);
+}
+
+// Promise because of @typescript-eslint/await-thenable in useFetchReports hook
+// CountReportConfigurations
 export function fetchReportConfigurationsCount({
     query,
 }: {
@@ -39,11 +67,11 @@ export function fetchReportConfigurationsCount({
     );
     return axios
         .get<{ count: number }>(`/v2/reports/configuration-count?${params}`)
-        .then((response) => {
-            return response.data;
-        });
+        .then((response) => response.data);
 }
 
+// Promise because of @typescript-eslint/await-thenable in useFetchReports hook
+// ListReportConfigurations
 export function fetchReportConfigurations({
     query,
     page,
@@ -54,7 +82,7 @@ export function fetchReportConfigurations({
     page: number;
     perPage: number;
     sortOption: ApiSortOption;
-}): Promise<ReportConfiguration[]> {
+}): Promise<ImageVulnerabilityReportConfiguration[]> {
     const params = queryString.stringify(
         {
             query,
@@ -63,35 +91,31 @@ export function fetchReportConfigurations({
         { arrayFormat: 'repeat', allowDots: true }
     );
     return axios
-        .get<{ reportConfigs: ReportConfiguration[] }>(`/v2/reports/configurations?${params}`)
-        .then((response) => {
-            return response?.data?.reportConfigs ?? [];
-        });
+        .get<{
+            reportConfigs: ImageVulnerabilityReportConfiguration[];
+        }>(`/v2/reports/configurations?${params}`)
+        .then((response) => response?.data?.reportConfigs ?? []);
 }
 
-export function fetchReportConfiguration(reportId: string): Promise<ReportConfiguration> {
+// Promise because of @typescript-eslint/await-thenable in useFetchReport hook
+// GetReportConfiguration
+export function fetchReportConfiguration(
+    reportId: string
+): Promise<ImageVulnerabilityReportConfiguration> {
     return axios
-        .get<ReportConfiguration>(`/v2/reports/configurations/${reportId}`)
-        .then((response) => {
-            return response.data;
-        });
+        .get<ImageVulnerabilityReportConfiguration>(`/v2/reports/configurations/${reportId}`)
+        .then((response) => response.data);
 }
 
-export function fetchReportStatus(id: string): Promise<ReportStatus | null> {
+// Promise because of @typescript-eslint/await-thenable in useDeleteModal hook
+// DeleteReportConfiguration
+export function deleteReportConfiguration(reportId: string): Promise<Empty> {
     return axios
-        .get<{ status: ReportStatus | null }>(`/v2/reports/jobs/${id}/status`)
-        .then((response) => {
-            return response.data?.status;
-        });
+        .delete<Empty>(`/v2/reports/configurations/${reportId}`)
+        .then((response) => response.data);
 }
 
-export function fetchReportLastRunStatus(id: string): Promise<ReportStatus | null> {
-    return axios
-        .get<{ status: ReportStatus | null }>(`/v2/reports/last-status/${id}`)
-        .then((response) => {
-            return response.data?.status;
-        });
-}
+// Configuration-based jobs
 
 export type FetchReportHistoryServiceParams = {
     id: string;
@@ -102,6 +126,8 @@ export type FetchReportHistoryServiceParams = {
     showMyHistory: boolean;
 };
 
+// Promise because of @typescript-eslint/await-thenable in useWatchLastSnapshotForReports hook
+// GetReportHistory and GetMyReportHistory
 export function fetchReportHistory({
     id,
     query,
@@ -119,16 +145,42 @@ export function fetchReportHistory({
         },
         { arrayFormat: 'repeat', allowDots: true }
     );
+    const history = showMyHistory ? 'my-history' : 'history';
     return axios
-        .get<ReportHistoryResponse>(
-            `/v2/reports/configurations/${id}/${showMyHistory ? 'my-history' : 'history'}?${params}`
-        )
+        .get<ReportHistoryResponse>(`/v2/reports/configurations/${id}/${history}?${params}`)
         .then((response) => {
             const snapshots = response.data?.reportSnapshots ?? [];
             return snapshots.filter(isConfiguredReportSnapshot);
         });
 }
 
+// Promise because of TS2339 in useRunReport hook
+// RunReport
+// @TODO: Rename this to runReport when we remove the old report code
+export function runReportRequest(
+    reportConfigId: string,
+    reportNotificationMethod: ReportNotificationMethod
+): Promise<RunReportResponse> {
+    return axios
+        .post<RunReportResponse>('/v2/reports/run', {
+            reportConfigId,
+            reportNotificationMethod,
+        })
+        .then((response) => response.data);
+}
+
+// Job management
+
+// Promise because of TS2322 in ReportJobs component
+// DeleteReport
+export function deleteDownloadableReport(reportId: string): Promise<Empty> {
+    return axios
+        .delete<Empty>(`/v2/reports/jobs/${reportId}/delete`)
+        .then((response) => response.data);
+}
+
+// View-based jobs
+
 export type FetchViewBasedReportHistoryServiceParams = {
     searchFilter: SearchFilter;
     page: number;
@@ -137,13 +189,14 @@ export type FetchViewBasedReportHistoryServiceParams = {
     showMyHistory: boolean;
 };
 
+// GetViewBasedMyReportHistory and GetViewBasedReportHistory
 export function fetchViewBasedReportHistory({
     searchFilter,
     page,
     perPage,
     sortOption,
     showMyHistory,
-}: FetchViewBasedReportHistoryServiceParams): Promise<ViewBasedReportSnapshot[]> {
+}: FetchViewBasedReportHistoryServiceParams): CancellableRequest<ViewBasedReportSnapshot[]> {
     const params = buildNestedRawQueryParams(
         { searchFilter, page, perPage, sortOption },
         'reportParamQuery'
@@ -153,67 +206,16 @@ export function fetchViewBasedReportHistory({
         ? '/v2/reports/view-based/my-history'
         : '/v2/reports/view-based/history';
 
-    return axios.get<ReportHistoryResponse>(`${endpoint}?${params}`).then((response) => {
-        const snapshots = response.data?.reportSnapshots ?? [];
-        return snapshots.filter(isViewBasedReportSnapshot);
-    });
-}
-
-export function createReportConfiguration(
-    report: ReportConfiguration
-): Promise<ReportConfiguration> {
-    return axios
-        .post<ReportConfiguration>('/v2/reports/configurations', report)
-        .then((response) => {
-            return response.data;
-        });
-}
-
-export function updateReportConfiguration(
-    reportId: string,
-    report: ReportConfiguration
-): Promise<ReportConfiguration> {
-    return axios
-        .put<ReportConfiguration>(`/v2/reports/configurations/${reportId}`, report)
-        .then((response) => {
-            return response.data;
-        });
-}
-
-export function deleteReportConfiguration(reportId: string): Promise<Empty> {
-    return axios.delete<Empty>(`/v2/reports/configurations/${reportId}`).then((response) => {
-        return response.data;
-    });
-}
-
-// @TODO: Rename this to runReport when we remove the old report code
-export function runReportRequest(
-    reportConfigId: string,
-    reportNotificationMethod: ReportNotificationMethod
-): Promise<RunReportResponse> {
-    return axios
-        .post<RunReportResponse>('/v2/reports/run', {
-            reportConfigId,
-            reportNotificationMethod,
+    return makeCancellableAxiosRequest((signal) =>
+        axios.get<ReportHistoryResponse>(`${endpoint}?${params}`, { signal }).then((response) => {
+            const snapshots = response.data?.reportSnapshots ?? [];
+            return snapshots.filter(isViewBasedReportSnapshot);
         })
-        .then((response) => {
-            return response.data;
-        });
-}
-
-export function downloadReport(reportId: string) {
-    return axios.get<string>(`/v2/reports/jobs/${reportId}/download`).then((response) => {
-        return response.data;
-    });
-}
-
-export function deleteDownloadableReport(reportId: string) {
-    return axios.delete<Empty>(`/v2/reports/jobs/${reportId}/delete`).then((response) => {
-        return response.data;
-    });
+    );
 }
 
-export function runViewBasedReport({
+// PostViewBasedReport
+export function runImageViewBasedReport({
     query,
     areaOfConcern,
 }: {
@@ -233,6 +235,8 @@ export function runViewBasedReport({
         .then((response) => response.data);
 }
 
+// Job download
+
 /**
  * Downloads a report file by job ID and saves it to the user's device with a sanitized filename
  * Returns file size in bytes for analytics tracking
diff --git a/ui/apps/platform/src/services/ReportsService.types.ts b/ui/apps/platform/src/services/ReportsService.types.ts
index a5f18bcd461cb..5c7fb837986e0 100644
--- a/ui/apps/platform/src/services/ReportsService.types.ts
+++ b/ui/apps/platform/src/services/ReportsService.types.ts
@@ -10,16 +10,62 @@ export type ReportConfigurationBase = {
     name: string;
     description: string;
     notifiers: NotifierConfiguration[];
-    schedule: Schedule | null;
+    schedule: ReportSchedule | null;
 };
 
-export type GenericVulnerabilityReportConfiguration = {
+// Not exactly 1:1 with the proto, which uses a oneOf that technically allows mismatched
+// type/filters (e.g. node type with image filters). Backend confirmed that can't happen, so
+// we pin `type` to its matching filters to simplify the typing.
+export type NodeVulnerabilityReportConfiguration = {
     type: 'NODE_VULNERABILITY';
-    vulnReportFilters: GenericVulnerabilityReportFilters;
-    resourceScope: {
-        entityScope: EntityScope;
-    };
-} & ReportConfigurationBase;
+} & ReportConfigurationBase &
+    NodeVulnerabilityReportFiltersConfiguration &
+    NodeVulnerabilityReportResourcesConfiguration;
+
+// Types of views and steps with only properties that they need to know:
+export type NodeVulnerabilityReportFiltersConfiguration = {
+    nodeVulnReportFilters: NodeVulnerabilityReportFilters;
+};
+
+export type NodeVulnerabilityReportResourcesConfiguration = {
+    resourceScope: NodeVulnerabilityReportResourceScope;
+};
+
+// Types of properties:
+export type NodeVulnerabilityReportFilters = {
+    allVuln: boolean;
+    query: string;
+};
+
+export type NodeVulnerabilityReportResourceScope = {
+    entityScope: EntityScope; // Cluster
+};
+
+// Draft of future configuration type.
+export type VirtualMachineVulnerabilityReportConfiguration = {
+    type: 'VIRTUAL_MACHINE_VULNERABILITY';
+} & ReportConfigurationBase &
+    VirtualMachineVulnerabilityReportFiltersConfiguration &
+    VirtualMachineVulnerabilityReportResourcesConfiguration;
+
+// Types of views and steps with only properties that they need to know:
+export type VirtualMachineVulnerabilityReportFiltersConfiguration = {
+    virtualMachineVulnReportFilters: VirtualMachineVulnerabilityReportFilters;
+};
+
+export type VirtualMachineVulnerabilityReportResourcesConfiguration = {
+    resourceScope: VirtualMachineVulnerabilityReportResourceScope;
+};
+
+// Types of properties:
+export type VirtualMachineVulnerabilityReportFilters = {
+    allVuln: boolean;
+    query: string;
+};
+
+export type VirtualMachineVulnerabilityReportResourceScope = {
+    entityScope: EntityScope; // Cluster and Namespace
+};
 
 // TODO temporary alias to limit changed files that might be superseded later anyway
 export type ReportConfiguration = ImageVulnerabilityReportConfiguration;
@@ -45,6 +91,48 @@ export type ImageVulnerabilityReportConfigurationForCollection = {
     };
 } & ReportConfigurationBase;
 
+// Types of views and steps with only properties that they need to know:
+export type ImageVulnerabilityReportResourcesConfiguration = {
+    resourceScope: ImageVulnerabilityReportResourceScope;
+    vulnReportFilters: {
+        imageTypes: ImageType[]; // more closely related to resources although in vulnReportFilters
+    };
+};
+
+export type ImageVulnerabilityReportResourceScope =
+    | {
+          collectionScope: CollectionScope;
+      }
+    | {
+          entityScope: EntityScope;
+      };
+
+// Types because Resources and Filters for view and wizard combine data properties.
+export type ImageVulnerabilityReportFiltersConfiguration = {
+    vulnReportFilters: ImageVulnerabilityReportFiltersWithoutCvesSince & CvesSince;
+};
+
+export type ImageVulnerabilityReportFiltersWithoutCvesSince =
+    | ImageVulnerabilityReportFiltersForEntityWithoutCvesSince
+    | ImageVulnerabilityReportFiltersForCollectionWithoutCvesSince;
+
+export type ImageVulnerabilityReportFiltersConfigurationForEntity = {
+    vulnReportFilters: ImageVulnerabilityReportFiltersForEntityWithoutCvesSince & CvesSince;
+};
+
+export type ImageVulnerabilityReportFiltersForEntityWithoutCvesSince = {
+    query: string;
+};
+
+export type ImageVulnerabilityReportFiltersConfigurationForCollection = {
+    vulnReportFilters: ImageVulnerabilityReportFiltersForCollectionWithoutCvesSince & CvesSince;
+};
+
+export type ImageVulnerabilityReportFiltersForCollectionWithoutCvesSince = {
+    fixability: Fixability;
+    severities: VulnerabilitySeverity[];
+};
+
 // Vulnerability report filters
 
 export type Fixability = 'BOTH' | 'FIXABLE' | 'NOT_FIXABLE';
@@ -74,10 +162,6 @@ export type CvesSince =
           sinceStartDate: string; // in the format of google.protobuf.Timestamp};
       };
 
-export type GenericVulnerabilityReportFilters = {
-    query: string;
-} & CvesSince;
-
 export type ViewBasedVulnerabilityReportFilters = {
     query: string;
 };
@@ -99,7 +183,7 @@ export type DaysOfMonth = {
 
 export type Interval = DaysOfWeek | DaysOfMonth;
 
-export type Schedule =
+export type ReportSchedule =
     | {
           intervalType: 'WEEKLY';
           hour: number;
@@ -111,6 +195,11 @@ export type Schedule =
           hour: number;
           minute: number;
           daysOfMonth: DaysOfMonth;
+      }
+    | {
+          intervalType: 'DAILY';
+          hour: number;
+          minute: number;
       };
 
 // Notification types
@@ -127,9 +216,13 @@ export type NotifierConfiguration = {
 
 // Resource scope types
 
-export type ResourceScope = {
-    collectionScope: CollectionScope;
-};
+export type ResourceScope =
+    | {
+          collectionScope: CollectionScope;
+      }
+    | {
+          entityScope: EntityScope;
+      };
 
 export type CollectionScope = {
     collectionId: string;
@@ -178,26 +271,36 @@ export type ReportHistoryResponse = {
 };
 
 export type ViewBasedReportSnapshot = Snapshot & {
+    type: 'VULNERABILITY';
     viewBasedVulnReportFilters: ViewBasedVulnerabilityReportFilters;
     areaOfConcern: string;
 };
 
-// TODO temporary disjunction until snamshot has type property.
+export type NodeViewBasedReportSnapshot = Snapshot & {
+    type: 'NODE_VULNERABILITY';
+    nodeVulnReportFilters: NodeVulnerabilityReportFilters;
+    areaOfConcern: string;
+};
+
 type VulnerabilityReportFilters =
-    | GenericVulnerabilityReportFilters
+    | NodeVulnerabilityReportFilters
     | ImageVulnerabilityReportFiltersForCollection
     | ImageVulnerabilityReportFiltersForEntity;
 
 // TODO distinguish configured versus view-based instead of combining them.
 export type ConfiguredReportSnapshot = Snapshot & {
+    type: ReportType;
     reportConfigId: string;
     vulnReportFilters: VulnerabilityReportFilters;
     collectionSnapshot: CollectionSnapshot;
-    schedule: Schedule | null;
+    schedule: ReportSchedule | null;
     notifiers: NotifierConfiguration[];
 };
 
-export type ReportSnapshot = ConfiguredReportSnapshot | ViewBasedReportSnapshot;
+export type ReportSnapshot =
+    | ConfiguredReportSnapshot
+    | ViewBasedReportSnapshot
+    | NodeViewBasedReportSnapshot;
 
 // Type guard functions
 
@@ -220,12 +323,22 @@ export type RunReportResponse = {
     reportId: string;
 };
 
-export type ReportRequestViewBased = {
-    type: ReportType;
+export type ImageReportRequestViewBased = {
+    type: 'VULNERABILITY';
     viewBasedVulnReportFilters: ViewBasedVulnerabilityReportFilters;
     areaOfConcern: string;
 };
 
+export type NodeReportRequestViewBased = {
+    type: 'NODE_VULNERABILITY';
+    // Although backend proto has NodeVulnerabilityReportFilters type,
+    // only query is relevant for view-based report.
+    nodeVulnReportFilters: ViewBasedVulnerabilityReportFilters;
+    areaOfConcern: string; // 'Nodes'
+};
+
+export type ReportRequestViewBased = ImageReportRequestViewBased | NodeReportRequestViewBased;
+
 export type RunReportResponseViewBased = {
     reportID: string;
     requestName: string;
diff --git a/ui/apps/platform/src/services/VirtualMachineService.ts b/ui/apps/platform/src/services/VirtualMachineService.ts
index 17b6f5b5c8563..44bcef607883f 100644
--- a/ui/apps/platform/src/services/VirtualMachineService.ts
+++ b/ui/apps/platform/src/services/VirtualMachineService.ts
@@ -1,8 +1,15 @@
+import qs from 'qs';
+
 import axios from 'services/instance';
 import type { VulnerabilitySeverity } from 'types/cve.proto';
 import type { ScanComponent, SourceType } from 'types/scanComponent.proto';
-import type { SearchQueryOptions } from 'types/search';
-import { applyRegexSearchModifiers, buildNestedRawQueryParams } from 'utils/searchUtils';
+import type { Advisory } from 'types/vulnerability.proto';
+import type { SearchFilter, SearchQueryOptions } from 'types/search';
+import {
+    applyRegexSearchModifiers,
+    buildNestedRawQueryParams,
+    getRequestQueryStringForSearchFilter,
+} from 'utils/searchUtils';
 
 // Legacy API (v2/virtualmachines)
 
@@ -136,6 +143,18 @@ export type ListVMCVEAffectedVMsResponse = {
     totalCount: number;
 };
 
+export type VMCVEComponentRow = {
+    componentName: string;
+    componentVersion: string;
+    source: SourceType;
+    fixedBy: string;
+    advisory: Advisory | null;
+};
+
+export type GetVMCVEComponentsResponse = {
+    components: VMCVEComponentRow[];
+};
+
 export type VMCVEByVMRow = {
     cve: string;
     severity: VulnerabilitySeverity;
@@ -147,7 +166,7 @@ export type VMCVEByVMRow = {
     publishedOn?: string;
     summary: string;
     link: string;
-    advisory?: { name: string; link: string };
+    advisory: Advisory | null;
 };
 
 export type ListVMCVEsByVMResponse = {
@@ -155,6 +174,12 @@ export type ListVMCVEsByVMResponse = {
     totalCount: number;
 };
 
+export type VMVulnSummary = {
+    severityCounts: VulnCountBySeverity;
+    fixableCount: number;
+    notFixableCount: number;
+};
+
 export type VMComponentScanStatus =
     | 'NOT_SCANNED'
     | 'SCAN_PENDING'
@@ -192,7 +217,7 @@ export type VMNote =
     | 'VM_NOTE_MISSING_SCANNER'
     | 'VM_NOTE_SCAN_FAILED';
 
-export type AgentStatus = 'AGENT_STATUS_UNKNOWN' | 'AGENT_STATUS_ACTIVE';
+export type AgentStatus = 'AGENT_STATUS_UNKNOWN' | 'AGENT_STATUS_ACTIVE' | 'AGENT_STATUS_INACTIVE';
 
 export type VMScanInfo = {
     scanId: string;
@@ -226,35 +251,95 @@ export function listVMs({
     perPage,
     searchFilter,
 }: SearchQueryOptions): Promise<ListVMsResponse> {
-    const params = buildNestedRawQueryParams({ page, perPage, sortOption, searchFilter });
+    const params = buildNestedRawQueryParams({
+        page,
+        perPage,
+        sortOption,
+        searchFilter: applyRegexSearchModifiers(searchFilter ?? {}),
+    });
     return axios
         .get<ListVMsResponse>(`/v2/virtualmachines/vms?${params}`)
         .then((response) => response.data);
 }
 
-export function listVMCVEs({ page, perPage }: SearchQueryOptions): Promise<ListVMCVEsResponse> {
-    const params = buildNestedRawQueryParams({ page, perPage });
+export function listVMCVEs({
+    searchFilter,
+    page,
+    perPage,
+    sortOption,
+}: SearchQueryOptions): Promise<ListVMCVEsResponse> {
+    const params = buildNestedRawQueryParams({
+        page,
+        perPage,
+        searchFilter: applyRegexSearchModifiers(searchFilter ?? {}),
+        sortOption,
+    });
     return axios
         .get<ListVMCVEsResponse>(`/v2/virtualmachines/cves?${params}`)
         .then((response) => response.data);
 }
 
-export function getVMCVEDetail(cveId: string): Promise<VMCVEDetail> {
+export function getVMCVEDetail(cveId: string, searchFilter: SearchFilter): Promise<VMCVEDetail> {
+    // Might consider updating buildNestedRawQueryParams to handle this case (no pagination).
+    const params = qs.stringify(
+        {
+            query: {
+                query: getRequestQueryStringForSearchFilter(
+                    applyRegexSearchModifiers(searchFilter)
+                ),
+            },
+        },
+        { arrayFormat: 'repeat', allowDots: true }
+    );
     return axios
-        .get<VMCVEDetail>(`/v2/virtualmachines/cves/${cveId}`)
+        .get<VMCVEDetail>(`/v2/virtualmachines/cves/${cveId}?${params}`)
         .then((response) => response.data);
 }
 
 export function listVMCVEAffectedVMs(
     cveId: string,
-    { sortOption, page, perPage }: SearchQueryOptions
+    { searchFilter, sortOption, page, perPage }: SearchQueryOptions
 ): Promise<ListVMCVEAffectedVMsResponse> {
-    const params = buildNestedRawQueryParams({ page, perPage, sortOption });
+    const params = buildNestedRawQueryParams({
+        page,
+        perPage,
+        sortOption,
+        searchFilter: applyRegexSearchModifiers(searchFilter ?? {}),
+    });
     return axios
         .get<ListVMCVEAffectedVMsResponse>(`/v2/virtualmachines/cves/${cveId}/vms?${params}`)
         .then((response) => response.data);
 }
 
+export function getVMCVEComponents(
+    vmId: string,
+    cveId: string
+): Promise<GetVMCVEComponentsResponse> {
+    return axios
+        .get<GetVMCVEComponentsResponse>(`/v2/virtualmachines/${vmId}/cves/${cveId}/components`)
+        .then((response) => response.data);
+}
+
+// Might consider updating buildNestedRawQueryParams to handle this case (no pagination).
+export function getVMVulnSummary(
+    virtualMachineId: string,
+    searchFilter: SearchFilter
+): Promise<VMVulnSummary> {
+    const params = qs.stringify(
+        {
+            query: {
+                query: getRequestQueryStringForSearchFilter(
+                    applyRegexSearchModifiers(searchFilter)
+                ),
+            },
+        },
+        { arrayFormat: 'repeat', allowDots: true }
+    );
+    return axios
+        .get<VMVulnSummary>(`/v2/virtualmachines/${virtualMachineId}/vuln-summary?${params}`)
+        .then((response) => response.data);
+}
+
 export function listVMCVEsByVM(
     vmId: string,
     { searchFilter, page, perPage, sortOption }: SearchQueryOptions
@@ -286,5 +371,5 @@ export function listVMComponents(
 }
 
 export function getVM(vmId: string): Promise<VMDetail> {
-    return axios.get<VMDetail>(`/v2/virtualmachines/vms/${vmId}`).then((response) => response.data);
+    return axios.get<VMDetail>(`/v2/virtualmachines/${vmId}`).then((response) => response.data);
 }
diff --git a/ui/apps/platform/src/services/imageService.ts b/ui/apps/platform/src/services/imageService.ts
index 0ecbb09e81b3e..b6df0353291a7 100644
--- a/ui/apps/platform/src/services/imageService.ts
+++ b/ui/apps/platform/src/services/imageService.ts
@@ -1,3 +1,5 @@
+import upperFirst from 'lodash/upperFirst';
+
 import type { ListImage, WatchedImage } from 'types/image.proto';
 
 import axios from './instance';
@@ -55,7 +57,10 @@ export function watchImage(name: string): Promise<string> {
         .then((response) => {
             const { normalizedName, errorType, errorMessage } = response.data;
             if (errorType !== 'NO_ERROR') {
-                throw new Error(errorMessage);
+                // Backend errors follow Go conventions (lower-case first letter); capitalize
+                // for display. upperFirst (not capitalize) preserves the rest of the message,
+                // e.g. the cluster name in "no connection to cluster ...".
+                throw new Error(upperFirst(errorMessage));
             }
 
             return normalizedName;
diff --git a/ui/apps/platform/src/setupProxy.js b/ui/apps/platform/src/setupProxy.js
index c6b399099ad75..3d73bde1e9f25 100644
--- a/ui/apps/platform/src/setupProxy.js
+++ b/ui/apps/platform/src/setupProxy.js
@@ -46,7 +46,11 @@ export function viteProxy() {
 
     const proxy = proxyWithTarget(process.env.UI_START_TARGET || 'https://localhost:8000');
 
+    // Custom proxies come first so their (often more specific, possibly regex)
+    // paths take precedence over the generic catch-alls below. Vite matches proxy
+    // contexts in insertion order, and treats keys beginning with `^` as RegExp.
     return {
+        ...customProxies,
         '/v1': proxy,
         '/v2': proxy,
         '/api': proxy,
diff --git a/ui/apps/platform/src/types/cve.proto.ts b/ui/apps/platform/src/types/cve.proto.ts
index e8778f7cd608e..2d808b8feaaba 100644
--- a/ui/apps/platform/src/types/cve.proto.ts
+++ b/ui/apps/platform/src/types/cve.proto.ts
@@ -35,7 +35,7 @@ export type EPSS = {
 export type Exploit = {
     // This must always be set to true.
     // This field solely exists for search purposes.
-    // exists: boolean; // search:"Known Exploit,store"
+    // exists: boolean; // search:"CISA KEV,store"
     knownRansomwareCampaignUse: boolean; // search:"Known Ransomware Campaign,store"
 };
 
diff --git a/ui/apps/platform/src/types/featureFlag.ts b/ui/apps/platform/src/types/featureFlag.ts
index 5993d5156364c..5e8ac920c9a48 100644
--- a/ui/apps/platform/src/types/featureFlag.ts
+++ b/ui/apps/platform/src/types/featureFlag.ts
@@ -2,21 +2,16 @@
 // However, add strings in alphabetical order to minimize merge conflicts when multiple people add or delete strings.
 // prettier-ignore
 export type FeatureFlagEnvVar =
-    | 'ROX_BASE_IMAGE_DETECTION'
-    | 'ROX_CISA_KEV'
-    | 'ROX_CVE_FIX_TIMESTAMP'
-    | 'ROX_DEPRECATED_COMPLIANCE_DASHBOARD'
+    | 'ROX_COMPLIANCE_CUSTOM_NODE_ROLES'
+    | 'ROX_COMPLIANCE_SURFACE_STALE_DATA'
     | 'ROX_EVALUATION_FILTER'
-    | 'ROX_FLATTEN_IMAGE_DATA'
     | 'ROX_INIT_CONTAINER_SUPPORT'
     | 'ROX_LABEL_BASED_POLICY_SCOPING'
     | 'ROX_LEGACY_SCANNER'
+    | 'ROX_LIGHTSPEED_RISK_SUMMARY'
     | 'ROX_NODE_INDEX_ENABLED'
-    | 'ROX_NODE_VULNERABILITY_REPORTS'
-    | 'ROX_POLICY_CRITERIA_MODAL'
     | 'ROX_SCANNER_V4'
     | 'ROX_SENSITIVE_FILE_ACTIVITY'
-    | 'ROX_SENSOR_COMPATIBILITY_STATUS'
     | 'ROX_UI_SECRETS_PAGE_MIGRATION'
     | 'ROX_VIRTUAL_MACHINES'
     | 'ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL'
diff --git a/ui/apps/platform/src/types/policy.proto.ts b/ui/apps/platform/src/types/policy.proto.ts
index df7f4ea7f8dfe..4d5d16350adb6 100644
--- a/ui/apps/platform/src/types/policy.proto.ts
+++ b/ui/apps/platform/src/types/policy.proto.ts
@@ -159,7 +159,7 @@ export type PolicyMitreAttackVector = {
     techniques: string[]; // technique ids
 };
 
-export type ContainerType = 'INIT';
+export type ContainerType = 'REGULAR' | 'INIT';
 
 export type SkipImageLayers = 'SKIP_NONE' | 'SKIP_BASE' | 'SKIP_APP';
 
diff --git a/ui/apps/platform/src/types/searchOptions.ts b/ui/apps/platform/src/types/searchOptions.ts
index 5cc6854495401..e2db4acb81016 100644
--- a/ui/apps/platform/src/types/searchOptions.ts
+++ b/ui/apps/platform/src/types/searchOptions.ts
@@ -37,6 +37,7 @@ export const searchFieldLabels = [
     'CVE Published On',
     'CVE Fix Available Timestamp',
     'CVE Created Time',
+    'CVE Origin',
     'CVE Snoozed',
     'CVE Snooze Expiry',
     'CVSS',
@@ -46,8 +47,8 @@ export const searchFieldLabels = [
     'CVE Orphaned',
     'CVE Orphaned Time',
     'EPSS Probability',
-    'Known Exploit', // frontend only pending backend implementation see obsolete #16887
-    'Known Ransomware Campaign', // frontend only pending backend implementation see obsolete #16887
+    'CISA KEV',
+    'Known Ransomware Campaign',
     'Advisory Name',
     'Advisory Link',
     //
@@ -422,8 +423,10 @@ export const searchFieldLabels = [
     'AuthProvider Name',
     //
     // Virtual Machine fields.
+    'Guest OS',
     'Virtual Machine ID',
     'Virtual Machine Name',
+    'Virtual Machine Scan Time',
     'Scan Status', // frontend only pending backend
 ] as const;
 
diff --git a/ui/apps/platform/src/utils/URLParseGenerate.test.js b/ui/apps/platform/src/utils/URLParseGenerate.test.js
index 7e08acec2b2fd..75dba6a93ee97 100644
--- a/ui/apps/platform/src/utils/URLParseGenerate.test.js
+++ b/ui/apps/platform/src/utils/URLParseGenerate.test.js
@@ -5,10 +5,6 @@ import useCases from 'constants/useCaseTypes';
 import { pagingParams, searchParams, sortParams } from 'constants/searchParams';
 import { urlEntityListTypes, urlEntityTypes } from '../routePaths';
 import parseURL from './URLParser';
-import generateURL from './URLGenerator';
-
-import WorkflowEntity from './WorkflowEntity';
-import { WorkflowState } from './WorkflowState';
 
 function getLocation(search, pathname) {
     return {
@@ -30,11 +26,6 @@ const searchParamValues = {
     },
 };
 
-const emptySearchParamValues = {
-    [searchParams.page]: '',
-    [searchParams.sidePanel]: '',
-};
-
 const sortParamValues = {
     [sortParams.page]: [{ id: 'name1', desc: true }],
     [sortParams.sidePanel]: [{ id: 'name2', desc: false }],
@@ -158,106 +149,3 @@ describe('ParseURL', () => {
         expect(workflowState.paging).toEqual({ p: 0, p2: 0 });
     });
 });
-
-describe('GenerateURL', () => {
-    it('generates a url with no search params when the search param objects are empty', () => {
-        const workflowState = new WorkflowState(
-            useCases.COMPLIANCE,
-            [
-                new WorkflowEntity(entityTypes.NAMESPACE),
-                new WorkflowEntity(entityTypes.NAMESPACE, 'nsId'),
-                new WorkflowEntity(entityTypes.DEPLOYMENT),
-            ],
-            emptySearchParamValues,
-            sortParamValues,
-            pagingParamValues
-        );
-
-        const url = generateURL(workflowState);
-        expect(url).toBe(
-            '/main/compliance/namespaces?workflowState[0][t]=NAMESPACE&workflowState[0][i]=nsId&workflowState[1][t]=DEPLOYMENT&sort[0][id]=name1&sort[0][desc]=true&sort2[0][id]=name2&sort2[0][desc]=false&p=1&p2=2'
-        );
-    });
-    it('generates a list url from workflowState', () => {
-        const workflowState = new WorkflowState(
-            useCases.COMPLIANCE,
-            [
-                new WorkflowEntity(entityTypes.NAMESPACE),
-                new WorkflowEntity(entityTypes.NAMESPACE, 'nsId'),
-                new WorkflowEntity(entityTypes.DEPLOYMENT),
-            ],
-            searchParamValues,
-            sortParamValues,
-            pagingParamValues
-        );
-
-        const url = generateURL(workflowState);
-        expect(url).toBe(
-            '/main/compliance/namespaces?workflowState[0][t]=NAMESPACE&workflowState[0][i]=nsId&workflowState[1][t]=DEPLOYMENT&s[sk1]=v1&s[sk2]=v2&s2[sk3]=v3&s2[sk4]=v4&sort[0][id]=name1&sort[0][desc]=true&sort2[0][id]=name2&sort2[0][desc]=false&p=1&p2=2'
-        );
-    });
-
-    it('generates a list url with sidepanel from workflowState', () => {
-        const workflowState = new WorkflowState(
-            useCases.COMPLIANCE,
-            [
-                new WorkflowEntity(entityTypes.NAMESPACE),
-                new WorkflowEntity(entityTypes.NAMESPACE, 'nsId'),
-                new WorkflowEntity(entityTypes.DEPLOYMENT),
-                new WorkflowEntity(entityTypes.DEPLOYMENT, 'depId'),
-            ],
-            searchParamValues,
-            sortParamValues,
-            pagingParamValues
-        );
-
-        const url = generateURL(workflowState);
-        expect(url).toBe(
-            '/main/compliance/namespaces?workflowState[0][t]=NAMESPACE&workflowState[0][i]=nsId&workflowState[1][t]=DEPLOYMENT&workflowState[2][t]=DEPLOYMENT&workflowState[2][i]=depId&s[sk1]=v1&s[sk2]=v2&s2[sk3]=v3&s2[sk4]=v4&sort[0][id]=name1&sort[0][desc]=true&sort2[0][id]=name2&sort2[0][desc]=false&p=1&p2=2'
-        );
-    });
-
-    it('generates an entity url from workflowState', () => {
-        const workflowState = new WorkflowState(
-            useCases.COMPLIANCE,
-            [
-                new WorkflowEntity(entityTypes.NAMESPACE, 'nsId'),
-                new WorkflowEntity(entityTypes.DEPLOYMENT),
-            ],
-            searchParamValues,
-            sortParamValues,
-            pagingParamValues
-        );
-
-        const url = generateURL(workflowState);
-        expect(url).toBe(
-            '/main/compliance/namespace/nsId/deployments?s[sk1]=v1&s[sk2]=v2&s2[sk3]=v3&s2[sk4]=v4&sort[0][id]=name1&sort[0][desc]=true&sort2[0][id]=name2&sort2[0][desc]=false&p=1&p2=2'
-        );
-    });
-
-    it('generates an entity url with side panel from workflowState', () => {
-        const workflowState = new WorkflowState(
-            useCases.COMPLIANCE,
-            [
-                new WorkflowEntity(entityTypes.NAMESPACE, 'nsId'),
-                new WorkflowEntity(entityTypes.DEPLOYMENT),
-                new WorkflowEntity(entityTypes.DEPLOYMENT, 'depId'),
-            ],
-            searchParamValues,
-            sortParamValues,
-            pagingParamValues
-        );
-
-        const url = generateURL(workflowState);
-        expect(url).toBe(
-            '/main/compliance/namespace/nsId/deployments?workflowState[0][t]=DEPLOYMENT&workflowState[0][i]=depId&s[sk1]=v1&s[sk2]=v2&s2[sk3]=v3&s2[sk4]=v4&sort[0][id]=name1&sort[0][desc]=true&sort2[0][id]=name2&sort2[0][desc]=false&p=1&p2=2'
-        );
-    });
-
-    it('generates a dashboard url from workflowState', () => {
-        const workflowState = new WorkflowState(useCases.COMPLIANCE, []);
-
-        const url = generateURL(workflowState);
-        expect(url).toBe('/main/compliance');
-    });
-});
diff --git a/ui/apps/platform/src/utils/URLService.test.js b/ui/apps/platform/src/utils/URLService.test.js
index a5ecbd4a94398..4d12a3f7f8791 100644
--- a/ui/apps/platform/src/utils/URLService.test.js
+++ b/ui/apps/platform/src/utils/URLService.test.js
@@ -458,25 +458,6 @@ it('overflows all paths', () => {
     });
 });
 
-it('overflows a parent entity', () => {
-    const match = getMatch({
-        context: baseContext,
-        pageEntityType: urlEntityTypes.NODE,
-        pageEntityId: 'pageEntityId',
-        entityListType1: urlEntityListTypes.CONTROL,
-        entityId1: 'entityId1',
-        entityType2: urlEntityTypes.NODE,
-        entityId2: 'nodeId2',
-    });
-    const url = URLService.getURL(match);
-    url.push(entityTypes.CLUSTER, 'clusterId');
-    expect(url.urlParams).toEqual({
-        context: useCases.CONFIG_MANAGEMENT,
-        pageEntityType: entityTypes.CLUSTER,
-        pageEntityId: 'clusterId',
-    });
-});
-
 it('should properly encode entity ids with special characters', () => {
     const match = getMatch({
         context: baseContext,
diff --git a/ui/apps/platform/src/utils/__snapshots__/entityRelationships.test.js.snap b/ui/apps/platform/src/utils/__snapshots__/entityRelationships.test.js.snap
index 9f32fefed0c59..0e1199be38e10 100644
--- a/ui/apps/platform/src/utils/__snapshots__/entityRelationships.test.js.snap
+++ b/ui/apps/platform/src/utils/__snapshots__/entityRelationships.test.js.snap
@@ -5,11 +5,11 @@ exports[`entityRelationshipMap > has properties and derived properties 1`] = `
   "CLUSTER": {
     "1-children": "NAMESPACE NODE ROLE",
     "2-parents": "",
-    "3-matches        ": "CLUSTER_CVE CONTROL",
+    "3-matches        ": "CLUSTER_CVE",
     "4-extendedMatches": "",
-    "5-getMatches     ": "CLUSTER_CVE CONTROL",
-    "6-getContains        ": "CONTROL DEPLOYMENT IMAGE IMAGE_COMPONENT IMAGE_CVE NAMESPACE NODE NODE_COMPONENT NODE_CVE POLICY ROLE SECRET SERVICE_ACCOUNT SUBJECT",
-    "7-isContainedInferred": "CONTROL DEPLOYMENT IMAGE IMAGE_COMPONENT IMAGE_CVE NODE_COMPONENT NODE_CVE POLICY SECRET SERVICE_ACCOUNT SUBJECT",
+    "5-getMatches     ": "CLUSTER_CVE",
+    "6-getContains        ": "DEPLOYMENT IMAGE IMAGE_COMPONENT IMAGE_CVE NAMESPACE NODE NODE_COMPONENT NODE_CVE POLICY ROLE SECRET SERVICE_ACCOUNT SUBJECT",
+    "7-isContainedInferred": "DEPLOYMENT IMAGE IMAGE_COMPONENT IMAGE_CVE NODE_COMPONENT NODE_CVE POLICY SECRET SERVICE_ACCOUNT SUBJECT",
   },
   "CLUSTER_CVE": {
     "1-children": "",
@@ -20,21 +20,12 @@ exports[`entityRelationshipMap > has properties and derived properties 1`] = `
     "6-getContains        ": "",
     "7-isContainedInferred": "",
   },
-  "CONTROL": {
-    "1-children": "",
-    "2-parents": "",
-    "3-matches        ": "CLUSTER DEPLOYMENT NODE",
-    "4-extendedMatches": "",
-    "5-getMatches     ": "CLUSTER DEPLOYMENT NODE",
-    "6-getContains        ": "",
-    "7-isContainedInferred": "",
-  },
   "DEPLOYMENT": {
     "1-children": "IMAGE",
     "2-parents": "CLUSTER NAMESPACE",
-    "3-matches        ": "CONTROL POLICY SECRET SERVICE_ACCOUNT",
+    "3-matches        ": "POLICY SECRET SERVICE_ACCOUNT",
     "4-extendedMatches": "",
-    "5-getMatches     ": "CONTROL POLICY SECRET SERVICE_ACCOUNT",
+    "5-getMatches     ": "POLICY SECRET SERVICE_ACCOUNT",
     "6-getContains        ": "IMAGE IMAGE_COMPONENT IMAGE_CVE",
     "7-isContainedInferred": "IMAGE_COMPONENT IMAGE_CVE",
   },
@@ -71,15 +62,15 @@ exports[`entityRelationshipMap > has properties and derived properties 1`] = `
     "3-matches        ": "",
     "4-extendedMatches": "",
     "5-getMatches     ": "",
-    "6-getContains        ": "CONTROL DEPLOYMENT IMAGE IMAGE_COMPONENT IMAGE_CVE POLICY ROLE SECRET SERVICE_ACCOUNT",
-    "7-isContainedInferred": "CONTROL IMAGE IMAGE_COMPONENT IMAGE_CVE POLICY ROLE",
+    "6-getContains        ": "DEPLOYMENT IMAGE IMAGE_COMPONENT IMAGE_CVE POLICY ROLE SECRET SERVICE_ACCOUNT",
+    "7-isContainedInferred": "IMAGE IMAGE_COMPONENT IMAGE_CVE POLICY ROLE",
   },
   "NODE": {
     "1-children": "NODE_COMPONENT",
     "2-parents": "CLUSTER",
-    "3-matches        ": "CONTROL",
+    "3-matches        ": "",
     "4-extendedMatches": "",
-    "5-getMatches     ": "CONTROL",
+    "5-getMatches     ": "",
     "6-getContains        ": "NODE_COMPONENT NODE_CVE",
     "7-isContainedInferred": "NODE_CVE",
   },
diff --git a/ui/apps/platform/src/utils/entityRelationships.test.js b/ui/apps/platform/src/utils/entityRelationships.test.js
index d8fa6a9fa4c14..2d5e465d291ad 100644
--- a/ui/apps/platform/src/utils/entityRelationships.test.js
+++ b/ui/apps/platform/src/utils/entityRelationships.test.js
@@ -81,11 +81,6 @@ describe('entityRelationshipMap', () => {
     });
 });
 
-it('gets Matches relationships for Cluster', () => {
-    const matchesForCluster = getEntityTypesByRelationship('CLUSTER', 'MATCHES');
-    expect(matchesForCluster).not.toContain('CONTROL');
-});
-
 it('gets Matches relationships for Image CVE', () => {
     // should also get extended matches
     const matchesForImageCVE = getEntityTypesByRelationship('IMAGE_CVE', 'MATCHES');
@@ -112,8 +107,6 @@ it('gets Contains relationships for Cluster', () => {
     expect(containsForCluster).not.toContain('SERVICE_ACCOUNT');
     // should have grandchild
     expect(containsForCluster).toContain('DEPLOYMENT');
-    // should have grandchild's matches
-    expect(containsForCluster).not.toContain('CONTROL');
 });
 
 it('gets Contains relationships for Image', () => {
diff --git a/ui/apps/platform/src/utils/entityRelationships.ts b/ui/apps/platform/src/utils/entityRelationships.ts
index ac76512e9ffea..69f9061ba493a 100644
--- a/ui/apps/platform/src/utils/entityRelationships.ts
+++ b/ui/apps/platform/src/utils/entityRelationships.ts
@@ -6,13 +6,7 @@
 import type { RelationshipType } from 'constants/relationshipTypes';
 import type { IsFeatureFlagEnabled } from 'hooks/useFeatureFlags';
 
-/*
-// For historical interest: never used.
-const complianceEntityTypes = ['CONTROL', 'NODE', 'CLUSTER', 'NAMESPACE', 'DEPLOYMENT'];
-*/
-
 const configurationManagementEntityTypes = [
-    'CONTROL',
     'NODE',
     'IMAGE',
     'ROLE',
@@ -65,14 +59,10 @@ export function getVulnerabilityManagementEntityTypes(
     isFeatureFlagEnabled?: IsFeatureFlagEnabled
 ): VulnerabilityManagementEntityType[] {
     if (isFeatureFlagEnabled) {
-        // Arrays include all possible entity types for use case.
-        return vulnerabilityManagementEntityTypes.filter((/* entityType */) => {
-            /*
-            // Pattern to filter out an entity type if a feature flag is not enabled.
-            if (entityType === 'WHICHEVER' && !isFeatureFlagEnabled(ROX_WHATEVER)) {
+        return vulnerabilityManagementEntityTypes.filter((entityType) => {
+            if (entityType === 'CLUSTER_CVE' && !isFeatureFlagEnabled('ROX_LEGACY_SCANNER')) {
                 return false;
-            } 
-            */
+            }
             return true;
         });
     }
@@ -112,7 +102,6 @@ export const entityGroupMap: Record<EntityType, EntityGroup> = {
     IMAGE_COMPONENT: 'APPLICATION_RESOURCES',
 
     POLICY: 'SECURITY',
-    CONTROL: 'SECURITY',
     NODE_CVE: 'SECURITY',
     IMAGE_CVE: 'SECURITY',
     CLUSTER_CVE: 'SECURITY',
@@ -130,13 +119,13 @@ const entityRelationshipMap: Record<EntityType, EntityRelationshipData> = {
     CLUSTER: {
         children: ['NODE', 'NAMESPACE', 'ROLE'],
         parents: [],
-        matches: ['CONTROL', 'CLUSTER_CVE'],
+        matches: ['CLUSTER_CVE'],
         // extendedMatches: [entityTypes.POLICY]
     },
     NODE: {
         children: ['NODE_COMPONENT'],
         parents: ['CLUSTER'],
-        matches: ['CONTROL'],
+        matches: [],
     },
     NAMESPACE: {
         children: ['DEPLOYMENT', 'SERVICE_ACCOUNT', 'SECRET'],
@@ -147,7 +136,7 @@ const entityRelationshipMap: Record<EntityType, EntityRelationshipData> = {
     DEPLOYMENT: {
         children: ['IMAGE'],
         parents: ['NAMESPACE', 'CLUSTER'],
-        matches: ['SERVICE_ACCOUNT', 'POLICY', 'CONTROL', 'SECRET'],
+        matches: ['SERVICE_ACCOUNT', 'POLICY', 'SECRET'],
     },
     IMAGE: {
         children: ['IMAGE_COMPONENT'],
@@ -184,11 +173,6 @@ const entityRelationshipMap: Record<EntityType, EntityRelationshipData> = {
         matches: [],
         extendedMatches: ['CLUSTER'],
     },
-    CONTROL: {
-        children: [],
-        parents: [],
-        matches: ['NODE', 'DEPLOYMENT', 'CLUSTER'],
-    },
     POLICY: {
         children: [],
         parents: [],
diff --git a/ui/apps/platform/src/utils/getEntityName.js b/ui/apps/platform/src/utils/getEntityName.js
index 87f4ff249beba..b1ed66ee50ee2 100644
--- a/ui/apps/platform/src/utils/getEntityName.js
+++ b/ui/apps/platform/src/utils/getEntityName.js
@@ -31,12 +31,6 @@ const entityNameKeyMap = {
         return result;
     },
     [entityTypes.NODE]: (data) => resolvePath(data, 'node.name'),
-    [entityTypes.CONTROL]: (data) => {
-        if (!data.control) {
-            return null;
-        }
-        return `${data.control.name} - ${data.control.description}`;
-    },
     [entityTypes.IMAGE]: (data) => resolvePath(data, 'image.name.fullName'),
     [entityTypes.POLICY]: (data) => resolvePath(data, 'policy.name'),
     [entityTypes.SUBJECT]: (data) => resolvePath(data, 'subject.name'),
diff --git a/ui/apps/platform/src/utils/getEntityName.test.js b/ui/apps/platform/src/utils/getEntityName.test.js
index 2fe98ec2c5cff..fa4176461945b 100644
--- a/ui/apps/platform/src/utils/getEntityName.test.js
+++ b/ui/apps/platform/src/utils/getEntityName.test.js
@@ -67,24 +67,6 @@ describe('getEntityName', () => {
         expect(entityName).toEqual('system:kube-dns');
     });
 
-    it('handles combined data for a CONTROL entity', () => {
-        const entityType = entityTypes.CONTROL;
-        const data = {
-            control: {
-                id: 'CIS_Docker_v1_2_0:1_2_1',
-                name: '1.2.1',
-                description: 'Ensure a separate partition for containers has been created',
-                __typename: 'ComplianceControl',
-            },
-        };
-
-        const entityName = getEntityName(entityType, data);
-
-        expect(entityName).toEqual(
-            '1.2.1 - Ensure a separate partition for containers has been created'
-        );
-    });
-
     it('handles nested data for a SUBJECT entity', () => {
         const entityType = entityTypes.SUBJECT;
         const data = {
diff --git a/ui/apps/platform/src/utils/queryMap.js b/ui/apps/platform/src/utils/queryMap.js
index 3dd561eea869d..5f4bdca54cf04 100644
--- a/ui/apps/platform/src/utils/queryMap.js
+++ b/ui/apps/platform/src/utils/queryMap.js
@@ -7,7 +7,6 @@ import { CLUSTER_NAME } from 'queries/cluster';
 import { CLUSTER_CVE_NAME, CVE_NAME, IMAGE_CVE_NAME, NODE_CVE_NAME } from 'queries/cve';
 import { NAMESPACE_NAME } from 'queries/namespace';
 import { POLICY_NAME } from 'queries/policy';
-import { CONTROL_NAME } from 'queries/controls';
 import { IMAGE_NAME } from 'queries/image';
 import { NODE_NAME } from 'queries/node';
 import { SUBJECT_NAME } from 'queries/subject';
@@ -26,7 +25,6 @@ export const entityNameQueryMap = {
     [entityTypes.NAMESPACE]: NAMESPACE_NAME,
     [entityTypes.ROLE]: ROLE_NAME,
     [entityTypes.NODE]: NODE_NAME,
-    [entityTypes.CONTROL]: CONTROL_NAME,
     [entityTypes.IMAGE]: IMAGE_NAME,
     [entityTypes.POLICY]: POLICY_NAME,
     [entityTypes.SUBJECT]: SUBJECT_NAME,
diff --git a/ui/apps/platform/src/utils/queryService.js b/ui/apps/platform/src/utils/queryService.js
index 3d93aa2c93600..948bff6ae0583 100644
--- a/ui/apps/platform/src/utils/queryService.js
+++ b/ui/apps/platform/src/utils/queryService.js
@@ -9,7 +9,6 @@ import { SUBJECT_FRAGMENT, SUBJECT_WITH_CLUSTER_FRAGMENT } from 'queries/subject
 import { K8S_ROLE_FRAGMENT } from 'queries/role';
 import { SECRET_FRAGMENT } from 'queries/secret';
 import { SERVICE_ACCOUNT_FRAGMENT } from 'queries/serviceAccount';
-import { CONTROL_FRAGMENT } from 'queries/controls';
 import { POLICY_FRAGMENT } from 'queries/policy';
 import { IMAGE_FRAGMENT } from 'queries/image';
 import {
@@ -144,9 +143,6 @@ function getListFieldName(entityType, listType, useCase) {
         if (listType === entityTypes.ROLE) {
             return 'k8sRoles';
         }
-        if (listType === entityTypes.CONTROL) {
-            return 'complianceResults';
-        }
     }
 
     if (entityType === entityTypes.NODE) {
@@ -218,8 +214,6 @@ function getFragmentName(listType) {
             return 'policyFields';
         case entityTypes.SERVICE_ACCOUNT:
             return 'serviceAccountFields';
-        case entityTypes.CONTROL:
-            return 'controlFields';
         case entityTypes.IMAGE_CVE:
             return 'imageCVEFields';
         case entityTypes.NODE_CVE:
@@ -246,7 +240,6 @@ function getFragment(entityType, listType, useCase) {
         [entityTypes.SECRET]: SECRET_FRAGMENT,
         [entityTypes.POLICY]: POLICY_FRAGMENT,
         [entityTypes.SERVICE_ACCOUNT]: SERVICE_ACCOUNT_FRAGMENT,
-        [entityTypes.CONTROL]: CONTROL_FRAGMENT,
     };
 
     const fragmentsByUseCase = {
diff --git a/ui/apps/platform/src/utils/responseErrorUtils.test.ts b/ui/apps/platform/src/utils/responseErrorUtils.test.ts
new file mode 100644
index 0000000000000..872a982ec27f9
--- /dev/null
+++ b/ui/apps/platform/src/utils/responseErrorUtils.test.ts
@@ -0,0 +1,35 @@
+import { getAxiosErrorMessage } from './responseErrorUtils';
+
+describe('responseErrorUtils', () => {
+    describe('getAxiosErrorMessage', () => {
+        it('preserves a plain error message including its original casing', () => {
+            const error = new Error('no connection to cluster "Prod-East" (OCP)');
+
+            expect(getAxiosErrorMessage(error)).toBe('no connection to cluster "Prod-East" (OCP)');
+        });
+
+        it('preserves a backend message returned in the axios response body', () => {
+            const error = Object.assign(new Error('Request failed'), {
+                response: {
+                    data: { message: 'cluster "Prod-East" does not support delegated scanning' },
+                },
+            });
+
+            expect(getAxiosErrorMessage(error)).toBe(
+                'cluster "Prod-East" does not support delegated scanning'
+            );
+        });
+
+        it('preserves a message beginning with a lower-case acronym', () => {
+            const error = new Error('gRPC connection to Cluster "Prod-East" failed');
+
+            expect(getAxiosErrorMessage(error)).toBe(
+                'gRPC connection to Cluster "Prod-East" failed'
+            );
+        });
+
+        it('returns a fallback for non-error input', () => {
+            expect(getAxiosErrorMessage(undefined)).toBe('Unknown error');
+        });
+    });
+});
diff --git a/ui/apps/platform/src/utils/responseErrorUtils.ts b/ui/apps/platform/src/utils/responseErrorUtils.ts
index a22ed9b8a5532..6d35f21cea826 100644
--- a/ui/apps/platform/src/utils/responseErrorUtils.ts
+++ b/ui/apps/platform/src/utils/responseErrorUtils.ts
@@ -21,7 +21,7 @@ const commonStatusCodeNameMap = {
 
 /*
  * Given argument of promise-catch method or try-catch block for an axios call,
- * return error message.
+ * return error message without changing backend wording or casing.
  */
 export function getAxiosErrorMessage(error: unknown): string {
     // See https://axios-http.com/docs/handling_errors
diff --git a/ui/apps/platform/src/utils/searchUtils.ts b/ui/apps/platform/src/utils/searchUtils.ts
index 82f329ca838de..9be99fdd3d567 100644
--- a/ui/apps/platform/src/utils/searchUtils.ts
+++ b/ui/apps/platform/src/utils/searchUtils.ts
@@ -26,6 +26,7 @@ import {
 } from 'Components/CompoundSearchFilter/attributes/cluster';
 import { policyAttributes } from 'Components/CompoundSearchFilter/attributes/policy';
 import { profileName } from 'Components/CompoundSearchFilter/attributes/profile';
+import { virtualMachineAttributes } from 'Components/CompoundSearchFilter/attributes/virtualMachine';
 
 import type { NonEmptyArray, ValueOf } from './type.utils';
 import { safeGeneratePath } from './urlUtils';
@@ -220,16 +221,11 @@ export function flattenFilterValue<UndefinedFallback>(
  * @param options.perPage The number of items per page
  */
 export function getListQueryParams({
-    searchFilter,
+    searchFilter = {},
     sortOption,
     page,
     perPage,
-}: {
-    searchFilter: SearchFilter;
-    sortOption: ApiSortOption;
-    page: number;
-    perPage: number;
-}): string {
+}: SearchQueryOptions): string {
     const query = getRequestQueryStringForSearchFilter(searchFilter);
     return qs.stringify(
         {
@@ -454,6 +450,7 @@ const regexSearchOptions = [
     clusterTypeAttribute,
     policyAttributes,
     profileName,
+    virtualMachineAttributes,
 ]
     .flat()
     .filter(({ inputType }) => inputType === 'text' || inputType === 'autocomplete')